Merge webkit.org at r51976 : Initial merge by git.

Change-Id: Ib0e7e2f0fb4bee5a186610272edf3186f0986b43

2198 files changed, 135834 insertions, 29116 deletions

diff --git a/Android.mk b/Android.mk
index 2918e30..d56c5a6 100644
--- a/Android.mk
+++ b/Android.mk
@@ -82,6 +82,7 @@ include $(LOCAL_PATH)/Android.jscbindings.mk
 endif
 ifeq ($(JAVASCRIPT_ENGINE),v8)
 include $(LOCAL_PATH)/Android.v8bindings.mk
+<<<<<<< HEAD:Android.mk
 # TODO: We should use the WebCore JNI code instead.
 JNI_PATH := V8Binding/jni
 # bridge/jni path must be listed after V8Bindings, so files are preferentially
@@ -96,6 +97,8 @@ JNI_SRC_FILES := \
 	jni_npobject.cpp \
 	jni_runtime.cpp
 WEBKIT_SRC_FILES += $(addprefix $(JNI_PATH)/,$(JNI_SRC_FILES))
+=======
+>>>>>>> webkit.org at r51976:Android.mk
 endif
 WEBKIT_SRC_FILES += $(addprefix $d/,$(LOCAL_SRC_FILES))
 LOCAL_C_INCLUDES := $(BINDING_C_INCLUDES)
@@ -110,6 +113,7 @@ ifeq ($(JAVASCRIPT_ENGINE),v8)
 include $(LOCAL_PATH)/Android.derived.v8bindings.mk
 endif
 
+<<<<<<< HEAD:Android.mk
 # Include source files for android WebKit port
 d := WebKit
 LOCAL_PATH := $(BASE_PATH)/$d
@@ -117,6 +121,8 @@ intermediates := $(base_intermediates)/$d
 include $(LOCAL_PATH)/Android.mk
 WEBKIT_SRC_FILES += $(addprefix $d/,$(LOCAL_SRC_FILES))
 
+=======
+>>>>>>> webkit.org at r51976:Android.mk
 # Redefine LOCAL_PATH here so the build system is not confused
 LOCAL_PATH := $(BASE_PATH)
 
@@ -128,8 +134,11 @@ LOCAL_CFLAGS += -fvisibility=hidden
 
 ifeq ($(TARGET_ARCH),arm)
 LOCAL_CFLAGS += -Darm
+<<<<<<< HEAD:Android.mk
 # remove this warning: "note: the mangling of 'va_list' has changed in GCC 4.4"
 LOCAL_CFLAGS += -Wno-psabi
+=======
+>>>>>>> webkit.org at r51976:Android.mk
 endif
 
 ifeq ($(ENABLE_SVG),true)
@@ -330,6 +339,7 @@ LOCAL_LDFLAGS := -fvisibility=hidden
 LOCAL_CFLAGS := $(WEBKIT_CFLAGS)
 LOCAL_C_INCLUDES := $(WEBKIT_C_INCLUDES)
 LOCAL_PATH := $(BASE_PATH)
+<<<<<<< HEAD:Android.mk
 LOCAL_SRC_FILES := \
 	WebKit/android/jni/WebCoreJniOnLoad.cpp
 # Do this dependency by hand. The reason we have to do this is because the
@@ -337,7 +347,10 @@ LOCAL_SRC_FILES := \
 # We make all of our object files depend on those files so that they are built
 # before we try to compile the file.
 LOCAL_ADDITIONAL_DEPENDENCIES := $(filter %.h, $(WEBKIT_GENERATED_SOURCES))
+=======
+>>>>>>> webkit.org at r51976:Android.mk
 include $(BUILD_SHARED_LIBRARY)
+<<<<<<< HEAD:Android.mk
 
 # Build the wds client
 include $(BASE_PATH)/WebKit/android/wds/client/Android.mk
@@ -347,3 +360,5 @@ include $(BASE_PATH)/WebKit/android/benchmark/Android.mk
 
 # Build the webkit merge tool.
 include $(BASE_PATH)/WebKitTools/android/webkitmerge/Android.mk
+=======
+>>>>>>> webkit.org at r51976:Android.mk
diff --git a/JavaScriptCore/API/APICast.h b/JavaScriptCore/API/APICast.h
index b9167a8..4284c44 100644
--- a/JavaScriptCore/API/APICast.h
+++ b/JavaScriptCore/API/APICast.h
@@ -51,16 +51,20 @@ typedef struct OpaqueJSValue* JSObjectRef;
 
 inline JSC::ExecState* toJS(JSContextRef c)
 {
+    ASSERT(c);
     return reinterpret_cast<JSC::ExecState*>(const_cast<OpaqueJSContext*>(c));
 }
 
 inline JSC::ExecState* toJS(JSGlobalContextRef c)
 {
+    ASSERT(c);
     return reinterpret_cast<JSC::ExecState*>(c);
 }
 
-inline JSC::JSValue toJS(JSC::ExecState*, JSValueRef v)
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
 {
+    ASSERT_UNUSED(exec, exec);
+    ASSERT(v);
 #if USE(JSVALUE32_64)
     JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
     if (!jsCell)
@@ -73,6 +77,20 @@ inline JSC::JSValue toJS(JSC::ExecState*, JSValueRef v)
 #endif
 }
 
+inline JSC::JSValue toJSForGC(JSC::ExecState* exec, JSValueRef v)
+{
+    ASSERT_UNUSED(exec, exec);
+    ASSERT(v);
+#if USE(JSVALUE32_64)
+    JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
+    if (!jsCell)
+        return JSC::JSValue();
+    return jsCell;
+#else
+    return JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#endif
+}
+
 inline JSC::JSObject* toJS(JSObjectRef o)
 {
     return reinterpret_cast<JSC::JSObject*>(o);
diff --git a/JavaScriptCore/API/JSCallbackObjectFunctions.h b/JavaScriptCore/API/JSCallbackObjectFunctions.h
index 9b726e8..ed86a00 100644
--- a/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -131,15 +131,15 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
                 JSLock::DropAllLocks dropAllLocks(exec);
                 value = getProperty(ctx, thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
-            if (value) {
-                slot.setValue(toJS(exec, value));
-                return true;
-            }
             if (exception) {
+                exec->setException(toJS(exec, exception));
                 slot.setValue(jsUndefined());
                 return true;
             }
+            if (value) {
+                slot.setValue(toJS(exec, value));
+                return true;
+            }
         }
         
         if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
@@ -184,7 +184,8 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
                 JSLock::DropAllLocks dropAllLocks(exec);
                 result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             if (result || exception)
                 return;
         }
@@ -202,7 +203,8 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
                         JSLock::DropAllLocks dropAllLocks(exec);
                         result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
                     }
-                    exec->setException(toJS(exec, exception));
+                    if (exception)
+                        exec->setException(toJS(exec, exception));
                     if (result || exception)
                         return;
                 } else
@@ -240,7 +242,8 @@ bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, const Identifier& p
                 JSLock::DropAllLocks dropAllLocks(exec);
                 result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             if (result || exception)
                 return true;
         }
@@ -301,7 +304,8 @@ JSObject* JSCallbackObject<Base>::construct(ExecState* exec, JSObject* construct
                 JSLock::DropAllLocks dropAllLocks(exec);
                 result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &exception));
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -325,7 +329,8 @@ bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValue value, JSValue
                 JSLock::DropAllLocks dropAllLocks(exec);
                 result = hasInstance(execRef, thisRef, valueRef, &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -363,7 +368,8 @@ JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject,
                 JSLock::DropAllLocks dropAllLocks(exec);
                 result = toJS(exec, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception));
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -435,7 +441,8 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
             }
 
             double dValue;
-            return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
+            if (value)
+                return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
         }
             
     return Base::toNumber(exec);
@@ -459,7 +466,8 @@ UString JSCallbackObject<Base>::toString(ExecState* exec) const
                 exec->setException(toJS(exec, exception));
                 return "";
             }
-            return toJS(exec, value).getString();
+            if (value)
+                return toJS(exec, value).getString(exec);
         }
             
     return Base::toString(exec);
@@ -507,13 +515,14 @@ JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identif
                         JSLock::DropAllLocks dropAllLocks(exec);
                         value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
                     }
-                    exec->setException(toJS(exec, exception));
+                    if (exception) {
+                        exec->setException(toJS(exec, exception));
+                        return jsUndefined();
+                    }
                     if (value)
                         return toJS(exec, value);
-                    if (exception)
-                        return jsUndefined();
                 }
-                    
+
     return throwError(exec, ReferenceError, "Static value property defined with NULL getProperty callback.");
 }
 
@@ -560,11 +569,12 @@ JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier
                 JSLock::DropAllLocks dropAllLocks(exec);
                 value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception) {
+                exec->setException(toJS(exec, exception));
+                return jsUndefined();
+            }
             if (value)
                 return toJS(exec, value);
-            if (exception)
-                return jsUndefined();
         }
             
     return throwError(exec, ReferenceError, "hasProperty callback returned true for a property that doesn't exist.");
diff --git a/JavaScriptCore/API/JSValueRef.cpp b/JavaScriptCore/API/JSValueRef.cpp
index 2207181..31859d6 100644
--- a/JavaScriptCore/API/JSValueRef.cpp
+++ b/JavaScriptCore/API/JSValueRef.cpp
@@ -169,7 +169,7 @@ bool JSValueIsStrictEqual(JSContextRef ctx, JSValueRef a, JSValueRef b)
     JSValue jsA = toJS(exec, a);
     JSValue jsB = toJS(exec, b);
 
-    return JSValue::strictEqual(jsA, jsB);
+    return JSValue::strictEqual(exec, jsA, jsB);
 }
 
 bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObjectRef constructor, JSValueRef* exception)
@@ -307,7 +307,7 @@ void JSValueProtect(JSContextRef ctx, JSValueRef value)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcProtect(jsValue);
 }
 
@@ -317,6 +317,6 @@ void JSValueUnprotect(JSContextRef ctx, JSValueRef value)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcUnprotect(jsValue);
 }
diff --git a/JavaScriptCore/API/tests/testapi.c b/JavaScriptCore/API/tests/testapi.c
index 152babc..e7aba0f 100644
--- a/JavaScriptCore/API/tests/testapi.c
+++ b/JavaScriptCore/API/tests/testapi.c
@@ -166,6 +166,10 @@ static JSValueRef MyObject_getProperty(JSContextRef context, JSObjectRef object,
     if (JSStringIsEqualToUTF8CString(propertyName, "cantFind")) {
         return JSValueMakeUndefined(context);
     }
+    
+    if (JSStringIsEqualToUTF8CString(propertyName, "hasPropertyLie")) {
+        return 0;
+    }
 
     if (JSStringIsEqualToUTF8CString(propertyName, "throwOnGet")) {
         return JSEvaluateScript(context, JSStringCreateWithUTF8CString("throw 'an exception'"), object, JSStringCreateWithUTF8CString("test script"), 1, exception);
@@ -176,7 +180,7 @@ static JSValueRef MyObject_getProperty(JSContextRef context, JSObjectRef object,
         return JSValueMakeNumber(context, 1);
     }
     
-    return NULL;
+    return JSValueMakeNull(context);
 }
 
 static bool MyObject_setProperty(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
@@ -299,7 +303,7 @@ static JSValueRef MyObject_convertToType(JSContextRef context, JSObjectRef objec
     }
 
     // string conversion -- forward to default object class
-    return NULL;
+    return JSValueMakeNull(context);
 }
 
 static JSStaticValue evilStaticValues[] = {
@@ -374,7 +378,7 @@ static JSValueRef EvilExceptionObject_convertToType(JSContextRef context, JSObje
         funcName = JSStringCreateWithUTF8CString("toStringExplicit");
         break;
     default:
-        return NULL;
+        return JSValueMakeNull(context);
         break;
     }
     
@@ -382,7 +386,7 @@ static JSValueRef EvilExceptionObject_convertToType(JSContextRef context, JSObje
     JSStringRelease(funcName);    
     JSObjectRef function = JSValueToObject(context, func, exception);
     if (!function)
-        return NULL;
+        return JSValueMakeNull(context);
     JSValueRef value = JSObjectCallAsFunction(context, function, object, 0, NULL, exception);
     if (!value) {
         JSStringRef errorString = JSStringCreateWithUTF8CString("convertToType failed"); 
@@ -737,6 +741,15 @@ static void testInitializeFinalize()
     ASSERT(JSObjectGetPrivate(o) == (void*)3);
 }
 
+static JSValueRef jsNumberValue =  NULL;
+
+static void makeGlobalNumberValue(JSContextRef context) {
+    JSValueRef v = JSValueMakeNumber(context, 420);
+    JSValueProtect(context, v);
+    jsNumberValue = v;
+    v = NULL;
+}
+
 int main(int argc, char* argv[])
 {
     const char *scriptPath = "testapi.js";
@@ -948,10 +961,12 @@ int main(int argc, char* argv[])
     CFRelease(cfEmptyString);
     
     jsGlobalValue = JSObjectMake(context, NULL, NULL);
+    makeGlobalNumberValue(context);
     JSValueProtect(context, jsGlobalValue);
     JSGarbageCollect(context);
     ASSERT(JSValueIsObject(context, jsGlobalValue));
     JSValueUnprotect(context, jsGlobalValue);
+    JSValueUnprotect(context, jsNumberValue);
 
     JSStringRef goodSyntax = JSStringCreateWithUTF8CString("x = 1;");
     JSStringRef badSyntax = JSStringCreateWithUTF8CString("x := 1;");
diff --git a/JavaScriptCore/Android.mk b/JavaScriptCore/Android.mk
index ba7f05a..2fca4f4 100644
--- a/JavaScriptCore/Android.mk
+++ b/JavaScriptCore/Android.mk
@@ -35,6 +35,10 @@ LOCAL_SRC_FILES := \
 	bytecode/StructureStubInfo.cpp \
 	\
 	bytecompiler/BytecodeGenerator.cpp \
+<<<<<<< HEAD:JavaScriptCore/Android.mk
+=======
+	bytecompiler/NodesCodegen.cpp \
+>>>>>>> webkit.org at r51976:JavaScriptCore/Android.mk
 	\
 	debugger/Debugger.cpp \
 	debugger/DebuggerActivation.cpp \
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index fb09372..3e9187b 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,2455 @@
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect caching of prototype lookup with dictionary base
+        https://bugs.webkit.org/show_bug.cgi?id=32402
+
+        Make sure we don't add cached prototype lookup to the proto_list
+        lookup chain if the top level object is a dictionary.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove JSObject::getPropertyAttributes() and all usage of it.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        getOwnPropertyDescriptor() should be used instead.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyDescriptor):
+        * debugger/DebuggerActivation.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::propertyIsEnumerable):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSVariableObject.h:
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt & Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32367
+        Add support for short Ropes (up to 3 entries) inline within JSString.
+        (rather than externally allocating an object to hold the rope).
+        Switch jsAdd of (JSString* + JSString*) to now make use of Ropes.
+
+        ~1% progression on Sunspidey.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::deref):
+        (JSC::JSString::Rope::Fiber::ref):
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        (JSC::JSString::JSString):
+        (JSC::JSString::~JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::length):
+        (JSC::JSString::canGetIndex):
+        (JSC::JSString::appendStringInConstruct):
+        (JSC::JSString::appendValueInConstructAndIncrementLength):
+        (JSC::JSString::isRope):
+        (JSC::JSString::string):
+        (JSC::JSString::ropeLength):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+        (JSC::resolveBase):
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix three more things found by compiling with clang++.
+        
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        Add the 'std' qualifier to the call to make_pair.
+
+        * wtf/DateMath.cpp:
+        (WTF::initializeDates):
+        Incrementing a bool is deprecated according to the C++ specification.
+        
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        Name lookup should not be done in dependent bases, so explicitly qualify the call to set.
+
+2009-12-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Google reader gets stuck in the "Loading..." state and does not complete
+        https://bugs.webkit.org/show_bug.cgi?id=32256
+        <rdar://problem/7456388>
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless): Fix some backward branches.
+
+2009-12-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32228
+        Make destruction of ropes non-recursive to prevent stack exhaustion.
+        Also, pass a UString& into initializeFiber rather than a Ustring::Rep*,
+        since the Rep is not being ref counted this could result in usage of a
+        Rep with refcount zero (where the Rep comes from a temporary UString
+        returned from a function).
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::destructNonRecursive):
+        (JSC::JSString::Rope::~Rope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::initializeFiber):
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+
+2009-12-09  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31930
+
+        Update to r51457. ASSERTs changed to COMPILE_ASSERTs.
+        The speedup is 25%.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Updates Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        * Android.mk: Modified.
+        * Android.v8.wtf.mk: Modified.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a bug found while trying to compile JavaScriptCore with clang++.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm): Don't self assign here.  Use false instead.
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Attempt to fix the Windows build.
+        
+        * wtf/FastMalloc.h:
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix some things found while trying to compile JavaScriptCore with clang++.
+
+        * wtf/FastMalloc.h:
+        Add correct exception specifications for the allocation/deallocation operators.
+        
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        Fix a bunch of struct/class mismatches.
+
+2009-12-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        move code generation portions of Nodes.cpp to bytecompiler directory
+        https://bugs.webkit.org/show_bug.cgi?id=32284
+
+        * bytecompiler/NodesCodegen.cpp: Copied from parser/Nodes.cpp. Removed parts that
+        are not about codegen.
+        * parser/Nodes.cpp: Removed everything that is about codegen.
+
+        Update build systems:
+        
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref):
+        (WTF::RefCountedBase::hasOneRef):
+        (WTF::RefCountedBase::refCount):
+        (WTF::RefCountedBase::derefBase):
+        * wtf/ThreadVerifier.h: Removed.
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Darin Adler.
+
+        Make WebKit build correctly on FreeBSD, IA64, and Alpha.
+        Based on work by Petr Salinger <Petr.Salinger@seznam.cz>,
+        and Colin Watson <cjwatson@ubuntu.com>.
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): Disable thread verification on this class since it uses addressOfCount().
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Add ASSERT.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::derefBase): Ditto.
+        (WTF::RefCountedBase::disableThreadVerification): delegate to ThreadVerifier method.
+        * wtf/ThreadVerifier.h: Added.
+        (WTF::ThreadVerifier::ThreadVerifier): New Debug-only class to verify that ref/deref of RefCounted is done on the same thread.
+        (WTF::ThreadVerifier::activate): Activates checks. Called when ref count becomes above 2.
+        (WTF::ThreadVerifier::deactivate): Deactivates checks. Called when ref count drops below 2.
+        (WTF::ThreadVerifier::disableThreadVerification): used on objects that should not be checked (StringImpl etc)
+        (WTF::ThreadVerifier::verifyThread):
+        * GNUmakefile.am: Add ThreadVerifier.h to the build file.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        * Android.mk: Added.
+        * Android.v8.wtf.mk: Added.
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fixage part I).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toString):
+        * API/JSValueRef.cpp:
+        (JSValueIsStrictEqual):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * profiler/Profiler.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getString):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getString):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::createOrNull):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        (JSC::JSValue::toString):
+        * runtime/JSValue.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/Operations.cpp:
+        (JSC::JSValue::strictEqualSlowCase):
+        * runtime/Operations.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::equalTo):
+        * runtime/PropertyDescriptor.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix. Be flexible about which version of ICU is used on Windows.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Add optional xcopy commands to copy ICU 4.2.
+
+2009-12-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        op_loop_if_less JIT codegen is broken for 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=32221
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false): Fix codegen in this version - test was backwards.
+
+2009-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.create fails if properties on the descriptor are getters
+        https://bugs.webkit.org/show_bug.cgi?id=32219
+
+        Correctly initialise the PropertySlots with the descriptor object.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Actually tested 64-bit *and* 32-bit build this time.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really really fix 64-bit build for prior patch (actually tested this time).
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+        (JSC::JIT::emitSlow_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really fix 64-bit build for prior patch.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Fix 64-bit build for prior patch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-12-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        conway benchmark spends half it's time in op_less (jump fusion fails)
+        https://bugs.webkit.org/show_bug.cgi?id=32190
+
+        <1% speedup on SunSpider and V8
+        2x speedup on "conway" benchmark
+        
+        Two optimizations:
+        1) Improve codegen for logical operators &&, || and ! in a condition context
+        
+        When generating code for combinations of &&, || and !, in a
+        condition context (i.e. in an if statement or loop condition), we
+        used to produce a value, and then separately jump based on its
+        truthiness. Now we pass the false and true targets in, and let the
+        logical operators generate jumps directly. This helps in four
+        ways:
+
+        a) Individual clauses of a short-circuit logical operator can now
+        jump directly to the then or else clause of an if statement (or to
+        the top or exit of a loop) instead of jumping to a jump.
+        
+        b) It used to be that jump fusion with the condition of the first
+        clause of a logical operator was inhibited, because the register
+        was ref'd to be used later, in the actual condition jump; this no
+        longer happens since a jump straight to the final target is
+        generated directly.
+
+        c) It used to be that jump fusion with the condition of the second
+        clause of a logical operator was inhibited, because there was a
+        jump target right after the second clause and before the actual
+        condition jump. But now it's no longer necessary for the first
+        clause to jump there so jump fusion is not blocked.
+
+        d) We avoid generating excess mov statements in some cases.
+        
+        As a concrete example this source:
+        
+        if (!((x < q && y < q) || (t < q && z < q))) {
+            // ...
+        }
+        
+        Used to generate this bytecode:
+        
+        [  34] less              r1, r-15, r-19
+        [  38] jfalse            r1, 7(->45)
+        [  41] less              r1, r-16, r-19
+        [  45] jtrue             r1, 14(->59)
+        [  48] less              r1, r-17, r-19
+        [  52] jfalse            r1, 7(->59)
+        [  55] less              r1, r-18, r-19
+        [  59] jtrue             r1, 17(->76)
+        
+        And now generates this bytecode (also taking advantage of the second optimization below):
+        
+        [  34] jnless            r-15, r-19, 8(->42)
+        [  38] jless             r-16, r-19, 26(->64)
+        [  42] jnless            r-17, r-19, 8(->50)
+        [  46] jless             r-18, r-19, 18(->64)
+        
+        Note the jump fusion and the fact that there's less jump
+        indirection - three of the four jumps go straight to the target
+        clause instead of indirecting through another jump.
+        
+        2) Implement jless opcode to take advantage of the above, since we'll now often generate
+        a less followed by a jtrue where fusion is not forbidden.
+       
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::hasConditionContextCodegen): Helper function to determine
+        whether a node supports special conditional codegen. Return false as this is the default.
+        (JSC::ExpressionNode::emitBytecodeInConditionContext): Assert not reached - only really
+        defined for nodes that do have conditional codegen.
+        (JSC::UnaryOpNode::expr): Add const version.
+        (JSC::LogicalNotNode::hasConditionContextCodegen): Returne true only if subexpression
+        supports it.
+        (JSC::LogicalOpNode::hasConditionContextCodegen): Return true.
+        * parser/Nodes.cpp:
+        (JSC::LogicalNotNode::emitBytecodeInConditionContext): Implemented - just swap
+        the true and false targets for the child node.
+        (JSC::LogicalOpNode::emitBytecodeInConditionContext): Implemented - handle jumps
+        directly, improving codegen quality. Also handles further nested conditional codegen.
+        (JSC::ConditionalNode::emitBytecode): Use condition context codegen when available.
+        (JSC::IfNode::emitBytecode): ditto
+        (JSC::IfElseNode::emitBytecode): ditto
+        (JSC::DoWhileNode::emitBytecode): ditto
+        (JSC::WhileNode::emitBytecode): ditto
+        (JSC::ForNode::emitBytecode): ditto
+
+        * bytecode/Opcode.h: 
+        - Added loop_if_false opcode - needed now that falsey jumps can be backwards.
+        - Added jless opcode to take advantage of new fusion opportunities.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Handle above.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfTrue): Add peephole for less + jtrue ==> jless.
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add handling of backwrds falsey jumps.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInConditionContext): Wrapper to handle tracking of
+        overly deep expressions etc.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Implement the two new opcodes (loop_if_false, jless).
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Implement JIT support for the two new opcodes.
+        (JSC::JIT::privateCompileSlowCases): ditto
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless): ditto
+        (JSC::JIT::emitBinaryDoubleOp): ditto
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-12-04  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JavaScript delete operator should return false for string properties
+        https://bugs.webkit.org/show_bug.cgi?id=32012
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolled back r51633 because it causes a perf regression in Chromium.
+
+        * wtf/Platform.h:
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Try and fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Export a symbol that should be exported.
+
+2009-12-03  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Mac build.
+
+        * JavaScriptCore.exp:  Export a symbol that should be exported.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(4.0.3-48777): Crash in JSC::ExecState::propertyNames() (Debug-only?)
+        https://bugs.webkit.org/show_bug.cgi?id=32133
+
+        Work around odd GCC-ism and correct the scopechain for use by
+        calls made while a cachedcall is active on the callstack.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Brraaaaiiiinnnnnzzzzzzzz" Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32136
+        Add a rope representation to JSString.  Presently JSString always holds its data in UString form.
+        Instead, allow the result of a string concatenation to be represented in a tree form - with a
+        variable sized, reference-counted rope node retaining a set of UString::Reps (or other rope nopes).
+
+        Strings must still currently be resolved down to a flat UString representation before being used,
+        but by holding the string in a rope representation during construction we can avoid copying data
+        until we know the final size of the string.
+
+        ~2% progression on SunSpider (~25% on date-format-xparb, ~20% on string-validate-input).
+
+        * JavaScriptCore.exp:
+
+            - Update exports.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+            - Switch the string length trampoline to read the length directly from JSString::m_length,
+              rather than from the JSString's UString::Rep's 'len' property.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+            - Modify op_add such that addition of two strings, where either or both strings are already
+              in rope representation, produces a rope as a result.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::copyChars):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::Fiber):
+        (JSC::JSString::Rope::Fiber::destroy):
+        (JSC::JSString::Rope::Fiber::isRope):
+        (JSC::JSString::Rope::Fiber::rope):
+        (JSC::JSString::Rope::Fiber::string):
+        (JSC::JSString::Rope::create):
+        (JSC::JSString::Rope::initializeFiber):
+        (JSC::JSString::Rope::ropeLength):
+        (JSC::JSString::Rope::stringLength):
+        (JSC::JSString::Rope::fibers):
+        (JSC::JSString::Rope::Rope):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::length):
+        (JSC::JSString::isRope):
+        (JSC::JSString::rope):
+        (JSC::JSString::string):
+        (JSC::JSString::canGetIndex):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSubstring):
+        (JSC::JSString::getStringPropertySlot):
+
+            - Add rope form.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+
+            - Update string concatenation, and addition of ropes, to produce ropes.
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT for Chrome/Mac.
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add files missed in prior patch.
+
+        * runtime/JSZombie.cpp:
+        (JSC::):
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h: Added.
+        (JSC::JSZombie::JSZombie):
+        (JSC::JSZombie::isZombie):
+        (JSC::JSZombie::classInfo):
+        (JSC::JSZombie::isGetterSetter):
+        (JSC::JSZombie::isAPIValueWrapper):
+        (JSC::JSZombie::isPropertyNameIterator):
+        (JSC::JSZombie::getCallData):
+        (JSC::JSZombie::getConstructData):
+        (JSC::JSZombie::getUInt32):
+        (JSC::JSZombie::toPrimitive):
+        (JSC::JSZombie::getPrimitiveNumber):
+        (JSC::JSZombie::toBoolean):
+        (JSC::JSZombie::toNumber):
+        (JSC::JSZombie::toString):
+        (JSC::JSZombie::toObject):
+        (JSC::JSZombie::markChildren):
+        (JSC::JSZombie::put):
+        (JSC::JSZombie::deleteProperty):
+        (JSC::JSZombie::toThisObject):
+        (JSC::JSZombie::toThisString):
+        (JSC::JSZombie::toThisJSString):
+        (JSC::JSZombie::getJSNumber):
+        (JSC::JSZombie::getOwnPropertySlot):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add zombies to JSC
+        https://bugs.webkit.org/show_bug.cgi?id=32103
+
+        Add a compile time flag to make the JSC collector replace "unreachable"
+        objects with zombie objects.  The zombie object is a JSCell subclass that
+        ASSERTs on any attempt to use the JSCell methods.  In addition there are
+        a number of additional assertions in bottleneck code to catch zombie usage
+        as quickly as possible.
+
+        Grrr. Argh. Brains.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::isZombie):
+        (JSC::JSValue::isZombie):
+        * runtime/JSValue.h:
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        * wtf/Platform.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added variants of find/contains/add that allow a foreign key type to be used.
+        This will allow AtomicString-keyed maps to be queried by C string without
+        having to create a temporary AtomicString (see HTTPHeaderMap.)
+        The code for this is adapted from the equivalent in HashSet.h.
+
+        * wtf/HashMap.h:
+        (WTF::HashMap::find):
+        (WTF::HashMap::contains):
+        (WTF::HashMap::add):
+        * wtf/HashSet.h: Changed "method" to "function member" in a comment.
+
+2009-12-01  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Revert 51551 because it broke GTK+.
+
+        * wtf/Platform.h:
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix.  Reviewed by NOBODY.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+        
+        Remove the temporary duct tape of willExecute/didExecute virtual hooks on the JSGlobalData::ClientData - these are no longer necessary.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove obsolete PLATFORM(KDE) code
+        https://bugs.webkit.org/show_bug.cgi?id=31958
+
+        KDE is now using unpatched QtWebKit.
+
+        * parser/Lexer.cpp: Remove obsolete KDE_USE_FINAL guard
+        * wtf/Platform.h: Remove PLATFORM(KDE) definition and code 
+        section that is guarded with it.
+
+2009-11-30  Jan-Arve Sæther  <jan-arve.saether@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix compilation with win32-icc
+
+        The Intel compiler does not support the __has_trivial_constructor type
+        trait.  The Intel Compiler can report itself as _MSC_VER >= 1400. The
+        reason for that is that the Intel Compiler depends on the Microsoft
+        Platform SDK, and in order to try to be "fully" MS compatible it will
+        "pretend" to be the same MS compiler as was shipped with the MS PSDK.
+        (Thus, compiling with win32-icc with VC8 SDK will make the source code
+        "think" the compiler at hand supports this type trait).
+
+        * wtf/TypeTraits.h:
+
+2009-11-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Mac build has JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=31828
+
+        * wtf/Platform.h: Enable JIT for Qt Mac builds
+
+2009-11-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Apply workaround for the limitation of VirtualFree with MEM_RELEASE to all ports running on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=31943
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+
+2009-11-28  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31930
+
+        Seems a typo. We don't need ~270k memory to determine the vptrs.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. 
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        Build fix for chromium after r51423.
+        Exclude gtk directory from chromium build.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect behaviour of jneq_null in the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=31901
+
+        Correct the logic of jneq_null.  This is already covered by existing tests.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * GNUmakefile.am: Change the path for GOwnPtr.*.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Remove
+          GOwnPtr.cpp from the exclude list.
+        * JavaScriptCore.gypi: Change the path for GOwnPtr.*.
+        * wscript: Remove GOwnPtr.cpp from the exclude list.
+        * wtf/GOwnPtr.cpp: Removed.
+        * wtf/GOwnPtr.h: Removed.
+        * wtf/Threading.h: Change the path for GOwnPtr.h.
+        * wtf/gtk/GOwnPtr.cpp: Copied from JavaScriptCore/wtf/GOwnPtr.cpp.
+        * wtf/gtk/GOwnPtr.h: Copied from JavaScriptCore/wtf/GOwnPtr.h.
+        * wtf/unicode/glib/UnicodeGLib.h: Change the path for GOwnPtr.h.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add ability to enable ACCELERATED_COMPOSITING on Windows (currently disabled)
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+
+        * wtf/Platform.h:
+
+2009-11-24  Jason Smith  <dark.panda@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        RegExp#exec's returned Array-like object behaves differently from
+        regular Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31689
+
+        * JavaScriptCore/runtime/RegExpConstructor.cpp: ensure that undefined
+        values are added to the returned RegExpMatchesArray
+
+2009-11-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON.stringify performance on undefined is very poor
+        https://bugs.webkit.org/show_bug.cgi?id=31839
+
+        Switch from a UString to a Vector<UChar> when building
+        the JSON string, allowing us to safely remove the substr-copy
+        we otherwise did when unwinding an undefined property.
+
+        Also turns out to be a ~5% speedup on stringification.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::StringBuilder::append):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        * wtf/unicode/UTF8.cpp:
+        * wtf/unicode/glib/UnicodeGLib.cpp:
+        * wtf/unicode/wince/UnicodeWince.cpp:
+
+2009-11-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Streamlined some Math functions where we expect or know the result not
+        to be representable as an int.
+        
+        SunSpider says 0.6% faster.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::jsDoubleNumber):
+        (JSC::JSValue::JSValue): Added a function for making a numeric JSValue
+        and skipping the "can I encode this as an int?" check, avoiding the
+        overhead of int <-> double roundtripping and double <-> double comparison
+        and branching.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan): For these functions, which we expect or know
+        to produce results not representable as ints, call jsDoubleNumber instead
+        of jsNumber.
+
+2009-11-23  Mark Rowe  <mrowe@apple.com>
+
+        Unreviewed. Unbreak the regression tests after r51329.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Null-check clientData before dereferencing it.
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction): Ditto.
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 1/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Since the API is in JSC but worlds only exist in WebCore, add callbacks on the JSGlobalData::ClientData
+        to allow it to update the current world on entry/exit via the JSC API.  This is temporary duck
+        tape, and should be removed once the current world no longer needs to be explicitly tracked.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::ClientData::beginningExecution):
+        (JSC::JSGlobalData::ClientData::completedExecution):
+        * runtime/JSGlobalData.h:
+
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Adds MainThreadAndroid.cpp with Android-specific WTF threading functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31807
+
+        * wtf/android: Added.
+        * wtf/android/MainThreadAndroid.cpp: Added.
+        (WTF::timeoutFired):
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * JavaScriptCore.exp: Export callOnMainThreadAndWait.
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Symbian] Fix lastIndexOf() for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=31773
+
+        Symbian soft floating point library has problems with operators
+        comparing NaN to numbers. Without a workaround lastIndexOf() 
+        function does not work.
+
+        Patch developed by David Leong.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):Add an extra test 
+        to check for NaN for Symbian.
+
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android port lacks implementation of atomicIncrement and atomicDecrement.
+        https://bugs.webkit.org/show_bug.cgi?id=31715
+
+        * wtf/Threading.h: Modified.
+        (WTF::atomicIncrement): Added Android implementation.
+        (WTF::atomicDecrement): Added Android implementation.
+
+2009-11-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Sort source lists and remove obsolete comments 
+        from the build system.
+
+        * JavaScriptCore.pri:
+
+2009-11-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt][Mac] Turn on multiple JavaScript threads for QtWebkit on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31753
+
+        * wtf/Platform.h:
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        * wtf/Platform.h: Modified. Added Android-specific configuration.
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/MainThread.cpp:
+        (WTF::FunctionWithContext::FunctionWithContext):
+        (WTF::dispatchFunctionsFromMainThread):
+        (WTF::callOnMainThreadAndWait):
+        * wtf/MainThread.h:
+        Re-add callOnMainThreadAndWait(), which was removed in bug 23926.
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        isMainThread() on Chromium (Mac and Linux) is so slow it timeouts LayoutTests..
+        https://bugs.webkit.org/show_bug.cgi?id=31693
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): grab and use the pthread_t of the main thread instead of ThreadIdentifier.
+        (WTF::isMainThread): Ditto.
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(STRING_H) guard from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=31668
+
+        * config.h:
+        * runtime/UString.cpp:
+
+2009-11-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Fixing a bug in MessageQueue::removeIf() that leads to an
+        assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31657
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::removeIf):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        JavaScriptCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        * runtime/DatePrototype.cpp: Remove include directive 
+        for float.h as it is included in MathExtras.h already.
+        * runtime/Operations.cpp: Ditto.
+        * runtime/UString.cpp: Ditto.
+        * wtf/dtoa.cpp: Ditto.
+        * wtf/MathExtras.h: Remove HAVE(FLOAT_H) guard.
+        * wtf/Platform.h: Ditto.
+
+2009-11-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix for 32-bit Sparc machines: these machines are big-endian.
+
+        * wtf/Platform.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move UString::from(double) implementation to new
+        WTF::doubleToStringInJavaScriptFormat(), and expose it because WebCore
+        code will use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31330
+
+        - Introduce new function createRep(const char*, unsigned) and
+          UString::UString(const char*, unsigned) to reduce 2 calls to strlen().
+        - Fix a bug that dtoa() doesn't update *rve if the input value is NaN
+          or Infinity.
+
+        No new tests because this doesn't change the behavior.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::from): Move the code to doubleToStringInJavaScriptFormat().
+        * runtime/UString.h:
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Fix a bug about rve.
+        (WTF::append): A helper for doubleToStringInJavaScriptFormat().
+        (WTF::doubleToStringInJavaScriptFormat): Move the code from UString::from(double).
+        * wtf/dtoa.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        * JavaScriptCore.pro:
+
+2009-11-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove Chromium's unnecessary dependency on wtf's tcmalloc files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31648
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-18  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Qt] Implement symbol hiding for JSC's JIT functions.
+
+        These functions are implemented directly in assembly, so they need the
+        proper directives to enable/disable visibility. On ELF systems, it's
+        .hidden, whereas on Mach-O systems (Mac) it's .private_extern. On
+        Windows, it's not necessary since you have to explicitly export. I
+        also implemented the AIX idiom, though it's unlikely anyone will
+        implement AIX/POWER JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=30864
+
+        * jit/JITStubs.cpp:
+
+2009-11-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Interpreter may do an out of range access when throwing an exception in the profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=31635
+
+        Add bounds check.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2009-11-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix the clobber list of cacheFlush for ARM and Thumb2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=31631
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-11-18  Harald Fernengel  <harald.fernengel@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix detection of linux-g++
+
+        Never use "linux-g++*" to check for linux-g++, since this will break embedded
+        builds which use linux-arm-g++ and friends. Use 'linux*-g++*' to check for any
+        g++ on linux mkspec.
+
+        * JavaScriptCore.pri:
+
+2009-11-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add JSContextRefPrivate.h to list of copied files.
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2009-11-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [GTK] Style cleanup for GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=31506
+
+        Remove forward declaration in GOwnPtr and do some style cleanup.
+
+        * wtf/GOwnPtr.cpp:
+        * wtf/GOwnPtr.h:
+        (WTF::GOwnPtr::GOwnPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::get):
+        (WTF::GOwnPtr::release):
+        (WTF::GOwnPtr::outPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        (WTF::GOwnPtr::operator*):
+        (WTF::GOwnPtr::operator->):
+        (WTF::GOwnPtr::operator!):
+        (WTF::GOwnPtr::operator UnspecifiedBoolType):
+        (WTF::GOwnPtr::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+        (WTF::freeOwnedGPtr):
+
+2009-11-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect use of JavaScriptCore API in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=31577
+
+        Add assertions to the 'toJS' functions to catch mistakes like
+        this early.  Restructure existing code which blindly passed potentially
+        null values to toJS when forwarding exceptions so that a null check is
+        performed first.
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/tests/testapi.c: Fix errors in the API tester.
+        (MyObject_getProperty):
+        (MyObject_convertToType):
+        (EvilExceptionObject_convertToType):
+
+2009-11-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Minor fixes for JSVALUE32_64: branchConvertDoubleToInt32
+        failed on a CortexA8 CPU, but not on a simulator; and
+        JITCall.cpp modifications was somehow not committed to mainline.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::fmrs_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2009-11-16  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix Qt build on Windows CE 6.
+
+        * JavaScriptCore.pri: Add missing include path.
+        * wtf/Platform.h: Include ce_time.h for Windows CE 6.
+
+2009-11-13  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Adding optimization support for mode JSVALUE32_64
+        on ARM systems.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-11-14  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Adding JSVALUE32_64 support for ARM (but not turning it
+        on by default). All optimizations must be disabled, since
+        this patch is only the first of a series of patches.
+
+        During the work, a lot of x86 specific code revealed and
+        made platform independent.
+        See revisions: 50531 50541 50593 50594 50595
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fdivd_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::neg32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::branchOr32):
+        (JSC::MacroAssemblerARM::set8):
+        (JSC::MacroAssemblerARM::setTest8):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::zeroDouble):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        * wtf/StdLibExtras.h:
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Adding isAlphanumeric abstraction, required
+        by TextBoundaries.cpp.
+
+        * wtf/unicode/glib/UnicodeGLib.h:
+        (WTF::Unicode::isAlphanumeric):
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::isAlphanumeric):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * JavaScriptCore.pri:
+
+2009-11-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSValueProtect and JSValueUnprotect don't protect API wrapper values
+        https://bugs.webkit.org/show_bug.cgi?id=31485
+
+        Make JSValueProtect/Unprotect use a new 'toJS' function, 'toJSForGC' that
+        does not attempt to to strip out API wrapper objects.
+
+        * API/APICast.h:
+        (toJSForGC):
+        * API/JSValueRef.cpp:
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * API/tests/testapi.c:
+        (makeGlobalNumberValue):
+        (main):
+
+2009-11-13  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Antti Koivisto.
+
+        Fix typo, ce_time.cpp should be ce_time.c
+
+        * JavaScriptCore.pri:
+
+2009-11-12  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Calculate the time offset only if we were able to parse
+        the date string. This saves an IPC in Chromium for
+        invalid date strings.
+        https://bugs.webkit.org/show_bug.cgi?id=31416
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::parseDateFromNullTerminatedCharacters):
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Rollout r50896 until i can work out why it causes failures.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
+2009-11-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Remove LIBRARY directive from def file to fix Debug_All target.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Holger Freyther.
+
+        Revert r50204, since it makes DRT crash on 32 bits release builds
+        for GTK+.
+
+        * wtf/FastMalloc.h:
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Start unifying entry logic for function and eval code.
+
+        Eval now uses a ret instruction to end execution, and sets up
+        a callframe more in line with what we do for function entry.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
+2009-11-12  Richard Moe Gustavsen  <richard.gustavsen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Disable pthread_setname_np.
+
+        This allows Qt builds on Mac from 10.6 to run on earlier version
+        where this symbol is not present.
+        https://bugs.webkit.org/show_bug.cgi?id=31403
+
+        * wtf/Platform.h:
+
+2009-11-12  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix linking on Linux 32-bit.
+
+        It was missing the ".text" directive at the top of the file,
+        indicating that code would follow. Without it, the assembler created
+        "NOTYPE" symbols, which would result in linker errors.
+        https://bugs.webkit.org/show_bug.cgi?id=30863
+
+        * jit/JITStubs.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Refactor multiple JavaScriptCore threads
+        https://bugs.webkit.org/show_bug.cgi?id=31328
+
+        Remove the id field from the PlatformThread structure 
+        as it is not used.
+
+        * runtime/Collector.cpp:
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Linux build fix: Added an #include for UINT_MAX.
+
+        * runtime/WeakRandom.h:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptGlue build fix: Marked a file 'private' instead of 'project'.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "avGni arBalroguch" Barraclough.
+
+        Faster Math.random, based on GameRand.
+        
+        SunSpider says 1.4% faster.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added the header to the project.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Use an object to track random number generation
+        state, initialized to the current time.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncRandom): Use the new hotness.
+
+        * runtime/WeakRandom.h: Added.
+        (JSC::WeakRandom::WeakRandom):
+        (JSC::WeakRandom::get):
+        (JSC::WeakRandom::advance): The new hotness.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Imported the v8 DST cache.
+        
+        SunSpider says 1.5% faster.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Reset the DST cache when resetting
+        other date data.
+
+        * runtime/JSGlobalData.h:
+        (JSC::DSTOffsetCache::DSTOffsetCache):
+        (JSC::DSTOffsetCache::reset): Added a struct for the DST cache.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateDSTOffsetSimple):
+        (WTF::calculateDSTOffset):
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getDSTOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: The imported code for probing and updating the cache.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed an edge case that could cause the engine not to notice a timezone
+        change.
+        
+        No test because this case would require manual intervention to change
+        the timezone during the test.
+        
+        SunSpider reports no change.
+
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::reset): Added a helper function for resetting
+        this cache. Also, shrank the cache, since we'll be resetting it often.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Include resetting the DateInstanceCache
+        in resetting Date data. (Otherwise, a cache hit could bypass a necessary
+        timezone update check.)
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some manual inlining and constant propogation in Date code.
+        
+        SunSpider reports a 0.4% speedup on date-*, no overall speedup. Shark
+        says some previously evident stalls are now gone.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatTime):
+        (JSC::formatTimeUTC): Split formatTime into UTC and non-UTC variants.
+
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::calculateGregorianDateTime):
+        (JSC::DateInstance::calculateGregorianDateTimeUTC):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::gregorianDateTime):
+        (JSC::DateInstance::gregorianDateTimeUTC): Split gregorianDateTime into
+        a UTC and non-UTC variant, and split each variant into a fast inline
+        case and a slow out-of-line case.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Updated for the gregorianDateTime change above.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a new symbol.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "Home Wrecker" Weinig.
+
+        Added a tiny cache for Date parsing.
+        
+        SunSpider says 1.2% faster.
+
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate): Try to reuse the last parsed Date, if present.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache):
+        * runtime/JSGlobalData.h: Added storage for last parsed Date. Refactored
+        this code to make resetting the date cache easier.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
+        refactoring.
+
+        * wtf/DateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: Changed ExecState to be first parameter, as is the JSC custom.
+
+2009-11-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Can cache prototype lookups on uncacheable dictionaries.
+        https://bugs.webkit.org/show_bug.cgi?id=31198
+
+        Replace fromDictionaryTransition with flattenDictionaryObject and
+        flattenDictionaryStructure.  This change is necessary as we need to
+        guarantee that our attempt to convert away from a dictionary structure
+        will definitely succeed, and in some cases this requires mutating the
+        object storage itself.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/JSObject.h:
+        (JSC::JSObject::flattenDictionaryObject):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::comparePropertyMapEntryIndices):
+        * runtime/Structure.h:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Remove extra character from r50701.
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Revert r50695 because it broke QtWebKit (clean builds).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Prepended $$PWD to GENERATED_SOURCES_DIR to avoid potential ambiguities when included from WebCore.pro.
+        Some preprocessors consider this GENERATED_SOURCES_DIR relative to current invoking dir (e.g., ./WebCore),
+        and not the working dir of JavaCriptCore.pri (i.e., ../JavaScriptCore/).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (speculative snow leopard and windows build fixes).
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+        
+        Hopefully, the last build fix.
+
+        Create better separation in DateMath about the JSC
+        and non-JSC portions. Also, only expose the non-JSC
+        version in the exports.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getUTCOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::gmtoffset):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        For the change in DateMath.
+
+        * config.h:
+        * wtf/DateMath.cpp:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export some symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated export file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added some #includes.
+
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+        
+        If the VM calculates the local timezone offset from UTC, it caches the
+        result until the end of the current VM invocation. (We don't want to cache
+        forever, because the user's timezone may change over time.)
+        
+        This removes notify_* overhead on Mac, and, more significantly, removes
+        OS time and date call overhead on non-Mac platforms.
+
+        ~8% speedup on Date microbenchmark on Mac. SunSpider reports maybe a tiny
+        speedup on Mac. (Speedup on non-Mac platforms should be even more noticeable.)
+
+        * JavaScriptCore.exp:
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Made the 
+        DynamicGlobalObjectScope constructor responsible for checking whether a
+        dynamicGlobalObject has already been set. This eliminated some duplicate
+        client code, and allowed me to avoid adding even more duplicate client
+        code. Made DynamicGlobalObjectScope responsible for resetting the
+        local timezone cache upon first entry to the VM.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * wtf/DateMath.cpp:
+        (WTF::getCurrentUTCTime):
+        (WTF::getCurrentUTCTimeWithMicroseconds):
+        (WTF::getLocalTime):
+        (JSC::getUTCOffset): Use the new cache. Also, see below.
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::initializeDates):
+        (JSC::parseDateFromNullTerminatedCharacters): Simplified the way this function
+        accounts for the local timezone offset, to accomodate our new caching API,
+        and a (possibly misguided) caller in WebCore. Also, see below.
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime): Moved most of the code in
+        DateMath.* into the JSC namespace. The code needed to move so it could
+        naturally interact with ExecState and JSGlobalData to support caching.
+        Logically, it seemed right to move it, too, since this code is not really
+        as low-level as the WTF namespace might imply -- it implements a set of
+        date parsing and conversion quirks that are finely tuned to the JavaScript
+        language. Also removed the Mac OS X notify_* infrastructure.
+        
+        * wtf/CurrentTime.h:
+        (WTF::currentTimeMS):
+        (WTF::getLocalTime): Moved the rest of the DateMath code here, and renamed
+        it to make it consistent with WTF's currentTime function.
+
+2009-11-06  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix after r50595.
+
+        Rename the remaining rshiftPtr calls to rshift32
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitFastArithImmToInt):
+
+2009-11-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tidy up the shift methods on the macro-assembler interface.
+
+        Currently behaviour of shifts of a magnitude > 0x1f is undefined.
+        Instead defined that all shifts are masked to this range.  This makes a lot of
+        practical sense, both since having undefined behaviour is not particularly
+        desirable, and because this behaviour is commonly required (particularly since
+        it is required bt ECMA-262 for shifts).
+
+        Update the ARM assemblers to provide this behaviour.  Remove (now) redundant
+        masks from JITArithmetic, and remove rshiftPtr (this was used in case that
+        could be rewritten in a simpler form using rshift32, only optimized JSVALUE32
+        on x86-64, which uses JSVALUE64!)
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::rshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::lshift32):
+        (JSC::MacroAssemblerARMv7::rshift32):
+        * assembler/MacroAssemblerX86_64.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+
+2009-11-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a magic number (1) from the JIT, instead compute the value with OBJECT_OFFSET.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::getArgument):
+        * jit/JITStubs.h:
+
+2009-11-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31159
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The x86 branchDouble behaviour is reworked, and all JIT
+        ports should follow the x86 port. See bug 31104 and 31151
+
+        This patch contains a fix for the traditional ARM port
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fmrs_r):
+        (JSC::ARMAssembler::ftosid_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+        
+        * wtf/wince/FastMallocWince.h:
+
+2009-11-05  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use ARMv7 specific encoding for immediate constants on ARMv7 target
+        https://bugs.webkit.org/show_bug.cgi?id=31060
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::getOp2): Use INVALID_IMM
+        (JSC::ARMAssembler::getImm): Use encodeComplexImm for complex immediate
+        (JSC::ARMAssembler::moveImm): Ditto.
+        (JSC::ARMAssembler::encodeComplexImm): Encode a constant by one or two
+        instructions or a PC relative load.
+        * assembler/ARMAssembler.h: Use INVALID_IMM if a constant cannot be
+        encoded as an immediate constant.
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::movw_r): 16-bit immediate load
+        (JSC::ARMAssembler::movt_r): High halfword 16-bit immediate load
+        (JSC::ARMAssembler::getImm16Op2): Encode immediate constant for
+        movw_r and mowt_r
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Provide TARGETING_TIGER and TARGETING_LEOPARD as analogues to
+        BUILDING_ON_TIGER and BUILDING_ON_LEOPARD.  The TARGETING_ macros
+        consider the deployment target; the BUILDING_ON_ macros consider the
+        headers being built against.
+
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31151
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The ARMv7 JIT is currently using ARMv7Assembler::ConditionEQ to branch
+        for DoubleEqualOrUnordered, however this is incorrect – ConditionEQ won't
+        branch on unordered operands.  Similarly, DoubleLessThanOrUnordered &
+        DoubleLessThanOrEqualOrUnordered use ARMv7Assembler::ConditionLO &
+        ARMv7Assembler::ConditionLS, whereas they should be using
+        ARMv7Assembler::ConditionLT & ARMv7Assembler::ConditionLE.
+
+        Fix these, and fill out the missing DoubleConditions.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        (JSC::MacroAssemblerARMv7::branchDouble):
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Enable native call optimizations on ARMv7.  (Existing ARM_TRADITIONAL
+        implementation was generic, worked perfectly, just needed turning on).
+
+        * jit/JITOpcodes.cpp:
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe, Oliver Hunt, and Sam Weinig.
+
+        Add a missing assert to the ARMv7 JIT.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::ARMThumbImmediate):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove bogus op_ prefix on dumped version of three opcodes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix dumping of constants in bytecode so that they aren't printed as large positive register numbers.
+
+        We do this by having the registerName function return information about the constant if the register
+        number corresponds to a constant.  This requires that registerName, and several functions that call it,
+        be converted to member functions of CodeBlock so that the constant value can be retrieved.  The
+        ExecState also needs to be threaded down through these functions so that it can be passed on to
+        constantName when needed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::CodeBlock::registerName):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isConstantRegisterIndex):
+
+2009-11-04  Pavel Heimlich  <tropikhajma@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30647
+        Solaris build failure due to strnstr.
+
+        * wtf/StringExtras.h: Enable strnstr on Solaris, too.
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31104
+        Refactor x86-specific behaviour out of the JIT.
+
+        - Add explicit double branch conditions for ordered and unordered comparisons (presently the brehaviour is a mix).
+        - Refactor double to int conversion out into the MacroAssembler.
+        - Remove broken double to int conversion for !JSVALUE32_64 builds - this code was broken and slowing us down, fixing it showed it not to be an improvement.
+        - Remove exclusion of double to int conversion from (1 % X) cases in JSVALUE32_64 builds - if this was of benefit this is no longer the case; simplify.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove BUILDING_ON_LEOPARD from JavaScriptCore.gyp.  This is supposed
+        to be set as needed only in wtf/Platform.h.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION (r48573): JSC may incorrectly cache chain lookups with a dictionary at the head of the chain
+        https://bugs.webkit.org/show_bug.cgi?id=31045
+
+        Add guards to prevent caching of prototype chain lookups with dictionaries at the
+        head of the chain.  Also add a few tighter assertions to cached prototype lookups
+        to catch this in future.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * wtf/Platform.h: Turn on CF support if both QT and DARWIN
+        platforms are defined.
+
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::alwaysTruePredicate):
+        (WTF::MessageQueue::~MessageQueue):
+        (WTF::MessageQueue::append):
+        (WTF::MessageQueue::appendAndCheckEmpty):
+        (WTF::MessageQueue::prepend):
+        (WTF::MessageQueue::waitForMessage):
+        (WTF::MessageQueue::waitForMessageFilteredWithTimeout):
+        (WTF::MessageQueue::tryGetMessage):
+        (WTF::MessageQueue::removeIf):
+        The MessageQueue is changed to act as a queue of OwnPtr<DataType>. It takes ownership
+        of posted tasks and passes it to the new owner (in another thread) when the task is fetched.
+        All methods have arguments of type PassOwnPtr<DataType> and return the same type.
+
+        * wtf/Threading.cpp:
+        (WTF::createThread):
+        Superficial change to trigger rebuild of JSC project on Windows,
+        workaround for https://bugs.webkit.org/show_bug.cgi?id=30890
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed failing layout test: restore a special case I accidentally deleted.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromDateArgs): In the case of applying a change to a date
+        that is NaN, reset the date to 0 *and* then apply the change; don't just
+        reset the date to 0.
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: update for object-to-pointer change.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30942
+        Use pointers instead of copies to pass GregorianDateTime objects around.
+        
+        SunSpider reports a shocking 4.5% speedup on date-format-xparb, and 1.3%
+        speedup on date-format-tofte.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Renamed getGregorianDateTime to gregorianDateTime,
+        since it no longer has an out parameter. Uses 0 to indicate invalid dates.
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's ListHashSet
+        https://bugs.webkit.org/show_bug.cgi?id=30853
+
+        Inherits ListHashSet class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/rendering/RenderBlock.cpp:1813.
+
+        * wtf/ListHashSet.h:
+
+2009-10-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Regression: crash enumerating properties of an object with getters or setters
+        https://bugs.webkit.org/show_bug.cgi?id=30948
+
+        Add a guard to prevent us trying to cache property enumeration on
+        objects with getters or setters.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+ 
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r50218-r50262): E*TRADE accounts page is missing content
+        https://bugs.webkit.org/show_bug.cgi?id=30947
+        <rdar://problem/7348833>
+
+        The logic for flagging that a structure has non-enumerable properties
+        was in addPropertyWithoutTransition, rather than in the core Structure::put
+        method.  Despite this I was unable to produce a testcase that caused
+        the failure that etrade was experiencing, but the new assertion in
+        getEnumerablePropertyNames triggers on numerous layout tests without
+        the fix, so in effecti all for..in enumeration in any test ends up
+        doing the required consistency check.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::put):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::checkConsistency):
+
+2009-10-29  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add cacheFlush support for Thumb-2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=30865
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
 2009-10-28  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 42aa3cf..cd462d6 100644
--- a/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -44,14 +44,13 @@ ENABLE_DATAGRID = ENABLE_DATAGRID;
 ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
 ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
-ENABLE_FILTERS = ;
+ENABLE_FILTERS = ENABLE_FILTERS;
 ENABLE_GEOLOCATION = ;
 ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
 ENABLE_MATHML = ;
 ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
-ENABLE_RUBY = ENABLE_RUBY;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
@@ -67,4 +66,4 @@ ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/JavaScriptCore/Configurations/Version.xcconfig b/JavaScriptCore/Configurations/Version.xcconfig
index fabc009..b3bf41d 100644
--- a/JavaScriptCore/Configurations/Version.xcconfig
+++ b/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 4;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/JavaScriptCore/GNUmakefile.am b/JavaScriptCore/GNUmakefile.am
index 5e50ba7..dba305a 100644
--- a/JavaScriptCore/GNUmakefile.am
+++ b/JavaScriptCore/GNUmakefile.am
@@ -236,8 +236,6 @@ javascriptcore_sources += \
 	JavaScriptCore/wtf/Deque.h \
 	JavaScriptCore/wtf/DisallowCType.h \
 	JavaScriptCore/wtf/Forward.h \
-	JavaScriptCore/wtf/GOwnPtr.cpp \
-	JavaScriptCore/wtf/GOwnPtr.h \
 	JavaScriptCore/wtf/GetPtr.h \
 	JavaScriptCore/wtf/HashCountedSet.h \
 	JavaScriptCore/wtf/HashFunctions.h \
@@ -288,6 +286,8 @@ javascriptcore_sources += \
 	JavaScriptCore/wtf/UnusedParam.h \
 	JavaScriptCore/wtf/Vector.h \
 	JavaScriptCore/wtf/VectorTraits.h \
+	JavaScriptCore/wtf/gtk/GOwnPtr.cpp \
+	JavaScriptCore/wtf/gtk/GOwnPtr.h \
 	JavaScriptCore/wtf/gtk/MainThreadGtk.cpp \
 	JavaScriptCore/wtf/gtk/ThreadingGtk.cpp \
 	JavaScriptCore/wtf/unicode/Collator.h \
@@ -342,6 +342,7 @@ javascriptcore_sources += \
 	JavaScriptCore/interpreter/RegisterFile.h \
 	JavaScriptCore/bytecompiler/BytecodeGenerator.cpp \
 	JavaScriptCore/bytecompiler/BytecodeGenerator.h \
+	JavaScriptCore/bytecompiler/NodesCodegen.cpp \
 	JavaScriptCore/bytecompiler/LabelScope.h \
 	JavaScriptCore/debugger/Debugger.cpp \
 	JavaScriptCore/debugger/Debugger.h \
@@ -498,6 +499,7 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/Tracing.h \
 	JavaScriptCore/runtime/UString.cpp \
 	JavaScriptCore/runtime/UString.h \
+	JavaScriptCore/runtime/WeakRandom.h \
 	JavaScriptCore/wtf/FastAllocBase.h \
 	JavaScriptCore/wtf/FastMalloc.cpp \
 	JavaScriptCore/wtf/FastMalloc.h \
diff --git a/JavaScriptCore/JavaScriptCore.exp b/JavaScriptCore/JavaScriptCore.exp
index 12c96b3..1c91d36 100644
--- a/JavaScriptCore/JavaScriptCore.exp
+++ b/JavaScriptCore/JavaScriptCore.exp
@@ -111,6 +111,7 @@ __ZN3JSC12JSGlobalData12createLeakedEv
 __ZN3JSC12JSGlobalData12stopSamplingEv
 __ZN3JSC12JSGlobalData13startSamplingEv
 __ZN3JSC12JSGlobalData14dumpSampleDataEPNS_9ExecStateE
+__ZN3JSC12JSGlobalData14resetDateCacheEv
 __ZN3JSC12JSGlobalData14sharedInstanceEv
 __ZN3JSC12JSGlobalData6createEb
 __ZN3JSC12JSGlobalDataD1Ev
@@ -149,7 +150,7 @@ __ZN3JSC15JSWrapperObject12markChildrenERNS_9MarkStackE
 __ZN3JSC15createTypeErrorEPNS_9ExecStateEPKc
 __ZN3JSC15toInt32SlowCaseEdRb
 __ZN3JSC16InternalFunction4infoE
-__ZN3JSC16InternalFunction4nameEPNS_12JSGlobalDataE
+__ZN3JSC16InternalFunction4nameEPNS_9ExecStateE
 __ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_10IdentifierE
 __ZN3JSC16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC16JSVariableObject14symbolTableGetERKNS_10IdentifierERNS_18PropertyDescriptorE
@@ -178,6 +179,7 @@ __ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectER
 __ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
 __ZN3JSC25evaluateInGlobalCallFrameERKNS_7UStringERNS_7JSValueEPNS_14JSGlobalObjectE
 __ZN3JSC35createInterruptedExecutionExceptionEPNS_12JSGlobalDataE
+__ZN3JSC3NaNE
 __ZN3JSC4Heap11objectCountEv
 __ZN3JSC4Heap14primaryHeapEndEv
 __ZN3JSC4Heap15recordExtraCostEm
@@ -270,6 +272,7 @@ __ZN3JSC8JSObject23allocatePropertyStorageEmm
 __ZN3JSC8JSObject24getOwnPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC8JSObject3putEPNS_9ExecStateEjNS_7JSValueE  
+__ZN3JSC8JSString4RopeD1Ev
 __ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler14startProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler8profilerEv
@@ -326,9 +329,11 @@ __ZN3WTF21RefCountedLeakCounter9decrementEv
 __ZN3WTF21RefCountedLeakCounter9incrementEv
 __ZN3WTF21RefCountedLeakCounterC1EPKc
 __ZN3WTF21RefCountedLeakCounterD1Ev
+__ZN3WTF23callOnMainThreadAndWaitEPFvPvES0_
 __ZN3WTF23waitForThreadCompletionEjPPv
 __ZN3WTF27releaseFastMallocFreeMemoryEv
 __ZN3WTF28setMainThreadCallbacksPausedEb
+__ZN3WTF32doubleToStringInJavaScriptFormatEdPcPj
 __ZN3WTF36lockAtomicallyInitializedStaticMutexEv
 __ZN3WTF37parseDateFromNullTerminatedCharactersEPKc
 __ZN3WTF38unlockAtomicallyInitializedStaticMutexEv
@@ -350,7 +355,6 @@ __ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7
 __ZNK3JSC14JSGlobalObject14isDynamicScopeEv
 __ZNK3JSC16InternalFunction9classInfoEv
 __ZNK3JSC16JSVariableObject16isVariableObjectEv
-__ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZNK3JSC17DebuggerCallFrame10thisObjectEv
 __ZNK3JSC17DebuggerCallFrame12functionNameEv
 __ZNK3JSC17DebuggerCallFrame22calculatedFunctionNameEv
@@ -372,9 +376,9 @@ __ZNK3JSC6JSCell8toNumberEPNS_9ExecStateE
 __ZNK3JSC6JSCell8toObjectEPNS_9ExecStateE
 __ZNK3JSC6JSCell8toStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell9classInfoEv
-__ZNK3JSC6JSCell9getStringERNS_7UStringE
-__ZNK3JSC6JSCell9getStringEv
 __ZNK3JSC6JSCell9getUInt32ERj
+__ZNK3JSC6JSCell9getStringEPNS_9ExecStateE
+__ZNK3JSC6JSCell9getStringEPNS_9ExecStateERNS_7UStringE
 __ZNK3JSC6JSCell9toBooleanEPNS_9ExecStateE
 __ZNK3JSC7ArgList8getSliceEiRS0_
 __ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateE
@@ -392,12 +396,12 @@ __ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateEj
 __ZNK3JSC8JSObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
-__ZNK3JSC8JSObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
 __ZNK3JSC8JSObject8toObjectEPNS_9ExecStateE
 __ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
 __ZNK3JSC8JSObject9classNameEv
 __ZNK3JSC8JSObject9toBooleanEPNS_9ExecStateE
+__ZNK3JSC8JSString11resolveRopeEPNS_9ExecStateE
 __ZNK3JSC9HashTable11createTableEPNS_12JSGlobalDataE
 __ZNK3JSC9HashTable11deleteTableEv
 __ZNK3WTF8Collator7collateEPKtmS2_m
diff --git a/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp b/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
index cfad3cf..64e20a2 100644
--- a/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
+++ b/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
@@ -75,15 +75,10 @@
             ],
             'include_dirs': [
               '../os-win32',
-              '<(chromium_src_dir)/webkit/build/JavaScriptCore',
             ],
           }],
           ['OS=="mac"', {
             'defines': [
-              # Ensure that only Leopard features are used when doing the
-              # Mac build.
-              'BUILDING_ON_LEOPARD',
-
               # Use USE_NEW_THEME on Mac.
               'WTF_USE_NEW_THEME=1',
             ],
@@ -119,9 +114,10 @@
         # ... Then include what we want.
         ['include', '../wtf/'],
         # GLib/GTK, even though its name doesn't really indicate.
-        ['exclude', '/(GOwnPtr|glib/.*)\\.(cpp|h)$'],
+        ['exclude', '/(gtk|glib)/.*\\.(cpp|h)$'],
         ['exclude', '(Default|Gtk|Mac|None|Qt|Win|Wx)\\.(cpp|mm)$'],
         ['exclude', 'wtf/CurrentTime\\.cpp$'],
+        ['exclude', 'wtf/TC.*\\.(cpp|h)$'],
       ],
       'direct_dependent_settings': {
         'include_dirs': [
@@ -141,18 +137,6 @@
             ['exclude', 'ThreadingPthreads\\.cpp$'],
             ['include', 'Thread(ing|Specific)Win\\.cpp$']
           ],
-          'include_dirs': [
-            '<(chromium_src_dir)/webkit/build',
-            '../kjs',
-            '../API',
-            # These 3 do not seem to exist.
-            '../bindings',
-            '../bindings/c',
-            '../bindings/jni',
-            # FIXME: removed these - don't seem to exist
-            'pending',
-            'pending/wtf',
-          ],
           'include_dirs!': [
             '<(SHARED_INTERMEDIATE_DIR)/webkit',
           ],
diff --git a/JavaScriptCore/JavaScriptCore.gypi b/JavaScriptCore/JavaScriptCore.gypi
index 03c23c3..b4495b2 100644
--- a/JavaScriptCore/JavaScriptCore.gypi
+++ b/JavaScriptCore/JavaScriptCore.gypi
@@ -64,6 +64,7 @@
             'bytecode/StructureStubInfo.h',
             'bytecompiler/BytecodeGenerator.cpp',
             'bytecompiler/BytecodeGenerator.h',
+            'bytecompiler/NodesCodegen.cpp',
             'bytecompiler/Label.h',
             'bytecompiler/LabelScope.h',
             'bytecompiler/RegisterID.h',
@@ -332,6 +333,7 @@
             'runtime/Tracing.h',
             'runtime/UString.cpp',
             'runtime/UString.h',
+            'runtime/WeakRandom.h',
             'wrec/CharacterClass.cpp',
             'wrec/CharacterClass.h',
             'wrec/CharacterClassConstructor.cpp',
@@ -369,8 +371,8 @@
             'wtf/FastMalloc.h',
             'wtf/Forward.h',
             'wtf/GetPtr.h',
-            'wtf/GOwnPtr.cpp',
-            'wtf/GOwnPtr.h',
+            'wtf/gtk/GOwnPtr.cpp',
+            'wtf/gtk/GOwnPtr.h',
             'wtf/gtk/MainThreadGtk.cpp',
             'wtf/gtk/ThreadingGtk.cpp',
             'wtf/HashCountedSet.h',
diff --git a/JavaScriptCore/JavaScriptCore.order b/JavaScriptCore/JavaScriptCore.order
index 3ae3ec6..d6f6caa 100644
--- a/JavaScriptCore/JavaScriptCore.order
+++ b/JavaScriptCore/JavaScriptCore.order
@@ -1625,7 +1625,6 @@ __ZN3JSC18EmptyStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10Registe
 __ZN3JSCL27compareByStringPairForQSortEPKvS1_
 __Z22jsc_pcre_ucp_othercasej
 __ZN3JSCL35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
-__ZNK3JSC8JSObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZN3WTF7HashMapIjN3JSC7JSValueENS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3setERKjRKS2_
 __ZN3WTF9HashTableIjSt4pairIjN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEE
 __ZN3JSC12RegisterFile21releaseExcessCapacityEv
@@ -1841,7 +1840,6 @@ __ZN3JSC6JSCell14toThisJSStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
 __ZN3JSCL27objectProtoFuncLookupSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZN3JSC9ExecState22regExpConstructorTableEPS0_
 __ZN3JSCL24regExpConstructorDollar7EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZN3JSCL24regExpConstructorDollar8EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
diff --git a/JavaScriptCore/JavaScriptCore.pri b/JavaScriptCore/JavaScriptCore.pri
index eb26664..aecf01c 100644
--- a/JavaScriptCore/JavaScriptCore.pri
+++ b/JavaScriptCore/JavaScriptCore.pri
@@ -9,6 +9,11 @@ CONFIG(debug, debug|release) {
     OBJECTS_DIR = obj/release
 }
 
+symbian: {
+    # Need to guarantee this comes before system includes of /epoc32/include
+    MMP_RULES += "USERINCLUDE ../JavaScriptCore/profiler"
+}
+
 INCLUDEPATH = \
     $$PWD \
     $$PWD/.. \
@@ -54,28 +59,29 @@ win32-* {
 
 # Rules when JIT enabled (not disabled)
 !contains(DEFINES, ENABLE_JIT=0) {
-    linux-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
+    linux*-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
         QMAKE_CXXFLAGS += -fno-stack-protector
         QMAKE_CFLAGS += -fno-stack-protector
     }
 }
 
 wince* {
-    SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.cpp
+    INCLUDEPATH += $$QT_SOURCE_TREE/src/3rdparty/ce-compat
+    SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.c
     DEFINES += WINCEBASIC
 }
 
 include(pcre/pcre.pri)
 
 LUT_FILES += \
+    runtime/ArrayPrototype.cpp \
     runtime/DatePrototype.cpp \
     runtime/JSONObject.cpp \
-    runtime/NumberConstructor.cpp \
-    runtime/StringPrototype.cpp \
-    runtime/ArrayPrototype.cpp \
     runtime/MathObject.cpp \
+    runtime/NumberConstructor.cpp \
     runtime/RegExpConstructor.cpp \
-    runtime/RegExpObject.cpp
+    runtime/RegExpObject.cpp \
+    runtime/StringPrototype.cpp
 
 KEYWORDLUT_FILES += \
     parser/Keywords.table
@@ -84,16 +90,6 @@ JSCBISON += \
     parser/Grammar.y
 
 SOURCES += \
-    wtf/Assertions.cpp \
-    wtf/ByteArray.cpp \
-    wtf/HashTable.cpp \
-    wtf/MainThread.cpp \
-    wtf/RandomNumber.cpp \
-    wtf/RefCountedLeakCounter.cpp \
-    wtf/TypeTraits.cpp \
-    wtf/unicode/CollatorDefault.cpp \
-    wtf/unicode/icu/CollatorICU.cpp \
-    wtf/unicode/UTF8.cpp \
     API/JSBase.cpp \
     API/JSCallbackConstructor.cpp \
     API/JSCallbackFunction.cpp \
@@ -104,60 +100,38 @@ SOURCES += \
     API/JSStringRef.cpp \
     API/JSValueRef.cpp \
     API/OpaqueJSString.cpp \
-    runtime/InitializeThreading.cpp \
-    runtime/JSGlobalData.cpp \
-    runtime/JSGlobalObject.cpp \
-    runtime/JSStaticScopeObject.cpp \
-    runtime/JSVariableObject.cpp \
-    runtime/JSActivation.cpp \
-    runtime/JSNotAnObject.cpp \
-    runtime/JSONObject.cpp \
-    runtime/LiteralParser.cpp \
-    runtime/MarkStack.cpp \
-    runtime/TimeoutChecker.cpp \
-    bytecode/CodeBlock.cpp \
-    bytecode/StructureStubInfo.cpp \
-    bytecode/JumpTable.cpp \
     assembler/ARMAssembler.cpp \
     assembler/MacroAssemblerARM.cpp \
-    jit/JIT.cpp \
-    jit/JITCall.cpp \
+    bytecode/CodeBlock.cpp \
+    bytecode/JumpTable.cpp \
+    bytecode/Opcode.cpp \
+    bytecode/SamplingTool.cpp \
+    bytecode/StructureStubInfo.cpp \
+    bytecompiler/BytecodeGenerator.cpp \
+    bytecompiler/NodesCodegen.cpp \
+    debugger/DebuggerActivation.cpp \
+    debugger/DebuggerCallFrame.cpp \
+    debugger/Debugger.cpp \
+    interpreter/CallFrame.cpp \
+    interpreter/Interpreter.cpp \
+    interpreter/RegisterFile.cpp \
+    jit/ExecutableAllocator.cpp \
     jit/JITArithmetic.cpp \
+    jit/JITCall.cpp \
+    jit/JIT.cpp \
     jit/JITOpcodes.cpp \
     jit/JITPropertyAccess.cpp \
-    jit/ExecutableAllocator.cpp \
     jit/JITStubs.cpp \
-    bytecompiler/BytecodeGenerator.cpp \
-    runtime/ExceptionHelpers.cpp \
-    runtime/JSPropertyNameIterator.cpp \
-    interpreter/Interpreter.cpp \
-    bytecode/Opcode.cpp \
-    bytecode/SamplingTool.cpp \
-    yarr/RegexCompiler.cpp \
-    yarr/RegexInterpreter.cpp \
-    yarr/RegexJIT.cpp \
-    interpreter/RegisterFile.cpp
-
-symbian {
-    SOURCES += jit/ExecutableAllocatorSymbian.cpp \
-              runtime/MarkStackSymbian.cpp
-} else {
-    win32-*|wince* {
-        SOURCES += jit/ExecutableAllocatorWin.cpp \
-                  runtime/MarkStackWin.cpp
-    } else {
-        SOURCES += jit/ExecutableAllocatorPosix.cpp \
-                  runtime/MarkStackPosix.cpp
-    }
-}
-
-!contains(DEFINES, USE_SYSTEM_MALLOC) {
-    SOURCES += wtf/TCSystemAlloc.cpp
-}
-
-# AllInOneFile.cpp helps gcc analize and optimize code
-# Other compilers may be able to do this at link time
-SOURCES += \
+    parser/Lexer.cpp \
+    parser/Nodes.cpp \
+    parser/ParserArena.cpp \
+    parser/Parser.cpp \
+    profiler/HeavyProfile.cpp \
+    profiler/Profile.cpp \
+    profiler/ProfileGenerator.cpp \
+    profiler/ProfileNode.cpp \
+    profiler/Profiler.cpp \
+    profiler/TreeProfile.cpp \
     runtime/ArgList.cpp \
     runtime/Arguments.cpp \
     runtime/ArrayConstructor.cpp \
@@ -168,62 +142,64 @@ SOURCES += \
     runtime/CallData.cpp \
     runtime/Collector.cpp \
     runtime/CommonIdentifiers.cpp \
+    runtime/Completion.cpp \
     runtime/ConstructData.cpp \
-    wtf/CurrentTime.cpp \
     runtime/DateConstructor.cpp \
     runtime/DateConversion.cpp \
     runtime/DateInstance.cpp \
     runtime/DatePrototype.cpp \
-    debugger/Debugger.cpp \
-    debugger/DebuggerCallFrame.cpp \
-    debugger/DebuggerActivation.cpp \
-    wtf/dtoa.cpp \
-    runtime/Error.cpp \
     runtime/ErrorConstructor.cpp \
+    runtime/Error.cpp \
     runtime/ErrorInstance.cpp \
     runtime/ErrorPrototype.cpp \
-    interpreter/CallFrame.cpp \
+    runtime/ExceptionHelpers.cpp \
     runtime/Executable.cpp \
     runtime/FunctionConstructor.cpp \
     runtime/FunctionPrototype.cpp \
     runtime/GetterSetter.cpp \
     runtime/GlobalEvalFunction.cpp \
     runtime/Identifier.cpp \
+    runtime/InitializeThreading.cpp \
     runtime/InternalFunction.cpp \
-    runtime/Completion.cpp \
-    runtime/JSArray.cpp \
+    runtime/JSActivation.cpp \
     runtime/JSAPIValueWrapper.cpp \
+    runtime/JSArray.cpp \
     runtime/JSByteArray.cpp \
     runtime/JSCell.cpp \
     runtime/JSFunction.cpp \
+    runtime/JSGlobalData.cpp \
+    runtime/JSGlobalObject.cpp \
     runtime/JSGlobalObjectFunctions.cpp \
     runtime/JSImmediate.cpp \
     runtime/JSLock.cpp \
+    runtime/JSNotAnObject.cpp \
     runtime/JSNumberCell.cpp \
     runtime/JSObject.cpp \
+    runtime/JSONObject.cpp \
+    runtime/JSPropertyNameIterator.cpp \
+    runtime/JSStaticScopeObject.cpp \
     runtime/JSString.cpp \
     runtime/JSValue.cpp \
+    runtime/JSVariableObject.cpp \
     runtime/JSWrapperObject.cpp \
-    parser/Lexer.cpp \
+    runtime/LiteralParser.cpp \
     runtime/Lookup.cpp \
+    runtime/MarkStack.cpp \
     runtime/MathObject.cpp \
     runtime/NativeErrorConstructor.cpp \
     runtime/NativeErrorPrototype.cpp \
-    parser/Nodes.cpp \
     runtime/NumberConstructor.cpp \
     runtime/NumberObject.cpp \
     runtime/NumberPrototype.cpp \
     runtime/ObjectConstructor.cpp \
     runtime/ObjectPrototype.cpp \
     runtime/Operations.cpp \
-    parser/Parser.cpp \
-    parser/ParserArena.cpp \
     runtime/PropertyDescriptor.cpp \
     runtime/PropertyNameArray.cpp \
     runtime/PropertySlot.cpp \
     runtime/PrototypeFunction.cpp \
-    runtime/RegExp.cpp \
     runtime/RegExpConstructor.cpp \
+    runtime/RegExp.cpp \
     runtime/RegExpObject.cpp \
     runtime/RegExpPrototype.cpp \
     runtime/ScopeChain.cpp \
@@ -231,19 +207,46 @@ SOURCES += \
     runtime/StringConstructor.cpp \
     runtime/StringObject.cpp \
     runtime/StringPrototype.cpp \
-    runtime/Structure.cpp \
     runtime/StructureChain.cpp \
+    runtime/Structure.cpp \
+    runtime/TimeoutChecker.cpp \
     runtime/UString.cpp \
-    profiler/HeavyProfile.cpp \
-    profiler/Profile.cpp \
-    profiler/ProfileGenerator.cpp \
-    profiler/ProfileNode.cpp \
-    profiler/Profiler.cpp \
-    profiler/TreeProfile.cpp \
+    wtf/Assertions.cpp \
+    wtf/ByteArray.cpp \
+    wtf/CurrentTime.cpp \
     wtf/DateMath.cpp \
+    wtf/dtoa.cpp \
     wtf/FastMalloc.cpp \
+    wtf/HashTable.cpp \
+    wtf/MainThread.cpp \
+    wtf/qt/MainThreadQt.cpp \
+    wtf/RandomNumber.cpp \
+    wtf/RefCountedLeakCounter.cpp \
     wtf/Threading.cpp \
-    wtf/qt/MainThreadQt.cpp
+    wtf/TypeTraits.cpp \
+    wtf/unicode/CollatorDefault.cpp \
+    wtf/unicode/icu/CollatorICU.cpp \
+    wtf/unicode/UTF8.cpp \
+    yarr/RegexCompiler.cpp \
+    yarr/RegexInterpreter.cpp \
+    yarr/RegexJIT.cpp
+
+symbian {
+    SOURCES += jit/ExecutableAllocatorSymbian.cpp \
+              runtime/MarkStackSymbian.cpp
+} else {
+    win32-*|wince* {
+        SOURCES += jit/ExecutableAllocatorWin.cpp \
+                  runtime/MarkStackWin.cpp
+    } else {
+        SOURCES += jit/ExecutableAllocatorPosix.cpp \
+                  runtime/MarkStackPosix.cpp
+    }
+}
+
+!contains(DEFINES, USE_SYSTEM_MALLOC) {
+    SOURCES += wtf/TCSystemAlloc.cpp
+}
 
 !contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     SOURCES += wtf/qt/ThreadingQt.cpp
diff --git a/JavaScriptCore/JavaScriptCore.pro b/JavaScriptCore/JavaScriptCore.pro
index a1affd4..0d6becb 100644
--- a/JavaScriptCore/JavaScriptCore.pro
+++ b/JavaScriptCore/JavaScriptCore.pro
@@ -52,17 +52,11 @@ win32-g++ {
     QMAKE_LIBDIR_POST += $$split(TMPPATH,";")
 }
 
-DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1
-
 DEFINES += WTF_CHANGES=1
 
 include(JavaScriptCore.pri)
 
 QMAKE_EXTRA_TARGETS += generated_files
 
-lessThan(QT_MINOR_VERSION, 4) {
-    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-}
-
 *-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
 *-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index 01f84f1..aae8118 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -1,6 +1,5 @@
-LIBRARY    "JavaScriptCore"
-
 EXPORTS
+    
     ??0Collator@WTF@@QAE@PBD@Z
     ??0DateInstance@JSC@@QAE@PAVExecState@1@N@Z
     ??0DropAllLocks@JSLock@JSC@@QAE@W4JSLockBehavior@2@@Z
@@ -27,12 +26,14 @@ EXPORTS
     ??1JSGlobalObject@JSC@@UAE@XZ
     ??1Mutex@WTF@@QAE@XZ
     ??1RefCountedLeakCounter@WTF@@QAE@XZ
+    ??1Rope@JSString@JSC@@QAE@XZ
     ??1Structure@JSC@@QAE@XZ
     ??1ThreadCondition@WTF@@QAE@XZ
     ??2JSCell@JSC@@SAPAXIPAVExecState@1@@Z
     ??2JSGlobalObject@JSC@@SAPAXIPAVJSGlobalData@1@@Z
     ??4UString@JSC@@QAEAAV01@PBD@Z
     ??8JSC@@YA_NABVUString@0@0@Z
+    ?NaN@JSC@@3NB
     ?UTF8String@UString@JSC@@QBE?AVCString@2@_N@Z
     ?add@Identifier@JSC@@SA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVExecState@2@PBD@Z
     ?add@PropertyNameArray@JSC@@QAEXPAURep@UString@2@@Z
@@ -52,6 +53,7 @@ EXPORTS
     ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
     ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z
     ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
+    ?callOnMainThreadAndWait@WTF@@YAXP6AXPAX@Z0@Z
     ?changePrototypeTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@VJSValue@2@@Z
     ?checkSameIdentifierTable@Identifier@JSC@@CAXPAVExecState@2@PAURep@UString@2@@Z
     ?checkSameIdentifierTable@Identifier@JSC@@CAXPAVJSGlobalData@2@PAURep@UString@2@@Z
@@ -114,6 +116,7 @@ EXPORTS
     ?detachThread@WTF@@YAXI@Z
     ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z
     ?dumpSampleData@JSGlobalData@JSC@@QAEXPAVExecState@2@@Z
+    ?doubleToStringInJavaScriptFormat@WTF@@YAXNQADPAI@Z
     ?enumerable@PropertyDescriptor@JSC@@QBE_NXZ
     ?equal@Identifier@JSC@@SA_NPBURep@UString@2@PBD@Z
     ?equal@JSC@@YA_NPBURep@UString@1@0@Z
@@ -152,13 +155,11 @@ EXPORTS
     ?getPrimitiveNumber@JSCell@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
     ?getPrimitiveNumber@JSObject@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
     ?getPrimitiveNumber@JSString@JSC@@EAE_NPAVExecState@2@AANAAVJSValue@2@@Z
-    ?getPropertyAttributes@JSObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
-    ?getPropertyAttributes@JSVariableObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
     ?getPropertyDescriptor@JSObject@JSC@@QAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
     ?getPropertyNames@JSObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
     ?getSlice@ArgList@JSC@@QBEXHAAV12@@Z
-    ?getString@JSCell@JSC@@QBE?AVUString@2@XZ
-    ?getString@JSCell@JSC@@QBE_NAAVUString@2@@Z
+    ?getString@JSCell@JSC@@QBE?AVUString@2@PAVExecState@2@@Z
+    ?getString@JSCell@JSC@@QBE_NPAVExecState@2@AAVUString@2@@Z
     ?getUInt32@JSCell@JSC@@UBE_NAAI@Z
     ?getter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
     ?globalExec@JSGlobalObject@JSC@@UAEPAVExecState@2@XZ
@@ -197,7 +198,7 @@ EXPORTS
     ?markChildren@JSObject@JSC@@UAEXAAVMarkStack@2@@Z
     ?markChildren@JSWrapperObject@JSC@@EAEXAAVMarkStack@2@@Z
     ?materializePropertyMap@Structure@JSC@@AAEXXZ
-    ?name@InternalFunction@JSC@@QAEABVUString@2@PAVJSGlobalData@2@@Z
+    ?name@InternalFunction@JSC@@QAEABVUString@2@PAVExecState@2@@Z
     ?nonInlineNaN@JSC@@YANXZ
     ?objectCount@Heap@JSC@@QAEIXZ
     ?objectProtoFuncToString@JSC@@YI?AVJSValue@1@PAVExecState@1@PAVJSObject@1@V21@ABVArgList@1@@Z
@@ -227,6 +228,8 @@ EXPORTS
     ?releaseStack@MarkStack@JSC@@CAXPAXI@Z
     ?reset@ParserArena@JSC@@QAEXXZ
     ?reset@TimeoutChecker@JSC@@QAEXXZ
+    ?resetDateCache@JSGlobalData@JSC@@QAEXXZ
+    ?resolveRope@JSString@JSC@@ABEXPAVExecState@2@@Z
     ?restoreAll@Profile@JSC@@QAEXXZ
     ?retrieveCaller@Interpreter@JSC@@QBE?AVJSValue@2@PAVExecState@2@PAVInternalFunction@2@@Z
     ?retrieveLastCaller@Interpreter@JSC@@QBEXPAVExecState@2@AAH1AAVUString@2@AAVJSValue@2@@Z
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index bf25a85..5b7f9ad 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -668,6 +668,14 @@
 				RelativePath="..\..\runtime\DateInstanceCache.h"

 				>

 			</File>

+                        <File

+                                RelativePath="..\..\wtf\DateMath.cpp"

+                                >

+                        </File>

+                        <File

+                                RelativePath="..\..\wtf\DateMath.h"

+                                >

+                        </File>

 			<File

 				RelativePath="..\..\runtime\DatePrototype.cpp"

 				>

@@ -1204,6 +1212,10 @@
 				RelativePath="..\..\runtime\UString.h"

 				>

 			</File>

+			<File

+				RelativePath="..\..\runtime\WeakRandom.h"

+				>

+			</File>

 			<Filter

 				Name="DerivedSources"

 				>

@@ -1537,6 +1549,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\bytecompiler\NodesCodegen.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\..\bytecompiler\Label.h"

 				>

 			</File>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
index 9fd7ad4..92479bb 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
@@ -7,6 +7,7 @@ all:
     xcopy /y /d "..\..\API\JavaScript.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
     xcopy /y /d "..\..\API\JSBase.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
     xcopy /y /d "..\..\API\JSContextRef.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSContextRefPrivate.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
     xcopy /y /d "..\..\API\JSObjectRef.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
     xcopy /y /d "..\..\API\JSStringRef.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
     xcopy /y /d "..\..\API\JSStringRefCF.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index 67c004c..78f507a 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -285,14 +285,6 @@
 			>

 		</File>

 		<File

-			RelativePath="..\..\wtf\DateMath.cpp"

-			>

-		</File>

-		<File

-			RelativePath="..\..\wtf\DateMath.h"

-			>

-		</File>

-		<File

 			RelativePath="..\..\wtf\Deque.h"

 			>

 		</File>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
index 7e8a193..1a8f8b6 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
+++ b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
@@ -1,25 +1,25 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jscCommon"
-	>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../assembler/;../../wrec/;../../parser/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;../../../icu/include;&quot;$(WebKitLibrariesDir)\include&quot;;../../jit/"
-		PreprocessorDefinitions="__STD_C"
-	/>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WTF$(WebKitConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"
-		SubSystem="1"
-	/>
-	<Tool
-		Name="VCPostBuildEventTool"
-		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\objc$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\objc$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\ASL$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\ASL$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;cmd /c&#x0D;&#x0A;"
-	/>
-	<Tool
-		Name="VCPreBuildEventTool"
-		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscCommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\JavaScriptCore\$(ConfigurationName)\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../assembler/;../../wrec/;../../parser/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;../../../icu/include;&quot;$(WebKitLibrariesDir)\include&quot;;../../jit/"

+		PreprocessorDefinitions="__STD_C"

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WTF$(WebKitConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"

+		SubSystem="1"

+	/>

+	<Tool

+		Name="VCPostBuildEventTool"

+		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\objc$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\objc$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\ASL$(LibraryConfigSuffix).dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\ASL$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;cmd /c&#x0D;&#x0A;"

+	/>

+	<Tool

+		Name="VCPreBuildEventTool"

+		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 48cf396..e766243 100644
--- a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -51,6 +51,7 @@
 		140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		141211310A48794D00480255 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
 		141211340A48795800480255 /* minidom.c in Sources */ = {isa = PBXBuildFile; fileRef = 141211020A48780900480255 /* minidom.c */; };
+		1420BE7B10AA6DDB00F455D2 /* WeakRandom.h in Headers */ = {isa = PBXBuildFile; fileRef = 1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1421359B0A677F4F00A8195E /* JSBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1421359A0A677F4F00A8195E /* JSBase.cpp */; };
 		14280823107EC02C0013E7B2 /* Debugger.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8580255597D01FF60F7 /* Debugger.cpp */; };
 		1428082D107EC0570013E7B2 /* CallData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA62DFE0E2826230004F30D /* CallData.cpp */; };
@@ -187,6 +188,7 @@
 		5D6A566B0F05995500266145 /* Threading.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D6A566A0F05995500266145 /* Threading.cpp */; };
 		5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */ = {isa = PBXBuildFile; fileRef = F692A8540255597D01FF60F7 /* create_hash_table */; settings = {ATTRIBUTES = (); }; };
 		6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 655EB29A10CE2581001A990E /* NodesCodegen.cpp */; };
 		65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DFC92D08EA173A00F7300B /* HashTable.cpp */; };
 		65FDE49C0BDD1D4A00E80111 /* Assertions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B808E7EECC0023E5F6 /* Assertions.cpp */; settings = {COMPILER_FLAGS = "-Wno-missing-format-attribute"; }; };
 		7E2ADD8E0E79AAD500D50C51 /* CharacterClassConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E2ADD8D0E79AAD500D50C51 /* CharacterClassConstructor.h */; };
@@ -283,6 +285,7 @@
 		A7A1F7AC0F252B3C00E184E2 /* ByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7A1F7AA0F252B3C00E184E2 /* ByteArray.cpp */; };
 		A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */; };
+		A7C2217810C7479400F97913 /* JSZombie.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C2216B10C7469C00F97913 /* JSZombie.cpp */; };
 		A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */; };
 		A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D649A91015224E009B2E1B /* PossiblyNull.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
@@ -561,6 +564,7 @@
 		1412110D0A48788700480255 /* minidom.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = minidom.js; path = tests/minidom.js; sourceTree = "<group>"; };
 		141211200A48793C00480255 /* minidom */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = minidom; sourceTree = BUILT_PRODUCTS_DIR; };
 		1419D32C0CEA7CDE00FF507A /* RefCounted.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RefCounted.h; sourceTree = "<group>"; };
+		1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakRandom.h; sourceTree = "<group>"; };
 		1421359A0A677F4F00A8195E /* JSBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBase.cpp; sourceTree = "<group>"; };
 		142711380A460BBB0080EEEA /* JSBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBase.h; sourceTree = "<group>"; };
 		1429D77B0ED20D7300B89619 /* Interpreter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Interpreter.h; sourceTree = "<group>"; };
@@ -678,6 +682,7 @@
 		6541BD6F08E80A17002CBEE7 /* TCSpinLock.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = TCSpinLock.h; sourceTree = "<group>"; tabWidth = 8; };
 		6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TCSystemAlloc.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		6541BD7108E80A17002CBEE7 /* TCSystemAlloc.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = TCSystemAlloc.h; sourceTree = "<group>"; tabWidth = 8; };
+		655EB29A10CE2581001A990E /* NodesCodegen.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NodesCodegen.cpp; sourceTree = "<group>"; };
 		6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreFoundation.framework; path = /System/Library/Frameworks/CoreFoundation.framework; sourceTree = "<absolute>"; };
 		65621E6B089E859700760F35 /* PropertySlot.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertySlot.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		65621E6C089E859700760F35 /* PropertySlot.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = PropertySlot.h; sourceTree = "<group>"; tabWidth = 8; };
@@ -835,6 +840,8 @@
 		A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByteArray.h; sourceTree = "<group>"; };
 		A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableAllocator.h; sourceTree = "<group>"; };
 		A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocator.cpp; sourceTree = "<group>"; };
+		A7C2216810C745E000F97913 /* JSZombie.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSZombie.h; sourceTree = "<group>"; };
+		A7C2216B10C7469C00F97913 /* JSZombie.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSZombie.cpp; sourceTree = "<group>"; };
 		A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStackPosix.cpp; sourceTree = "<group>"; };
 		A7D649A91015224E009B2E1B /* PossiblyNull.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PossiblyNull.h; sourceTree = "<group>"; };
 		A7E2EA690FB460CF00601F06 /* LiteralParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiteralParser.h; sourceTree = "<group>"; };
@@ -1385,6 +1392,7 @@
 			isa = PBXGroup;
 			children = (
 				969A07200ED1CE3300F1F681 /* BytecodeGenerator.cpp */,
+				655EB29A10CE2581001A990E /* NodesCodegen.cpp */,
 				969A07210ED1CE3300F1F681 /* BytecodeGenerator.h */,
 				969A07270ED1CE6900F1F681 /* Label.h */,
 				960097A50EBABB58007A7297 /* LabelScope.h */,
@@ -1593,6 +1601,9 @@
 				5D53726E0E1C54880021E549 /* Tracing.h */,
 				F692A8850255597D01FF60F7 /* UString.cpp */,
 				F692A8860255597D01FF60F7 /* UString.h */,
+				1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */,
+				A7C2216810C745E000F97913 /* JSZombie.h */,
+				A7C2216B10C7469C00F97913 /* JSZombie.cpp */,
 			);
 			path = runtime;
 			sourceTree = "<group>";
@@ -2002,6 +2013,7 @@
 				BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */,
 				148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */,
 				14A1563210966365006FA260 /* DateInstanceCache.h in Headers */,
+				1420BE7B10AA6DDB00F455D2 /* WeakRandom.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2184,7 +2196,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\ntouch \"$SRCROOT/Info.plist\"\n";
+			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\nif [[ \"${CONFIGURATION}\" != \"Production\" ]]; then\n    touch \"$SRCROOT/Info.plist\";\nfi;\n";
 		};
 		5D35DEE10C7C140B008648B2 /* Generate DTrace header */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -2444,6 +2456,8 @@
 				1429DA820ED2482900B89619 /* WRECFunctors.cpp in Sources */,
 				1429DAE10ED2645B00B89619 /* WRECGenerator.cpp in Sources */,
 				1429DAC00ED263E700B89619 /* WRECParser.cpp in Sources */,
+				A7C2217810C7479400F97913 /* JSZombie.cpp in Sources */,
+				655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/JavaScriptCore/JavaScriptCoreSources.bkl b/JavaScriptCore/JavaScriptCoreSources.bkl
index 1852d12..1f36c1c 100644
--- a/JavaScriptCore/JavaScriptCoreSources.bkl
+++ b/JavaScriptCore/JavaScriptCoreSources.bkl
@@ -43,6 +43,7 @@ Source files for JSCore.
     </set>
     <set append="1" var="JSCORE_BYTECOMPILER_SOURCES">
         bytecompiler/BytecodeGenerator.cpp
+        bytecompiler/NodesCodegen.cpp
     </set>
     <set append="1" var="JSCORE_DEBUGGER_SOURCES">
         debugger/Debugger.cpp
@@ -89,6 +90,7 @@ Source files for JSCore.
         runtime/DateConstructor.cpp
         runtime/DateConversion.cpp
         runtime/DateInstance.cpp
+        wtf/DateMath.cpp
         runtime/DatePrototype.cpp
         runtime/Error.cpp
         runtime/ErrorConstructor.cpp
@@ -173,7 +175,6 @@ Source files for JSCore.
         wtf/Assertions.cpp
         wtf/ByteArray.cpp
         wtf/CurrentTime.cpp
-        wtf/DateMath.cpp
         wtf/FastMalloc.cpp
         wtf/HashTable.cpp
         wtf/MainThread.cpp
diff --git a/JavaScriptCore/assembler/ARMAssembler.cpp b/JavaScriptCore/assembler/ARMAssembler.cpp
index 1324586..81c3222 100644
--- a/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -118,7 +118,7 @@ ARMWord ARMAssembler::getOp2(ARMWord imm)
     if ((imm & 0x00ffffff) == 0)
         return OP2_IMM | (imm >> 24) | (rol << 8);
 
-    return 0;
+    return INVALID_IMM;
 }
 
 int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
@@ -236,25 +236,18 @@ ARMWord ARMAssembler::getImm(ARMWord imm, int tmpReg, bool invert)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp)
+    if (tmp != INVALID_IMM)
         return tmp;
 
     tmp = getOp2(~imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         if (invert)
             return tmp | OP2_INV_IMM;
         mvn_r(tmpReg, tmp);
         return tmpReg;
     }
 
-    // Do it by 2 instruction
-    if (genInt(tmpReg, imm, true))
-        return tmpReg;
-    if (genInt(tmpReg, ~imm, false))
-        return tmpReg;
-
-    ldr_imm(tmpReg, imm);
-    return tmpReg;
+    return encodeComplexImm(imm, tmpReg);
 }
 
 void ARMAssembler::moveImm(ARMWord imm, int dest)
@@ -263,24 +256,43 @@ void ARMAssembler::moveImm(ARMWord imm, int dest)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         mov_r(dest, tmp);
         return;
     }
 
     tmp = getOp2(~imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         mvn_r(dest, tmp);
         return;
     }
 
+    encodeComplexImm(imm, dest);
+}
+
+ARMWord ARMAssembler::encodeComplexImm(ARMWord imm, int dest)
+{
+    ARMWord tmp;
+
+#if ARM_ARCH_VERSION >= 7
+    tmp = getImm16Op2(imm);
+    if (tmp != INVALID_IMM) {
+        movw_r(dest, tmp);
+        return dest;
+    }
+    movw_r(dest, getImm16Op2(imm & 0xffff));
+    movt_r(dest, getImm16Op2(imm >> 16));
+    return dest;
+#else
     // Do it by 2 instruction
     if (genInt(dest, imm, true))
-        return;
+        return dest;
     if (genInt(dest, ~imm, false))
-        return;
+        return dest;
 
     ldr_imm(dest, imm);
+    return dest;
+#endif
 }
 
 // Memory load/store helpers
diff --git a/JavaScriptCore/assembler/ARMAssembler.h b/JavaScriptCore/assembler/ARMAssembler.h
index 9f9a450..712473e 100644
--- a/JavaScriptCore/assembler/ARMAssembler.h
+++ b/JavaScriptCore/assembler/ARMAssembler.h
@@ -121,6 +121,7 @@ namespace JSC {
             MUL = 0x00000090,
             MULL = 0x00c00090,
             FADDD = 0x0e300b00,
+            FDIVD = 0x0e800b00,
             FSUBD = 0x0e300b40,
             FMULD = 0x0e200b00,
             FCMPD = 0x0eb40b40,
@@ -133,12 +134,18 @@ namespace JSC {
             B = 0x0a000000,
             BL = 0x0b000000,
             FMSR = 0x0e000a10,
+            FMRS = 0x0e100a10,
             FSITOD = 0x0eb80bc0,
+            FTOSID = 0x0ebd0b40,
             FMSTAT = 0x0ef1fa10,
 #if ARM_ARCH_VERSION >= 5
             CLZ = 0x016f0f10,
             BKPT = 0xe120070,
 #endif
+#if ARM_ARCH_VERSION >= 7
+            MOVW = 0x03000000,
+            MOVT = 0x03400000,
+#endif
         };
 
         enum {
@@ -175,6 +182,8 @@ namespace JSC {
             padForAlign32 = 0xee120070,
         };
 
+        static const ARMWord INVALID_IMM = 0xf0000000;
+
         class JmpSrc {
             friend class ARMAssembler;
         public:
@@ -333,6 +342,20 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | MOV, rd, ARMRegisters::r0, op2);
         }
 
+#if ARM_ARCH_VERSION >= 7
+        void movw_r(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVW | RD(rd) | op2);
+        }
+
+        void movt_r(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVT | RD(rd) | op2);
+        }
+#endif
+
         void movs_r(int rd, ARMWord op2, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | MOV | SET_CC, rd, ARMRegisters::r0, op2);
@@ -378,6 +401,11 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | FADDD, dd, dn, dm);
         }
 
+        void fdivd_r(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FDIVD, dd, dn, dm);
+        }
+
         void fsubd_r(int dd, int dn, int dm, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | FSUBD, dd, dn, dm);
@@ -482,11 +510,21 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | FMSR, rn, dd, 0);
         }
 
+        void fmrs_r(int rd, int dn, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FMRS, rd, dn, 0);
+        }
+
         void fsitod_r(int dd, int dm, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | FSITOD, dd, 0, dm);
         }
 
+        void ftosid_r(int fd, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FTOSID, fd, 0, dm);
+        }
+
         void fmstat(Condition cc = AL)
         {
             m_buffer.putInt(static_cast<ARMWord>(cc) | FMSTAT);
@@ -708,8 +746,18 @@ namespace JSC {
         }
 
         static ARMWord getOp2(ARMWord imm);
+
+#if ARM_ARCH_VERSION >= 7
+        static ARMWord getImm16Op2(ARMWord imm)
+        {
+            if (imm <= 0xffff)
+                return (imm & 0xf000) << 4 | (imm & 0xfff);
+            return INVALID_IMM;
+        }
+#endif
         ARMWord getImm(ARMWord imm, int tmpReg, bool invert = false);
         void moveImm(ARMWord imm, int dest);
+        ARMWord encodeComplexImm(ARMWord imm, int dest);
 
         // Memory load/store helpers
 
diff --git a/JavaScriptCore/assembler/ARMv7Assembler.h b/JavaScriptCore/assembler/ARMv7Assembler.h
index 02ce2e9..e253a53 100644
--- a/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -236,6 +236,11 @@ class ARMThumbImmediate {
     ARMThumbImmediate(ThumbImmediateType type, uint16_t value)
         : m_type(TypeUInt16)
     {
+        // Make sure this constructor is only reached with type TypeUInt16;
+        // this extra parameter makes the code a little clearer by making it
+        // explicit at call sites which type is being constructed
+        ASSERT_UNUSED(type, type == TypeUInt16);
+
         m_value.asInt = value;
     }
 
diff --git a/JavaScriptCore/assembler/MacroAssembler.h b/JavaScriptCore/assembler/MacroAssembler.h
index 2743ab4..858707d 100644
--- a/JavaScriptCore/assembler/MacroAssembler.h
+++ b/JavaScriptCore/assembler/MacroAssembler.h
@@ -179,16 +179,6 @@ public:
         or32(imm, dest);
     }
 
-    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
-    {
-        rshift32(shift_amount, dest);
-    }
-
-    void rshiftPtr(Imm32 imm, RegisterID dest)
-    {
-        rshift32(imm, dest);
-    }
-
     void subPtr(RegisterID src, RegisterID dest)
     {
         sub32(src, dest);
diff --git a/JavaScriptCore/assembler/MacroAssemblerARM.h b/JavaScriptCore/assembler/MacroAssemblerARM.h
index 7a72b06..24e2e11 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -38,6 +38,9 @@
 namespace JSC {
 
 class MacroAssemblerARM : public AbstractMacroAssembler<ARMAssembler> {
+    static const int DoubleConditionMask = 0x0f;
+    static const int DoubleConditionBitSpecial = 0x10;
+    COMPILE_ASSERT(!(DoubleConditionBitSpecial & DoubleConditionMask), DoubleConditionBitSpecial_should_not_interfere_with_ARMAssembler_Condition_codes);
 public:
     enum Condition {
         Equal = ARMAssembler::EQ,
@@ -57,11 +60,20 @@ public:
     };
 
     enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
         DoubleEqual = ARMAssembler::EQ,
+        DoubleNotEqual = ARMAssembler::NE | DoubleConditionBitSpecial,
         DoubleGreaterThan = ARMAssembler::GT,
         DoubleGreaterThanOrEqual = ARMAssembler::GE,
-        DoubleLessThan = ARMAssembler::LT,
-        DoubleLessThanOrEqual = ARMAssembler::LE,
+        DoubleLessThan = ARMAssembler::CC,
+        DoubleLessThanOrEqual = ARMAssembler::LS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMAssembler::EQ | DoubleConditionBitSpecial,
+        DoubleNotEqualOrUnordered = ARMAssembler::NE,
+        DoubleGreaterThanOrUnordered = ARMAssembler::HI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMAssembler::CS,
+        DoubleLessThanOrUnordered = ARMAssembler::LT,
+        DoubleLessThanOrEqualOrUnordered = ARMAssembler::LE,
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
@@ -106,14 +118,18 @@ public:
             m_assembler.ands_r(dest, dest, w);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
+        ARMWord w = ARMAssembler::getOp2(0x1f);
+        ASSERT(w != ARMAssembler::INVALID_IMM);
+        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+
+        m_assembler.movs_r(dest, m_assembler.lsl_r(dest, ARMRegisters::S0));
     }
 
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+    void lshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.lsl_r(dest, shift_amount));
+        m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
     }
 
     void mul32(RegisterID src, RegisterID dest)
@@ -131,6 +147,11 @@ public:
         m_assembler.muls_r(dest, src, ARMRegisters::S0);
     }
 
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.rsbs_r(srcDest, srcDest, ARMAssembler::getOp2(0));
+    }
+
     void not32(RegisterID dest)
     {
         m_assembler.mvns_r(dest, dest);
@@ -148,7 +169,11 @@ public:
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.asr_r(dest, shift_amount));
+        ARMWord w = ARMAssembler::getOp2(0x1f);
+        ASSERT(w != ARMAssembler::INVALID_IMM);
+        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+
+        m_assembler.movs_r(dest, m_assembler.asr_r(dest, ARMRegisters::S0));
     }
 
     void rshift32(Imm32 imm, RegisterID dest)
@@ -505,6 +530,13 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
+    Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+        or32(src, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
     void breakpoint()
     {
         m_assembler.bkpt(0);
@@ -548,6 +580,25 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
+    void set8(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        set32(cond, left, right, dest);
+    }
+
+    void set8(Condition cond, Address left, RegisterID right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        load32(left, ARMRegisters::S1);
+        set32(cond, ARMRegisters::S1, right, dest);
+    }
+
+    void set8(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        set32(cond, left, right, dest);
+    }
+
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
         load32(address, ARMRegisters::S1);
@@ -559,6 +610,12 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
+    void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        setTest32(cond, address, mask, dest);
+    }
+
     void add32(Imm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
@@ -666,6 +723,12 @@ public:
         m_assembler.doubleTransfer(true, dest, address.base, address.offset);
     }
 
+    void loadDouble(void* address, FPRegisterID dest)
+    {
+        m_assembler.ldr_un_imm(ARMRegisters::S0, (ARMWord)address);
+        m_assembler.fdtr_u(true, dest, ARMRegisters::S0, 0);
+    }
+
     void storeDouble(FPRegisterID src, ImplicitAddress address)
     {
         m_assembler.doubleTransfer(false, src, address.base, address.offset);
@@ -682,6 +745,18 @@ public:
         addDouble(ARMRegisters::SD0, dest);
     }
 
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fdivd_r(dest, dest, src);
+    }
+
+    void divDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        loadDouble(src, ARMRegisters::SD0);
+        divDouble(ARMRegisters::SD0, dest);
+    }
+
     void subDouble(FPRegisterID src, FPRegisterID dest)
     {
         m_assembler.fsubd_r(dest, dest, src);
@@ -710,11 +785,30 @@ public:
         m_assembler.fsitod_r(dest, dest);
     }
 
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        // flds does not worth the effort here
+        load32(src, ARMRegisters::S1);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        // flds does not worth the effort here
+        m_assembler.ldr_un_imm(ARMRegisters::S1, (ARMWord)src.m_ptr);
+        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         m_assembler.fcmpd_r(left, right);
         m_assembler.fmstat();
-        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond)));
+        if (cond & DoubleConditionBitSpecial)
+            m_assembler.cmp_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::VS);
+        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond & ~DoubleConditionMask)));
     }
 
     // Truncates 'src' to an integer, and places the resulting 'dest'.
@@ -729,6 +823,29 @@ public:
         return jump();
     }
 
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        m_assembler.ftosid_r(ARMRegisters::SD0, src);
+        m_assembler.fmrs_r(dest, ARMRegisters::SD0);
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        m_assembler.fsitod_r(ARMRegisters::SD0, ARMRegisters::SD0);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, ARMRegisters::SD0));
+
+        // If the result is zero, it might have been -0.0, and 0.0 equals to -0.0
+        failureCases.append(branchTest32(Zero, dest));
+    }
+
+    void zeroDouble(FPRegisterID srcDest)
+    {
+        m_assembler.mov_r(ARMRegisters::S0, ARMAssembler::getOp2(0));
+        convertInt32ToDouble(ARMRegisters::S0, srcDest);
+    }
+
 protected:
     ARMAssembler::Condition ARMCondition(Condition cond)
     {
diff --git a/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index c479517..532a9cf 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -93,13 +93,21 @@ public:
         Zero = ARMv7Assembler::ConditionEQ,
         NonZero = ARMv7Assembler::ConditionNE
     };
-
     enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
         DoubleEqual = ARMv7Assembler::ConditionEQ,
+        DoubleNotEqual = ARMv7Assembler::ConditionVC, // Not the right flag! check for this & handle differently.
         DoubleGreaterThan = ARMv7Assembler::ConditionGT,
         DoubleGreaterThanOrEqual = ARMv7Assembler::ConditionGE,
         DoubleLessThan = ARMv7Assembler::ConditionLO,
         DoubleLessThanOrEqual = ARMv7Assembler::ConditionLS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMv7Assembler::ConditionVS, // Not the right flag! check for this & handle differently.
+        DoubleNotEqualOrUnordered = ARMv7Assembler::ConditionNE,
+        DoubleGreaterThanOrUnordered = ARMv7Assembler::ConditionHI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMv7Assembler::ConditionHS,
+        DoubleLessThanOrUnordered = ARMv7Assembler::ConditionLT,
+        DoubleLessThanOrEqualOrUnordered = ARMv7Assembler::ConditionLE,
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
@@ -189,14 +197,19 @@ public:
         }
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.lsl(dest, dest, imm.m_value);
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shift_amount, armImm);
+
+        m_assembler.lsl(dest, dest, dataTempRegister);
     }
 
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+    void lshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.lsl(dest, dest, shift_amount);
+        m_assembler.lsl(dest, dest, imm.m_value & 0x1f);
     }
 
     void mul32(RegisterID src, RegisterID dest)
@@ -233,12 +246,17 @@ public:
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.asr(dest, dest, shift_amount);
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shift_amount, armImm);
+
+        m_assembler.asr(dest, dest, dataTempRegister);
     }
 
     void rshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.asr(dest, dest, imm.m_value);
+        m_assembler.asr(dest, dest, imm.m_value & 0x1f);
     }
 
     void sub32(RegisterID src, RegisterID dest)
@@ -531,6 +549,23 @@ public:
     {
         m_assembler.vcmp_F64(left, right);
         m_assembler.vmrs_APSR_nzcv_FPSCR();
+
+        if (cond == DoubleNotEqual) {
+            // ConditionNE jumps if NotEqual *or* unordered - force the unordered cases not to jump.
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump result = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            return result;
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump notEqual = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            // We get here if either unordered, or equal.
+            Jump result = makeJump();
+            notEqual.link(this);
+            return result;
+        }
         return makeBranch(cond);
     }
 
diff --git a/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index 5ebefa7..96d21f1 100644
--- a/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -36,6 +36,10 @@
 namespace JSC {
 
 class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler> {
+    static const int DoubleConditionBitInvert = 0x10;
+    static const int DoubleConditionBitSpecial = 0x20;
+    static const int DoubleConditionBits = DoubleConditionBitInvert | DoubleConditionBitSpecial;
+
 public:
 
     enum Condition {
@@ -56,13 +60,24 @@ public:
     };
 
     enum DoubleCondition {
-        DoubleEqual = X86Assembler::ConditionE,
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
+        DoubleEqual = X86Assembler::ConditionE | DoubleConditionBitSpecial,
         DoubleNotEqual = X86Assembler::ConditionNE,
         DoubleGreaterThan = X86Assembler::ConditionA,
         DoubleGreaterThanOrEqual = X86Assembler::ConditionAE,
-        DoubleLessThan = X86Assembler::ConditionB,
-        DoubleLessThanOrEqual = X86Assembler::ConditionBE,
+        DoubleLessThan = X86Assembler::ConditionA | DoubleConditionBitInvert,
+        DoubleLessThanOrEqual = X86Assembler::ConditionAE | DoubleConditionBitInvert,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = X86Assembler::ConditionE,
+        DoubleNotEqualOrUnordered = X86Assembler::ConditionNE | DoubleConditionBitSpecial,
+        DoubleGreaterThanOrUnordered = X86Assembler::ConditionB | DoubleConditionBitInvert,
+        DoubleGreaterThanOrEqualOrUnordered = X86Assembler::ConditionBE | DoubleConditionBitInvert,
+        DoubleLessThanOrUnordered = X86Assembler::ConditionB,
+        DoubleLessThanOrEqualOrUnordered = X86Assembler::ConditionBE,
     };
+    COMPILE_ASSERT(
+        !((X86Assembler::ConditionE | X86Assembler::ConditionNE | X86Assembler::ConditionA | X86Assembler::ConditionAE | X86Assembler::ConditionB | X86Assembler::ConditionBE) & DoubleConditionBits),
+        DoubleConditionBits_should_not_interfere_with_X86Assembler_Condition_codes);
 
     static const RegisterID stackPointerRegister = X86Registers::esp;
 
@@ -416,20 +431,35 @@ public:
 
     void convertInt32ToDouble(Address src, FPRegisterID dest)
     {
+        ASSERT(isSSE2Present());
         m_assembler.cvtsi2sd_mr(src.offset, src.base, dest);
     }
 
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         ASSERT(isSSE2Present());
-        m_assembler.ucomisd_rr(right, left);
-        return Jump(m_assembler.jCC(x86Condition(cond)));
-    }
 
-    Jump branchDouble(DoubleCondition cond, FPRegisterID left, Address right)
-    {
-        m_assembler.ucomisd_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jCC(x86Condition(cond)));
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomisd_rr(left, right);
+        else
+            m_assembler.ucomisd_rr(right, left);
+
+        if (cond == DoubleEqual) {
+            Jump isUnordered(m_assembler.jp());
+            Jump result = Jump(m_assembler.je());
+            isUnordered.link(this);
+            return result;
+        } else if (cond == DoubleNotEqualOrUnordered) {
+            Jump isUnordered(m_assembler.jp());
+            Jump isEqual(m_assembler.je());
+            isUnordered.link(this);
+            Jump result = jump();
+            isEqual.link(this);
+            return result;
+        }
+
+        ASSERT(!(cond & DoubleConditionBitSpecial));
+        return Jump(m_assembler.jCC(static_cast<X86Assembler::Condition>(cond & ~DoubleConditionBits)));
     }
 
     // Truncates 'src' to an integer, and places the resulting 'dest'.
@@ -443,6 +473,25 @@ public:
         return branch32(Equal, dest, Imm32(0x80000000));
     }
 
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+
+        // If the result is zero, it might have been -0.0, and the double comparison won't catch this!
+        failureCases.append(branchTest32(Zero, dest));
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        convertInt32ToDouble(dest, fpTemp);
+        m_assembler.ucomisd_rr(fpTemp, src);
+        failureCases.append(m_assembler.jp());
+        failureCases.append(m_assembler.jne());
+    }
+
     void zeroDouble(FPRegisterID srcDest)
     {
         ASSERT(isSSE2Present());
@@ -509,7 +558,8 @@ public:
 
     void swap(RegisterID reg1, RegisterID reg2)
     {
-        m_assembler.xchgq_rr(reg1, reg2);
+        if (reg1 != reg2)
+            m_assembler.xchgq_rr(reg1, reg2);
     }
 
     void signExtend32ToPtr(RegisterID src, RegisterID dest)
@@ -889,11 +939,6 @@ protected:
         return static_cast<X86Assembler::Condition>(cond);
     }
 
-    X86Assembler::Condition x86Condition(DoubleCondition cond)
-    {
-        return static_cast<X86Assembler::Condition>(cond);
-    }
-
 private:
     // Only MacroAssemblerX86 should be using the following method; SSE2 is always available on
     // x86_64, and clients & subclasses of MacroAssembler should be using 'supportsFloatingPoint()'.
diff --git a/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index 0f95fe6..7828cf5 100644
--- a/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -192,33 +192,6 @@ public:
         m_assembler.orq_ir(imm.m_value, dest);
     }
 
-    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
-    {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
-            swap(shift_amount, X86Registers::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarq_CLr(X86Registers::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.sarq_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarq_CLr(dest);
-        
-            swap(shift_amount, X86Registers::ecx);
-        } else
-            m_assembler.sarq_CLr(dest);
-    }
-
-    void rshiftPtr(Imm32 imm, RegisterID dest)
-    {
-        m_assembler.sarq_i8r(imm.m_value, dest);
-    }
-
     void subPtr(RegisterID src, RegisterID dest)
     {
         m_assembler.subq_rr(src, dest);
diff --git a/JavaScriptCore/bytecode/CodeBlock.cpp b/JavaScriptCore/bytecode/CodeBlock.cpp
index c915934..13bed8c 100644
--- a/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -71,17 +71,9 @@ static UString valueToSourceString(ExecState* exec, JSValue val)
     return val.toString(exec);
 }
 
-static CString registerName(int r)
-{
-    if (r == missingThisObjectMarker())
-        return "<null>";
-
-    return (UString("r") + UString::from(r)).UTF8String();
-}
-
 static CString constantName(ExecState* exec, int k, JSValue value)
 {
-    return (valueToSourceString(exec, value) + "(@k" + UString::from(k) + ")").UTF8String();
+    return (valueToSourceString(exec, value) + "(@k" + UString::from(k - FirstConstantRegisterIndex) + ")").UTF8String();
 }
 
 static CString idName(int id0, const Identifier& ident)
@@ -89,6 +81,17 @@ static CString idName(int id0, const Identifier& ident)
     return (ident.ustring() + "(@id" + UString::from(id0) +")").UTF8String();
 }
 
+CString CodeBlock::registerName(ExecState* exec, int r) const
+{
+    if (r == missingThisObjectMarker())
+        return "<null>";
+
+    if (isConstantRegisterIndex(r))
+        return constantName(exec, r, getConstant(r));
+
+    return (UString("r") + UString::from(r)).UTF8String();
+}
+
 static UString regexpToSourceString(RegExp* regExp)
 {
     UString pattern = UString("/") + regExp->pattern() + "/";
@@ -135,44 +138,44 @@ NEVER_INLINE static const char* debugHookName(int debugHookID)
     return "";
 }
 
-static void printUnaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
+void CodeBlock::printUnaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
 
-    printf("[%4d] %s\t\t %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str());
+    printf("[%4d] %s\t\t %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
 }
 
-static void printBinaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
+void CodeBlock::printBinaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int r2 = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+    printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
 }
 
-static void printConditionalJump(const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op)
+void CodeBlock::printConditionalJump(ExecState* exec, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int offset = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, location + offset);
+    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(exec, r0).c_str(), offset, location + offset);
 }
 
-static void printGetByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
+void CodeBlock::printGetByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
     it += 4;
 }
 
-static void printPutByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
+void CodeBlock::printPutByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
     it += 4;
 }
 
@@ -357,7 +360,7 @@ void CodeBlock::dump(ExecState* exec) const
         unsigned registerIndex = m_numVars;
         size_t i = 0;
         do {
-            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
+            printf("   k%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
             ++i;
             ++registerIndex;
         } while (i < m_constantRegisters.size());
@@ -481,7 +484,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_enter_with_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] enter_with_activation %s\n", location, registerName(r0).c_str());
+            printf("[%4d] enter_with_activation %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_create_arguments: {
@@ -494,148 +497,148 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_convert_this: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] convert_this %s\n", location, registerName(r0).c_str());
+            printf("[%4d] convert_this %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_object: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] new_object\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] new_object\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_array: {
             int dst = (++it)->u.operand;
             int argv = (++it)->u.operand;
             int argc = (++it)->u.operand;
-            printf("[%4d] new_array\t %s, %s, %d\n", location, registerName(dst).c_str(), registerName(argv).c_str(), argc);
+            printf("[%4d] new_array\t %s, %s, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, argv).c_str(), argc);
             break;
         }
         case op_new_regexp: {
             int r0 = (++it)->u.operand;
             int re0 = (++it)->u.operand;
-            printf("[%4d] new_regexp\t %s, %s\n", location, registerName(r0).c_str(), regexpName(re0, regexp(re0)).c_str());
+            printf("[%4d] new_regexp\t %s, %s\n", location, registerName(exec, r0).c_str(), regexpName(re0, regexp(re0)).c_str());
             break;
         }
         case op_mov: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] mov\t\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] mov\t\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_not: {
-            printUnaryOp(location, it, "not");
+            printUnaryOp(exec, location, it, "not");
             break;
         }
         case op_eq: {
-            printBinaryOp(location, it, "eq");
+            printBinaryOp(exec, location, it, "eq");
             break;
         }
         case op_eq_null: {
-            printUnaryOp(location, it, "eq_null");
+            printUnaryOp(exec, location, it, "eq_null");
             break;
         }
         case op_neq: {
-            printBinaryOp(location, it, "neq");
+            printBinaryOp(exec, location, it, "neq");
             break;
         }
         case op_neq_null: {
-            printUnaryOp(location, it, "neq_null");
+            printUnaryOp(exec, location, it, "neq_null");
             break;
         }
         case op_stricteq: {
-            printBinaryOp(location, it, "stricteq");
+            printBinaryOp(exec, location, it, "stricteq");
             break;
         }
         case op_nstricteq: {
-            printBinaryOp(location, it, "nstricteq");
+            printBinaryOp(exec, location, it, "nstricteq");
             break;
         }
         case op_less: {
-            printBinaryOp(location, it, "less");
+            printBinaryOp(exec, location, it, "less");
             break;
         }
         case op_lesseq: {
-            printBinaryOp(location, it, "lesseq");
+            printBinaryOp(exec, location, it, "lesseq");
             break;
         }
         case op_pre_inc: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_inc\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] pre_inc\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_pre_dec: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_dec\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] pre_dec\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_post_inc: {
-            printUnaryOp(location, it, "post_inc");
+            printUnaryOp(exec, location, it, "post_inc");
             break;
         }
         case op_post_dec: {
-            printUnaryOp(location, it, "post_dec");
+            printUnaryOp(exec, location, it, "post_dec");
             break;
         }
         case op_to_jsnumber: {
-            printUnaryOp(location, it, "to_jsnumber");
+            printUnaryOp(exec, location, it, "to_jsnumber");
             break;
         }
         case op_negate: {
-            printUnaryOp(location, it, "negate");
+            printUnaryOp(exec, location, it, "negate");
             break;
         }
         case op_add: {
-            printBinaryOp(location, it, "add");
+            printBinaryOp(exec, location, it, "add");
             ++it;
             break;
         }
         case op_mul: {
-            printBinaryOp(location, it, "mul");
+            printBinaryOp(exec, location, it, "mul");
             ++it;
             break;
         }
         case op_div: {
-            printBinaryOp(location, it, "div");
+            printBinaryOp(exec, location, it, "div");
             ++it;
             break;
         }
         case op_mod: {
-            printBinaryOp(location, it, "mod");
+            printBinaryOp(exec, location, it, "mod");
             break;
         }
         case op_sub: {
-            printBinaryOp(location, it, "sub");
+            printBinaryOp(exec, location, it, "sub");
             ++it;
             break;
         }
         case op_lshift: {
-            printBinaryOp(location, it, "lshift");
+            printBinaryOp(exec, location, it, "lshift");
             break;            
         }
         case op_rshift: {
-            printBinaryOp(location, it, "rshift");
+            printBinaryOp(exec, location, it, "rshift");
             break;
         }
         case op_urshift: {
-            printBinaryOp(location, it, "urshift");
+            printBinaryOp(exec, location, it, "urshift");
             break;
         }
         case op_bitand: {
-            printBinaryOp(location, it, "bitand");
+            printBinaryOp(exec, location, it, "bitand");
             ++it;
             break;
         }
         case op_bitxor: {
-            printBinaryOp(location, it, "bitxor");
+            printBinaryOp(exec, location, it, "bitxor");
             ++it;
             break;
         }
         case op_bitor: {
-            printBinaryOp(location, it, "bitor");
+            printBinaryOp(exec, location, it, "bitor");
             ++it;
             break;
         }
         case op_bitnot: {
-            printUnaryOp(location, it, "bitnot");
+            printUnaryOp(exec, location, it, "bitnot");
             break;
         }
         case op_instanceof: {
@@ -643,59 +646,59 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
             int r3 = (++it)->u.operand;
-            printf("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str());
+            printf("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str());
             break;
         }
         case op_typeof: {
-            printUnaryOp(location, it, "typeof");
+            printUnaryOp(exec, location, it, "typeof");
             break;
         }
         case op_is_undefined: {
-            printUnaryOp(location, it, "is_undefined");
+            printUnaryOp(exec, location, it, "is_undefined");
             break;
         }
         case op_is_boolean: {
-            printUnaryOp(location, it, "is_boolean");
+            printUnaryOp(exec, location, it, "is_boolean");
             break;
         }
         case op_is_number: {
-            printUnaryOp(location, it, "is_number");
+            printUnaryOp(exec, location, it, "is_number");
             break;
         }
         case op_is_string: {
-            printUnaryOp(location, it, "is_string");
+            printUnaryOp(exec, location, it, "is_string");
             break;
         }
         case op_is_object: {
-            printUnaryOp(location, it, "is_object");
+            printUnaryOp(exec, location, it, "is_object");
             break;
         }
         case op_is_function: {
-            printUnaryOp(location, it, "is_function");
+            printUnaryOp(exec, location, it, "is_function");
             break;
         }
         case op_in: {
-            printBinaryOp(location, it, "in");
+            printBinaryOp(exec, location, it, "in");
             break;
         }
         case op_resolve: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve\t\t %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve\t\t %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_resolve_skip: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), skipLevels);
+            printf("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), skipLevels);
             break;
         }
         case op_resolve_global: {
             int r0 = (++it)->u.operand;
             JSValue scope = JSValue((++it)->u.jsCell);
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
             it += 2;
             break;
         }
@@ -703,125 +706,125 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(r0).c_str(), index, skipLevels);
+            printf("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(exec, r0).c_str(), index, skipLevels);
             break;
         }
         case op_put_scoped_var: {
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(r0).c_str());
+            printf("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(exec, r0).c_str());
             break;
         }
         case op_get_global_var: {
             int r0 = (++it)->u.operand;
             JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
-            printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
+            printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
             break;
         }
         case op_put_global_var: {
             JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(r0).c_str());
+            printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(exec, r0).c_str());
             break;
         }
         case op_resolve_base: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_base\t %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_base\t %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_resolve_with_base: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_get_by_id: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id");
+            printGetByIdOp(exec, location, it, "get_by_id");
             break;
         }
         case op_get_by_id_self: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_self");
+            printGetByIdOp(exec, location, it, "get_by_id_self");
             break;
         }
         case op_get_by_id_self_list: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_self_list");
+            printGetByIdOp(exec, location, it, "get_by_id_self_list");
             break;
         }
         case op_get_by_id_proto: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_proto");
+            printGetByIdOp(exec, location, it, "get_by_id_proto");
             break;
         }
         case op_get_by_id_proto_list: {
-            printGetByIdOp(location, it, m_identifiers, "op_get_by_id_proto_list");
+            printGetByIdOp(exec, location, it, "op_get_by_id_proto_list");
             break;
         }
         case op_get_by_id_chain: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_chain");
+            printGetByIdOp(exec, location, it, "get_by_id_chain");
             break;
         }
         case op_get_by_id_generic: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_generic");
+            printGetByIdOp(exec, location, it, "get_by_id_generic");
             break;
         }
         case op_get_array_length: {
-            printGetByIdOp(location, it, m_identifiers, "get_array_length");
+            printGetByIdOp(exec, location, it, "get_array_length");
             break;
         }
         case op_get_string_length: {
-            printGetByIdOp(location, it, m_identifiers, "get_string_length");
+            printGetByIdOp(exec, location, it, "get_string_length");
             break;
         }
         case op_put_by_id: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id");
+            printPutByIdOp(exec, location, it, "put_by_id");
             break;
         }
         case op_put_by_id_replace: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_replace");
+            printPutByIdOp(exec, location, it, "put_by_id_replace");
             break;
         }
         case op_put_by_id_transition: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_transition");
+            printPutByIdOp(exec, location, it, "put_by_id_transition");
             break;
         }
         case op_put_by_id_generic: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_generic");
+            printPutByIdOp(exec, location, it, "put_by_id_generic");
             break;
         }
         case op_put_getter: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_getter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] put_getter\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_put_setter: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_method_check: {
-            printf("[%4d] op_method_check\n", location);
+            printf("[%4d] method_check\n", location);
             break;
         }
         case op_del_by_id: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_get_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_get_by_pname: {
@@ -831,28 +834,28 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r3 = (++it)->u.operand;
             int r4 = (++it)->u.operand;
             int r5 = (++it)->u.operand;
-            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), registerName(r4).c_str(), registerName(r5).c_str());
+            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str(), registerName(exec, r4).c_str(), registerName(exec, r5).c_str());
             break;
         }
         case op_put_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_del_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_put_by_index: {
             int r0 = (++it)->u.operand;
             unsigned n0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(r0).c_str(), n0, registerName(r1).c_str());
+            printf("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(exec, r0).c_str(), n0, registerName(exec, r1).c_str());
             break;
         }
         case op_jmp: {
@@ -866,91 +869,102 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_jtrue: {
-            printConditionalJump(begin, it, location, "jtrue");
+            printConditionalJump(exec, begin, it, location, "jtrue");
             break;
         }
         case op_loop_if_true: {
-            printConditionalJump(begin, it, location, "loop_if_true");
+            printConditionalJump(exec, begin, it, location, "loop_if_true");
+            break;
+        }
+        case op_loop_if_false: {
+            printConditionalJump(exec, begin, it, location, "loop_if_false");
             break;
         }
         case op_jfalse: {
-            printConditionalJump(begin, it, location, "jfalse");
+            printConditionalJump(exec, begin, it, location, "jfalse");
             break;
         }
         case op_jeq_null: {
-            printConditionalJump(begin, it, location, "jeq_null");
+            printConditionalJump(exec, begin, it, location, "jeq_null");
             break;
         }
         case op_jneq_null: {
-            printConditionalJump(begin, it, location, "jneq_null");
+            printConditionalJump(exec, begin, it, location, "jneq_null");
             break;
         }
         case op_jneq_ptr: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
+            break;
+        }
+        case op_jless: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_lesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_switch_imm: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_switch_char: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_switch_string: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_new_func: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            printf("[%4d] new_func\t\t %s, f%d\n", location, registerName(r0).c_str(), f0);
+            printf("[%4d] new_func\t\t %s, f%d\n", location, registerName(exec, r0).c_str(), f0);
             break;
         }
         case op_new_func_exp: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            printf("[%4d] new_func_exp\t %s, f%d\n", location, registerName(r0).c_str(), f0);
+            printf("[%4d] new_func_exp\t %s, f%d\n", location, registerName(exec, r0).c_str(), f0);
             break;
         }
         case op_call: {
@@ -958,7 +972,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call\t\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
+            printf("[%4d] call\t\t %s, %s, %d, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset);
             break;
         }
         case op_call_eval: {
@@ -966,7 +980,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
+            printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset);
             break;
         }
         case op_call_varargs: {
@@ -974,16 +988,16 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), registerName(argCount).c_str(), registerOffset);
+            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), registerName(exec, argCount).c_str(), registerOffset);
             break;
         }
         case op_load_varargs: {
-            printUnaryOp(location, it, "load_varargs");
+            printUnaryOp(exec, location, it, "load_varargs");
             break;
         }
         case op_tear_off_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] tear_off_activation\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] tear_off_activation\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_tear_off_arguments: {
@@ -992,7 +1006,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_ret: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] ret\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] ret\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_construct: {
@@ -1002,26 +1016,26 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int registerOffset = (++it)->u.operand;
             int proto = (++it)->u.operand;
             int thisRegister = (++it)->u.operand;
-            printf("[%4d] construct\t %s, %s, %d, %d, %s, %s\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset, registerName(proto).c_str(), registerName(thisRegister).c_str());
+            printf("[%4d] construct\t %s, %s, %d, %d, %s, %s\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset, registerName(exec, proto).c_str(), registerName(exec, thisRegister).c_str());
             break;
         }
         case op_construct_verify: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] construct_verify\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] construct_verify\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_strcat: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int count = (++it)->u.operand;
-            printf("[%4d] op_strcat\t %s, %s, %d\n", location, registerName(r0).c_str(), registerName(r1).c_str(), count);
+            printf("[%4d] strcat\t\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), count);
             break;
         }
         case op_to_primitive: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] op_to_primitive\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] to_primitive\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_get_pnames: {
@@ -1030,7 +1044,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r2 = it[3].u.operand;
             int r3 = it[4].u.operand;
             int offset = it[5].u.operand;
-            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), offset, location + offset);
+            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str(), offset, location + offset);
             it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
@@ -1038,13 +1052,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int dest = it[1].u.operand;
             int iter = it[4].u.operand;
             int offset = it[5].u.operand;
-            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, location + offset);
+            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(exec, dest).c_str(), registerName(exec, iter).c_str(), offset, location + offset);
             it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
         case op_push_scope: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] push_scope\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] push_scope\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_pop_scope: {
@@ -1055,7 +1069,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_jmp_scopes: {
@@ -1066,30 +1080,30 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_catch: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] catch\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] catch\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_throw: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] throw\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] throw\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_error: {
             int r0 = (++it)->u.operand;
             int errorType = (++it)->u.operand;
             int k0 = (++it)->u.operand;
-            printf("[%4d] new_error\t %s, %d, %s\n", location, registerName(r0).c_str(), errorType, constantName(exec, k0, getConstant(k0)).c_str());
+            printf("[%4d] new_error\t %s, %d, %s\n", location, registerName(exec, r0).c_str(), errorType, constantName(exec, k0, getConstant(k0)).c_str());
             break;
         }
         case op_jsr: {
             int retAddrDst = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, location + offset);
+            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(exec, retAddrDst).c_str(), offset, location + offset);
             break;
         }
         case op_sret: {
             int retAddrSrc = (++it)->u.operand;
-            printf("[%4d] sret\t\t %s\n", location, registerName(retAddrSrc).c_str());
+            printf("[%4d] sret\t\t %s\n", location, registerName(exec, retAddrSrc).c_str());
             break;
         }
         case op_debug: {
@@ -1101,17 +1115,17 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_profile_will_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_will_call %s\n", location, registerName(function).c_str());
+            printf("[%4d] profile_will_call %s\n", location, registerName(exec, function).c_str());
             break;
         }
         case op_profile_did_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_did_call\t %s\n", location, registerName(function).c_str());
+            printf("[%4d] profile_did_call\t %s\n", location, registerName(exec, function).c_str());
             break;
         }
         case op_end: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] end\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] end\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
     }
diff --git a/JavaScriptCore/bytecode/CodeBlock.h b/JavaScriptCore/bytecode/CodeBlock.h
index 4ba58d7..eb874cc 100644
--- a/JavaScriptCore/bytecode/CodeBlock.h
+++ b/JavaScriptCore/bytecode/CodeBlock.h
@@ -438,7 +438,7 @@ namespace JSC {
         size_t numberOfConstantRegisters() const { return m_constantRegisters.size(); }
         void addConstantRegister(const Register& r) { return m_constantRegisters.append(r); }
         Register& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
-        ALWAYS_INLINE bool isConstantRegisterIndex(int index) { return index >= FirstConstantRegisterIndex; }
+        ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
         ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].jsValue(); }
 
         unsigned addFunctionDecl(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionDecls.size(); m_functionDecls.append(n); return size; }
@@ -482,6 +482,13 @@ namespace JSC {
     private:
 #if !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING)
         void dump(ExecState*, const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator&) const;
+
+        CString registerName(ExecState*, int r) const;
+        void printUnaryOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printBinaryOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printConditionalJump(ExecState*, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator&, int location, const char* op) const;
+        void printGetByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printPutByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
 #endif
 
         void reparseForExceptionInfoIfNecessary(CallFrame*);
diff --git a/JavaScriptCore/bytecode/Opcode.h b/JavaScriptCore/bytecode/Opcode.h
index 4facbef..e88f051 100644
--- a/JavaScriptCore/bytecode/Opcode.h
+++ b/JavaScriptCore/bytecode/Opcode.h
@@ -128,9 +128,11 @@ namespace JSC {
         macro(op_jneq_ptr, 4) \
         macro(op_jnless, 4) \
         macro(op_jnlesseq, 4) \
+        macro(op_jless, 4) \
         macro(op_jmp_scopes, 3) \
         macro(op_loop, 2) \
         macro(op_loop_if_true, 3) \
+        macro(op_loop_if_false, 3) \
         macro(op_loop_if_less, 4) \
         macro(op_loop_if_lesseq, 4) \
         macro(op_switch_imm, 4) \
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 04dae15..b0a0877 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -616,7 +616,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJump(Label* target)
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* target)
 {
-    if (m_lastOpcodeID == op_less && !target->isForward()) {
+    if (m_lastOpcodeID == op_less) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -627,7 +627,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
             rewindBinaryOp();
 
             size_t begin = instructions().size();
-            emitOpcode(op_loop_if_less);
+            emitOpcode(target->isForward() ? op_jless : op_loop_if_less);
             instructions().append(src1Index);
             instructions().append(src2Index);
             instructions().append(target->bind(begin, instructions().size()));
@@ -692,9 +692,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* target)
 {
-    ASSERT(target->isForward());
-
-    if (m_lastOpcodeID == op_less) {
+    if (m_lastOpcodeID == op_less && target->isForward()) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -711,7 +709,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_lesseq) {
+    } else if (m_lastOpcodeID == op_lesseq && target->isForward()) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -738,12 +736,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             rewindUnaryOp();
 
             size_t begin = instructions().size();
-            emitOpcode(op_jtrue);
+            emitOpcode(target->isForward() ? op_jtrue : op_loop_if_true);
             instructions().append(srcIndex);
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_eq_null) {
+    } else if (m_lastOpcodeID == op_eq_null && target->isForward()) {
         int dstIndex;
         int srcIndex;
 
@@ -758,7 +756,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_neq_null) {
+    } else if (m_lastOpcodeID == op_neq_null && target->isForward()) {
         int dstIndex;
         int srcIndex;
 
@@ -776,7 +774,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
     }
 
     size_t begin = instructions().size();
-    emitOpcode(op_jfalse);
+    emitOpcode(target->isForward() ? op_jfalse : op_loop_if_false);
     instructions().append(cond->index());
     instructions().append(target->bind(begin, instructions().size()));
     return target;
@@ -906,7 +904,7 @@ RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
             && m_codeBlock->constantRegister(src2->index()).jsValue().isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->value();
+            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->tryGetValue();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 4648fb5..8b6a425 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -192,6 +192,19 @@ namespace JSC {
             return emitNode(0, n);
         }
 
+        void emitNodeInConditionContext(ExpressionNode* n, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+        {
+            if (!m_codeBlock->numberOfLineInfos() || m_codeBlock->lastLineInfo().lineNumber != n->lineNo()) {
+                LineInfo info = { instructions().size(), n->lineNo() };
+                m_codeBlock->addLineInfo(info);
+            }
+            if (m_emitNodeDepth >= s_maxEmitNodeDepth)
+                emitThrowExpressionTooDeepException();
+            ++m_emitNodeDepth;
+            n->emitBytecodeInConditionContext(*this, trueTarget, falseTarget, fallThroughMeansTrue);
+            --m_emitNodeDepth;
+        }
+
         void emitExpressionInfo(unsigned divot, unsigned startOffset, unsigned endOffset)
         { 
             divot -= m_codeBlock->sourceOffset();
diff --git a/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/JavaScriptCore/bytecompiler/NodesCodegen.cpp
new file mode 100644
index 0000000..80a7a2f
--- /dev/null
+++ b/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -0,0 +1,2002 @@
+/*
+*  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+*  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+*  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+*  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+*  Copyright (C) 2007 Maks Orlovich
+*  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+*
+*  This library is free software; you can redistribute it and/or
+*  modify it under the terms of the GNU Library General Public
+*  License as published by the Free Software Foundation; either
+*  version 2 of the License, or (at your option) any later version.
+*
+*  This library is distributed in the hope that it will be useful,
+*  but WITHOUT ANY WARRANTY; without even the implied warranty of
+*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+*  Library General Public License for more details.
+*
+*  You should have received a copy of the GNU Library General Public License
+*  along with this library; see the file COPYING.LIB.  If not, write to
+*  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+*  Boston, MA 02110-1301, USA.
+*
+*/
+
+#include "config.h"
+#include "Nodes.h"
+#include "NodeConstructors.h"
+
+#include "BytecodeGenerator.h"
+#include "CallFrame.h"
+#include "Debugger.h"
+#include "JIT.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSStaticScopeObject.h"
+#include "LabelScope.h"
+#include "Lexer.h"
+#include "Operations.h"
+#include "Parser.h"
+#include "PropertyNameArray.h"
+#include "RegExpObject.h"
+#include "SamplingTool.h"
+#include <wtf/Assertions.h>
+#include <wtf/RefCountedLeakCounter.h>
+#include <wtf/Threading.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+/*
+    Details of the emitBytecode function.
+
+    Return value: The register holding the production's value.
+             dst: An optional parameter specifying the most efficient destination at
+                  which to store the production's value. The callee must honor dst.
+
+    The dst argument provides for a crude form of copy propagation. For example,
+
+        x = 1
+
+    becomes
+    
+        load r[x], 1
+    
+    instead of 
+
+        load r0, 1
+        mov r[x], r0
+    
+    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
+*/
+
+// ------------------------------ ThrowableExpressionData --------------------------------
+
+static void substitute(UString& string, const UString& substring)
+{
+    int position = string.find("%s");
+    ASSERT(position != -1);
+    UString newString = string.substr(0, position);
+    newString.append(substring);
+    newString.append(string.substr(position + 2));
+    string = newString;
+}
+
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
+{
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
+    generator.emitThrow(exception);
+    return exception;
+}
+
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
+{
+    UString message = messageTemplate;
+    substitute(message, label);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
+    generator.emitThrow(exception);
+    return exception;
+}
+
+inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
+{
+    return emitThrowError(generator, type, messageTemplate, label.ustring());
+}
+
+// ------------------------------ NullNode -------------------------------------
+
+RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, jsNull());
+}
+
+// ------------------------------ BooleanNode ----------------------------------
+
+RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ NumberNode -----------------------------------
+
+RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ StringNode -----------------------------------
+
+RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ RegExpNode -----------------------------------
+
+RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
+    if (!regExp->isValid())
+        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
+}
+
+// ------------------------------ ThisNode -------------------------------------
+
+RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
+}
+
+// ------------------------------ ResolveNode ----------------------------------
+
+bool ResolveNode::isPure(BytecodeGenerator& generator) const
+{
+    return generator.isLocal(m_ident);
+}
+
+RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.moveToDestinationIfNeeded(dst, local);
+    }
+    
+    generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);
+    return generator.emitResolve(generator.finalDestination(dst), m_ident);
+}
+
+// ------------------------------ ArrayNode ------------------------------------
+
+RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // FIXME: Should we put all of this code into emitNewArray?
+
+    unsigned length = 0;
+    ElementNode* firstPutElement;
+    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
+        if (firstPutElement->elision())
+            break;
+        ++length;
+    }
+
+    if (!firstPutElement && !m_elision)
+        return generator.emitNewArray(generator.finalDestination(dst), m_element);
+
+    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
+
+    for (ElementNode* n = firstPutElement; n; n = n->next()) {
+        RegisterID* value = generator.emitNode(n->value());
+        length += n->elision();
+        generator.emitPutByIndex(array.get(), length++, value);
+    }
+
+    if (m_elision) {
+        RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
+        generator.emitPutById(array.get(), generator.propertyNames().length, value);
+    }
+
+    return generator.moveToDestinationIfNeeded(dst, array.get());
+}
+
+bool ArrayNode::isSimpleArray() const
+{
+    if (m_elision || m_optional)
+        return false;
+    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
+        if (ptr->elision())
+            return false;
+    }
+    return true;
+}
+
+ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
+{
+    ASSERT(!m_elision && !m_optional);
+    ElementNode* ptr = m_element;
+    if (!ptr)
+        return 0;
+    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
+    ArgumentListNode* tail = head;
+    ptr = ptr->next();
+    for (; ptr; ptr = ptr->next()) {
+        ASSERT(!ptr->elision());
+        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
+    }
+    return head;
+}
+
+// ------------------------------ ObjectLiteralNode ----------------------------
+
+RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+     if (!m_list) {
+         if (dst == generator.ignoredResult())
+             return 0;
+         return generator.emitNewObject(generator.finalDestination(dst));
+     }
+     return generator.emitNode(dst, m_list);
+}
+
+// ------------------------------ PropertyListNode -----------------------------
+
+RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> newObj = generator.tempDestination(dst);
+    
+    generator.emitNewObject(newObj.get());
+    
+    for (PropertyListNode* p = this; p; p = p->m_next) {
+        RegisterID* value = generator.emitNode(p->m_node->m_assign);
+        
+        switch (p->m_node->m_type) {
+            case PropertyNode::Constant: {
+                generator.emitPutById(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            case PropertyNode::Getter: {
+                generator.emitPutGetter(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            case PropertyNode::Setter: {
+                generator.emitPutSetter(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            default:
+                ASSERT_NOT_REACHED();
+        }
+    }
+    
+    return generator.moveToDestinationIfNeeded(dst, newObj.get());
+}
+
+// ------------------------------ BracketAccessorNode --------------------------------
+
+RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
+    RegisterID* property = generator.emitNode(m_subscript);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
+}
+
+// ------------------------------ DotAccessorNode --------------------------------
+
+RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
+}
+
+// ------------------------------ ArgumentListNode -----------------------------
+
+RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    return generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ NewExprNode ----------------------------------
+
+RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ EvalFunctionCallNode ----------------------------------
+
+RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.tempDestination(dst);
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
+    generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
+    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallValueNode ----------------------------------
+
+RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallResolveNode ----------------------------------
+
+RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
+        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
+        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+
+    RefPtr<RegisterID> func = generator.newTemporary();
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    int identifierStart = divot() - startOffset();
+    generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
+    generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallBracketNode ----------------------------------
+
+RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RegisterID* property = generator.emitNode(m_subscript);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
+    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallDotNode ----------------------------------
+
+RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> function = generator.tempDestination(dst);
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    generator.emitNode(thisRegister.get(), m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    generator.emitMethodCheck();
+    generator.emitGetById(function.get(), thisRegister.get(), m_ident);
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
+    {
+        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+        RefPtr<RegisterID> thisRegister = generator.newTemporary();
+        ArgumentListNode* oldList = m_args->m_listNode;
+        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            m_args->m_listNode = m_args->m_listNode->m_next;
+        } else
+            generator.emitLoad(thisRegister.get(), jsNull());
+
+        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+        generator.emitJump(end.get());
+        m_args->m_listNode = oldList;
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+    
+static bool areTrivialApplyArguments(ArgumentsNode* args)
+{
+    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
+        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
+}
+
+RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // A few simple cases can be trivially handled as ordinary function calls.
+    // function.apply(), function.apply(arg) -> identical to function.call
+    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
+    bool mayBeCall = areTrivialApplyArguments(m_args);
+
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
+    {
+        if (mayBeCall) {
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            ArgumentListNode* oldList = m_args->m_listNode;
+            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+                m_args->m_listNode = m_args->m_listNode->m_next;
+                if (m_args->m_listNode) {
+                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
+                    ASSERT(!m_args->m_listNode->m_next);
+                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
+                }
+            } else
+                generator.emitLoad(thisRegister.get(), jsNull());
+            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+            m_args->m_listNode = oldList;
+        } else {
+            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
+            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            RefPtr<RegisterID> argsRegister = generator.newTemporary();
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            ArgumentListNode* args = m_args->m_listNode->m_next;
+            bool isArgumentsApply = false;
+            if (args->m_expr->isResolveNode()) {
+                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
+                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
+                if (isArgumentsApply)
+                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
+            }
+            if (!isArgumentsApply)
+                generator.emitNode(argsRegister.get(), args->m_expr);
+            while ((args = args->m_next))
+                generator.emitNode(args->m_expr);
+
+            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
+            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
+        }
+        generator.emitJump(end.get());
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+
+// ------------------------------ PostfixResolveNode ----------------------------------
+
+static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
+{
+    return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);
+}
+
+static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
+{
+    if (srcDst == dst)
+        return generator.emitToJSNumber(dst, srcDst);
+    return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
+}
+
+RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            if (dst == generator.ignoredResult())
+                return 0;
+            return generator.emitToJSNumber(generator.finalDestination(dst), local);
+        }
+
+        if (dst == generator.ignoredResult())
+            return emitPreIncOrDec(generator, local, m_operator);
+        return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
+        RegisterID* oldValue;
+        if (dst == generator.ignoredResult()) {
+            oldValue = 0;
+            emitPreIncOrDec(generator, value.get(), m_operator);
+        } else {
+            oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
+        }
+        generator.emitPutScopedVar(depth, index, value.get(), globalObject);
+        return oldValue;
+    }
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> value = generator.newTemporary();
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        emitPreIncOrDec(generator, value.get(), m_operator);
+    } else {
+        oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
+    }
+    generator.emitPutById(base.get(), m_ident, value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixBracketNode ----------------------------------
+
+RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        if (m_operator == OpPlusPlus)
+            generator.emitPreInc(value.get());
+        else
+            generator.emitPreDec(value.get());
+    } else {
+        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+    }
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixDotNode ----------------------------------
+
+RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        if (m_operator == OpPlusPlus)
+            generator.emitPreInc(value.get());
+        else
+            generator.emitPreDec(value.get());
+    } else {
+        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+    }
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixErrorNode -----------------------------------
+
+RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Postfix ++ operator applied to value that is not a reference."
+        : "Postfix -- operator applied to value that is not a reference.");
+}
+
+// ------------------------------ DeleteResolveNode -----------------------------------
+
+RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (generator.registerFor(m_ident))
+        return generator.emitLoad(generator.finalDestination(dst), false);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
+    return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
+}
+
+// ------------------------------ DeleteBracketNode -----------------------------------
+
+RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
+    RegisterID* r1 = generator.emitNode(m_subscript);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
+}
+
+// ------------------------------ DeleteDotNode -----------------------------------
+
+RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* r0 = generator.emitNode(m_base);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
+}
+
+// ------------------------------ DeleteValueNode -----------------------------------
+
+RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitNode(generator.ignoredResult(), m_expr);
+
+    // delete on a non-location expression ignores the value and returns true
+    return generator.emitLoad(generator.finalDestination(dst), true);
+}
+
+// ------------------------------ VoidNode -------------------------------------
+
+RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+    return generator.emitLoad(dst, jsUndefined());
+}
+
+// ------------------------------ TypeOfValueNode -----------------------------------
+
+RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.emitTypeOf(generator.finalDestination(dst), local);
+    }
+
+    RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
+    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
+}
+
+// ------------------------------ TypeOfValueNode -----------------------------------
+
+RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> src = generator.emitNode(m_expr);
+    return generator.emitTypeOf(generator.finalDestination(dst), src.get());
+}
+
+// ------------------------------ PrefixResolveNode ----------------------------------
+
+RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            if (dst == generator.ignoredResult())
+                return 0;
+            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
+            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
+        }
+
+        emitPreIncOrDec(generator, local, m_operator);
+        return generator.moveToDestinationIfNeeded(dst, local);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
+        emitPreIncOrDec(generator, propDst.get(), m_operator);
+        generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);
+        return generator.moveToDestinationIfNeeded(dst, propDst.get());
+    }
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);
+    emitPreIncOrDec(generator, propDst.get(), m_operator);
+    generator.emitPutById(base.get(), m_ident, propDst.get());
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixBracketNode ----------------------------------
+
+RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
+    RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
+    if (m_operator == OpPlusPlus)
+        generator.emitPreInc(value);
+    else
+        generator.emitPreDec(value);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), value);
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixDotNode ----------------------------------
+
+RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
+    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
+    if (m_operator == OpPlusPlus)
+        generator.emitPreInc(value);
+    else
+        generator.emitPreDec(value);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, value);
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixErrorNode -----------------------------------
+
+RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Prefix ++ operator applied to value that is not a reference."
+        : "Prefix -- operator applied to value that is not a reference.");
+}
+
+// ------------------------------ Unary Operation Nodes -----------------------------------
+
+RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* src = generator.emitNode(m_expr);
+    return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
+}
+
+
+// ------------------------------ LogicalNotNode -----------------------------------
+
+void LogicalNotNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+{
+    ASSERT(expr()->hasConditionContextCodegen());
+
+    // reverse the true and false targets
+    generator.emitNodeInConditionContext(expr(), falseTarget, trueTarget, !fallThroughMeansTrue);
+}
+
+
+// ------------------------------ Binary Operation Nodes -----------------------------------
+
+// BinaryOpNode::emitStrcat:
+//
+// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
+// more values, where we can determine a set of separate op_add operations would be operating on
+// string values.
+//
+// This function expects to be operating on a graph of AST nodes looking something like this:
+//
+//     (a)...     (b)
+//          \   /
+//           (+)     (c)
+//              \   /
+//      [d]     ((+))
+//         \    /
+//          [+=]
+//
+// The assignment operation is optional, if it exists the register holding the value on the
+// lefthand side of the assignment should be passing as the optional 'lhs' argument.
+//
+// The method should be called on the node at the root of the tree of regular binary add
+// operations (marked in the diagram with a double set of parentheses).  This node must
+// be performing a string concatenation (determined by statically detecting that at least
+// one child must be a string).  
+//
+// Since the minimum number of values being concatenated together is expected to be 3, if
+// a lhs to a concatenating assignment is not provided then the  root add should have at
+// least one left child that is also an add that can be determined to be operating on strings.
+//
+RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
+{
+    ASSERT(isAdd());
+    ASSERT(resultDescriptor().definitelyIsString());
+
+    // Create a list of expressions for all the adds in the tree of nodes we can convert into
+    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
+    // added first, and the leftmost child is never added, so the vector produced for the
+    // example above will be [ c, b ].
+    Vector<ExpressionNode*, 16> reverseExpressionList;
+    reverseExpressionList.append(m_expr2);
+
+    // Examine the left child of the add.  So long as this is a string add, add its right-child
+    // to the list, and keep processing along the left fork.
+    ExpressionNode* leftMostAddChild = m_expr1;
+    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
+        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
+        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
+    }
+
+    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
+
+    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
+    // We could possibly avoid this (the lhs is converted last anyway, we could let the
+    // op_strcat node handle its conversion if required).
+    if (lhs)
+        temporaryRegisters.append(generator.newTemporary());
+
+    // Emit code for the leftmost node ((a) in the example).
+    temporaryRegisters.append(generator.newTemporary());
+    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
+    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
+
+    // Note on ordering of conversions:
+    //
+    // We maintain the same ordering of conversions as we would see if the concatenations
+    // was performed as a sequence of adds (otherwise this optimization could change
+    // behaviour should an object have been provided a valueOf or toString method).
+    //
+    // Considering the above example, the sequnce of execution is:
+    //     * evaluate operand (a)
+    //     * evaluate operand (b)
+    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
+    //     * convert (b) to primitive   <-  (ditto)
+    //     * evaluate operand (c)
+    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
+    // And optionally, if there is an assignment:
+    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
+    //
+    // As such we do not plant an op to convert the leftmost child now.  Instead, use
+    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
+    // once the second node has been generated.  However, if the leftmost child is an
+    // immediate we can trivially determine that no conversion will be required.
+    // If this is the case
+    if (leftMostAddChild->isString())
+        leftMostAddChildTempRegister = 0;
+
+    while (reverseExpressionList.size()) {
+        ExpressionNode* node = reverseExpressionList.last();
+        reverseExpressionList.removeLast();
+
+        // Emit the code for the current node.
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), node);
+
+        // On the first iteration of this loop, when we first reach this point we have just
+        // generated the second node, which means it is time to convert the leftmost operand.
+        if (leftMostAddChildTempRegister) {
+            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
+            leftMostAddChildTempRegister = 0; // Only do this once.
+        }
+        // Plant a conversion for this node, if necessary.
+        if (!node->isString())
+            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
+    }
+    ASSERT(temporaryRegisters.size() >= 3);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    // If there is an assignment convert the lhs now.  This will also copy lhs to
+    // the temporary register we allocated for it.
+    if (lhs)
+        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
+
+    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
+}
+
+RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    OpcodeID opcodeID = this->opcodeID();
+
+    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
+        return emitStrcat(generator, dst);
+
+    if (opcodeID == op_neq) {
+        if (m_expr1->isNull() || m_expr2->isNull()) {
+            RefPtr<RegisterID> src = generator.tempDestination(dst);
+            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+            return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
+        }
+    }
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
+}
+
+RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_expr1->isNull() || m_expr2->isNull()) {
+        RefPtr<RegisterID> src = generator.tempDestination(dst);
+        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+        return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
+    }
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
+}
+
+RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
+}
+
+RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
+}
+
+RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
+}
+
+RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitGetByIdExceptionInfo(op_instanceof);
+    RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);
+}
+
+// ------------------------------ LogicalOpNode ----------------------------
+
+RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> temp = generator.tempDestination(dst);
+    RefPtr<Label> target = generator.newLabel();
+    
+    generator.emitNode(temp.get(), m_expr1);
+    if (m_operator == OpLogicalAnd)
+        generator.emitJumpIfFalse(temp.get(), target.get());
+    else
+        generator.emitJumpIfTrue(temp.get(), target.get());
+    generator.emitNode(temp.get(), m_expr2);
+    generator.emitLabel(target.get());
+
+    return generator.moveToDestinationIfNeeded(dst, temp.get());
+}
+
+void LogicalOpNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+{
+    if (m_expr1->hasConditionContextCodegen()) {
+        RefPtr<Label> afterExpr1 = generator.newLabel();
+        if (m_operator == OpLogicalAnd)
+            generator.emitNodeInConditionContext(m_expr1, afterExpr1.get(), falseTarget, true);
+        else 
+            generator.emitNodeInConditionContext(m_expr1, trueTarget, afterExpr1.get(), false);
+        generator.emitLabel(afterExpr1.get());
+    } else {
+        RegisterID* temp = generator.emitNode(m_expr1);
+        if (m_operator == OpLogicalAnd)
+            generator.emitJumpIfFalse(temp, falseTarget);
+        else
+            generator.emitJumpIfTrue(temp, trueTarget);
+    }
+
+    if (m_expr2->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr2, trueTarget, falseTarget, fallThroughMeansTrue);
+    else {
+        RegisterID* temp = generator.emitNode(m_expr2);
+        if (fallThroughMeansTrue)
+            generator.emitJumpIfFalse(temp, falseTarget);
+        else
+            generator.emitJumpIfTrue(temp, trueTarget);
+    }
+}
+
+// ------------------------------ ConditionalNode ------------------------------
+
+RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> newDst = generator.finalDestination(dst);
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    if (m_logical->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_logical, beforeThen.get(), beforeElse.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_logical);
+        generator.emitJumpIfFalse(cond, beforeElse.get());
+    }
+
+    generator.emitNode(newDst.get(), m_expr1);
+    generator.emitJump(afterElse.get());
+
+    generator.emitLabel(beforeElse.get());
+    generator.emitNode(newDst.get(), m_expr2);
+
+    generator.emitLabel(afterElse.get());
+
+    return newDst.get();
+}
+
+// ------------------------------ ReadModifyResolveNode -----------------------------------
+
+// FIXME: should this be moved to be a method on BytecodeGenerator?
+static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
+{
+    OpcodeID opcodeID;
+    switch (oper) {
+        case OpMultEq:
+            opcodeID = op_mul;
+            break;
+        case OpDivEq:
+            opcodeID = op_div;
+            break;
+        case OpPlusEq:
+            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
+                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
+            opcodeID = op_add;
+            break;
+        case OpMinusEq:
+            opcodeID = op_sub;
+            break;
+        case OpLShift:
+            opcodeID = op_lshift;
+            break;
+        case OpRShift:
+            opcodeID = op_rshift;
+            break;
+        case OpURShift:
+            opcodeID = op_urshift;
+            break;
+        case OpAndEq:
+            opcodeID = op_bitand;
+            break;
+        case OpXOrEq:
+            opcodeID = op_bitxor;
+            break;
+        case OpOrEq:
+            opcodeID = op_bitor;
+            break;
+        case OpModEq:
+            opcodeID = op_mod;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            return dst;
+    }
+
+    RegisterID* src2 = generator.emitNode(m_right);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
+}
+
+RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        }
+        
+        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
+            RefPtr<RegisterID> result = generator.newTemporary();
+            generator.emitMove(result.get(), local);
+            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+            generator.emitMove(local, result.get());
+            return generator.moveToDestinationIfNeeded(dst, result.get());
+        }
+        
+        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        return generator.moveToDestinationIfNeeded(dst, result);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
+        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        generator.emitPutScopedVar(depth, index, result, globalObject);
+        return result;
+    }
+
+    RefPtr<RegisterID> src1 = generator.tempDestination(dst);
+    generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
+    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
+    return generator.emitPutById(base.get(), m_ident, result);
+}
+
+// ------------------------------ AssignResolveNode -----------------------------------
+
+RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident))
+            return generator.emitNode(dst, m_right);
+        
+        RegisterID* result = generator.emitNode(local, m_right);
+        return generator.moveToDestinationIfNeeded(dst, result);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        if (dst == generator.ignoredResult())
+            dst = 0;
+        RegisterID* value = generator.emitNode(dst, m_right);
+        generator.emitPutScopedVar(depth, index, value, globalObject);
+        return value;
+    }
+
+    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RegisterID* value = generator.emitNode(dst, m_right);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitPutById(base.get(), m_ident, value);
+}
+
+// ------------------------------ AssignDotNode -----------------------------------
+
+RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RegisterID* result = generator.emitNode(value.get(), m_right);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, result);
+    return generator.moveToDestinationIfNeeded(dst, result);
+}
+
+// ------------------------------ ReadModifyDotNode -----------------------------------
+
+RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitPutById(base.get(), m_ident, updatedValue);
+}
+
+// ------------------------------ AssignErrorNode -----------------------------------
+
+RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
+}
+
+// ------------------------------ AssignBracketNode -----------------------------------
+
+RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RegisterID* result = generator.emitNode(value.get(), m_right);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), result);
+    return generator.moveToDestinationIfNeeded(dst, result);
+}
+
+// ------------------------------ ReadModifyBracketNode -----------------------------------
+
+RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), updatedValue);
+
+    return updatedValue;
+}
+
+// ------------------------------ CommaNode ------------------------------------
+
+RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expressions.size() > 1);
+    for (size_t i = 0; i < m_expressions.size() - 1; i++)
+        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
+    return generator.emitNode(dst, m_expressions.last());
+}
+
+// ------------------------------ ConstDeclNode ------------------------------------
+
+RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
+{
+    if (RegisterID* local = generator.constRegisterFor(m_ident)) {
+        if (!m_init)
+            return local;
+
+        return generator.emitNode(local, m_init);
+    }
+
+    if (generator.codeType() != EvalCode) {
+        if (m_init)
+            return generator.emitNode(m_init);
+        else
+            return generator.emitResolve(generator.newTemporary(), m_ident);
+    }
+    // FIXME: While this code should only be hit in eval code, it will potentially
+    // assign to the wrong base if m_ident exists in an intervening dynamic scope.
+    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
+    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
+    return generator.emitPutById(base.get(), m_ident, value);
+}
+
+RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    RegisterID* result = 0;
+    for (ConstDeclNode* n = this; n; n = n->m_next)
+        result = n->emitCodeSingle(generator);
+
+    return result;
+}
+
+// ------------------------------ ConstStatementNode -----------------------------
+
+RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_next);
+}
+
+// ------------------------------ SourceElements -------------------------------
+
+
+inline StatementNode* SourceElements::lastStatement() const
+{
+    size_t size = m_statements.size();
+    return size ? m_statements[size - 1] : 0;
+}
+
+inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    size_t size = m_statements.size();
+    for (size_t i = 0; i < size; ++i)
+        generator.emitNode(dst, m_statements[i]);
+}
+
+// ------------------------------ BlockNode ------------------------------------
+
+inline StatementNode* BlockNode::lastStatement() const
+{
+    return m_statements ? m_statements->lastStatement() : 0;
+}
+
+RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+    return 0;
+}
+
+// ------------------------------ EmptyStatementNode ---------------------------
+
+RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return dst;
+}
+
+// ------------------------------ DebuggerStatementNode ---------------------------
+
+RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
+    return dst;
+}
+
+// ------------------------------ ExprStatementNode ----------------------------
+
+RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
+    return generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ VarStatementNode ----------------------------
+
+RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    ASSERT(m_expr);
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_expr);
+}
+
+// ------------------------------ IfNode ---------------------------------------
+
+RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<Label> afterThen = generator.newLabel();
+
+    if (m_condition->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_condition, beforeThen.get(), afterThen.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_condition);
+        generator.emitJumpIfFalse(cond, afterThen.get());
+    }
+
+    generator.emitNode(dst, m_ifBlock);
+    generator.emitLabel(afterThen.get());
+
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
+    return 0;
+}
+
+// ------------------------------ IfElseNode ---------------------------------------
+
+RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    if (m_condition->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_condition, beforeThen.get(), beforeElse.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_condition);
+        generator.emitJumpIfFalse(cond, beforeElse.get());
+    }
+
+    generator.emitNode(dst, m_ifBlock);
+    generator.emitJump(afterElse.get());
+
+    generator.emitLabel(beforeElse.get());
+
+    generator.emitNode(dst, m_elseBlock);
+
+    generator.emitLabel(afterElse.get());
+
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
+    return 0;
+}
+
+// ------------------------------ DoWhileNode ----------------------------------
+
+RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+   
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+    if (m_expr->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
+    else {
+        RegisterID* cond = generator.emitNode(m_expr);
+        generator.emitJumpIfTrue(cond, topOfLoop.get());
+    }
+
+    generator.emitLabel(scope->breakTarget());
+    return result.get();
+}
+
+// ------------------------------ WhileNode ------------------------------------
+
+RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    generator.emitJump(scope->continueTarget());
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+    
+    generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+
+    if (m_expr->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
+    else {
+        RegisterID* cond = generator.emitNode(m_expr);
+        generator.emitJumpIfTrue(cond, topOfLoop.get());
+    }
+
+    generator.emitLabel(scope->breakTarget());
+    
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion
+    return 0;
+}
+
+// ------------------------------ ForNode --------------------------------------
+
+RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (m_expr1)
+        generator.emitNode(generator.ignoredResult(), m_expr1);
+
+    RefPtr<Label> condition = generator.newLabel();
+    generator.emitJump(condition.get());
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    if (m_expr3)
+        generator.emitNode(generator.ignoredResult(), m_expr3);
+
+    generator.emitLabel(condition.get());
+    if (m_expr2) {
+        if (m_expr2->hasConditionContextCodegen())
+            generator.emitNodeInConditionContext(m_expr2, topOfLoop.get(), scope->breakTarget(), false);
+        else {
+            RegisterID* cond = generator.emitNode(m_expr2);
+            generator.emitJumpIfTrue(cond, topOfLoop.get());
+        }
+    } else
+        generator.emitJump(topOfLoop.get());
+
+    generator.emitLabel(scope->breakTarget());
+    return result.get();
+}
+
+// ------------------------------ ForInNode ------------------------------------
+
+RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    if (!m_lexpr->isLocation())
+        return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (m_init)
+        generator.emitNode(generator.ignoredResult(), m_init);
+
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_expr);
+    RefPtr<RegisterID> i = generator.newTemporary();
+    RefPtr<RegisterID> size = generator.newTemporary();
+    RefPtr<RegisterID> expectedSubscript;
+    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
+    generator.emitJump(scope->continueTarget());
+
+    RefPtr<Label> loopStart = generator.newLabel();
+    generator.emitLabel(loopStart.get());
+
+    RegisterID* propertyName;
+    bool optimizedForinAccess = false;
+    if (m_lexpr->isResolveNode()) {
+        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
+        propertyName = generator.registerFor(ident);
+        if (!propertyName) {
+            propertyName = generator.newTemporary();
+            RefPtr<RegisterID> protect = propertyName;
+            RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
+
+            generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+            generator.emitPutById(base, ident, propertyName);
+        } else {
+            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
+            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
+            optimizedForinAccess = true;
+        }
+    } else if (m_lexpr->isDotAccessorNode()) {
+        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
+        const Identifier& ident = assignNode->identifier();
+        propertyName = generator.newTemporary();
+        RefPtr<RegisterID> protect = propertyName;
+        RegisterID* base = generator.emitNode(assignNode->base());
+
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
+        generator.emitPutById(base, ident, propertyName);
+    } else {
+        ASSERT(m_lexpr->isBracketAccessorNode());
+        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
+        propertyName = generator.newTemporary();
+        RefPtr<RegisterID> protect = propertyName;
+        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
+        RegisterID* subscript = generator.emitNode(assignNode->subscript());
+        
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
+        generator.emitPutByVal(base.get(), subscript, propertyName);
+    }   
+
+    generator.emitNode(dst, m_statement);
+
+    if (optimizedForinAccess)
+        generator.popOptimisedForIn();
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitLabel(scope->breakTarget());
+    return dst;
+}
+
+// ------------------------------ ContinueNode ---------------------------------
+
+// ECMA 12.7
+RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    LabelScope* scope = generator.continueTarget(m_ident);
+
+    if (!scope)
+        return m_ident.isEmpty()
+            ? emitThrowError(generator, SyntaxError, "Invalid continue statement.")
+            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
+
+    generator.emitJumpScopes(scope->continueTarget(), scope->scopeDepth());
+    return dst;
+}
+
+// ------------------------------ BreakNode ------------------------------------
+
+// ECMA 12.8
+RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    LabelScope* scope = generator.breakTarget(m_ident);
+    
+    if (!scope)
+        return m_ident.isEmpty()
+            ? emitThrowError(generator, SyntaxError, "Invalid break statement.")
+            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
+
+    generator.emitJumpScopes(scope->breakTarget(), scope->scopeDepth());
+    return dst;
+}
+
+// ------------------------------ ReturnNode -----------------------------------
+
+RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    if (generator.codeType() != FunctionCode)
+        return emitThrowError(generator, SyntaxError, "Invalid return statement.");
+
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
+    RefPtr<RegisterID> returnRegister;
+    if (generator.scopeDepth()) {
+        RefPtr<Label> l0 = generator.newLabel();
+        if (generator.hasFinaliser() && !r0->isTemporary()) {
+            returnRegister = generator.emitMove(generator.newTemporary(), r0);
+            r0 = returnRegister.get();
+        }
+        generator.emitJumpScopes(l0.get(), 0);
+        generator.emitLabel(l0.get());
+    }
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    return generator.emitReturn(r0);
+}
+
+// ------------------------------ WithNode -------------------------------------
+
+RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<RegisterID> scope = generator.newTemporary();
+    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
+    generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
+    generator.emitPushScope(scope.get());
+    RegisterID* result = generator.emitNode(dst, m_statement);
+    generator.emitPopScope();
+    return result;
+}
+
+// ------------------------------ CaseClauseNode --------------------------------
+
+inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+}
+
+// ------------------------------ CaseBlockNode --------------------------------
+
+enum SwitchKind { 
+    SwitchUnset = 0,
+    SwitchNumber = 1, 
+    SwitchString = 2, 
+    SwitchNeither = 3 
+};
+
+static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
+{
+    for (; list; list = list->getNext()) {
+        ExpressionNode* clauseExpression = list->getClause()->expr();
+        literalVector.append(clauseExpression);
+        if (clauseExpression->isNumber()) {
+            double value = static_cast<NumberNode*>(clauseExpression)->value();
+            int32_t intVal = static_cast<int32_t>(value);
+            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            if (intVal < min_num)
+                min_num = intVal;
+            if (intVal > max_num)
+                max_num = intVal;
+            typeForTable = SwitchNumber;
+            continue;
+        }
+        if (clauseExpression->isString()) {
+            if (typeForTable & ~SwitchString) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
+            if (singleCharacterSwitch &= value.size() == 1) {
+                int32_t intVal = value.rep()->data()[0];
+                if (intVal < min_num)
+                    min_num = intVal;
+                if (intVal > max_num)
+                    max_num = intVal;
+            }
+            typeForTable = SwitchString;
+            continue;
+        }
+        typeForTable = SwitchNeither;
+        break;        
+    }
+}
+    
+SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
+{
+    SwitchKind typeForTable = SwitchUnset;
+    bool singleCharacterSwitch = true;
+    
+    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    
+    if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
+        return SwitchInfo::SwitchNone;
+    
+    if (typeForTable == SwitchNumber) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchImmediate;
+        return SwitchInfo::SwitchNone;
+    } 
+    
+    ASSERT(typeForTable == SwitchString);
+    
+    if (singleCharacterSwitch) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchCharacter;
+    }
+
+    return SwitchInfo::SwitchString;
+}
+
+RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
+{
+    RefPtr<Label> defaultLabel;
+    Vector<RefPtr<Label>, 8> labelVector;
+    Vector<ExpressionNode*, 8> literalVector;
+    int32_t min_num = std::numeric_limits<int32_t>::max();
+    int32_t max_num = std::numeric_limits<int32_t>::min();
+    SwitchInfo::SwitchType switchType = tryOptimizedSwitch(literalVector, min_num, max_num);
+
+    if (switchType != SwitchInfo::SwitchNone) {
+        // Prepare the various labels
+        for (uint32_t i = 0; i < literalVector.size(); i++)
+            labelVector.append(generator.newLabel());
+        defaultLabel = generator.newLabel();
+        generator.beginSwitch(switchExpression, switchType);
+    } else {
+        // Setup jumps
+        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        
+        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        defaultLabel = generator.newLabel();
+        generator.emitJump(defaultLabel.get());
+    }
+
+    RegisterID* result = 0;
+
+    size_t i = 0;
+    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+
+    if (m_defaultClause) {
+        generator.emitLabel(defaultLabel.get());
+        m_defaultClause->emitBytecode(generator, dst);
+    }
+
+    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+    if (!m_defaultClause)
+        generator.emitLabel(defaultLabel.get());
+
+    ASSERT(i == labelVector.size());
+    if (switchType != SwitchInfo::SwitchNone) {
+        ASSERT(labelVector.size() == literalVector.size());
+        generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
+    }
+    return result;
+}
+
+// ------------------------------ SwitchNode -----------------------------------
+
+RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
+
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+    RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
+
+    generator.emitLabel(scope->breakTarget());
+    return r1;
+}
+
+// ------------------------------ LabelNode ------------------------------------
+
+RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (generator.breakTarget(m_name))
+        return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
+
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
+    RegisterID* r0 = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->breakTarget());
+    return r0;
+}
+
+// ------------------------------ ThrowNode ------------------------------------
+
+RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitThrow(expr.get());
+    return 0;
+}
+
+// ------------------------------ TryNode --------------------------------------
+
+RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // NOTE: The catch and finally blocks must be labeled explicitly, so the
+    // optimizer knows they may be jumped to from anywhere.
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    RefPtr<Label> tryStartLabel = generator.newLabel();
+    RefPtr<Label> finallyStart;
+    RefPtr<RegisterID> finallyReturnAddr;
+    if (m_finallyBlock) {
+        finallyStart = generator.newLabel();
+        finallyReturnAddr = generator.newTemporary();
+        generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
+    }
+
+    generator.emitLabel(tryStartLabel.get());
+    generator.emitNode(dst, m_tryBlock);
+
+    if (m_catchBlock) {
+        RefPtr<Label> catchEndLabel = generator.newLabel();
+        
+        // Normal path: jump over the catch block.
+        generator.emitJump(catchEndLabel.get());
+
+        // Uncaught exception path: the catch block.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
+        if (m_catchHasEval) {
+            RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
+            generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
+            generator.emitMove(exceptionRegister.get(), dynamicScopeObject.get());
+            generator.emitPushScope(exceptionRegister.get());
+        } else
+            generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
+        generator.emitNode(dst, m_catchBlock);
+        generator.emitPopScope();
+        generator.emitLabel(catchEndLabel.get());
+    }
+
+    if (m_finallyBlock) {
+        generator.popFinallyContext();
+        // there may be important registers live at the time we jump
+        // to a finally block (such as for a return or throw) so we
+        // ref the highest register ever used as a conservative
+        // approach to not clobbering anything important
+        RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
+        RefPtr<Label> finallyEndLabel = generator.newLabel();
+
+        // Normal path: invoke the finally block, then jump over it.
+        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
+        generator.emitJump(finallyEndLabel.get());
+
+        // Uncaught exception path: invoke the finally block, then re-throw the exception.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
+        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
+        generator.emitThrow(tempExceptionRegister.get());
+
+        // The finally block.
+        generator.emitLabel(finallyStart.get());
+        generator.emitNode(dst, m_finallyBlock);
+        generator.emitSubroutineReturn(finallyReturnAddr.get());
+
+        generator.emitLabel(finallyEndLabel.get());
+    }
+
+    return dst;
+}
+
+// ------------------------------ ScopeNode -----------------------------
+
+inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_data->m_statements)
+        m_data->m_statements->emitBytecode(generator, dst);
+}
+
+// ------------------------------ ProgramNode -----------------------------
+
+RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitEnd(dstRegister.get());
+    return 0;
+}
+
+// ------------------------------ EvalNode -----------------------------
+
+RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitEnd(dstRegister.get());
+    return 0;
+}
+
+// ------------------------------ FunctionBodyNode -----------------------------
+
+RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
+    emitStatementsBytecode(generator, generator.ignoredResult());
+    StatementNode* singleStatement = this->singleStatement();
+    if (singleStatement && singleStatement->isBlock()) {
+        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
+        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
+            return 0;
+    }
+
+    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    generator.emitReturn(r0);
+    return 0;
+}
+
+// ------------------------------ FuncDeclNode ---------------------------------
+
+RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    return dst;
+}
+
+// ------------------------------ FuncExprNode ---------------------------------
+
+RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
+}
+
+} // namespace JSC
diff --git a/JavaScriptCore/config.h b/JavaScriptCore/config.h
index 6681761..30757db 100644
--- a/JavaScriptCore/config.h
+++ b/JavaScriptCore/config.h
@@ -57,7 +57,6 @@
 
 /* FIXME: if all platforms have these, do they really need #defines? */
 #define HAVE_STDINT_H 1
-#define HAVE_STRING_H 1
 
 #define WTF_CHANGES 1
 
@@ -74,3 +73,15 @@
 #include <wtf/DisallowCType.h>
 #endif
 
+#if PLATFORM(CHROMIUM)
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 1
+#endif
+#endif /* PLATFORM(CHROMIUM) */
+
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 0
+#endif /* !defined(WTF_USE_V8) */
+
+/* Using V8 implies not using JSC and vice versa */
+#define WTF_USE_JSC !WTF_USE_V8
diff --git a/JavaScriptCore/debugger/DebuggerActivation.cpp b/JavaScriptCore/debugger/DebuggerActivation.cpp
index 5cc9a9f..d47db5b 100644
--- a/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -76,9 +76,9 @@ void DebuggerActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray&
     m_activation->getPropertyNames(exec, propertyNames);
 }
 
-bool DebuggerActivation::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+bool DebuggerActivation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    return m_activation->getPropertyAttributes(exec, propertyName, attributes);
+    return m_activation->getOwnPropertyDescriptor(exec, propertyName, descriptor);
 }
 
 void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
diff --git a/JavaScriptCore/debugger/DebuggerActivation.h b/JavaScriptCore/debugger/DebuggerActivation.h
index 63cf635..373e62d 100644
--- a/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/JavaScriptCore/debugger/DebuggerActivation.h
@@ -43,7 +43,7 @@ namespace JSC {
         virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes);
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
diff --git a/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index c9d7cc6..c6b4223 100644
--- a/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -44,7 +44,7 @@ const UString* DebuggerCallFrame::functionName() const
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
         return 0;
-    return &function->name(&m_callFrame->globalData());
+    return &function->name(m_callFrame);
 }
     
 UString DebuggerCallFrame::calculatedFunctionName() const
@@ -55,7 +55,7 @@ UString DebuggerCallFrame::calculatedFunctionName() const
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
         return 0;
-    return function->calculatedDisplayName(&m_callFrame->globalData());
+    return function->calculatedDisplayName(m_callFrame);
 }
 
 DebuggerCallFrame::Type DebuggerCallFrame::type() const
diff --git a/JavaScriptCore/interpreter/CachedCall.h b/JavaScriptCore/interpreter/CachedCall.h
index e903b79..eb48a03 100644
--- a/JavaScriptCore/interpreter/CachedCall.h
+++ b/JavaScriptCore/interpreter/CachedCall.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
             , m_exception(exception)
-            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().globalObject())
+            , m_globalObjectScope(callFrame, function->scope().globalObject())
         {
             ASSERT(!function->isHostFunction());
             m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node(), exception);
@@ -52,7 +52,14 @@ namespace JSC {
         }
         void setThis(JSValue v) { m_closure.setArgument(0, v); }
         void setArgument(int n, JSValue v) { m_closure.setArgument(n + 1, v); }
-        CallFrame* newCallFrame() { return m_closure.newCallFrame; }
+
+        CallFrame* newCallFrame(ExecState* exec)
+        {
+            CallFrame* callFrame = m_closure.newCallFrame;
+            callFrame->setScopeChain(exec->scopeChain());
+            return callFrame;
+        }
+
         ~CachedCall()
         {
             if (m_valid)
diff --git a/JavaScriptCore/interpreter/CallFrame.h b/JavaScriptCore/interpreter/CallFrame.h
index b4d49db..fff4c9b 100644
--- a/JavaScriptCore/interpreter/CallFrame.h
+++ b/JavaScriptCore/interpreter/CallFrame.h
@@ -39,7 +39,11 @@ namespace JSC  {
     public:
         JSFunction* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
-        ScopeChainNode* scopeChain() const { return this[RegisterFile::ScopeChain].Register::scopeChain(); }
+        ScopeChainNode* scopeChain() const
+        {
+            ASSERT(this[RegisterFile::ScopeChain].Register::scopeChain());
+            return this[RegisterFile::ScopeChain].Register::scopeChain();
+        }
         int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
 
         JSValue thisValue();
@@ -66,6 +70,7 @@ namespace JSC  {
         // or a pointer everywhere.
         JSGlobalData& globalData() const
         {
+            ASSERT(scopeChain()->globalData);
             return *scopeChain()->globalData;
         }
 
diff --git a/JavaScriptCore/interpreter/Interpreter.cpp b/JavaScriptCore/interpreter/Interpreter.cpp
index c77a0f1..ed8bf5b 100644
--- a/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/JavaScriptCore/interpreter/Interpreter.cpp
@@ -300,7 +300,7 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
     if (!program.isString())
         return program;
 
-    UString programSource = asString(program)->value();
+    UString programSource = asString(program)->value(callFrame);
 
     LiteralParser preparser(callFrame, programSource, LiteralParser::NonStrictJSON);
     if (JSValue parsedObject = preparser.tryLiteralParse())
@@ -537,7 +537,7 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 #if !ENABLE(JIT)
         if (isCallBytecode(codeBlock->instructions()[bytecodeOffset].u.opcode))
             profiler->didExecute(callFrame, callFrame->r(codeBlock->instructions()[bytecodeOffset + 2].u.operand).jsValue());
-        else if (codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
+        else if (codeBlock->instructions().size() > (bytecodeOffset + 8) && codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
             profiler->didExecute(callFrame, callFrame->r(codeBlock->instructions()[bytecodeOffset + 10].u.operand).jsValue());
 #else
         int functionRegisterIndex;
@@ -647,7 +647,7 @@ JSValue Interpreter::execute(FunctionExecutable* functionExecutable, CallFrame*
         return jsNull();
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
@@ -777,7 +777,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
         }
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     EvalCodeBlock* codeBlock = &eval->bytecode(callFrame, scopeChain);
 
@@ -1029,6 +1029,11 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
+    if (structure->isDictionary()) {
+        vPC[0] = getOpcode(op_get_by_id_generic);
+        return;
+    }
+
     if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
         ASSERT(slot.slotBase().isObject());
 
@@ -1037,7 +1042,9 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (baseObject->structure()->isDictionary())
-            baseObject->setStructure(Structure::fromDictionaryTransition(baseObject->structure()));
+            baseObject->flattenDictionaryObject();
+
+        ASSERT(!baseObject->structure()->isUncacheableDictionary());
 
         vPC[0] = getOpcode(op_get_by_id_proto);
         vPC[5] = baseObject->structure();
@@ -1299,7 +1306,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        callFrame->r(dst) = jsBoolean(JSValue::strictEqual(src1, src2));
+        callFrame->r(dst) = jsBoolean(JSValue::strictEqual(callFrame, src1, src2));
 
         vPC += OPCODE_LENGTH(op_stricteq);
         NEXT_INSTRUCTION();
@@ -1314,7 +1321,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(src1, src2));
+        callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(callFrame, src1, src2));
 
         vPC += OPCODE_LENGTH(op_nstricteq);
         NEXT_INSTRUCTION();
@@ -1488,7 +1495,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() + src2.asInt32());
         else {
             JSValue result = jsAdd(callFrame, src1, src2);
@@ -1575,7 +1582,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() - src2.asInt32());
         else {
             JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
@@ -2134,6 +2141,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                     int offset = vPC[6].u.operand;
 
                     ASSERT(protoObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
+                    ASSERT(baseValue.get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
                     callFrame->r(dst) = JSValue(protoObject->getDirectOffset(offset));
 
                     vPC += OPCODE_LENGTH(op_get_by_id_proto);
@@ -2189,6 +2197,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                         int offset = vPC[7].u.operand;
 
                         ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
+                        ASSERT(baseValue.get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
                         callFrame->r(dst) = JSValue(baseObject->getDirectOffset(offset));
 
                         vPC += OPCODE_LENGTH(op_get_by_id_chain);
@@ -2256,7 +2265,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->value().size());
+            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->length());
             vPC += OPCODE_LENGTH(op_get_string_length);
             NEXT_INSTRUCTION();
         }
@@ -2470,7 +2479,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 else
                     result = jsArray->JSArray::get(callFrame, i);
             } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
-                result = asString(baseValue)->getIndex(&callFrame->globalData(), i);
+                result = asString(baseValue)->getIndex(callFrame, i);
             else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i))
                 result = asByteArray(baseValue)->getIndex(callFrame, i);
             else
@@ -2638,6 +2647,26 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_loop_if_true);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_loop_if_false) {
+        /* loop_if_true cond(r) target(offset)
+         
+           Jumps to offset target from the current instruction, if and
+           only if register cond converts to boolean as false.
+
+           Additionally this loop instruction may terminate JS execution is
+           the JS timeout is reached.
+         */
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
+        if (!callFrame->r(cond).jsValue().toBoolean(callFrame)) {
+            vPC += target;
+            CHECK_FOR_TIMEOUT();
+            NEXT_INSTRUCTION();
+        }
+        
+        vPC += OPCODE_LENGTH(op_loop_if_true);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jtrue) {
         /* jtrue cond(r) target(offset)
 
@@ -2698,7 +2727,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
-        if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+        if (!srcValue.isUndefinedOrNull() && (!srcValue.isCell() || !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -2801,6 +2830,29 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_jnless);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_jless) {
+        /* jless src1(r) src2(r) target(offset)
+
+           Checks whether register src1 is less than register src2, as
+           with the ECMAScript '<' operator, and then jumps to offset
+           target from the current instruction, if and only if the 
+           result of the comparison is true.
+        */
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
+
+        bool result = jsLess(callFrame, src1, src2);
+        CHECK_FOR_EXCEPTION();
+        
+        if (result) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        vPC += OPCODE_LENGTH(op_jless);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jnlesseq) {
         /* jnlesseq src1(r) src2(r) target(offset)
 
@@ -2863,7 +2915,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
-            UString::Rep* value = asString(scrutinee)->value().rep();
+            UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
             if (value->size() != 1)
                 vPC += defaultOffset;
             else
@@ -2886,7 +2938,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
-            vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value().rep(), defaultOffset);
+            vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value(callFrame).rep(), defaultOffset);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_func) {
@@ -3478,7 +3530,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int src = vPC[2].u.operand;
         int count = vPC[3].u.operand;
 
-        callFrame->r(dst) = concatenateStrings(callFrame, &callFrame->registers()[src], count);
+        callFrame->r(dst) = jsString(callFrame, &callFrame->registers()[src], count);
+        CHECK_FOR_EXCEPTION();
         vPC += OPCODE_LENGTH(op_strcat);
 
         NEXT_INSTRUCTION();
diff --git a/JavaScriptCore/interpreter/Register.h b/JavaScriptCore/interpreter/Register.h
index 76184ba..d0b0568 100644
--- a/JavaScriptCore/interpreter/Register.h
+++ b/JavaScriptCore/interpreter/Register.h
@@ -104,6 +104,9 @@ namespace JSC {
 
     ALWAYS_INLINE Register::Register(JSValue v)
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
+#endif
         u.value = JSValue::encode(v);
     }
 
diff --git a/JavaScriptCore/jit/ExecutableAllocator.h b/JavaScriptCore/jit/ExecutableAllocator.h
index 1d15ef0..9ca62c8 100644
--- a/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/JavaScriptCore/jit/ExecutableAllocator.h
@@ -189,6 +189,22 @@ public:
         sys_dcache_flush(code, size);
         sys_icache_invalidate(code, size);
     }
+#elif PLATFORM(ARM_THUMB2) && PLATFORM(LINUX)
+    static void cacheFlush(void* code, size_t size)
+    {
+        asm volatile (
+            "push    {r7}\n"
+            "mov     r0, %0\n"
+            "mov     r1, %1\n"
+            "movw    r7, #0x2\n"
+            "movt    r7, #0xf\n"
+            "movs    r2, #0x0\n"
+            "svc     0x0\n"
+            "pop     {r7}\n"
+            :
+            : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
+            : "r0", "r1", "r2");
+    }
 #elif PLATFORM(SYMBIAN)
     static void cacheFlush(void* code, size_t size)
     {
@@ -208,7 +224,7 @@ public:
             "pop     {r7}\n"
             :
             : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
-            : "r0", "r1");
+            : "r0", "r1", "r2");
     }
 #else
     #error "The cacheFlush support is missing on this platform."
diff --git a/JavaScriptCore/jit/JIT.cpp b/JavaScriptCore/jit/JIT.cpp
index 000e4b8..585486f 100644
--- a/JavaScriptCore/jit/JIT.cpp
+++ b/JavaScriptCore/jit/JIT.cpp
@@ -37,7 +37,6 @@ JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse
 #include "CodeBlock.h"
 #include "Interpreter.h"
 #include "JITInlineMethods.h"
-#include "JITStubs.h"
 #include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
@@ -251,6 +250,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_jneq_null)
         DEFINE_OP(op_jneq_ptr)
         DEFINE_OP(op_jnless)
+        DEFINE_OP(op_jless)
         DEFINE_OP(op_jnlesseq)
         DEFINE_OP(op_jsr)
         DEFINE_OP(op_jtrue)
@@ -259,6 +259,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_loop_if_less)
         DEFINE_OP(op_loop_if_lesseq)
         DEFINE_OP(op_loop_if_true)
+        DEFINE_OP(op_loop_if_false)
         DEFINE_OP(op_lshift)
         DEFINE_OP(op_method_check)
         DEFINE_OP(op_mod)
@@ -390,11 +391,13 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_instanceof)
         DEFINE_SLOWCASE_OP(op_jfalse)
         DEFINE_SLOWCASE_OP(op_jnless)
+        DEFINE_SLOWCASE_OP(op_jless)
         DEFINE_SLOWCASE_OP(op_jnlesseq)
         DEFINE_SLOWCASE_OP(op_jtrue)
         DEFINE_SLOWCASE_OP(op_loop_if_less)
         DEFINE_SLOWCASE_OP(op_loop_if_lesseq)
         DEFINE_SLOWCASE_OP(op_loop_if_true)
+        DEFINE_SLOWCASE_OP(op_loop_if_false)
         DEFINE_SLOWCASE_OP(op_lshift)
         DEFINE_SLOWCASE_OP(op_method_check)
         DEFINE_SLOWCASE_OP(op_mod)
diff --git a/JavaScriptCore/jit/JIT.h b/JavaScriptCore/jit/JIT.h
index e19ea17..0b902b9 100644
--- a/JavaScriptCore/jit/JIT.h
+++ b/JavaScriptCore/jit/JIT.h
@@ -465,6 +465,47 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 11;
         static const int patchOffsetMethodCheckProtoStruct = 18;
         static const int patchOffsetMethodCheckPutFunction = 29;
+#elif PLATFORM(ARM_TRADITIONAL)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 4;
+        static const int patchOffsetPutByIdExternalLoad = 16;
+        static const int patchLengthPutByIdExternalLoad = 4;
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 28;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 4;
+        static const int patchOffsetGetByIdBranchToSlowCase = 16;
+        static const int patchOffsetGetByIdExternalLoad = 16;
+        static const int patchLengthGetByIdExternalLoad = 4;
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 28;
+        static const int patchOffsetGetByIdPutResult = 36;
+#if ENABLE(OPCODE_SAMPLING)
+        #error "OPCODE_SAMPLING is not yet supported"
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 32;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 12;
+
+        static const int patchOffsetMethodCheckProtoObj = 12;
+        static const int patchOffsetMethodCheckProtoStruct = 20;
+        static const int patchOffsetMethodCheckPutFunction = 32;
+
+        // sequenceOpCall
+        static const int sequenceOpCallInstructionSpace = 12;
+        static const int sequenceOpCallConstantSpace = 2;
+        // sequenceMethodCheck
+        static const int sequenceMethodCheckInstructionSpace = 40;
+        static const int sequenceMethodCheckConstantSpace = 6;
+        // sequenceGetByIdHotPath
+        static const int sequenceGetByIdHotPathInstructionSpace = 36;
+        static const int sequenceGetByIdHotPathConstantSpace = 4;
+        // sequenceGetByIdSlowCase
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 40;
+        static const int sequenceGetByIdSlowCaseConstantSpace = 2;
+        // sequencePutById
+        static const int sequencePutByIdInstructionSpace = 36;
+        static const int sequencePutByIdConstantSpace = 4;
 #else
 #error "JSVALUE32_64 not supported on this platform."
 #endif
@@ -629,10 +670,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 12;
         static const int patchOffsetMethodCheckProtoStruct = 20;
         static const int patchOffsetMethodCheckPutFunction = 32;
-#endif
-#endif // USE(JSVALUE32_64)
 
-#if PLATFORM(ARM_TRADITIONAL)
         // sequenceOpCall
         static const int sequenceOpCallInstructionSpace = 12;
         static const int sequenceOpCallConstantSpace = 2;
@@ -649,6 +687,7 @@ namespace JSC {
         static const int sequencePutByIdInstructionSpace = 28;
         static const int sequencePutByIdConstantSpace = 3;
 #endif
+#endif // USE(JSVALUE32_64)
 
 #if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
 #define BEGIN_UNINTERRUPTED_SEQUENCE(name) beginUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace)
@@ -697,6 +736,7 @@ namespace JSC {
         void emit_op_jneq_null(Instruction*);
         void emit_op_jneq_ptr(Instruction*);
         void emit_op_jnless(Instruction*);
+        void emit_op_jless(Instruction*);
         void emit_op_jnlesseq(Instruction*);
         void emit_op_jsr(Instruction*);
         void emit_op_jtrue(Instruction*);
@@ -705,6 +745,7 @@ namespace JSC {
         void emit_op_loop_if_less(Instruction*);
         void emit_op_loop_if_lesseq(Instruction*);
         void emit_op_loop_if_true(Instruction*);
+        void emit_op_loop_if_false(Instruction*);
         void emit_op_lshift(Instruction*);
         void emit_op_method_check(Instruction*);
         void emit_op_mod(Instruction*);
@@ -779,11 +820,13 @@ namespace JSC {
         void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jless(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_less(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_lesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_true(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_false(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
diff --git a/JavaScriptCore/jit/JITArithmetic.cpp b/JavaScriptCore/jit/JITArithmetic.cpp
index 8cda482..70f7564 100644
--- a/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/JavaScriptCore/jit/JITArithmetic.cpp
@@ -148,6 +148,69 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
+void JIT::emit_op_jless(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    // Int32 less.
+    if (isOperandConstantImmediateInt(op1)) {
+        emitLoad(op2, regT3, regT2);
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
+    } else {
+        emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT0, regT2), target);
+    }
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double less.
+    emitBinaryDoubleOp(op_jless, target, op1, op2, OperandTypes(), notInt32Op1, notInt32Op2, !isOperandConstantImmediateInt(op1), isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2));
+    end.link(this);
+}
+
+void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    if (!supportsFloatingPoint()) {
+        if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // int32 check
+        linkSlowCase(iter); // int32 check
+    } else {
+        if (!isOperandConstantImmediateInt(op1)) {
+            linkSlowCase(iter); // double check
+            linkSlowCase(iter); // int32 check
+        }
+        if (isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // double check
+    }
+
+    JITStubCall stubCall(this, cti_op_jless);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+}
+
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -829,11 +892,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT0, fpRegT2), dst);
+                break;
+            case op_jless:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThan, fpRegT2, fpRegT0), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT0, fpRegT2), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -882,11 +949,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), dst);
+                break;
+            case op_jless:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -1000,20 +1071,11 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     divDouble(fpRegT1, fpRegT0);
 
     JumpList doubleResult;
-    if (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) {
-        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
-        convertInt32ToDouble(regT0, fpRegT1);
-        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
-
-        doubleResult.append(m_assembler.jne());
-        doubleResult.append(m_assembler.jp());
-        
-        doubleResult.append(branchTest32(Zero, regT0));
+    branchConvertDoubleToInt32(fpRegT0, regT0, doubleResult, fpRegT1);
 
-        // Int32 result.
-        emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
-        end.append(jump());
-    }
+    // Int32 result.
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+    end.append(jump());
 
     // Double result.
     doubleResult.link(this);
@@ -1152,13 +1214,8 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotImmediateInteger(regT2);
     emitFastArithImmToInt(regT0);
     emitFastArithImmToInt(regT2);
-#if !PLATFORM(X86)
-    // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-    // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-    and32(Imm32(0x1f), regT2);
-#endif
     lshift32(regT2, regT0);
-#if !USE(JSVALUE64)
+#if USE(JSVALUE32)
     addSlowCase(branchAdd32(Overflow, regT0, regT0));
     signExtend32ToPtr(regT0, regT0);
 #endif
@@ -1203,11 +1260,7 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-#if USE(JSVALUE64)
         rshift32(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
-#else
-        rshiftPtr(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
-#endif
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT2);
         if (supportsFloatingPointTruncate()) {
@@ -1234,15 +1287,9 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
             emitJumpSlowCaseIfNotImmediateInteger(regT2);
         }
         emitFastArithImmToInt(regT2);
-#if !PLATFORM(X86)
-        // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-        // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-        and32(Imm32(0x1f), regT2);
-#endif
-#if USE(JSVALUE64)
         rshift32(regT2, regT0);
-#else
-        rshiftPtr(regT2, regT0);
+#if USE(JSVALUE32)
+        signExtend32ToPtr(regT0, regT0);
 #endif
     }
 #if USE(JSVALUE64)
@@ -1365,7 +1412,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1406,7 +1453,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1452,7 +1499,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1479,6 +1526,191 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     }
 }
 
+void JIT::emit_op_jless(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(JSVALUE64)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(JSVALUE64)
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
+#else
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
+#endif
+        addJump(branch32(GreaterThan, regT1, Imm32(op1imm)), target);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(LessThan, regT0, regT1), target);
+    }
+}
+
+void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+#endif
+            
+            int32_t op2imm = getConstantOperand(op2).asInt32();
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+            
+            int32_t op1imm = getConstantOperand(op1).asInt32();
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+
+    } else {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
+#endif
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+    }
+}
+
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -1550,7 +1782,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1591,7 +1823,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1637,7 +1869,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -2160,27 +2392,10 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     }
     divDouble(fpRegT1, fpRegT0);
 
-    JumpList doubleResult;
-    Jump end;
-    bool attemptIntConversion = (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) && isOperandConstantImmediateInt(op2);
-    if (attemptIntConversion) {
-        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
-        doubleResult.append(branchTest32(Zero, regT0));
-        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
-        
-        doubleResult.append(m_assembler.jne());
-        doubleResult.append(m_assembler.jp());
-        emitFastArithIntToImmNoCheck(regT0, regT0);
-        end = jump();
-    }
-
     // Double result.
-    doubleResult.link(this);
     moveDoubleToPtr(fpRegT0, regT0);
     subPtr(tagTypeNumberRegister, regT0);
 
-    if (attemptIntConversion)
-        end.link(this);
     emitPutVirtualRegister(dst, regT0);
 }
 
diff --git a/JavaScriptCore/jit/JITCall.cpp b/JavaScriptCore/jit/JITCall.cpp
index f7fcc0a..179aad7 100644
--- a/JavaScriptCore/jit/JITCall.cpp
+++ b/JavaScriptCore/jit/JITCall.cpp
@@ -315,7 +315,13 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     emitLoad(callee, regT1, regT0);
 
     DataLabelPtr addressOfLinkedFunctionCheck;
+
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(0));
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     addSlowCase(jumpToSlow);
     ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
diff --git a/JavaScriptCore/jit/JITInlineMethods.h b/JavaScriptCore/jit/JITInlineMethods.h
index 93d6ce7..1ce6889 100644
--- a/JavaScriptCore/jit/JITInlineMethods.h
+++ b/JavaScriptCore/jit/JITInlineMethods.h
@@ -37,7 +37,7 @@ namespace JSC {
 // puts an arg onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(src, argumentStackOffset);
 }
 
@@ -45,7 +45,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumbe
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(Imm32(value), argumentStackOffset);
 }
 
@@ -53,7 +53,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argum
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(ImmPtr(value), argumentStackOffset);
 }
 
@@ -61,7 +61,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argument
 
 ALWAYS_INLINE void JIT::emitGetJITStubArg(unsigned argumentNumber, RegisterID dst)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     peek(dst, argumentStackOffset);
 }
 
@@ -585,7 +585,7 @@ ALWAYS_INLINE bool JIT::getOperandConstantImmediateInt(unsigned op1, unsigned op
 
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(payload, argumentStackOffset);
     poke(tag, argumentStackOffset + 1);
 }
@@ -594,7 +594,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, un
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch1, RegisterID scratch2)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue constant = m_codeBlock->getConstant(src);
         poke(Imm32(constant.payload()), argumentStackOffset);
@@ -817,7 +817,7 @@ ALWAYS_INLINE void JIT::emitFastArithImmToInt(RegisterID reg)
 #if USE(JSVALUE64)
     UNUSED_PARAM(reg);
 #else
-    rshiftPtr(Imm32(JSImmediate::IntegerPayloadShift), reg);
+    rshift32(Imm32(JSImmediate::IntegerPayloadShift), reg);
 #endif
 }
 
@@ -846,7 +846,7 @@ ALWAYS_INLINE void JIT::emitTagAsBoolImmediate(RegisterID reg)
 // get arg puts an arg from the SF register array onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue value = m_codeBlock->getConstant(src);
         poke(ImmPtr(JSValue::encode(value)), argumentStackOffset);
diff --git a/JavaScriptCore/jit/JITOpcodes.cpp b/JavaScriptCore/jit/JITOpcodes.cpp
index 14736cf..77fec28 100644
--- a/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/JavaScriptCore/jit/JITOpcodes.cpp
@@ -52,8 +52,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT2);
-    load32(Address(regT2, OBJECT_OFFSETOF(UString::Rep, len)), regT2);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_stringLength)), regT2);
 
     Jump string_failureCases3 = branch32(Above, regT2, Imm32(INT_MAX));
     move(regT2, regT0);
@@ -138,7 +137,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCode)), regT0);
     jump(regT0);
 
-#if PLATFORM(X86)
+#if PLATFORM(X86) || PLATFORM(ARM_TRADITIONAL)
     Label nativeCallThunk = align();
     preserveReturnAddressAfterCall(regT0);
     emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
@@ -149,6 +148,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
     
+#if PLATFORM(X86)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     /* We have two structs that we use to describe the stackframe we set up for our
@@ -248,6 +248,66 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
+#elif PLATFORM(ARM_TRADITIONAL)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    // Allocate stack space for our arglist
+    COMPILE_ASSERT((sizeof(ArgList) & 0x7) == 0 && sizeof(JSValue) == 8 && sizeof(Register) == 8, ArgList_should_by_8byte_aligned);
+    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // Push argcount
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
+
+    // Calculate the start of the callframe header, and store in regT1
+    move(callFrameRegister, regT1);
+    sub32(Imm32(RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), regT1);
+
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT1)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+
+    // push pointer to arguments
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
+
+    // Argument passing method:
+    // r0 - points to return value
+    // r1 - callFrame
+    // r2 - callee
+    // stack: this(JSValue) and a pointer to ArgList
+
+    move(stackPointerRegister, regT3);
+    subPtr(Imm32(8), stackPointerRegister);
+    move(stackPointerRegister, regT0);
+    subPtr(Imm32(8 + 4 + 4 /* padding */), stackPointerRegister);
+
+    // Setup arg4:
+    storePtr(regT3, Address(stackPointerRegister, 8));
+
+    // Setup arg3
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    load32(Address(regT1, -(int32_t)sizeof(void*) * 2), regT3);
+    storePtr(regT3, Address(stackPointerRegister, 0));
+    load32(Address(regT1, -(int32_t)sizeof(void*)), regT3);
+    storePtr(regT3, Address(stackPointerRegister, 4));
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    // Load return value
+    load32(Address(stackPointerRegister, 16), regT0);
+    load32(Address(stackPointerRegister, 20), regT1);
+
+    addPtr(Imm32(sizeof(ArgList) + 16 + 8), stackPointerRegister);
+#endif
+
     // Check for an exception
     move(ImmPtr(&globalData->exception), regT2);
     Jump sawException = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::EmptyValueTag));
@@ -394,7 +454,7 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
         linkSlowCase(iter); // int32 check
     linkSlowCase(iter); // int32 check
 
-    JITStubCall stubCall(this, cti_op_loop_if_less);
+    JITStubCall stubCall(this, cti_op_jless);
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
@@ -683,6 +743,50 @@ void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowC
     emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
+void JIT::emit_op_loop_if_false(Instruction* currentInstruction)
+{
+    unsigned cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitTimeoutCheck();
+
+    emitLoad(cond, regT1, regT0);
+
+    Jump isTrue = branch32(Equal, regT1, Imm32(JSValue::TrueTag));
+    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target);
+
+    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    Jump isTrue2 = branch32(NotEqual, regT0, Imm32(0));
+    addJump(jump(), target);
+
+    if (supportsFloatingPoint()) {
+        isNotInteger.link(this);
+
+        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+
+        zeroDouble(fpRegT0);
+        emitLoadDouble(cond, fpRegT1);
+        addJump(branchDouble(DoubleEqualOrUnordered, fpRegT0, fpRegT1), target);
+    } else
+        addSlowCase(isNotInteger);
+
+    isTrue.link(this);
+    isTrue2.link(this);
+}
+
+void JIT::emitSlow_op_loop_if_false(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_jtrue);
+    stubCall.addArgument(cond);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target);
+}
+
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_base);
@@ -786,7 +890,7 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target);
+        addJump(branchDouble(DoubleEqualOrUnordered, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -1532,8 +1636,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT0);
-    load32(Address(regT0, OBJECT_OFFSETOF(UString::Rep, len)), regT0);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_stringLength)), regT0);
 
     Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
 
@@ -1756,7 +1859,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif PLATFORM(ARM)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     // Allocate stack space for our arglist
@@ -1790,7 +1893,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     move(callFrameRegister, regT0);
 
     // Setup arg4: This is a plain hack
-    move(stackPointerRegister, ARMRegisters::S0);
+    move(stackPointerRegister, ARMRegisters::r3);
 
     call(Address(regT1, OBJECT_OFFSETOF(JSFunction, m_data)));
 
@@ -2196,6 +2299,25 @@ void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
 
     isZero.link(this);
 };
+
+void JIT::emit_op_loop_if_false(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target);
+    Jump isNonZero = emitJumpIfImmediateInteger(regT0);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))));
+
+    isNonZero.link(this);
+    RECORD_JUMP_TARGET(target);
+};
+
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_base);
@@ -2882,14 +3004,14 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
     unsigned target = currentInstruction[3].u.operand;
     if (isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
+        JITStubCall stubCall(this, cti_op_jless);
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
         emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
+        JITStubCall stubCall(this, cti_op_jless);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT0);
         stubCall.call();
@@ -2897,7 +3019,7 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
     } else {
         linkSlowCase(iter);
         linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
+        JITStubCall stubCall(this, cti_op_jless);
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
@@ -2954,6 +3076,15 @@ void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowC
     emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
 }
 
+void JIT::emitSlow_op_loop_if_false(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand); // inverted!
+}
+
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
diff --git a/JavaScriptCore/jit/JITPropertyAccess.cpp b/JavaScriptCore/jit/JITPropertyAccess.cpp
index bf367a6..e2995a1 100644
--- a/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -212,12 +212,17 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
     emitLoad(base, regT1, regT0);
     emitJumpSlowCaseIfNotJSCell(base, regT1);
 
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+
     Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
     Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
 
     // This will be relinked to load the function without doing a load.
     DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+ 
+    END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+    
     move(Imm32(JSValue::CellTag), regT1);
     Jump match = jump();
 
@@ -374,6 +379,9 @@ void JIT::compileGetByIdHotPath()
     // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
     // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
     // to jump back to if one of these trampolies finds a match.
+
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+    
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
     m_propertyAccessInstructionIndex++;
@@ -396,6 +404,8 @@ void JIT::compileGetByIdHotPath()
 
     Label putResult(this);
     ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
 }
 
 void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -417,13 +427,18 @@ void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<Sl
     linkSlowCaseIfNotJSCell(iter, base);
     linkSlowCase(iter);
 
-    Label coldPathBegin(this);
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
 
+#ifndef NDEBUG
+    Label coldPathBegin(this);
+#endif
     JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
     stubCall.addArgument(regT1, regT0);
     stubCall.addArgument(ImmPtr(ident));
     Call call = stubCall.call(dst);
 
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+
     ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
 
     // Track the location of the call; this will be used to recover patch information.
@@ -444,6 +459,8 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(base, regT1);
 
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequencePutById);
+
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
     m_propertyAccessInstructionIndex++;
@@ -461,6 +478,9 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 
     DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
     DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
+
+    END_UNINTERRUPTED_SEQUENCE(sequencePutById);
+
     ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
     ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
 }
diff --git a/JavaScriptCore/jit/JITStubCall.h b/JavaScriptCore/jit/JITStubCall.h
index c5ed9e3..cfbd7dc 100644
--- a/JavaScriptCore/jit/JITStubCall.h
+++ b/JavaScriptCore/jit/JITStubCall.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Cell)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -46,7 +46,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Cell)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -54,7 +54,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(VoidPtr)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -62,7 +62,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Int)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -70,7 +70,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Int)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -78,7 +78,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Void)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -87,7 +87,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Value)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 #endif
@@ -145,7 +145,7 @@ namespace JSC {
 
         void getArgument(size_t argumentNumber, JIT::RegisterID tag, JIT::RegisterID payload)
         {
-            size_t stackIndex = stackIndexStart + (argumentNumber * stackIndexStep);
+            size_t stackIndex = JITSTACKFRAME_ARGS_INDEX + (argumentNumber * stackIndexStep);
             m_jit->peek(payload, stackIndex);
             m_jit->peek(tag, stackIndex + 1);
         }
@@ -222,7 +222,6 @@ namespace JSC {
 
     private:
         static const size_t stackIndexStep = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 2 : 1;
-        static const size_t stackIndexStart = 1; // Index 0 is reserved for restoreArgumentReference().
 
         JIT* m_jit;
         FunctionPtr m_stub;
diff --git a/JavaScriptCore/jit/JITStubs.cpp b/JavaScriptCore/jit/JITStubs.cpp
index c999618..8dd7a97 100644
--- a/JavaScriptCore/jit/JITStubs.cpp
+++ b/JavaScriptCore/jit/JITStubs.cpp
@@ -56,6 +56,7 @@
 #include "RegExpPrototype.h"
 #include "Register.h"
 #include "SamplingTool.h"
+#include <wtf/StdLibExtras.h>
 #include <stdarg.h>
 #include <stdio.h>
 
@@ -81,6 +82,19 @@ namespace JSC {
 #define SYMBOL_STRING_RELOCATION(name) SYMBOL_STRING(name)
 #endif
 
+#if PLATFORM(DARWIN)
+    // Mach-O platform
+#define HIDE_SYMBOL(name) ".private_extern _" #name
+#elif PLATFORM(AIX)
+    // IBM's own file format
+#define HIDE_SYMBOL(name) ".lglobl " #name
+#elif PLATFORM(LINUX) || PLATFORM(FREEBSD) || PLATFORM(OPENBSD) || PLATFORM(SOLARIS) || (PLATFORM(HPUX) && PLATFORM(IA64)) || PLATFORM(SYMBIAN) || PLATFORM(NETBSD)
+    // ELF platform
+#define HIDE_SYMBOL(name) ".hidden " #name
+#else
+#define HIDE_SYMBOL(name)
+#endif
+
 #if USE(JSVALUE32_64)
 
 #if COMPILER(GCC) && PLATFORM(X86)
@@ -93,7 +107,9 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x58, JITStackFrame_
 COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x50, JITStackFrame_code_offset_matches_ctiTrampoline);
 
 asm volatile (
+".text\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushl %ebp" "\n"
     "movl %esp, %ebp" "\n"
@@ -114,6 +130,7 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
@@ -129,6 +146,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "addl $0x3c, %esp" "\n"
     "popl %ebx" "\n"
@@ -153,6 +171,7 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x80, JITStackFrame_code_
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushq %rbp" "\n"
     "movq %rsp, %rbp" "\n"
@@ -179,6 +198,7 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
     "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
@@ -194,6 +214,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "addq $0x48, %rsp" "\n"
     "popq %rbx" "\n"
@@ -215,6 +236,7 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
@@ -241,6 +263,7 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
@@ -269,6 +292,40 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "bx lr" "\n"
 );
 
+#elif COMPILER(GCC) && PLATFORM(ARM_TRADITIONAL)
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "stmdb sp!, {r1-r3}" "\n"
+    "stmdb sp!, {r4-r8, lr}" "\n"
+    "sub sp, sp, #68" "\n"
+    "mov r4, r2" "\n"
+    "mov r5, #512" "\n"
+    // r0 contains the code
+    "mov lr, pc" "\n"
+    "mov pc, r0" "\n"
+    "add sp, sp, #68" "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "mov r0, sp" "\n"
+    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+
+// Both has the same return sequence
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "add sp, sp, #68" "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+);
+
 #elif COMPILER(MSVC)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
@@ -346,7 +403,9 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_
 COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
 
 asm volatile (
+".text\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushl %ebp" "\n"
     "movl %esp, %ebp" "\n"
@@ -367,6 +426,7 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
@@ -382,6 +442,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "addl $0x1c, %esp" "\n"
     "popl %ebx" "\n"
@@ -404,7 +465,9 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x48, JITStackFrame_code_
 COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x78, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
 
 asm volatile (
+".text\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushq %rbp" "\n"
     "movq %rsp, %rbp" "\n"
@@ -438,6 +501,7 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
     "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
@@ -453,6 +517,7 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "addq $0x78, %rsp" "\n"
     "popq %rbx" "\n"
@@ -474,6 +539,7 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
@@ -500,6 +566,7 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
@@ -517,6 +584,7 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 ".thumb" "\n"
 ".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
@@ -531,7 +599,9 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
 #elif COMPILER(GCC) && PLATFORM(ARM_TRADITIONAL)
 
 asm volatile (
+".text\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "stmdb sp!, {r1-r3}" "\n"
     "stmdb sp!, {r4-r8, lr}" "\n"
@@ -548,12 +618,14 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "mov r0, sp" "\n"
     "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
 
 // Both has the same return sequence
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "add sp, sp, #36" "\n"
     "ldmia sp!, {r4-r8, lr}" "\n"
@@ -758,6 +830,11 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         return;
     }
 
+    if (structure->isDictionary()) {
+        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
+        return;
+    }
+
     if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
         ASSERT(slot.slotBase().isObject());
 
@@ -766,10 +843,12 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+            slotBaseObject->flattenDictionaryObject();
         
         stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
 
+        ASSERT(!structure->isDictionary());
+        ASSERT(!slotBaseObject->structure()->isDictionary());
         JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
         return;
     }
@@ -888,6 +967,7 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         ".text" "\n" \
         ".align 2" "\n" \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
+        HIDE_SYMBOL(cti_##op) "\n"             \
         ".thumb" "\n" \
         ".thumb_func " THUMB_FUNC_PARAM(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
@@ -900,6 +980,14 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
 
 #elif PLATFORM(ARM_TRADITIONAL) && COMPILER(GCC)
 
+#if USE(JSVALUE32_64)
+#define THUNK_RETURN_ADDRESS_OFFSET 64
+#else
+#define THUNK_RETURN_ADDRESS_OFFSET 32
+#endif
+
+COMPILE_ASSERT(offsetof(struct JITStackFrame, thunkReturnAddress) == THUNK_RETURN_ADDRESS_OFFSET, JITStackFrame_thunkReturnAddress_offset_mismatch);
+
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
         rtype JITStubThunked_##op(STUB_ARGS_DECLARATION); \
@@ -907,9 +995,9 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
     asm volatile ( \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
-        "str lr, [sp, #32]" "\n" \
+        "str lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
-        "ldr lr, [sp, #32]" "\n" \
+        "ldr lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "mov pc, lr" "\n" \
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
@@ -945,38 +1033,19 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
 
     JSValue v1 = stackFrame.args[0].jsValue();
     JSValue v2 = stackFrame.args[1].jsValue();
-
-    double left;
-    double right = 0.0;
-
-    bool rightIsNumber = v2.getNumber(right);
-    if (rightIsNumber && v1.getNumber(left))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
-    
     CallFrame* callFrame = stackFrame.callFrame;
 
-    bool leftIsString = v1.isString();
-    if (leftIsString && v2.isString()) {
-        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-
-        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
+    if (v1.isString()) {
+        JSValue result = v2.isString()
+            ? jsString(callFrame, asString(v1), asString(v2))
+            : jsString(callFrame, asString(v1), v2.toString(callFrame));
+        CHECK_FOR_EXCEPTION_AT_END();
+        return JSValue::encode(result);
     }
 
-    if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = v2.isInt32() ?
-            concatenate(asString(v1)->value().rep(), v2.asInt32()) :
-            concatenate(asString(v1)->value().rep(), right);
-
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
-    }
+    double left = 0.0, right;
+    if (v1.getNumber(left) && v2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
 
     // All other cases are pretty uncommon
     JSValue result = jsAddSlowCase(callFrame, v1, v2);
@@ -1025,19 +1094,6 @@ DEFINE_STUB_FUNCTION(void, register_file_check)
     throwStackOverflowError(oldCallFrame, stackFrame.globalData, ReturnAddressPtr(oldCallFrame->returnPC()), STUB_RETURN_ADDRESS);
 }
 
-DEFINE_STUB_FUNCTION(int, op_loop_if_less)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-    JSValue src2 = stackFrame.args[1].jsValue();
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
 DEFINE_STUB_FUNCTION(int, op_loop_if_lesseq)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -1176,7 +1232,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+            slotBaseObject->flattenDictionaryObject();
 
         // The result fetched should always be the callee!
         ASSERT(result == JSValue(callee));
@@ -1311,7 +1367,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
     CHECK_FOR_EXCEPTION();
 
-    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isUncacheableDictionary()) {
+    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
         return JSValue::encode(result);
     }
@@ -1326,10 +1382,11 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
     if (slot.slotBase() == baseValue)
         ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
     else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
+        ASSERT(!asCell(baseValue)->structure()->isDictionary());
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+            slotBaseObject->flattenDictionaryObject();
 
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
@@ -1339,6 +1396,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
     } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase())) {
+        ASSERT(!asCell(baseValue)->structure()->isDictionary());
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
 
@@ -1807,7 +1865,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val)
         } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_string));
-            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+            result = asString(baseValue)->getIndex(callFrame, i);
         } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_byte_array));
@@ -1838,7 +1896,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_string)
     if (LIKELY(subscript.isUInt32())) {
         uint32_t i = subscript.asUInt32();
         if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
-            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+            result = asString(baseValue)->getIndex(callFrame, i);
         else {
             result = baseValue.get(callFrame, i);
             if (!isJSString(globalData, baseValue))
@@ -2003,19 +2061,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_lesseq)
     return JSValue::encode(result);
 }
 
-DEFINE_STUB_FUNCTION(int, op_loop_if_true)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = src1.toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-    
 DEFINE_STUB_FUNCTION(int, op_load_varargs)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2354,20 +2399,20 @@ DEFINE_STUB_FUNCTION(int, op_eq)
 
     if (cell1->isString()) {
         if (src2.isInt32())
-            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asInt32();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asInt32();
             
         if (src2.isDouble())
-            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asDouble();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asDouble();
 
         if (src2.isTrue())
-            return static_cast<JSString*>(cell1)->value().toDouble() == 1.0;
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 1.0;
 
         if (src2.isFalse())
-            return static_cast<JSString*>(cell1)->value().toDouble() == 0.0;
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 0.0;
 
         JSCell* cell2 = asCell(src2);
         if (cell2->isString())
-            return static_cast<JSString*>(cell1)->value() == static_cast<JSString*>(cell2)->value();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame) == static_cast<JSString*>(cell2)->value(stackFrame.callFrame);
 
         src2 = asObject(cell2)->toPrimitive(stackFrame.callFrame);
         CHECK_FOR_EXCEPTION();
@@ -2390,7 +2435,7 @@ DEFINE_STUB_FUNCTION(int, op_eq_strings)
 
     ASSERT(string1->isString());
     ASSERT(string2->isString());
-    return string1->value() == string2->value();
+    return string1->value(stackFrame.callFrame) == string2->value(stackFrame.callFrame);
 }
 
 #else // USE(JSVALUE32_64)
@@ -2688,7 +2733,7 @@ DEFINE_STUB_FUNCTION(int, has_property)
 
     JSObject* base = stackFrame.args[0].jsObject();
     JSString* property = stackFrame.args[1].jsString();
-    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value()));
+    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value(stackFrame.callFrame)));
 }
 
 DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
@@ -2765,7 +2810,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_stricteq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
-    return JSValue::encode(jsBoolean(JSValue::strictEqual(src1, src2)));
+    return JSValue::encode(jsBoolean(JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_primitive)
@@ -2779,7 +2824,9 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_strcat)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValue::encode(concatenateStrings(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32()));
+    JSValue result = jsString(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32());
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
@@ -2789,7 +2836,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
-    return JSValue::encode(jsBoolean(!JSValue::strictEqual(src1, src2)));
+    return JSValue::encode(jsBoolean(!JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_jsnumber)
@@ -2898,7 +2945,7 @@ DEFINE_STUB_FUNCTION(void*, op_switch_char)
     void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
 
     if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
+        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
         if (value->size() == 1)
             result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]).executableAddress();
     }
@@ -2918,7 +2965,7 @@ DEFINE_STUB_FUNCTION(void*, op_switch_string)
     void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
 
     if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
+        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
         result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value).executableAddress();
     }
 
diff --git a/JavaScriptCore/jit/JITStubs.h b/JavaScriptCore/jit/JITStubs.h
index 69776cb..f71dc9a 100644
--- a/JavaScriptCore/jit/JITStubs.h
+++ b/JavaScriptCore/jit/JITStubs.h
@@ -187,6 +187,8 @@ namespace JSC {
 #error "JITStackFrame not defined for this platform."
 #endif
 
+#define JITSTACKFRAME_ARGS_INDEX (OBJECT_OFFSETOF(JITStackFrame, args) / sizeof(void*))
+
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
     #define STUB_ARGS_DECLARATION void* args, ...
     #define STUB_ARGS (reinterpret_cast<void**>(vl_args) - 1)
@@ -333,9 +335,7 @@ extern "C" {
     int JIT_STUB cti_op_jlesseq(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_jtrue(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_load_varargs(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_less(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_has_property(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
diff --git a/JavaScriptCore/jsc.pro b/JavaScriptCore/jsc.pro
index c6efabc..9bcf08b 100644
--- a/JavaScriptCore/jsc.pro
+++ b/JavaScriptCore/jsc.pro
@@ -23,13 +23,13 @@ CONFIG(debug, debug|release) {
 OBJECTS_DIR_WTR = $$OBJECTS_DIR$${QMAKE_DIR_SEP}
 include($$PWD/JavaScriptCore.pri)
 
-lessThan(QT_MINOR_VERSION, 4) {
-    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-}
-
 *-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
 *-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
 
 symbian {
     TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
 }
+
+mac {
+    LIBS_PRIVATE += -framework AppKit
+}
\ No newline at end of file
diff --git a/JavaScriptCore/parser/Lexer.cpp b/JavaScriptCore/parser/Lexer.cpp
index df30838..9148230 100644
--- a/JavaScriptCore/parser/Lexer.cpp
+++ b/JavaScriptCore/parser/Lexer.cpp
@@ -39,10 +39,7 @@ using namespace Unicode;
 // We can't specify the namespace in yacc's C output, so do it here instead.
 using namespace JSC;
 
-#ifndef KDE_USE_FINAL
 #include "Grammar.h"
-#endif
-
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
diff --git a/JavaScriptCore/parser/Nodes.cpp b/JavaScriptCore/parser/Nodes.cpp
index 45009dc..4b97e9a 100644
--- a/JavaScriptCore/parser/Nodes.cpp
+++ b/JavaScriptCore/parser/Nodes.cpp
@@ -49,63 +49,6 @@ using namespace WTF;
 
 namespace JSC {
 
-/*
-    Details of the emitBytecode function.
-
-    Return value: The register holding the production's value.
-             dst: An optional parameter specifying the most efficient destination at
-                  which to store the production's value. The callee must honor dst.
-
-    The dst argument provides for a crude form of copy propagation. For example,
-
-        x = 1
-
-    becomes
-    
-        load r[x], 1
-    
-    instead of 
-
-        load r0, 1
-        mov r[x], r0
-    
-    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
-*/
-
-// ------------------------------ ThrowableExpressionData --------------------------------
-
-static void substitute(UString& string, const UString& substring)
-{
-    int position = string.find("%s");
-    ASSERT(position != -1);
-    UString newString = string.substr(0, position);
-    newString.append(substring);
-    newString.append(string.substr(position + 2));
-    string = newString;
-}
-
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
-{
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
-    generator.emitThrow(exception);
-    return exception;
-}
-
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
-{
-    UString message = messageTemplate;
-    substitute(message, label);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
-    generator.emitThrow(exception);
-    return exception;
-}
-
-inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
-{
-    return emitThrowError(generator, type, messageTemplate, label.ustring());
-}
 
 // ------------------------------ StatementNode --------------------------------
 
@@ -130,1753 +73,6 @@ inline StatementNode* SourceElements::singleStatement() const
     return size == 1 ? m_statements[0] : 0;
 }
 
-inline StatementNode* SourceElements::lastStatement() const
-{
-    size_t size = m_statements.size();
-    return size ? m_statements[size - 1] : 0;
-}
-
-// ------------------------------ NullNode -------------------------------------
-
-RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, jsNull());
-}
-
-// ------------------------------ BooleanNode ----------------------------------
-
-RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ NumberNode -----------------------------------
-
-RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ StringNode -----------------------------------
-
-RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ RegExpNode -----------------------------------
-
-RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
-    if (!regExp->isValid())
-        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
-}
-
-// ------------------------------ ThisNode -------------------------------------
-
-RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
-}
-
-// ------------------------------ ResolveNode ----------------------------------
-
-bool ResolveNode::isPure(BytecodeGenerator& generator) const
-{
-    return generator.isLocal(m_ident);
-}
-
-RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == generator.ignoredResult())
-            return 0;
-        return generator.moveToDestinationIfNeeded(dst, local);
-    }
-    
-    generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);
-    return generator.emitResolve(generator.finalDestination(dst), m_ident);
-}
-
-// ------------------------------ ArrayNode ------------------------------------
-
-RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // FIXME: Should we put all of this code into emitNewArray?
-
-    unsigned length = 0;
-    ElementNode* firstPutElement;
-    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
-        if (firstPutElement->elision())
-            break;
-        ++length;
-    }
-
-    if (!firstPutElement && !m_elision)
-        return generator.emitNewArray(generator.finalDestination(dst), m_element);
-
-    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
-
-    for (ElementNode* n = firstPutElement; n; n = n->next()) {
-        RegisterID* value = generator.emitNode(n->value());
-        length += n->elision();
-        generator.emitPutByIndex(array.get(), length++, value);
-    }
-
-    if (m_elision) {
-        RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
-        generator.emitPutById(array.get(), generator.propertyNames().length, value);
-    }
-
-    return generator.moveToDestinationIfNeeded(dst, array.get());
-}
-
-bool ArrayNode::isSimpleArray() const
-{
-    if (m_elision || m_optional)
-        return false;
-    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
-        if (ptr->elision())
-            return false;
-    }
-    return true;
-}
-
-ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
-{
-    ASSERT(!m_elision && !m_optional);
-    ElementNode* ptr = m_element;
-    if (!ptr)
-        return 0;
-    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
-    ArgumentListNode* tail = head;
-    ptr = ptr->next();
-    for (; ptr; ptr = ptr->next()) {
-        ASSERT(!ptr->elision());
-        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
-    }
-    return head;
-}
-
-// ------------------------------ ObjectLiteralNode ----------------------------
-
-RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-     if (!m_list) {
-         if (dst == generator.ignoredResult())
-             return 0;
-         return generator.emitNewObject(generator.finalDestination(dst));
-     }
-     return generator.emitNode(dst, m_list);
-}
-
-// ------------------------------ PropertyListNode -----------------------------
-
-RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> newObj = generator.tempDestination(dst);
-    
-    generator.emitNewObject(newObj.get());
-    
-    for (PropertyListNode* p = this; p; p = p->m_next) {
-        RegisterID* value = generator.emitNode(p->m_node->m_assign);
-        
-        switch (p->m_node->m_type) {
-            case PropertyNode::Constant: {
-                generator.emitPutById(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            case PropertyNode::Getter: {
-                generator.emitPutGetter(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            case PropertyNode::Setter: {
-                generator.emitPutSetter(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            default:
-                ASSERT_NOT_REACHED();
-        }
-    }
-    
-    return generator.moveToDestinationIfNeeded(dst, newObj.get());
-}
-
-// ------------------------------ BracketAccessorNode --------------------------------
-
-RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
-    RegisterID* property = generator.emitNode(m_subscript);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
-}
-
-// ------------------------------ DotAccessorNode --------------------------------
-
-RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
-}
-
-// ------------------------------ ArgumentListNode -----------------------------
-
-RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expr);
-    return generator.emitNode(dst, m_expr);
-}
-
-// ------------------------------ NewExprNode ----------------------------------
-
-RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.emitNode(m_expr);
-    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ EvalFunctionCallNode ----------------------------------
-
-RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.tempDestination(dst);
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
-    generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
-    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallValueNode ----------------------------------
-
-RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.emitNode(m_expr);
-    RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallResolveNode ----------------------------------
-
-RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
-        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
-        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-
-    RefPtr<RegisterID> func = generator.newTemporary();
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    int identifierStart = divot() - startOffset();
-    generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
-    generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallBracketNode ----------------------------------
-
-RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RegisterID* property = generator.emitNode(m_subscript);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
-    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallDotNode ----------------------------------
-
-RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> function = generator.tempDestination(dst);
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    generator.emitNode(thisRegister.get(), m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    generator.emitMethodCheck();
-    generator.emitGetById(function.get(), thisRegister.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<Label> realCall = generator.newLabel();
-    RefPtr<Label> end = generator.newLabel();
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
-    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
-    {
-        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
-        RefPtr<RegisterID> thisRegister = generator.newTemporary();
-        ArgumentListNode* oldList = m_args->m_listNode;
-        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
-            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-            m_args->m_listNode = m_args->m_listNode->m_next;
-        } else
-            generator.emitLoad(thisRegister.get(), jsNull());
-
-        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-        generator.emitJump(end.get());
-        m_args->m_listNode = oldList;
-    }
-    generator.emitLabel(realCall.get());
-    {
-        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-    generator.emitLabel(end.get());
-    return finalDestination.get();
-}
-    
-static bool areTrivialApplyArguments(ArgumentsNode* args)
-{
-    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
-        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
-}
-
-RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // A few simple cases can be trivially handled as ordinary function calls.
-    // function.apply(), function.apply(arg) -> identical to function.call
-    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
-    bool mayBeCall = areTrivialApplyArguments(m_args);
-
-    RefPtr<Label> realCall = generator.newLabel();
-    RefPtr<Label> end = generator.newLabel();
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
-    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
-    {
-        if (mayBeCall) {
-            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
-            RefPtr<RegisterID> thisRegister = generator.newTemporary();
-            ArgumentListNode* oldList = m_args->m_listNode;
-            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
-                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-                m_args->m_listNode = m_args->m_listNode->m_next;
-                if (m_args->m_listNode) {
-                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
-                    ASSERT(!m_args->m_listNode->m_next);
-                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
-                }
-            } else
-                generator.emitLoad(thisRegister.get(), jsNull());
-            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-            m_args->m_listNode = oldList;
-        } else {
-            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
-            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
-            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
-            RefPtr<RegisterID> thisRegister = generator.newTemporary();
-            RefPtr<RegisterID> argsRegister = generator.newTemporary();
-            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-            ArgumentListNode* args = m_args->m_listNode->m_next;
-            bool isArgumentsApply = false;
-            if (args->m_expr->isResolveNode()) {
-                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
-                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
-                if (isArgumentsApply)
-                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
-            }
-            if (!isArgumentsApply)
-                generator.emitNode(argsRegister.get(), args->m_expr);
-            while ((args = args->m_next))
-                generator.emitNode(args->m_expr);
-
-            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
-            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
-        }
-        generator.emitJump(end.get());
-    }
-    generator.emitLabel(realCall.get());
-    {
-        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-    generator.emitLabel(end.get());
-    return finalDestination.get();
-}
-
-// ------------------------------ PostfixResolveNode ----------------------------------
-
-static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
-{
-    return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);
-}
-
-static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
-{
-    if (srcDst == dst)
-        return generator.emitToJSNumber(dst, srcDst);
-    return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
-}
-
-RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            if (dst == generator.ignoredResult())
-                return 0;
-            return generator.emitToJSNumber(generator.finalDestination(dst), local);
-        }
-
-        if (dst == generator.ignoredResult())
-            return emitPreIncOrDec(generator, local, m_operator);
-        return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
-        RegisterID* oldValue;
-        if (dst == generator.ignoredResult()) {
-            oldValue = 0;
-            emitPreIncOrDec(generator, value.get(), m_operator);
-        } else {
-            oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-        }
-        generator.emitPutScopedVar(depth, index, value.get(), globalObject);
-        return oldValue;
-    }
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RefPtr<RegisterID> value = generator.newTemporary();
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        emitPreIncOrDec(generator, value.get(), m_operator);
-    } else {
-        oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-    }
-    generator.emitPutById(base.get(), m_ident, value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixBracketNode ----------------------------------
-
-RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
-    }
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixDotNode ----------------------------------
-
-RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
-    }
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixErrorNode -----------------------------------
-
-RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
-        ? "Postfix ++ operator applied to value that is not a reference."
-        : "Postfix -- operator applied to value that is not a reference.");
-}
-
-// ------------------------------ DeleteResolveNode -----------------------------------
-
-RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (generator.registerFor(m_ident))
-        return generator.emitLoad(generator.finalDestination(dst), false);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
-    return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
-}
-
-// ------------------------------ DeleteBracketNode -----------------------------------
-
-RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
-    RegisterID* r1 = generator.emitNode(m_subscript);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
-}
-
-// ------------------------------ DeleteDotNode -----------------------------------
-
-RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* r0 = generator.emitNode(m_base);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
-}
-
-// ------------------------------ DeleteValueNode -----------------------------------
-
-RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitNode(generator.ignoredResult(), m_expr);
-
-    // delete on a non-location expression ignores the value and returns true
-    return generator.emitLoad(generator.finalDestination(dst), true);
-}
-
-// ------------------------------ VoidNode -------------------------------------
-
-RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr);
-        return 0;
-    }
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
-    return generator.emitLoad(dst, jsUndefined());
-}
-
-// ------------------------------ TypeOfValueNode -----------------------------------
-
-RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == generator.ignoredResult())
-            return 0;
-        return generator.emitTypeOf(generator.finalDestination(dst), local);
-    }
-
-    RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
-    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
-}
-
-// ------------------------------ TypeOfValueNode -----------------------------------
-
-RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr);
-        return 0;
-    }
-    RefPtr<RegisterID> src = generator.emitNode(m_expr);
-    return generator.emitTypeOf(generator.finalDestination(dst), src.get());
-}
-
-// ------------------------------ PrefixResolveNode ----------------------------------
-
-RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            if (dst == generator.ignoredResult())
-                return 0;
-            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
-            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
-        }
-
-        emitPreIncOrDec(generator, local, m_operator);
-        return generator.moveToDestinationIfNeeded(dst, local);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        emitPreIncOrDec(generator, propDst.get(), m_operator);
-        generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);
-        return generator.moveToDestinationIfNeeded(dst, propDst.get());
-    }
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);
-    emitPreIncOrDec(generator, propDst.get(), m_operator);
-    generator.emitPutById(base.get(), m_ident, propDst.get());
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixBracketNode ----------------------------------
-
-RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
-    RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), value);
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixDotNode ----------------------------------
-
-RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
-    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value);
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixErrorNode -----------------------------------
-
-RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
-        ? "Prefix ++ operator applied to value that is not a reference."
-        : "Prefix -- operator applied to value that is not a reference.");
-}
-
-// ------------------------------ Unary Operation Nodes -----------------------------------
-
-RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* src = generator.emitNode(m_expr);
-    return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
-}
-
-// ------------------------------ Binary Operation Nodes -----------------------------------
-
-// BinaryOpNode::emitStrcat:
-//
-// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
-// more values, where we can determine a set of separate op_add operations would be operating on
-// string values.
-//
-// This function expects to be operating on a graph of AST nodes looking something like this:
-//
-//     (a)...     (b)
-//          \   /
-//           (+)     (c)
-//              \   /
-//      [d]     ((+))
-//         \    /
-//          [+=]
-//
-// The assignment operation is optional, if it exists the register holding the value on the
-// lefthand side of the assignment should be passing as the optional 'lhs' argument.
-//
-// The method should be called on the node at the root of the tree of regular binary add
-// operations (marked in the diagram with a double set of parentheses).  This node must
-// be performing a string concatenation (determined by statically detecting that at least
-// one child must be a string).  
-//
-// Since the minimum number of values being concatenated together is expected to be 3, if
-// a lhs to a concatenating assignment is not provided then the  root add should have at
-// least one left child that is also an add that can be determined to be operating on strings.
-//
-RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
-{
-    ASSERT(isAdd());
-    ASSERT(resultDescriptor().definitelyIsString());
-
-    // Create a list of expressions for all the adds in the tree of nodes we can convert into
-    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
-    // added first, and the leftmost child is never added, so the vector produced for the
-    // example above will be [ c, b ].
-    Vector<ExpressionNode*, 16> reverseExpressionList;
-    reverseExpressionList.append(m_expr2);
-
-    // Examine the left child of the add.  So long as this is a string add, add its right-child
-    // to the list, and keep processing along the left fork.
-    ExpressionNode* leftMostAddChild = m_expr1;
-    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
-        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
-        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
-    }
-
-    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
-
-    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
-    // We could possibly avoid this (the lhs is converted last anyway, we could let the
-    // op_strcat node handle its conversion if required).
-    if (lhs)
-        temporaryRegisters.append(generator.newTemporary());
-
-    // Emit code for the leftmost node ((a) in the example).
-    temporaryRegisters.append(generator.newTemporary());
-    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
-    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
-
-    // Note on ordering of conversions:
-    //
-    // We maintain the same ordering of conversions as we would see if the concatenations
-    // was performed as a sequence of adds (otherwise this optimization could change
-    // behaviour should an object have been provided a valueOf or toString method).
-    //
-    // Considering the above example, the sequnce of execution is:
-    //     * evaluate operand (a)
-    //     * evaluate operand (b)
-    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
-    //     * convert (b) to primitive   <-  (ditto)
-    //     * evaluate operand (c)
-    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
-    // And optionally, if there is an assignment:
-    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
-    //
-    // As such we do not plant an op to convert the leftmost child now.  Instead, use
-    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
-    // once the second node has been generated.  However, if the leftmost child is an
-    // immediate we can trivially determine that no conversion will be required.
-    // If this is the case
-    if (leftMostAddChild->isString())
-        leftMostAddChildTempRegister = 0;
-
-    while (reverseExpressionList.size()) {
-        ExpressionNode* node = reverseExpressionList.last();
-        reverseExpressionList.removeLast();
-
-        // Emit the code for the current node.
-        temporaryRegisters.append(generator.newTemporary());
-        generator.emitNode(temporaryRegisters.last().get(), node);
-
-        // On the first iteration of this loop, when we first reach this point we have just
-        // generated the second node, which means it is time to convert the leftmost operand.
-        if (leftMostAddChildTempRegister) {
-            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
-            leftMostAddChildTempRegister = 0; // Only do this once.
-        }
-        // Plant a conversion for this node, if necessary.
-        if (!node->isString())
-            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
-    }
-    ASSERT(temporaryRegisters.size() >= 3);
-
-    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
-    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
-    if (emitExpressionInfoForMe)
-        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
-
-    // If there is an assignment convert the lhs now.  This will also copy lhs to
-    // the temporary register we allocated for it.
-    if (lhs)
-        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
-
-    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
-}
-
-RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    OpcodeID opcodeID = this->opcodeID();
-
-    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
-        return emitStrcat(generator, dst);
-
-    if (opcodeID == op_neq) {
-        if (m_expr1->isNull() || m_expr2->isNull()) {
-            RefPtr<RegisterID> src = generator.tempDestination(dst);
-            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
-            return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
-        }
-    }
-
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
-}
-
-RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_expr1->isNull() || m_expr2->isNull()) {
-        RefPtr<RegisterID> src = generator.tempDestination(dst);
-        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
-        return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
-    }
-
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
-}
-
-RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
-}
-
-RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
-}
-
-RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
-}
-
-RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitGetByIdExceptionInfo(op_instanceof);
-    RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);
-}
-
-// ------------------------------ LogicalOpNode ----------------------------
-
-RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> temp = generator.tempDestination(dst);
-    RefPtr<Label> target = generator.newLabel();
-    
-    generator.emitNode(temp.get(), m_expr1);
-    if (m_operator == OpLogicalAnd)
-        generator.emitJumpIfFalse(temp.get(), target.get());
-    else
-        generator.emitJumpIfTrue(temp.get(), target.get());
-    generator.emitNode(temp.get(), m_expr2);
-    generator.emitLabel(target.get());
-
-    return generator.moveToDestinationIfNeeded(dst, temp.get());
-}
-
-// ------------------------------ ConditionalNode ------------------------------
-
-RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> newDst = generator.finalDestination(dst);
-    RefPtr<Label> beforeElse = generator.newLabel();
-    RefPtr<Label> afterElse = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_logical);
-    generator.emitJumpIfFalse(cond, beforeElse.get());
-
-    generator.emitNode(newDst.get(), m_expr1);
-    generator.emitJump(afterElse.get());
-
-    generator.emitLabel(beforeElse.get());
-    generator.emitNode(newDst.get(), m_expr2);
-
-    generator.emitLabel(afterElse.get());
-
-    return newDst.get();
-}
-
-// ------------------------------ ReadModifyResolveNode -----------------------------------
-
-// FIXME: should this be moved to be a method on BytecodeGenerator?
-static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
-{
-    OpcodeID opcodeID;
-    switch (oper) {
-        case OpMultEq:
-            opcodeID = op_mul;
-            break;
-        case OpDivEq:
-            opcodeID = op_div;
-            break;
-        case OpPlusEq:
-            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
-                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
-            opcodeID = op_add;
-            break;
-        case OpMinusEq:
-            opcodeID = op_sub;
-            break;
-        case OpLShift:
-            opcodeID = op_lshift;
-            break;
-        case OpRShift:
-            opcodeID = op_rshift;
-            break;
-        case OpURShift:
-            opcodeID = op_urshift;
-            break;
-        case OpAndEq:
-            opcodeID = op_bitand;
-            break;
-        case OpXOrEq:
-            opcodeID = op_bitxor;
-            break;
-        case OpOrEq:
-            opcodeID = op_bitor;
-            break;
-        case OpModEq:
-            opcodeID = op_mod;
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-            return dst;
-    }
-
-    RegisterID* src2 = generator.emitNode(m_right);
-
-    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
-    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
-    if (emitExpressionInfoForMe)
-        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
-
-    return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
-}
-
-RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        }
-        
-        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
-            RefPtr<RegisterID> result = generator.newTemporary();
-            generator.emitMove(result.get(), local);
-            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-            generator.emitMove(local, result.get());
-            return generator.moveToDestinationIfNeeded(dst, result.get());
-        }
-        
-        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        return generator.moveToDestinationIfNeeded(dst, result);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        generator.emitPutScopedVar(depth, index, result, globalObject);
-        return result;
-    }
-
-    RefPtr<RegisterID> src1 = generator.tempDestination(dst);
-    generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
-    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
-    return generator.emitPutById(base.get(), m_ident, result);
-}
-
-// ------------------------------ AssignResolveNode -----------------------------------
-
-RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident))
-            return generator.emitNode(dst, m_right);
-        
-        RegisterID* result = generator.emitNode(local, m_right);
-        return generator.moveToDestinationIfNeeded(dst, result);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        if (dst == generator.ignoredResult())
-            dst = 0;
-        RegisterID* value = generator.emitNode(dst, m_right);
-        generator.emitPutScopedVar(depth, index, value, globalObject);
-        return value;
-    }
-
-    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RegisterID* value = generator.emitNode(dst, m_right);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitPutById(base.get(), m_ident, value);
-}
-
-// ------------------------------ AssignDotNode -----------------------------------
-
-RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
-    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, result);
-    return generator.moveToDestinationIfNeeded(dst, result);
-}
-
-// ------------------------------ ReadModifyDotNode -----------------------------------
-
-RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitPutById(base.get(), m_ident, updatedValue);
-}
-
-// ------------------------------ AssignErrorNode -----------------------------------
-
-RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
-}
-
-// ------------------------------ AssignBracketNode -----------------------------------
-
-RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
-    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), result);
-    return generator.moveToDestinationIfNeeded(dst, result);
-}
-
-// ------------------------------ ReadModifyBracketNode -----------------------------------
-
-RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), updatedValue);
-
-    return updatedValue;
-}
-
-// ------------------------------ CommaNode ------------------------------------
-
-RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expressions.size() > 1);
-    for (size_t i = 0; i < m_expressions.size() - 1; i++)
-        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
-    return generator.emitNode(dst, m_expressions.last());
-}
-
-// ------------------------------ ConstDeclNode ------------------------------------
-
-RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
-{
-    if (RegisterID* local = generator.constRegisterFor(m_ident)) {
-        if (!m_init)
-            return local;
-
-        return generator.emitNode(local, m_init);
-    }
-
-    if (generator.codeType() != EvalCode) {
-        if (m_init)
-            return generator.emitNode(m_init);
-        else
-            return generator.emitResolve(generator.newTemporary(), m_ident);
-    }
-    // FIXME: While this code should only be hit in eval code, it will potentially
-    // assign to the wrong base if m_ident exists in an intervening dynamic scope.
-    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
-    return generator.emitPutById(base.get(), m_ident, value);
-}
-
-RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    RegisterID* result = 0;
-    for (ConstDeclNode* n = this; n; n = n->m_next)
-        result = n->emitCodeSingle(generator);
-
-    return result;
-}
-
-// ------------------------------ ConstStatementNode -----------------------------
-
-RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_next);
-}
-
-// ------------------------------ SourceElements -------------------------------
-
-inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    size_t size = m_statements.size();
-    for (size_t i = 0; i < size; ++i)
-        generator.emitNode(dst, m_statements[i]);
-}
-
-// ------------------------------ BlockNode ------------------------------------
-
-inline StatementNode* BlockNode::lastStatement() const
-{
-    return m_statements ? m_statements->lastStatement() : 0;
-}
-
-RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_statements)
-        m_statements->emitBytecode(generator, dst);
-    return 0;
-}
-
-// ------------------------------ EmptyStatementNode ---------------------------
-
-RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return dst;
-}
-
-// ------------------------------ DebuggerStatementNode ---------------------------
-
-RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
-    return dst;
-}
-
-// ------------------------------ ExprStatementNode ----------------------------
-
-RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
-    return generator.emitNode(dst, m_expr);
-}
-
-// ------------------------------ VarStatementNode ----------------------------
-
-RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_expr);
-}
-
-// ------------------------------ IfNode ---------------------------------------
-
-RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<Label> afterThen = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_condition);
-    generator.emitJumpIfFalse(cond, afterThen.get());
-
-    generator.emitNode(dst, m_ifBlock);
-    generator.emitLabel(afterThen.get());
-
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
-    return 0;
-}
-
-// ------------------------------ IfElseNode ---------------------------------------
-
-RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<Label> beforeElse = generator.newLabel();
-    RefPtr<Label> afterElse = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_condition);
-    generator.emitJumpIfFalse(cond, beforeElse.get());
-
-    generator.emitNode(dst, m_ifBlock);
-    generator.emitJump(afterElse.get());
-
-    generator.emitLabel(beforeElse.get());
-
-    generator.emitNode(dst, m_elseBlock);
-
-    generator.emitLabel(afterElse.get());
-
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
-    return 0;
-}
-
-// ------------------------------ DoWhileNode ----------------------------------
-
-RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-   
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr);
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    return result.get();
-}
-
-// ------------------------------ WhileNode ------------------------------------
-
-RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    generator.emitJump(scope->continueTarget());
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-    
-    generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr);
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion
-    return 0;
-}
-
-// ------------------------------ ForNode --------------------------------------
-
-RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (m_expr1)
-        generator.emitNode(generator.ignoredResult(), m_expr1);
-
-    RefPtr<Label> condition = generator.newLabel();
-    generator.emitJump(condition.get());
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    if (m_expr3)
-        generator.emitNode(generator.ignoredResult(), m_expr3);
-
-    generator.emitLabel(condition.get());
-    if (m_expr2) {
-        RegisterID* cond = generator.emitNode(m_expr2);
-        generator.emitJumpIfTrue(cond, topOfLoop.get());
-    } else
-        generator.emitJump(topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    return result.get();
-}
-
-// ------------------------------ ForInNode ------------------------------------
-
-RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    if (!m_lexpr->isLocation())
-        return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (m_init)
-        generator.emitNode(generator.ignoredResult(), m_init);
-
-    RefPtr<RegisterID> base = generator.newTemporary();
-    generator.emitNode(base.get(), m_expr);
-    RefPtr<RegisterID> i = generator.newTemporary();
-    RefPtr<RegisterID> size = generator.newTemporary();
-    RefPtr<RegisterID> expectedSubscript;
-    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
-    generator.emitJump(scope->continueTarget());
-
-    RefPtr<Label> loopStart = generator.newLabel();
-    generator.emitLabel(loopStart.get());
-
-    RegisterID* propertyName;
-    bool optimizedForinAccess = false;
-    if (m_lexpr->isResolveNode()) {
-        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
-        propertyName = generator.registerFor(ident);
-        if (!propertyName) {
-            propertyName = generator.newTemporary();
-            RefPtr<RegisterID> protect = propertyName;
-            RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
-
-            generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-            generator.emitPutById(base, ident, propertyName);
-        } else {
-            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
-            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
-            optimizedForinAccess = true;
-        }
-    } else if (m_lexpr->isDotAccessorNode()) {
-        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
-        const Identifier& ident = assignNode->identifier();
-        propertyName = generator.newTemporary();
-        RefPtr<RegisterID> protect = propertyName;
-        RegisterID* base = generator.emitNode(assignNode->base());
-
-        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
-        generator.emitPutById(base, ident, propertyName);
-    } else {
-        ASSERT(m_lexpr->isBracketAccessorNode());
-        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
-        propertyName = generator.newTemporary();
-        RefPtr<RegisterID> protect = propertyName;
-        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
-        RegisterID* subscript = generator.emitNode(assignNode->subscript());
-        
-        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
-        generator.emitPutByVal(base.get(), subscript, propertyName);
-    }   
-
-    generator.emitNode(dst, m_statement);
-
-    if (optimizedForinAccess)
-        generator.popOptimisedForIn();
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    generator.emitLabel(scope->breakTarget());
-    return dst;
-}
-
-// ------------------------------ ContinueNode ---------------------------------
-
-// ECMA 12.7
-RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    LabelScope* scope = generator.continueTarget(m_ident);
-
-    if (!scope)
-        return m_ident.isEmpty()
-            ? emitThrowError(generator, SyntaxError, "Invalid continue statement.")
-            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
-
-    generator.emitJumpScopes(scope->continueTarget(), scope->scopeDepth());
-    return dst;
-}
-
-// ------------------------------ BreakNode ------------------------------------
-
-// ECMA 12.8
-RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    LabelScope* scope = generator.breakTarget(m_ident);
-    
-    if (!scope)
-        return m_ident.isEmpty()
-            ? emitThrowError(generator, SyntaxError, "Invalid break statement.")
-            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
-
-    generator.emitJumpScopes(scope->breakTarget(), scope->scopeDepth());
-    return dst;
-}
-
-// ------------------------------ ReturnNode -----------------------------------
-
-RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    if (generator.codeType() != FunctionCode)
-        return emitThrowError(generator, SyntaxError, "Invalid return statement.");
-
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
-    RefPtr<RegisterID> returnRegister;
-    if (generator.scopeDepth()) {
-        RefPtr<Label> l0 = generator.newLabel();
-        if (generator.hasFinaliser() && !r0->isTemporary()) {
-            returnRegister = generator.emitMove(generator.newTemporary(), r0);
-            r0 = returnRegister.get();
-        }
-        generator.emitJumpScopes(l0.get(), 0);
-        generator.emitLabel(l0.get());
-    }
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-    return generator.emitReturn(r0);
-}
-
-// ------------------------------ WithNode -------------------------------------
-
-RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<RegisterID> scope = generator.newTemporary();
-    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
-    generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
-    generator.emitPushScope(scope.get());
-    RegisterID* result = generator.emitNode(dst, m_statement);
-    generator.emitPopScope();
-    return result;
-}
-
-// ------------------------------ CaseClauseNode --------------------------------
-
-inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_statements)
-        m_statements->emitBytecode(generator, dst);
-}
-
-// ------------------------------ CaseBlockNode --------------------------------
-
-enum SwitchKind { 
-    SwitchUnset = 0,
-    SwitchNumber = 1, 
-    SwitchString = 2, 
-    SwitchNeither = 3 
-};
-
-static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
-{
-    for (; list; list = list->getNext()) {
-        ExpressionNode* clauseExpression = list->getClause()->expr();
-        literalVector.append(clauseExpression);
-        if (clauseExpression->isNumber()) {
-            double value = static_cast<NumberNode*>(clauseExpression)->value();
-            int32_t intVal = static_cast<int32_t>(value);
-            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
-                typeForTable = SwitchNeither;
-                break;
-            }
-            if (intVal < min_num)
-                min_num = intVal;
-            if (intVal > max_num)
-                max_num = intVal;
-            typeForTable = SwitchNumber;
-            continue;
-        }
-        if (clauseExpression->isString()) {
-            if (typeForTable & ~SwitchString) {
-                typeForTable = SwitchNeither;
-                break;
-            }
-            const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
-            if (singleCharacterSwitch &= value.size() == 1) {
-                int32_t intVal = value.rep()->data()[0];
-                if (intVal < min_num)
-                    min_num = intVal;
-                if (intVal > max_num)
-                    max_num = intVal;
-            }
-            typeForTable = SwitchString;
-            continue;
-        }
-        typeForTable = SwitchNeither;
-        break;        
-    }
-}
-    
-SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
-{
-    SwitchKind typeForTable = SwitchUnset;
-    bool singleCharacterSwitch = true;
-    
-    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    
-    if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
-        return SwitchInfo::SwitchNone;
-    
-    if (typeForTable == SwitchNumber) {
-        int32_t range = max_num - min_num;
-        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
-            return SwitchInfo::SwitchImmediate;
-        return SwitchInfo::SwitchNone;
-    } 
-    
-    ASSERT(typeForTable == SwitchString);
-    
-    if (singleCharacterSwitch) {
-        int32_t range = max_num - min_num;
-        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
-            return SwitchInfo::SwitchCharacter;
-    }
-
-    return SwitchInfo::SwitchString;
-}
-
-RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
-{
-    RefPtr<Label> defaultLabel;
-    Vector<RefPtr<Label>, 8> labelVector;
-    Vector<ExpressionNode*, 8> literalVector;
-    int32_t min_num = std::numeric_limits<int32_t>::max();
-    int32_t max_num = std::numeric_limits<int32_t>::min();
-    SwitchInfo::SwitchType switchType = tryOptimizedSwitch(literalVector, min_num, max_num);
-
-    if (switchType != SwitchInfo::SwitchNone) {
-        // Prepare the various labels
-        for (uint32_t i = 0; i < literalVector.size(); i++)
-            labelVector.append(generator.newLabel());
-        defaultLabel = generator.newLabel();
-        generator.beginSwitch(switchExpression, switchType);
-    } else {
-        // Setup jumps
-        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
-            RefPtr<RegisterID> clauseVal = generator.newTemporary();
-            generator.emitNode(clauseVal.get(), list->getClause()->expr());
-            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
-            labelVector.append(generator.newLabel());
-            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
-        }
-        
-        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
-            RefPtr<RegisterID> clauseVal = generator.newTemporary();
-            generator.emitNode(clauseVal.get(), list->getClause()->expr());
-            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
-            labelVector.append(generator.newLabel());
-            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
-        }
-        defaultLabel = generator.newLabel();
-        generator.emitJump(defaultLabel.get());
-    }
-
-    RegisterID* result = 0;
-
-    size_t i = 0;
-    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
-        generator.emitLabel(labelVector[i++].get());
-        list->getClause()->emitBytecode(generator, dst);
-    }
-
-    if (m_defaultClause) {
-        generator.emitLabel(defaultLabel.get());
-        m_defaultClause->emitBytecode(generator, dst);
-    }
-
-    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
-        generator.emitLabel(labelVector[i++].get());
-        list->getClause()->emitBytecode(generator, dst);
-    }
-    if (!m_defaultClause)
-        generator.emitLabel(defaultLabel.get());
-
-    ASSERT(i == labelVector.size());
-    if (switchType != SwitchInfo::SwitchNone) {
-        ASSERT(labelVector.size() == literalVector.size());
-        generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
-    }
-    return result;
-}
-
-// ------------------------------ SwitchNode -----------------------------------
-
-RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
-
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
-    RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
-
-    generator.emitLabel(scope->breakTarget());
-    return r1;
-}
-
-// ------------------------------ LabelNode ------------------------------------
-
-RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (generator.breakTarget(m_name))
-        return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
-
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
-    RegisterID* r0 = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->breakTarget());
-    return r0;
-}
-
-// ------------------------------ ThrowNode ------------------------------------
-
-RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitThrow(expr.get());
-    return 0;
-}
-
-// ------------------------------ TryNode --------------------------------------
-
-RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // NOTE: The catch and finally blocks must be labeled explicitly, so the
-    // optimizer knows they may be jumped to from anywhere.
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    RefPtr<Label> tryStartLabel = generator.newLabel();
-    RefPtr<Label> finallyStart;
-    RefPtr<RegisterID> finallyReturnAddr;
-    if (m_finallyBlock) {
-        finallyStart = generator.newLabel();
-        finallyReturnAddr = generator.newTemporary();
-        generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
-    }
-
-    generator.emitLabel(tryStartLabel.get());
-    generator.emitNode(dst, m_tryBlock);
-
-    if (m_catchBlock) {
-        RefPtr<Label> catchEndLabel = generator.newLabel();
-        
-        // Normal path: jump over the catch block.
-        generator.emitJump(catchEndLabel.get());
-
-        // Uncaught exception path: the catch block.
-        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
-        if (m_catchHasEval) {
-            RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
-            generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
-            generator.emitMove(exceptionRegister.get(), dynamicScopeObject.get());
-            generator.emitPushScope(exceptionRegister.get());
-        } else
-            generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
-        generator.emitNode(dst, m_catchBlock);
-        generator.emitPopScope();
-        generator.emitLabel(catchEndLabel.get());
-    }
-
-    if (m_finallyBlock) {
-        generator.popFinallyContext();
-        // there may be important registers live at the time we jump
-        // to a finally block (such as for a return or throw) so we
-        // ref the highest register ever used as a conservative
-        // approach to not clobbering anything important
-        RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
-        RefPtr<Label> finallyEndLabel = generator.newLabel();
-
-        // Normal path: invoke the finally block, then jump over it.
-        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        generator.emitJump(finallyEndLabel.get());
-
-        // Uncaught exception path: invoke the finally block, then re-throw the exception.
-        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
-        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        generator.emitThrow(tempExceptionRegister.get());
-
-        // The finally block.
-        generator.emitLabel(finallyStart.get());
-        generator.emitNode(dst, m_finallyBlock);
-        generator.emitSubroutineReturn(finallyReturnAddr.get());
-
-        generator.emitLabel(finallyEndLabel.get());
-    }
-
-    return dst;
-}
-
 // -----------------------------ScopeNodeData ---------------------------
 
 ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* statements, VarStack* varStack, FunctionStack* funcStack, int numConstants)
@@ -1908,12 +104,6 @@ ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceE
 {
 }
 
-inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_data->m_statements)
-        m_data->m_statements->emitBytecode(generator, dst);
-}
-
 StatementNode* ScopeNode::singleStatement() const
 {
     return m_data->m_statements ? m_data->m_statements->singleStatement() : 0;
@@ -1937,19 +127,6 @@ PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, SourceElem
     return node.release();
 }
 
-RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
-
-    RefPtr<RegisterID> dstRegister = generator.newTemporary();
-    generator.emitLoad(dstRegister.get(), jsUndefined());
-    emitStatementsBytecode(generator, dstRegister.get());
-
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
-    generator.emitEnd(dstRegister.get());
-    return 0;
-}
-
 // ------------------------------ EvalNode -----------------------------
 
 inline EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
@@ -1968,19 +145,6 @@ PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, SourceElements*
     return node.release();
 }
 
-RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
-
-    RefPtr<RegisterID> dstRegister = generator.newTemporary();
-    generator.emitLoad(dstRegister.get(), jsUndefined());
-    emitStatementsBytecode(generator, dstRegister.get());
-
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
-    generator.emitEnd(dstRegister.get());
-    return 0;
-}
-
 // ------------------------------ FunctionBodyNode -----------------------------
 
 FunctionParameters::FunctionParameters(ParameterNode* firstParameter)
@@ -2028,37 +192,4 @@ PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData,
     return node.release();
 }
 
-RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
-    emitStatementsBytecode(generator, generator.ignoredResult());
-    StatementNode* singleStatement = this->singleStatement();
-    if (singleStatement && singleStatement->isBlock()) {
-        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
-        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
-            return 0;
-    }
-
-    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-    generator.emitReturn(r0);
-    return 0;
-}
-
-// ------------------------------ FuncDeclNode ---------------------------------
-
-RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    return dst;
-}
-
-// ------------------------------ FuncExprNode ---------------------------------
-
-RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
-}
-
 } // namespace JSC
diff --git a/JavaScriptCore/parser/Nodes.h b/JavaScriptCore/parser/Nodes.h
index be84c4a..c216ea8 100644
--- a/JavaScriptCore/parser/Nodes.h
+++ b/JavaScriptCore/parser/Nodes.h
@@ -40,6 +40,7 @@ namespace JSC {
     class ArgumentListNode;
     class BytecodeGenerator;
     class FunctionBodyNode;
+    class Label;
     class PropertyListNode;
     class ReadModifyResolveNode;
     class RegisterID;
@@ -151,6 +152,9 @@ namespace JSC {
         virtual bool isCommaNode() const { return false; }
         virtual bool isSimpleArray() const { return false; }
         virtual bool isAdd() const { return false; }
+        virtual bool hasConditionContextCodegen() const { return false; }
+
+        virtual void emitBytecodeInConditionContext(BytecodeGenerator&, Label*, Label*, bool) { ASSERT_NOT_REACHED(); }
 
         virtual ExpressionNode* stripUnaryPlus() { return this; }
 
@@ -757,6 +761,7 @@ namespace JSC {
 
     protected:
         ExpressionNode* expr() { return m_expr; }
+        const ExpressionNode* expr() const { return m_expr; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -788,6 +793,9 @@ namespace JSC {
     class LogicalNotNode : public UnaryOpNode {
     public:
         LogicalNotNode(JSGlobalData*, ExpressionNode*);
+    private:
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue);
+        virtual bool hasConditionContextCodegen() const { return expr()->hasConditionContextCodegen(); }
     };
 
     class BinaryOpNode : public ExpressionNode {
@@ -952,6 +960,8 @@ namespace JSC {
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue);
+        virtual bool hasConditionContextCodegen() const { return true; }
 
         ExpressionNode* m_expr1;
         ExpressionNode* m_expr2;
diff --git a/JavaScriptCore/pcre/pcre_exec.cpp b/JavaScriptCore/pcre/pcre_exec.cpp
index 16619d4..8ca2eb4 100644
--- a/JavaScriptCore/pcre/pcre_exec.cpp
+++ b/JavaScriptCore/pcre/pcre_exec.cpp
@@ -2164,14 +2164,14 @@ void Histogram::add(const JSRegExp* re, double elapsedTime)
 
 HistogramTimeLogger::HistogramTimeLogger(const JSRegExp* re)
     : m_re(re)
-    , m_startTime(getCurrentUTCTimeWithMicroseconds())
+    , m_startTime(currentTimeMS())
 {
 }
 
 HistogramTimeLogger::~HistogramTimeLogger()
 {
     static Histogram histogram;
-    histogram.add(m_re, getCurrentUTCTimeWithMicroseconds() - m_startTime);
+    histogram.add(m_re, currentTimeMS() - m_startTime);
 }
 
 #endif
diff --git a/JavaScriptCore/profiler/ProfileGenerator.cpp b/JavaScriptCore/profiler/ProfileGenerator.cpp
index dc68ecb..17d37d7 100644
--- a/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -63,7 +63,7 @@ void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
     JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
-    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(&exec->globalData(), function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
+    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(exec, function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
     m_head->insertNode(m_currentNode.get());
 }
 
diff --git a/JavaScriptCore/profiler/ProfileNode.cpp b/JavaScriptCore/profiler/ProfileNode.cpp
index 19050aa..02fb7c9 100644
--- a/JavaScriptCore/profiler/ProfileNode.cpp
+++ b/JavaScriptCore/profiler/ProfileNode.cpp
@@ -37,6 +37,8 @@
 #include <windows.h>
 #endif
 
+using namespace WTF;
+
 namespace JSC {
 
 static double getCount()
@@ -49,7 +51,7 @@ static double getCount()
     QueryPerformanceCounter(&counter);
     return static_cast<double>(counter.QuadPart) / frequency.QuadPart;
 #else
-    return WTF::getCurrentUTCTimeWithMicroseconds();
+    return currentTimeMS();
 #endif
 }
 
diff --git a/JavaScriptCore/profiler/Profiler.cpp b/JavaScriptCore/profiler/Profiler.cpp
index 6f72e08..5585d2e 100644
--- a/JavaScriptCore/profiler/Profiler.cpp
+++ b/JavaScriptCore/profiler/Profiler.cpp
@@ -46,7 +46,7 @@ static const char* GlobalCodeExecution = "(program)";
 static const char* AnonymousFunction = "(anonymous function)";
 static unsigned ProfilesUID = 0;
 
-static CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData*, JSFunction*);
+static CallIdentifier createCallIdentifierFromFunctionImp(ExecState*, JSFunction*);
 
 Profiler* Profiler::s_sharedProfiler = 0;
 Profiler* Profiler::s_sharedEnabledProfilerReference = 0;
@@ -109,14 +109,14 @@ void Profiler::willExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, createCallIdentifier(&exec->globalData(), function, "", 0), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, createCallIdentifier(exec, function, "", 0), exec->lexicalGlobalObject()->profileGroup());
 }
 
 void Profiler::willExecute(ExecState* exec, const UString& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber);
+    CallIdentifier callIdentifier = createCallIdentifier(exec, JSValue(), sourceURL, startingLineNumber);
 
     dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, callIdentifier, exec->lexicalGlobalObject()->profileGroup());
 }
@@ -125,17 +125,17 @@ void Profiler::didExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), function, "", 0), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(exec, function, "", 0), exec->lexicalGlobalObject()->profileGroup());
 }
 
 void Profiler::didExecute(ExecState* exec, const UString& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(exec, JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(ExecState* exec, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
 {
     if (!functionValue)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
@@ -144,17 +144,17 @@ CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue
     if (asObject(functionValue)->inherits(&JSFunction::info)) {
         JSFunction* function = asFunction(functionValue);
         if (!function->executable()->isHostFunction())
-            return createCallIdentifierFromFunctionImp(globalData, function);
+            return createCallIdentifierFromFunctionImp(exec, function);
     }
     if (asObject(functionValue)->inherits(&InternalFunction::info))
-        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(globalData), defaultSourceURL, defaultLineNumber);
+        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(exec), defaultSourceURL, defaultLineNumber);
     return CallIdentifier("(" + asObject(functionValue)->className() + " object)", defaultSourceURL, defaultLineNumber);
 }
 
-CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData* globalData, JSFunction* function)
+CallIdentifier createCallIdentifierFromFunctionImp(ExecState* exec, JSFunction* function)
 {
     ASSERT(!function->isHostFunction());
-    const UString& name = function->calculatedDisplayName(globalData);
+    const UString& name = function->calculatedDisplayName(exec);
     return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->jsExecutable()->sourceURL(), function->jsExecutable()->lineNo());
 }
 
diff --git a/JavaScriptCore/profiler/Profiler.h b/JavaScriptCore/profiler/Profiler.h
index 21621bf..4b8b4a0 100644
--- a/JavaScriptCore/profiler/Profiler.h
+++ b/JavaScriptCore/profiler/Profiler.h
@@ -52,7 +52,7 @@ namespace JSC {
         }
 
         static Profiler* profiler(); 
-        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValue, const UString& sourceURL, int lineNumber);
+        static CallIdentifier createCallIdentifier(ExecState* exec, JSValue, const UString& sourceURL, int lineNumber);
 
         void startProfiling(ExecState*, const UString& title);
         PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
diff --git a/JavaScriptCore/runtime/ArgList.h b/JavaScriptCore/runtime/ArgList.h
index 3227770..8e1fdbe 100644
--- a/JavaScriptCore/runtime/ArgList.h
+++ b/JavaScriptCore/runtime/ArgList.h
@@ -104,7 +104,11 @@ namespace JSC {
         void append(JSValue v)
         {
             ASSERT(!m_isReadOnly);
-            
+
+#if ENABLE(JSC_ZOMBIES)
+            ASSERT(!v.isZombie());
+#endif
+
             if (m_isUsingInlineBuffer && m_size < inlineCapacity) {
                 m_vector.uncheckedAppend(v);
                 ++m_size;
@@ -187,6 +191,10 @@ namespace JSC {
             : m_args(args)
             , m_argCount(argCount)
         {
+#if ENABLE(JSC_ZOMBIES)
+            for (size_t i = 0; i < argCount; i++)
+                ASSERT(!m_args[i].isZombie());
+#endif
         }
         
         ArgList(Register* args, int argCount)
diff --git a/JavaScriptCore/runtime/ArrayPrototype.cpp b/JavaScriptCore/runtime/ArrayPrototype.cpp
index 7a89447..5b359e7 100644
--- a/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -745,8 +745,8 @@ JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValue th
             cachedCall.setArgument(0, array->getIndex(k));
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (!cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (!result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(false);
         }
     }
@@ -846,8 +846,8 @@ JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec, JSObject*, JSValue thi
             cachedCall.setArgument(0, array->getIndex(k));
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(true);
         }
     }
@@ -1034,7 +1034,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue
         JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValue::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(exec, searchElement, e))
             return jsNumber(exec, index);
     }
 
@@ -1065,7 +1065,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSVa
         JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValue::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(exec, searchElement, e))
             return jsNumber(exec, index);
     }
 
diff --git a/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index 929a5e7..74089a5 100644
--- a/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -43,7 +43,7 @@ namespace JSC {
 
         ~BatchedTransitionOptimizer()
         {
-            m_object->setStructure(Structure::fromDictionaryTransition(m_object->structure()));
+            m_object->flattenDictionaryObject();
         }
 
     private:
diff --git a/JavaScriptCore/runtime/Collector.cpp b/JavaScriptCore/runtime/Collector.cpp
index 1b238d9..1630a58 100644
--- a/JavaScriptCore/runtime/Collector.cpp
+++ b/JavaScriptCore/runtime/Collector.cpp
@@ -32,6 +32,7 @@
 #include "JSONObject.h"
 #include "JSString.h"
 #include "JSValue.h"
+#include "JSZombie.h"
 #include "MarkStack.h"
 #include "Nodes.h"
 #include "Tracing.h"
@@ -118,11 +119,7 @@ static RHeap* userChunk = 0;
 #if PLATFORM(DARWIN)
 typedef mach_port_t PlatformThread;
 #elif PLATFORM(WIN_OS)
-struct PlatformThread {
-    PlatformThread(DWORD _id, HANDLE _handle) : id(_id), handle(_handle) {}
-    DWORD id;
-    HANDLE handle;
-};
+typedef HANDLE PlatformThread;
 #endif
 
 class Heap::Thread {
@@ -198,9 +195,11 @@ void Heap::destroy()
 
     sweep<PrimaryHeap>();
     // No need to sweep number heap, because the JSNumber destructor doesn't do anything.
-
+#if ENABLE(JSC_ZOMBIES)
+    ASSERT(primaryHeap.numLiveObjects == primaryHeap.numZombies);
+#else
     ASSERT(!primaryHeap.numLiveObjects);
-
+#endif
     freeBlocks(&primaryHeap);
     freeBlocks(&numberHeap);
 
@@ -646,8 +645,7 @@ static inline PlatformThread getCurrentPlatformThread()
 #if PLATFORM(DARWIN)
     return pthread_mach_thread_np(pthread_self());
 #elif PLATFORM(WIN_OS)
-    HANDLE threadHandle = pthread_getw32threadhandle_np(pthread_self());
-    return PlatformThread(GetCurrentThreadId(), threadHandle);
+    return pthread_getw32threadhandle_np(pthread_self());
 #endif
 }
 
@@ -811,7 +809,7 @@ static inline void suspendThread(const PlatformThread& platformThread)
 #if PLATFORM(DARWIN)
     thread_suspend(platformThread);
 #elif PLATFORM(WIN_OS)
-    SuspendThread(platformThread.handle);
+    SuspendThread(platformThread);
 #else
 #error Need a way to suspend threads on this platform
 #endif
@@ -822,7 +820,7 @@ static inline void resumeThread(const PlatformThread& platformThread)
 #if PLATFORM(DARWIN)
     thread_resume(platformThread);
 #elif PLATFORM(WIN_OS)
-    ResumeThread(platformThread.handle);
+    ResumeThread(platformThread);
 #else
 #error Need a way to resume threads on this platform
 #endif
@@ -886,7 +884,7 @@ static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, P
 
 #elif PLATFORM(WIN_OS) && PLATFORM(X86)
     regs.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL | CONTEXT_SEGMENTS;
-    GetThreadContext(platformThread.handle, &regs);
+    GetThreadContext(platformThread, &regs);
     return sizeof(CONTEXT);
 #else
 #error Need a way to get thread registers on this platform
@@ -1041,17 +1039,26 @@ template <HeapType heapType> size_t Heap::sweep()
                         // assumes the object has a valid vptr.)
                         if (cell->u.freeCell.zeroIfFree == 0)
                             continue;
-                        
+#if ENABLE(JSC_ZOMBIES)
+                        if (!imp->isZombie()) {
+                            const ClassInfo* info = imp->classInfo();
+                            imp->~JSCell();
+                            new (imp) JSZombie(info, JSZombie::leakedZombieStructure());
+                            heap.numZombies++;
+                        }
+#else
                         imp->~JSCell();
+#endif
                     }
-                    
-                    --usedCells;
                     --numLiveObjects;
+#if !ENABLE(JSC_ZOMBIES)
+                    --usedCells;
                     
                     // put cell on the free list
                     cell->u.freeCell.zeroIfFree = 0;
                     cell->u.freeCell.next = freeList - (cell + 1);
                     freeList = cell;
+#endif
                 }
             }
         } else {
@@ -1064,8 +1071,18 @@ template <HeapType heapType> size_t Heap::sweep()
                     if (!curBlock->marked.get(i >> HeapConstants<heapType>::bitmapShift)) {
                         if (heapType != NumberHeap) {
                             JSCell* imp = reinterpret_cast<JSCell*>(cell);
+#if ENABLE(JSC_ZOMBIES)
+                            if (!imp->isZombie()) {
+                                const ClassInfo* info = imp->classInfo();
+                                imp->~JSCell();
+                                new (imp) JSZombie(info, JSZombie::leakedZombieStructure());
+                                heap.numZombies++;
+                            }
+#else
                             imp->~JSCell();
+#endif
                         }
+#if !ENABLE(JSC_ZOMBIES)
                         --usedCells;
                         --numLiveObjects;
                         
@@ -1073,6 +1090,7 @@ template <HeapType heapType> size_t Heap::sweep()
                         cell->u.freeCell.zeroIfFree = 0;
                         cell->u.freeCell.next = freeList - (cell + 1); 
                         freeList = cell;
+#endif
                     }
                 }
             }
diff --git a/JavaScriptCore/runtime/Collector.h b/JavaScriptCore/runtime/Collector.h
index 9ca9d18..9128701 100644
--- a/JavaScriptCore/runtime/Collector.h
+++ b/JavaScriptCore/runtime/Collector.h
@@ -60,6 +60,9 @@ namespace JSC {
         size_t numLiveObjects;
         size_t numLiveObjectsAtLastCollect;
         size_t extraCost;
+#if ENABLE(JSC_ZOMBIES)
+        size_t numZombies;
+#endif
 
         OperationInProgress operationInProgress;
     };
diff --git a/JavaScriptCore/runtime/DateConstructor.cpp b/JavaScriptCore/runtime/DateConstructor.cpp
index 9908fef..61ec4c5 100644
--- a/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/JavaScriptCore/runtime/DateConstructor.cpp
@@ -77,14 +77,14 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
     double value;
 
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
-        value = getCurrentUTCTime();
+        value = jsCurrentTime();
     else if (numArgs == 1) {
         if (args.at(0).inherits(&DateInstance::info))
             value = asDateInstance(args.at(0))->internalNumber();
         else {
             JSValue primitive = args.at(0).toPrimitive(exec);
             if (primitive.isString())
-                value = parseDate(primitive.getString());
+                value = parseDate(exec, primitive.getString(exec));
             else
                 value = primitive.toNumber(exec);
         }
@@ -108,7 +108,7 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
             t.second = args.at(5).toInt32(exec);
             t.isDST = -1;
             double ms = (numArgs >= 7) ? args.at(6).toNumber(exec) : 0;
-            value = gregorianDateTimeToMS(t, ms, false);
+            value = gregorianDateTimeToMS(exec, t, ms, false);
         }
     }
 
@@ -132,8 +132,8 @@ static JSValue JSC_HOST_CALL callDate(ExecState* exec, JSObject*, JSValue, const
     time_t localTime = time(0);
     tm localTM;
     getLocalTime(&localTime, &localTM);
-    GregorianDateTime ts(localTM);
-    return jsNontrivialString(exec, formatDate(ts) + " " + formatTime(ts, false));
+    GregorianDateTime ts(exec, localTM);
+    return jsNontrivialString(exec, formatDate(ts) + " " + formatTime(ts));
 }
 
 CallType DateConstructor::getCallData(CallData& callData)
@@ -144,12 +144,12 @@ CallType DateConstructor::getCallData(CallData& callData)
 
 static JSValue JSC_HOST_CALL dateParse(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseDate(args.at(0).toString(exec)));
+    return jsNumber(exec, parseDate(exec, args.at(0).toString(exec)));
 }
 
 static JSValue JSC_HOST_CALL dateNow(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, getCurrentUTCTime());
+    return jsNumber(exec, jsCurrentTime());
 }
 
 static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const ArgList& args) 
@@ -173,7 +173,7 @@ static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const
     t.minute = args.at(4).toInt32(exec);
     t.second = args.at(5).toInt32(exec);
     double ms = (n >= 7) ? args.at(6).toNumber(exec) : 0;
-    return jsNumber(exec, gregorianDateTimeToMS(t, ms, true));
+    return jsNumber(exec, gregorianDateTimeToMS(exec, t, ms, true));
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/DateConversion.cpp b/JavaScriptCore/runtime/DateConversion.cpp
index a725478..b9d0e02 100644
--- a/JavaScriptCore/runtime/DateConversion.cpp
+++ b/JavaScriptCore/runtime/DateConversion.cpp
@@ -43,6 +43,7 @@
 #include "config.h"
 #include "DateConversion.h"
 
+#include "CallFrame.h"
 #include "UString.h"
 #include <wtf/DateMath.h>
 #include <wtf/StringExtras.h>
@@ -51,9 +52,14 @@ using namespace WTF;
 
 namespace JSC {
 
-double parseDate(const UString &date)
+double parseDate(ExecState* exec, const UString &date)
 {
-    return parseDateFromNullTerminatedCharacters(date.UTF8String().c_str());
+    if (date == exec->globalData().cachedDateString)
+        return exec->globalData().cachedDateStringValue;
+    double value = parseDateFromNullTerminatedCharacters(exec, date.UTF8String().c_str());
+    exec->globalData().cachedDateString = date;
+    exec->globalData().cachedDateStringValue = value;
+    return value;
 }
 
 UString formatDate(const GregorianDateTime &t)
@@ -74,28 +80,31 @@ UString formatDateUTCVariant(const GregorianDateTime &t)
     return buffer;
 }
 
-UString formatTime(const GregorianDateTime &t, bool utc)
+UString formatTime(const GregorianDateTime &t)
 {
     char buffer[100];
-    if (utc) {
-        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
-    } else {
-        int offset = abs(gmtoffset(t));
-        char timeZoneName[70];
-        struct tm gtm = t;
-        strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+    int offset = abs(gmtoffset(t));
+    char timeZoneName[70];
+    struct tm gtm = t;
+    strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
 
-        if (timeZoneName[0]) {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
-        } else {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
-        }
+    if (timeZoneName[0]) {
+        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
+            t.hour, t.minute, t.second,
+            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
+    } else {
+        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
+            t.hour, t.minute, t.second,
+            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
     }
     return UString(buffer);
 }
 
+UString formatTimeUTC(const GregorianDateTime &t)
+{
+    char buffer[100];
+    snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
+    return UString(buffer);
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/DateConversion.h b/JavaScriptCore/runtime/DateConversion.h
index 0d12815..dc980d3 100644
--- a/JavaScriptCore/runtime/DateConversion.h
+++ b/JavaScriptCore/runtime/DateConversion.h
@@ -42,18 +42,17 @@
 #ifndef DateConversion_h
 #define DateConversion_h
 
-namespace WTF {
-    struct GregorianDateTime;
-}
-
 namespace JSC {
 
+class ExecState;
 class UString;
+struct GregorianDateTime;
 
-double parseDate(const UString&);
-UString formatDate(const WTF::GregorianDateTime&);
-UString formatDateUTCVariant(const WTF::GregorianDateTime&);
-UString formatTime(const WTF::GregorianDateTime&, bool inputIsUTC);
+double parseDate(ExecState* exec, const UString&);
+UString formatDate(const GregorianDateTime&);
+UString formatDateUTCVariant(const GregorianDateTime&);
+UString formatTime(const GregorianDateTime&);
+UString formatTimeUTC(const GregorianDateTime&);
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/DateInstance.cpp b/JavaScriptCore/runtime/DateInstance.cpp
index d4c9ef7..77a92be 100644
--- a/JavaScriptCore/runtime/DateInstance.cpp
+++ b/JavaScriptCore/runtime/DateInstance.cpp
@@ -46,30 +46,36 @@ DateInstance::DateInstance(ExecState* exec, double time)
     setInternalValue(jsNumber(exec, timeClip(time)));
 }
 
-bool DateInstance::getGregorianDateTime(ExecState* exec, bool outputIsUTC, GregorianDateTime& t) const
+const GregorianDateTime* DateInstance::calculateGregorianDateTime(ExecState* exec) const
 {
     double milli = internalNumber();
     if (isnan(milli))
-        return false;
+        return 0;
 
     if (!m_data)
         m_data = exec->globalData().dateInstanceCache.add(milli);
 
-    if (outputIsUTC) {
-        if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
-            WTF::msToGregorianDateTime(internalNumber(), true, m_data->m_cachedGregorianDateTimeUTC);
-            m_data->m_gregorianDateTimeUTCCachedForMS = milli;
-        }
-        t.copyFrom(m_data->m_cachedGregorianDateTimeUTC);
-    } else {
-        if (m_data->m_gregorianDateTimeCachedForMS != milli) {
-            WTF::msToGregorianDateTime(internalNumber(), false, m_data->m_cachedGregorianDateTime);
-            m_data->m_gregorianDateTimeCachedForMS = milli;
-        }
-        t.copyFrom(m_data->m_cachedGregorianDateTime);
+    if (m_data->m_gregorianDateTimeCachedForMS != milli) {
+        msToGregorianDateTime(exec, milli, false, m_data->m_cachedGregorianDateTime);
+        m_data->m_gregorianDateTimeCachedForMS = milli;
     }
+    return &m_data->m_cachedGregorianDateTime;
+}
+
+const GregorianDateTime* DateInstance::calculateGregorianDateTimeUTC(ExecState* exec) const
+{
+    double milli = internalNumber();
+    if (isnan(milli))
+        return 0;
 
-    return true;
+    if (!m_data)
+        m_data = exec->globalData().dateInstanceCache.add(milli);
+
+    if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
+        msToGregorianDateTime(exec, milli, true, m_data->m_cachedGregorianDateTimeUTC);
+        m_data->m_gregorianDateTimeUTCCachedForMS = milli;
+    }
+    return &m_data->m_cachedGregorianDateTimeUTC;
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/DateInstance.h b/JavaScriptCore/runtime/DateInstance.h
index 38b321c..44b7521 100644
--- a/JavaScriptCore/runtime/DateInstance.h
+++ b/JavaScriptCore/runtime/DateInstance.h
@@ -38,7 +38,19 @@ namespace JSC {
 
         static JS_EXPORTDATA const ClassInfo info;
 
-        bool getGregorianDateTime(ExecState*, bool outputIsUTC, WTF::GregorianDateTime&) const;
+        const GregorianDateTime* gregorianDateTime(ExecState* exec) const
+        {
+            if (m_data && m_data->m_gregorianDateTimeCachedForMS == internalNumber())
+                return &m_data->m_cachedGregorianDateTime;
+            return calculateGregorianDateTime(exec);
+        }
+        
+        const GregorianDateTime* gregorianDateTimeUTC(ExecState* exec) const
+        {
+            if (m_data && m_data->m_gregorianDateTimeUTCCachedForMS == internalNumber())
+                return &m_data->m_cachedGregorianDateTimeUTC;
+            return calculateGregorianDateTimeUTC(exec);
+        }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
@@ -49,6 +61,8 @@ namespace JSC {
         static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
 
     private:
+        const GregorianDateTime* calculateGregorianDateTime(ExecState*) const;
+        const GregorianDateTime* calculateGregorianDateTimeUTC(ExecState*) const;
         virtual const ClassInfo* classInfo() const { return &info; }
 
         mutable RefPtr<DateInstanceData> m_data;
diff --git a/JavaScriptCore/runtime/DateInstanceCache.h b/JavaScriptCore/runtime/DateInstanceCache.h
index b626c1d..d208580 100644
--- a/JavaScriptCore/runtime/DateInstanceCache.h
+++ b/JavaScriptCore/runtime/DateInstanceCache.h
@@ -40,9 +40,9 @@ namespace JSC {
         static PassRefPtr<DateInstanceData> create() { return adoptRef(new DateInstanceData); }
 
         double m_gregorianDateTimeCachedForMS;
-        WTF::GregorianDateTime m_cachedGregorianDateTime;
+        GregorianDateTime m_cachedGregorianDateTime;
         double m_gregorianDateTimeUTCCachedForMS;
-        WTF::GregorianDateTime m_cachedGregorianDateTimeUTC;
+        GregorianDateTime m_cachedGregorianDateTimeUTC;
 
     private:
         DateInstanceData()
@@ -56,6 +56,11 @@ namespace JSC {
     public:
         DateInstanceCache()
         {
+            reset();
+        }
+        
+        void reset()
+        {
             for (size_t i = 0; i < cacheSize; ++i)
                 m_cache[i].key = NaN;
         }
@@ -72,7 +77,7 @@ namespace JSC {
         }
 
     private:
-        static const size_t cacheSize = 64;
+        static const size_t cacheSize = 16;
 
         struct CacheEntry {
             double key;
diff --git a/JavaScriptCore/runtime/DatePrototype.cpp b/JavaScriptCore/runtime/DatePrototype.cpp
index 3f3e1f9..7a2e802 100644
--- a/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/JavaScriptCore/runtime/DatePrototype.cpp
@@ -28,7 +28,6 @@
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "DateInstance.h"
-#include <float.h>
 
 #if !PLATFORM(MAC) && HAVE(LANGINFO_H)
 #include <langinfo.h>
@@ -253,11 +252,10 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 
 static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double, LocaleDateTimeFormat format, const ArgList&)
 {
-    GregorianDateTime gregorianDateTime;
-    const bool outputIsUTC = false;
-    if (!dateObject->getGregorianDateTime(exec, outputIsUTC, gregorianDateTime))
+    const GregorianDateTime* gregorianDateTime = dateObject->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return formatLocaleDate(exec, gregorianDateTime, format);
+    return formatLocaleDate(exec, *gregorianDateTime, format);
 }
 
 #endif // !PLATFORM(MAC)
@@ -420,14 +418,12 @@ JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, outputIsUTC));
+    return jsNontrivialString(exec, formatDate(*gregorianDateTime) + " " + formatTime(*gregorianDateTime));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -435,14 +431,12 @@ JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
+    return jsNontrivialString(exec, formatDateUTCVariant(*gregorianDateTime) + " " + formatTimeUTC(*gregorianDateTime));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -450,17 +444,15 @@ JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
     
-    const bool outputIsUTC = true;
-    
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
     // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
     // 6 for formatting and one for null termination = 27.  We add one extra character to allow us to force null termination.
     char buffer[28];
-    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
+    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + gregorianDateTime->year, gregorianDateTime->month + 1, gregorianDateTime->monthDay, gregorianDateTime->hour, gregorianDateTime->minute, gregorianDateTime->second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
     buffer[sizeof(buffer) - 1] = 0;
     return jsNontrivialString(exec, buffer);
 }
@@ -470,14 +462,12 @@ JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDate(t));
+    return jsNontrivialString(exec, formatDate(*gregorianDateTime));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -485,14 +475,12 @@ JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatTime(t, outputIsUTC));
+    return jsNontrivialString(exec, formatTime(*gregorianDateTime));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -535,14 +523,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, 1900 + t.year);
+    return jsNumber(exec, 1900 + gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -550,14 +536,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JS
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, 1900 + t.year);
+    return jsNumber(exec, 1900 + gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -565,14 +549,12 @@ JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
+    return jsNontrivialString(exec, formatDateUTCVariant(*gregorianDateTime) + " " + formatTimeUTC(*gregorianDateTime));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -580,14 +562,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.month);
+    return jsNumber(exec, gregorianDateTime->month);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -595,14 +575,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.month);
+    return jsNumber(exec, gregorianDateTime->month);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -610,14 +588,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.monthDay);
+    return jsNumber(exec, gregorianDateTime->monthDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -625,14 +601,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.monthDay);
+    return jsNumber(exec, gregorianDateTime->monthDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -640,14 +614,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue th
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.weekDay);
+    return jsNumber(exec, gregorianDateTime->weekDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -655,14 +627,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.weekDay);
+    return jsNumber(exec, gregorianDateTime->weekDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -670,14 +640,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.hour);
+    return jsNumber(exec, gregorianDateTime->hour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -685,14 +653,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.hour);
+    return jsNumber(exec, gregorianDateTime->hour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -700,14 +666,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.minute);
+    return jsNumber(exec, gregorianDateTime->minute);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -715,14 +679,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.minute);
+    return jsNumber(exec, gregorianDateTime->minute);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -730,14 +692,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.second);
+    return jsNumber(exec, gregorianDateTime->second);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -745,14 +705,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.second);
+    return jsNumber(exec, gregorianDateTime->second);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -790,14 +748,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*,
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, -gmtoffset(t) / minutesPerHour);
+    return jsNumber(exec, -gregorianDateTime->utcOffset / minutesPerHour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -830,16 +786,21 @@ static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const
     double secs = floor(milli / msPerSecond);
     double ms = milli - secs * msPerSecond;
 
-    GregorianDateTime t;
-    thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
+    const GregorianDateTime* other = inputIsUTC 
+        ? thisDateObj->gregorianDateTimeUTC(exec)
+        : thisDateObj->gregorianDateTime(exec);
+    if (!other)
+        return jsNaN(exec);
 
-    if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &t)) {
+    GregorianDateTime gregorianDateTime;
+    gregorianDateTime.copyFrom(*other);
+    if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
     
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -857,26 +818,28 @@ static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const
     }      
     
     double milli = thisDateObj->internalNumber();
-    double ms = 0;
-
-    GregorianDateTime t;
-    if (numArgsToUse == 3 && isnan(milli))
-        // Based on ECMA 262 15.9.5.40 - .41 (set[UTC]FullYear)
-        // the time must be reset to +0 if it is NaN. 
-        WTF::msToGregorianDateTime(0, true, t);
-    else {
-        double secs = floor(milli / msPerSecond);
-        ms = milli - secs * msPerSecond;
-        thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
+    double ms = 0; 
+
+    GregorianDateTime gregorianDateTime; 
+    if (numArgsToUse == 3 && isnan(milli)) 
+        msToGregorianDateTime(exec, 0, true, gregorianDateTime); 
+    else { 
+        ms = milli - floor(milli / msPerSecond) * msPerSecond; 
+        const GregorianDateTime* other = inputIsUTC 
+            ? thisDateObj->gregorianDateTimeUTC(exec)
+            : thisDateObj->gregorianDateTime(exec);
+        if (!other)
+            return jsNaN(exec);
+        gregorianDateTime.copyFrom(*other);
     }
     
-    if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &t)) {
+    if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
            
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -970,8 +933,6 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (args.isEmpty()) { 
         JSValue result = jsNaN(exec);
@@ -982,15 +943,16 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     double milli = thisDateObj->internalNumber();
     double ms = 0;
 
-    GregorianDateTime t;
+    GregorianDateTime gregorianDateTime;
     if (isnan(milli))
         // Based on ECMA 262 B.2.5 (setYear)
         // the time must be reset to +0 if it is NaN. 
-        WTF::msToGregorianDateTime(0, true, t);
+        msToGregorianDateTime(exec, 0, true, gregorianDateTime);
     else {   
         double secs = floor(milli / msPerSecond);
         ms = milli - secs * msPerSecond;
-        thisDateObj->getGregorianDateTime(exec, outputIsUTC, t);
+        if (const GregorianDateTime* other = thisDateObj->gregorianDateTime(exec))
+            gregorianDateTime.copyFrom(*other);
     }
     
     bool ok = true;
@@ -1001,8 +963,8 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
         return result;
     }
             
-    t.year = (year > 99 || year < 0) ? year - 1900 : year;
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, outputIsUTC));
+    gregorianDateTime.year = (year > 99 || year < 0) ? year - 1900 : year;
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, false));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -1012,16 +974,14 @@ JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
 
     // NOTE: IE returns the full year even in getYear.
-    return jsNumber(exec, t.year);
+    return jsNumber(exec, gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
diff --git a/JavaScriptCore/runtime/FunctionPrototype.cpp b/JavaScriptCore/runtime/FunctionPrototype.cpp
index 45f17b1..a3a7479 100644
--- a/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -90,13 +90,13 @@ JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec, JSObject*, JSVa
             FunctionExecutable* executable = function->jsExecutable();
             UString sourceString = executable->source().toString();
             insertSemicolonIfNeeded(sourceString);
-            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + executable->paramString() + ") " + sourceString);
+            return jsString(exec, "function " + function->name(exec) + "(" + executable->paramString() + ") " + sourceString);
         }
     }
 
     if (thisValue.inherits(&InternalFunction::info)) {
         InternalFunction* function = asInternalFunction(thisValue);
-        return jsString(exec, "function " + function->name(&exec->globalData()) + "() {\n    [native code]\n}");
+        return jsString(exec, "function " + function->name(exec) + "() {\n    [native code]\n}");
     }
 
     return throwError(exec, TypeError);
diff --git a/JavaScriptCore/runtime/InitializeThreading.cpp b/JavaScriptCore/runtime/InitializeThreading.cpp
index fea89f8..aad1af8 100644
--- a/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -51,7 +51,7 @@ static void initializeThreadingOnce()
     initializeUString();
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex = new Mutex;
-    WTF::initializeDates();
+    initializeDates();
 #endif
 }
 
diff --git a/JavaScriptCore/runtime/InternalFunction.cpp b/JavaScriptCore/runtime/InternalFunction.cpp
index 2ba2984..c48d628 100644
--- a/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/JavaScriptCore/runtime/InternalFunction.cpp
@@ -43,29 +43,29 @@ InternalFunction::InternalFunction(JSGlobalData* globalData, NonNullPassRefPtr<S
     putDirect(globalData->propertyNames->name, jsString(globalData, name.ustring()), DontDelete | ReadOnly | DontEnum);
 }
 
-const UString& InternalFunction::name(JSGlobalData* globalData)
+const UString& InternalFunction::name(ExecState* exec)
 {
-    return asString(getDirect(globalData->propertyNames->name))->value();
+    return asString(getDirect(exec->globalData().propertyNames->name))->value(exec);
 }
 
-const UString InternalFunction::displayName(JSGlobalData* globalData)
+const UString InternalFunction::displayName(ExecState* exec)
 {
-    JSValue displayName = getDirect(globalData->propertyNames->displayName);
+    JSValue displayName = getDirect(exec->globalData().propertyNames->displayName);
     
-    if (displayName && isJSString(globalData, displayName))
-        return asString(displayName)->value();
+    if (displayName && isJSString(&exec->globalData(), displayName))
+        return asString(displayName)->value(exec);
     
     return UString::null();
 }
 
-const UString InternalFunction::calculatedDisplayName(JSGlobalData* globalData)
+const UString InternalFunction::calculatedDisplayName(ExecState* exec)
 {
-    const UString explicitName = displayName(globalData);
+    const UString explicitName = displayName(exec);
     
     if (!explicitName.isEmpty())
         return explicitName;
     
-    return name(globalData);
+    return name(exec);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/InternalFunction.h b/JavaScriptCore/runtime/InternalFunction.h
index de9a1d6..fa1e5aa 100644
--- a/JavaScriptCore/runtime/InternalFunction.h
+++ b/JavaScriptCore/runtime/InternalFunction.h
@@ -36,9 +36,9 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const; 
         static JS_EXPORTDATA const ClassInfo info;
 
-        const UString& name(JSGlobalData*);
-        const UString displayName(JSGlobalData*);
-        const UString calculatedDisplayName(JSGlobalData*);
+        const UString& name(ExecState*);
+        const UString displayName(ExecState*);
+        const UString calculatedDisplayName(ExecState*);
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
diff --git a/JavaScriptCore/runtime/JSArray.cpp b/JavaScriptCore/runtime/JSArray.cpp
index fd9e7b2..b16d3fa 100644
--- a/JavaScriptCore/runtime/JSArray.cpp
+++ b/JavaScriptCore/runtime/JSArray.cpp
@@ -785,7 +785,7 @@ struct AVLTreeAbstractorForArrayCompare {
             m_cachedCall->setThis(m_globalThisValue);
             m_cachedCall->setArgument(0, va);
             m_cachedCall->setArgument(1, vb);
-            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame());
+            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame(m_exec));
         } else {
             MarkedArgumentBuffer arguments;
             arguments.append(va);
diff --git a/JavaScriptCore/runtime/JSCell.cpp b/JavaScriptCore/runtime/JSCell.cpp
index fae056e..17410e2 100644
--- a/JavaScriptCore/runtime/JSCell.cpp
+++ b/JavaScriptCore/runtime/JSCell.cpp
@@ -86,17 +86,17 @@ bool JSCell::getUInt32(uint32_t&) const
     return false;
 }
 
-bool JSCell::getString(UString&stringValue) const
+bool JSCell::getString(ExecState* exec, UString&stringValue) const
 {
     if (!isString())
         return false;
-    stringValue = static_cast<const JSString*>(this)->value();
+    stringValue = static_cast<const JSString*>(this)->value(exec);
     return true;
 }
 
-UString JSCell::getString() const
+UString JSCell::getString(ExecState* exec) const
 {
-    return isString() ? static_cast<const JSString*>(this)->value() : UString();
+    return isString() ? static_cast<const JSString*>(this)->value(exec) : UString();
 }
 
 JSObject* JSCell::getObject()
diff --git a/JavaScriptCore/runtime/JSCell.h b/JavaScriptCore/runtime/JSCell.h
index 722ae33..c8ba2b8 100644
--- a/JavaScriptCore/runtime/JSCell.h
+++ b/JavaScriptCore/runtime/JSCell.h
@@ -42,6 +42,7 @@ namespace JSC {
         friend class JSString;
         friend class JSValue;
         friend class JSAPIValueWrapper;
+        friend class JSZombie;
         friend struct VPtrSet;
 
     private:
@@ -64,8 +65,8 @@ namespace JSC {
         Structure* structure() const;
 
         // Extracting the value.
-        bool getString(UString&) const;
-        UString getString() const; // null string if not a string
+        bool getString(ExecState* exec, UString&) const;
+        UString getString(ExecState* exec) const; // null string if not a string
         JSObject* getObject(); // NULL if not an object
         const JSObject* getObject() const; // NULL if not an object
         
@@ -90,6 +91,9 @@ namespace JSC {
         void* operator new(size_t, void* placementNewDestination) { return placementNewDestination; }
 
         virtual void markChildren(MarkStack&);
+#if ENABLE(JSC_ZOMBIES)
+        virtual bool isZombie() const { return false; }
+#endif
 
         // Object operations, with the toObject operation included.
         virtual const ClassInfo* classInfo() const;
@@ -175,14 +179,14 @@ namespace JSC {
         return isCell() && asCell()->isObject();
     }
 
-    inline bool JSValue::getString(UString& s) const
+    inline bool JSValue::getString(ExecState* exec, UString& s) const
     {
-        return isCell() && asCell()->getString(s);
+        return isCell() && asCell()->getString(exec, s);
     }
 
-    inline UString JSValue::getString() const
+    inline UString JSValue::getString(ExecState* exec) const
     {
-        return isCell() ? asCell()->getString() : UString();
+        return isCell() ? asCell()->getString(exec) : UString();
     }
 
     inline JSObject* JSValue::getObject() const
@@ -342,7 +346,13 @@ namespace JSC {
     {
         return cellBlock(c)->heap;
     }
-
+    
+#if ENABLE(JSC_ZOMBIES)
+    inline bool JSValue::isZombie() const
+    {
+        return isCell() && asCell() && asCell()->isZombie();
+    }
+#endif
 } // namespace JSC
 
 #endif // JSCell_h
diff --git a/JavaScriptCore/runtime/JSGlobalData.cpp b/JavaScriptCore/runtime/JSGlobalData.cpp
index 1221ef2..234449f 100644
--- a/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -82,26 +82,28 @@ struct VPtrSet {
 
 VPtrSet::VPtrSet()
 {
-    // Bizarrely, calling fastMalloc here is faster than allocating space on the stack.
-    void* storage = fastMalloc(sizeof(CollectorBlock));
+    CollectorCell cell;
+    void* storage = &cell;
 
+    COMPILE_ASSERT(sizeof(JSArray) <= sizeof(CollectorCell), sizeof_JSArray_must_be_less_than_CollectorCell);
     JSCell* jsArray = new (storage) JSArray(JSArray::createStructure(jsNull()));
     jsArrayVPtr = jsArray->vptr();
     jsArray->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSByteArray) <= sizeof(CollectorCell), sizeof_JSByteArray_must_be_less_than_CollectorCell);
     JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
     jsByteArrayVPtr = jsByteArray->vptr();
     jsByteArray->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSString) <= sizeof(CollectorCell), sizeof_JSString_must_be_less_than_CollectorCell);
     JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
     jsStringVPtr = jsString->vptr();
     jsString->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSFunction) <= sizeof(CollectorCell), sizeof_JSFunction_must_be_less_than_CollectorCell);
     JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
     jsFunctionVPtr = jsFunction->vptr();
     jsFunction->~JSCell();
-
-    fastFree(storage);
 }
 
 JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
@@ -147,6 +149,8 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     , functionCodeBlockBeingReparsed(0)
     , firstStringifierToMark(0)
     , markStack(vptrSet.jsArrayVPtr)
+    , cachedUTCOffset(NaN)
+    , weakRandom(static_cast<int>(currentTime()))
 #ifndef NDEBUG
     , mainThreadOnly(false)
 #endif
@@ -251,6 +255,14 @@ JSGlobalData::ClientData::~ClientData()
 {
 }
 
+void JSGlobalData::resetDateCache()
+{
+    cachedUTCOffset = NaN;
+    dstOffsetCache.reset();
+    cachedDateString = UString();
+    dateInstanceCache.reset();
+}
+
 void JSGlobalData::startSampling()
 {
     interpreter->startSampling();
diff --git a/JavaScriptCore/runtime/JSGlobalData.h b/JavaScriptCore/runtime/JSGlobalData.h
index d2aa2da..f0c1b5c 100644
--- a/JavaScriptCore/runtime/JSGlobalData.h
+++ b/JavaScriptCore/runtime/JSGlobalData.h
@@ -38,6 +38,7 @@
 #include "NumericStrings.h"
 #include "SmallStrings.h"
 #include "TimeoutChecker.h"
+#include "WeakRandom.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
@@ -63,6 +64,26 @@ namespace JSC {
     struct Instruction;    
     struct VPtrSet;
 
+    struct DSTOffsetCache {
+        DSTOffsetCache()
+        {
+            reset();
+        }
+        
+        void reset()
+        {
+            offset = 0.0;
+            start = 0.0;
+            end = -1.0;
+            increment = 0.0;
+        }
+
+        double offset;
+        double start;
+        double end;
+        double increment;
+    };
+
     class JSGlobalData : public RefCounted<JSGlobalData> {
     public:
         struct ClientData {
@@ -153,10 +174,20 @@ namespace JSC {
 
         MarkStack markStack;
 
+        double cachedUTCOffset;
+        DSTOffsetCache dstOffsetCache;
+        
+        UString cachedDateString;
+        double cachedDateStringValue;
+        
+        WeakRandom weakRandom;
+
 #ifndef NDEBUG
         bool mainThreadOnly;
 #endif
 
+        void resetDateCache();
+
         void startSampling();
         void stopSampling();
         void dumpSampleData(ExecState* exec);
@@ -165,7 +196,7 @@ namespace JSC {
         static JSGlobalData*& sharedInstanceInternal();
         void createNativeThunk();
     };
-
+    
 } // namespace JSC
 
 #endif // JSGlobalData_h
diff --git a/JavaScriptCore/runtime/JSGlobalObject.h b/JavaScriptCore/runtime/JSGlobalObject.h
index 720d3a5..9e4ef49 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/JavaScriptCore/runtime/JSGlobalObject.h
@@ -442,7 +442,13 @@ namespace JSC {
             : m_dynamicGlobalObjectSlot(callFrame->globalData().dynamicGlobalObject)
             , m_savedDynamicGlobalObject(m_dynamicGlobalObjectSlot)
         {
-            m_dynamicGlobalObjectSlot = dynamicGlobalObject;
+            if (!m_dynamicGlobalObjectSlot) {
+                m_dynamicGlobalObjectSlot = dynamicGlobalObject;
+
+                // Reset the date cache between JS invocations to force the VM
+                // to observe time zone changes.
+                callFrame->globalData().resetDateCache();
+            }
         }
 
         ~DynamicGlobalObjectScope()
diff --git a/JavaScriptCore/runtime/JSNumberCell.h b/JavaScriptCore/runtime/JSNumberCell.h
index 309488f..e9e2470 100644
--- a/JavaScriptCore/runtime/JSNumberCell.h
+++ b/JavaScriptCore/runtime/JSNumberCell.h
@@ -109,6 +109,11 @@ namespace JSC {
         return static_cast<JSNumberCell*>(v.asCell());
     }
 
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState* exec, double d)
+    {
+        *this = jsNumberCell(exec, d);
+    }
+
     inline JSValue::JSValue(ExecState* exec, double d)
     {
         JSValue v = JSImmediate::from(d);
@@ -193,6 +198,11 @@ namespace JSC {
 #endif // USE(JSVALUE32)
 
 #if USE(JSVALUE64)
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    {
+        *this = JSImmediate::fromNumberOutsideIntegerRange(d);
+    }
+
     inline JSValue::JSValue(ExecState*, double d)
     {
         JSValue v = JSImmediate::from(d);
diff --git a/JavaScriptCore/runtime/JSONObject.cpp b/JavaScriptCore/runtime/JSONObject.cpp
index 297d457..cc7f6d9 100644
--- a/JavaScriptCore/runtime/JSONObject.cpp
+++ b/JavaScriptCore/runtime/JSONObject.cpp
@@ -70,7 +70,23 @@ public:
     void markAggregate(MarkStack&);
 
 private:
-    typedef UString StringBuilder;
+    class StringBuilder : public Vector<UChar> {
+    public:
+        using Vector<UChar>::append;
+
+        inline void append(const char* str)
+        {
+            size_t len = strlen(str);
+            reserveCapacity(size() + len);
+            for (size_t i = 0; i < len; i++)
+                Vector<UChar>::append(str[i]);
+        }
+
+        inline void append(const UString& str)
+        {
+            append(str.data(), str.size());
+        }
+    };
 
     class Holder {
     public:
@@ -156,7 +172,7 @@ static inline UString gap(ExecState* exec, JSValue space)
     }
 
     // If the space value is a string, use it as the gap string, otherwise use no gap string.
-    UString spaces = space.getString();
+    UString spaces = space.getString(exec);
     if (spaces.size() > maxGapLength) {
         spaces = spaces.substr(0, maxGapLength);
     }
@@ -213,7 +229,7 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
                 break;
 
             UString propertyName;
-            if (name.getString(propertyName)) {
+            if (name.getString(exec, propertyName)) {
                 m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
                 continue;
             }
@@ -269,7 +285,9 @@ JSValue Stringifier::stringify(JSValue value)
     if (m_exec->hadException())
         return jsNull();
 
-    return jsString(m_exec, result);
+    result.shrinkToFit();
+    size_t length = result.size();
+    return jsString(m_exec, UString(result.releaseBuffer(), length, false));
 }
 
 void Stringifier::appendQuotedString(StringBuilder& builder, const UString& value)
@@ -389,7 +407,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
     }
 
     UString stringValue;
-    if (value.getString(stringValue)) {
+    if (value.getString(m_exec, stringValue)) {
         appendQuotedString(builder, stringValue);
         return StringifySucceeded;
     }
@@ -586,7 +604,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
             // This only occurs when get an undefined value for an object property.
             // In this case we don't want the separator and property name that we
             // already appended, so roll back.
-            builder = builder.substr(0, rollBackPoint);
+            builder.resize(rollBackPoint);
             break;
     }
 
diff --git a/JavaScriptCore/runtime/JSObject.cpp b/JavaScriptCore/runtime/JSObject.cpp
index 6932ded..ed9fdc2 100644
--- a/JavaScriptCore/runtime/JSObject.cpp
+++ b/JavaScriptCore/runtime/JSObject.cpp
@@ -406,26 +406,10 @@ bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 
 bool JSObject::propertyIsEnumerable(ExecState* exec, const Identifier& propertyName) const
 {
-    unsigned attributes;
-    if (!getPropertyAttributes(exec, propertyName, attributes))
+    PropertyDescriptor descriptor;
+    if (!const_cast<JSObject*>(this)->getOwnPropertyDescriptor(exec, propertyName, descriptor))
         return false;
-    return !(attributes & DontEnum);
-}
-
-bool JSObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    JSCell* specificValue;
-    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
-        return true;
-    
-    // Look in the static hashtable of properties
-    const HashEntry* entry = findPropertyHashEntry(exec, propertyName);
-    if (entry) {
-        attributes = entry->attributes();
-        return true;
-    }
-    
-    return false;
+    return descriptor.enumerable();
 }
 
 bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyName, JSCell*& specificValue) const
@@ -522,12 +506,12 @@ void JSObject::removeDirect(const Identifier& propertyName)
 
 void JSObject::putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunction(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunction(Identifier(exec, function->name(exec)), function, attr);
 }
 
 void JSObject::putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunctionWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunctionWithoutTransition(Identifier(exec, function->name(exec)), function, attr);
 }
 
 NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue* location)
@@ -599,7 +583,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     if (descriptor.isEmpty())
         return true;
 
-    if (current.equalTo(descriptor))
+    if (current.equalTo(exec, descriptor))
         return true;
 
     // Filter out invalid changes
@@ -645,7 +629,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
                 return false;
             }
             if (!current.writable()) {
-                if (descriptor.value() || !JSValue::strictEqual(current.value(), descriptor.value())) {
+                if (descriptor.value() || !JSValue::strictEqual(exec, current.value(), descriptor.value())) {
                     if (throwException)
                         throwError(exec, TypeError, "Attempting to change value of a readonly property.");
                     return false;
@@ -667,12 +651,12 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     // Changing the accessor functions of an existing accessor property
     ASSERT(descriptor.isAccessorDescriptor());
     if (!current.configurable()) {
-        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(current.setter(), descriptor.setter()))) {
+        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
             if (throwException)
                 throwError(exec, TypeError, "Attempting to change the setter of an unconfigurable property.");
             return false;
         }
-        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(current.getter(), descriptor.getter()))) {
+        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
             if (throwException)
                 throwError(exec, TypeError, "Attempting to change the getter of an unconfigurable property.");
             return false;
diff --git a/JavaScriptCore/runtime/JSObject.h b/JavaScriptCore/runtime/JSObject.h
index 5a89c40..a5da267 100644
--- a/JavaScriptCore/runtime/JSObject.h
+++ b/JavaScriptCore/runtime/JSObject.h
@@ -135,7 +135,6 @@ namespace JSC {
         virtual JSObject* toThisObject(ExecState*) const;
         virtual JSObject* unwrappedObject();
 
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
         bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 
         // This get function only looks at the property map.
@@ -210,6 +209,11 @@ namespace JSC {
             return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
+        void flattenDictionaryObject()
+        {
+            m_structure->flattenDictionaryStructure(this);
+        }
+
     protected:
         static const unsigned StructureFlags = 0;
 
@@ -229,7 +233,7 @@ namespace JSC {
         using JSCell::isGetterSetter;
         using JSCell::toObject;
         void getObject();
-        void getString();
+        void getString(ExecState* exec);
         void isObject();
         void isString();
 #if USE(JSVALUE32)
diff --git a/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 6fd0344..d3dcb83 100644
--- a/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -45,7 +45,8 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
     o->getPropertyNames(exec, propertyNames);
     size_t numCacheableSlots = 0;
     if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasAnonymousSlots() &&
-        !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
+        !o->structure()->hasGetterSetterProperties() && !o->structure()->isUncacheableDictionary() &&
+        !o->structure()->typeInfo().overridesGetPropertyNames())
         numCacheableSlots = o->structure()->propertyStorageSize();
 
     JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
@@ -76,7 +77,7 @@ JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
     if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
         return identifier;
 
-    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value())))
+    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value(exec))))
         return JSValue();
     return identifier;
 }
diff --git a/JavaScriptCore/runtime/JSString.cpp b/JavaScriptCore/runtime/JSString.cpp
index 20ba868..28ae6f7 100644
--- a/JavaScriptCore/runtime/JSString.cpp
+++ b/JavaScriptCore/runtime/JSString.cpp
@@ -25,41 +25,160 @@
 
 #include "JSGlobalObject.h"
 #include "JSObject.h"
+#include "Operations.h"
 #include "StringObject.h"
 #include "StringPrototype.h"
 
 namespace JSC {
 
+void JSString::Rope::destructNonRecursive()
+{
+    Vector<Rope*, 32> workQueue;
+    Rope* rope = this;
+
+    while (true) {
+        unsigned length = rope->ropeLength();
+        for (unsigned i = 0; i < length; ++i) {
+            Fiber& fiber = rope->fibers(i);
+            if (fiber.isString())
+                fiber.string()->deref();
+            else {
+                Rope* nextRope = fiber.rope();
+                if (nextRope->hasOneRef())
+                    workQueue.append(nextRope);
+                else
+                    nextRope->deref();
+            }
+        }
+        if (rope != this)
+            fastFree(rope);
+
+        if (workQueue.isEmpty())
+            return;
+
+        rope = workQueue.last();
+        workQueue.removeLast();
+    }
+}
+
+JSString::Rope::~Rope()
+{
+    destructNonRecursive();
+}
+
+#define ROPE_COPY_CHARS_INLINE_CUTOFF 20
+
+static inline void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
+{
+#ifdef ROPE_COPY_CHARS_INLINE_CUTOFF
+    if (numCharacters <= ROPE_COPY_CHARS_INLINE_CUTOFF) {
+        for (unsigned i = 0; i < numCharacters; ++i)
+            destination[i] = source[i];
+        return;
+    }
+#endif
+    memcpy(destination, source, numCharacters * sizeof(UChar));
+}
+
+// Overview: this methods converts a JSString from holding a string in rope form
+// down to a simple UString representation.  It does so by building up the string
+// backwards, since we want to avoid recursion, we expect that the tree structure
+// representing the rope is likely imbalanced with more nodes down the left side
+// (since appending to the string is likely more common) - and as such resolving
+// in this fashion should minimize work queue size.  (If we built the queue forwards
+// we would likely have to place all of the constituent UString::Reps into the
+// Vector before performing any concatenation, but by working backwards we likely
+// only fill the queue with the number of substrings at any given level in a
+// rope-of-ropes.)
+void JSString::resolveRope(ExecState* exec) const
+{
+    ASSERT(isRope());
+
+    // Allocate the buffer to hold the final string, position initially points to the end.
+    UChar* buffer;
+    if (!tryFastMalloc(m_stringLength * sizeof(UChar)).getValue(buffer)) {
+        for (unsigned i = 0; i < m_ropeLength; ++i)
+            m_fibers[i].deref();
+        m_ropeLength = 0;
+        ASSERT(!isRope());
+        ASSERT(m_value == UString());
+
+        throwOutOfMemoryError(exec);
+        return;
+    }
+    UChar* position = buffer + m_stringLength;
+
+    // Start with the current Rope.
+    Vector<Rope::Fiber, 32> workQueue;
+    Rope::Fiber currentFiber;
+    for (unsigned i = 0; i < (m_ropeLength - 1); ++i)
+        workQueue.append(m_fibers[i]);
+    currentFiber = m_fibers[m_ropeLength - 1];
+    while (true) {
+        if (currentFiber.isRope()) {
+            Rope* rope = currentFiber.rope();
+            // Copy the contents of the current rope into the workQueue, with the last item in 'currentFiber'
+            // (we will be working backwards over the rope).
+            unsigned ropeLengthMinusOne = rope->ropeLength() - 1;
+            for (unsigned i = 0; i < ropeLengthMinusOne; ++i)
+                workQueue.append(rope->fibers(i));
+            currentFiber = rope->fibers(ropeLengthMinusOne);
+        } else {
+            UString::Rep* string = currentFiber.string();
+            unsigned length = string->len;
+            position -= length;
+            copyChars(position, string->data(), length);
+
+            // Was this the last item in the work queue?
+            if (workQueue.isEmpty()) {
+                // Create a string from the UChar buffer, clear the rope RefPtr.
+                ASSERT(buffer == position);
+                m_value = UString::Rep::create(buffer, m_stringLength);
+                for (unsigned i = 0; i < m_ropeLength; ++i)
+                    m_fibers[i].deref();
+                m_ropeLength = 0;
+
+                ASSERT(!isRope());
+                return;
+            }
+
+            // No! - set the next item up to process.
+            currentFiber = workQueue.last();
+            workQueue.removeLast();
+        }
+    }
+}
+
 JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSString*>(this);
 }
 
-bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
+bool JSString::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result)
 {
-    value = this;
-    number = m_value.toDouble();
+    result = this;
+    number = value(exec).toDouble();
     return false;
 }
 
 bool JSString::toBoolean(ExecState*) const
 {
-    return !m_value.isEmpty();
+    return m_stringLength;
 }
 
-double JSString::toNumber(ExecState*) const
+double JSString::toNumber(ExecState* exec) const
 {
-    return m_value.toDouble();
+    return value(exec).toDouble();
 }
 
-UString JSString::toString(ExecState*) const
+UString JSString::toString(ExecState* exec) const
 {
-    return m_value;
+    return value(exec);
 }
 
-UString JSString::toThisString(ExecState*) const
+UString JSString::toThisString(ExecState* exec) const
 {
-    return m_value;
+    return value(exec);
 }
 
 JSString* JSString::toThisJSString(ExecState*)
@@ -106,14 +225,14 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
 bool JSString::getStringPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     if (propertyName == exec->propertyNames().length) {
-        descriptor.setDescriptor(jsNumber(exec, m_value.size()), DontEnum | DontDelete | ReadOnly);
+        descriptor.setDescriptor(jsNumber(exec, m_stringLength), DontEnum | DontDelete | ReadOnly);
         return true;
     }
     
     bool isStrictUInt32;
     unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
-    if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
-        descriptor.setDescriptor(jsSingleCharacterSubstring(exec, m_value, i), DontDelete | ReadOnly);
+    if (isStrictUInt32 && i < m_stringLength) {
+        descriptor.setDescriptor(jsSingleCharacterSubstring(exec, value(exec), i), DontDelete | ReadOnly);
         return true;
     }
     
diff --git a/JavaScriptCore/runtime/JSString.h b/JavaScriptCore/runtime/JSString.h
index 39dfe75..1867b17 100644
--- a/JavaScriptCore/runtime/JSString.h
+++ b/JavaScriptCore/runtime/JSString.h
@@ -60,13 +60,110 @@ namespace JSC {
     JSString* jsOwnedString(ExecState*, const UString&); 
 
     class JSString : public JSCell {
+    public:
         friend class JIT;
         friend struct VPtrSet;
 
-    public:
+        // A Rope is a string composed of a set of substrings.
+        class Rope : public RefCounted<Rope> {
+        public:
+            // A Rope is composed from a set of smaller strings called Fibers.
+            // Each Fiber in a rope is either UString::Rep or another Rope.
+            class Fiber {
+            public:
+                Fiber() {}
+                Fiber(UString::Rep* string) : m_value(reinterpret_cast<intptr_t>(string)) {}
+                Fiber(Rope* rope) : m_value(reinterpret_cast<intptr_t>(rope) | 1) {}
+
+                void deref()
+                {
+                    if (isRope())
+                        rope()->deref();
+                    else
+                        string()->deref();
+                }
+
+                Fiber& ref()
+                {
+                    if (isString())
+                        string()->ref();
+                    else
+                        rope()->ref();
+                    return *this;
+                }
+
+                unsigned refAndGetLength()
+                {
+                    if (isString()) {
+                        UString::Rep* rep = string();
+                        return rep->ref()->len;
+                    } else {
+                        Rope* r = rope();
+                        r->ref();
+                        return r->stringLength();
+                    }
+                }
+
+                bool isRope() { return m_value & 1; }
+                Rope* rope() { return reinterpret_cast<Rope*>(m_value & ~1); }
+                bool isString() { return !isRope(); }
+                UString::Rep* string() { return reinterpret_cast<UString::Rep*>(m_value); }
+
+            private:
+                intptr_t m_value;
+            };
+
+            // Creates a Rope comprising of 'ropeLength' Fibers.
+            // The Rope is constructed in an uninitialized state - initialize must be called for each Fiber in the Rope.
+            static PassRefPtr<Rope> createOrNull(unsigned ropeLength)
+            {
+                void* allocation;
+                if (tryFastMalloc(sizeof(Rope) + (ropeLength - 1) * sizeof(Fiber)).getValue(allocation))
+                    return adoptRef(new (allocation) Rope(ropeLength));
+                return 0;
+            }
+
+            ~Rope();
+            void destructNonRecursive();
+
+            void append(unsigned &index, Fiber& fiber)
+            {
+                m_fibers[index++] = fiber;
+                m_stringLength += fiber.refAndGetLength();
+            }
+            void append(unsigned &index, const UString& string)
+            {
+                UString::Rep* rep = string.rep();
+                m_fibers[index++] = Fiber(rep);
+                m_stringLength += rep->ref()->len;
+            }
+            void append(unsigned& index, JSString* jsString)
+            {
+                if (jsString->isRope()) {
+                    for (unsigned i = 0; i < jsString->m_ropeLength; ++i)
+                        append(index, jsString->m_fibers[i]);
+                } else
+                    append(index, jsString->string());
+            }
+
+            unsigned ropeLength() { return m_ropeLength; }
+            unsigned stringLength() { return m_stringLength; }
+            Fiber& fibers(unsigned index) { return m_fibers[index]; }
+
+        private:
+            Rope(unsigned ropeLength) : m_ropeLength(ropeLength), m_stringLength(0) {}
+            void* operator new(size_t, void* inPlace) { return inPlace; }
+            
+            unsigned m_ropeLength;
+            unsigned m_stringLength;
+            Fiber m_fibers[1];
+        };
+
         JSString(JSGlobalData* globalData, const UString& value)
             : JSCell(globalData->stringStructure.get())
+            , m_stringLength(value.size())
             , m_value(value)
+            , m_ropeLength(0)
         {
             Heap::heap(this)->reportExtraMemoryCost(value.cost());
         }
@@ -74,23 +171,106 @@ namespace JSC {
         enum HasOtherOwnerType { HasOtherOwner };
         JSString(JSGlobalData* globalData, const UString& value, HasOtherOwnerType)
             : JSCell(globalData->stringStructure.get())
+            , m_stringLength(value.size())
             , m_value(value)
+            , m_ropeLength(0)
         {
         }
         JSString(JSGlobalData* globalData, PassRefPtr<UString::Rep> value, HasOtherOwnerType)
             : JSCell(globalData->stringStructure.get())
+            , m_stringLength(value->size())
             , m_value(value)
+            , m_ropeLength(0)
         {
         }
-        
-        const UString& value() const { return m_value; }
+        JSString(JSGlobalData* globalData, PassRefPtr<JSString::Rope> rope)
+            : JSCell(globalData->stringStructure.get())
+            , m_stringLength(rope->stringLength())
+            , m_ropeLength(1)
+        {
+            m_fibers[0] = rope.releaseRef();
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with ropeLength <= 3.
+        JSString(JSGlobalData* globalData, unsigned ropeLength, JSString* s1, JSString* s2)
+            : JSCell(globalData->stringStructure.get())
+            , m_stringLength(s1->length() + s2->length())
+            , m_ropeLength(ropeLength)
+        {
+            ASSERT(ropeLength <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, s1);
+            appendStringInConstruct(index, s2);
+            ASSERT(ropeLength == index);
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with ropeLength <= 3.
+        JSString(JSGlobalData* globalData, unsigned ropeLength, JSString* s1, const UString& u2)
+            : JSCell(globalData->stringStructure.get())
+            , m_stringLength(s1->length() + u2.size())
+            , m_ropeLength(ropeLength)
+        {
+            ASSERT(ropeLength <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, s1);
+            appendStringInConstruct(index, u2);
+            ASSERT(ropeLength == index);
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with ropeLength <= 3.
+        JSString(JSGlobalData* globalData, unsigned ropeLength, const UString& u1, JSString* s2)
+            : JSCell(globalData->stringStructure.get())
+            , m_stringLength(u1.size() + s2->length())
+            , m_ropeLength(ropeLength)
+        {
+            ASSERT(ropeLength <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, u1);
+            appendStringInConstruct(index, s2);
+            ASSERT(ropeLength == index);
+        }
+        // This constructor constructs a new string by concatenating v1, v2 & v3.
+        // This should only be called with ropeLength <= 3 ... which since every
+        // value must require a ropeLength of at least one implies that the length
+        // for each value must be exactly 1!
+        JSString(ExecState* exec, JSValue v1, JSValue v2, JSValue v3)
+            : JSCell(exec->globalData().stringStructure.get())
+            , m_stringLength(0)
+            , m_ropeLength(s_maxInternalRopeLength)
+        {
+            unsigned index = 0;
+            appendValueInConstructAndIncrementLength(exec, index, v1);
+            appendValueInConstructAndIncrementLength(exec, index, v2);
+            appendValueInConstructAndIncrementLength(exec, index, v3);
+            ASSERT(index == s_maxInternalRopeLength);
+        }
+
+        ~JSString()
+        {
+            for (unsigned i = 0; i < m_ropeLength; ++i)
+                m_fibers[i].deref();
+        }
+
+        const UString& value(ExecState* exec) const
+        {
+            if (isRope())
+                resolveRope(exec);
+            return m_value;
+        }
+        const UString tryGetValue() const
+        {
+            if (isRope())
+                UString();
+            return m_value;
+        }
+        unsigned length() { return m_stringLength; }
 
         bool getStringPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getStringPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         bool getStringPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
 
-        bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
-        JSString* getIndex(JSGlobalData*, unsigned);
+        bool canGetIndex(unsigned i) { return i < m_stringLength; }
+        JSString* getIndex(ExecState*, unsigned);
 
         static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
 
@@ -98,7 +278,39 @@ namespace JSC {
         enum VPtrStealingHackType { VPtrStealingHack };
         JSString(VPtrStealingHackType) 
             : JSCell(0)
+            , m_ropeLength(0)
+        {
+        }
+
+        void resolveRope(ExecState*) const;
+
+        void appendStringInConstruct(unsigned& index, const UString& string)
+        {
+            m_fibers[index++] = Rope::Fiber(string.rep()->ref());
+        }
+
+        void appendStringInConstruct(unsigned& index, JSString* jsString)
+        {
+            if (jsString->isRope()) {
+                for (unsigned i = 0; i < jsString->m_ropeLength; ++i)
+                    m_fibers[index++] = jsString->m_fibers[i].ref();
+            } else
+                appendStringInConstruct(index, jsString->string());
+        }
+
+        void appendValueInConstructAndIncrementLength(ExecState* exec, unsigned& index, JSValue v)
         {
+            if (v.isString()) {
+                ASSERT(asCell(v)->isString());
+                JSString* s = static_cast<JSString*>(asCell(v));
+                ASSERT(s->ropeLength() == 1);
+                appendStringInConstruct(index, s);
+                m_stringLength += s->length();
+            } else {
+                UString u(v.toString(exec));
+                m_fibers[index++] = Rope::Fiber(u.rep()->ref());
+                m_stringLength += u.size();
+            }
         }
 
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
@@ -117,7 +329,22 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        UString m_value;
+        static const unsigned s_maxInternalRopeLength = 3;
+
+        // A string is represented either by a UString or a Rope.
+        unsigned m_stringLength;
+        mutable UString m_value;
+        mutable unsigned m_ropeLength;
+        mutable Rope::Fiber m_fibers[s_maxInternalRopeLength];
+
+        bool isRope() const { return m_ropeLength; }
+        UString& string() { ASSERT(!isRope()); return m_value; }
+        unsigned ropeLength() { return m_ropeLength ? m_ropeLength : 1; }
+
+        friend JSValue jsString(ExecState* exec, JSString* s1, JSString* s2);
+        friend JSValue jsString(ExecState* exec, const UString& u1, JSString* s2);
+        friend JSValue jsString(ExecState* exec, JSString* s1, const UString& u2);
+        friend JSValue jsString(ExecState* exec, Register* strings, unsigned count);
     };
 
     JSString* asString(JSValue);
@@ -146,7 +373,7 @@ namespace JSC {
         UChar c = s.data()[offset];
         if (c <= 0xFF)
             return globalData->smallStrings.singleCharacterString(globalData, c);
-        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, 1));
+        return new (globalData) JSString(globalData, UString(UString::Rep::create(s.rep(), offset, 1)));
     }
 
     inline JSString* jsNontrivialString(JSGlobalData* globalData, const char* s)
@@ -163,10 +390,10 @@ namespace JSC {
         return new (globalData) JSString(globalData, s);
     }
 
-    inline JSString* JSString::getIndex(JSGlobalData* globalData, unsigned i)
+    inline JSString* JSString::getIndex(ExecState* exec, unsigned i)
     {
         ASSERT(canGetIndex(i));
-        return jsSingleCharacterSubstring(globalData, m_value, i);
+        return jsSingleCharacterSubstring(&exec->globalData(), value(exec), i);
     }
 
     inline JSString* jsString(JSGlobalData* globalData, const UString& s)
@@ -181,7 +408,7 @@ namespace JSC {
         }
         return new (globalData) JSString(globalData, s);
     }
-        
+
     inline JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
     {
         ASSERT(offset <= static_cast<unsigned>(s.size()));
@@ -194,7 +421,7 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
+        return new (globalData) JSString(globalData, UString(UString::Rep::create(s.rep(), offset, length)));
     }
 
     inline JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
@@ -222,14 +449,14 @@ namespace JSC {
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
     {
         if (propertyName == exec->propertyNames().length) {
-            slot.setValue(jsNumber(exec, m_value.size()));
+            slot.setValue(jsNumber(exec, m_stringLength));
             return true;
         }
 
         bool isStrictUInt32;
         unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
-        if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
-            slot.setValue(jsSingleCharacterSubstring(exec, m_value, i));
+        if (isStrictUInt32 && i < m_stringLength) {
+            slot.setValue(jsSingleCharacterSubstring(exec, value(exec), i));
             return true;
         }
 
@@ -238,8 +465,8 @@ namespace JSC {
         
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
     {
-        if (propertyName < static_cast<unsigned>(m_value.size())) {
-            slot.setValue(jsSingleCharacterSubstring(exec, m_value, propertyName));
+        if (propertyName < m_stringLength) {
+            slot.setValue(jsSingleCharacterSubstring(exec, value(exec), propertyName));
             return true;
         }
 
@@ -258,7 +485,7 @@ namespace JSC {
     inline UString JSValue::toString(ExecState* exec) const
     {
         if (isString())
-            return static_cast<JSString*>(asCell())->value();
+            return static_cast<JSString*>(asCell())->value(exec);
         if (isInt32())
             return exec->globalData().numericStrings.add(asInt32());
         if (isDouble())
diff --git a/JavaScriptCore/runtime/JSValue.h b/JavaScriptCore/runtime/JSValue.h
index 1063cdc..fa5b5c0 100644
--- a/JavaScriptCore/runtime/JSValue.h
+++ b/JavaScriptCore/runtime/JSValue.h
@@ -80,6 +80,7 @@ namespace JSC {
         enum JSUndefinedTag { JSUndefined };
         enum JSTrueTag { JSTrue };
         enum JSFalseTag { JSFalse };
+        enum EncodeAsDoubleTag { EncodeAsDouble };
 
         JSValue();
         JSValue(JSNullTag);
@@ -90,6 +91,7 @@ namespace JSC {
         JSValue(const JSCell* ptr);
 
         // Numbers
+        JSValue(EncodeAsDoubleTag, ExecState*, double);
         JSValue(ExecState*, double);
         JSValue(ExecState*, char);
         JSValue(ExecState*, unsigned char);
@@ -135,8 +137,8 @@ namespace JSC {
         bool getBoolean() const; // false if not a boolean
         bool getNumber(double&) const;
         double uncheckedGetNumber() const;
-        bool getString(UString&) const;
-        UString getString() const; // null string if not a string
+        bool getString(ExecState* exec, UString&) const;
+        UString getString(ExecState* exec) const; // null string if not a string
         JSObject* getObject() const; // 0 if not an object
 
         CallType getCallData(CallData&);
@@ -166,6 +168,10 @@ namespace JSC {
         uint32_t toUInt32(ExecState*) const;
         uint32_t toUInt32(ExecState*, bool& ok) const;
 
+#if ENABLE(JSC_ZOMBIES)
+        bool isZombie() const;
+#endif
+
         // Floating point conversions (this is a convenience method for webcore;
         // signle precision float is not a representation used in JS or JSC).
         float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
@@ -186,9 +192,9 @@ namespace JSC {
         static bool equal(ExecState* exec, JSValue v1, JSValue v2);
         static bool equalSlowCase(ExecState* exec, JSValue v1, JSValue v2);
         static bool equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
-        static bool strictEqual(JSValue v1, JSValue v2);
-        static bool strictEqualSlowCase(JSValue v1, JSValue v2);
-        static bool strictEqualSlowCaseInline(JSValue v1, JSValue v2);
+        static bool strictEqual(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqualSlowCase(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqualSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
 
         JSValue getJSNumber(); // JSValue() if this is not a JSNumber or number object
 
@@ -279,6 +285,11 @@ namespace JSC {
         return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
     }
 
+    ALWAYS_INLINE JSValue jsDoubleNumber(ExecState* exec, double d)
+    {
+        return JSValue(JSValue::EncodeAsDouble, exec, d);
+    }
+
     ALWAYS_INLINE JSValue jsNumber(ExecState* exec, double d)
     {
         return JSValue(exec, d);
@@ -431,6 +442,9 @@ namespace JSC {
     {
         JSValue v;
         v.u.asEncodedJSValue = encodedJSValue;
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
+#endif
         return v;
     }
 
@@ -477,6 +491,9 @@ namespace JSC {
         else
             u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(ptr);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
@@ -486,6 +503,9 @@ namespace JSC {
         else
             u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::operator bool() const
@@ -583,6 +603,11 @@ namespace JSC {
         return reinterpret_cast<JSCell*>(u.asBits.payload);
     }
 
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    {
+        u.asDouble = d;
+    }
+
     inline JSValue::JSValue(ExecState* exec, double d)
     {
         const int32_t asInt32 = static_cast<int32_t>(d);
@@ -781,11 +806,17 @@ namespace JSC {
     inline JSValue::JSValue(JSCell* ptr)
         : m_ptr(ptr)
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
         : m_ptr(const_cast<JSCell*>(ptr))
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::operator bool() const
diff --git a/JavaScriptCore/runtime/JSVariableObject.cpp b/JavaScriptCore/runtime/JSVariableObject.cpp
index 6586393..3aa9e62 100644
--- a/JavaScriptCore/runtime/JSVariableObject.cpp
+++ b/JavaScriptCore/runtime/JSVariableObject.cpp
@@ -53,16 +53,6 @@ void JSVariableObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& p
     JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
-bool JSVariableObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    SymbolTableEntry entry = symbolTable().get(propertyName.ustring().rep());
-    if (!entry.isNull()) {
-        attributes = entry.getAttributes() | DontDelete;
-        return true;
-    }
-    return JSObject::getPropertyAttributes(exec, propertyName, attributes);
-}
-
 bool JSVariableObject::isVariableObject() const
 {
     return true;
diff --git a/JavaScriptCore/runtime/JSVariableObject.h b/JavaScriptCore/runtime/JSVariableObject.h
index d8b1479..15d6ff5 100644
--- a/JavaScriptCore/runtime/JSVariableObject.h
+++ b/JavaScriptCore/runtime/JSVariableObject.h
@@ -54,8 +54,6 @@ namespace JSC {
         virtual bool isVariableObject() const;
         virtual bool isDynamicScope() const = 0;
 
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
-
         Register& registerAt(int index) const { return d->registers[index]; }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
diff --git a/WebKit/mac/WebCoreSupport/WebGeolocationInternal.h b/JavaScriptCore/runtime/JSZombie.cpp
index 8145d4d..072d29b 100644
--- a/WebKit/mac/WebCoreSupport/WebGeolocationInternal.h
+++ b/JavaScriptCore/runtime/JSZombie.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,16 +23,26 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import "WebGeolocationPrivate.h"
+#include "config.h"
+#include "JSZombie.h"
+#include "ClassInfo.h"
 
-namespace WebCore {
-    class Geolocation;
-}
+#if ENABLE(JSC_ZOMBIES)
+
+namespace JSC {
 
-typedef WebCore::Geolocation WebCoreGeolocation;
+const ClassInfo JSZombie::s_info = { "Zombie", 0, 0, 0 };
 
-@interface WebGeolocation (WebInternal)
+Structure* JSZombie::leakedZombieStructure() {
+    static Structure* structure = 0;
+    if (!structure) {
+        Structure::startIgnoringLeaks();
+        structure = Structure::create(jsNull(), TypeInfo(UnspecifiedType)).releaseRef();
+        Structure::stopIgnoringLeaks();
+    }
+    return structure;
+}
 
-- (id)_initWithWebCoreGeolocation:(WebCoreGeolocation *)geolocation;
+}
 
-@end
+#endif // ENABLE(JSC_ZOMBIES)
diff --git a/JavaScriptCore/runtime/JSZombie.h b/JavaScriptCore/runtime/JSZombie.h
new file mode 100644
index 0000000..8b33ea6
--- /dev/null
+++ b/JavaScriptCore/runtime/JSZombie.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSZombie_h
+#define JSZombie_h
+
+#include "JSCell.h"
+
+#if ENABLE(JSC_ZOMBIES)
+namespace JSC {
+
+class JSZombie : public JSCell {
+public:
+    JSZombie(const ClassInfo* oldInfo, Structure* structure)
+        : JSCell(structure)
+        , m_oldInfo(oldInfo)
+    {
+    }
+    virtual bool isZombie() const { return true; }
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static Structure* leakedZombieStructure();
+
+    virtual bool isGetterSetter() const { ASSERT_NOT_REACHED(); return false; }
+    virtual bool isAPIValueWrapper() const { ASSERT_NOT_REACHED(); return false; }
+    virtual bool isPropertyNameIterator() const { ASSERT_NOT_REACHED(); return false; }
+    virtual CallType getCallData(CallData&) { ASSERT_NOT_REACHED(); return CallTypeNone; }
+    virtual ConstructType getConstructData(ConstructData&) { ASSERT_NOT_REACHED(); return ConstructTypeNone; }
+    virtual bool getUInt32(uint32_t&) const { ASSERT_NOT_REACHED(); return false; }
+    virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const { ASSERT_NOT_REACHED(); return jsNull(); }
+    virtual bool getPrimitiveNumber(ExecState*, double&, JSValue&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool toBoolean(ExecState*) const { ASSERT_NOT_REACHED(); return false; }
+    virtual double toNumber(ExecState*) const { ASSERT_NOT_REACHED(); return 0.0; }
+    virtual UString toString(ExecState*) const { ASSERT_NOT_REACHED(); return ""; }
+    virtual JSObject* toObject(ExecState*) const { ASSERT_NOT_REACHED(); return 0; }
+    virtual void markChildren(MarkStack&) { ASSERT_NOT_REACHED(); }
+    virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&) { ASSERT_NOT_REACHED(); }
+    virtual void put(ExecState*, unsigned, JSValue) { ASSERT_NOT_REACHED(); }
+    virtual bool deleteProperty(ExecState*, const Identifier&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool deleteProperty(ExecState*, unsigned) { ASSERT_NOT_REACHED(); return false; }
+    virtual JSObject* toThisObject(ExecState*) const { ASSERT_NOT_REACHED(); return 0; }
+    virtual UString toThisString(ExecState*) const { ASSERT_NOT_REACHED(); return ""; }
+    virtual JSString* toThisJSString(ExecState*) { ASSERT_NOT_REACHED(); return 0; }
+    virtual JSValue getJSNumber() { ASSERT_NOT_REACHED(); return jsNull(); }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
+    
+    static const ClassInfo s_info;
+private:
+    const ClassInfo* m_oldInfo;
+};
+
+}
+
+#endif // ENABLE(JSC_ZOMBIES)
+
+#endif // JSZombie_h
diff --git a/JavaScriptCore/runtime/MarkStack.h b/JavaScriptCore/runtime/MarkStack.h
index ea09f54..a114ae0 100644
--- a/JavaScriptCore/runtime/MarkStack.h
+++ b/JavaScriptCore/runtime/MarkStack.h
@@ -153,7 +153,7 @@ namespace JSC {
                 ASSERT(0 == (size % MarkStack::pageSize()));
                 if (size == m_allocated)
                     return;
-#if PLATFORM(WIN) || PLATFORM(SYMBIAN)
+#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
                 // We cannot release a part of a region with VirtualFree.  To get around this,
                 // we'll release the entire region and reallocate the size that we want.
                 releaseStack(m_data, m_allocated);
diff --git a/JavaScriptCore/runtime/MathObject.cpp b/JavaScriptCore/runtime/MathObject.cpp
index e8b7b97..98ff3ba 100644
--- a/JavaScriptCore/runtime/MathObject.cpp
+++ b/JavaScriptCore/runtime/MathObject.cpp
@@ -96,7 +96,6 @@ MathObject::MathObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     putDirectWithoutTransition(Identifier(exec, "PI"), jsNumber(exec, piDouble), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT1_2"), jsNumber(exec, sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT2"), jsNumber(exec, sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
-    WTF::initializeWeakRandomNumberGenerator();
 }
 
 // ECMA 15.8
@@ -120,22 +119,22 @@ JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, acos(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, acos(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, asin(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, asin(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, atan(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
+    return jsDoubleNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -145,12 +144,12 @@ JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, con
 
 JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, cos(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, cos(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, exp(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, exp(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -160,7 +159,7 @@ JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, co
 
 JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, log(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, log(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -211,7 +210,7 @@ JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, WTF::weakRandomNumber());
+    return jsDoubleNumber(exec, exec->globalData().weakRandom.get());
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -224,17 +223,17 @@ JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec, JSObject*, JSValue, co
 
 JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sin(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, sin(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sqrt(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, sqrt(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, tan(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, tan(args.at(0).toNumber(exec)));
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index c655fae..403fc7e 100644
--- a/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -33,7 +33,7 @@ ASSERT_CLASS_FITS_IN_CELL(NativeErrorConstructor);
 const ClassInfo NativeErrorConstructor::info = { "Function", &InternalFunction::info, 0, 0 };
 
 NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, NativeErrorPrototype* nativeErrorPrototype)
-    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString()))
+    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString(exec)))
     , m_errorStructure(ErrorInstance::createStructure(nativeErrorPrototype))
 {
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
diff --git a/JavaScriptCore/runtime/ObjectConstructor.cpp b/JavaScriptCore/runtime/ObjectConstructor.cpp
index 837d5a6..693efc3 100644
--- a/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -148,14 +148,14 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
     JSObject* description = asObject(in);
 
-    PropertySlot enumerableSlot;
+    PropertySlot enumerableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().enumerable, enumerableSlot)) {
         desc.setEnumerable(enumerableSlot.getValue(exec, exec->propertyNames().enumerable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot configurableSlot;
+    PropertySlot configurableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().configurable, configurableSlot)) {
         desc.setConfigurable(configurableSlot.getValue(exec, exec->propertyNames().configurable).toBoolean(exec));
         if (exec->hadException())
@@ -163,21 +163,21 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
 
     JSValue value;
-    PropertySlot valueSlot;
+    PropertySlot valueSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().value, valueSlot)) {
         desc.setValue(valueSlot.getValue(exec, exec->propertyNames().value));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot writableSlot;
+    PropertySlot writableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().writable, writableSlot)) {
         desc.setWritable(writableSlot.getValue(exec, exec->propertyNames().writable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot getSlot;
+    PropertySlot getSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().get, getSlot)) {
         JSValue get = getSlot.getValue(exec, exec->propertyNames().get);
         if (exec->hadException())
@@ -193,7 +193,7 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         desc.setGetter(get);
     }
 
-    PropertySlot setSlot;
+    PropertySlot setSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().set, setSlot)) {
         JSValue set = setSlot.getValue(exec, exec->propertyNames().set);
         if (exec->hadException())
diff --git a/JavaScriptCore/runtime/Operations.cpp b/JavaScriptCore/runtime/Operations.cpp
index 093bbec..0e1887c 100644
--- a/JavaScriptCore/runtime/Operations.cpp
+++ b/JavaScriptCore/runtime/Operations.cpp
@@ -29,10 +29,6 @@
 #include <stdio.h>
 #include <wtf/MathExtras.h>
 
-#if HAVE(FLOAT_H)
-#include <float.h>
-#endif
-
 namespace JSC {
 
 bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
@@ -40,9 +36,9 @@ bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
     return equalSlowCaseInline(exec, v1, v2);
 }
 
-bool JSValue::strictEqualSlowCase(JSValue v1, JSValue v2)
+bool JSValue::strictEqualSlowCase(ExecState* exec, JSValue v1, JSValue v2)
 {
-    return strictEqualSlowCaseInline(v1, v2);
+    return strictEqualSlowCaseInline(exec, v1, v2);
 }
 
 NEVER_INLINE JSValue throwOutOfMemoryError(ExecState* exec)
@@ -58,12 +54,13 @@ NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
     JSValue p1 = v1.toPrimitive(callFrame);
     JSValue p2 = v2.toPrimitive(callFrame);
 
-    if (p1.isString() || p2.isString()) {
-        RefPtr<UString::Rep> value = concatenate(p1.toString(callFrame).rep(), p2.toString(callFrame).rep());
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
+    if (p1.isString()) {
+        return p2.isString()
+            ? jsString(callFrame, asString(p1), asString(p2))
+            : jsString(callFrame, asString(p1), p2.toString(callFrame));
     }
+    if (p2.isString())
+        return jsString(callFrame, p1.toString(callFrame), asString(p2));
 
     return jsNumber(callFrame, p1.toNumber(callFrame) + p2.toNumber(callFrame));
 }
diff --git a/JavaScriptCore/runtime/Operations.h b/JavaScriptCore/runtime/Operations.h
index 1aa68b3..0289ac2 100644
--- a/JavaScriptCore/runtime/Operations.h
+++ b/JavaScriptCore/runtime/Operations.h
@@ -35,6 +35,99 @@ namespace JSC {
     bool jsIsObjectType(JSValue);
     bool jsIsFunctionType(JSValue);
 
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)
+    {
+        if (!s1->length())
+            return s2;
+        if (!s2->length())
+            return s1;
+
+        unsigned ropeLength = s1->ropeLength() + s2->ropeLength();
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (ropeLength <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, ropeLength, s1, s2);
+
+        unsigned index = 0;
+        RefPtr<JSString::Rope> rope = JSString::Rope::createOrNull(ropeLength);
+        if (UNLIKELY(!rope))
+            return throwOutOfMemoryError(exec);
+        rope->append(index, s1);
+        rope->append(index, s2);
+        ASSERT(index == ropeLength);
+        return new (globalData) JSString(globalData, rope.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, const UString& u1, JSString* s2)
+    {
+        unsigned ropeLength = 1 + s2->ropeLength();
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (ropeLength <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, ropeLength, u1, s2);
+
+        unsigned index = 0;
+        RefPtr<JSString::Rope> rope = JSString::Rope::createOrNull(ropeLength);
+        if (UNLIKELY(!rope))
+            return throwOutOfMemoryError(exec);
+        rope->append(index, u1);
+        rope->append(index, s2);
+        ASSERT(index == ropeLength);
+        return new (globalData) JSString(globalData, rope.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, const UString& u2)
+    {
+        unsigned ropeLength = s1->ropeLength() + 1;
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (ropeLength <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, ropeLength, s1, u2);
+
+        unsigned index = 0;
+        RefPtr<JSString::Rope> rope = JSString::Rope::createOrNull(ropeLength);
+        if (UNLIKELY(!rope))
+            return throwOutOfMemoryError(exec);
+        rope->append(index, s1);
+        rope->append(index, u2);
+        ASSERT(index == ropeLength);
+        return new (globalData) JSString(globalData, rope.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, Register* strings, unsigned count)
+    {
+        ASSERT(count >= 3);
+
+        unsigned ropeLength = 0;
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                ropeLength += asString(v)->ropeLength();
+            else
+                ++ropeLength;
+        }
+
+        JSGlobalData* globalData = &exec->globalData();
+        if (ropeLength == 3)
+            return new (globalData) JSString(exec, strings[0].jsValue(), strings[1].jsValue(), strings[2].jsValue());
+
+        RefPtr<JSString::Rope> rope = JSString::Rope::createOrNull(ropeLength);
+        if (UNLIKELY(!rope))
+            return throwOutOfMemoryError(exec);
+
+        unsigned index = 0;
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                rope->append(index, asString(v));
+            else
+                rope->append(index, v.toString(exec));
+        }
+
+        ASSERT(index == ropeLength);
+        return new (globalData) JSString(globalData, rope.release());
+    }
+
     // ECMA 11.9.3
     inline bool JSValue::equal(ExecState* exec, JSValue v1, JSValue v2)
     {
@@ -53,7 +146,7 @@ namespace JSC {
             bool s1 = v1.isString();
             bool s2 = v2.isString();
             if (s1 && s2)
-                return asString(v1)->value() == asString(v2)->value();
+                return asString(v1)->value(exec) == asString(v2)->value(exec);
 
             if (v1.isUndefinedOrNull()) {
                 if (v2.isUndefinedOrNull())
@@ -110,17 +203,17 @@ namespace JSC {
     }
 
     // ECMA 11.9.3
-    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(JSValue v1, JSValue v2)
+    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
     {
         ASSERT(v1.isCell() && v2.isCell());
 
         if (v1.asCell()->isString() && v2.asCell()->isString())
-            return asString(v1)->value() == asString(v2)->value();
+            return asString(v1)->value(exec) == asString(v2)->value(exec);
 
         return v1 == v2;
     }
 
-    inline bool JSValue::strictEqual(JSValue v1, JSValue v2)
+    inline bool JSValue::strictEqual(ExecState* exec, JSValue v1, JSValue v2)
     {
         if (v1.isInt32() && v2.isInt32())
             return v1 == v2;
@@ -131,7 +224,7 @@ namespace JSC {
         if (!v1.isCell() || !v2.isCell())
             return v1 == v2;
 
-        return strictEqualSlowCaseInline(v1, v2);
+        return strictEqualSlowCaseInline(exec, v1, v2);
     }
 
     inline bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
@@ -146,7 +239,7 @@ namespace JSC {
 
         JSGlobalData* globalData = &callFrame->globalData();
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
-            return asString(v1)->value() < asString(v2)->value();
+            return asString(v1)->value(callFrame) < asString(v2)->value(callFrame);
 
         JSValue p1;
         JSValue p2;
@@ -156,7 +249,7 @@ namespace JSC {
         if (wasNotString1 | wasNotString2)
             return n1 < n2;
 
-        return asString(p1)->value() < asString(p2)->value();
+        return asString(p1)->value(callFrame) < asString(p2)->value(callFrame);
     }
 
     inline bool jsLessEq(CallFrame* callFrame, JSValue v1, JSValue v2)
@@ -171,7 +264,7 @@ namespace JSC {
 
         JSGlobalData* globalData = &callFrame->globalData();
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
-            return !(asString(v2)->value() < asString(v1)->value());
+            return !(asString(v2)->value(callFrame) < asString(v1)->value(callFrame));
 
         JSValue p1;
         JSValue p2;
@@ -181,7 +274,7 @@ namespace JSC {
         if (wasNotString1 | wasNotString2)
             return n1 <= n2;
 
-        return !(asString(p2)->value() < asString(p1)->value());
+        return !(asString(p2)->value(callFrame) < asString(p1)->value(callFrame));
     }
 
     // Fast-path choices here are based on frequency data from SunSpider:
@@ -195,29 +288,14 @@ namespace JSC {
 
     ALWAYS_INLINE JSValue jsAdd(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
-        double left;
-        double right = 0.0;
-
-        bool rightIsNumber = v2.getNumber(right);
-        if (rightIsNumber && v1.getNumber(left))
+        double left = 0.0, right;
+        if (v1.getNumber(left), v2.getNumber(right))
             return jsNumber(callFrame, left + right);
         
-        bool leftIsString = v1.isString();
-        if (leftIsString && v2.isString()) {
-            RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-            if (!value)
-                return throwOutOfMemoryError(callFrame);
-            return jsString(callFrame, value.release());
-        }
-
-        if (rightIsNumber & leftIsString) {
-            RefPtr<UString::Rep> value = v2.isInt32() ?
-                concatenate(asString(v1)->value().rep(), v2.asInt32()) :
-                concatenate(asString(v1)->value().rep(), right);
-
-            if (!value)
-                return throwOutOfMemoryError(callFrame);
-            return jsString(callFrame, value.release());
+        if (v1.isString()) {
+            return v2.isString()
+                ? jsString(callFrame, asString(v1), asString(v2))
+                : jsString(callFrame, asString(v1), v2.toString(callFrame));
         }
 
         // All other cases are pretty uncommon
@@ -243,7 +321,7 @@ namespace JSC {
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
             if (cell->structure()->isDictionary())
-                asObject(cell)->setStructure(Structure::fromDictionaryTransition(cell->structure()));
+                asObject(cell)->flattenDictionaryObject();
 
             ++count;
         }
@@ -265,7 +343,7 @@ namespace JSC {
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
             if (base->structure()->isDictionary())
-                asObject(base)->setStructure(Structure::fromDictionaryTransition(base->structure()));
+                asObject(base)->flattenDictionaryObject();
 
             ++count;
         }
@@ -293,52 +371,6 @@ namespace JSC {
         ASSERT_NOT_REACHED();
         return JSValue();
     }
-
-    ALWAYS_INLINE JSValue concatenateStrings(CallFrame* callFrame, Register* strings, unsigned count)
-    {
-        ASSERT(count >= 3);
-
-        // Estimate the amount of space required to hold the entire string.  If all
-        // arguments are strings, we can easily calculate the exact amount of space
-        // required.  For any other arguments, for now let's assume they may require
-        // 11 UChars of storage.  This is enouch to hold any int, and likely is also
-        // reasonable for the other immediates.  We may want to come back and tune
-        // this value at some point.
-        unsigned bufferSize = 0;
-        for (unsigned i = 0; i < count; ++i) {
-            JSValue v = strings[i].jsValue();
-            if (LIKELY(v.isString()))
-                bufferSize += asString(v)->value().size();
-            else
-                bufferSize += 11;
-        }
-
-        // Allocate an output string to store the result.
-        // If the first argument is a String, and if it has the capacity (or can grow
-        // its capacity) to hold the entire result then use this as a base to concatenate
-        // onto.  Otherwise, allocate a new empty output buffer.
-        JSValue firstValue = strings[0].jsValue();
-        RefPtr<UString::Rep> resultRep;
-        if (firstValue.isString() && (resultRep = asString(firstValue)->value().rep())->reserveCapacity(bufferSize)) {
-            // We're going to concatenate onto the first string - remove it from the list of items to be appended.
-            ++strings;
-            --count;
-        } else
-            resultRep = UString::Rep::createEmptyBuffer(bufferSize);
-        UString result(resultRep);
-
-        // Loop over the operands, writing them into the output buffer.
-        for (unsigned i = 0; i < count; ++i) {
-            JSValue v = strings[i].jsValue();
-            if (LIKELY(v.isString()))
-                result.append(asString(v)->value());
-            else
-                result.append(v.toString(callFrame));
-        }
-
-        return jsString(callFrame, result);
-    }
-
 } // namespace JSC
 
 #endif // Operations_h
diff --git a/JavaScriptCore/runtime/PropertyDescriptor.cpp b/JavaScriptCore/runtime/PropertyDescriptor.cpp
index 4db814f..558ae28 100644
--- a/JavaScriptCore/runtime/PropertyDescriptor.cpp
+++ b/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -153,15 +153,15 @@ void PropertyDescriptor::setGetter(JSValue getter)
     m_attributes &= ~ReadOnly;
 }
 
-bool PropertyDescriptor::equalTo(const PropertyDescriptor& other) const
+bool PropertyDescriptor::equalTo(ExecState* exec, const PropertyDescriptor& other) const
 {
     if (!other.m_value == m_value ||
         !other.m_getter == m_getter ||
         !other.m_setter == m_setter)
         return false;
-    return (!m_value || JSValue::strictEqual(other.m_value, m_value)) && 
-           (!m_getter || JSValue::strictEqual(other.m_getter, m_getter)) && 
-           (!m_setter || JSValue::strictEqual(other.m_setter, m_setter)) &&
+    return (!m_value || JSValue::strictEqual(exec, other.m_value, m_value)) && 
+           (!m_getter || JSValue::strictEqual(exec, other.m_getter, m_getter)) && 
+           (!m_setter || JSValue::strictEqual(exec, other.m_setter, m_setter)) &&
            attributesEqual(other);
 }
 
diff --git a/JavaScriptCore/runtime/PropertyDescriptor.h b/JavaScriptCore/runtime/PropertyDescriptor.h
index 40bec86..ff9f160 100644
--- a/JavaScriptCore/runtime/PropertyDescriptor.h
+++ b/JavaScriptCore/runtime/PropertyDescriptor.h
@@ -61,7 +61,7 @@ namespace JSC {
         bool configurablePresent() const { return m_seenAttributes & ConfigurablePresent; }
         bool setterPresent() const { return m_setter; }
         bool getterPresent() const { return m_getter; }
-        bool equalTo(const PropertyDescriptor& other) const;
+        bool equalTo(ExecState* exec, const PropertyDescriptor& other) const;
         bool attributesEqual(const PropertyDescriptor& other) const;
         unsigned attributesWithOverride(const PropertyDescriptor& other) const;
     private:
diff --git a/JavaScriptCore/runtime/RegExpConstructor.cpp b/JavaScriptCore/runtime/RegExpConstructor.cpp
index c609e08..e5c6909 100644
--- a/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -132,6 +132,8 @@ void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
         int start = d->lastOvector()[2 * i];
         if (start >= 0)
             JSArray::put(exec, i, jsSubstring(exec, d->lastInput, start, d->lastOvector()[2 * i + 1] - start));
+        else
+            JSArray::put(exec, i, jsUndefined());
     }
 
     PutPropertySlot slot;
diff --git a/JavaScriptCore/runtime/StringObject.cpp b/JavaScriptCore/runtime/StringObject.cpp
index 7216d3a..f23a20d 100644
--- a/JavaScriptCore/runtime/StringObject.cpp
+++ b/JavaScriptCore/runtime/StringObject.cpp
@@ -79,12 +79,16 @@ bool StringObject::deleteProperty(ExecState* exec, const Identifier& propertyNam
 {
     if (propertyName == exec->propertyNames().length)
         return false;
+    bool isStrictUInt32;
+    unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
+    if (isStrictUInt32 && internalValue()->canGetIndex(i))
+        return false;
     return JSObject::deleteProperty(exec, propertyName);
 }
 
 void StringObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    int size = internalValue()->value().size();
+    int size = internalValue()->length();
     for (int i = 0; i < size; ++i)
         propertyNames.add(Identifier(exec, UString::from(i)));
     return JSObject::getOwnPropertyNames(exec, propertyNames);
diff --git a/JavaScriptCore/runtime/StringPrototype.cpp b/JavaScriptCore/runtime/StringPrototype.cpp
index a0713b8..32f9e6b 100644
--- a/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/JavaScriptCore/runtime/StringPrototype.cpp
@@ -224,7 +224,7 @@ static inline int localeCompare(const UString& a, const UString& b)
 JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSString* sourceVal = thisValue.toThisJSString(exec);
-    const UString& source = sourceVal->value();
+    const UString& source = sourceVal->value(exec);
 
     JSValue pattern = args.at(0);
 
@@ -281,7 +281,8 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 cachedCall.setArgument(i++, sourceVal);
                 
                 cachedCall.setThis(exec->globalThisValue());
-                replacements.append(cachedCall.call().toString(cachedCall.newCallFrame()));
+                JSValue result = cachedCall.call();
+                replacements.append(result.toString(cachedCall.newCallFrame(exec)));
                 if (exec->hadException())
                     break;
 
@@ -469,6 +470,11 @@ JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSV
         dpos = 0;
     else if (!(dpos <= len)) // true for NaN
         dpos = len;
+#if PLATFORM(SYMBIAN)
+    // Work around for broken NaN compare operator
+    else if (isnan(dpos))
+        dpos = len;
+#endif
     return jsNumber(exec, s.rfind(u2, static_cast<int>(dpos)));
 }
 
@@ -691,7 +697,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec, JSObject*, JSVal
 JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
-    const UString& s = sVal->value();
+    const UString& s = sVal->value(exec);
 
     int sSize = s.size();
     if (!sSize)
@@ -725,7 +731,7 @@ JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSV
 JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
-    const UString& s = sVal->value();
+    const UString& s = sVal->value(exec);
 
     int sSize = s.size();
     if (!sSize)
diff --git a/JavaScriptCore/runtime/Structure.cpp b/JavaScriptCore/runtime/Structure.cpp
index 65b62f9..e4c9ac3 100644
--- a/JavaScriptCore/runtime/Structure.cpp
+++ b/JavaScriptCore/runtime/Structure.cpp
@@ -77,6 +77,8 @@ static HashSet<Structure*>& ignoreSet = *(new HashSet<Structure*>);
 static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
 #endif
 
+static int comparePropertyMapEntryIndices(const void* a, const void* b);
+
 void Structure::dumpStatistics()
 {
 #if DUMP_STRUCTURE_ID_STATISTICS
@@ -534,20 +536,47 @@ PassRefPtr<Structure> Structure::toUncacheableDictionaryTransition(Structure* st
     return toDictionaryTransition(structure, UncachedDictionaryKind);
 }
 
-PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
+PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSObject* object)
 {
-    ASSERT(structure->isDictionary());
-
-    // Since dictionary Structures are not shared, and no opcodes specialize
-    // for them, we don't need to allocate a new Structure when transitioning
-    // to non-dictionary status.
-
-    // FIMXE: We can make this more efficient by canonicalizing the Structure (draining the
-    // deleted offsets vector) before transitioning from dictionary. 
-    if (!structure->m_propertyTable || !structure->m_propertyTable->deletedOffsets || structure->m_propertyTable->deletedOffsets->isEmpty())
-        structure->m_dictionaryKind = NoneDictionaryKind;
+    ASSERT(isDictionary());
+    if (isUncacheableDictionary()) {
+        ASSERT(m_propertyTable);
+        Vector<PropertyMapEntry*> sortedPropertyEntries(m_propertyTable->keyCount);
+        PropertyMapEntry** p = sortedPropertyEntries.data();
+        unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
+        for (unsigned i = 1; i <= entryCount; i++) {
+            if (m_propertyTable->entries()[i].key)
+                *p++ = &m_propertyTable->entries()[i];
+        }
+        size_t propertyCount = p - sortedPropertyEntries.data();
+        qsort(sortedPropertyEntries.data(), propertyCount, sizeof(PropertyMapEntry*), comparePropertyMapEntryIndices);
+        sortedPropertyEntries.resize(propertyCount);
+
+        // We now have the properties currently defined on this object
+        // in the order that they are expected to be in, but we need to
+        // reorder the storage, so we have to copy the current values out
+        Vector<JSValue> values(propertyCount);
+        unsigned anonymousSlotCount = m_propertyTable->anonymousSlotCount;
+        for (unsigned i = 0; i < propertyCount; i++) {
+            PropertyMapEntry* entry = sortedPropertyEntries[i];
+            values[i] = object->getDirectOffset(entry->offset);
+            // Update property table to have the new property offsets
+            entry->offset = anonymousSlotCount + i;
+            entry->index = i;
+        }
+        
+        // Copy the original property values into their final locations
+        for (unsigned i = 0; i < propertyCount; i++)
+            object->putDirectOffset(anonymousSlotCount + i, values[i]);
+
+        if (m_propertyTable->deletedOffsets) {
+            delete m_propertyTable->deletedOffsets;
+            m_propertyTable->deletedOffsets = 0;
+        }
+    }
 
-    return structure;
+    m_dictionaryKind = NoneDictionaryKind;
+    return this;
 }
 
 size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
@@ -556,8 +585,6 @@ size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, u
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
-    if (attributes & DontEnum)
-        m_hasNonEnumerableProperties = true;
 
     size_t offset = put(propertyName, attributes, specificValue);
     if (propertyStorageSize() > propertyStorageCapacity())
@@ -739,6 +766,9 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
 
     checkConsistency();
 
+    if (attributes & DontEnum)
+        m_hasNonEnumerableProperties = true;
+
     UString::Rep* rep = propertyName._ustring.rep();
 
     if (!m_propertyTable)
@@ -1003,7 +1033,7 @@ void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
     checkConsistency();
 }
 
-static int comparePropertyMapEntryIndices(const void* a, const void* b)
+int comparePropertyMapEntryIndices(const void* a, const void* b)
 {
     unsigned ia = static_cast<PropertyMapEntry* const*>(a)[0]->index;
     unsigned ib = static_cast<PropertyMapEntry* const*>(b)[0]->index;
@@ -1025,6 +1055,7 @@ void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
         int i = 0;
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
         for (unsigned k = 1; k <= entryCount; k++) {
+            ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[k].attributes & DontEnum));
             if (m_propertyTable->entries()[k].key && !(m_propertyTable->entries()[k].attributes & DontEnum)) {
                 PropertyMapEntry* value = &m_propertyTable->entries()[k];
                 int j;
@@ -1112,6 +1143,7 @@ void Structure::checkConsistency()
 
     unsigned nonEmptyEntryCount = 0;
     for (unsigned c = 1; c <= m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount; ++c) {
+        ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[c].attributes & DontEnum));
         UString::Rep* rep = m_propertyTable->entries()[c].key;
         if (!rep)
             continue;
diff --git a/JavaScriptCore/runtime/Structure.h b/JavaScriptCore/runtime/Structure.h
index f355c53..c6b7d91 100644
--- a/JavaScriptCore/runtime/Structure.h
+++ b/JavaScriptCore/runtime/Structure.h
@@ -74,7 +74,8 @@ namespace JSC {
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
         static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
         static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
-        static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
+
+        PassRefPtr<Structure> flattenDictionaryStructure(JSObject*);
 
         ~Structure();
 
@@ -306,7 +307,7 @@ namespace JSC {
         TransitionTable* transitionTable = new TransitionTable;
         setTransitionTable(transitionTable);
         if (existingTransition)
-            add(make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
+            add(std::make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
     }
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/UString.cpp b/JavaScriptCore/runtime/UString.cpp
index e66ca93..50d23c4 100644
--- a/JavaScriptCore/runtime/UString.cpp
+++ b/JavaScriptCore/runtime/UString.cpp
@@ -30,12 +30,12 @@
 #include "Identifier.h"
 #include "Operations.h"
 #include <ctype.h>
-#include <float.h>
 #include <limits.h>
 #include <limits>
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
@@ -44,9 +44,6 @@
 #include <wtf/unicode/UTF8.h>
 #include <wtf/StringExtras.h>
 
-#if HAVE(STRING_H)
-#include <string.h>
-#endif
 #if HAVE(STRINGS_H)
 #include <strings.h>
 #endif
@@ -578,11 +575,33 @@ static PassRefPtr<UString::Rep> createRep(const char* c)
 
 }
 
+static inline PassRefPtr<UString::Rep> createRep(const char* c, int length)
+{
+    if (!c)
+        return &UString::Rep::null();
+
+    if (!length)
+        return &UString::Rep::empty();
+
+    UChar* d;
+    if (!allocChars(length).getValue(d))
+        return &UString::Rep::null();
+
+    for (int i = 0; i < length; i++)
+        d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
+    return UString::Rep::create(d, length);
+}
+
 UString::UString(const char* c)
     : m_rep(createRep(c))
 {
 }
 
+UString::UString(const char* c, int length)
+    : m_rep(createRep(c, length))
+{
+}
+
 UString::UString(const UChar* c, int length)
 {
     if (length == 0) 
@@ -1025,69 +1044,10 @@ UString UString::from(long l)
 
 UString UString::from(double d)
 {
-    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
-    if (isnan(d))
-        return "NaN";
-    if (!d)
-        return "0"; // -0 -> "0"
-
-    char buf[80];
-    int decimalPoint;
-    int sign;
-    
-    char result[80];
-    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
-    int length = static_cast<int>(strlen(result));
-  
-    int i = 0;
-    if (sign)
-        buf[i++] = '-';
-  
-    if (decimalPoint <= 0 && decimalPoint > -6) {
-        buf[i++] = '0';
-        buf[i++] = '.';
-        for (int j = decimalPoint; j < 0; j++)
-            buf[i++] = '0';
-        strcpy(buf + i, result);
-    } else if (decimalPoint <= 21 && decimalPoint > 0) {
-        if (length <= decimalPoint) {
-            strcpy(buf + i, result);
-            i += length;
-            for (int j = 0; j < decimalPoint - length; j++)
-                buf[i++] = '0';
-            buf[i] = '\0';
-        } else {
-            strncpy(buf + i, result, decimalPoint);
-            i += decimalPoint;
-            buf[i++] = '.';
-            strcpy(buf + i, result + decimalPoint);
-        }
-    } else if (result[0] < '0' || result[0] > '9')
-        strcpy(buf + i, result);
-    else {
-        buf[i++] = result[0];
-        if (length > 1) {
-            buf[i++] = '.';
-            strcpy(buf + i, result + 1);
-            i += length - 1;
-        }
-        
-        buf[i++] = 'e';
-        buf[i++] = (decimalPoint >= 0) ? '+' : '-';
-        // decimalPoint can't be more than 3 digits decimal given the
-        // nature of float representation
-        int exponential = decimalPoint - 1;
-        if (exponential < 0)
-            exponential = -exponential;
-        if (exponential >= 100)
-            buf[i++] = static_cast<char>('0' + exponential / 100);
-        if (exponential >= 10)
-            buf[i++] = static_cast<char>('0' + (exponential % 100) / 10);
-        buf[i++] = static_cast<char>('0' + exponential % 10);
-        buf[i++] = '\0';
-    }
-    
-    return UString(buf);
+    DtoaBuffer buffer;
+    unsigned length;
+    doubleToStringInJavaScriptFormat(d, buffer, &length);
+    return UString(buffer, length);
 }
 
 UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const
diff --git a/JavaScriptCore/runtime/UString.h b/JavaScriptCore/runtime/UString.h
index c4dad2a..9b046f2 100644
--- a/JavaScriptCore/runtime/UString.h
+++ b/JavaScriptCore/runtime/UString.h
@@ -235,7 +235,10 @@ namespace JSC {
 
     public:
         UString();
+        // Constructor for null-terminated ASCII string.
         UString(const char*);
+        // Constructor for non-null-terminated ASCII string.
+        UString(const char*, int length);
         UString(const UChar*, int length);
         UString(UChar*, int length, bool copy);
 
diff --git a/JavaScriptCore/runtime/WeakRandom.h b/JavaScriptCore/runtime/WeakRandom.h
new file mode 100644
index 0000000..ff3995e
--- /dev/null
+++ b/JavaScriptCore/runtime/WeakRandom.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ *
+ * Copyright (c) 2009 Ian C. Bullard
+ * 
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ * 
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef WeakRandom_h
+#define WeakRandom_h
+
+#include <limits.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class WeakRandom {
+public:
+    WeakRandom(unsigned seed)
+        : m_low(seed ^ 0x49616E42)
+        , m_high(seed)
+    {
+    }
+
+    double get()
+    {
+        return advance() / (UINT_MAX + 1.0);
+    }
+
+private:
+    unsigned advance()
+    {
+        m_high = (m_high << 16) + (m_high >> 16);
+        m_high += m_low;
+        m_low += m_high;
+        return m_high;
+    }
+
+    unsigned m_low;
+    unsigned m_high;
+};
+
+} // namespace JSC
+
+#endif // WeakRandom_h
diff --git a/JavaScriptCore/wscript b/JavaScriptCore/wscript
index 7a5ba1b..356950f 100644
--- a/JavaScriptCore/wscript
+++ b/JavaScriptCore/wscript
@@ -29,7 +29,7 @@ import commands
 
 from settings import *
 
-jscore_excludes = ['jsc.cpp', 'ucptable.cpp', 'GOwnPtr.cpp']
+jscore_excludes = ['jsc.cpp', 'ucptable.cpp']
 jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp', '*Symbian.cpp']))
 
 sources = []
diff --git a/JavaScriptCore/wtf/CurrentTime.h b/JavaScriptCore/wtf/CurrentTime.h
index 31f1ec8..472770e 100644
--- a/JavaScriptCore/wtf/CurrentTime.h
+++ b/JavaScriptCore/wtf/CurrentTime.h
@@ -32,13 +32,32 @@
 #ifndef CurrentTime_h
 #define CurrentTime_h
 
+#include <time.h>
+
 namespace WTF {
 
-    // Returns the current system (UTC) time in seconds, starting January 1, 1970.
-    // Precision varies depending on a platform but usually is as good or better 
+    // Returns the current UTC time in seconds, counted from January 1, 1970.
+    // Precision varies depending on platform but is usually as good or better 
     // than a millisecond.
     double currentTime();
 
+    // Same thing, in milliseconds.
+    inline double currentTimeMS()
+    {
+        return currentTime() * 1000.0; 
+    }
+
+    inline void getLocalTime(const time_t* localTime, struct tm* localTM)
+    {
+    #if COMPILER(MSVC7) || COMPILER(MINGW) || PLATFORM(WINCE)
+        *localTM = *localtime(localTime);
+    #elif COMPILER(MSVC)
+        localtime_s(localTM, localTime);
+    #else
+        localtime_r(localTime, localTM);
+    #endif
+    }
+
 } // namespace WTF
 
 using WTF::currentTime;
diff --git a/JavaScriptCore/wtf/DateMath.cpp b/JavaScriptCore/wtf/DateMath.cpp
index 2110432..187fa63 100644
--- a/JavaScriptCore/wtf/DateMath.cpp
+++ b/JavaScriptCore/wtf/DateMath.cpp
@@ -39,6 +39,33 @@
  * other provisions required by the MPL or the GPL, as the case may be.
  * If you do not delete the provisions above, a recipient may use your
  * version of this file under any of the LGPL, the MPL or the GPL.
+
+ * Copyright 2006-2008 the V8 project authors. All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -61,10 +88,6 @@
 #include <errno.h>
 #endif
 
-#if PLATFORM(DARWIN)
-#include <notify.h>
-#endif
-
 #if PLATFORM(WINCE)
 extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t);
 extern "C" struct tm * localtime(const time_t *timer);
@@ -78,8 +101,14 @@ extern "C" struct tm * localtime(const time_t *timer);
 #include <sys/timeb.h>
 #endif
 
+#if USE(JSC)
+#include "CallFrame.h"
+#endif
+
 #define NaN std::numeric_limits<double>::quiet_NaN()
 
+using namespace WTF;
+
 namespace WTF {
 
 /* Constants */
@@ -293,28 +322,6 @@ static int dateToDayInYear(int year, int month, int day)
     return yearday + monthday + day - 1;
 }
 
-double getCurrentUTCTime()
-{
-    return floor(getCurrentUTCTimeWithMicroseconds());
-}
-
-// Returns current time in milliseconds since 1 Jan 1970.
-double getCurrentUTCTimeWithMicroseconds()
-{
-    return currentTime() * 1000.0; 
-}
-
-void getLocalTime(const time_t* localTime, struct tm* localTM)
-{
-#if COMPILER(MSVC7) || COMPILER(MINGW) || PLATFORM(WINCE)
-    *localTM = *localtime(localTime);
-#elif COMPILER(MSVC)
-    localtime_s(localTM, localTime);
-#else
-    localtime_r(localTime, localTM);
-#endif
-}
-
 // There is a hard limit at 2038 that we currently do not have a workaround
 // for (rdar://problem/5052975).
 static inline int maximumYearForDST()
@@ -328,7 +335,7 @@ static inline int minimumYearForDST()
     // greater than the max year minus 27 (2010), we want to use the max year
     // minus 27 instead, to ensure there is a range of 28 years that all years
     // can map to.
-    return std::min(msToYear(getCurrentUTCTime()), maximumYearForDST() - 27) ;
+    return std::min(msToYear(jsCurrentTime()), maximumYearForDST() - 27) ;
 }
 
 /*
@@ -399,44 +406,10 @@ static int32_t calculateUTCOffset()
     return static_cast<int32_t>(utcOffset * 1000);
 }
 
-#if PLATFORM(DARWIN)
-static int32_t s_cachedUTCOffset; // In milliseconds. An assumption here is that access to an int32_t variable is atomic on platforms that take this code path.
-static bool s_haveCachedUTCOffset;
-static int s_notificationToken;
-#endif
-
-/*
- * Get the difference in milliseconds between this time zone and UTC (GMT)
- * NOT including DST.
- */
-double getUTCOffset()
-{
-#if PLATFORM(DARWIN)
-    if (s_haveCachedUTCOffset) {
-        int notified;
-        uint32_t status = notify_check(s_notificationToken, &notified);
-        if (status == NOTIFY_STATUS_OK && !notified)
-            return s_cachedUTCOffset;
-    }
-#endif
-
-    int32_t utcOffset = calculateUTCOffset();
-
-#if PLATFORM(DARWIN)
-    // Theoretically, it is possible that several threads will be executing this code at once, in which case we will have a race condition,
-    // and a newer value may be overwritten. In practice, time zones don't change that often.
-    s_cachedUTCOffset = utcOffset;
-#endif
-
-    return utcOffset;
-}
-
 /*
- * Get the DST offset for the time passed in.  Takes
- * seconds (not milliseconds) and cannot handle dates before 1970
- * on some OS'
+ * Get the DST offset for the time passed in.
  */
-static double getDSTOffsetSimple(double localTimeSeconds, double utcOffset)
+static double calculateDSTOffsetSimple(double localTimeSeconds, double utcOffset)
 {
     if (localTimeSeconds > maxUnixTime)
         localTimeSeconds = maxUnixTime;
@@ -465,9 +438,9 @@ static double getDSTOffsetSimple(double localTimeSeconds, double utcOffset)
 }
 
 // Get the DST offset, given a time in UTC
-static double getDSTOffset(double ms, double utcOffset)
+static double calculateDSTOffset(double ms, double utcOffset)
 {
-    // On Mac OS X, the call to localtime (see getDSTOffsetSimple) will return historically accurate
+    // On Mac OS X, the call to localtime (see calculateDSTOffsetSimple) will return historically accurate
     // DST information (e.g. New Zealand did not have DST from 1946 to 1974) however the JavaScript
     // standard explicitly dictates that historical information should not be considered when
     // determining DST. For this reason we shift away from years that localtime can handle but would
@@ -483,65 +456,18 @@ static double getDSTOffset(double ms, double utcOffset)
         ms = (day * msPerDay) + msToMilliseconds(ms);
     }
 
-    return getDSTOffsetSimple(ms / msPerSecond, utcOffset);
-}
-
-double gregorianDateTimeToMS(const GregorianDateTime& t, double milliSeconds, bool inputIsUTC)
-{
-    int day = dateToDayInYear(t.year + 1900, t.month, t.monthDay);
-    double ms = timeToMS(t.hour, t.minute, t.second, milliSeconds);
-    double result = (day * msPerDay) + ms;
-
-    if (!inputIsUTC) { // convert to UTC
-        double utcOffset = getUTCOffset();
-        result -= utcOffset;
-        result -= getDSTOffset(result, utcOffset);
-    }
-
-    return result;
-}
-
-// input is UTC
-void msToGregorianDateTime(double ms, bool outputIsUTC, GregorianDateTime& tm)
-{
-    double dstOff = 0.0;
-    double utcOff = 0.0;
-    if (!outputIsUTC) {
-        utcOff = getUTCOffset();
-        dstOff = getDSTOffset(ms, utcOff);
-        ms += dstOff + utcOff;
-    }
-
-    const int year = msToYear(ms);
-    tm.second   =  msToSeconds(ms);
-    tm.minute   =  msToMinutes(ms);
-    tm.hour     =  msToHours(ms);
-    tm.weekDay  =  msToWeekDay(ms);
-    tm.yearDay  =  dayInYear(ms, year);
-    tm.monthDay =  dayInMonthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.year     =  year - 1900;
-    tm.isDST    =  dstOff != 0.0;
-    tm.utcOffset = static_cast<long>((dstOff + utcOff) / msPerSecond);
-    tm.timeZone = NULL;
+    return calculateDSTOffsetSimple(ms / msPerSecond, utcOffset);
 }
 
 void initializeDates()
 {
 #ifndef NDEBUG
     static bool alreadyInitialized;
-    ASSERT(!alreadyInitialized++);
+    ASSERT(!alreadyInitialized);
+    alreadyInitialized = true;
 #endif
 
     equivalentYearForDST(2000); // Need to call once to initialize a static used in this function.
-#if PLATFORM(DARWIN)
-    // Register for a notification whenever the time zone changes.
-    uint32_t status = notify_register_check("com.apple.system.timezone", &s_notificationToken);
-    if (status == NOTIFY_STATUS_OK) {
-        s_cachedUTCOffset = calculateUTCOffset();
-        s_haveCachedUTCOffset = true;
-    }
-#endif
 }
 
 static inline double ymdhmsToSeconds(long year, int mon, int day, int hour, int minute, int second)
@@ -622,8 +548,12 @@ static bool parseLong(const char* string, char** stopPosition, int base, long* r
     return true;
 }
 
-double parseDateFromNullTerminatedCharacters(const char* dateString)
+// Odd case where 'exec' is allowed to be 0, to accomodate a caller in WebCore.
+static double parseDateFromNullTerminatedCharacters(const char* dateString, bool& haveTZ, int& offset)
 {
+    haveTZ = false;
+    offset = 0;
+
     // This parses a date in the form:
     //     Tuesday, 09-Nov-99 23:12:40 GMT
     // or
@@ -824,9 +754,6 @@ double parseDateFromNullTerminatedCharacters(const char* dateString)
         }
     }
 
-    bool haveTZ = false;
-    int offset = 0;
-
     // Don't fail if the time zone is missing. 
     // Some websites omit the time zone (4275206).
     if (*dateString) {
@@ -889,23 +816,25 @@ double parseDateFromNullTerminatedCharacters(const char* dateString)
         else
             year += 1900;
     }
+    
+    return ymdhmsToSeconds(year, month + 1, day, hour, minute, second) * msPerSecond;
+}
+
+double parseDateFromNullTerminatedCharacters(const char* dateString)
+{
+    bool haveTZ;
+    int offset;
+    double ms = parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
+    if (isnan(ms))
+        return NaN;
 
     // fall back to local timezone
     if (!haveTZ) {
-        GregorianDateTime t;
-        t.monthDay = day;
-        t.month = month;
-        t.year = year - 1900;
-        t.isDST = -1;
-        t.second = second;
-        t.minute = minute;
-        t.hour = hour;
-
-        // Use our gregorianDateTimeToMS() rather than mktime() as the latter can't handle the full year range.
-        return gregorianDateTimeToMS(t, 0, false);
+        double utcOffset = calculateUTCOffset();
+        double dstOffset = calculateDSTOffset(ms, utcOffset);
+        offset = static_cast<int>((utcOffset + dstOffset) / msPerMinute);
     }
-
-    return (ymdhmsToSeconds(year, month + 1, day, hour, minute, second) - (offset * 60.0)) * msPerSecond;
+    return ms - (offset * msPerMinute);
 }
 
 double timeClip(double t)
@@ -916,6 +845,143 @@ double timeClip(double t)
         return NaN;
     return trunc(t);
 }
+} // namespace WTF
 
+#if USE(JSC)
+namespace JSC {
+
+// Get the DST offset for the time passed in.
+//
+// NOTE: The implementation relies on the fact that no time zones have
+// more than one daylight savings offset change per month.
+// If this function is called with NaN it returns NaN.
+static double getDSTOffset(ExecState* exec, double ms, double utcOffset)
+{
+    DSTOffsetCache& cache = exec->globalData().dstOffsetCache;
+    double start = cache.start;
+    double end = cache.end;
+
+    if (start <= ms) {
+        // If the time fits in the cached interval, return the cached offset.
+        if (ms <= end) return cache.offset;
+
+        // Compute a possible new interval end.
+        double newEnd = end + cache.increment;
+
+        if (ms <= newEnd) {
+            double endOffset = calculateDSTOffset(newEnd, utcOffset);
+            if (cache.offset == endOffset) {
+                // If the offset at the end of the new interval still matches
+                // the offset in the cache, we grow the cached time interval
+                // and return the offset.
+                cache.end = newEnd;
+                cache.increment = msPerMonth;
+                return endOffset;
+            } else {
+                double offset = calculateDSTOffset(ms, utcOffset);
+                if (offset == endOffset) {
+                    // The offset at the given time is equal to the offset at the
+                    // new end of the interval, so that means that we've just skipped
+                    // the point in time where the DST offset change occurred. Updated
+                    // the interval to reflect this and reset the increment.
+                    cache.start = ms;
+                    cache.end = newEnd;
+                    cache.increment = msPerMonth;
+                } else {
+                    // The interval contains a DST offset change and the given time is
+                    // before it. Adjust the increment to avoid a linear search for
+                    // the offset change point and change the end of the interval.
+                    cache.increment /= 3;
+                    cache.end = ms;
+                }
+                // Update the offset in the cache and return it.
+                cache.offset = offset;
+                return offset;
+            }
+        }
+    }
 
-} // namespace WTF
+    // Compute the DST offset for the time and shrink the cache interval
+    // to only contain the time. This allows fast repeated DST offset
+    // computations for the same time.
+    double offset = calculateDSTOffset(ms, utcOffset);
+    cache.offset = offset;
+    cache.start = ms;
+    cache.end = ms;
+    cache.increment = msPerMonth;
+    return offset;
+}
+
+/*
+ * Get the difference in milliseconds between this time zone and UTC (GMT)
+ * NOT including DST.
+ */
+double getUTCOffset(ExecState* exec)
+{
+    double utcOffset = exec->globalData().cachedUTCOffset;
+    if (!isnan(utcOffset))
+        return utcOffset;
+    exec->globalData().cachedUTCOffset = calculateUTCOffset();
+    return exec->globalData().cachedUTCOffset;
+}
+
+double gregorianDateTimeToMS(ExecState* exec, const GregorianDateTime& t, double milliSeconds, bool inputIsUTC)
+{
+    int day = dateToDayInYear(t.year + 1900, t.month, t.monthDay);
+    double ms = timeToMS(t.hour, t.minute, t.second, milliSeconds);
+    double result = (day * WTF::msPerDay) + ms;
+
+    if (!inputIsUTC) { // convert to UTC
+        double utcOffset = getUTCOffset(exec);
+        result -= utcOffset;
+        result -= getDSTOffset(exec, result, utcOffset);
+    }
+
+    return result;
+}
+
+// input is UTC
+void msToGregorianDateTime(ExecState* exec, double ms, bool outputIsUTC, GregorianDateTime& tm)
+{
+    double dstOff = 0.0;
+    double utcOff = 0.0;
+    if (!outputIsUTC) {
+        utcOff = getUTCOffset(exec);
+        dstOff = getDSTOffset(exec, ms, utcOff);
+        ms += dstOff + utcOff;
+    }
+
+    const int year = msToYear(ms);
+    tm.second   =  msToSeconds(ms);
+    tm.minute   =  msToMinutes(ms);
+    tm.hour     =  msToHours(ms);
+    tm.weekDay  =  msToWeekDay(ms);
+    tm.yearDay  =  dayInYear(ms, year);
+    tm.monthDay =  dayInMonthFromDayInYear(tm.yearDay, isLeapYear(year));
+    tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
+    tm.year     =  year - 1900;
+    tm.isDST    =  dstOff != 0.0;
+    tm.utcOffset = static_cast<long>((dstOff + utcOff) / WTF::msPerSecond);
+    tm.timeZone = NULL;
+}
+
+double parseDateFromNullTerminatedCharacters(ExecState* exec, const char* dateString)
+{
+    ASSERT(exec);
+    bool haveTZ;
+    int offset;
+    double ms = WTF::parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
+    if (isnan(ms))
+        return NaN;
+
+    // fall back to local timezone
+    if (!haveTZ) {
+        double utcOffset = getUTCOffset(exec);
+        double dstOffset = getDSTOffset(exec, ms, utcOffset);
+        offset = static_cast<int>((utcOffset + dstOffset) / WTF::msPerMinute);
+    }
+    return ms - (offset * WTF::msPerMinute);
+}
+
+} // namespace JSC
+#endif // USE(JSC)
diff --git a/JavaScriptCore/wtf/DateMath.h b/JavaScriptCore/wtf/DateMath.h
index 6110f76..6d4ac1e 100644
--- a/JavaScriptCore/wtf/DateMath.h
+++ b/JavaScriptCore/wtf/DateMath.h
@@ -42,27 +42,27 @@
 #ifndef DateMath_h
 #define DateMath_h
 
-#include <time.h>
+#include <math.h>
 #include <string.h>
+#include <time.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/UnusedParam.h>
 
 namespace WTF {
-
-struct GregorianDateTime;
-
 void initializeDates();
-void msToGregorianDateTime(double, bool outputIsUTC, GregorianDateTime&);
-double gregorianDateTimeToMS(const GregorianDateTime&, double, bool inputIsUTC);
-double getUTCOffset();
 int equivalentYearForDST(int year);
-double getCurrentUTCTime();
-double getCurrentUTCTimeWithMicroseconds();
-void getLocalTime(const time_t*, tm*);
 
 // Not really math related, but this is currently the only shared place to put these.  
-double parseDateFromNullTerminatedCharacters(const char*);
+double parseDateFromNullTerminatedCharacters(const char* dateString);
 double timeClip(double);
 
+inline double jsCurrentTime()
+{
+    // JavaScript doesn't recognize fractions of a millisecond.
+    return floor(WTF::currentTimeMS());
+}
+
 const char * const weekdayName[7] = { "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" };
 const char * const monthName[12] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
 
@@ -74,9 +74,22 @@ const double msPerSecond = 1000.0;
 const double msPerMinute = 60.0 * 1000.0;
 const double msPerHour = 60.0 * 60.0 * 1000.0;
 const double msPerDay = 24.0 * 60.0 * 60.0 * 1000.0;
+const double msPerMonth = 2592000000.0;
 
-// Intentionally overridding the default tm of the system
-// Tee members of tm differ on various operating systems.
+} // namespace WTF
+
+#if USE(JSC)
+namespace JSC {
+class ExecState;
+struct GregorianDateTime;
+
+void msToGregorianDateTime(ExecState*, double, bool outputIsUTC, GregorianDateTime&);
+double gregorianDateTimeToMS(ExecState*, const GregorianDateTime&, double, bool inputIsUTC);
+double getUTCOffset(ExecState*);
+double parseDateFromNullTerminatedCharacters(ExecState*, const char* dateString);
+
+// Intentionally overridding the default tm of the system.
+// The members of tm differ on various operating systems.
 struct GregorianDateTime : Noncopyable {
     GregorianDateTime()
         : second(0)
@@ -98,7 +111,7 @@ struct GregorianDateTime : Noncopyable {
         delete [] timeZone;
     }
 
-    GregorianDateTime(const tm& inTm)
+    GregorianDateTime(ExecState* exec, const tm& inTm)
         : second(inTm.tm_sec)
         , minute(inTm.tm_min)
         , hour(inTm.tm_hour)
@@ -109,10 +122,11 @@ struct GregorianDateTime : Noncopyable {
         , year(inTm.tm_year)
         , isDST(inTm.tm_isdst)
     {
+        UNUSED_PARAM(exec);
 #if HAVE(TM_GMTOFF)
         utcOffset = static_cast<int>(inTm.tm_gmtoff);
 #else
-        utcOffset = static_cast<int>(getUTCOffset() / msPerSecond + (isDST ? secondsPerHour : 0));
+        utcOffset = static_cast<int>(getUTCOffset(exec) / WTF::msPerSecond + (isDST ? WTF::secondsPerHour : 0));
 #endif
 
 #if HAVE(TM_ZONE)
@@ -186,7 +200,7 @@ static inline int gmtoffset(const GregorianDateTime& t)
 {
     return t.utcOffset;
 }
-
-} // namespace WTF
+} // namespace JSC
+#endif // USE(JSC)
 
 #endif // DateMath_h
diff --git a/JavaScriptCore/wtf/FastMalloc.h b/JavaScriptCore/wtf/FastMalloc.h
index 541b05d..abe4a58 100644
--- a/JavaScriptCore/wtf/FastMalloc.h
+++ b/JavaScriptCore/wtf/FastMalloc.h
@@ -26,19 +26,13 @@
 #include <stdlib.h>
 #include <new>
 
-#if COMPILER(GCC)
-#define WTF_FAST_MALLOC_EXPORT __attribute__((visibility("default")))
-#else
-#define WTF_FAST_MALLOC_EXPORT
-#endif
-
 namespace WTF {
 
     // These functions call CRASH() if an allocation fails.
-    void* fastMalloc(size_t) WTF_FAST_MALLOC_EXPORT;
+    void* fastMalloc(size_t);
     void* fastZeroedMalloc(size_t);
-    void* fastCalloc(size_t numElements, size_t elementSize) WTF_FAST_MALLOC_EXPORT;
-    void* fastRealloc(void*, size_t) WTF_FAST_MALLOC_EXPORT;
+    void* fastCalloc(size_t numElements, size_t elementSize);
+    void* fastRealloc(void*, size_t);
 
     struct TryMallocReturnValue {
         TryMallocReturnValue(void* data)
@@ -77,7 +71,7 @@ namespace WTF {
     TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size);
     TryMallocReturnValue tryFastRealloc(void* p, size_t n);
 
-    void fastFree(void*) WTF_FAST_MALLOC_EXPORT;
+    void fastFree(void*);
 
 #ifndef NDEBUG    
     void fastMallocForbid();
@@ -222,14 +216,21 @@ using WTF::fastMallocAllow;
 // We musn't customize the global operator new and delete for the Qt port.
 #if !PLATFORM(QT)
 
-WTF_PRIVATE_INLINE void* operator new(size_t size) { return fastMalloc(size); }
+#if COMPILER(MSVC)
+#pragma warning(push)
+#pragma warning(disable: 4290) // Disable the C++ exception specification ignored warning.
+#endif
+WTF_PRIVATE_INLINE void* operator new(size_t size) throw (std::bad_alloc) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new(size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
-WTF_PRIVATE_INLINE void operator delete(void* p) { fastFree(p); }
+WTF_PRIVATE_INLINE void operator delete(void* p) throw() { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete(void* p, const std::nothrow_t&) throw() { fastFree(p); }
-WTF_PRIVATE_INLINE void* operator new[](size_t size) { return fastMalloc(size); }
+WTF_PRIVATE_INLINE void* operator new[](size_t size) throw (std::bad_alloc) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new[](size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
-WTF_PRIVATE_INLINE void operator delete[](void* p) { fastFree(p); }
+WTF_PRIVATE_INLINE void operator delete[](void* p) throw() { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete[](void* p, const std::nothrow_t&) throw() { fastFree(p); }
+#if COMPILER(MSVC)
+#pragma warning(pop)
+#endif
 
 #endif
 
diff --git a/JavaScriptCore/wtf/GOwnPtr.h b/JavaScriptCore/wtf/GOwnPtr.h
deleted file mode 100644
index 4993348..0000000
--- a/JavaScriptCore/wtf/GOwnPtr.h
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
- *  Copyright (C) 2008 Collabora Ltd.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef GOwnPtr_h
-#define GOwnPtr_h
-
-#include <algorithm>
-#include <glib.h>
-#include <wtf/Assertions.h>
-#include <wtf/Noncopyable.h>
-
-namespace WTF {
-    template <typename T> inline void freeOwnedGPtr(T* ptr) { g_free(reinterpret_cast<void*>(ptr)); }
-    template<> void freeOwnedGPtr<GError>(GError*);
-    template<> void freeOwnedGPtr<GList>(GList*);
-    template<> void freeOwnedGPtr<GCond>(GCond*);
-    template<> void freeOwnedGPtr<GMutex>(GMutex*);
-    template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
-    template<> void freeOwnedGPtr<GDir>(GDir*);
-    template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
-
-    template <typename T> class GOwnPtr : public Noncopyable {
-    public:
-        explicit GOwnPtr(T* ptr = 0) : m_ptr(ptr) { }
-        ~GOwnPtr() { freeOwnedGPtr(m_ptr); }
-
-        T* get() const { return m_ptr; }
-        T* release() { T* ptr = m_ptr; m_ptr = 0; return ptr; }
-        T*& outPtr() { ASSERT(!m_ptr); return m_ptr; }
-
-        void set(T* ptr) { ASSERT(!ptr || m_ptr != ptr); freeOwnedGPtr(m_ptr); m_ptr = ptr; }
-        void clear() { freeOwnedGPtr(m_ptr); m_ptr = 0; }
-
-        T& operator*() const { ASSERT(m_ptr); return *m_ptr; }
-        T* operator->() const { ASSERT(m_ptr); return m_ptr; }
-
-        bool operator!() const { return !m_ptr; }
-
-        // This conversion operator allows implicit conversion to bool but not to other integer types.
-        typedef T* GOwnPtr::*UnspecifiedBoolType;
-        operator UnspecifiedBoolType() const { return m_ptr ? &GOwnPtr::m_ptr : 0; }
-
-        void swap(GOwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
-
-    private:
-        T* m_ptr;
-    };
-    
-    template <typename T> inline void swap(GOwnPtr<T>& a, GOwnPtr<T>& b) { a.swap(b); }
-
-    template <typename T, typename U> inline bool operator==(const GOwnPtr<T>& a, U* b)
-    { 
-        return a.get() == b; 
-    }
-    
-    template <typename T, typename U> inline bool operator==(T* a, const GOwnPtr<U>& b) 
-    {
-        return a == b.get(); 
-    }
-
-    template <typename T, typename U> inline bool operator!=(const GOwnPtr<T>& a, U* b)
-    {
-        return a.get() != b; 
-    }
-
-    template <typename T, typename U> inline bool operator!=(T* a, const GOwnPtr<U>& b)
-    { 
-        return a != b.get(); 
-    }
-    
-    template <typename T> inline typename GOwnPtr<T>::PtrType getPtr(const GOwnPtr<T>& p)
-    {
-        return p.get();
-    }
-
-} // namespace WTF
-
-using WTF::GOwnPtr;
-
-#endif // GOwnPtr_h
diff --git a/JavaScriptCore/wtf/HashMap.h b/JavaScriptCore/wtf/HashMap.h
index 3de5ee6..ece3812 100644
--- a/JavaScriptCore/wtf/HashMap.h
+++ b/JavaScriptCore/wtf/HashMap.h
@@ -83,6 +83,23 @@ namespace WTF {
 
         MappedType take(const KeyType&); // efficient combination of get with remove
 
+        // An alternate version of find() that finds the object by hashing and comparing
+        // with some other type, to avoid the cost of type conversion. HashTranslator
+        // must have the following function members:
+        //   static unsigned hash(const T&);
+        //   static bool equal(const ValueType&, const T&);
+        template<typename T, typename HashTranslator> iterator find(const T&);
+        template<typename T, typename HashTranslator> const_iterator find(const T&) const;
+        template<typename T, typename HashTranslator> bool contains(const T&) const;
+
+        // An alternate version of add() that finds the object by hashing and comparing
+        // with some other type, to avoid the cost of type conversion if the object is already
+        // in the table. HashTranslator must have the following function members:
+        //   static unsigned hash(const T&);
+        //   static bool equal(const ValueType&, const T&);
+        //   static translate(ValueType&, const T&, unsigned hashCode);
+        template<typename T, typename HashTranslator> pair<iterator, bool> add(const T&, const MappedType&);
+
     private:
         pair<iterator, bool> inlineAdd(const KeyType&, const MappedType&);
 
@@ -107,6 +124,19 @@ namespace WTF {
         }
     };
 
+    template<typename ValueType, typename ValueTraits, typename T, typename Translator>
+    struct HashMapTranslatorAdapter {
+        typedef typename ValueType::first_type KeyType;
+        typedef typename ValueType::second_type MappedType;
+
+        static unsigned hash(const T& key) { return Translator::hash(key); }
+        static bool equal(const KeyType& a, const T& b) { return Translator::equal(a, b); }
+        static void translate(ValueType& location, const T& key, const MappedType&, unsigned hashCode)
+        {
+            Translator::translate(location.first, key, hashCode);
+        }
+    };
+
     template<typename T, typename U, typename V, typename W, typename X>
     inline void HashMap<T, U, V, W, X>::swap(HashMap& other)
     {
@@ -174,6 +204,33 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline typename HashMap<T, U, V, W, X>::iterator
+    HashMap<T, U, V, W, X>::find(const TYPE& value)
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template find<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline typename HashMap<T, U, V, W, X>::const_iterator 
+    HashMap<T, U, V, W, X>::find(const TYPE& value) const
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template find<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline bool
+    HashMap<T, U, V, W, X>::contains(const TYPE& value) const
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template contains<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
     inline pair<typename HashMap<T, U, V, W, X>::iterator, bool>
     HashMap<T, U, V, W, X>::inlineAdd(const KeyType& key, const MappedType& mapped) 
     {
@@ -194,6 +251,15 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    pair<typename HashMap<T, U, V, W, X>::iterator, bool>
+    HashMap<T, U, V, W, X>::add(const TYPE& key, const MappedType& value)
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template addPassingHashCode<TYPE, MappedType, Adapter>(key, value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
     pair<typename HashMap<T, U, V, W, X>::iterator, bool>
     HashMap<T, U, V, W, X>::add(const KeyType& key, const MappedType& mapped)
     {
diff --git a/JavaScriptCore/wtf/HashSet.h b/JavaScriptCore/wtf/HashSet.h
index f4e2cf7..0d7b4bb 100644
--- a/JavaScriptCore/wtf/HashSet.h
+++ b/JavaScriptCore/wtf/HashSet.h
@@ -81,7 +81,7 @@ namespace WTF {
 
         // An alternate version of add() that finds the object by hashing and comparing
         // with some other type, to avoid the cost of type conversion if the object is already
-        // in the table. HashTranslator must have the following methods:
+        // in the table. HashTranslator must have the following function members:
         //   static unsigned hash(const T&);
         //   static bool equal(const ValueType&, const T&);
         //   static translate(ValueType&, const T&, unsigned hashCode);
diff --git a/JavaScriptCore/wtf/ListHashSet.h b/JavaScriptCore/wtf/ListHashSet.h
index 38cc998..54ed36b 100644
--- a/JavaScriptCore/wtf/ListHashSet.h
+++ b/JavaScriptCore/wtf/ListHashSet.h
@@ -51,7 +51,7 @@ namespace WTF {
     template<typename ValueArg> struct ListHashSetNodeAllocator;
     template<typename ValueArg, typename HashArg> struct ListHashSetNodeHashFunctions;
 
-    template<typename ValueArg, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet {
+    template<typename ValueArg, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet : public FastAllocBase {
     private:
         typedef ListHashSetNode<ValueArg> Node;
         typedef ListHashSetNodeAllocator<ValueArg> NodeAllocator;
diff --git a/JavaScriptCore/wtf/MainThread.cpp b/JavaScriptCore/wtf/MainThread.cpp
index e999094..40a4ae5 100644
--- a/JavaScriptCore/wtf/MainThread.cpp
+++ b/JavaScriptCore/wtf/MainThread.cpp
@@ -39,10 +39,12 @@ namespace WTF {
 struct FunctionWithContext {
     MainThreadFunction* function;
     void* context;
+    ThreadCondition* syncFlag;
 
-    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0)
+    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0, ThreadCondition* syncFlag = 0)
         : function(function)
         , context(context)
+        , syncFlag(syncFlag)
     { 
     }
 };
@@ -92,6 +94,8 @@ void dispatchFunctionsFromMainThread()
         }
 
         invocation.function(invocation.context);
+        if (invocation.syncFlag)
+            invocation.syncFlag->signal();
 
         // If we are running accumulated functions for too long so UI may become unresponsive, we need to
         // yield so the user input can be processed. Otherwise user may not be able to even close the window.
@@ -117,6 +121,24 @@ void callOnMainThread(MainThreadFunction* function, void* context)
         scheduleDispatchFunctionsOnMainThread();
 }
 
+void callOnMainThreadAndWait(MainThreadFunction* function, void* context)
+{
+    ASSERT(function);
+
+    if (isMainThread()) {
+        function(context);
+        return;
+    }
+
+    ThreadCondition syncFlag;
+    Mutex& functionQueueMutex = mainThreadFunctionQueueMutex();
+    MutexLocker locker(functionQueueMutex);
+    functionQueue().append(FunctionWithContext(function, context, &syncFlag));
+    if (functionQueue().size() == 1)
+        scheduleDispatchFunctionsOnMainThread();
+    syncFlag.wait(functionQueueMutex);
+}
+
 void setMainThreadCallbacksPaused(bool paused)
 {
     ASSERT(isMainThread());
diff --git a/JavaScriptCore/wtf/MainThread.h b/JavaScriptCore/wtf/MainThread.h
index 01ce804..8c0275b 100644
--- a/JavaScriptCore/wtf/MainThread.h
+++ b/JavaScriptCore/wtf/MainThread.h
@@ -38,6 +38,9 @@ typedef void MainThreadFunction(void*);
 
 void callOnMainThread(MainThreadFunction*, void* context);
 
+// Blocks the thread until the call finishes on the main thread. Misusing this can easily cause deadlocks.
+void callOnMainThreadAndWait(MainThreadFunction*, void* context);
+
 void setMainThreadCallbacksPaused(bool paused);
 
 // Must be called from the main thread (Darwin is an exception to this rule).
@@ -52,6 +55,7 @@ void dispatchFunctionsFromMainThread();
 } // namespace WTF
 
 using WTF::callOnMainThread;
+using WTF::callOnMainThreadAndWait;
 using WTF::setMainThreadCallbacksPaused;
 
 #endif // MainThread_h
diff --git a/JavaScriptCore/wtf/MathExtras.h b/JavaScriptCore/wtf/MathExtras.h
index 556230e..ee2110e 100644
--- a/JavaScriptCore/wtf/MathExtras.h
+++ b/JavaScriptCore/wtf/MathExtras.h
@@ -26,6 +26,7 @@
 #ifndef WTF_MathExtras_h
 #define WTF_MathExtras_h
 
+#include <float.h>
 #include <math.h>
 #include <stdlib.h>
 
@@ -43,11 +44,6 @@
 #include <stdlib.h>
 #endif
 #include <limits>
-
-#if HAVE(FLOAT_H)
-#include <float.h>
-#endif
-
 #endif
 
 #ifndef M_PI
diff --git a/JavaScriptCore/wtf/MessageQueue.h b/JavaScriptCore/wtf/MessageQueue.h
index 9c9a4a78..48bd10a 100644
--- a/JavaScriptCore/wtf/MessageQueue.h
+++ b/JavaScriptCore/wtf/MessageQueue.h
@@ -44,23 +44,27 @@ namespace WTF {
         MessageQueueMessageReceived,  // A message was successfully received and returned.
     };
 
+    // The queue takes ownership of messages and transfer it to the new owner
+    // when messages are fetched from the queue.
+    // Essentially, MessageQueue acts as a queue of OwnPtr<DataType>.
     template<typename DataType>
     class MessageQueue : public Noncopyable {
     public:
         MessageQueue() : m_killed(false) { }
-        
-        void append(const DataType&);
-        bool appendAndCheckEmpty(const DataType&);
-        void prepend(const DataType&);
-        bool waitForMessage(DataType&);
+        ~MessageQueue();
+
+        void append(PassOwnPtr<DataType>);
+        bool appendAndCheckEmpty(PassOwnPtr<DataType>);
+        void prepend(PassOwnPtr<DataType>);
+
+        PassOwnPtr<DataType> waitForMessage();
+        PassOwnPtr<DataType> tryGetMessage();
         template<typename Predicate>
-        MessageQueueWaitResult waitForMessageFilteredWithTimeout(DataType&, Predicate&, double absoluteTime);
+        PassOwnPtr<DataType> waitForMessageFilteredWithTimeout(MessageQueueWaitResult&, Predicate&, double absoluteTime);
 
         template<typename Predicate>
         void removeIf(Predicate&);
 
-        bool tryGetMessage(DataType&);
-
         void kill();
         bool killed() const;
 
@@ -70,86 +74,98 @@ namespace WTF {
         static double infiniteTime() { return std::numeric_limits<double>::max(); }
 
     private:
-        static bool alwaysTruePredicate(DataType&) { return true; }
+        static bool alwaysTruePredicate(DataType*) { return true; }
 
         mutable Mutex m_mutex;
         ThreadCondition m_condition;
-        Deque<DataType> m_queue;
+        Deque<DataType*> m_queue;
         bool m_killed;
     };
 
     template<typename DataType>
-    inline void MessageQueue<DataType>::append(const DataType& message)
+    MessageQueue<DataType>::~MessageQueue()
+    {
+        deleteAllValues(m_queue);
+    }
+
+    template<typename DataType>
+    inline void MessageQueue<DataType>::append(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
-        m_queue.append(message);
+        m_queue.append(message.release());
         m_condition.signal();
     }
 
     // Returns true if the queue was empty before the item was added.
     template<typename DataType>
-    inline bool MessageQueue<DataType>::appendAndCheckEmpty(const DataType& message)
+    inline bool MessageQueue<DataType>::appendAndCheckEmpty(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
         bool wasEmpty = m_queue.isEmpty();
-        m_queue.append(message);
+        m_queue.append(message.release());
         m_condition.signal();
         return wasEmpty;
     }
 
     template<typename DataType>
-    inline void MessageQueue<DataType>::prepend(const DataType& message)
+    inline void MessageQueue<DataType>::prepend(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
-        m_queue.prepend(message);
+        m_queue.prepend(message.release());
         m_condition.signal();
     }
 
     template<typename DataType>
-    inline bool MessageQueue<DataType>::waitForMessage(DataType& result)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::waitForMessage()
     {
-        MessageQueueWaitResult exitReason = waitForMessageFilteredWithTimeout(result, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
+        MessageQueueWaitResult exitReason; 
+        PassOwnPtr<DataType> result = waitForMessageFilteredWithTimeout(exitReason, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
         ASSERT(exitReason == MessageQueueTerminated || exitReason == MessageQueueMessageReceived);
-        return exitReason == MessageQueueMessageReceived;
+        return result;
     }
 
     template<typename DataType>
     template<typename Predicate>
-    inline MessageQueueWaitResult MessageQueue<DataType>::waitForMessageFilteredWithTimeout(DataType& result, Predicate& predicate, double absoluteTime)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::waitForMessageFilteredWithTimeout(MessageQueueWaitResult& result, Predicate& predicate, double absoluteTime)
     {
         MutexLocker lock(m_mutex);
         bool timedOut = false;
 
-        DequeConstIterator<DataType> found = m_queue.end();
+        DequeConstIterator<DataType*> found = m_queue.end();
         while (!m_killed && !timedOut && (found = m_queue.findIf(predicate)) == m_queue.end())
             timedOut = !m_condition.timedWait(m_mutex, absoluteTime);
 
         ASSERT(!timedOut || absoluteTime != infiniteTime());
 
-        if (m_killed)
-            return MessageQueueTerminated;
+        if (m_killed) {
+            result = MessageQueueTerminated;
+            return 0;
+        }
 
-        if (timedOut)
-            return MessageQueueTimeout;
+        if (timedOut) {
+            result = MessageQueueTimeout;
+            return 0;
+        }
 
         ASSERT(found != m_queue.end());
-        result = *found;
+        DataType* message = *found;
         m_queue.remove(found);
-        return MessageQueueMessageReceived;
+        result = MessageQueueMessageReceived;
+        return message;
     }
 
     template<typename DataType>
-    inline bool MessageQueue<DataType>::tryGetMessage(DataType& result)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::tryGetMessage()
     {
         MutexLocker lock(m_mutex);
         if (m_killed)
-            return false;
+            return 0;
         if (m_queue.isEmpty())
-            return false;
+            return 0;
 
-        result = m_queue.first();
+        DataType* message = m_queue.first();
         m_queue.removeFirst();
-        return true;
+        return message;
     }
 
     template<typename DataType>
@@ -157,9 +173,15 @@ namespace WTF {
     inline void MessageQueue<DataType>::removeIf(Predicate& predicate)
     {
         MutexLocker lock(m_mutex);
-        DequeConstIterator<DataType> found = m_queue.end();
-        while ((found = m_queue.findIf(predicate)) != m_queue.end()) {
+        // See bug 31657 for why this loop looks so weird
+        while (true) {
+            DequeConstIterator<DataType*> found = m_queue.findIf(predicate);
+            if (found == m_queue.end())
+                break;
+
+            DataType* message = *found;
             m_queue.remove(found);
+            delete message;
        }
     }
 
diff --git a/JavaScriptCore/wtf/Platform.h b/JavaScriptCore/wtf/Platform.h
index 20c030b..091ba4f 100644
--- a/JavaScriptCore/wtf/Platform.h
+++ b/JavaScriptCore/wtf/Platform.h
@@ -47,6 +47,11 @@
 #elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
 #define BUILDING_ON_LEOPARD 1
 #endif
+#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_5
+#define TARGETING_TIGER 1
+#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_6
+#define TARGETING_LEOPARD 1
+#endif
 #include <TargetConditionals.h>
 #endif
 
@@ -136,19 +141,15 @@
 
 /* PLATFORM(CHROMIUM) */
 /* PLATFORM(QT) */
+/* PLATFORM(WX) */
 /* PLATFORM(GTK) */
+/* PLATFORM(HAIKU) */
 /* PLATFORM(MAC) */
 /* PLATFORM(WIN) */
 #if defined(BUILDING_CHROMIUM__)
 #define WTF_PLATFORM_CHROMIUM 1
 #elif defined(BUILDING_QT__)
 #define WTF_PLATFORM_QT 1
-
-/* PLATFORM(KDE) */
-#if defined(BUILDING_KDE__)
-#define WTF_PLATFORM_KDE 1
-#endif
-
 #elif defined(BUILDING_WX__)
 #define WTF_PLATFORM_WX 1
 #elif defined(BUILDING_GTK__)
@@ -224,6 +225,16 @@
 #define WTF_PLATFORM_BIG_ENDIAN 1
 #endif
 
+/* PLATFORM(SPARC32) */
+#if defined(__sparc) && !defined(__arch64__) || defined(__sparcv8)
+#define WTF_PLATFORM_SPARC32 1
+#define WTF_PLATFORM_BIG_ENDIAN 1
+#endif
+
+#if PLATFORM(SPARC32) || PLATFORM(SPARC64)
+#define WTF_PLATFORM_SPARC
+#endif
+
 /* PLATFORM(PPC64) */
 #if   defined(__ppc64__) \
    || defined(__PPC64__)
@@ -354,6 +365,16 @@
 #define WTF_PLATFORM_X86_64 1
 #endif
 
+/* PLATFORM(IA64) */
+#if defined(__ia64__)
+#define WTF_PLATFORM_IA64 1
+#endif
+
+/* PLATFORM(ALPHA) */
+#if defined(__alpha__)
+#define WTF_PLATFORM_ALPHA 1
+#endif
+
 /* PLATFORM(SH4) */
 #if defined(__SH4__)
 #define WTF_PLATFORM_SH4 1
@@ -377,6 +398,8 @@
 #   if Q_BYTE_ORDER == Q_BIG_EDIAN
 #       define WTF_PLATFORM_BIG_ENDIAN 1
 #   endif
+
+#   include <ce_time.h>
 #endif
 
 /* Compiler */
@@ -423,7 +446,7 @@
 #define WTF_COMPILER_WINSCW 1
 #endif
 
-#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN)) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
+#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && PLATFORM(DARWIN))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
 #define ENABLE_JSC_MULTIPLE_THREADS 1
 #endif
 
@@ -459,8 +482,7 @@
 
 #endif  /* PLATFORM(WINCE) && !PLATFORM(QT) */
 
-/* for Unicode, KDE uses Qt */
-#if PLATFORM(KDE) || PLATFORM(QT)
+#if PLATFORM(QT)
 #define WTF_USE_QT4_UNICODE 1
 #elif PLATFORM(WINCE)
 #define WTF_USE_WINCE_UNICODE 1
@@ -493,6 +515,10 @@
 #define HAVE_PTHREAD_RWLOCK 1
 #endif
 
+#if PLATFORM(QT) && PLATFORM(DARWIN)
+#define WTF_PLATFORM_CF 1
+#endif
+
 #if PLATFORM(IPHONE)
 #define ENABLE_CONTEXT_MENUS 0
 #define ENABLE_DRAG_SUPPORT 0
@@ -520,7 +546,10 @@
 // This prevents unnecessary invals.
 #define ENABLE_TEXT_CARET 1
 #define ENABLE_JAVASCRIPT_DEBUGGER 0
+<<<<<<< HEAD:JavaScriptCore/wtf/Platform.h
 #define ENABLE_ORIENTATION_EVENTS 1
+=======
+>>>>>>> webkit.org at r51976:JavaScriptCore/wtf/Platform.h
 #endif
 
 #if PLATFORM(WIN)
@@ -529,6 +558,9 @@
 
 #if PLATFORM(WX)
 #define ENABLE_ASSEMBLER 1
+#if PLATFORM(DARWIN)
+#define WTF_PLATFORM_CF 1
+#endif
 #endif
 
 #if PLATFORM(GTK)
@@ -577,7 +609,7 @@
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TIMEB_H 1
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE) && !PLATFORM(QT)
 #define HAVE_MADV_FREE_REUSE 1
 #define HAVE_MADV_FREE 1
 #define HAVE_PTHREAD_SETNAME_NP 1
@@ -589,7 +621,6 @@
 
 #elif PLATFORM(WIN_OS)
 
-#define HAVE_FLOAT_H 1
 #if PLATFORM(WINCE)
 #define HAVE_ERRNO_H 0
 #else
@@ -741,7 +772,7 @@
 #endif
 
 #if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64)
-#if PLATFORM(X86_64) && (PLATFORM(DARWIN) || PLATFORM(LINUX) || PLATFORM(WIN_OS))
+#if (PLATFORM(X86_64) && (PLATFORM(UNIX) || PLATFORM(WIN_OS))) || PLATFORM(IA64) || PLATFORM(ALPHA)
 #define WTF_USE_JSVALUE64 1
 #elif PLATFORM(ARM) || PLATFORM(PPC64)
 #define WTF_USE_JSVALUE32 1
@@ -769,14 +800,18 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
 #elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
     #define ENABLE_JIT 1
-    #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
 /* The JIT is tested & working on x86 Windows */
 #elif PLATFORM(X86) && PLATFORM(WIN)
     #define ENABLE_JIT 1
 #endif
 
 #if PLATFORM(QT)
-#if PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100
+#if PLATFORM(X86_64) && PLATFORM(DARWIN)
+    #define ENABLE_JIT 1
+#elif PLATFORM(X86) && PLATFORM(DARWIN)
+    #define ENABLE_JIT 1
+    #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
+#elif PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
 #elif PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)
@@ -787,9 +822,6 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
 #elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
     #define ENABLE_JIT 1
-    #if PLATFORM(ARM_THUMB2)
-        #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
-    #endif
 #endif
 #endif /* PLATFORM(QT) */
 
@@ -894,6 +926,10 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WTF_USE_ACCELERATED_COMPOSITING 1
 #endif
 
+#if PLATFORM(WIN)
+#define WTF_USE_ACCELERATED_COMPOSITING 0
+#endif
+
 #if COMPILER(GCC)
 #define WARN_UNUSED_RETURN __attribute__ ((warn_unused_result))
 #else
@@ -907,4 +943,6 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 /* Set up a define for a common error that is intended to cause a build error -- thus the space after Error. */
 #define WTF_PLATFORM_CFNETWORK Error USE_macro_should_be_used_with_CFNETWORK
 
+#define ENABLE_JSC_ZOMBIES 0
+
 #endif /* WTF_Platform_h */
diff --git a/JavaScriptCore/wtf/PtrAndFlags.h b/JavaScriptCore/wtf/PtrAndFlags.h
index 5d0bd2a..1e1bee0 100644
--- a/JavaScriptCore/wtf/PtrAndFlags.h
+++ b/JavaScriptCore/wtf/PtrAndFlags.h
@@ -68,7 +68,7 @@ namespace WTF {
         PtrAndFlags(T* ptr)
         {
             PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
-            set(ptr);
+            PtrAndFlagsBase<T, FlagEnum>::set(ptr);
         }
     };
 } // namespace WTF
diff --git a/JavaScriptCore/wtf/StdLibExtras.h b/JavaScriptCore/wtf/StdLibExtras.h
index c9b5742..dd90c85 100644
--- a/JavaScriptCore/wtf/StdLibExtras.h
+++ b/JavaScriptCore/wtf/StdLibExtras.h
@@ -48,6 +48,10 @@
 // NULL can cause compiler problems, especially in cases of multiple inheritance.
 #define OBJECT_OFFSETOF(class, field) (reinterpret_cast<ptrdiff_t>(&(reinterpret_cast<class*>(0x4000)->field)) - 0x4000)
 
+// STRINGIZE: Can convert any value to quoted string, even expandable macros
+#define STRINGIZE(exp) #exp
+#define STRINGIZE_VALUE_OF(exp) STRINGIZE(exp)
+
 namespace WTF {
 
     /*
diff --git a/JavaScriptCore/wtf/StringExtras.h b/JavaScriptCore/wtf/StringExtras.h
index 1120d65..50efe35 100644
--- a/JavaScriptCore/wtf/StringExtras.h
+++ b/JavaScriptCore/wtf/StringExtras.h
@@ -85,7 +85,7 @@ inline int strcasecmp(const char* s1, const char* s2)
 
 #endif
 
-#if PLATFORM(WIN_OS) || PLATFORM(LINUX)
+#if PLATFORM(WIN_OS) || PLATFORM(LINUX) || PLATFORM(SOLARIS)
 
 inline char* strnstr(const char* buffer, const char* target, size_t bufferLength)
 {
diff --git a/JavaScriptCore/wtf/Threading.h b/JavaScriptCore/wtf/Threading.h
index b24e7c8..2a2e9c4 100644
--- a/JavaScriptCore/wtf/Threading.h
+++ b/JavaScriptCore/wtf/Threading.h
@@ -86,7 +86,7 @@
 #if USE(PTHREADS)
 #include <pthread.h>
 #elif PLATFORM(GTK)
-#include <wtf/GOwnPtr.h>
+#include <wtf/gtk/GOwnPtr.h>
 typedef struct _GMutex GMutex;
 typedef struct _GCond GCond;
 #endif
diff --git a/JavaScriptCore/wtf/ThreadingPthreads.cpp b/JavaScriptCore/wtf/ThreadingPthreads.cpp
index 6cad5e3..fe7b26a 100644
--- a/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -56,7 +56,7 @@ typedef HashMap<ThreadIdentifier, pthread_t> ThreadMap;
 static Mutex* atomicallyInitializedStaticMutex;
 
 #if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
-static ThreadIdentifier mainThreadIdentifier; // The thread that was the first to call initializeThreading(), which must be the main thread.
+static pthread_t mainThread; // The thread that was the first to call initializeThreading(), which must be the main thread.
 #endif
 
 static Mutex& threadMapMutex()
@@ -72,7 +72,7 @@ void initializeThreading()
         threadMapMutex();
         initializeRandomNumberGenerator();
 #if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
-        mainThreadIdentifier = currentThread();
+        mainThread = pthread_self();
 #endif
         initializeMainThread();
     }
@@ -232,7 +232,7 @@ bool isMainThread()
 #if PLATFORM(DARWIN) && !PLATFORM(CHROMIUM)
     return pthread_main_np();
 #else
-    return currentThread() == mainThreadIdentifier;
+    return pthread_equal(pthread_self(), mainThread);
 #endif
 }
 
diff --git a/JavaScriptCore/wtf/TypeTraits.h b/JavaScriptCore/wtf/TypeTraits.h
index 6ce6a3e..9e75e7a 100644
--- a/JavaScriptCore/wtf/TypeTraits.h
+++ b/JavaScriptCore/wtf/TypeTraits.h
@@ -155,7 +155,7 @@ namespace WTF {
     typedef IntegralConstant<bool, true>  true_type;
     typedef IntegralConstant<bool, false> false_type;
 
-#if defined(_MSC_VER) && (_MSC_VER >= 1400)
+#if defined(_MSC_VER) && (_MSC_VER >= 1400) && !defined(__INTEL_COMPILER)
     // VC8 (VS2005) and later have built-in compiler support for HasTrivialConstructor / HasTrivialDestructor,
     // but for some unexplained reason it doesn't work on built-in types.
     template <typename T> struct HasTrivialConstructor : public IntegralConstant<bool, __has_trivial_constructor(T)>{ };
diff --git a/JavaScriptCore/wtf/Vector.h b/JavaScriptCore/wtf/Vector.h
index e1fc5b4..decc9c9 100644
--- a/JavaScriptCore/wtf/Vector.h
+++ b/JavaScriptCore/wtf/Vector.h
@@ -71,7 +71,7 @@ namespace WTF {
     }
 
     template <bool needsDestruction, typename T>
-    class VectorDestructor;
+    struct VectorDestructor;
 
     template<typename T>
     struct VectorDestructor<false, T>
@@ -90,7 +90,7 @@ namespace WTF {
     };
 
     template <bool needsInitialization, bool canInitializeWithMemset, typename T>
-    class VectorInitializer;
+    struct VectorInitializer;
 
     template<bool ignore, typename T>
     struct VectorInitializer<false, ignore, T>
@@ -118,7 +118,7 @@ namespace WTF {
     };
 
     template <bool canMoveWithMemcpy, typename T>
-    class VectorMover;
+    struct VectorMover;
 
     template<typename T>
     struct VectorMover<false, T>
@@ -162,7 +162,7 @@ namespace WTF {
     };
 
     template <bool canCopyWithMemcpy, typename T>
-    class VectorCopier;
+    struct VectorCopier;
 
     template<typename T>
     struct VectorCopier<false, T>
@@ -187,7 +187,7 @@ namespace WTF {
     };
 
     template <bool canFillWithMemset, typename T>
-    class VectorFiller;
+    struct VectorFiller;
 
     template<typename T>
     struct VectorFiller<false, T>
@@ -212,7 +212,7 @@ namespace WTF {
     };
     
     template<bool canCompareWithMemcmp, typename T>
-    class VectorComparer;
+    struct VectorComparer;
     
     template<typename T>
     struct VectorComparer<false, T>
diff --git a/JavaScriptCore/wtf/VectorTraits.h b/JavaScriptCore/wtf/VectorTraits.h
index eb4c279..bf77878 100644
--- a/JavaScriptCore/wtf/VectorTraits.h
+++ b/JavaScriptCore/wtf/VectorTraits.h
@@ -32,7 +32,7 @@ using std::pair;
 namespace WTF {
 
     template<bool isPod, typename T>
-    class VectorTraitsBase;
+    struct VectorTraitsBase;
 
     template<typename T>
     struct VectorTraitsBase<false, T>
diff --git a/JavaScriptCore/wtf/dtoa.cpp b/JavaScriptCore/wtf/dtoa.cpp
index d75c17a..edcb82b 100644
--- a/JavaScriptCore/wtf/dtoa.cpp
+++ b/JavaScriptCore/wtf/dtoa.cpp
@@ -140,7 +140,6 @@
 #else
 #define NO_ERRNO
 #endif
-#include <float.h>
 #include <math.h>
 #include <stdint.h>
 #include <stdlib.h>
@@ -148,6 +147,7 @@
 #include <wtf/AlwaysInline.h>
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
+#include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
 #include <wtf/Threading.h>
 
@@ -1869,7 +1869,7 @@ static ALWAYS_INLINE int quorem(BigInt& b, BigInt& S)
  *       calculation.
  */
 
-void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rve)
+void dtoa(DtoaBuffer result, double dd, int ndigits, int* decpt, int* sign, char** rve)
 {
     /*
         Arguments ndigits, decpt, sign are similar to those
@@ -1908,16 +1908,23 @@ void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rv
     {
         /* Infinity or NaN */
         *decpt = 9999;
-        if (!word1(&u) && !(word0(&u) & 0xfffff))
+        if (!word1(&u) && !(word0(&u) & 0xfffff)) {
             strcpy(result, "Infinity");
-        else 
+            if (rve)
+                *rve = result + 8;
+        } else {
             strcpy(result, "NaN");
+            if (rve)
+                *rve = result + 3;
+        }
         return;
     }
     if (!dval(&u)) {
         *decpt = 1;
         result[0] = '0';
         result[1] = '\0';
+        if (rve)
+            *rve = result + 1;
         return;
     }
 
@@ -2376,4 +2383,83 @@ ret:
         *rve = s;
 }
 
+static ALWAYS_INLINE void append(char*& next, const char* src, unsigned size)
+{
+    for (unsigned i = 0; i < size; ++i)
+        *next++ = *src++;
+}
+
+void doubleToStringInJavaScriptFormat(double d, DtoaBuffer buffer, unsigned* resultLength)
+{
+    ASSERT(buffer);
+
+    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
+    if (isnan(d)) {
+        append(buffer, "NaN", 3);
+        if (resultLength)
+            *resultLength = 3;
+        return;
+    }
+    // -0 -> "0"
+    if (!d) {
+        buffer[0] = '0';
+        if (resultLength)
+            *resultLength = 1;
+        return;
+    }
+
+    int decimalPoint;
+    int sign;
+
+    DtoaBuffer result;
+    char* resultEnd = 0;
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, &resultEnd);
+    int length = resultEnd - result;
+
+    char* next = buffer;
+    if (sign)
+        *next++ = '-';
+
+    if (decimalPoint <= 0 && decimalPoint > -6) {
+        *next++ = '0';
+        *next++ = '.';
+        for (int j = decimalPoint; j < 0; j++)
+            *next++ = '0';
+        append(next, result, length);
+    } else if (decimalPoint <= 21 && decimalPoint > 0) {
+        if (length <= decimalPoint) {
+            append(next, result, length);
+            for (int j = 0; j < decimalPoint - length; j++)
+                *next++ = '0';
+        } else {
+            append(next, result, decimalPoint);
+            *next++ = '.';
+            append(next, result + decimalPoint, length - decimalPoint);
+        }
+    } else if (result[0] < '0' || result[0] > '9')
+        append(next, result, length);
+    else {
+        *next++ = result[0];
+        if (length > 1) {
+            *next++ = '.';
+            append(next, result + 1, length - 1);
+        }
+
+        *next++ = 'e';
+        *next++ = (decimalPoint >= 0) ? '+' : '-';
+        // decimalPoint can't be more than 3 digits decimal given the
+        // nature of float representation
+        int exponential = decimalPoint - 1;
+        if (exponential < 0)
+            exponential = -exponential;
+        if (exponential >= 100)
+            *next++ = static_cast<char>('0' + exponential / 100);
+        if (exponential >= 10)
+            *next++ = static_cast<char>('0' + (exponential % 100) / 10);
+        *next++ = static_cast<char>('0' + exponential % 10);
+    }
+    if (resultLength)
+        *resultLength = next - buffer;
+}
+
 } // namespace WTF
diff --git a/JavaScriptCore/wtf/dtoa.h b/JavaScriptCore/wtf/dtoa.h
index cbec7c7..6127f53 100644
--- a/JavaScriptCore/wtf/dtoa.h
+++ b/JavaScriptCore/wtf/dtoa.h
@@ -30,8 +30,18 @@ namespace WTF {
     extern WTF::Mutex* s_dtoaP5Mutex;
 
     double strtod(const char* s00, char** se);
-    void dtoa(char* result, double d, int ndigits, int* decpt, int* sign, char** rve);
+
+    typedef char DtoaBuffer[80];
+    void dtoa(DtoaBuffer result, double d, int ndigits, int* decpt, int* sign, char** rve);
+
+    // dtoa() for ECMA-262 'ToString Applied to the Number Type.'
+    // The *resultLength will have the length of the resultant string in bufer.
+    // The resultant string isn't terminated by 0.
+    void doubleToStringInJavaScriptFormat(double, DtoaBuffer, unsigned* resultLength);
 
 } // namespace WTF
 
+using WTF::DtoaBuffer;
+using WTF::doubleToStringInJavaScriptFormat;
+
 #endif // WTF_dtoa_h
diff --git a/JavaScriptCore/wtf/GOwnPtr.cpp b/JavaScriptCore/wtf/gtk/GOwnPtr.cpp
index 432885f..8999962 100644
--- a/JavaScriptCore/wtf/GOwnPtr.cpp
+++ b/JavaScriptCore/wtf/gtk/GOwnPtr.cpp
@@ -19,6 +19,8 @@
 #include "config.h"
 #include "GOwnPtr.h"
 
+#include <glib.h>
+
 namespace WTF {
 
 template <> void freeOwnedGPtr<GError>(GError* ptr)
diff --git a/JavaScriptCore/wtf/gtk/GOwnPtr.h b/JavaScriptCore/wtf/gtk/GOwnPtr.h
new file mode 100644
index 0000000..ad2c30e
--- /dev/null
+++ b/JavaScriptCore/wtf/gtk/GOwnPtr.h
@@ -0,0 +1,146 @@
+/*
+ *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008 Collabora Ltd.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef GOwnPtr_h
+#define GOwnPtr_h
+
+#include <algorithm>
+#include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
+
+// Forward delcarations at this point avoid the need to include GLib includes
+// in WTF headers.
+typedef struct _GError GError;
+typedef struct _GList GList;
+typedef struct _GCond GCond;
+typedef struct _GMutex GMutex;
+typedef struct _GPatternSpec GPatternSpec;
+typedef struct _GDir GDir;
+typedef struct _GHashTable GHashTable;
+extern "C" void g_free(void*);
+
+namespace WTF {
+
+template <typename T> inline void freeOwnedGPtr(T* ptr);
+template<> void freeOwnedGPtr<GError>(GError*);
+template<> void freeOwnedGPtr<GList>(GList*);
+template<> void freeOwnedGPtr<GCond>(GCond*);
+template<> void freeOwnedGPtr<GMutex>(GMutex*);
+template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
+template<> void freeOwnedGPtr<GDir>(GDir*);
+template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
+
+template <typename T> class GOwnPtr : public Noncopyable {
+public:
+    explicit GOwnPtr(T* ptr = 0) : m_ptr(ptr) { }
+    ~GOwnPtr() { freeOwnedGPtr(m_ptr); }
+
+    T* get() const { return m_ptr; }
+    T* release()
+    {
+        T* ptr = m_ptr;
+        m_ptr = 0;
+        return ptr;
+    }
+
+    T*& outPtr()
+    {
+        ASSERT(!m_ptr);
+        return m_ptr;
+    }
+
+    void set(T* ptr)
+    {
+        ASSERT(!ptr || m_ptr != ptr);
+        freeOwnedGPtr(m_ptr);
+        m_ptr = ptr;
+    }
+
+    void clear()
+    {
+        freeOwnedGPtr(m_ptr);
+        m_ptr = 0;
+    }
+
+    T& operator*() const
+    {
+        ASSERT(m_ptr);
+        return *m_ptr;
+    }
+
+    T* operator->() const
+    {
+        ASSERT(m_ptr);
+        return m_ptr;
+    }
+
+    bool operator!() const { return !m_ptr; }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+    typedef T* GOwnPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return m_ptr ? &GOwnPtr::m_ptr : 0; }
+
+    void swap(GOwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
+
+private:
+    T* m_ptr;
+};
+
+template <typename T> inline void swap(GOwnPtr<T>& a, GOwnPtr<T>& b)
+{
+    a.swap(b);
+}
+
+template <typename T, typename U> inline bool operator==(const GOwnPtr<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const GOwnPtr<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const GOwnPtr<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const GOwnPtr<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+template <typename T> inline typename GOwnPtr<T>::PtrType getPtr(const GOwnPtr<T>& p)
+{
+    return p.get();
+}
+
+template <typename T> inline void freeOwnedGPtr(T* ptr)
+{
+    g_free(ptr);
+}
+
+} // namespace WTF
+
+using WTF::GOwnPtr;
+
+#endif // GOwnPtr_h
diff --git a/JavaScriptCore/wtf/unicode/UTF8.cpp b/JavaScriptCore/wtf/unicode/UTF8.cpp
index 9e713fe..21d5856 100644
--- a/JavaScriptCore/wtf/unicode/UTF8.cpp
+++ b/JavaScriptCore/wtf/unicode/UTF8.cpp
@@ -23,6 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "UTF8.h"
 
 namespace WTF {
diff --git a/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp b/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
index a779b36..e20c376 100644
--- a/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
+++ b/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
@@ -19,6 +19,7 @@
  *
  */
 
+#include "config.h"
 #include "UnicodeGLib.h"
 
 namespace WTF {
diff --git a/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h b/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
index c03d3ec..d72e707 100644
--- a/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
+++ b/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
@@ -26,7 +26,7 @@
 #define UnicodeGLib_h
 
 #include "UnicodeMacrosFromICU.h"
-#include <wtf/GOwnPtr.h>
+#include <wtf/gtk/GOwnPtr.h>
 
 #include <glib.h>
 #include <pango/pango.h>
@@ -152,6 +152,11 @@ inline bool isArabicChar(UChar32 c)
     return c >= 0x0600 && c <= 0x06FF;
 }
 
+inline bool isAlphanumeric(UChar32 c)
+{
+    return g_unichar_isalnum(c);
+}
+
 inline bool isFormatChar(UChar32 c)
 {
     return g_unichar_type(c) == G_UNICODE_FORMAT;
diff --git a/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h b/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
index 35c6fbf..a2a5c0a 100644
--- a/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+++ b/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
@@ -164,6 +164,11 @@ inline bool isArabicChar(UChar32 c)
       return ublock_getCode(c) == UBLOCK_ARABIC;
 }
 
+inline bool isAlphanumeric(UChar32 c)
+{
+    return u_isalnum(c);
+}
+
 inline bool isSeparatorSpace(UChar32 c)
 {
     return u_charType(c) == U_SPACE_SEPARATOR;
diff --git a/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index bdf2028..cfd482d 100644
--- a/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -30,7 +30,6 @@
 
 #include <stdint.h>
 
-#if QT_VERSION >= 0x040300
 QT_BEGIN_NAMESPACE
 namespace QUnicodeTables {
     struct Properties {
@@ -55,7 +54,6 @@ namespace QUnicodeTables {
     Q_CORE_EXPORT const Properties * QT_FASTCALL properties(ushort ucs2);
 }
 QT_END_NAMESPACE
-#endif
 
 // ugly hack to make UChar compatible with JSChar in API/JSStringRef.h
 #if defined(Q_OS_WIN) || COMPILER(WINSCW)
@@ -186,8 +184,6 @@ enum CharCategory {
 };
 
 
-#if QT_VERSION >= 0x040300
-
 // FIXME: handle surrogates correctly in all methods
 
 inline UChar32 toLower(UChar32 ch)
@@ -406,138 +402,6 @@ inline CharCategory category(UChar32 c)
     return (CharCategory) U_MASK(QChar::category(c));
 }
 
-#else
-
-inline UChar32 toLower(UChar32 ch)
-{
-    if (ch > 0xffff)
-        return ch;
-    return QChar((unsigned short)ch).toLower().unicode();
-}
-
-inline int toLower(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-  *error = false;
-  if (resultLength < srcLength) {
-    *error = true;
-    return srcLength;
-  }
-  for (int i = 0; i < srcLength; ++i)
-    result[i] = QChar(src[i]).toLower().unicode();
-  return srcLength;
-}
-
-inline UChar32 toUpper(UChar32 ch)
-{
-    if (ch > 0xffff)
-        return ch;
-    return QChar((unsigned short)ch).toUpper().unicode();
-}
-
-inline int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-    *error = false;
-    if (resultLength < srcLength) {
-        *error = true;
-        return srcLength;
-    }
-    for (int i = 0; i < srcLength; ++i)
-        result[i] = QChar(src[i]).toUpper().unicode();
-    return srcLength;
-}
-
-inline int toTitleCase(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar((unsigned short)c).toUpper().unicode();
-}
-
-inline UChar32 foldCase(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar((unsigned short)c).toLower().unicode();
-}
-
-inline int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-    return toLower(result, resultLength, src, srcLength, error);
-}
-
-inline bool isPrintableChar(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).isPrint();
-}
-
-inline bool isArabicChar(UChar32 c)
-{
-    return c >= 0x0600 && c <= 0x06FF;
-}
-
-inline bool isSeparatorSpace(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).category() == QChar::Separator_Space;
-}
-
-inline bool isPunct(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).isPunct();
-}
-
-inline bool isLower(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).category() == QChar::Letter_Lowercase;
-}
-
-inline UChar32 mirroredChar(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar(c).mirroredChar().unicode();
-}
-
-inline uint8_t combiningClass(UChar32 c)
-{
-    if (c > 0xffff)
-        return 0;
-    return QChar((unsigned short)c).combiningClass();
-}
-
-inline DecompositionType decompositionType(UChar32 c)
-{
-    if (c > 0xffff)
-        return DecompositionNone;
-    return (DecompositionType)QChar(c).decompositionTag();
-}
-
-inline int umemcasecmp(const UChar* a, const UChar* b, int len)
-{
-    for (int i = 0; i < len; ++i) {
-        QChar c1 = QChar(a[i]).toLower();
-        QChar c2 = QChar(b[i]).toLower();
-        if (c1 != c2)
-        return c1.unicode() - c2.unicode();
-    }
-    return 0;
-}
-
-inline Direction direction(UChar32 c)
-{
-    if (c > 0xffff)
-        return LeftToRight;
-    return (Direction)QChar(c).direction();
-}
-
-inline CharCategory category(UChar32 c)
-{
-    if (c > 0xffff)
-        return NoCategory;
-    return (CharCategory) U_MASK(QChar(c).category());
-}
-
-#endif
-
 } }
 
 #endif // WTF_UNICODE_QT4_H
diff --git a/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp b/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
index 966f2a1..2df44f8 100644
--- a/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
+++ b/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
@@ -19,6 +19,7 @@
  *  Boston, MA 02110-1301, USA.
  */
 
+#include "config.h"
 #include "UnicodeWince.h"
 
 #include <wchar.h>
diff --git a/JavaScriptCore/wtf/wince/FastMallocWince.h b/JavaScriptCore/wtf/wince/FastMallocWince.h
index 93d9f75..37174f0 100644
--- a/JavaScriptCore/wtf/wince/FastMallocWince.h
+++ b/JavaScriptCore/wtf/wince/FastMallocWince.h
@@ -1,5 +1,4 @@
 /*
- *  This file is part of the KDE libraries
  *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved
  *
diff --git a/JavaScriptCore/yarr/RegexPattern.h b/JavaScriptCore/yarr/RegexPattern.h
index a451131..dd7512d 100644
--- a/JavaScriptCore/yarr/RegexPattern.h
+++ b/JavaScriptCore/yarr/RegexPattern.h
@@ -137,7 +137,7 @@ struct PatternTerm {
 
     PatternTerm(unsigned spatternId)
         : type(TypeBackReference)
-        , invertOrCapture(invertOrCapture)
+        , invertOrCapture(false)
     {
         subpatternId = spatternId;
         quantityType = QuantifierFixedCount;
diff --git a/JavaScriptGlue/ChangeLog b/JavaScriptGlue/ChangeLog
index 7a8598a..95cce28 100644
--- a/JavaScriptGlue/ChangeLog
+++ b/JavaScriptGlue/ChangeLog
@@ -1,3 +1,49 @@
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Removed.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Added.
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * JavaScriptGlue.xcodeproj/project.pbxproj:
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        Added the use jsc define for files that use
+        this config file and DateMath.h. This should
+        be able to go away when DateMath is properly
+        split into wtf and jsc portions which is this bug:
+        https://bugs.webkit.org/show_bug.cgi?id=31246
+
+        * config.h:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+        
+        * ForwardingHeaders/wtf/CurrentTime.h: Added.
+
 2009-10-27  Geoffrey Garen  <ggaren@apple.com>
 
         Build fix: Updated for JavaScriptCore export changes.
diff --git a/JavaScriptGlue/Configurations/Version.xcconfig b/JavaScriptGlue/Configurations/Version.xcconfig
index fabc009..b3bf41d 100644
--- a/JavaScriptGlue/Configurations/Version.xcconfig
+++ b/JavaScriptGlue/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 4;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/JavaScriptGlue/ForwardingHeaders/wtf/CurrentTime.h b/JavaScriptGlue/ForwardingHeaders/wtf/CurrentTime.h
new file mode 100644
index 0000000..a31a23d
--- /dev/null
+++ b/JavaScriptGlue/ForwardingHeaders/wtf/CurrentTime.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/CurrentTime.h>
diff --git a/JavaScriptGlue/JavaScriptGlue.xcodeproj/project.pbxproj b/JavaScriptGlue/JavaScriptGlue.xcodeproj/project.pbxproj
index f40be08..80c895a 100644
--- a/JavaScriptGlue/JavaScriptGlue.xcodeproj/project.pbxproj
+++ b/JavaScriptGlue/JavaScriptGlue.xcodeproj/project.pbxproj
@@ -341,7 +341,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\ntouch \"$SRCROOT/Info.plist\"\n";
+			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\nif [[ \"${CONFIGURATION}\" != \"Production\" ]]; then\n    touch \"$SRCROOT/Info.plist\";\nfi;\n";
 		};
 		5DA0F0C00DC2B48900EA22B4 /* Remove Headers If Needed */ = {
 			isa = PBXShellScriptBuildPhase;
diff --git a/JavaScriptGlue/config.h b/JavaScriptGlue/config.h
index fdbd4ae..88bbb9a 100644
--- a/JavaScriptGlue/config.h
+++ b/JavaScriptGlue/config.h
@@ -4,4 +4,17 @@
 
 #include <wtf/Platform.h>
 
+#if PLATFORM(CHROMIUM)
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 1
+#endif
+#endif /* PLATFORM(CHROMIUM) */
+
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 0
+#endif /* !defined(WTF_USE_V8) */
+
+/* Using V8 implies not using JSC and vice versa */
+#define WTF_USE_JSC !WTF_USE_V8
+
 #define JS_EXPORTDATA
diff --git a/WebCore/Android.derived.jscbindings.mk b/WebCore/Android.derived.jscbindings.mk
index 2eb19f5..a589bba 100644
--- a/WebCore/Android.derived.jscbindings.mk
+++ b/WebCore/Android.derived.jscbindings.mk
@@ -49,7 +49,11 @@ js_binding_scripts := $(addprefix $(LOCAL_PATH)/,\
 			bindings/scripts/generate-bindings.pl \
 		)
 
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
 FEATURE_DEFINES := ENABLE_ORIENTATION_EVENTS=1 ENABLE_TOUCH_EVENTS=1 ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1 ENABLE_DOM_STORAGE=1 ENABLE_VIDEO=1 ENABLE_WORKERS=1 ENABLE_GEOLOCATION=1 ENABLE_CHANNEL_MESSAGING=1
+=======
+FEATURE_DEFINES := ANDROID_ORIENTATION_SUPPORT ENABLE_TOUCH_EVENTS=1 ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1 ENABLE_DOM_STORAGE=1 ENABLE_VIDEO=1 ENABLE_WORKERS=1 ENABLE_GEOLOCATION=1 ENABLE_CHANNEL_MESSAGING=1
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
 
 # CSS
 GEN := \
@@ -132,9 +136,12 @@ GEN := \
     $(intermediates)/dom/JSRangeException.h \
     $(intermediates)/dom/JSText.h \
     $(intermediates)/dom/JSTextEvent.h \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/dom/JSTouch.h \
     $(intermediates)/dom/JSTouchEvent.h \
     $(intermediates)/dom/JSTouchList.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/dom/JSTreeWalker.h \
     $(intermediates)/dom/JSUIEvent.h \
     $(intermediates)/dom/JSWebKitAnimationEvent.h \
@@ -245,6 +252,7 @@ $(patsubst %.h,%.cpp,$(GEN)): $(intermediates)/html/%.cpp : $(intermediates)/htm
 
 # Canvas
 GEN := \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasActiveInfo.h \
     $(intermediates)/html/canvas/JSCanvasArray.h \
     $(intermediates)/html/canvas/JSCanvasArrayBuffer.h \
@@ -252,13 +260,22 @@ GEN := \
     $(intermediates)/html/canvas/JSCanvasByteArray.h \
     $(intermediates)/html/canvas/JSCanvasFloatArray.h \
     $(intermediates)/html/canvas/JSCanvasFramebuffer.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasGradient.h \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasIntArray.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasNumberArray.h \
     $(intermediates)/html/canvas/JSCanvasPattern.h \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasProgram.h \
     $(intermediates)/html/canvas/JSCanvasRenderbuffer.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasRenderingContext.h \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasRenderingContext2D.h \
     $(intermediates)/html/canvas/JSCanvasRenderingContext3D.h \
     $(intermediates)/html/canvas/JSCanvasShader.h \
@@ -267,6 +284,9 @@ GEN := \
     $(intermediates)/html/canvas/JSCanvasUnsignedByteArray.h \
     $(intermediates)/html/canvas/JSCanvasUnsignedIntArray.h \
     $(intermediates)/html/canvas/JSCanvasUnsignedShortArray.h
+=======
+    $(intermediates)/html/canvas/JSCanvasRenderingContext2D.h
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
 
 $(GEN): PRIVATE_PATH := $(LOCAL_PATH)
 $(GEN): PRIVATE_CUSTOM_TOOL = perl -I$(PRIVATE_PATH)/bindings/scripts $(PRIVATE_PATH)/bindings/scripts/generate-bindings.pl --defines "$(FEATURE_DEFINES) LANGUAGE_JAVASCRIPT" --generator JS --include dom --include html --outputdir $(dir $@) $<
diff --git a/WebCore/Android.derived.v8bindings.mk b/WebCore/Android.derived.v8bindings.mk
index e0b5d98..8b2ca0c 100644
--- a/WebCore/Android.derived.v8bindings.mk
+++ b/WebCore/Android.derived.v8bindings.mk
@@ -30,7 +30,11 @@ js_binding_scripts := \
 	$(LOCAL_PATH)/bindings/scripts/IDLStructure.pm \
 	$(LOCAL_PATH)/bindings/scripts/generate-bindings.pl
 
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
 FEATURE_DEFINES := ENABLE_ORIENTATION_EVENTS=1 ENABLE_TOUCH_EVENTS=1 V8_BINDING ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1 ENABLE_DOM_STORAGE=1 ENABLE_VIDEO=1 ENABLE_WORKERS=1 ENABLE_GEOLOCATION=1
+=======
+FEATURE_DEFINES := ANDROID_ORIENTATION_SUPPORT ENABLE_TOUCH_EVENTS=1 V8_BINDING ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1 ENABLE_DOM_STORAGE=1 ENABLE_VIDEO=1 ENABLE_WORKERS=1 ENABLE_GEOLOCATION=1
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
 
 # CSS
 GEN := \
@@ -114,9 +118,12 @@ GEN := \
     $(intermediates)/bindings/V8RangeException.h \
     $(intermediates)/bindings/V8Text.h \
     $(intermediates)/bindings/V8TextEvent.h \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8Touch.h \
     $(intermediates)/bindings/V8TouchEvent.h \
     $(intermediates)/bindings/V8TouchList.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8TreeWalker.h \
     $(intermediates)/bindings/V8UIEvent.h \
     $(intermediates)/bindings/V8WebKitAnimationEvent.h \
@@ -228,6 +235,7 @@ $(patsubst %.h,%.cpp,$(GEN)): $(intermediates)/bindings/%.cpp : $(intermediates)
 
 # Canvas
 GEN := \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasActiveInfo.h \
     $(intermediates)/bindings/V8CanvasArray.h \
     $(intermediates)/bindings/V8CanvasArrayBuffer.h \
@@ -235,14 +243,23 @@ GEN := \
     $(intermediates)/bindings/V8CanvasByteArray.h \
     $(intermediates)/bindings/V8CanvasFloatArray.h \
     $(intermediates)/bindings/V8CanvasFramebuffer.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasGradient.h \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasIntArray.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasNumberArray.h \
     $(intermediates)/bindings/V8CanvasPattern.h \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasPixelArray.h \
     $(intermediates)/bindings/V8CanvasProgram.h \
     $(intermediates)/bindings/V8CanvasRenderbuffer.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasRenderingContext.h \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasRenderingContext2D.h \
     $(intermediates)/bindings/V8CanvasRenderingContext3D.h \
     $(intermediates)/bindings/V8CanvasShader.h \
@@ -251,6 +268,9 @@ GEN := \
     $(intermediates)/bindings/V8CanvasUnsignedByteArray.h \
     $(intermediates)/bindings/V8CanvasUnsignedIntArray.h \
     $(intermediates)/bindings/V8CanvasUnsignedShortArray.h
+=======
+    $(intermediates)/bindings/V8CanvasRenderingContext2D.h
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
 
 $(GEN): PRIVATE_PATH := $(LOCAL_PATH)
 $(GEN): PRIVATE_CUSTOM_TOOL = SOURCE_ROOT=$(PRIVATE_PATH) perl -I$(PRIVATE_PATH)/bindings/scripts $(PRIVATE_PATH)/bindings/scripts/generate-bindings.pl --defines "$(FEATURE_DEFINES) LANGUAGE_JAVASCRIPT" --generator V8 --include dom --include html --include html/canvas --outputdir $(dir $@) $<
diff --git a/WebCore/Android.jscbindings.mk b/WebCore/Android.jscbindings.mk
index 0eaff05..981894c 100644
--- a/WebCore/Android.jscbindings.mk
+++ b/WebCore/Android.jscbindings.mk
@@ -66,6 +66,7 @@ LOCAL_SRC_FILES += \
 	bindings/js/JSCSSStyleDeclarationCustom.cpp \
 	bindings/js/JSCSSValueCustom.cpp \
 	bindings/js/JSCallbackData.cpp \
+<<<<<<< HEAD:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasArrayBufferConstructor.cpp \
 	bindings/js/JSCanvasArrayCustom.cpp \
 	bindings/js/JSCanvasByteArrayConstructor.cpp \
@@ -74,10 +75,16 @@ LOCAL_SRC_FILES += \
 	bindings/js/JSCanvasFloatArrayCustom.cpp \
 	bindings/js/JSCanvasIntArrayConstructor.cpp \
 	bindings/js/JSCanvasIntArrayCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasNumberArrayCustom.cpp \
 	bindings/js/JSCanvasRenderingContext2DCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasRenderingContext3DCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasRenderingContextCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasShortArrayConstructor.cpp \
 	bindings/js/JSCanvasShortArrayCustom.cpp \
 	bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp \
@@ -86,6 +93,8 @@ LOCAL_SRC_FILES += \
 	bindings/js/JSCanvasUnsignedIntArrayCustom.cpp \
 	bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp \
 	bindings/js/JSCanvasUnsignedShortArrayCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.jscbindings.mk
 	bindings/js/JSClipboardCustom.cpp \
 	bindings/js/JSConsoleCustom.cpp \
 	bindings/js/JSCoordinatesCustom.cpp \
@@ -186,7 +195,10 @@ LOCAL_SRC_FILES += \
 	bindings/js/ScriptCallFrame.cpp \
 	bindings/js/ScriptCallStack.cpp \
 	bindings/js/ScriptController.cpp \
+<<<<<<< HEAD:WebCore/Android.jscbindings.mk
 	bindings/js/ScriptControllerAndroid.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.jscbindings.mk
 	bindings/js/ScriptEventListener.cpp \
 	bindings/js/ScriptFunctionCall.cpp \
 	bindings/js/ScriptObject.cpp \
diff --git a/WebCore/Android.mk b/WebCore/Android.mk
index 880b4c3..5b2de3d 100644
--- a/WebCore/Android.mk
+++ b/WebCore/Android.mk
@@ -104,7 +104,10 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/CharacterData.cpp \
 	dom/CheckedRadioButtons.cpp \
 	dom/ChildNodeList.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	dom/ClassNames.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	dom/ClassNodeList.cpp \
 	dom/ClientRect.cpp \
 	dom/ClientRectList.cpp \
@@ -160,15 +163,22 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/ScriptExecutionContext.cpp \
 	dom/SelectElement.cpp \
 	dom/SelectorNodeList.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
+=======
+	dom/SpaceSplitString.cpp \
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	dom/StaticNodeList.cpp \
 	dom/StyleElement.cpp \
 	dom/StyledElement.cpp \
 	dom/TagNodeList.cpp \
 	dom/Text.cpp \
 	dom/TextEvent.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	dom/Touch.cpp \
 	dom/TouchEvent.cpp \
 	dom/TouchList.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	dom/Traversal.cpp \
 	dom/TreeWalker.cpp \
 	dom/UIEvent.cpp \
@@ -260,30 +270,45 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	html/TimeRanges.cpp \
 	html/ValidityState.cpp \
 	\
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasArray.cpp \
 	html/canvas/CanvasArrayBuffer.cpp \
 	html/canvas/CanvasBuffer.cpp \
 	html/canvas/CanvasByteArray.cpp \
 	html/canvas/CanvasFloatArray.cpp \
 	html/canvas/CanvasFramebuffer.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	html/canvas/CanvasGradient.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasIntArray.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	html/canvas/CanvasNumberArray.cpp \
 	html/canvas/CanvasObject.cpp \
 	html/canvas/CanvasPattern.cpp \
 	html/canvas/CanvasPixelArray.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasProgram.cpp \
 	html/canvas/CanvasRenderbuffer.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	html/canvas/CanvasRenderingContext.cpp \
 	html/canvas/CanvasRenderingContext2D.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasRenderingContext3D.cpp \
 	html/canvas/CanvasShader.cpp \
 	html/canvas/CanvasShortArray.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	html/canvas/CanvasStyle.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasTexture.cpp \
 	html/canvas/CanvasUnsignedByteArray.cpp \
 	html/canvas/CanvasUnsignedIntArray.cpp \
 	html/canvas/CanvasUnsignedShortArray.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	\
 	loader/Cache.cpp \
 	loader/CachedCSSStyleSheet.cpp \
@@ -460,6 +485,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/graphics/SegmentedFontData.cpp \
 	platform/graphics/SimpleFontData.cpp \
 	platform/graphics/StringTruncator.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	platform/graphics/WidthIterator.cpp \
 	\
 	platform/graphics/android/BitmapAllocatorAndroid.cpp \
@@ -479,6 +505,9 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/graphics/android/PlatformGraphicsContext.cpp \
 	platform/graphics/android/SharedBufferStream.cpp \
 	platform/graphics/android/android_graphics.cpp \
+=======
+	platform/graphics/WidthIterator.cpp
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 
 ifeq ($(ENABLE_SVG), true)
 LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
@@ -526,11 +555,15 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/network/ResourceHandle.cpp \
 	platform/network/ResourceRequestBase.cpp \
 	platform/network/ResourceResponseBase.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	\
 	platform/network/android/Cookie.cpp \
 	platform/network/android/NetworkStateNotifierAndroid.cpp \
 	platform/network/android/ResourceHandleAndroid.cpp \
 	platform/network/android/ResourceRequestAndroid.cpp \
+=======
+	platform/network/SocketStreamHandleBase.cpp \
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	\
 	platform/posix/FileSystemPOSIX.cpp \
 	\
@@ -550,7 +583,10 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/text/String.cpp \
 	platform/text/StringBuilder.cpp \
 	platform/text/StringImpl.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	platform/text/TextBoundariesICU.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	platform/text/TextBreakIteratorICU.cpp \
 	platform/text/TextCodec.cpp \
 	platform/text/TextCodecICU.cpp \
@@ -578,10 +614,13 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	plugins/PluginView.cpp \
 	plugins/npapi.cpp \
 	\
+<<<<<<< HEAD:WebCore/Android.mk
 	plugins/android/PluginDataAndroid.cpp \
 	plugins/android/PluginPackageAndroid.cpp \
 	plugins/android/PluginViewAndroid.cpp \
 	\
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	rendering/AutoTableLayout.cpp \
 	rendering/CounterNode.cpp \
 	rendering/EllipsisBox.cpp \
diff --git a/WebCore/Android.v8bindings.mk b/WebCore/Android.v8bindings.mk
index f683fca..7d028ea 100644
--- a/WebCore/Android.v8bindings.mk
+++ b/WebCore/Android.v8bindings.mk
@@ -88,17 +88,23 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8AbstractWorkerCustom.cpp \
 	bindings/v8/custom/V8AttrCustom.cpp \
 	bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8CanvasArrayBufferCustom.cpp \
 	bindings/v8/custom/V8CanvasByteArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasFloatArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasIntArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasPixelArrayCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp \
 	bindings/v8/custom/V8CanvasShortArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8ClientRectListCustom.cpp \
 	bindings/v8/custom/V8ClipboardCustom.cpp \
 	bindings/v8/custom/V8CoordinatesCustom.cpp \
@@ -166,7 +172,10 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8SharedWorkerCustom.cpp \
 	bindings/v8/custom/V8StorageCustom.cpp \
 	bindings/v8/custom/V8StyleSheetListCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8TouchListCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8TreeWalkerCustom.cpp \
 	bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp \
 	bindings/v8/custom/V8WebKitPointConstructor.cpp \
@@ -178,5 +187,9 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8XMLSerializerConstructor.cpp
 
 LOCAL_SRC_FILES += \
+<<<<<<< HEAD:WebCore/Android.v8bindings.mk
 	bridge/jni/jni_utility.cpp \
 	bridge/jni/v8/jni_utility_private.cpp
+=======
+	bridge/jni/jni_utility.cpp
+>>>>>>> webkit.org at r51976:WebCore/Android.v8bindings.mk
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 1727089..67567ab 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16674 @@
+2009-12-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32140
+        REGRESSION(r50072): Mailman administrative functionality is broken
+
+        Test: http/tests/misc/percent-sign-in-form-field-name.html
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::appendQuotedString): Don't encode percent
+        sign, we never had a good reason to do that.
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove getPropertyAttributes() from JavaScript bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        The functionality is provided by getOwnPropertyDescriptor().
+
+        * WebCore.order:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Changed WebGLRenderingContext to synthesize GL errors rather than
+        raising JavaScript exceptions. Removed internal getError() calls
+        after each graphics call. The GraphicsContext3D maintains the
+        synthetic exceptions because only it has complete information
+        about certain conditions requiring them to be raised.
+
+        Based on idea from Ilmari Heikkinen, added create3DDebugContext()
+        to webgl-test.js and changed the WebGL layout tests expecting
+        error conditions to use it. Updated expected.txt files, which now
+        implicitly test the OpenGL error as it is part of the exception's
+        message.
+
+        Added new targeted test covering aspects of synthetic errors as
+        well as regression tests for bugs uncovered during its development.
+
+        Test: fast/canvas/webgl/error-reporting.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::attachShader):
+        (WebCore::WebGLRenderingContext::bindAttribLocation):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::compileShader):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::detachShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
+        (WebCore::WebGLRenderingContext::framebufferTexture2D):
+        (WebCore::WebGLRenderingContext::getActiveAttrib):
+        (WebCore::WebGLRenderingContext::getActiveUniform):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::linkProgram):
+        (WebCore::WebGLRenderingContext::shaderSource):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for assert on Chrome/skia with SVG Filters enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32394
+
+        Covered by LayoutTests/svg/W3C-SVG-1.1/filters-tile-01-b.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): With 2 highlighted lines of text in gmail/hotmail selecting Bold selects other 2 edit buttons automatically.
+        <rdar://problem/7442065>
+        https://bugs.webkit.org/show_bug.cgi?id=32285
+
+        When examining the styles of the nodes after the first in a range selection, we take into
+        cosideration differences in style of txt nodes only.
+        
+        Test: editing/execCommand/queryCommandState-02.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionHasStyle):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
+        https://bugs.webkit.org/show_bug.cgi?id=31576
+
+        Add a RefCounted wrapper object around xmlParserCtxtPtr so we can
+        maintain it's lifetime more effectively.
+
+        Test: fast/parser/xhtml-close-while-parsing.xhtml
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::popCurrentNode):
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLParserContext::context):
+        (WebCore::XMLParserContext::XMLParserContext):
+        (WebCore::XMLTokenizer::context):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLParserContext::createStringParser):
+        (WebCore::XMLParserContext::createMemoryParser):
+        (WebCore::XMLParserContext::~XMLParserContext):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::lineNumber):
+        (WebCore::XMLTokenizer::columnNumber):
+        (WebCore::XMLTokenizer::stopParsing):
+        (WebCore::parseXMLDocumentFragment):
+        (WebCore::parseAttributes):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: debugger shortcuts don't work when
+        Search field or Console drawer has focus.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32392
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.documentKeyUp):
+        (WebInspector.searchKeyDown):
+
+2009-12-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Events created in isolated worlds may fire in main world.
+        https://bugs.webkit.org/show_bug.cgi?id=32386
+
+        Test: http/tests/security/isolatedWorld/events.html
+
+        * WebCore.gypi: Added WorldContextHandle.
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Added WorldContextHandle params.
+        * bindings/v8/SharedPersistent.h: Fixed a few style/include issues.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Added WorldContextHandle params.
+        (WebCore::V8AbstractEventListener::handleEvent): Adjusted context retrieval to use WorldContextHandle.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::worldContext): Added WorldContextHandle params.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Ditto.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Ditto.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Adjusted context retrieval to use WorldContextHandle.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::context): Refactored to use mainWorldContext();
+        (WebCore::V8Proxy::mainWorldContext): Added.
+        (WebCore::toV8Context): Changed to use WorldContextHandle.
+        * bindings/v8/V8Proxy.h: Added mainWorldContext decl.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException): Added an extra check to avoid crashes during frame teardown.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Added WorldContextHandle params.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/WorldContextHandle.cpp: Added.
+        * bindings/v8/WorldContextHandle.h: Added.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Added WorldContextHandle params.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Added WorldContextHandle params.
+
+2009-12-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Pass more information about a plug-in to the PluginHalterDelegate
+
+        Reviewed by Adam Roben.
+
+        * loader/EmptyClients.h:
+        Remove this unused class.
+
+        * page/HaltablePlugin.h:
+        Add new functions to return the plug-in's name and whether it is
+        windowed.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::timerFired):
+        Pass new arguments to the client.
+
+        * page/PluginHalterClient.h:
+        Add new parameters.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::pluginName):
+        Return the name from the PluginPackage.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isWindowed):
+
+2009-12-09  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31738>.
+        Web Inspector: Console Scope Bar should be on top of console when Console is a Panel.
+        
+        When the console is set to be shown as a full panel, move the scope bar to the top
+        where it looks best. When it is only shown as a drawer, move it to the bottom, where
+        it originally was. This takes up less space as a drawer, and makes it more discoverable
+        and usable when it is the full panel.
+
+        * inspector/front-end/ConsolePanel.js:
+        (WebInspector.ConsolePanel.prototype.show): Move filter bar to top.
+        (WebInspector.ConsolePanel.prototype.hide): Move filter bar back to bottom.
+        * inspector/front-end/inspector.css:
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Fix for alpha blending in SVG Filters on Chromium/skia.
+        https://bugs.webkit.org/show_bug.cgi?id=32378
+
+        Covered by LayoutTests/svg/filters/feGaussianBlur.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add context menu actions for DOM tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32348
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextMenu):
+        (WebInspector.ContextMenu.prototype.show):
+        (WebInspector.ContextMenu.prototype.appendItem):
+        (WebInspector.ContextMenu.prototype.appendSeparator):
+        (WebInspector.ContextMenu.prototype._itemSelected):
+        (WebInspector.contextMenuItemSelected):
+        (WebInspector.contextMenuCleared):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout):
+        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent):
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._populateTextContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.ondblclick):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector.contextMenuEventFired):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.treeElementDoubleClicked):
+
+2009-12-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Filters contain some leaks in untested code
+        https://bugs.webkit.org/show_bug.cgi?id=32325
+
+        Fix obvious leak in SVGFE*Lighting classes. Implement the create() idiom for 
+        all classes in svg/graphics, that were missing it. The lighting filters aren't
+        implemented so far, but the associated FilterEffect objects are build, which created
+        these leaks.
+
+        This removes the SVG related failures in the leaks bot.
+
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::findLights):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDistantLightElement.cpp:
+        (WebCore::SVGFEDistantLightElement::lightSource):
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEPointLightElement.cpp:
+        (WebCore::SVGFEPointLightElement::lightSource):
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::findLights):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFESpotLightElement.cpp:
+        (WebCore::SVGFESpotLightElement::lightSource):
+        * svg/SVGFESpotLightElement.h:
+        * svg/graphics/filters/SVGDistantLightSource.h:
+        (WebCore::DistantLightSource::create):
+        (WebCore::DistantLightSource::DistantLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::FEDiffuseLighting):
+        (WebCore::FEDiffuseLighting::create):
+        (WebCore::FEDiffuseLighting::setLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::FESpecularLighting):
+        (WebCore::FESpecularLighting::create):
+        (WebCore::FESpecularLighting::setLightSource):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGLightSource.h:
+        * svg/graphics/filters/SVGPointLightSource.h:
+        (WebCore::PointLightSource::create):
+        (WebCore::PointLightSource::PointLightSource):
+        * svg/graphics/filters/SVGSpotLightSource.h:
+        (WebCore::SpotLightSource::create):
+        (WebCore::SpotLightSource::SpotLightSource):
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Chromium] SporeViewer demo doesn't work in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32364
+
+        Test: fast/canvas/webgl/bug-32364.html
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+
+2009-12-09  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32346 SVG property 
+        -webkit-shadow should apply shadow on the result after compositing
+        -and corresponding-
+        <rdar://problem/7389404>
+
+        Set a transparency layer when setting a shadow to apply the shadow 
+        to the composite.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32332
+        WebSocket events should be dispatched synchronously
+
+        Updated websocket/tests/simple to test for the new behavior.
+
+        When Web Sockets API says that events should be queued for async dispatch, it means something
+        different. We should keep this in mind when dealing with other HTML5-related specs.
+
+        The model for HTML5 is that code running in response to network events (e.g. WebSocket or
+        XMLHttpRequest algorithms) runs in a separate thread of execution, and thus needs to post
+        async events as its only way to communicate with client code. As long as network events are
+        queued themselves (as they are in WebKit), there is no need to queue JS events for async
+        dispatch.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32355
+        Assertion failure when opening a WebSocket connection
+
+        I couldn't make a reliable test for this. Once the test from bug 32299 is landed, it
+        will provide partial coverage, as I was frequently seeing the assertion failure with it.
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::send):
+        It's not an error if zero is returned from platformSend() - it just means that nothing could
+        be pushed down to the network layer, and all data was queued for later.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): This will no longer happen with SocketStream,
+        but a client can potentially destroy the handle from any callback, so we need to check that
+        this didn't happen.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Ditto.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Roll out 51919 and 51920. They were incorrect and unnecessary right now.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Adds wtf/StdLibExtras.h include for DEFINE_STATIC_LOCAL in V8 ScriptState.
+        https://bugs.webkit.org/show_bug.cgi?id=32330
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptState.cpp: Modified. Adds wtf/StdLibExtras.h include.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ENABLE(INSPECTOR) guards around script binding methods that use types
+        defined only when INSPECTOR is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32328
+
+        Build fix only, no new tests.
+
+        * bindings/js/ScriptValue.cpp: Modified. Added ENABLE(INSPECTOR) guard to ScriptValue::quarantineValue.
+        * bindings/v8/ScriptObject.cpp: Modified. Added ENABLE(INSPECTOR) guard to some overloads of ScriptGlobalObject::set.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds Android Makefiles for building with V8.
+        Also updates existing Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        Build fix only, no new tests.
+
+        * Android.derived.jscbindings.mk: Modified.
+        * Android.derived.mk: Modified.
+        * Android.derived.v8bindings.mk: Added.
+        * Android.jscbindings.mk: Modified.
+        * Android.mk: Modified.
+        * Android.v8bindings.mk: Added.
+
+2009-12-09  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32338 - [Chromium] Fix Chromium builder by including missing GeolocationServiceChromium
+        https://bugs.webkit.org/show_bug.cgi?id=32338
+
+        Fix build break: re-include file dropped out by merge in http://trac.webkit.org/changeset/51681/trunk/WebCore/WebCore.gypi
+
+        * WebCore.gypi: Add missing GeolocationServiceChromium.cpp
+
+2009-12-09  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Brady Eidson.
+
+        Fixed a typo in http://trac.webkit.org/changeset/51644 that broke
+        the QWebPage autotest.
+
+        No new test required.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+
+2009-12-09  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        Exclude JSSVG*.cpp generated files from --minimal and --no-svg builds.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32286
+
+        * WebCore.pro:
+
+2009-12-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Carlson.
+
+        Ogg mimetypes are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=27113
+
+        The ogg extension is handled by audio/ogg instead of
+        application/ogg. See
+        http://wiki.xiph.org/MIME_Types_and_File_Extensions
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::TypeExtensionPair::):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use the current run loop instead of the main runloop for the NetworkStateNotifier.
+
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use isMainThread() helper instead of pthread_main_np() != 0.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some #ifdefs to allow us to experiment with a single NSView mac WebKit.
+
+        * page/Chrome.h:
+        * page/EventHandler.h:
+        * page/mac/ChromeMac.mm:
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::dragOperation):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventLoopHandleMouseDragged):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::isKeyboardOptionTab):
+        (WebCore::EventHandler::invertSenseOfTabsToLinks):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Widget.cpp:
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setIsSelected):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+
+2009-12-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium build fix.
+
+        No new tests.
+
+        * bindings/v8/DOMData.cpp
+        * bindings/v8/V8DOMWrapper.cpp
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+
+2009-12-09  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Isolated world reuse failure
+        https://bugs.webkit.org/show_bug.cgi?id=32306
+
+        Fixed bug introduced in r51407: (http://trac.webkit.org/changeset/51407) which caused layout test
+        LayoutTests/http/tests/security/isolatedWorld/world-reuse.html to fail.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-12-09  Patrick Scott  <phanna@email.unc.edu>
+
+        Fix the build with ENABLE_ORIENTATION_EVENTS
+        https://bugs.webkit.org/show_bug.cgi?id=32321
+
+        * page/Frame.cpp:
+        (WebCore::Frame::sendOrientationChangeEvent):
+
+2009-12-09  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium tickmarks in scrollbar now UX approved.
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+
+2009-12-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Delay load DLLs for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        Add logic to turn off accelerated compositing if d3d9 or QuartzCore
+        DLLs are not present.
+        
+        This patch also changes the WKCACFLayerRenderer to be a pointer.
+        This allows me to have a create() method which will not create it when
+        accelerated compositing is disabled because of missing DLLs. It 
+        avoids having to do so many checks. I also made WebViewWndProc 
+        a member function to allow several methods to be made protected, which
+        allows me to avoid doing availability checks there as well.
+
+        * platform/graphics/win/WKCACFLayer.cpp:
+        * platform/graphics/win/WKCACFLayer.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        * rendering/RenderLayerBacking.cpp:
+
+2009-12-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename dom/ClassNames to SpaceSplitString and update build files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32250
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchRules):
+        * dom/ClassNames.cpp: Removed.
+        * dom/ClassNames.h: Removed.
+        * dom/ClassNodeList.h:
+        * dom/NamedMappedAttrMap.h:
+        (WebCore::NamedMappedAttrMap::classNames):
+        * dom/SpaceSplitString.cpp: Copied from WebCore/dom/ClassNames.cpp.
+        (WebCore::SpaceSplitStringData::createVector):
+        (WebCore::SpaceSplitStringData::containsAll):
+        * dom/SpaceSplitString.h: Copied from WebCore/dom/ClassNames.h.
+        (WebCore::SpaceSplitStringData::SpaceSplitStringData):
+        (WebCore::SpaceSplitString::SpaceSplitString):
+        (WebCore::SpaceSplitString::set):
+        (WebCore::SpaceSplitString::containsAll):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::classNames):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setRel):
+
+2009-12-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Enable SVG filters in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=32323
+
+        Covered by SVG filter layout tests.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::functionForUniform):
+
+2009-12-08  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebSocket allow space (U+0020) in sub protocol name.
+        https://bugs.webkit.org/show_bug.cgi?id=32266
+
+        Test: websocket/tests/sub-protocol-with-space.html
+
+        * websockets/WebSocket.cpp:
+        (WebCore::isValidProtocolString):
+
+2009-12-08  Peterson Trethewey  <petersont@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement WebGLUniformLocation and change API to use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31173
+
+        Test: fast/canvas/webgl/uniform-location.html
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::functionForUniform):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toWebGLUniformLocation):
+        (WebCore::):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::isFunctionToCallForAttribute):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLUniformLocation.cpp: Added.
+        (WebCore::WebGLUniformLocation::create):
+        (WebCore::WebGLUniformLocation::WebGLUniformLocation):
+        * html/canvas/WebGLUniformLocation.h: Added.
+        (WebCore::WebGLUniformLocation::~WebGLUniformLocation):
+        (WebCore::WebGLUniformLocation::program):
+        (WebCore::WebGLUniformLocation::location):
+        * html/canvas/WebGLUniformLocation.idl: Added.
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion failure in WebCore::RenderBlock::startDelayUpdateScrollInfo
+
+        startDelayUpdateScrollInfo calls a function that can end up calling
+        startDelayUpdateScrollInfo again. However, it's static state is
+        inconsistent when this happens leading to an assertion failure (or
+        probably a memory leak if assertions are off).
+
+        Thanks to Robert Swiecki for the test case.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32172
+        http://code.google.com/p/chromium/issues/detail?id=28880
+
+        Test: fast/css/recursive-delay-update-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+
+2009-12-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebCore source level debugging on Windows not reliable in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=32297
+
+        Customized pdb file name/location for WebCore static library.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add ProgramDataBaseFileName.
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * platform/FileSystem.h:
+        * platform/cf/BinaryPropertyList.h:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::unloadModule):
+        (WebCore::wxDirTraverserNonRecursive::wxDirTraverserNonRecursive):
+        (WebCore::wxDirTraverserNonRecursive::OnFile):
+        (WebCore::wxDirTraverserNonRecursive::OnDir):
+        (WebCore::listDirectory):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::nativeWindowFor):
+        (WebCore::cgHandleFor):
+        (WebCore::topLevelOffsetFor):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::globalMousePosForPlugin):
+        * plugins/wx/PluginDataWx.cpp: Added.
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * wscript:
+
+2009-12-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Navigating to a cached page can result in accessing a destroyed HTMLInputElement.
+        <rdar://problem/6856662> and https://webkit.org/b/32293
+
+        Test: fast/loader/input-element-page-cache-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Make sure to unregister for the activation
+          callback after the new m_autocomplete setting has been stored so the unregistration actually
+          takes place.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Removed.
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord):
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+
+2009-12-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: support custom WebCore context menu items in Chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32277
+
+        * platform/ContextMenu.h:
+        * platform/ContextMenuItem.h:
+        (WebCore::PlatformMenuItemDescription::PlatformMenuItemDescription):
+        * platform/chromium/ContextMenuChromium.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemWithAction):
+        (WebCore::ContextMenu::itemAtIndex):
+        (WebCore::ContextMenu::platformDescription):
+        * platform/chromium/ContextMenuItemChromium.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::releasePlatformDescription):
+        (WebCore::ContextMenuItem::type):
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::checked):
+        (WebCore::ContextMenuItem::enabled):
+        (WebCore::ContextMenuItem::setType):
+        (WebCore::ContextMenuItem::setAction):
+        (WebCore::ContextMenuItem::setTitle):
+        (WebCore::ContextMenuItem::setChecked):
+        (WebCore::ContextMenuItem::setEnabled):
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium Linux: set default scrollbar colours.
+
+        This is so that layout tests have sane defaults for the scrollbar
+        colours, even if the API user doesn't set any.
+
+        This is a fix due to r51827.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32287
+
+        This is very well covered by existing layout tests.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+
+2009-12-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/7397808> Crash occurs at 
+        RenderObject::containingBlock() as I type in the Google Search 
+        field (during page load)
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea): ownerRenderer() needs to be 
+        null checked.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord): Disable thread verification for this class because of its cross-thread use in IconDatabase.
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Disable thread verification for this class, add FIXME to enforce proper usage via crossThreadString.
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Added.
+
+2009-12-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Adam Barth.
+
+        Inform the NotificationCenter when its window goes away in the same
+        manner as other DOMWindow fields, and prevent invalid operations on
+        it after that happens.
+
+        As part of this, change the V8 bindings for notifications to call
+        through the NotificationCenter rather than doing those operations
+        itself.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31886
+
+        Test: fast/notifications/notification-after-close.html
+
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::disconnectFrame):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed block selection gap repainting in table cells
+
+        Test: fast/repaint/block-selection-gap-in-table-cell.html
+
+        This recently-introduced regression exposed the fact that
+        RenderTableCell did not override offsetFromContainer() to adjust for
+        the fact that table cells’ coordinates are relative to the table
+        section, not the table row. With this fixed, RenderTableCell no longer
+        needs to override mapLocalToContainer() and mapAbsoluteToLocalPoint(),
+        since the base class implementations of those use offsetFromContainer().
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::offsetFromContainer):
+        * rendering/RenderTableCell.h:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sane way to force a rebuild on all win slaves, according to Adam Roben.
+
+        * WebCorePrefix.h:
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * loader/loader.cpp:
+        (WebCore::cachedResourceTypeToTargetType):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in to eventually fix the win debug build.
+
+        * svg/svgtags.in:
+
+2009-12-08  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32167
+        Update the ResourceRequest::RequestType.  This previously
+        was specific to Chromium.  Moved into ResourceRequestBase, enabling
+        more specificity about the type (which is otherwise only known to the
+        loader), and also making this information available to all platforms.
+        Any platform with a network layer which can utilize this information
+        may want to use it for prioritization.
+
+        Note to Chromium glue: TargetIsSubResource renamed to TargetIsSubresource.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::CachedResourceTypeToTargetType):
+        (WebCore::Loader::Host::servePendingRequests):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::):
+        (WebCore::ResourceRequestBase::targetType):
+        (WebCore::ResourceRequestBase::setTargetType):
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        Build system change only. No tests possible.
+
+        * Android.derived.jscbindings.mk: Added.
+        * Android.derived.mk: Added.
+        * Android.jscbindings.mk: Added.
+        * Android.mk: Added.
+        * WebCorePrefix.h: Modified. Sets up some flags and adds a header required for building on Android.
+
+2009-12-08  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS): Conditionalize prefetching on
+        the libSoup version.
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Win.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * bindings/scripts/CodeGeneratorCOM.pm: Touch file to assure a world rebuild. Hopefully.
+
+2009-12-08  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CSS Counter Nesting still does not work according to the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=31723
+
+        Test: fast/css/counters/nesting.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Replaced the faulty counter insertion algorithm with one that works.
+
+2009-12-08  John Sullivan  <sullivan@apple.com>
+
+        Add isAutofilled getter to match existing setter.
+
+        Reviewed by Ada Chan.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isAutofilled]):
+        Implemented new cover function.
+        
+        * bindings/objc/DOMPrivate.h:
+        Declared new cover function.
+
+2009-12-08  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Create a TextBreakIterator implementation based on GLib (without ICU)
+        https://bugs.webkit.org/show_bug.cgi?id=31469
+
+        Added a TextBreakIterator implementation based on GLib and pango,
+        which allows compiling WebCore without ICU.
+
+        * GNUmakefile.am:
+        * platform/text/gtk/TextBreakIteratorGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::setUpIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::cursorMovementIterator):
+        (WebCore::wordBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
+        (WebCore::textBreakFirst):
+        (WebCore::textBreakLast):
+        (WebCore::textBreakNext):
+        (WebCore::textBreakPrevious):
+        (WebCore::textBreakPreceding):
+        (WebCore::textBreakFollowing):
+        (WebCore::textBreakCurrent):
+        (WebCore::isTextBreak):
+
+2009-12-08  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Change the way cookies are retrieved in the WebInspector frontend.
+
+        Moved the cookie filtering from the native code into the frontend so that
+        all cookies can be retrieved regardless of the associated domain
+        (required for certain audits to run.)
+        https://bugs.webkit.org/show_bug.cgi?id=32160
+
+        Test: inspector/cookie-resource-match.html
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * inspector/InspectorController.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.cookieMatchesResourceURL):
+        (WebInspector.Cookies.cookieDomainMatchesResourceDomain):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.get documentURL):
+        (WebInspector.Resource.prototype.set documentURL):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in, in order to force SVGNames.* regeneration. Praying for gtk bot to be fixed :-)
+
+        * svg/svgtags.in:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Trying to force a rebuild on the Gtk slave. If that doesn't work, someone must force a rebuild from scratch.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: provide custom context menu in the front-end window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32200
+
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::contextMenuItemSelected):
+        (WebCore::InspectorFrontend::contextMenuCleared):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        (WebCore::InspectorFrontendHost::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::contextMenuCleared):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::create):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::~MenuSelectionHandler):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::disconnect):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuCleared):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::MenuSelectionHandler):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/ContextMenu.js: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentContextMenu):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::ContextMenuController):
+        (WebCore::ContextMenuController::clearContextMenu):
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::showContextMenu):
+        (WebCore::ContextMenuController::createContextMenu):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/ContextMenuController.h:
+        * page/ContextMenuSelectionHandler.h: Added.
+        (WebCore::ContextMenuSelectionHandler::ContextMenuSelectionHandler):
+        (WebCore::ContextMenuSelectionHandler::~ContextMenuSelectionHandler):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h:
+
+2009-12-08  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        [Qt] Build fix of duplicated platform/graphics/filters/FEGaussianBlur.cpp in WebCore.pro after enabled svg filters.
+
+        No new tests needed.
+        * WebCore.pro:
+
+2009-12-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a function to show render tree for debugging
+        https://bugs.webkit.org/show_bug.cgi?id=31288
+
+        No new tests because this just adds a function for debugging.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::showRenderObject):
+        (WebCore::RenderObject::showRenderTreeAndMark):
+        (showRenderTree):
+        * rendering/RenderObject.h:
+
+2009-12-07  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement NamedPropertyEnumerator and IndexedPropertyEnumerator for
+        V8 NPObject. This should make the object enumerable and fix the
+        enumeration issue in layout test plugins/netscape-enumerate.html.
+
+        Also fix some existing style issues per webkit style guidelines.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32254
+
+        Test: plugins/netscape-enumerate.html
+
+        * bindings/v8/V8NPObject.cpp:
+        (npObjectInvokeImpl):
+        (npObjectInvokeDefaultHandler):
+        (npObjectGetProperty):
+        (npObjectPropertyEnumerator):
+        (npObjectNamedPropertyEnumerator):
+        (npObjectIndexedPropertyEnumerator):
+        (createV8ObjectForNPObject):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fragments now make WebSocket URL parsing fail.
+        https://bugs.webkit.org/show_bug.cgi?id=32144
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix wrong length parsing in WebSocket.
+        https://bugs.webkit.org/show_bug.cgi?id=32203
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.pro:
+
+2009-12-07  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: theme scrollbars to match GTK theme.
+        Add functions to RenderThemeChromiumLinux to change the scrollbar
+        color.
+
+        Since the change is to the Chromium WebKit API layer, testing will
+        be in Chromium's test shell.
+        http://bugs.webkit.org/show_bug.cgi?id=32048
+
+        Patch from Markus Gutschke <markus@chromium.org>.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::saturateAndBrighten):
+        (WebCore::outlineColor):
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setScrollbarColors):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::thumbInactiveColor):
+        (WebCore::RenderThemeChromiumLinux::thumbActiveColor):
+        (WebCore::RenderThemeChromiumLinux::trackColor):
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Doesn't respect Content-Disposition for downloads, and provides no way for apps to do that
+        https://bugs.webkit.org/show_bug.cgi?id=32247
+
+        Allow creating a ResourceResponse from a SoupMessage.
+
+        Covered by API test.
+
+        * platform/network/soup/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::updateFromSoupMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Reverting problematic patch, causing errors.
+
+        Revert r51789 (Avoid zero division during SVGPaintServerPattern::setup()). Crashes on all Windows slaves.
+        Reopen bug https://bugs.webkit.org/show_bug.cgi?id=29912.
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for HTMLInputElement::stepUp() and stepDown() for
+        type=number and type=range.
+        https://bugs.webkit.org/show_bug.cgi?id=27451
+
+        Our implementation of stepUp() and stepDown() rounds the resultant
+        value to conform to the step value.
+        Change the number-string conversion method for RenderSlider to be
+        consistent with type=number.
+
+        Tests: fast/forms/input-step-number.html
+               fast/forms/input-step-range.html
+               fast/forms/input-step-unsupported.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::rangeOverflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::minimum): Renamed from rangeMinimum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::maximum): Renamed from rangeMaximum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::stepBase):
+        (WebCore::HTMLInputElement::stepMismatch): Use stepBase().
+        (WebCore::HTMLInputElement::applyStepForNumberOrRange):
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        (WebCore::HTMLInputElement::formStringFromDouble):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        * html/HTMLInputElement.idl: Add stepUp() and stepDown().
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange): Sync with rangeMinimum()/rangeMaximum() renaming.
+        (WebCore::RenderSlider::updateFromElement): Use formStringFromDouble().
+        (WebCore::RenderSlider::setValueForPosition): Use formStringFromDouble().
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix try 2 (dumb error).
+
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix.
+
+        Fix Chromium build break caused by an added dependency from
+        ScriptControllerBase to JSDOMWindowShell, and an API change in
+        ScriptValue.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): Indent does not work for twice modified with background text in gmail.
+        <rdar://problem/7442387>
+        https://bugs.webkit.org/show_bug.cgi?id=32233
+        
+        Fixes problem in re-creating the correct hierarchy under the new block.
+        Added extensive testing to cover all the cases.
+
+        Test: editing/execCommand/indent-with-style2.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Force JS binding regeneration, eventually fixing the broken tests on the bots.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix mac builds by touching svgtags.in - I only tried from-scratch builds.
+
+        * svg/svgtags.in:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        * bindings/js/ScriptValue.h:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        Only enable filters on mac for now, skipped all affected tests on the other platforms.
+        Will enable them one after another, to minimize breakage.
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that KURL rejects a host name which has an IPv4 address
+        inside an IPv6 form like [::127.0.0.1].
+        https://bugs.webkit.org/show_bug.cgi?id=29913
+
+        * platform/KURL.cpp:
+        (WebCore::characterClassTable): Add IPv6Char to '.'.
+
+2009-12-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7443417> - Closing a window opened with "New windows open with: Same Page" results in crash in ::~HistoryItem
+
+        The HistoryItem copy constructor has one very specific use case - to support the feature of a WebView copying another WebView's
+        BackForwardList.  That constructor wasn't initializing its m_document pointer, leading to this crash in the destructor.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::~HistoryItem): Change the setDocument(0) to an ASSERT that the document is already 0. A HistoryItem cannot
+          outlive its Document and Documents will always clear the back-pointer in their ::detach() method.
+        (WebCore::HistoryItem::HistoryItem): Missed the m_document initializer in the copy constructor. Also remove an invalid assertion
+          about the original items m_cachedPage object (which is irrelevant to the copy).
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove partial SharedScript implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=32237
+        The patch was obtained by running "git revert" command and then un-reverting WebCore/ChangeLog.
+
+        * DerivedSources.make:
+        * SharedScript/SharedScriptContext.cpp: Removed.
+        * SharedScript/SharedScriptContext.h: Removed.
+        * SharedScript/SharedScriptContext.idl: Removed.
+        * SharedScript/SharedScriptController.h: Removed.
+        * SharedScript/WebKitSharedScript.cpp: Removed.
+        * SharedScript/WebKitSharedScript.h: Removed.
+        * SharedScript/WebKitSharedScript.idl: Removed.
+        * SharedScript/WebKitSharedScriptRepository.cpp: Removed.
+        * SharedScript/WebKitSharedScriptRepository.h: Removed.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * dom/ScriptExecutionContext.h:
+
+2009-12-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32226
+        Random crashes in WebSocket tests on Leopard Debug builbot
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::close):
+        Make sure the object still exists when setting m_state.
+
+2009-12-07  Shiki Okasaka  <shiki@google.com>
+
+        Reviewed by Dirk Schulze.
+
+        Avoid zero division during SVGPaintServerPattern::setup()
+        https://bugs.webkit.org/show_bug.cgi?id=29912
+
+        Fix zero division bugs in SVGPaintServerPattern::setup() that occurred
+        if the tile of a pattern was bigger than the pattern and the pattern
+        size was < 0.5, and if the attribute overflow was set to visible.
+
+        Test: svg/custom/small-pattern.html
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31889
+
+        Fixed bug in handling of zero-argument constructor call.
+
+        Test: fast/canvas/webgl/bug-31889.html
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-12-07  Gyuyoung Kim  <gyuyoung@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32024
+        [GTK] WebKit does not compile without JAVASCRIPT_DEBUGGER
+
+        Fix build errors when javascript-debugger is disabled on GTK
+
+        * GNUmakefile.am:
+
+2009-12-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7437820> Weird selection artifacts
+
+        Tests: fast/repaint/block-selection-gap-stale-cache-2.html
+               fast/repaint/block-selection-gap-stale-cache.html
+
+        Instead of caching the block selection gaps’ bounds in the RenderView at setSelection()
+        time, cache them in each RenderLayer at paint time. This prevents the cache from getting
+        stale due to layout changes and overflow scrolling.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Account for overflow scroll.
+        (WebCore::RenderBlock::paintSelection): Update the enclosing layer’s selection gaps bounds.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::addBlockSelectionGapsBounds): Added. Updates the selection gaps
+        bounds to include the given rect.
+        (WebCore::RenderLayer::clearBlockSelectionGapsBounds): Added. Recursively clears the cached
+        selection gaps bounds.
+        (WebCore::RenderLayer::repaintBlockSelectionGaps): Added. Recursively invalidates the
+        selection gaps bounds.
+        * rendering/RenderLayer.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Clear the layer-level selection gaps bounds instead
+        of the view-level cache.
+        (WebCore::RenderView::clearSelection): Changed to call repaintBlockSelectionGaps().
+        * rendering/RenderView.h:
+
+2009-12-07  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixed whitelist comment and removed useless (tags, sdp) mimetypes
+        from it. Also, GStreamer doesn't handle directly SMIL.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Eliminate the segfaults which occur when accessing the text interface now
+        implemented by text controls.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-12-07  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Turn the MediaPlayer supported types blacklist into a whitelist
+
+        [GTK] REGRESSION: webkit thinks it can render PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=32183
+
+        Covered by API test.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25524
+        [Gtk] Expose the title attribute to assistive technologies
+
+        Expose 'alt' attribute from images as accessible name.
+        Expose the 'title' core HTML attribute as accessible description.
+        This is a modified version of the original fix submitted by Mario Sanchez Prada,
+        adjusted so that it doesn't impact other platforms.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_name):
+        (webkit_accessible_get_description):
+
+2009-12-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix support for generic font families
+
+        By not propagating the resolved font family in FontCacheQt and
+        only concidering the font description we ended up passing the
+        generic font families to Qt directly. Since most systems don't
+        have a mapping for these font families we ended up using the
+        default font in most cases.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.getOwnPropertyDescriptor() allows cross-frame access
+        https://bugs.webkit.org/show_bug.cgi?id=32119
+
+        Make all implementations of getOwnPropertyDescriptor that have
+        cross domain restrictions simply fail immediately on cross domain
+        access, rather than trying to mimic the behaviour of normal
+        property access.
+
+        Test: http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific functions from jni_utility and moves them to new jsc/jni_utility_private files.
+        https://bugs.webkit.org/show_bug.cgi?id=32157
+
+        Build fix only, no new tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Modified. Add jni_utility_private.[cpp|h].
+        * bridge/jni/jni_instance.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_jsobject.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_objc.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_runtime.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_utility.cpp: Modified. Removed convertValueToJValue and convertArrayInstanceToJavaArray.
+        * bridge/jni/jni_utility.h: Modified. Removed convertValueToJValue and dispatchJNICall.
+        * bridge/jni/jsc: Added.
+        * bridge/jni/jsc/jni_utility_private.cpp: Added.
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/jni_utility_private.h: Added. Header for convertValueToJValue and dispatchJNICall.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Include jni_utility_private.h for JSC.
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        texImage2D pixel junk for transparency
+        https://bugs.webkit.org/show_bug.cgi?id=32188
+
+        Use kCGBlendModeCopy when drawing an image to the intermediate context
+        used to create a GL texture.
+
+        No test as we don't currently have any mechanism to retrieve pixel data
+        from the webgl context.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::imageToTexture):
+
+2009-12-03  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Advertize audio/ogg correctly and refactored mime-type cache
+        building.
+
+        [GTK] Recognize oga as audio/ogg
+        https://bugs.webkit.org/show_bug.cgi?id=31990
+
+        Test: media/media-can-play-ogg.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32175
+        REGRESSION: websocket/tests/url-parsing.html is crashing on Leopard Bot
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): Call platformClose() to unschedule both
+        streams, guaranteeing that there will be no callbacks after SocketStreamHandle is destroyed.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Edited a comment a bit.
+
+2009-12-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Adam Barth.
+
+        Check that a CSS format() argument is of a valid type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31815
+        http://code.google.com/p/chromium/issues/detail?id=28582
+
+        Test: fast/css/url-format-non-string.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceSrc):
+
+2009-12-04  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: make rounded borders heavier.
+
+        Skia draws its rounded corners differently from the other ports.
+        Whereas they have anti-aliased clipping regions, Skia only has 1-bit
+        regions. (Which is technically more correct, but somewhat unhelpful
+        for us.) Instead, with Skia we use a layer and collect all the
+        clipping paths in effect. When the state is popped, we paint
+        transparency outside the clipping paths and merge the layer down.
+
+        This appears to cause rounded borders to look a little thin, which is
+        addressed in this patch.
+
+        This is well covered by existing tests but will require new baselines
+        in the Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31778
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+
+2009-12-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7441571> Hardware-backed layers are skipped when printing
+        
+        When printing, set the PaintBehaviorFlattenCompositingLayers flag so that compositing layers
+        paint. This also causes 3D transforms to be flattened to 2D.
+
+        Test: printing/compositing-layer-printing.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-12-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fix up some issues in my SVGListTraits change from yesterday.
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-04  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: chromium build fix.
+
+        Fix Chromium build break caused by moving of isDefaultPortForProtocol() and
+        portAllowed() into KURL.h/KURL.cpp.  Cloning code.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isDefaultPortForProtocol):
+        (WebCore::portAllowed):
+
+2009-12-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Remove suppress highlight when restoring selected node.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32152
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setDocument.selectNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+
+2009-12-04  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Gradient SVG animation demonstrates tearing at animation extremes
+        https://bugs.webkit.org/show_bug.cgi?id=11929
+
+        The focalPoint of a radial gradient is temporarly substracted by
+        the centralPoint, if the focalPoint is not in the radius of the
+        gradient. This is needed to calculate a new postion of the focalPoint
+        according to the specification. But the new focalPoint needs to be
+        moved by the centralPoint after this calculation, which is not the case
+        at the moment. This patch fixes this issue. It was also introduced a
+        deviation of maximal 0.2% for Cairo to get around the fixed point numbers
+        in Cairo.
+
+        W3C-SVG-1.1/pservers-grad-13-b needed an update. The missing adjustment
+        of the new focalPoint caused wrong results for the last three tests.
+
+        Test: svg/custom/radial-gradient-with-outstanding-focalPoint.svg
+
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+
+2009-12-04  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Do not use WebCore::String::String(const UChar*, int length) to convert
+        short v8 strings.
+
+        Plus added string traits.
+        https://bugs.webkit.org/show_bug.cgi?id=31415
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+
+2009-12-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: AX: buttons now extremely repetitive
+        https://bugs.webkit.org/show_bug.cgi?id=32164
+
+        Test: platform/mac/accessibility/button-shouldnot-have-axvalue.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isButton):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-12-04  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Check whether the right side of a string append is non-empty
+        https://bugs.webkit.org/show_bug.cgi?id=32151
+
+        Especially beneficial for CachedScript::script() method
+        which usually appends an empty string returned by flush()
+        to its m_script member. m_script is often hundreds of kbytes
+        which is duplated without reason.
+
+        * platform/text/String.cpp:
+        (WebCore::String::append):
+
+2009-12-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Mail.app crashes when indenting table pasted from Numbers.app.
+        <rdar://problem/7209507>
+        https://bugs.webkit.org/show_bug.cgi?id=32166
+
+        Test: LayoutTests/editing/execCommand/indent-partial-table.html
+        
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Added test to verify that the end of the paragraph
+        after the selection has not been moved.
+
+2009-12-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32085
+        WebSocket should block the same ports that are blocked for resource loading
+
+        Test: websocket/tests/url-parsing.html
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+        Move isDefaultPortForProtocol() to KURL, because that's a better place for it (SecurityOrigin
+        is not even in WebCore/platform directory).
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setPort):
+        Updated for the new location of isDefaultPortForProtocol().
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::protocolIs): In an assertion, compare to "javascript" case-insensitively,
+        since the function doesn't require lower case input.
+        (WebCore::isDefaultPortForProtocol): Moved from SecurityOrigin.
+        (WebCore::portAllowed): Moved from ResourceHandle.
+        * platform/KURL.h:
+
+        * platform/network/ResourceHandle.cpp: (WebCore::ResourceHandle::create): Updated for the
+        new location of portAllowed().
+
+        * websockets/WebSocket.cpp: (WebCore::WebSocket::connect): Per the spec, raise a SECURITY_ERR
+        if trying to connect to a blocked port.
+
+2009-12-04  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] WebKit crashes when loading certain SVG images
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        Existing tests cover the change.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformDataPrivate::FontPlatformDataPrivate):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::family):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::italic):
+        (WebCore::FontPlatformData::smallCaps):
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::hash):
+
+2009-12-04  Adam Treat  <atreat@rim.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix wrong assert that was only working through sheer luck.
+        https://bugs.webkit.org/show_bug.cgi?id=32162
+
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::create):
+
+2009-12-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow removing 'qrc' as a local security origin scheme
+
+        * page/SecurityOrigin.cpp:
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CollectionCache
+        https://bugs.webkit.org/show_bug.cgi?id=32109
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        struct name            - instantiated at: WebCore/'location'
+
+        struct CollectionCache - dom/Document.cpp:4029
+
+        * html/CollectionCache.h:
+
+2009-12-04  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a crashing bug in Geolocation when a watch is cleared from some callbacks. 
+        https://bugs.webkit.org/show_bug.cgi?id=32111
+
+        In Geolocation::GeoNotifier::timerFired, a JS callback may be invoked if a
+        fatal error was registered on this GeoNotifier or if this request has timed
+        out. If the request is a watch, and is cleared by a call to clearWatch in the
+        callback, the GeoNotifier object will be destroyed. We must therefore cache the
+        m_geolocation member to allow us to call Geolocation::fatalErrorOccurred or
+        Geolocation::requestTimedOut.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-clear-watch.html
+               fast/dom/Geolocation/timeout-clear-watch.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Cache the m_geolocation member before invoking the JS callback.
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for 2 classes of the platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name         - instantiated at: WebCore/'location'
+
+        class SharedTimer         - (its child class) workers/WorkerRunLoop.cpp:91
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        class TransformOperations - rendering/style/RenderStyle.h:1175
+
+        Noncopyable.h's include added to SharedTimer.h.
+
+        * platform/SharedTimer.h:
+        * platform/graphics/transforms/TransformOperations.h:
+
+2009-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK]Enable DNS prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=23846
+
+        Enable DNS prefetching.
+
+        Based on a patch by José Millán.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS):
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the svg directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name           - instantiated at: WebCore/'location'
+
+        struct ResourceSet          - svg/graphics/SVGResource.cpp:148
+        class SVGFontData           - css/CSSFontFaceSource.cpp:156
+        class SVGDocumentExtensions - dom/Document.cpp:3962
+        class SVGViewSpec           - svg/SVGSVGElement.cpp:191
+
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGFontData.h:
+        * svg/SVGViewSpec.h:
+        * svg/graphics/SVGResource.cpp:
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: aria-activedescendant doesn't work as intended
+        https://bugs.webkit.org/show_bug.cgi?id=32100
+
+        Fixes a number of issues regarding the "tree" role and aria-activedescendant.
+        1. The indexes were being reported incorrectly by treeitems.
+        2. aria-activedescendant changes were not being sent to the containing item.
+        3. The tree's selected rows need to consult aria-activedescendant.
+        4. Since a tree changes what it returns as its children (it returns its rows)
+           the mac-specific array indexing methods need to correctly handle the tree case.
+
+        Tests: platform/mac/accessibility/aria-tree-activedescendant.html
+               platform/mac/accessibility/aria-tree-index-of-items.html
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::shouldFocusActiveDescendant):
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-12-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the xml directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated 
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        struct XMLHttpRequestStaticData - xml/XMLHttpRequest.cpp:134
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        class NodeTest                  - xml/XPathGrammar.y:258
+        class NodeSet                   - xml/XPathValue.cpp:52
+        struct EvaluationContext        - xml/XPathExpressionNode.cpp:40
+
+        * xml/XMLHttpRequest.cpp:
+        * xml/XPathExpressionNode.h:
+        * xml/XPathNodeSet.h:
+        * xml/XPathStep.h:
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        New History changes do not compile for Chromium/V8
+        https://bugs.webkit.org/show_bug.cgi?id=32148
+
+        Existing tests suffice (just trying to get code to compile).
+
+        * WebCore.gypi:
+        Added V8HistoryCustom.cpp and other missing files.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom handlers for History.pushState()/replaceState().
+        * bindings/v8/custom/V8HistoryCustom.cpp: Added.
+        Added custom handlers for History.pushState()/replaceState().
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        Stubbed out this routine for now - will implement in the future.
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<XBLBindingManager> Document::m_bindingManager;
+        https://bugs.webkit.org/show_bug.cgi?id=32147
+
+        The document actually owns the bindingManager.  That's what the code
+        should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::bindingManager):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<Tokenizer> Document::m_tokenizer;
+        https://bugs.webkit.org/show_bug.cgi?id=32145
+
+        The document actually owns the tokenizer.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+        (WebCore::Document::~Document):
+        (WebCore::Document::cancelParsing):
+        (WebCore::Document::implicitOpen):
+        (WebCore::Document::implicitClose):
+        * dom/Document.h:
+        (WebCore::Document::tokenizer):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<RenderArena> Document::m_renderArena;
+        https://bugs.webkit.org/show_bug.cgi?id=32146
+
+        The document owns the renderArena.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Also, removed a redundant initialization
+        of the tokenizer that I missed in my previous patch.
+        (WebCore::Document::~Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        (WebCore::Document::renderArena):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolling back r51633 because it causes a chromium perf regression.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        The code should say that Document owns DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=32143
+
+        It's the truth.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::docLoader):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        AX: VO just says "term" on many web sites
+        https://bugs.webkit.org/show_bug.cgi?id=32139
+
+        Test: platform/mac/accessibility/definition-list-term.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Implement WAI-ARIA scrollbar role and related property aria-orientation
+        https://bugs.webkit.org/show_bug.cgi?id=32126
+
+        Test: accessibility/aria-scrollbar-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isScrollbar):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::valueForRange):
+        (WebCore::AccessibilityRenderObject::orientation):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7401617> Selection painting issue in hardware-
+        accelerated layers
+        which is another part of https://bugs.webkit.org/show_bug.cgi?id=23628
+        Fix selection painting to do container-relative repaints
+
+        Test: fast/repaint/block-selection-gap-in-composited-layer.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Compute and paint
+        gap rects in the coordinate space of the repaint container.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect): Added a
+        FIXME.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Map block selection gap rects from
+        the repaint container’s coordinate space to the view’s coordinate space
+        before adding them to the cached selection bounds.
+        (WebCore::RenderView::clearSelection): Changed to use
+        repaintRectangleInViewAndCompositedLayers() so that the selection rect
+        is invalidated in composited layers as well.
+
+2009-12-03  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32066 - Add enable geolocation flag to WebCore::Settings for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32066
+
+        Adds geolocationEnabled in Settings for runtime control of geolocaiton features. This defaults to ON
+        as it is intended as a development and testing aid, not a user control. To completely remove geolocation
+        from a given port, the compile time ENABLE_GEOLOCATION should still be used.
+        Adding placeholder GeolocationServiceChromium implementation, as this is required to allows
+        ENABLE_GEOLOCATION to be defined (in turn required for testing), even though this patch does not
+        make that the default just yet.
+
+        * WebCore.gypi:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Add new m_geolocationEnabled flag default value
+        (WebCore::Settings::setGeolocationEnabled): Setter for  m_geolocationEnabled flag
+        * page/Settings.h:
+        (WebCore::Settings::geolocationEnabled):  Add m_geolocationEnabled flag
+        * platform/chromium/GeolocationServiceChromium.cpp: Added.
+        (WebCore::GeolocationServiceChromium::GeolocationServiceChromium): Place holder GeolocationServiceChromium)
+        (WebCore::createGeolocationService): factory function, only required when ENABLED(GEOLOCATION) is true
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        SpinTracer: 349 spins in Mail at WebCore::Editor::advanceToNextMisspelling(bool)
+        <rdar://problem/7198592>
+        https://bugs.webkit.org/show_bug.cgi?id=32129
+
+        Fixed the way the next paragraph is calculated.
+        I've added a repro case in Safari and attached it to the Bugzilla bug.
+
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingOrBadGrammarInRange): Changed the way we move to the
+        next paragraph in the loop.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No wonder editing WebCore.exp repeatedly while I worked on this patch never seemed to stick.
+
+        Long live our auto-generated overlords that I didn't know about...  
+
+        * WebCore.base.exp:
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r51627): 3 SVG tests are failing
+        https://bugs.webkit.org/show_bug.cgi?id=32117
+
+        Null checking Items in the SVGList is insufficient as items may
+        be floats, etc so add SVGListTraits::isNull and add appropriate
+        specializations.
+
+        Test: svg/dom/svglist-exception-on-out-bounds-error.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGListTypeOperations::isNull):
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::documentDetached):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::pushState):
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Multiple Undos removes the last posted comment and/or the ones before it.
+        <rdar://problem/6557066>
+        https://bugs.webkit.org/show_bug.cgi?id=32079
+        
+        The fix consists in preventing Undos and Redos to be applied to elements that
+        are no longer editable. We do not attempt to remove the commands from the queue.
+        It is a relatively simple fix that comes with a little extra overhead for the apply
+        and unapply methods where we are now performing the editability check.
+
+        Test: editing/undo/undo-indent-noneditable.html
+
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::doApply):
+        (WebCore::AppendNodeCommand::doUnapply):
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::doApply):
+        (WebCore::DeleteFromTextNodeCommand::doUnapply):
+        * editing/InsertIntoTextNodeCommand.cpp:
+        (WebCore::InsertIntoTextNodeCommand::doApply):
+        (WebCore::InsertIntoTextNodeCommand::doUnapply):
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::doApply):
+        (WebCore::InsertNodeBeforeCommand::doUnapply):
+        * editing/JoinTextNodesCommand.cpp:
+        (WebCore::JoinTextNodesCommand::doApply):
+        (WebCore::JoinTextNodesCommand::doUnapply):
+        * editing/MergeIdenticalElementsCommand.cpp:
+        (WebCore::MergeIdenticalElementsCommand::doApply):
+        (WebCore::MergeIdenticalElementsCommand::doUnapply):
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply):
+        (WebCore::RemoveNodeCommand::doUnapply):
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply):
+        (WebCore::SplitElementCommand::doUnapply):
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply):
+        (WebCore::SplitTextNodeCommand::doUnapply):
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply):
+        (WebCore::WrapContentsInDummySpanCommand::doReapply):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        Tests: fast/loader/stateobjects/document-destroyed-navigate-back.html
+               fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html
+               fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html
+               fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html
+               fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html
+               fast/loader/stateobjects/pushstate-object-types.html
+               fast/loader/stateobjects/pushstate-then-replacestate.html
+               fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html
+               fast/loader/stateobjects/replacestate-then-pushstate.html
+               http/tests/loading/state-object-security-exception.html
+
+        Derived sources and project file changes:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am
+        * WebCore.pro
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Add the new PopStateEvent:
+        * dom/PopStateEvent.cpp: Added.
+        (WebCore::PopStateEvent::PopStateEvent):
+        (WebCore::PopStateEvent::initPopStateEvent):
+        * dom/PopStateEvent.h: Added.
+        (WebCore::PopStateEvent::create):
+        (WebCore::PopStateEvent::isPopStateEvent):
+        (WebCore::PopStateEvent::state):
+        * dom/PopStateEvent.idl: Added.
+        * bindings/js/JSPopStateEventCustom.cpp: Added.
+        (WebCore::JSPopStateEvent::initPopStateEvent):
+        (WebCore::JSPopStateEvent::state):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/Event.cpp:
+        (WebCore::Event::isPopStateEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+
+        Add the "onpopstate" attribute:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+        Add pushState and replaceState management to the loader and history machinery:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::pushState):
+        (WebCore::JSHistory::replaceState):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateForSameDocumentNavigation): Augmented from "scrollToAnchor()", combining
+          both the same-document fragment scroll case with the new same-document state object activation case.
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/HistoryController.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Use insertItemAfterCurrent.
+        (WebCore::BackForwardList::insertItemAfterCurrent): Optionally insert the item without clearing the forward
+          list, as pushStateItem might've selectively cleared only certain items, with the bulk of the forward list
+          meant to remain.
+        (WebCore::BackForwardList::pushStateItem): Clear the forward list *only* for the state item's document, then 
+          insert the new item.
+        (WebCore::BackForwardList::removeItem):
+        * history/BackForwardList.h:
+        * page/History.cpp:
+        (WebCore::History::urlForState):
+        (WebCore::History::stateObjectAdded):
+        * page/History.h:
+        * page/History.idl:
+
+        Let HistoryItems and Documents associate with each other, as well as letting HistoryItems contain state objects:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        (WebCore::HistoryItem::setDocument):
+        (WebCore::HistoryItem::documentDetached):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::stateObject):
+        (WebCore::HistoryItem::document):
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify all back/forward history items owned by this Document that it
+          is going away.
+        (WebCore::Document::registerHistoryItem): Manage the list of back/forward history items this document owns.
+        (WebCore::Document::unregisterHistoryItem): Ditto.
+        * dom/Document.h:
+
+        Add the ability for Documents, DocumentLoaders, and FrameLoaderClients to be notified when a Documents
+        URL changes as the result of pushState(), replaceState(), or a popstate navigation:
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): If there's a pending state object, dispatch the popstate event.
+        (WebCore::Document::updateURLForPushOrReplaceState):
+        (WebCore::Document::statePopped): If loading is complete, dispatch the popstate event. Otherwise, set 
+          the pending state object.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::replaceRequestURLForSameDocumentNavigation):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeStateObjectForPageForFrame):
+
+        Change handling of "loading a HistoryItem" to distinguish between new-Document navigations and same-Document
+        navigations, combining the old concept of anchor scrolls with the new concept of state object navigations:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Changed to allow state object activations to pass through without the load stopping.
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix.
+        r51621 changed JS bindings only, broke v8's.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+
+2009-12-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Attributes and NamedNodeMaps aren't tracked correctly and may be prematurely garbage-collected.
+        https://bugs.webkit.org/show_bug.cgi?id=32094
+
+        Covered by existing test: LayoutTests/fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertNamedNodeMapToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Chromium: Add support for settings containing ":"
+
+        https://bugs.webkit.org/show_bug.cgi?id=32118
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection):
+
+2009-12-03  Rafael Antognolli  <antognolli@profusion.mobi>, Kenneth Christiansen <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        repaint events from outside the viewport aren't received
+        https://bugs.webkit.org/show_bug.cgi?id=32081
+
+        When using a tiled backing store for painting, you need to receive
+        event from outside the viewport. Setting the viewport to the size
+        of the contents is not an option if you want to make use of WebCore's
+        infrastructure for drawing scrollbars etc.
+
+        A new property, paintsEntireContents, has been introduced for the
+        above use-case. It is settable, as tiling will be optional for Qt,
+        and for the not yet upstreamed EFL port, there will be two different
+        views, where only one of them are tiled.
+
+        No change in behavior, so no new tests added.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::setPaintsEntireContents):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::paintsEntireContents):
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * platform/graphics/SimpleFontData.h: Change #ifdef to define getNSFont() on Chrome/Mac .
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Provide forward declarations
+        of Core Text functions that are public on 10.6 but SPI on 10.5.
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        Test: inspector/settings-set-get.html
+
+        * WebCore.Inspector.exp:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setting):
+        (WebCore::InspectorController::setSetting):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::attachWindow):
+        (WebCore::InspectorController::setAttachedWindowHeight):
+        (WebCore::InspectorController::storeLastActivePanel):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::showWindow):
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::ensureResourceTrackingSettingsLoaded):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::disableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setting):
+        (WebCore::InspectorFrontendHost::setSetting):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::populateSetting):
+        (WebCore::EmptyInspectorClient::storeSetting):
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] notifyHistoryItemChanged() should pass a pointer to the HistoryItem that changed.
+        https://bugs.webkit.org/show_bug.cgi?id=31915
+
+        No change in functionality so no new tests required.
+
+        * history/HistoryItem.cpp:
+        (WebCore::defaultNotifyHistoryItemChanged): Update this function to pass the HistoryItem that is being changed.
+        (WebCore::HistoryItem::setAlternateTitle): Update call to notifyHistoryItemChanged to include the new parameter.
+        (WebCore::HistoryItem::setURLString): ditto.
+        (WebCore::HistoryItem::setOriginalURLString): ditto.
+        (WebCore::HistoryItem::setReferrer): ditto.
+        (WebCore::HistoryItem::setTitle): ditto.
+        (WebCore::HistoryItem::setTarget): ditto.
+        (WebCore::HistoryItem::setDocumentState): On Android, add a call to notifyHistoryItemChanged. See bug for a discussion of why this is needed.
+        (WebCore::HistoryItem::clearDocumentState): ditto.
+        (WebCore::HistoryItem::setIsTargetItem): ditto.
+        (WebCore::HistoryItem::addChildItem): ditto.
+        (WebCore::HistoryItem::setFormInfoFromRequest): ditto.
+        * history/HistoryItem.h: Update signature of notifyHistoryItemChanged.
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        This change adds three new methods on the FrameLoaderClient interface to receive notifications when the BackForwardList changes.
+
+        No new tests required. Functionality on all platforms upstream remains the same. Android is the first platform to make use of these callbacks.
+
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Execute the callback.
+        (WebCore::BackForwardList::goBack): ditto.
+        (WebCore::BackForwardList::goForward): ditto.
+        (WebCore::BackForwardList::goToItem): ditto.
+        (WebCore::BackForwardList::setCapacity): dito.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidAddBackForwardItem): Add an empty implementation for the callback that does nothing.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidRemoveBackForwardItem): ditto.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeBackForwardIndex): ditto.
+        * loader/FrameLoaderClient.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] Upstream WebCore/history/android: Require some platform specific state attached to HistoryItem.
+        https://bugs.webkit.org/show_bug.cgi?id=31913
+
+        Android stores information such as the zoom scale factor and bridge back to the Java counterpart with HistoryItem.
+
+        No new tests required as this is Android specific code.
+
+        * history/HistoryItem.h: Add Android specific member data to HistoryItem.
+        * history/android: Added.
+        * history/android/AndroidWebHistoryBridge.h: Added.
+        * history/android/HistoryItemAndroid.cpp: Added, provides implementation for Android specific member functions in HistoryItem.
+        (WebCore::HistoryItem::bridge): Added.
+        (WebCore::HistoryItem::setBridge): Added.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        NULL ptr in SVGPathSegList::getPathSegAtLength()
+        https://bugs.webkit.org/show_bug.cgi?id=30313
+
+        Add exception checks to SVGPathSegList's implementation to catch (and propagate) exceptions.
+        Add null checks to SVGList's content manipulation functions to prevent
+        null values from entering the list in the first place.
+
+        Test: svg/dom/svgpath-out-of-bounds-getPathSeg.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::getPathSegAtLength):
+        * svg/SVGPathElement.h:
+        * svg/SVGPathElement.idl:
+        * svg/SVGPathSegList.cpp:
+        (WebCore::SVGPathSegList::getPathSegAtLength):
+        (WebCore::SVGPathSegList::toPathData):
+        (WebCore::SVGPathSegList::createAnimated):
+        * svg/SVGPathSegList.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sanitize web fonts using the OTS library 
+        https://bugs.webkit.org/show_bug.cgi?id=31106
+
+        Add support for OpenType sanitizer (OTS). It parses OpenType files (from @font-face)
+        and attempts to validate and sanitize them. We hope this reduces the attack surface
+        of the system font libraries.
+
+        * WebCore.gyp/WebCore.gyp: Added dependency to (chromium_src_dir)/third_party/ots/ library.
+        * WebCore.gypi: Added new files below.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * platform/graphics/chromium/FontCustomPlatformData.cpp: Validate and transcode a web font.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.cpp: Ditto.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/opentype/OpenTypeSanitizer.cpp: Added.
+        (WebCore::OpenTypeSanitizer::sanitize):
+        * platform/graphics/opentype/OpenTypeSanitizer.h: Added.
+        (WebCore::OpenTypeSanitizer::OpenTypeSanitizer):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Web Inspector frontend heap allocates ScriptFunctionCall which is unsafe
+        https://bugs.webkit.org/show_bug.cgi?id=32098
+
+        Fix is simply to make the ScriptFunctionCall stack allocated as nature intended.
+        Doing this required adding an appendArgument(char*) to ScriptFunctionCall so
+        that an explicit String cast would not be necessary.
+
+        To prevent something like this happening again in future i've added private
+        operator new implementations to ScriptFunctionCall making this type of mistake
+        produce errors when compiling.
+
+        Test case: Inspector tests now pass with GC on every alloc enabled.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        (WebCore::ScriptFunctionCall::operator new):
+        (WebCore::ScriptFunctionCall::operator new[]):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::setChildNodes):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        (WebCore::InspectorFrontend::childNodeInserted):
+        (WebCore::InspectorFrontend::childNodeRemoved):
+        (WebCore::InspectorFrontend::attributesUpdated):
+        (WebCore::InspectorFrontend::didRemoveNode):
+        (WebCore::InspectorFrontend::didGetChildNodes):
+        (WebCore::InspectorFrontend::didApplyDomChange):
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetCookies):
+        (WebCore::InspectorFrontend::didDispatchOnInjectedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+
+2009-12-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32072, clean up invalid @-rule error handling so that we
+        pass more CSS test suite stuff.  Make the grammar stop enforcing the ordering of @namespace vs.
+        @variables vs. @import.  Just let the parser handle that instead.  This simplifies the grammar and
+        makes error handling deal with more cases correctly.
+
+        Added fast/css/namespaces/namespaces-invalid-at-rules.xml
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::parseRule):
+        (WebCore::CSSParser::createCharsetRule):
+        (WebCore::CSSParser::createImportRule):
+        (WebCore::CSSParser::createMediaRule):
+        (WebCore::CSSParser::createKeyframesRule):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::addNamespace):
+        (WebCore::CSSParser::createVariablesRule):
+        * css/CSSParser.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Safari/Chromium for Windows fails to load CJK WebFonts
+        https://bugs.webkit.org/show_bug.cgi?id=31804
+        
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameAndActivateFont): Load a remote font even if the font has 2 or more faces.
+
+2009-12-02  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: Need tickmarks in scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ScrollbarThemeChromiumMac.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumMac.mm: Added.
+
+2009-11-13  Timothy Hatcher  <timothy@apple.com>
+
+        Expose a function to set the value of an input element on behalf of the user.
+        This function will dispatch the change event so the page is notified when autofill
+        happens. Also dispatch a change event when a select element is changed by autofill.
+
+        <rdar://problem/6760590> Would like a way to detect a login form AutoFill from JavaScript
+
+        Reviewed by Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj: Added the DOMHTMLInputElementPrivate.h header.
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Call setSelectedIndexByUser instead so
+        a change event is fired. This method is called by Safari autofill.
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Use dispatchFormControlChangeEvent instead
+        of dispatching the change event directly to be consistent.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLInputElement::setValueForUser): Added. Calls setValue with the sendChangeEvent
+        (WebCore::HTMLInputElement::setValue): Added the optional sendChangeEvent argument. Mimics setChecked.
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Added setValueForUser for non-JS languages.
+        * html/InputElement.h: Added setValueForUser.
+
+2009-12-02  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM tree selection disappears upon page refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31142
+
+        Test: inspector/elements-panel-selection-on-refresh.html
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::pushNodeByPathToFrontend):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        (WebCore::InspectorController::resetScriptObjects):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::~InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::reset):
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForPath):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectDefaultNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeByPathToFrontend):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32045, make sure escape sequences work with
+        all the @-rules we support.  When escape sequences are present, the lexical scanner
+        just returns a generic token name: ATKEYWORD.  We have to process the escape sequences
+        and then recheck against the rules we support with the final processed name.  If we
+        find a match, we mutate the token value to the appropriate rule name token, e.g.,
+        NAMESPACE_SYM.
+
+        Added fast/css/namespaces/namespaces-escapes.xml
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::recheckAtKeyword):
+        (WebCore::CSSParser::text):
+        * css/CSSParser.h:
+
+2009-12-02  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.:w
+
+        Allow to skip thread checks when accessing DOMDataStore for processes
+        which run V8 in single thread mode.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Should be covered by buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMDataStore):
+        (WebCore::enableFasterDOMStoreAccess):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        * bindings/v8/V8DOMMap.h:
+
+2009-12-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Code clean up: remove ScriptObjectQuarantine.* as a whole.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32060
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/js/ScriptObjectQuarantine.h: Removed.
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/v8/ScriptObjectQuarantine.h: Removed.
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+
+2009-12-02  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket handshake check query component of URL
+        https://bugs.webkit.org/show_bug.cgi?id=31617
+
+        Tests: websocket/tests/url-with-credential.html
+               websocket/tests/url-with-empty-query.html
+               websocket/tests/url-with-fragment.html
+               websocket/tests/url-with-query-for-no-query.html
+               websocket/tests/url-with-query.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::query): returns a null if query is not specified and returns an empty if query is specified but empty.
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::resourceName): added. add query component to path if specified.
+        (WebCore::WebSocketHandshake::clientLocation):
+        (WebCore::WebSocketHandshake::clientHandshakeMessage):
+
+2009-12-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Incorrect code in WebGLRenderingContext.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32046
+
+        Fix incorrect code that happened to work. != has higher precendence than &.
+        The simplest fix is to remove the "!= 0" which violates WebKit style
+        guidelines anyway.
+
+        Also added periods to few comments in the same function.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+
+2009-12-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change [Reflect] to [ConvertNullToNullString, Reflect] for min, max,
+        pattern and step attributes of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=31708
+
+        * html/HTMLInputElement.idl:
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement support for ARIA drag and drop
+        https://bugs.webkit.org/show_bug.cgi?id=32007
+
+        Test: platform/mac/accessibility/aria-drag-drop.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIADropping):
+        (WebCore::AccessibilityObject::supportsARIADragging):
+        (WebCore::AccessibilityObject::isARIAGrabbed):
+        (WebCore::AccessibilityObject::setARIAGrabbed):
+        (WebCore::AccessibilityObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::supportsARIADropping):
+        (WebCore::AccessibilityRenderObject::supportsARIADragging):
+        (WebCore::AccessibilityRenderObject::isARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::setARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-01  Adam Barth  <abarth@webkit.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Unreviewed port of @sandbox to V8.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+
+2009-12-01  Patrik Persson  <patrik.j.persson@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        Implement HTML5 sandbox attribute for iframes.
+        http://www.w3.org/TR/html5/text-level-semantics.html#attr-iframe-sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Tests: fast/frames/sandboxed-iframe-attribute-parsing.html
+               fast/frames/sandboxed-iframe-forms.html
+               fast/frames/sandboxed-iframe-navigation-allowed.html
+               fast/frames/sandboxed-iframe-navigation-parent.html
+               fast/frames/sandboxed-iframe-navigation-targetlink.html
+               fast/frames/sandboxed-iframe-navigation-windowopen.html
+               fast/frames/sandboxed-iframe-plugins.html
+               fast/frames/sandboxed-iframe-scripting.html
+               fast/frames/sandboxed-iframe-storage.html
+               http/tests/security/sandboxed-iframe-document-cookie.html
+               http/tests/security/sandboxed-iframe-modify-self.html
+               http/tests/security/xss-DENIED-sandboxed-iframe.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied.html
+
+        * bindings/js/JSDOMWindowCustom.cpp: sandboxing navigation
+        (WebCore::createWindow):
+        * bindings/js/ScriptController.cpp: sandboxing scripts
+        (WebCore::ScriptController::isEnabled):
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+        (WebCore::Document::cookie): raise exception when accessed from sandbox
+        (WebCore::Document::setCookie): raise exception when accessed from sandbox
+        (WebCore::Document::initSecurityContext): updae sandbox status
+        (WebCore::Document::updateSandboxFlags):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * html/HTMLAppletElement.cpp: sandboxing applets
+        (WebCore::HTMLAppletElement::createRenderer):
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        (WebCore::HTMLAppletElement::canEmbedJava):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLFrameOwnerElement.cpp: management of sandbox flags as stated in attribute
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement):
+        (WebCore::HTMLFrameOwnerElement::setSandboxFlags):
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::sandboxFlags):
+        * html/HTMLIFrameElement.cpp: sandbox attribute parsing
+        (WebCore::parseSandboxAttribute):
+        (WebCore::HTMLIFrameElement::parseMappedAttribute):
+        * html/HTMLIFrameElement.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::submitForm): sandboxing forms
+        (WebCore::FrameLoader::requestObject): sandboxing plugins
+        (WebCore::FrameLoader::shouldAllowNavigation): sandboxing navigation
+        (WebCore::FrameLoader::updateSandboxFlags): propagation of sandbox flags
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::ownerElementSandboxFlagsChanged):
+        (WebCore::FrameLoader::isSandboxed):
+        (WebCore::FrameLoader::sandboxFlags):
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/DOMWindow.cpp: disable storage and databases in sandboxed frames
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        (WebCore::DOMWindow::openDatabase):
+        * page/SecurityOrigin.cpp: added sandboxing status
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::toString):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::isSandboxed):
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Kilzer.
+
+        ARIA: support a way to create a static text object
+        https://bugs.webkit.org/show_bug.cgi?id=32030
+
+        Test: accessibility/aria-text-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::isDescendantOfBarrenParent):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::text):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-12-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inspector crashes when collecting on every allocation
+        https://bugs.webkit.org/show_bug.cgi?id=32044
+
+        The crash is caused by the prototype wrapper object getting collected
+        when allocating the object that is going to use it as a prototype.
+        Because the only reference to the prototype wrapper is through the
+        new object's Structure it does not get marked automatically.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add 'sampleSVGAnimationForElementAtTime' method to the LayoutTestController,
+        for the use within the new SVG animation test framework (LayoutTests/svg/animations/)
+
+        layoutTestController.sampleAnimationAtTime(<svg animation id>, <absolute time>, <svg element id>);
+        to sample a svg animateMotion/animateColor/animate/set element at certain times.
+
+        After the desired SVG animation starts and calling the method above, it's immediately forwarded to
+        the desired sampling time. After JS returns from the 'sampleSVGAnimationForElementAtTime' method
+        a callback is fired used to sample the animation value at the target time. It's modelled similar
+        to the CSS animation/transition testing framework, inspired by
+        LayoutTests/animations/animation-test-helpers.js.
+
+        Though it has been extended to integrate within the fast/js/js-test-* framework, that's used for
+        the SVG dynamic-updates tests, to simplify test creation, by utilizing script-tests/* only.
+
+        Adding a simple testcase testing the DRT methods, it will soon be extended to test animVal/baseVal
+        interaction, while animating.
+
+        Test: svg/animations/animVal-basics.html
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::sampleAnimationAtTime):
+        * svg/SVGDocumentExtensions.h:
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::SMILTimeContainer):
+        (WebCore::SMILTimeContainer::sampleAnimationAtTime):
+        (WebCore::SMILTimeContainer::updateAnimations):
+        * svg/animation/SMILTimeContainer.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add convenience methods to Element and QualifiedName that take
+        char* instead of AtomicString, in preparation for removing the
+        implicit conversion between the two types (30187).
+        https://bugs.webkit.org/show_bug.cgi?id=31749
+
+        * dom/Element.cpp:
+        (WebCore::Element::setCStringAttribute):  Equivalent to setAttribute.
+        * dom/Element.h:
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::init):  Shared impl of both constructors
+        (WebCore::QualifiedName::QualifiedName):  New c'tor taking char*.
+        * dom/QualifiedName.h:
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::CaseFoldingCStringTranslator):  Enables lookup by C string
+        (WebCore::HTTPHeaderMap::get):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::contains):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::add):  New variant that takes C string
+        * platform/network/HTTPHeaderMap.h:
+        (WebCore::HTTPHeaderMap::get):
+        (WebCore::HTTPHeaderMap::add):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):  Use symbolic names for headers
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceResponseBase.h:
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        More Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp: Include RetainPtr.h.
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32036
+        Implement CredentialStorage::getFromPersistentStorage for CFNetwork
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32001
+
+        Added missing localized strings (that I left out of the patch for bug #21554):
+        %d × %d pixels
+        %d × %d pixels (Natural: %d × %d pixels)
+
+        Also, changed formatting of these stings to conform with existing ones (added
+        a space on both sides of the multiply sign).
+
+        * English.lproj/localizedStrings.js: Added stings.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for bug 32032, empty namespaces should be allowed in @namespace directives in CSS.
+
+        Added fast/css/namespaces/namespaces-empty.xml
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addNamespace):
+        (WebCore::CSSStyleSheet::determineNamespace):
+
+2009-12-01  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Escape key in the Search Field should be more User Friendly
+        https://bugs.webkit.org/show_bug.cgi?id=32005
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): add mousedown listener on the search field
+        (WebInspector.searchFieldManualFocus): user clicked to focus on the search field
+        (WebInspector.searchKeyDown): handle escape
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by David Kilzer.
+
+        @namespace directives need to use "maybe_space" in the "maybe_ns_prefix" portion of the grammar to match
+        the spec.  Not doing so prevent comments from being used immmediately after the namespace prefix.
+
+        Added fast/css/namespaces-comments.xml
+
+        * css/CSSGrammar.y:
+
+2009-12-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Reloading WebInspector from context menu is closing it instead of reloading.
+        https://bugs.webkit.org/show_bug.cgi?id=32004
+
+        When reloading WebInspector, don't delete its m_page.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+
+2009-12-01  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds V8 bindings for Geolocation.
+        https://bugs.webkit.org/show_bug.cgi?id=30206
+
+        Also adds Geolocation files to Chrome build files.
+
+        * WebCore.gyp/WebCore.gyp: Modified. Corrects list of Geolocation IDL files.
+        * WebCore.gypi: Modified. Adds Geolocation files.
+        * bindings/v8/DOMObjectsInclude.h: Modified. Adds Geolocation includes.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified. Adds Geolocation files.
+        * bindings/v8/V8Index.cpp: Modified. Includes Geolocation generated headers.
+        * bindings/v8/V8Index.h: Modified. Adds Geolocation types to DOM_OBJECT_TYPES.
+        * bindings/v8/custom/V8CoordinatesCustom.cpp: Added. Handles optional properties.
+        * bindings/v8/custom/V8CustomBinding.h: Modified. Declares callbacks and getters.
+        * bindings/v8/custom/V8CustomPositionCallback.cpp: Added.
+        (WebCore::V8CustomPositionCallback::V8CustomPositionCallback): Added. Constructor.
+        (WebCore::V8CustomPositionCallback::~V8CustomPositionCallback): Added. Destructor.
+        (WebCore::V8CustomPositionCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionCallback.h: Added.
+        (WebCore::V8CustomPositionCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp: Added.
+        (WebCore::V8CustomPositionErrorCallback::V8CustomPositionErrorCallback): Added. Constructor.
+        (WebCore::V8CustomPositionErrorCallback::~V8CustomPositionErrorCallback): Added. Destructor.
+        (WebCore::V8CustomPositionErrorCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.h: Added.
+        (WebCore::V8CustomPositionErrorCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8GeolocationCustom.cpp: Added.
+        (WebCore::throwTypeMismatchException): Added. Throws a type mismatch error.
+        (WebCore::createPositionCallback): Added. Handles type checking for successCallback argument.
+        (WebCore::createPositionErrorCallback): Added. Handles type checking for errorCallback argument.
+        (WebCore::createPositionOptions): Added. Handles type checking for positionOptions argument.
+
+2009-12-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Provide a way to get ScriptState for the inspected page.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32020
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromPage):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Changed mallocs to fastMallocs and frees to fastFrees in GraphicsContext3D. Also added error returns
+        https://bugs.webkit.org/show_bug.cgi?id=30778
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::imageToTexture):
+
+2009-12-01  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Don't crash in DOMWindow event getter in OOM situations
+        https://bugs.webkit.org/show_bug.cgi?id=32017
+
+        Add missing null handle checks in DOMWindow event property
+        accessors.  V8Proxy::context(frame) can return a null handle in
+        OOM situations either if failing to initialize a context or if an
+        OOM is handled gracefully and javascript is disabled.
+
+        No new tests because we don't have a good way to test
+        out-of-memory bugs.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Updated HTMLCanvasElement to accept "experimental-webgl" as the context name.
+        https://bugs.webkit.org/show_bug.cgi?id=31672
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+
+2009-12-01  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Not reviewed: chromium build fix, added missing import.
+
+        * inspector/InspectorFrontendHost.cpp:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fix windows build via unexcluding generated files from
+        project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Stop copying IDL files in to the WebCore framework wrapper.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build by making the Xcode project compatible with Xcode 2.4.
+
+        This was probably broken by hand-editing the project file as Xcode itself
+        knows how to keep project files to a backwards-compatible subset of its format.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: windows build fix (bad vcproj in r51528).
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-27  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Split InspectorBackend into three parts: backend,
+        injected script host and frontend host.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31888
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInspectorBackendCustom.cpp: Removed.
+        * bindings/js/JSInspectorFrontendHostCustom.cpp: Added.
+        (WebCore::JSInspectorFrontendHost::search):
+        (WebCore::JSInspectorFrontendHost::setting):
+        (WebCore::JSInspectorFrontendHost::setSetting):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Removed.
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InjectedScriptHost.cpp: Added.
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::copyText):
+        (WebCore::InjectedScriptHost::nodeForId):
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        (WebCore::InjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::InjectedScriptHost::addNodesToSearchResult):
+        (WebCore::InjectedScriptHost::currentCallFrame):
+        (WebCore::InjectedScriptHost::databaseForId):
+        (WebCore::InjectedScriptHost::selectDatabase):
+        (WebCore::InjectedScriptHost::selectDOMStorage):
+        (WebCore::InjectedScriptHost::reportDidDispatchOnInjectedScript):
+        (WebCore::InjectedScriptHost::inspectorDOMAgent):
+        (WebCore::InjectedScriptHost::inspectorFrontend):
+        * inspector/InjectedScriptHost.h: Added.
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::inspectorController):
+        (WebCore::InjectedScriptHost::disconnectController):
+        * inspector/InjectedScriptHost.idl: Added.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::InspectorBackend):
+        (WebCore::InspectorBackend::storeLastActivePanel):
+        (WebCore::InspectorBackend::toggleNodeSearch):
+        (WebCore::InspectorBackend::resourceTrackingEnabled):
+        (WebCore::InspectorBackend::debuggerEnabled):
+        (WebCore::InspectorBackend::enableDebugger):
+        (WebCore::InspectorBackend::disableDebugger):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        (WebCore::InspectorBackend::removeBreakpoint):
+        (WebCore::InspectorBackend::pauseInDebugger):
+        (WebCore::InspectorBackend::resumeDebugger):
+        (WebCore::InspectorBackend::stepOverStatementInDebugger):
+        (WebCore::InspectorBackend::stepIntoStatementInDebugger):
+        (WebCore::InspectorBackend::stepOutOfFunctionInDebugger):
+        (WebCore::InspectorBackend::pauseOnExceptions):
+        (WebCore::InspectorBackend::setPauseOnExceptions):
+        (WebCore::InspectorBackend::profilerEnabled):
+        (WebCore::InspectorBackend::enableProfiler):
+        (WebCore::InspectorBackend::disableProfiler):
+        (WebCore::InspectorBackend::startProfiling):
+        (WebCore::InspectorBackend::stopProfiling):
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        (WebCore::InspectorBackend::currentCallFrame):
+        (WebCore::InspectorBackend::highlightDOMNode):
+        (WebCore::InspectorBackend::hideDOMNodeHighlight):
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        (WebCore::InspectorBackend::nodeForId):
+        * inspector/InspectorBackend.h:
+        (WebCore::InspectorBackend::create):
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorFrontendHost):
+        (WebCore::InspectorController::injectedScriptHost):
+        * inspector/InspectorFrontendHost.cpp: Added.
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::loaded):
+        (WebCore::InspectorFrontendHost::attach):
+        (WebCore::InspectorFrontendHost::detach):
+        (WebCore::InspectorFrontendHost::closeWindow):
+        (WebCore::InspectorFrontendHost::windowUnloading):
+        (WebCore::InspectorFrontendHost::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendHost::moveWindowBy):
+        (WebCore::InspectorFrontendHost::localizedStringsURL):
+        (WebCore::InspectorFrontendHost::hiddenPanels):
+        (WebCore::InspectorFrontendHost::platform):
+        (WebCore::InspectorFrontendHost::port):
+        (WebCore::InspectorFrontendHost::addResourceSourceToFrame):
+        (WebCore::InspectorFrontendHost::addSourceToFrame):
+        * inspector/InspectorFrontendHost.h: Added.
+        (WebCore::InspectorFrontendHost::create):
+        (WebCore::InspectorFrontendHost::inspectorController):
+        (WebCore::InspectorFrontendHost::disconnectController):
+        * inspector/InspectorFrontendHost.idl: Added.
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage.prototype.getEntries):
+        (WebInspector.DOMStorage.prototype.setItem):
+        (WebInspector.DOMStorage.prototype.removeItem):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.getTableNames):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        ():
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._copy):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._window):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/InspectorBackendStub.js: Added.
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.wrapCallback):
+        (.WebInspector.InspectorBackendStub.prototype.platform):
+        (.WebInspector.InspectorBackendStub.prototype.port):
+        (.WebInspector.InspectorBackendStub.prototype.closeWindow):
+        (.WebInspector.InspectorBackendStub.prototype.attach):
+        (.WebInspector.InspectorBackendStub.prototype.detach):
+        (.WebInspector.InspectorBackendStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorBackendStub.prototype.clearMessages):
+        (.WebInspector.InspectorBackendStub.prototype.searchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.search):
+        (.WebInspector.InspectorBackendStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorBackendStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorBackendStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorBackendStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorBackendStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorBackendStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorBackendStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorBackendStub.prototype.loaded):
+        (.WebInspector.InspectorBackendStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorBackendStub.prototype.windowUnloading):
+        (.WebInspector.InspectorBackendStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorBackendStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.disableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.disableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.startProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.stopProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorBackendStub.prototype.getProfile):
+        (.WebInspector.InspectorBackendStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorBackendStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorBackendStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.setSetting):
+        (.WebInspector.InspectorBackendStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorBackendStub.prototype.setting):
+        * inspector/front-end/InspectorControllerStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js: Added.
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.platform):
+        (.WebInspector.InspectorFrontendHostStub.prototype.port):
+        (.WebInspector.InspectorFrontendHostStub.prototype.closeWindow):
+        (.WebInspector.InspectorFrontendHostStub.prototype.attach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.detach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.search):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorFrontendHostStub.prototype.moveWindowBy):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.loaded):
+        (.WebInspector.InspectorFrontendHostStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setSetting):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setting):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype.attachDebuggerWhenShown):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
+        (WebInspector.ScriptsPanel.prototype._togglePause):
+        (WebInspector.ScriptsPanel.prototype._stepOverClicked):
+        (WebInspector.ScriptsPanel.prototype._stepIntoClicked):
+        (WebInspector.ScriptsPanel.prototype._stepOutClicked):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype.performSearch.findSearchMatches):
+        (WebInspector.SourceView.prototype.performSearch):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.pendingDispatches.0.get platform):
+        (WebInspector.get port):
+        (WebInspector.set currentPanel):
+        (WebInspector._createPanels):
+        (WebInspector._loadPreferences):
+        (WebInspector.set attached):
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (windowLoaded):
+        (WebInspector.windowUnload):
+        (WebInspector.close):
+        (WebInspector.toolbarDrag):
+        (WebInspector.UIString):
+
+2009-11-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        css2.1/t1205-c566-list-stl-00-e-ag.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23264
+        css2.1/t1205-c565-list-pos-00-b.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23263
+
+        Ignore whitespaces after list markers.
+        Rendering of this was already done for the case where inside=false.
+        This fixes the rendering of inside=true case and calcInlinePrefWidths.
+
+        Test: fast/lists/calc-width-with-space.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-11-30  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51212
+
+        Fix scriptStateFromNode and ScriptStateFromPage to take DOMWrapperWorld
+        as the first argument.
+        Move mainThreadNormalWorld() to ScriptState.{h,cpp}.
+        Add debuggerWorld() and pluginWorld() in ScriptState.h.
+
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptState.h:
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+
+2009-11-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Can focus but not type into content editable block that contains only non-editable content.
+        <rdar://problem/5982901>
+        https://bugs.webkit.org/show_bug.cgi?id=31750
+        
+        The goal is to change the way we choose a visible position
+        after hit detection, by preferring a visually equivalent editable
+        position if available. By doing this, it is possible to add content
+        to an editable block that initially contains only non editable elements.
+
+        Test: editing/selection/mixed-editability-10.html
+
+        * WebCore.base.exp: Changed to match the new signature of downstream
+        and upstream in the Position class.
+        * dom/Position.cpp:
+        (WebCore::Position::atEditingBoundary): Added.
+        (WebCore::Position::upstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::downstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        (WebCore::Position::getInlineBoxAndOffset): Modified to retrieve the inline box
+        to be used in calculating the caret rectangle.
+        * dom/Position.h:
+        (WebCore::Position::):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::atEditingBoundary): Added.
+        (WebCore::PositionIterator::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        * dom/PositionIterator.h:
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        (WebCore::lastEditablePositionBeforePositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): Added logic to prefer an editable position,
+        if available.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::isAllCollapsibleWhitespace): Added.
+        * rendering/RenderText.h:
+
+2009-11-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, add header needed for wx build.
+
+        * css/CSSFontFaceSrcValue.cpp:
+
+2009-11-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/7424387> WebCore binary missing symbols when built for x86_64 from a machine that cannot run x86_64 binaries
+
+        The check for whether WTF_USE_PLUGIN_HOST_PROCESS is defined occurs under the native architecture of the build machine.
+        If that is 32-bit then WTF_USE_PLUGIN_HOST_PROCESS will not be defined.  We work around this by forcing the check to
+        be performed against the x86_64 architecture.
+
+        * DerivedSources.make:
+
+2009-11-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in 
+        Safari caused by extreme column-gap and column-width values 
+        -and corresponding-
+        <rdar://problem/7425433>
+
+        Prevent desiredColumnCount from being less than 1 since it is used 
+        as a divisor.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcColumnWidth):
+
+2009-11-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31659
+        Connection must be closed in case of Web Socket handshake error
+
+        The network connection was closed, but the close event wasn't dispatched.
+
+        Tested by websocket/tests/handshake-error.html, which is un-skipped now.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::platformClose):
+        Call client didHandle() method. This looks strange in CFNetwork implementation, because
+        it's the client that asked to close the stream, so it shouldn't need the callback. It makes
+        more sense in cross-process implementation, because closing is async there.
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+
+        Remove the last uses of mainThreadCurrentWorld(), so the world is always obtained via
+        currentWorld().  Switch this to obtain the world from the ExecsState's lexical global
+        object instead.  Remove the call/construct/evaluate 'InWorld' methods, since these
+        are no longer necessary.
+
+        * WebCore.base.exp:
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::updateDocument):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::acceptNode):
+        * dom/NodeIterator.h:
+        (WebCore::NodeIterator::nextNode):
+        (WebCore::NodeIterator::previousNode):
+        * dom/TreeWalker.h:
+        (WebCore::TreeWalker::parentNode):
+        (WebCore::TreeWalker::firstChild):
+        (WebCore::TreeWalker::lastChild):
+        (WebCore::TreeWalker::previousSibling):
+        (WebCore::TreeWalker::nextSibling):
+        (WebCore::TreeWalker::previousNode):
+        (WebCore::TreeWalker::nextNode):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+
+2009-11-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        All HTML5 media element events should be regular events
+        https://bugs.webkit.org/show_bug.cgi?id=30513
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::noneSupported):
+        (WebCore::HTMLMediaElement::mediaEngineError):
+        (WebCore::HTMLMediaElement::setNetworkState):
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Call scheduleEvent instead of scheduleProgressEvent.
+        (WebCore::HTMLMediaElement::progressEventTimerFired):
+            Call scheduleEvent instead of scheduleProgressEvent. Call renderer->updateFromElement
+            after scheduling a 'progress' event so the controller will update download
+            progress indicator.
+        * html/HTMLMediaElement.h:
+            Remove scheduleProgressEvent prototype.
+
+2009-11-30  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Wrong console output for Regexp escape sequence
+        https://bugs.webkit.org/show_bug.cgi?id=31538
+
+        Updated inspector/console-format.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement): style issues.
+        (WebInspector.ConsoleView.createFilterElement): style issues.
+        (WebInspector.ConsoleView): added _customFormatters table.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): style isses.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): style issues.
+        (WebInspector.ConsoleView.prototype._format): simplified delegation to formatter logic.
+        (WebInspector.ConsoleView.prototype._formatobject):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._printArray):
+        (WebInspector.ConsoleMessage.prototype._format): commented and broke down the algorithm into parts.
+        (WebInspector.ConsoleMessage.prototype._formatWithSubstitutionString.append): handle substitution string formatting.
+        (WebInspector.ConsoleMessage.prototype._formatIndividualValue): handling individual value formatting.
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js: simplified regex formatting.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyStringAsFragment): converted new RegExp to literal for performance benefits.
+        * inspector/front-end/utilities.js: 
+        (Element.prototype.hasStyleClass): update inaccurate comment.
+        (String.prototype.trimURL): converted new RegExp to literal for performance benefits.
+
+2009-11-30  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Clean up V8 bindings for CSSStyleDeclaration and CSSVariableDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=31895
+
+        No new tests. This is already covered by:
+                fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+                fast/dom/CSSStyleDeclaration/css-style-item.html
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::collectionStringIndexedPropertyGetter):
+        (WebCore::setCollectionStringIndexedGetter):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds include of wtf/StdLibExtras.h for DEFINE_STATIC_LOCAL in V8 ScriptController.
+        https://bugs.webkit.org/show_bug.cgi?id=31932
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptController.cpp: Modified. Adds include of wtf/StdLibExtras.h.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PassOwnPtr include to ScriptExecutionContext.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31929
+
+        Build fix only, no new tests.
+
+        * dom/ScriptExecutionContext.h: Modified. Adds PassOwnPtr include.
+
+2009-11-30  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION (r49757): masking-mask-01-b.svg rendered incorrectly
+        [https://bugs.webkit.org/show_bug.cgi?id=31980]
+
+        It turns out, that we did not handle maskUnits="userSpaceOnUse"
+        correctly. We just need to move the context of the maskImage
+        if maskContentUnits="objectBoundingBox". The context gets scaled
+        on this unit combination, so we have to substract the position of
+        the targetRect. On userSpaceOnUse the position just depends on the
+        position of the mask element.
+        I added a test with some senseless and reasonable values for size
+        and postion of the mask and it's contents. I also used every
+        combination of maskUnits and maskContentUnits to be sure, that it
+        is fixed this time.
+
+        Test: svg/custom/mask-with-all-units.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31928
+
+        Build fix only, no new tests.
+
+        * page/DOMWindow.cpp: Modified. Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds SHARED_WORKERS guards to V8 WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=31926
+
+        Build fix only, no new tests.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+
+2009-11-30  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Chrome::contentsSizeChanged() is called when the content size has not changed
+        https://bugs.webkit.org/show_bug.cgi?id=31978
+
+        Do not trigger contentsSizeChaned() is the new size is the same as the old one.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix some compiler warnings seen on QtWebKit/Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31962
+
+        No new tests as there is no functional change.
+
+        * platform/network/ResourceHandle.h: Make destructor virtual as 
+        after r50772 ResourceHandle has virtual functions.
+
+        * plugins/mac/PluginPackageMac.cpp: 
+        (WebCore::PluginPackage::fetchInfo): Fix typo WTF is a namespace
+        not a label
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Add l to the format
+        specifier
+
+2009-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add new headers to sources list.
+
+        * GNUmakefile.am:
+
+2009-11-30  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Get context menu to work in QGraphicsView
+        
+        Flash expects the value in record.where to be the global position for
+        displaying the context menu.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31979
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PLATFORM(CHROMIUM) guards around memory usage code in V8GCController.
+        https://bugs.webkit.org/show_bug.cgi?id=31925
+
+        This code uses ChromiumBridge and Chromium-specific constant values not
+        appropriate for other platforms such as Android.
+
+        Build fix only, no new tests.
+
+        * bindings/v8/V8GCController.cpp: Modified. Adds PLATFORM(CHROMIUM) around Chromium-specific code.
+
+2009-11-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix.
+
+        Correct draw signature used in ImageCairoWin.cpp.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        postMessage should serialize File objects
+        https://bugs.webkit.org/show_bug.cgi?id=31955
+
+        Update SerializedScriptValue to include support for
+        File objects in the serialized object graph.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asString):
+
+2009-11-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Optimize the hierarchy rebuilding of compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31879
+        
+        When updating the compositing layer hierarchy, instead of removing all
+        child layers and then re-adding them one by one, build a vector of child
+        layers, and set them in one go.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::setChildren): New method that takes a Vector of child
+        GraphicsLayers.
+        
+        * platform/graphics/mac/GraphicsLayerCA.h: Override setChildren().
+        * platform/graphics/win/GraphicsLayerCACF.h: Ditto.
+        * platform/graphics/mac/GraphicsLayerCA.mm: 
+        (WebCore::GraphicsLayerCA::setChildren): Implement setChildren() to 
+        set the bit that notes that sublayers changed.
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::setChildren): Implement setChildren() to 
+        udpate sublayers, with a note that this is not efficient.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        When updating compositing layers, use the faster updateLayerTreeGeometry() if
+        we know that no layer hierarchy changes are needed, and, at the root, use
+        the vector returned from rebuildCompositingLayerTree() to attach the root
+        layer.
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Changed to
+        collect child layers into Vectors of GraphicsLayers, which can be set as
+        layer children in one go.
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry): Split out from
+        rebuildCompositingLayerTree() for simplicity, and called when we just need to
+        update layer geometry, without doing any reparenting.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31971
+
+        Updated comment to reflect latest XSSAuditor bindings.
+
+        No functionality was changed. So, no new tests.
+
+        * page/XSSAuditor.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31969
+
+        Removes unnecessary #include files.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSComputedStyleDeclaration.cpp: Removed include CachedImage.h, and
+        Pair.h
+        * css/CSSCursorImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSFontFaceSrcValue.cpp: Removed include Node.h
+        * css/CSSFontSelector.cpp: Removed include NodeList.h
+        * css/CSSGradientValue.cpp: Removed include GraphicsContext.h, ImageBuffer.h
+        * css/CSSImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSImportRule.cpp: Removed include MediaList.h
+        * css/CSSMutableStyleDeclaration.cpp: Removed include CSSProperty.h
+        * css/CSSRule.cpp: Removed include CSSStyleSheet.h
+        * css/CSSStyleSelector.cpp: Removed include CSSFontFace.h,
+        CSSFontFaceSource.h, and CSSProperty.h
+        * page/EventSource.h: Removed include EventListener.h
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31965
+
+        Removed #include KeyframeList.h from CSSStyleSelector.h. Instead,
+        forward declared it.
+
+        As a side effect, we need to #include KeyframeList.h in
+        RenderLayerBacking.cpp.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h: Removed #include KeyframeList.h
+        * rendering/RenderLayerBacking.cpp: Added #include KeyframeList.h
+
+2009-11-29  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Continue to search for matching node in the case where multiple nodes
+        have the same id.
+        https://bugs.webkit.org/show_bug.cgi?id=31428
+
+        Test: fast/dom/Element/id-in-node-list-index01.html
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::itemWithName):
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31966
+
+        Removed #include RenderStyle.h from file KeyframeAnimation.h. Instead,
+        forward declared it.
+
+        No functionality was changed. So, no new tests.
+
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, fix change log entry date.
+
+        For some reason, bugzilla-tool did not update the date in the change
+        log entry for my last commit (r51468). So, this commit fixes the date
+        of that entry.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31964
+
+        Removed #include StringImpl, StyleImage. Instead, forward declared them.
+        Also, we can substitute #include <wtf/PassRefPtr.h> for #include PlatformString.h,
+        since it seems we only really used it to include PassRefPtr.h.
+
+        No functionality was changed. So, no new tests.
+
+        * rendering/style/ContentData.h:
+
+2009-11-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the rendering and storage directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31906
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class SQLTransactionClient      - storage/DatabaseThread.cpp:45
+        class SQLTransactionCoordinator - storage/DatabaseThread.cpp:46
+        class OriginUsageRecord         - storage/OriginQuotaManager.cpp:66
+        class DatabaseTracker           - storage/DatabaseTracker.cpp:62
+        class ScrollbarTheme            - (its child class) rendering/RenderScrollbarTheme.cpp:35
+        class RenderSelectionInfoBase   - (its child class) rendering/RenderView.cpp:310
+        class RenderOverflow            - rendering/RenderBox.cpp:2846
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        struct FillLayer                - css/CSSStyleSelector.cpp:197
+        struct ShadowData               - rendering/style/ShadowData.cpp:35
+        class CounterContent            - css/CSSStyleSelector.cpp:4111
+
+        * platform/ScrollbarTheme.h:
+        * rendering/RenderOverflow.h:
+        * rendering/RenderSelectionInfo.h:
+        * rendering/style/CounterContent.h:
+        * rendering/style/FillLayer.h:
+        * rendering/style/ShadowData.h:
+        * storage/DatabaseTracker.h:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLTransactionClient.h:
+        * storage/SQLTransactionCoordinator.h:
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51428.
+
+        [Chromium] Ignore line-height CSS property for PushButton
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustButtonStyle):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium test fix by reverting r51413.
+
+        [v8] Do not check the thread when accessing DOMDataStore
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, comment fix.
+
+        Corrected misspelling of the word "implemented".
+
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31940
+
+        Makes the error messages more descriptive when we refuse to load an object/embed or
+        refuse to load from the document base URL.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadObject): Changed console message to be more descriptive.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto.
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Instead of generating negative identifiers for cached resources in
+        InspectorController and extending identifier type from 'unsigned long' to 'long
+        long' reuse progress tracker from the inspected page to generate those
+        identifiers. It guarantees that InspectorResources have unique ids since
+        all of them are generated by that progress tracker.
+
+        Added a couple new overloaded methods to Script* objects that accept
+        long and unsigned long arguments. These types of argumens have already
+        been passed as long long.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31921
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::getTrackedResource):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Use inspected page's ProgressTracker to generate unique identifiers for cached resources in InspectorController.
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::createCached):
+        * inspector/InspectorResource.h: Change InspectorResource identifier type from 'long long' to 'unsigned long'.
+        (WebCore::InspectorResource::create):
+        (WebCore::InspectorResource::identifier):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+
+2009-11-26  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Assertion failure in RenderBlock::positionForPointWithInlineChildren when running fast/inline/relative-positioned-overflow.html
+        https://bugs.webkit.org/show_bug.cgi?id=29966
+
+        When an empty inline element is clicked, the root inline box has
+        no leaf children. Use the renderer of a normal child instead.
+
+        This change resolves Windows port's assertion failure in a layout test.
+        Also, this fixes the behavior when a user drags the mouse from an
+        empty inline element to above texts.
+
+        Test: editing/selection/last-empty-inline.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+
+2009-11-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to push buttons on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=button> issue with Chromium/Windows
+        and Chromium/Linux.
+        
+        * rendering/RenderThemeChromiumSkia.cpp: Implement adjustButtonStyle() to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustButtonStyle().
+
+2009-11-26  Kinuko Yasuda  <kinuko@chromium.com>
+
+        Reviewed by Eric Seidel.
+
+        Remove the special charset meta tag in the clipboard so that
+        copy-and-paste with interchange breaklines/spaces works correctly
+        within WebKit.
+
+        No new tests.  Layout tests that involve copy-and-paste with
+        interchange breaklines (like editing/pasteboard/paste-line-endings-00?)
+        should pass on Mac/Chromium with this fix.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-11-26  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Eric Seidel.
+
+        Compile with QT_NO_WHEELEVENT defined.
+
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        No new tests as there is no functional change.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp: Change the
+          path for GOwnPtr.h.
+        * platform/text/TextEncoding.cpp: Ditto.
+        * platform/text/gtk/TextCodecGtk.cpp: Ditto.
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Not reviewed. Build fix: revert r51421.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h: Remove unused DocumentLoader parameters from inspector methods.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength): Update loading end time when new data are received.
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad): Notify InspectorController about the failure.
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21554
+
+        Implements support for hovering over <img> src to display the height and width of that image
+        in a tooltip. Displays both the displayable and natural dimensions of the image.
+
+        Test: inspector/elements-img-tooltip.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode): Added.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle.callback):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.getPropertiesAsync): Added.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyURLAsNode): Added tooltipText argument.
+        (WebInspector.linkifyURL): Ditto.
+
+2009-11-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after drawPattern API change.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use an internal field instead of hidden property to speedup lookup
+        of entered isolated world.
+
+        Plus some inlinings.
+        https://bugs.webkit.org/show_bug.cgi?id=31884
+
+        Covered by layout tests + manual running of some benchmarks as
+        content scripts.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+        (WebCore::V8IsolatedWorld::getGlobalObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Corrects build break on Windows.
+
+        Rename platform/text/qt/TextBoundaries.cpp to TextBoundariesQt.cpp since
+        platform/text/TextBoundaries.cpp was compiled instead when compiling with nmake.
+
+        * WebCore.pro:
+        * platform/text/qt/TextBoundariesQt.cpp: Renamed from WebCore/platform/text/qt/TextBoundaries.cpp.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not check if the thread is main or not when accessing DOMDataStore as currently in Chromium WebKit is used in main thread only.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Covered by layout tests and buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Pass mouse position relative to the fake window
+        
+        When using off-screen rendering, we need to pass mouse events relative
+        to the fake window instead of the global position.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31794
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use QNetworkReply::rawHeaderPairs
+        https://bugs.webkit.org/show_bug.cgi?id=31826
+
+        The QNetworkReply is internally storing the HTTP headers
+        as a list of pairs. Currently we have to ask the QNetworkReply
+        to put all header names into a QStringList. Afterwards we will
+        iterate over this QStringList and ask the QNetworkReply to
+        give us the value for this header name. The current Qt implementation
+        is doing a linear to find the header value.
+
+        Use a new API to directly access the list of pairs and push
+        this into WebCore. This avoids doing some allocations and doing
+        linear searches from within a loop.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-21  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add Qt specific information of RenderPart
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        The WebCore::Widget of the RenderPart (RenderWidget) might be
+        backed with a platform widget. Print both the WebCore::Widget
+        and platform widget state. In the above bug we had a problem
+        that the WebCore::Widget was invisible but the QWidget was
+        visible.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Add special case for RenderPart
+
+2009-11-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Call Widget::setSelfVisible from hide/show
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        Call Widget::setSelfVisible from Widget::show and
+        Widget::hide and use isParentVisible to decide
+        if the widget should be shown. This way client
+        code can rely on isVisible.
+
+        Change PluginViewQt::show, PluginViewQt::hide to
+        call the base class as it is doing the right thing
+        now. Add an assert verify that platfomWidget and
+        platformPluginWidget are the same.
+
+        * manual-tests/qt/qtplugin.html: Modify manual test
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix compilation of REQUEST_DEBUG debug code
+        https://bugs.webkit.org/show_bug.cgi?id=31850
+
+        In r47907 the single parameter KURL constructor to parse
+        from a WebCore::String was replaced with a two parameter
+        constructor. I think in this debug case parsing the urls
+        again is no problem and I have changed the code to use the
+        two parameter version.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading):
+
+2009-11-26  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Avoid using JavaScript objects as context data
+        https://bugs.webkit.org/show_bug.cgi?id=31873
+
+        Change the context "data" from a JavaScript object holding the two properties type and value to
+        a string holding type and value separated by a comma.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::setContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-11-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Implement canSetValueAttribute in the API, the clean-up part.
+        https://bugs.webkit.org/show_bug.cgi?id=31894
+
+        * accessibility/chromium/AccessibilityObjectWrapper.h: Added RefCounted decl.
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper): Removed mis-refcountingness.
+
+2009-11-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Off-by-one error in index validation for drawElements and drawArrays
+        https://bugs.webkit.org/show_bug.cgi?id=31891
+
+        Fixed computation of number of elements for bound array objects.
+
+        Test: fast/canvas/webgl/index-validation.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+
+2009-11-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Update SharedScript to use eventNames() instead of EventNames()
+        https://bugs.webkit.org/show_bug.cgi?id=31890
+
+        * SharedScript/WebKitSharedScript.cpp:
+        (WebCore::LoadEventTask::performTask):
+
+2009-11-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, all through to m_qtMovie.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+            Make all but the destructor private since MediaPlayer call through the media
+            engine interface.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks):
+            Use handy new constants for QuickTime track types.
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+            New, closed caption support.
+        * platform/graphics/win/QTMovieWin.h:
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+            Deal with closed caption buttons.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::shouldRenderMediaControlPart):
+            New, don't ask the media engine if it has closed captions unless the Safari theme will
+            be able to render the button.
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+            New.
+        * rendering/RenderThemeWin.h:
+
+2009-11-25  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        MessagePorts always look remotely entangled even when closed.
+        https://bugs.webkit.org/show_bug.cgi?id=31698
+
+        Tests: Existing tests suffice, Chromium soak test passes now.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Removed kMessagePortEntangledPortIndex which is no longer used.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper):
+        Simplified GC code to reflect the Chromium MessagePort implementation
+        (locallyEntangledPort() always returns false).
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+        Cleaned up epilogue code to handle the case where the port gets closed
+        in mid-GC (due to the parent context being freed).
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::close):
+        Now sets the closed flag.
+        (WebCore::MessagePort::disentanglePorts):
+        Updated to use new isCloned() API instead of relying on isEntangled(), which was incorrect.
+        * dom/MessagePort.h:
+        Added a m_closed flag and updated isEntangled() to check it.
+        (WebCore::MessagePort::isEntangled):
+        Now returns false if the port has been closed.
+        (WebCore::MessagePort::isCloned):
+        Added new API to differentiate between cloned and closed ports (closed ports can still be passed to postMessage).
+
+2009-11-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crash of QtWebKit on any page with Flash when compiled with MinGW.
+
+        Fix inline assembly, don't dereference the function pointer twice.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+
+2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove the Referer header when redirecting to a non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31785
+
+        This makes Qt pass two tests introduced in r50226.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        The select elements do not reflect the actual choice the user makes.
+        https://bugs.webkit.org/show_bug.cgi?id=31831
+
+        Handle the drawing of the listboxes in Android code.
+
+        No new features, just fixing an Android problem. Existing layout tests are sufficient.
+
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::theme):
+        (WebCore::RenderThemeAndroid::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::adjustButtonStyle):
+        (WebCore::RenderThemeAndroid::paintTextArea):
+        (WebCore::RenderThemeAndroid::adjustListboxStyle):
+        * platform/android/RenderThemeAndroid.h:
+
+2009-11-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Load InspectorResource mime type from CachedResource for 304 responses
+
+        For network libraries that do not merge cache data into 304 ResourceResponses,
+        the mime type for cached resources is unknown.
+        https://bugs.webkit.org/show_bug.cgi?id=31868
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateResponse):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::type):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android is missing implementation of SSL Key generator functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31825
+
+        This change adds the PlatformBridge class to platform/android.
+        PlarformBridge is used to access the embedding layer for things
+        such as key generator, cookies, plugins, etc.
+
+        No new tests required, this is platform code.
+
+        * platform/android/PlatformBridge.h: Added.
+        * platform/android/SSLKeyGeneratorAndroid.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+
+2009-11-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] use gst_init_check() instead of gst_init()
+        https://bugs.webkit.org/show_bug.cgi?id=31864
+
+        Use gst_init_check() instead of gst_init() to prevent eventual
+        unexpected exit of the application.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+
+2009-11-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Some tests are crashing from time to time
+        https://bugs.webkit.org/show_bug.cgi?id=31866
+
+        Make sure we do not notify the client of a finished load, if the
+        load has been cancelled, or the client is gone.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-24  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Android] Upstream Android changes to WebCore/bridge/jni
+        https://bugs.webkit.org/show_bug.cgi?id=31824
+
+        No new tests required as no new functionality.
+
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass): Add calls to delete allocated references, to avoid potential leaks.
+        * bridge/jni/jni_instance.cpp: Add an Android include path.
+        * bridge/jni/jni_instance.h: Add getter/setter for JObjectWrapper::_instance and make the JavaInstance ctor and member variables protected. Both needed for the Android port, see bug for discussion.
+        (JSC::Bindings::JObjectWrapper::instance): Added.
+        (JSC::Bindings::JObjectWrapper::setInstance): Added.
+        * bridge/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod): Delete an allocated reference to avoid a potential leak.
+        * bridge/jni/jni_utility.h:
+        (JSC::Bindings::callJNIMethodV): Delete an allocated reference to avoid a potential leak.
+
+2009-11-24  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the plugins and rendering directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31827
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class PluginRequest             - plugins/PluginView.cpp:521
+        class PluginMainThreadScheduler - plugins/PluginMainThreadScheduler.cpp:34
+        class PluginDatabase            - plugins/PluginDatabase.cpp:50
+        struct MimeClassInfo            - plugins/PluginInfoStore.cpp:50
+        struct PluginInfo               - plugins/PluginInfoStore.cpp:40
+        class RenderArena               - dom/Document.cpp:1401
+        class RenderImageScaleData      - rendering/RenderImage.cpp:149
+        class TableLayout               - (its child class) rendering/RenderTable.cpp:82
+        struct ColumnInfo               - rendering/RenderBlock.cpp:3590
+        struct FloatingObject           - rendering/RenderBlock.cpp:2300
+        struct MaxMargin                - rendering/RenderBlock.cpp:4794
+        class RenderMarquee             - rendering/RenderLayer.cpp:3277
+
+        * plugins/PluginData.h:
+        * plugins/PluginDatabase.h:
+        * plugins/PluginMainThreadScheduler.h:
+        * plugins/PluginView.h:
+        * rendering/RenderArena.h:
+        * rendering/RenderBlock.cpp:
+        * rendering/RenderBlock.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderMarquee.h:
+        * rendering/TableLayout.h:
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Initial implementation of WebKitSharedScript and SharedScriptContext
+        https://bugs.webkit.org/show_bug.cgi?id=31569
+
+        No new tests since there are no bindings yet (soon to come).
+
+        * DerivedSources.make: Add WebKitSharedScript and SharedScriptContext to a list of idl files.
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify WebKitSharedScriptRepository that document is detaching.
+        * dom/EventTarget.cpp: Add new casting methods, since the new types are EventTargets.
+        (WebCore::EventTarget::toWebKitSharedScript):
+        (WebCore::EventTarget::toSharedScriptContext):
+        * dom/EventTarget.h: Ditto
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::isSharedScriptContext): New virtual method, since there is a new type of context.
+
+        * SharedScript/SharedScriptContext.cpp: Added. Similar to WorkerContext, but w/o threading.
+        (WebCore::SharedScriptContext::SharedScriptContext):
+        (WebCore::SharedScriptContext::~SharedScriptContext):
+        (WebCore::SharedScriptContext::clearScript):
+        (WebCore::SharedScriptContext::virtualURL):
+        (WebCore::SharedScriptContext::virtualCompleteURL):
+        (WebCore::SharedScriptContext::reportException):
+        (WebCore::SharedScriptContext::addMessage):
+        (WebCore::SharedScriptContext::resourceRetrievedByXMLHttpRequest):
+        (WebCore::SharedScriptContext::scriptImported):
+        (WebCore::SharedScriptContext::matches):
+        (WebCore::SharedScriptContext::addToDocumentsList):
+        (WebCore::SharedScriptContext::destructionTimerFired):
+        (WebCore::SharedScriptContext::removeFromDocumentList):
+        (WebCore::SharedScriptContext::load):
+        (WebCore::SharedScriptContext::postTask):
+        (WebCore::SharedScriptContext::eventTargetData):
+        (WebCore::SharedScriptContext::ensureEventTargetData):
+        (WebCore::SharedScriptContext::scriptExecutionContext):
+        * SharedScript/SharedScriptContext.h: Added.
+        (WebCore::SharedScriptContext::create):
+        (WebCore::SharedScriptContext::isSharedScriptContext):
+        (WebCore::SharedScriptContext::userAgent):
+        (WebCore::SharedScriptContext::toSharedScriptContext):
+        (WebCore::SharedScriptContext::self):
+        (WebCore::SharedScriptContext::script):
+        (WebCore::SharedScriptContext::loaded):
+        (WebCore::SharedScriptContext::name):
+        (WebCore::SharedScriptContext::refEventTarget):
+        (WebCore::SharedScriptContext::derefEventTarget):
+        (WebCore::SharedScriptContext::refScriptExecutionContext):
+        (WebCore::SharedScriptContext::derefScriptExecutionContext):
+        * SharedScript/SharedScriptContext.idl: Added.
+
+        * SharedScript/SharedScriptController.h: 
+        Added. Empty implementation of a ScriptController, will come later as part of bindings. Needed to compile.
+
+        * SharedScript/WebKitSharedScript.cpp: Added. EventTarget-based DOM object.
+        (WebCore::WebKitSharedScript::WebKitSharedScript):
+        (WebCore::WebKitSharedScript::~WebKitSharedScript):
+        (WebCore::WebKitSharedScript::setContext):
+        (WebCore::LoadEventTask::create): Fires asynchronous 'load' event when underlying SharedScriptContext is initialized.
+        (WebCore::LoadEventTask::performTask):
+        (WebCore::LoadEventTask::LoadEventTask):
+        (WebCore::WebKitSharedScript::scheduleLoadEvent):
+        * SharedScript/WebKitSharedScript.h: Added.
+        (WebCore::WebKitSharedScript::create):
+        (WebCore::WebKitSharedScript::scriptExecutionContext):
+        (WebCore::WebKitSharedScript::toWebKitSharedScript):
+        (WebCore::WebKitSharedScript::context):
+        (WebCore::WebKitSharedScript::refEventTarget):
+        (WebCore::WebKitSharedScript::derefEventTarget):
+        (WebCore::WebKitSharedScript::eventTargetData):
+        (WebCore::WebKitSharedScript::ensureEventTargetData):
+        * SharedScript/WebKitSharedScript.idl: Added.
+
+        * SharedScript/WebKitSharedScriptRepository.cpp: Added. Implements a list of running SharedScriptContexts.
+        (WebCore::ScriptLoader::ScriptLoader): The helper class to load an initial script of SharedScriptContext.
+        (WebCore::ScriptLoader::load):
+        (WebCore::ScriptLoader::notifyFinished):
+        (WebCore::WebKitSharedScriptRepository::instance): Repository has a static global instance.
+        (WebCore::WebKitSharedScriptRepository::connect):
+        (WebCore::WebKitSharedScriptRepository::documentDetached): Called from Document::detach().
+        (WebCore::WebKitSharedScriptRepository::removeSharedScriptContext): Called from ~SharedScriptContext().
+        (WebCore::WebKitSharedScriptRepository::connectToSharedScript):
+        (WebCore::WebKitSharedScriptRepository::getSharedScriptContext):
+        * SharedScript/WebKitSharedScriptRepository.h: Added.
+        (WebCore::WebKitSharedScriptRepository::WebKitSharedScriptRepository):
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+        
+        This part of the checkin adds the Windows specific GraphicsLayer support files.
+        It provides the interface between GraphicsLayer and CACF. It also deals with
+        the compositing loop, and provides the plumbing to pass the root layer up to
+        WebView.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateRecursive):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/win/GraphicsLayerCACF.cpp: Added.
+        * platform/graphics/win/GraphicsLayerCACF.h: Added.
+        * platform/graphics/win/WKCACFContextFlusher.cpp: Added.
+        * platform/graphics/win/WKCACFContextFlusher.h: Added.
+        * platform/graphics/win/WKCACFContextFlusherWin.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.h: Added.
+        * platform/graphics/win/WKCACFLayerWindow.cpp: Added.
+        * platform/graphics/win/WKCACFLayerWindow.h: Added.
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Do error checking of parameter to createShader
+        https://bugs.webkit.org/show_bug.cgi?id=31808
+
+        Test: fast/canvas/webgl/invalidPassedParams.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::createShader):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+
+2009-11-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to a search field on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31820
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=search> issue with Chromium/Windows
+        and Chromium/Linux.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldStyle): Implement this to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustSearchFieldStyle().
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Stylistic fix: indent the member var initialisation.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31848 - Remove uses of mainThreadCurrentWorld, and of currentWorld using a globalData.
+
+        These methods get the world from the global data rather than from an execstate.
+        If the current world is always read from an exec state then it can be read
+        from the global object, and world entry can become automagical, rather than
+        being explicitly set by an EnterDOMWrapperWorld.
+
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::DOMObjectWrapperMapFor):
+        (WebCore::hasCachedDOMObjectWrapper):
+        (WebCore::getCachedDOMObjectWrapper):
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::hasCachedDOMNodeWrapper):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::cacheDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        (WebCore::createWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Also, don't include the wrong one!
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Include the proper WKSI header.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVGUseElement::toClipPath can crash
+        <rdar://problem/7385270>
+
+        Null-test m_shadowTreeRootElement again, because the call to buildPendingResource() may not
+        actually initialize it.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Windows build fix.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        (WebCore::imageFromSelection):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Not reviewed. Revert r51351 until a new WebKitSupportLibrary is available.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        * rendering/RenderThemeWin.cpp:
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31844
+        SocketStreamHandleCFNet should support CONNECT proxy credentials
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/CredentialStorage.h:
+        * platform/network/mac/CredentialStorageMac.mm: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        * platform/network/cf/CredentialStorageCFNet.cpp: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        Add support for fetching credentials from persistent storage (CFNet version is currently
+        a stub).
+
+        * bindings/js/JSWebSocketCustom.cpp: Removed an unneeded include.
+
+        * platform/network/cf/SocketStreamHandle.h:
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::getStoredCONNECTProxyCredentials):
+        (WebCore::authenticationSchemeFromAuthenticationMethod):
+        (WebCore::SocketStreamHandle::addCONNECTCredentials):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        Check if connection attempt was resulted in 407, and try stored credentials if it did.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * WebCore.base.exp:
+        Updated WKSI.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 2: Add a new bit to the PaintBehavior flags, PaintBehaviorFlattenCompositingLayers,
+        and pass that down when painting into an image.
+        
+        When set, it forces painting of compositing layers to go down a software paint path
+        when all layers are painted, irrespective of compositing status, and where
+        3d transforms are flattened to 2d. When doing this, we also need to use temporary
+        clip rects for layers which are normally composited.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::paintBehavior):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::imageFromRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::renderableTransform):
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::paintsWithTransparency):
+        (WebCore::RenderLayer::paintsWithTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderObject.h:
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 1: Rename PaintRestriction to PaintBehavior, and make it a bitmask, in
+        preparation for adding a new flag related to painting into an image.
+        
+        PaintBehaviorSelectionOnly and PaintBehaviorForceBlackText are now separate flags.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::paintContents):
+        (WebCore::FrameView::setPaintBehavior):
+        * page/FrameView.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::selectionImage):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Renderer hang when using www.expedia.com
+        https://bugs.webkit.org/show_bug.cgi?id=31822
+
+        Test: http/tests/cache/subresource-failover-to-network.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously): Use the originalRequest
+        when inheriting cache policy.  This matches SubresourceLoader::create.
+
+2009-11-23  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Change get... calls to latest spec
+        https://bugs.webkit.org/show_bug.cgi?id=30091
+
+        Removed old versions of get calls on WebGLRenderingContext and
+        added new ones per spec returning "any". New code simplifies
+        GraphicsContext3D and fixes previously unimplemented routines.
+        Added custom JS and V8 bindings. Added exhaustive test case
+        exercising all new code paths. Updated preexisting test cases for
+        new APIs. Fixed preexisting bugs in WebKit's and Chrome's WebGL
+        implementations.
+
+        Ran WebGL layout tests in WebKit (clean) and Chrome (couple of
+        preexisting known failures) and manual WebGL tests in both
+        browsers.
+
+        Test: fast/canvas/webgl/gl-object-get-calls.html
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameterHelper):
+        (WebCore::JSWebGLRenderingContext::getBufferParameter):
+        (WebCore::JSWebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::JSWebGLRenderingContext::getParameter):
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::JSWebGLRenderingContext::getShaderParameter):
+        (WebCore::JSWebGLRenderingContext::getTexParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::JSWebGLRenderingContext::getVertexAttrib):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameter):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::setObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::create):
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        * html/canvas/WebGLBuffer.h:
+        * html/canvas/WebGLGetInfo.cpp: Added.
+        (WebCore::WebGLGetInfo::WebGLGetInfo):
+        (WebCore::WebGLGetInfo::~WebGLGetInfo):
+        (WebCore::WebGLGetInfo::getType):
+        (WebCore::WebGLGetInfo::getBool):
+        (WebCore::WebGLGetInfo::getFloat):
+        (WebCore::WebGLGetInfo::getLong):
+        (WebCore::WebGLGetInfo::getString):
+        (WebCore::WebGLGetInfo::getUnsignedLong):
+        (WebCore::WebGLGetInfo::getWebGLBuffer):
+        (WebCore::WebGLGetInfo::getWebGLFloatArray):
+        (WebCore::WebGLGetInfo::getWebGLFramebuffer):
+        (WebCore::WebGLGetInfo::getWebGLIntArray):
+        (WebCore::WebGLGetInfo::getWebGLProgram):
+        (WebCore::WebGLGetInfo::getWebGLRenderbuffer):
+        (WebCore::WebGLGetInfo::getWebGLTexture):
+        (WebCore::WebGLGetInfo::getWebGLUnsignedByteArray):
+        * html/canvas/WebGLGetInfo.h: Added.
+        (WebCore::WebGLGetInfo::):
+        * html/canvas/WebGLRenderbuffer.cpp:
+        (WebCore::WebGLRenderbuffer::create):
+        (WebCore::WebGLRenderbuffer::WebGLRenderbuffer):
+        * html/canvas/WebGLRenderbuffer.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLStateRestorer::WebGLStateRestorer):
+        (WebCore::WebGLStateRestorer::~WebGLStateRestorer):
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getString):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::getBooleanParameter):
+        (WebCore::WebGLRenderingContext::getFloatParameter):
+        (WebCore::WebGLRenderingContext::getIntParameter):
+        (WebCore::WebGLRenderingContext::getLongParameter):
+        (WebCore::WebGLRenderingContext::getUnsignedLongParameter):
+        (WebCore::WebGLRenderingContext::getWebGLFloatArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLIntArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLUnsignedByteArrayParameter):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLTexture.cpp:
+        (WebCore::WebGLTexture::create):
+        (WebCore::WebGLTexture::WebGLTexture):
+        * html/canvas/WebGLTexture.h:
+        * manual-tests/webgl/resources/utils3d.js:
+        (initWebGL):
+        (loadShader):
+        (Framerate.prototype.snapshot):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+
+2009-11-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add additional search path for QuickTime SDK.
+
+2009-11-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] GStreamer-CRITICAL's (and other warnings) on <video>
+        https://bugs.webkit.org/show_bug.cgi?id=26354
+
+        Implemented MediaPlayerPrivate::isAvailable by checking the
+        presence of the playbin2 GStreamer element.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-24  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        When building up the pango layout from text boxes, only append a
+        newline char after verifying there are no more boxes on this line.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-11-24  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Keyboard Shortcut to Clear Console Messages
+        https://bugs.webkit.org/show_bug.cgi?id=31780
+
+        All Platforms:  Ctrl+L  = Clear Console Messages
+        Mac Only:       Cmd+K   = Clear Console Messages
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView): create shortcuts
+        (WebInspector.ConsoleView.prototype._promptKeyDown): handle shortcuts
+        * inspector/front-end/KeyboardShortcut.js:
+        (WebInspector.KeyboardShortcut.makeKey): convenience conversion of "a-z" character to keyCode
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel): style fixes for keyboard shortcuts
+
+2009-11-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touch inspector controller in order to
+        kick win bot inspector deploy. rs=aroben.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement expandable compartments on timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31796
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordListRow.prototype.dispose):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow.prototype._onClick):
+        (WebInspector.TimelineRecordGraphRow.prototype.dispose):
+        * inspector/front-end/inspector.css:
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        No new tests as there is no new functionality.
+
+        * platform/graphics/win/IntPointWin.cpp:
+        * platform/graphics/win/IntRectWin.cpp:
+        * platform/graphics/win/IntSizeWin.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+        * platform/win/PlatformMouseEventWin.cpp:
+
+2009-11-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium build fix).
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-11-23  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Prevent ResourceHandleMac's version of ResourceHandle::receivedCredential from stripping
+        identity and certificate information from a WebCore::Credential when receivedCredential
+        needs to modify the credential's persistence.
+
+        Adding a new constructor Credential(const Credential& original, CredentialPersistence)
+        that copies every field from original except for persistence.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):
+        * platform/network/Credential.h:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 2/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Add references from the JSDOMWindowShell and the JSDOMGlobalObject to the world that owns them,
+        so that we can get to the world from the lexical global object of an ExecState.  In the long-term
+        we should switch over to using this approach for all cases we want to get a world from an exec state.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::WebCoreJSClientData::beginningExecution):
+        (WebCore::WebCoreJSClientData::completedExecution):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::world):
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::world):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::initScript):
+
+2009-11-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add range checks to rendering calls in WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=31239
+
+        I am now tracking the size of the data in each CanvasBuffer object
+        and keeping track of the buffer size of each active vertex attrib.
+        In drawArrays and drawElements I make sure no attempt is made to
+        access elements outside the valid buffer ranges. The test at:
+
+            http://cs.helsinki.fi/u/ilmarihe/c3d/functions/drawArraysOutOfBounds.html
+
+        no longer crashes.
+
+        I also added all the WebGL enumerations to GraphicsContext3D to use them in the validation checks
+
+        Tests: fast/canvas/webgl/drawArraysOutOfBounds.html
+               fast/canvas/webgl/drawElementssOutOfBounds.html
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::bufferData):
+        (WebCore::JSWebGLRenderingContext::bufferSubData):
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::data):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        (WebCore::WebGLBuffer::byteLength):
+        * html/canvas/WebGLBuffer.h:
+        (WebCore::WebGLBuffer::elementArrayBuffer):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::isFramebuffer):
+        (WebCore::WebGLRenderingContext::isProgram):
+        (WebCore::WebGLRenderingContext::isRenderbuffer):
+        (WebCore::WebGLRenderingContext::isShader):
+        (WebCore::WebGLRenderingContext::isTexture):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        (WebCore::WebGLRenderingContext::detachAndRemoveAllObjects):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::VertexAttribState::VertexAttribState):
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLShader.cpp:
+        (WebCore::WebGLShader::create):
+        (WebCore::WebGLShader::WebGLShader):
+        * html/canvas/WebGLShader.h:
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::createShader):
+
+2009-11-23  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        JSC bindings for HasIndexGetter generates incorrect code (affects
+        MediaList and CSSStyleDeclaration).
+        This cleans up the edge cases for indexing out of range for style and
+        computed style objects to return an empty string according to the spec.
+        MediaList now returns null when indexed out of range.
+        https://bugs.webkit.org/show_bug.cgi?id=31683
+
+        Tests: fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+               fast/dom/CSSStyleDeclaration/css-style-item.html
+               fast/dom/StyleSheet/css-medialist-item.html
+
+        * bindings/scripts/CodeGeneratorJS.pm: If IndexGetterReturnsString then
+                we do not check the length before calling the item function.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::item):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::item):
+        * css/CSSStyleDeclaration.idl:
+
+2009-11-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        DocumentMarkers need to be educated about transforms
+        https://bugs.webkit.org/show_bug.cgi?id=31751
+        
+        Find highlight is incorrect with transforms
+        <rdar://problem/6358394>
+
+        Allow callers to specify that Frame::selectionTextRects() takes transforms into account
+        when computing the set of rects that encompass a selection. For transformed elemenets, the
+        selection rect will be the bounding box of the selected content.
+        
+        Fix DocumentMarkers to cache rects in absolute coordinates, rather than painting coordinates.
+        
+        Test: editing/selection/transformed-selection-rects.html
+        
+        * WebCore.base.exp:
+        Frame::selectionTextRects() has a new parameter.
+        
+        * dom/Document.cpp:
+        (WebCore::Document::setRenderedRectForMarker):
+        * dom/Document.h:
+        Pass the marker as a const reference.
+        
+        * dom/Range.h:
+        * dom/Range.cpp:
+        (WebCore::Range::textQuads):
+        Add a new method, textQuads(), which returns a list of quads, respecting transforms.
+        
+        * page/Frame.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionTextRects):
+        Add a new parameter, respectTransforms, and when that is RespectTransforms, use the quad
+        method to get quads for ranges, and then take their bounding boxes.
+
+        * rendering/InlineTextBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::computeRectForReplacementMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        (WebCore::InlineTextBox::textPos):
+        (WebCore::InlineTextBox::offsetForPosition):
+        
+        Pass DocumentMarkers as a const references.
+        Convert the argument to setRenderedRectForMarker() into absolute coordinates.
+        
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Cairo] support blurred test-shadow
+        [https://bugs.webkit.org/show_bug.cgi?id=31797]
+
+        Support for blurred text-shadows on Cairo. This patch
+        reuses the code of blurred box-shadows, introduced in
+        bug 26102. For a full textshadow support, a filters enabled
+        build is needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Change incorrect calls to the constructor "EventNames()" to the correct accessor
+        "eventNames()". This saves ~100 AtomicString lookups each time.
+        https://bugs.webkit.org/show_bug.cgi?id=31811
+
+        * dom/EventNames.h:  Make constructor private to prevent this from happening again.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):  EventNames() --> eventNames()
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity):  EventNames() --> eventNames()
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):  EventNames() --> eventNames()
+        (WebCore::FrameLoader::pageHidden):  EventNames() --> eventNames()
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):  EventNames() --> eventNames()
+
+2009-11-23  Adam Langley  <agl@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Chromium Linux: Limit the stroke width and mitre limit.
+
+        Limit the stroke width and mitre limit that we'll pass into Skia to
+        avoid overflowing Skia's uint16_t glyph widths.
+
+        http://code.google.com/p/chromium/issues/detail?id=28250
+        https://bugs.webkit.org/show_bug.cgi?id=31747
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (scalarBound):
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31812
+        WebSocket code uses RefPtr::get() where it shouldn't
+
+        No change in funcitonality, just coding style correction.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::close):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didOpen):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        (WebCore::WebSocketChannel::didFail):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): pacExecutionCallbackMainThread
+        is static, so it can't use member variables directly.
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * platform/network/cf/SocketStreamHandle.h: Removed names from some void* arguments, since
+        they didn't carry useful information.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): When we need an http-style URL, we actually
+        always need https.
+        (WebCore::SocketStreamHandle::scheduleStreams): Factored out from constructor, since streams
+        only get scheduled after PAC is fetched and executed asynchronously.
+        (WebCore::SocketStreamHandle::copyPACExecutionDescription): Return a description for event
+        source.
+        (WebCore::MainThreadPACCallbackInfo::MainThreadPACCallbackInfo): Forward callback to main thread.
+        (WebCore::SocketStreamHandle::pacExecutionCallback): Ditto.
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): Ditto. To avoid code duplication,
+        we make the call even on Mac.
+        (WebCore::SocketStreamHandle::executePACFileURL): Make an async call to CFNetworkExecuteProxyAutoConfigurationURL.
+        (WebCore::SocketStreamHandle::removePACRunLoopSource): Once PAC execution is done or aborted,
+        we need to get rid of the event source.
+        (WebCore::SocketStreamHandle::chooseProxy): Use stored m_httpsURL.get.
+        (WebCore::SocketStreamHandle::chooseProxyFromArray): Factored out from chooseProxy - the
+        array may come directly from system configuration, or from PAC.
+        (WebCore::SocketStreamHandle::chooseProxy): Tiger version of this function is now completely
+        separate.
+        (WebCore::SocketStreamHandle::~SocketStreamHandle): Run loop source should be destroyed
+        before we get to the destructor.
+        (WebCore::SocketStreamHandle::platformClose): Destroy the run loop source, if PAC execution
+        is still in progress.
+
+2009-11-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Don't leak the CGImage we create when drawing a sub image.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-11-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Don't crash when OOM in creating isolated world
+        https://bugs.webkit.org/show_bug.cgi?id=31805
+
+        We need to add some more null checks to avoid crashing.  No new tests
+        because we don't have a good way to test out-of-memory bugs.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        This is the implementation of the filterRes attribute. It
+        helps the SVG developer to set the quality of a filter by
+        giving the width or height of filter.
+        This patch also sets the filter resolution to lower values
+        if a intermediate ImageBuffer size is bigger than the given
+        maximal size.
+        The maximal size is set to 5000x5000 by default. This is a
+        subjectiv decission. Everthing greater than this values gets
+        sensible slower. Values of 10000x10000 crashed on WebKitGtk.
+        For mobil devices a maximum size of 100x100 or 200x200 seems
+        to be reasonable.
+        The important fact on filter resolution is, that the output
+        size is still the size given by the <filter> element.
+
+        Tests: svg/filters/big-sized-filter-2.svg
+               svg/filters/big-sized-filter.svg
+               svg/filters/filterRes.svg
+
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::createPlatformShadow): Use scaledSubRegion for
+        calculation.
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply): Use scaledSubRegion for effect intern
+        calculations.
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/Filter.h: Add the abbility to change the quality
+        of a filter output.
+        (WebCore::Filter::filterResolution):
+        (WebCore::Filter::setFilterResolution):
+        (WebCore::Filter::calculateEffectSubRegion): Calculates the correct subRegion
+        as well as the scaledSubRegion. It also searches for the biggest effect size.
+        We have to change the filter resolution, if one intermediate ImageBuffer size
+        doesn't fit in the maximal image size.
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::calculateDrawingRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::getEffectContext): Use scaledSubRegion to create
+        a new intermediate ImageBuffer for the result of the current effect.
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::scaledSubRegion): The scaled subRegion of a the
+        filter effect.
+        (WebCore::FilterEffect::setScaledSubRegion):
+        (WebCore::FilterEffect::effectBoundaries): The original values of the
+        EffectElement for a second subRegion calculation.
+        (WebCore::FilterEffect::setEffectBoundaries):
+        * platform/graphics/filters/ImageBufferFilter.cpp:
+        (WebCore::ImageBufferFilter::ImageBufferFilter): Set the scale factor to one.
+        * platform/graphics/filters/ImageBufferFilter.h:
+        (WebCore::ImageBufferFilter::maxImageSize):
+        (WebCore::ImageBufferFilter::calculateEffectSubRegion):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::parseMappedAttribute): Parse filterRes attribute.
+        (WebCore::SVGFilterElement::buildFilter): Give SVGResourceFilter the current
+        filterResolution.
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes): Save
+        values to effectBoundaries of the filter effect
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::shouldProcessFilter): Return signal if a neccessary value is zero.
+        (WebCore::SVGResourceFilter::fitsInMaximumImageSize): Checks if the given size
+        fits into the maximal image size, modifys scale factors if not and return a
+        bool: fits.
+        (WebCore::SVGResourceFilter::prepareFilter): Scale the SourceImage to
+        filterResolution (given by FilterElement or calculated on to big image sizes).
+        Set the scale level to SVGFilter.
+        (WebCore::SVGResourceFilter::applyFilter): Don't apply filters if shouldProcessFilter
+        is wrong.
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::setFilterResolution): FilterResolution of FilterElement.
+        (WebCore::SVGResourceFilter::setHasFilterResolution): Does FilterElement provides
+        a FilterResolution?
+        (WebCore::SVGResourceFilter::scaleX): Current scale factor for horizontal.
+        (WebCore::SVGResourceFilter::scaleY): Current scale factor for vertical.
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::calculateEffectSubRegion): Calculate subRegion for LayoutTests,
+        scaledSubRegion according to the current filterResolution and get the maximal image size.
+        * svg/graphics/filters/SVGFilter.h:
+        (WebCore::SVGFilter::effectBoundingBoxMode): Original values of the FilterElement. 
+        (WebCore::SVGFilter::filterRegion): Use virtual for clarification.
+        (WebCore::SVGFilter::sourceImageRect): Use virtual for clarification.
+        (WebCore::SVGFilter::maxImageSize): Get the maximal image size.
+
+2009-11-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Wrong runtime instance objects of wrapped QObjects may be used if
+        the wrapped object died before the gc removed the instance.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31681
+
+        Before using a cached instance, verify that its wrapped QObject is
+        still alive.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getQtInstance):
+        * bridge/qt/qt_instance.h:
+        (JSC::Bindings::QtInstance::hashKey):
+
+2009-11-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARIA: support aria-flowto
+        https://bugs.webkit.org/show_bug.cgi?id=31762
+
+        Test: platform/mac/accessibility/aria-flowto.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        (WebCore::AccessibilityObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::linkedUIElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityRenderObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-11-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Build fix for WML enabled builds.
+        Adopt WebCore API changes.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce sidebar background on timeline panel in order
+        to prevent it from flickering on scroll.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31789
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Reimplement TimelinePanel to make it fast:
+        - Extract grid and overview into separate files
+        - Make timeline create only divs for visible rows
+
+        https://bugs.webkit.org/show_bug.cgi?id=31784
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        * inspector/front-end/TimelineGrid.js: Added.
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addEventDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/TimelineOverviewPane.js: Added.
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._onCheckboxClicked):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.setSidebarWidth):
+        (WebInspector.TimelineOverviewPane.prototype.updateMainViewWidth):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowResizeDragging):
+        (WebInspector.TimelineOverviewPane.prototype._dragWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowDragging):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowLeft):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowRight):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewPane.prototype._endWindowDragging):
+        (WebInspector.TimelineOverviewCalculator):
+        (WebInspector.TimelineOverviewCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineOverviewCalculator.prototype.reset):
+        (WebInspector.TimelineOverviewCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineOverviewCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineOverviewCalculator.prototype.formatValue):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.resize):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype.show):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+        (WebInspector.TimelineCategory):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-11-22  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Disable access to file:/// directory listings
+        https://bugs.webkit.org/show_bug.cgi?id=31329
+
+        Deny access to directory listings. This needs doing in WebKit for
+        WebKit clients that do permit top-level navigation to file:///dir.
+        This matches Firefox, plus the existing Safari implementation (which
+        does not support any directory access at all). It will fix the
+        LayoutTest named below for Chromium.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
+
+        * page/SecurityOrigin.cpp: Deny access to directory listings.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canRequest):
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Support Ctrl+P and Ctrl+N, Readline keyboard shortcuts in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=31400
+
+        Handle the following when on a Mac:
+
+          Ctrl+P = Previous (like Up arrow)
+          Ctrl+N = Next (like Down arrow)
+
+        No longer rerun autocompletion when just pushing a modifier key
+        like Control, Alt, Shift, or Meta.
+
+        Improved arrow key behavior with Multiline code in the Console, with the following behavior:
+
+          Up   = Previous Command if on First Line (caret moves to the end of the first line)
+                 otherwise default caret movement in text.
+          Down = Next Command if on Last Line (caret naturally moves to the end)
+                 otherwise default caret movement in text.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.handleKeyEvent): handle new keyboard shortcuts
+        (WebInspector.TextPrompt.prototype.isCaretOnFirstLine): check if the caret is on the top line
+        (WebInspector.TextPrompt.prototype.isCaretOnLastLine): check if the caret is on the bottom line
+        (WebInspector.TextPrompt.prototype._upKeyPressed):
+        (WebInspector.TextPrompt.prototype._downKeyPressed):
+        (WebInspector.TextPrompt.prototype._moveBackInHistory):
+        (WebInspector.TextPrompt.prototype._moveForwardInHistory):
+
+2009-11-21  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a tooltip containing the full url of the resource to each element
+        in the Resources panel so that it is possible to quickly see the query
+        parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=19103
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.refresh):
+        Set the tooltip to be the resource's url.
+
+2009-11-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CSSKeyframesRule::findRule() and deleteRule() should accept 'from' and 'to' as well as percentages
+        https://bugs.webkit.org/show_bug.cgi?id=31588
+        
+        In WebKitCSSKeyframesRule::findRuleIndex(), map 'from' to 0% an 'to' to 100%
+        so that findRule() and deleteRule() work with these keywords.
+
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::findRuleIndex):
+
+2009-11-21  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31647
+
+        Changed KeyboardEvent::m_keyEvent from a raw pointer to an OwnPtr.
+
+        No functionality was changed. So, no new tests.
+
+        * dom/KeyboardEvent.cpp:
+        (WebCore::KeyboardEvent::~KeyboardEvent):
+        * dom/KeyboardEvent.h: Changed m_keyEvent to OwnPtr.
+        (WebCore::KeyboardEvent::keyEvent):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for aria-owns
+        https://bugs.webkit.org/show_bug.cgi?id=31702
+
+        Re-organized how accessibilityAttributeNames are returned so 
+        that it's possible for an element to add an attribute based on 
+        a dynamic value. In this case, we only want to add AXOwn if the 
+        element actually supports aria-owns.
+  
+        Test: platform/mac/accessibility/aria-owns.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIAOwns):
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaOwnsElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAOwns):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7414396> Leopard & Tiger: Support closed caption in <video> element
+
+        * css/mediaControls.css:
+            Define closed caption toggle button.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create closed caption toggle button in display order.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't require MediaControllerThemeQuickTime theme for captions toggle button.
+            No need to check if the movie has video, a closed captions track is a video
+            track.
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Running code in the Console that ends with a
+        single line comment no longer produces a parse error.
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for 'math' role
+        https://bugs.webkit.org/show_bug.cgi?id=31706
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-20  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        NPN_ReloadPlugins does not reload the page even if reloadPages is true.
+        https://bugs.webkit.org/show_bug.cgi?id=30460
+
+        Replace call to PluginDatabase::installedPlugins()->refresh() with Page::refreshPlugins().
+        It already refreshes plugins and reloads pages when necessary.
+
+        Tests: plugins/reloadplugins-and-pages.html
+               plugins/reloadplugins-no-pages.html
+
+        * plugins/PluginInfoStore.cpp:
+        (WebCore::refreshPlugins):
+
+2009-11-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://7409188> WebKit needs to be able to serialize and deserialize objects.
+
+        Expose WebCore object serialization to WebKit.
+
+        * WebCore.base.exp:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31741>.
+        Web Inspector: User Entered Data on the console should show up no matter what filters.
+        
+        Always show .console-user-command-result, no matter what the filter say
+        we should do with the other classes.
+
+        * inspector/front-end/inspector.css:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31700>.
+        Web Inspector: isMac should be in one central location + Cached.
+        
+        We should cache the value of isMac, and make the indexOf call in one
+        single location, because we are calling it from multiple places, and saving
+        the result can save us time, and make the call sites simpler.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.isMac):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Removed .DS_Store accidentally added in last (r51245).
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add Console Only Layout Mode
+        https://bugs.webkit.org/show_bug.cgi?id=30282
+
+        Adds a Console Panel, which allows for a Full size Console. This
+        extends the Drawer to the size of a Panel. This also fixes previous
+        resize issues with the Drawer.
+
+        * inspector/front-end/ConsolePanel.js: added.
+        (WebInspector.ConsolePanel):
+        (WebInspector.ConsolePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ConsolePanel.prototype.show):
+        (WebInspector.ConsolePanel.prototype.hide):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.set visibleView):
+        (WebInspector.Drawer.prototype.get savedHeight): access the saved height of the variable console.
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype.resize): resize appropriately if full/non-full
+        (WebInspector.Drawer.prototype.enterPanelMode):
+        (WebInspector.Drawer.prototype.exitPanelMode):
+        (WebInspector.Drawer.prototype.immediatelyExitPanelMode):
+        (WebInspector.Drawer.prototype._cancelAnimationIfNeeded):
+        (WebInspector.Drawer.prototype._animateDrawerHeight.animationFinished):
+        (WebInspector.Drawer.prototype._animateDrawerHeight):
+        (WebInspector.Drawer.prototype._animationDuration):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+
+        Miscellaneous changes and cleanup.
+
+        * English.lproj/localizedStrings.js: "Console" toolbar title.
+        * inspector/front-end/ConsoleView.js: removed unnecessary element reordering  
+        * inspector/front-end/Images/consoleIcon.png: added.
+        * inspector/front-end/inspector.css: added icon.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): create console panel
+        (WebInspector.windowResize): resize drawer if necessary
+        (WebInspector.documentKeyDown): esc should not toggle the console when in panel mode
+        (WebInspector.animateStyle): start animation interval, returns the interval key
+        (WebInspector.toggleAttach): resize drawer if necessary
+        (WebInspector.showConsolePanel): restore the panel when the inspector restarts
+        (WebInspector.showProfileForURL): style fix
+
+        Restore the panel when the inspector restarts.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+        Build files.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31699>.
+        Web Inspector: Should Cache Values of InspectorController.platform() and port().
+
+        Refactor the Inspector to cache the value of InspectorController.platform
+        and InspectorController.port, because those need to call into C++, they are
+        being called more and more as we add platform specific keyboard shortcuts, and
+        they shouldn't change in the lifecycle of the Web Inspector.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.get platform):
+        (WebInspector.get port):
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.toolbarDragStart):
+
+2009-11-20  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build fix for filters enabled builds.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7389945> QTKit based media engine should not claim to support 
+        fullscreen on Leopard
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+            Only return true on SnowLeopard for now.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            No need to special case MediaFullscreenButtonPart as the default implementation 
+            asks the media engine if it supports fullscreen.
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Patch by Yongjun Zhang <yongjun.zhang@nokia.com> and
+                 Girish Ramakrishnan <girish@forwardbias.in>
+        
+        [Qt] Implement support for rendering plugins on Qt/Mac when a page is used
+        without a QWebView or when inside QGraphicsWebView.
+        
+        Currently, the code provides the cgcontext of the PlatformPluginWidget to
+        the plugin. This approach does not work when we are printing, or using
+        QWebFrame::render() to render to a QImage/QPixmap since the plugin ends
+        up drawing on the QWebView (i.e platformPluginWidget's cgcontext) instead
+        of the QPaintDevice's context.
+        
+        To solve all cases and keep the code simple, we render the plugin to an
+        offscreen pixmap in all cases. This way, the plugin always renders to the
+        CGContext of the pixmap and we then use QPainter to blit the pixmap into
+        the QPaintDevice. We also create a fake window and set it's WindowRef in
+        NPWindow. Only with this WindowRef does Flash paint correctly to the QPixmap.
+        
+        Now, that's the theory. In practice, ATM, mouse events do not work when using
+        the fake window. So, setPlatformPluginWidget() is still called when using QWebView
+        so that there are no regressions after this patch. Once we get mouse events
+        working, setPlatformPluginWidget will be removed.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31183
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Resync Resources Backend and Frontend
+        https://bugs.webkit.org/show_bug.cgi?id=31705
+
+        * inspector/front-end/Resource.js: resync enum values with backend
+        (WebInspector.Resource.prototype._mimeTypeIsConsistentWithType): return false if all else fails, not true in all cases
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        Build change only. No new tests possible.
+
+        * config.h: Modified. Added Android-specific configuration.
+
+2009-11-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change default stylesheet to reset text indentation for ruby elements by default.
+        (https://bugs.webkit.org/show_bug.cgi?id=31247)
+
+        Test: fast/ruby/ruby-text-indent.html
+
+        * css/html.css: reset text-indent on <ruby> and <rt> elements
+
+2009-11-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes <http://webkit.org/b/22754>.
+        Web Inspector: Keyboard shortcut for Element finder.
+
+        Use Command + Shift + C as a shortcut for Node Search, to 
+        match the Firebug shortcut to do the same thing.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * WebCore.vcproj/WebCore.vcproj: Added LoaderRunLoopCF.
+
+        * platform/network/ResourceHandle.h: Removed loaderRunLoop().
+
+        * platform/network/cf/LoaderRunLoopCF.cpp: Added.
+        (WebCore::emptyPerform):
+        (WebCore::runLoaderThread):
+        (WebCore::loaderRunLoop):
+        * platform/network/cf/LoaderRunLoopCF.h: Added.
+        Moved the run loop that we use for CFNetwork from ResourceHandle to its own file, because
+        it's needed for more than just resource loading.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Use loaderRunLoop() from its new location.
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::DNSResolveQueue::resolve): Ditto.
+
+        * platform/network/cf/SocketStreamHandle.h: Added static callbacks for forwarding events to
+        main thread.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Use loaderRunLoop() on Windows instead of
+        inoperable main run loop.
+
+        (WebCore::MainThreadEventCallbackInfo::MainThreadEventCallbackInfo): 
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::readStreamCallbackMainThread):
+        (WebCore::SocketStreamHandle::writeStreamCallbackMainThread):
+        Forward stream events to main thread on Windows.
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Quick style fix.
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+      
+       Build fix. No review needed.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/graphics/qt/StillImageQt.cpp:
+        (WebCore::StillImage::draw):
+        * platform/graphics/qt/StillImageQt.h:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::paintMissingPluginIcon):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31321 Make -webkit-
+        color-correction work with untagged images
+
+        Image's draw(), drawPattern(), and fillWithSolidColor() functions 
+        now take a ColorSpace. A bunch of classes inherit from Image, so 
+        draw() and drawPattern() functions there must also take a 
+        ColorSpace.
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::draw):
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::draw):
+        * platform/graphics/cg/PDFDocumentImage.h:
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        * svg/graphics/SVGImage.h:
+
+        All of the drawImage() functions and drawTiled() functions of 
+        GraphicsContext now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImage):
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+
+        This is where the actual work is done.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::imageWithColorSpace): New static function that returns a 
+        copy of the given image in the given ColorSpace *IF* we should use 
+        the given ColorSpace. We will ignore the color space if the image 
+        is tagged and return 0. 
+        (WebCore::BitmapImage::draw): Now takes a ColorSpace and uses it to 
+        call imageWithColorSpace(). 
+        (WebCore::Image::drawPattern): Same.
+
+        Attempt to keep all ports building. 
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/skia/BitmapImageSingleFrameSkia.h:
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+        Callers of GraphicsContext's drawImage() and drawTiled() functions 
+        now need to send a ColorSpace.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Properly create a CGImageRef on non-PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::sharedBufferGetBytesAtPosition):
+        (WebCore::sharedBufferRelease):
+        (WebCore::ImageSource::setData):
+        * platform/graphics/cg/ImageSourceCG.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+
+2009-11-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        -webkit-user-drag: element Drag images include overflow decorations from incorrect nodes
+        https://bugs.webkit.org/show_bug.cgi?id=31656
+
+        Make sure we're a child of the painting root before drawing overflow features.
+
+        * manual-tests/user-drag-with-decorations.html: Added.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix Chromium build.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Add new enum values for Show/HideClosedCaptionButton to make it compile.
+
+2009-11-19  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Do not assert when a high number is used for roman numerals in lists.
+        https://bugs.webkit.org/show_bug.cgi?id=31652
+
+        Test: fast/lists/ol-start-roman.html
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toRoman): Increase the char array size.
+
+2009-11-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Add translatable strings to cover validationMessage, after
+        r51172. Already covered by existing test.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        WebCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        No new tests as there is no functional change.
+
+        * html/HTMLInputElement.cpp: Remove include directive
+        for float.h as it is included in MathExtras.h already.
+
+2009-11-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Instrumentation should account for painting in compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31674
+
+        Add calls to InspectorTimelineAgent for painting into compositing layers,
+        which is not accounted for in FrameView::paintContents().
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Avoid fetching the FrameView multiple times.
+        
+        (WebCore::inspectorTimelineAgent):
+        (WebCore::RenderLayerBacking::paintContents):
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        Test: media/media-captions.html
+
+        * WebCore.base.exp:
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+            Define ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+            Define and match mediaControlsToggleClosedCaptionsButton.
+
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+            Define and match PseudoMediaControlsToggleClosedCaptions.
+
+        * css/CSSValueKeywords.in:
+            Define and use media-toggle-closed-captions-button.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQuickTime.css:
+            Add webkit-media-controls-toggle-closed-captions-button.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): 
+            Initialize m_closedCaptionsVisible.
+        (WebCore::HTMLMediaElement::loadInternal): 
+            Set m_closedCaptionsVisible to false.
+        (WebCore::HTMLMediaElement::hasClosedCaptions): 
+        (WebCore::HTMLMediaElement::closedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): 
+            New, captions internal methods.
+        (WebCore::HTMLMediaElement::setWebkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitHasClosedCaptions): 
+            New, captions DOM API.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for captions API.
+
+        * platform/ThemeTypes.h:
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+            Add empty implmentations.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::NullMediaPlayerPrivate::setClosedCaptionsVisible):
+            New, empty implementations of media engine closed caption functions.
+        (WebCore::MediaPlayer::hasClosedCaptions):
+        (WebCore::MediaPlayer::setClosedCaptionsVisible):
+            New, call media engine closed caption functions.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivateInterface::setClosedCaptionsVisible):
+            Declare new media engine methods.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, QTKit implementation of closed caption methods.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+            Add help text for ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            Declare and initialize wkQTMovieHasClosedCaptions and wkQTMovieSetShowClosedCaptions.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Deal with MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::defaultEventHandler):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::updateDisplayType):
+            New, implement the closed caption toggle button,
+
+        * rendering/MediaControlElements.h:
+            Define MediaShowClosedCaptionsButton and MediaHideClosedCaptionsButton,
+            declare MediaControlToggleClosedCaptionsButtonElement.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+        (WebCore::RenderMedia::createToggleClosedCaptionsButton):
+        (WebCore::RenderMedia::createStatusDisplay):
+        (WebCore::RenderMedia::updateControls):
+        (WebCore::RenderMedia::forwardEvent):
+        * rendering/RenderMedia.h:
+            Deal with m_toggleClosedCaptionsButton.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint):
+            Deal with MediaToggleClosedCaptionsButtonPart.
+
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.h:
+            Declare paintMediaToggleClosedCaptionsButton.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaToggleClosedCaptionsButton):
+            New.
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't render captions toggle button unless we are using the new theme, the
+            movie has captions, and the movie is in a <video> element since we currently
+            rely on QTKit to render the captions.
+
+        * rendering/style/RenderStyleConstants.h:
+            Define MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+
+2009-11-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add missing header.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31634
+        Ignore realm for proxy protection spaces
+
+        Only affects WebSocket proxy authentication, cannot be tested in DRT.
+
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::operator==):
+        * platform/network/ProtectionSpaceHash.h:
+        (WebCore::ProtectionSpaceHash::hash):
+
+2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Normalize signal and slot signatures.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+
+2009-11-19  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Store cookie domains in the WebInspector object
+
+        The cookie domains have been moved from StoragePanel into WebInspector.
+        Also, the document URLs are now passed inside the WebInspector.addResource()
+        payload rather than pushed directly from InspectorController.
+        https://bugs.webkit.org/show_bug.cgi?id=31627
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.addCookieDomain):
+        (WebInspector.reset):
+
+2009-11-19  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the other part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31585
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class RegularExpression    - instantiated at: WebCore/page/Frame.cpp:415
+        class TransformationMatrix - instantiated at: WebCore/rendering/TransformState.cpp:62
+        class Path                 - instantiated at: WebCore/html/HTMLAreaElement.cpp:73
+        class FontPlatformData     - instantiated at: WebCore/platform/graphics/qt/FontCacheQt.cpp:188
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class Cursors                         - instantiated at: WebCore/platform/qt/CursorQt.cpp:146
+        class NetworkStateNotifier            - instantiated at: WebCore/platform/network/NetworkStateNotifier.cpp:37
+        struct CrossThreadResourceRequestData - instantiated at: WebCore/platform/network/ResourceRequestBase.cpp:71
+
+        class ImageDecoder - its child class is instantiated at: WebCore/platform/graphics/qt/ImageDecoderQt.cpp:46
+        class MediaPlayerPrivateInterface - its child class is instantiated at: WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:119
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/qt/CursorQt.cpp:
+        * platform/text/RegularExpression.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51172.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed <rdar://problem/7398987> Assertion failure in
+        RenderLayer::updateClipRects when a plug-in’s enclosing layer is
+        enclosed by a transformed layer
+
+        Tests: fast/layers/clip-rects-transformed-2.html
+               fast/layers/clip-rects-transformed.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::clippingRoot): Added. Finds the nearest ancestor
+        that is either transformed or composited. During painting and hit
+        testing, when a transformed or composited layer is hit, it becomes the
+        new root layer, which ultimately gets passed to calculateRects().
+        (WebCore::RenderLayer::childrenClipRect): Pass the clipping root as the
+        root layer to calculateRects(), and return the bounding box of the
+        transformed rectangle.
+        (WebCore::RenderLayer::selfClipRect): Ditto.
+        * rendering/RenderLayer.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        No new tests as there is no change if compiled with 
+        Qt v4.4 or later version.
+
+        * WebCore.pro:
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::EntityResolver::resolveUndeclaredEntity):
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::startDocument):
+        (WebCore::XMLTokenizer::parseDtd):
+        * platform/graphics/qt/FontQt.cpp:
+        * platform/graphics/qt/FontQt43.cpp: Removed.
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::clearData):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::keyIdentifierForQtKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/text/qt/TextBoundaries.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * plugins/qt/PluginDataQt.cpp:
+        (WebCore::PluginData::initPlugins):
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        Test: fast/forms/validationMessage.html
+
+        * html/HTMLButtonElement.idl: validationMessage attribute
+        * html/HTMLFieldSetElement.idl: validationMessage attribute
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.idl: validationMessage attribute
+        * html/HTMLSelectElement.idl: validationMessage attribute
+        * html/HTMLTextAreaElement.idl: validationMessage attribute
+        * html/ValidityState.cpp: new method to retrieve pertinent localized text
+        * html/ValidityState.h:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/android/LocalizedStringsAndroid.cpp:
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        * platform/mac/LocalizedStringsMac.mm:
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        Fix a typo. Remove the trailing semicolon
+        from an include directive after r51137.
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51159.
+
+        Include float.h for DBL_MANT_DIG. Not sure why this
+        is not a problem for other ports.
+
+        * html/HTMLInputElement.cpp:
+
+2009-11-19  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 31574 -  Crashing bug when removing <ruby> element
+        (https://bugs.webkit.org/show_bug.cgi?id=31574)
+
+        Cause of the bug:
+        1.) RenderBlock::destroy() of the RenderRubyRun called destroyLeftoverChildren()
+        2.) that called destroy() of the RenderRubyBase(), which in RenderObject::destroy() calls remove()
+        3.) remove() is being redirected as parent()->removeChild() in RenderObject.h
+        4.) this triggers the special handling of child removal in RenderRubyRun that
+            causes it to destroy itself
+        5.) On returning from all this the renderer crashes when accessing a member
+            or virtual function on this now illegal object.
+
+        I therefore added a flag that tracks if the ruby run is being destroyed.
+        If so, avoid doing the special handling in removeChild that caused this.
+        It's not the most elegant solution, but the easiest to implement without
+        touching unrelated code. Also, it's self-documenting.
+
+        Test: fast/ruby/ruby-remove.html
+
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::destroy):
+        (WebCore::RenderRubyRun::removeChild):
+        * rendering/RenderRubyRun.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        No new tests as there is no functional change.
+
+        * WebCore.pro:
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBoundaries for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBoundariesWince.cpp: Added.
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBreakIterator for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBreakIteratorWince.cpp: Added.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for ValidityState.typeMismatch for the following INPUT types:
+          date datetime datetime-local month time week
+        https://bugs.webkit.org/show_bug.cgi?id=31342
+
+        Tests: fast/forms/ValidityState-typeMismatch-date.html
+               fast/forms/ValidityState-typeMismatch-datetime.html
+               fast/forms/ValidityState-typeMismatch-datetimelocal.html
+               fast/forms/ValidityState-typeMismatch-month.html
+               fast/forms/ValidityState-typeMismatch-time.html
+               fast/forms/ValidityState-typeMismatch-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToISODateTime): Check the type
+          validity of the specified type and string using the ISODateTime class.
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): Check the type validity
+          for date, datetime, datetime-local, month, time and week with
+          HTMLInputElemtn::formStringToISODateTime()
+
+2009-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix REGRESSION (r47022): Performance of DocumentFragment.appendChild is 1000x slower sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=31237
+        
+        Also speeds up Dromaeo DOM Core tests by 1.31x.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): Change marking algorithm to avoid O(N^2) behavior. The subtree
+        mark bit was no longer effective; instead I changed things so only a node that has no ancestors
+        with wrappers would do marking; there should be only one in the typical case (the root of the
+        detached subtree).
+        * dom/Node.cpp:
+        (WebCore::Node::Node): Remove now useless m_inSubtreeMark bit and related functions.
+        * dom/Node.h: ditto
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get rid of the redundant strokeType and fillType data members on
+        a GraphicsContext as well as the FillOrStrokeType enum. Use
+        null pointers instead.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor): Null out the pattern
+        and gradient.
+        (WebCore::GraphicsContext::setFillColor): Ditto.
+        (WebCore::GraphicsContext::setStrokePattern): Null out the graident.
+        (WebCore::GraphicsContext::setFillPattern): Ditto.
+        (WebCore::GraphicsContext::setStrokeGradient): Null out the pattern.
+        (WebCore::GraphicsContext::setFillGradient): Ditto.
+
+        * platform/graphics/GraphicsContextPrivate.h: Remove all that stuff.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::setPlatformStroke): Ditto.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern): Removed unneeded get.
+        (WebCore::GraphicsContext::applyFillPattern): Ditto.
+        (WebCore::calculateDrawingMode): Use fillPattern and strokePattern
+        to see if there is a pattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::drawPath): Use fillGradient, strokeGradient,
+        fillPattern, and strokePattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::fillPath): Added FIXME about color space that
+        is used in the pattern and gradient case probably erroneously. Moved
+        gradient code inside an if statement. Streamlined pattern code and
+        use an if statement. No switch any more.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+        (WebCore::GraphicsContext::strokeRect): Ditto.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath): Removed unneeded check of fillType.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Support for step attribute and ValidityStae.stepMismatch for
+        type=number and range.  stepMismatch will be false if the
+        difference between the current value and a multiple of the step
+        value is very small.
+
+        Change the behavior of RenderSlider so that it always has a value
+        rounded to the step attribute value.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31331
+
+        Tests: fast/forms/ValidityState-stepMismatch-number.html
+               fast/forms/ValidityState-stepMismatch-range.html
+               fast/forms/ValidityState-stepMismatch-unsupported.html
+               fast/forms/input-step.html
+
+        * html/HTMLAttributeNames.in: Add "step".
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getStepParameters):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Add "step".
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::stepMismatch): Forward to HTMLInputElement::stepMismatch().
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::clampValue):
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to ASSERT(isMainThread()) in ThreadShared methods.
+        https://bugs.webkit.org/show_bug.cgi?id=31637
+
+        Added ASSERT(IsMainThread()) to all following methods:
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared):
+        (WebCore::TreeShared::~TreeShared):
+        (WebCore::TreeShared::ref):
+        (WebCore::TreeShared::deref):
+        (WebCore::TreeShared::setParent):
+        (WebCore::TreeShared::parent):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Eric Seidel.
+
+        Add plugin visibility manual test
+
+        https://bugs.webkit.org/show_bug.cgi?id=31542
+
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+
+2009-11-18  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector - remember last script displayed in Scripts panel
+        https://bugs.webkit.org/show_bug.cgi?id=27552
+
+        Manual test added
+        
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.showScript):
+        (WebInspector.ScriptsPanel.prototype.showResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.ScriptsPanel.prototype._goBack):
+        (WebInspector.ScriptsPanel.prototype._goForward):
+        * manual-tests/inspector/remember-last-script.html: Added.
+
+2009-11-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Create bounded transparency layers instead of just clipping.
+
+        No new tests because this is just a performance improvement.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+
+2009-11-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add support for displaying deleteButton.
+        https://bugs.webkit.org/show_bug.cgi?id=31560
+
+        Test: LayoutTests/editing/deleting/5408255.html
+
+        * WebCore.qrc:
+        * platform/graphics/qt/ImageQt.cpp:
+        (loadResourcePixmap):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Qt build without JavaScript debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31575
+
+        * page/Console.idl:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24971
+        And
+        <rdar://problem/7138265>
+
+        Fixes an issue where setting the height of a table row programmatically
+        (via JavaScript) causes the table to be improperly rendered because the
+        height of each row in the table is not recalculated with respect to the
+        CSS height property.
+
+        In particular, programmatically setting the height of some table row causes
+        the rows of that table to be rendered with a height equal to the minimum
+        height required by the cells in that row, regardless of any specified cell
+        heights. Instead, when RenderTableSection::recalcCells is called, the height
+        of each row should be set to the CSS height property just as we do in
+        RenderTableSection::addChild.
+
+        Test: fast/table/row-height-recalc2.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::setRowHeightToRowStyleHeightIfNotRelative): Added.
+        (WebCore::RenderTableSection::addChild): Moved code that set row height into
+        method WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+        (WebCore::RenderTableSection::recalcCells): Modified to call
+        WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+
+2009-11-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31473
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class  AnimationList         - instantiated at WebCore/rendering/style/StyleRareNonInheritedData.cpp:85
+        class  Color                 - instantiated at WebCore/rendering/RenderTheme.cpp:48
+        struct Length                - instantiated at WebCore/platform/Length.cpp:103
+        class  PlatformKeyboardEvent - instantiated at WebCore/dom/KeyboardEvent.cpp:63
+        class  ContextMenuItem       - instantiated at WebCore/platform/ContextMenu.cpp:70
+        class  DeprecatedPtrList     - instantiated at WebCore/rendering/RenderBlock.cpp:2284
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class  GraphicsContextPrivate - instantiated at WebCore/platform/graphics/GraphicsContext.cpp:78
+        class  FontCache              - instantiated at WebCore/platform/graphics/qt/FontCacheQt.cpp:43
+        struct MediaPlayerFactory     - instantiated at WebCore/platform/graphics/MediaPlayer.cpp:163
+        class  DeprecatedPtrListNode  - instantiated at WebCore/platform/DeprecatedPtrListImpl.cpp:53
+
+        * platform/ContextMenuItem.h:
+        * platform/DeprecatedPtrList.h:
+        * platform/DeprecatedPtrListImpl.cpp:
+        * platform/Length.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/animation/AnimationList.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/MediaPlayer.cpp:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-18  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove V8CanvasPixelArrayCustom.cpp because it is no longer used by V8.
+        https://bugs.webkit.org/show_bug.cgi?id=31499
+
+        No new tests, just a build cleanup.
+
+        * WebCore.gypi:
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-18  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Enable wx plugin support using the Windows implementation as a base.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31636
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::inTransparencyLayer):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::unloadModule):
+        (WebCore::listDirectory):
+        * plugins/PluginDatabase.cpp:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::snapshot):
+        * wscript:
+
+2009-11-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Add shared timer and sound utilities to platform/android
+        https://bugs.webkit.org/show_bug.cgi?id=31584
+
+        No new tests required, this is platform specific code.
+
+        * platform/android/SharedTimerAndroid.cpp: Added.
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+        * platform/android/SoundAndroid.cpp: Added.
+        (WebCore::systemBeep):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix profile tree nodes loss after focus / restore actions.
+
+        Focusing on a node is currently implemented via nodes reattaching
+        with some caching involved. It seems that not all code was updated
+        to handle this scenario correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31553
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._restore):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._willHaveChildren):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        (WebInspector.DataGridNode.prototype._detach):
+        (WebInspector.DataGridNode.prototype.savePosition):
+        (WebInspector.DataGridNode.prototype.restorePosition):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridTree.prototype.focus):
+        (WebInspector.TopDownProfileDataGridTree.prototype.restore):
+
+2009-11-18  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPageClient.h needs in some cases QCursor, but it does not
+        include it 
+        https://bugs.webkit.org/show_bug.cgi?id=31527
+
+        No new tests as this is just a coding style fix that affects the 
+        build of some not yet submitted patches (i.e. for bug 30173).
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Nicolas Roard   <nicolas@roard.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        InspectorTimelineAgent.h should be guarded by ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=31504
+
+        * inspector/InspectorTimelineAgent.h:Added the guard.
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Build fix to my previous checkin, for Windows Chromium
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::PropertySynchronizer::synchronize): Fix implicit-conversion error on AtomicString.
+
+2009-11-18  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Directly Access <head> Instead of Searching for It
+        https://bugs.webkit.org/show_bug.cgi?id=31641
+        
+        Changed old access of the head element (document.getElementsByTagName)
+        to just use the document.head accessor.
+
+        * inspector/front-end/FontView.js:
+        (WebInspector.FontView):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (windowLoaded):
+
+2009-11-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix two Geolocation assertions.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::requestGeolocationPermissionForFrame): No need to use PageGroupLoadDeferrer since this
+        is not called from JS. 
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Watchers::set): The PassRefPtr was getting nulled out, so we need to put it in
+        a RefPtr first.
+
+2009-11-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Case sensitive file system build fix.
+
+        * platform/network/Credential.h: It's not WTF, just wtf.
+
+2009-11-18  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for certificates to WebCore::Credential so we can convert between NSURLCredential
+        objects and WebCore::Credential objects without losing certificate information.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):  Adding a constructor that takes an identity argument and a certificate chain argument
+        (WebCore::Credential::isEmpty):  Modifying isEmpty to support certificate based credentials (which don't have a username or password)
+        (WebCore::Credential::identity): Accessor for the m_identity property
+        (WebCore::Credential::certificates): Accessor for the m_certificates property
+        (WebCore::Credential::type):  Accessor for the m_type property
+        (WebCore::operator==):  Modifying == to compare the identity and certificate chains of certificate based credentials.
+        * platform/network/Credential.h:  Adding new fields to WebCore::Credential to support certificate based credentials.
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):  Modifying the mac() conversion method to correctly convert certificate based WebCore::Credential objects.
+        (WebCore::core):  Modifying the core() conversion method to correctly convert certificate based NSURLCredential objects.
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Reverting r50919 that has introduced a non-thread-safe refcounting in ScriptExecutionContext::postTaskToMainThread.
+        https://bugs.webkit.org/show_bug.cgi?id=31615
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::performTask):
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Eliminate unnecessary String-->AtomicString conversions from generated V8 bindings,
+        by causing the right v8-to-WebCore conversion function to be called for every parameter.
+        This no longer requires any IDL metadata, so I've removed the [HintAtomic] annotations.
+        To enforce correctness, I added a mode that disables implicit
+        String-->AtomicString conversions while compiling the generated bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31168
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Generate usage of V8Parameter class.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:  Enable NO_IMPLICIT_ATOMICSTRING.
+        * bindings/v8/V8Binding.h:  Add V8Parameter class.
+        * css/WebKitCSSKeyframesRule.h:  Make AtomicString conversions explicit.
+        * dom/Document.idl:  Remove obsolete [HintAtomic] annotation.
+        * platform/text/AtomicString.h:  Added NO_IMPLICIT_ATOMICSTRING option.
+        * svg/SVGAnimatedTemplate.h:  Change some return types to String to avoid implicit conversion.
+        * svg/SVGAnimatedProperty.h: Adapt to changed return types in SVGAnimatedTemplate.
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move FillOrStrokeType out of public header.
+
+        * platform/graphics/GraphicsContext.h: Updated copyright date to cover
+        some years we published Apple changes, sorted forward declarations,
+        removed FillOrStrokeType enum.
+        * platform/graphics/GraphicsContextPrivate.h: Updated copyright date
+        to cover some years we published Apple changes, sorted includes,
+        moved FillOrStrokeType enum here.
+
+2009-11-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add Settings for WebKitShowDebugBorders and WebKitShowRepaintCounter
+        https://bugs.webkit.org/show_bug.cgi?id=31601
+
+        These are used to debug accelerated compositing layers. I removed
+        the platform specific code from GraphicsLayerCA.mm and added calls
+        to GraphicsLayerClient to get it from the higher levels. The values 
+        now get cached in RenderLayerCompositing and are queried from there
+        by RenderLayerBacking (which implements the GraphicsLayerClient interface).
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setShowDebugBorders):
+        (WebCore::Settings::setShowRepaintCounter):
+        * page/Settings.h:
+        (WebCore::Settings::showDebugBorders):
+        (WebCore::Settings::showRepaintCounter):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::showDebugBorders):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::showDebugBorders):
+        (WebCore::RenderLayerBacking::showRepaintCounter):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::showDebugBorders):
+        (WebCore::RenderLayerCompositor::showRepaintCounter):
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of metrics and properties sidebars'
+        flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31629
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/PropertiesSidebarPane.js:
+
+2009-11-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31606>.
+        Web Inspector: Enter/Return key should enter edit mode for Editable Fields.
+        
+        This implements Enter starting editing mode in an editable DataGrid. If the
+        DataGrid is editable and the user hits return, startEditing the first child
+        of the selected node. Also refactored some editing functions to take an 
+        event target instead of the event itself, because the functions only needed
+        the target. Lastly, added had return in editing mode stop propogation, because
+        when enter was hit to confirm text, it would propagate back to the datagrid
+        and try to start editing again.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._ondblclick):
+        (WebInspector.DataGrid.prototype._startEditing):
+        (WebInspector.DataGrid.prototype.handleKeyEvent):
+        (WebInspector.DataGrid.prototype.dataGridNodeFromEvent):
+        (WebInspector.DataGrid.prototype._mouseDownInDataTable):
+        (WebInspector.DataGrid.prototype._clickInDataTable):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+
+2009-11-18  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        HTMLAnchorElement is inconsistent with its internal handling of the value returned for the href attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=31593
+
+        Test: fast/dom/HTMLAnchorElement/set-href-attribute-whitespace.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::href): Add call to deprecatedParseURL.
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Touch InspectorController so that frontend
+        JS files are deployed on Windows.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clone timeline records array instead of
+        copying reference on invalidate all.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31596
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+
+2009-11-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements don't drop out of compositing layers when animation ends
+        https://bugs.webkit.org/show_bug.cgi?id=31613
+        <rdar://problem/7402913>
+
+        Avoid setting the mustOverlapCompositedLayers flag on RenderLayers which
+        are compositing anyway for other reasons. Doing so can cause those layers
+        to stay in compositing mode even after animations finish, because needsToBeComposited()
+        continues to return true.
+        
+        No new tests because it's not possible to determine which elements are in
+        compositing layers from DRT output.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Mac Plugins: Remove null timer
+        
+        A null timer was used to send mouse move events. Instead, we now use
+        move events to send nullEvent. This brings down CPU usage by 20-30%.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31624
+
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-18  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] WebKit crashes when loading certain SVG images
+
+        Check if the familly exist before creating the PlatformData from it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Test: svg/text/text-font-invalid.html
+
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::fontDataAt):
+
+2009-11-17  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix crash in Chromium/Mac where dropdowns weren't dismissed correctly
+        after navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=31609
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal): Set parent for external
+        dropdowns, so that |PopupListBox::hidePopup()| can successfully notify
+        its parent's client.
+
+2009-11-17  Hayato Ito  <hayato@google.com>
+
+        Reviewed by Darin Adler.
+
+        Avoid infinite mutual recursion when deeply nested tags are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=30651
+
+        Test: fast/parser/block-nesting-cap-table.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::parseToken):
+        (WebCore::tagPriorityOfNode):
+        (WebCore::HTMLParser::limitBlockDepth):
+        (WebCore::HTMLParser::insertNodeAfterLimitBlockDepth):
+        (WebCore::HTMLParser::insertNode):
+        * html/HTMLParser.h:
+
+2009-11-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Final clean-ups for minor coding standard violations.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+
+2009-11-17  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        In all valid script tags for JavaScript, the event handler in <script...for> should not get executed.
+        https://bugs.webkit.org/show_bug.cgi?id=31567
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
+
+2009-11-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make DRT show web inspector for tests in inspector/ folder.
+        - Updated DRT to show/close inspector for all tests under /inspector
+        - Introduced LayoutTestController::setTimelineProfilingEnabled and
+          WebInspector::setTimelineProfilingEnabled beside setJavaScriptProfilingEnabled
+        - Removed reload on each inspector test
+        - Renamed fast/inspector to fast/inspector-support in order not to trigger
+        inspector for those.
+        - Reimplemented timeline tests in order to get rid of reload there.
+        - Moved tests that don't require harness into the fast group.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31472
+
+        * WebCore.Inspector.exp:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+
+2009-11-17  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Android is missing the implementation of the GeolocationService iface.
+        https://bugs.webkit.org/show_bug.cgi?id=31554
+
+        No new tests required as this is platform specific code.
+
+        * platform/android/GeolocationServiceAndroid.cpp: Added.
+        (WebCore::GeolocationServiceAndroid::create):
+        (WebCore::GeolocationServiceAndroid::GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::startUpdating):
+        (WebCore::GeolocationServiceAndroid::stopUpdating):
+        (WebCore::GeolocationServiceAndroid::suspend):
+        (WebCore::GeolocationServiceAndroid::resume):
+        (WebCore::GeolocationServiceAndroid::newPositionAvailable):
+        (WebCore::GeolocationServiceAndroid::newErrorAvailable):
+        (WebCore::GeolocationServiceAndroid::timerFired):
+        (WebCore::GeolocationServiceAndroid::isPositionMovement):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreAccurate):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreTimely):
+        * platform/android/GeolocationServiceAndroid.h: Added.
+        (WebCore::GeolocationServiceAndroid::~GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::lastPosition):
+        (WebCore::GeolocationServiceAndroid::lastError):
+        * platform/android/GeolocationServiceBridge.cpp: Added.
+        (WebCore::):
+        (WebCore::GeolocationServiceBridge::GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::~GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::start):
+        (WebCore::GeolocationServiceBridge::stop):
+        (WebCore::GeolocationServiceBridge::setEnableGps):
+        (WebCore::GeolocationServiceBridge::newLocationAvailable):
+        (WebCore::GeolocationServiceBridge::newErrorAvailable):
+        (WebCore::GeolocationServiceBridge::toGeoposition):
+        (WebCore::GeolocationServiceBridge::startJavaImplementation):
+        (WebCore::GeolocationServiceBridge::stopJavaImplementation):
+        * platform/android/GeolocationServiceBridge.h: Added.
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewd build fix.
+
+        - Fix typo in WebCore.vcproj.
+        - Intlude limits.h for INT_MAX.
+        - Enclose with parenthesis to suspress warning.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::addDay):
+
+2009-11-16  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Make sure wx scrollbar drawing code factors in transforms when switching backends,
+        fix calcs for scrollbar length, and tweak the Mac scrollbar tracking rects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31570
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::minimumThumbLength):
+        (WebCore::ScrollbarThemeWx::splitTrack):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        * platform/wx/ScrollbarThemeWx.h:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h:
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Introduce WebCore::ISODateTime class.
+        https://bugs.webkit.org/show_bug.cgi?id=31340
+
+        This class represents a value of date/time types of the HTML5 INPUT
+        element, and has some parsing methods for ISO 8601.
+
+        This change has no tests because the class is not used yet.
+
+        * GNUmakefile.am: Add ISODateTime.cpp and ISODateTime.h.
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: ditto.
+        * WebCoreSources.bkl: ditto.
+        * html/ISODateTime.cpp: Added. Implementation of WebCore::ISODateTime class.
+        (WebCore::isLeapYear):
+        (WebCore::maxDayOfMonth):
+        (WebCore::dayOfWeek):
+        (WebCore::ISODateTime::maxWeekNumberInYear):
+        (WebCore::countDigits):
+        (WebCore::toInt):
+        (WebCore::ISODateTime::parseYear): Private helper for parseDate() and parseWeek().
+        (WebCore::ISODateTime::addDay): Private helper for parseTimeZone().
+        (WebCore::ISODateTime::addMinute): ditto.
+        (WebCore::ISODateTime::parseTimeZone): Private helper for parseDateTime().
+        (WebCore::ISODateTime::parseMonth): Parser for <input type=month>.
+        (WebCore::ISODateTime::parseDate): Parser for <input type=date>.
+        (WebCore::ISODateTime::parseWeek): Parser for <input type=week>.
+        (WebCore::ISODateTime::parseTime): Parser for <input type=time>.
+        (WebCore::ISODateTime::parseDateTimeLocal): Parser for <input type=datetime-local>.
+        (WebCore::ISODateTime::parseDateTime): Parser for <input type=datetime>.
+        * html/ISODateTime.h: Added.  Declare WebCore::ISODateTime class.
+        (WebCore::ISODateTime::ISODateTime):
+        (WebCore::ISODateTime::millisecond):
+        (WebCore::ISODateTime::second):
+        (WebCore::ISODateTime::minute):
+        (WebCore::ISODateTime::hour):
+        (WebCore::ISODateTime::monthDay):
+        (WebCore::ISODateTime::month):
+        (WebCore::ISODateTime::fullYear):
+        (WebCore::ISODateTime::week):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: #ifdef, not #if.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Tiger build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Define CFN_EXPORT, as this macro was named
+        differently in Tiger CFNetwork.
+
+2009-11-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [KURLGoogle] setHostAndPort doesn't handle arguments without port correctly.
+
+        Fix a bug in the code that was dormant until http://trac.webkit.org/changeset/50784.
+
+        Covered by existing test: LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setHostAndPort): Added handling of arguments without port specified.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Jon Honeycutt.
+
+        A better Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Use a macro that inserts __declspec(dllimport) when appropriate for CFNetwork imports.
+
+2009-11-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Rename protocolIsValid to isValidProtocol.
+        https://bugs.webkit.org/show_bug.cgi?id=31503
+
+        This name change was suggested in https://bugs.webkit.org/show_bug.cgi?id=29972#c19.
+
+        No new tests since no new functionality was introduced.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setProtocol):
+        * platform/KURL.cpp:
+        (WebCore::isValidProtocol):
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp:
+        (WebCore::isValidProtocol):
+
+2009-11-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: aria-labelledby duplicates some of its WAI-ARIA label
+        https://bugs.webkit.org/show_bug.cgi?id=31565
+
+        Test: accessibility/aria-labelledby-overrides-label.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hasTextAlternative):
+        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-11-16  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Handle the case of a null NPObject* in NPN_SetException in
+        the V8 bindings.  This allow out of process plugins calling
+        NPN_SetException to just send null instead of sending an
+        NPObject* that would be an address in a different 
+        process's memory space.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31561
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_SetException): Allow null NPObject* and just throw a general error.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Disable CONNECT proxies on Windows until WebKitSupportLibrary includes support for those.
+
+2009-11-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] ASSERT failure while running DRT
+        https://bugs.webkit.org/show_bug.cgi?id=30978
+
+        Add needed Structure typeInfo flags to QtRuntimeObjectImpl and QtRuntimeMethod.
+        These flags are needed after r49649, where HasDefaultmark was changed to OverrideMarkChildren.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-11-16  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the build.  Land a file that was missing from r51049.
+
+        * bindings/js/JSWebGLArrayHelper.h: Copied from WebCore/html/canvas/WebGLByteArray.idl.
+        (WebCore::setWebGLArrayFromArray):
+
+2009-11-16  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update API of WebGLArray and friends
+        https://bugs.webkit.org/show_bug.cgi?id=31175
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLArrayHelper.h: Added.
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/js/JSWebGLByteArrayCustom.cpp:
+        (WebCore::JSWebGLByteArray::set):
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::set):
+        * bindings/js/JSWebGLIntArrayCustom.cpp:
+        (WebCore::JSWebGLIntArray::set):
+        * bindings/js/JSWebGLShortArrayCustom.cpp:
+        (WebCore::JSWebGLShortArray::set):
+        * bindings/js/JSWebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedByteArray::set):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::set):
+        * bindings/js/JSWebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedShortArray::set):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructWebGLArray):
+        (WebCore::getWebGLArrayElement):
+        (WebCore::setWebGLArrayFromArray):
+        (WebCore::setWebGLArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/WebGLArray.cpp:
+        (WebCore::WebGLArray::WebGLArray):
+        (WebCore::WebGLArray::~WebGLArray):
+        (WebCore::WebGLArray::setImpl):
+        * html/canvas/WebGLArray.h:
+        (WebCore::WebGLArray::isByteArray):
+        (WebCore::WebGLArray::isUnsignedByteArray):
+        (WebCore::WebGLArray::isShortArray):
+        (WebCore::WebGLArray::isUnsignedShortArray):
+        (WebCore::WebGLArray::isIntArray):
+        (WebCore::WebGLArray::isUnsignedIntArray):
+        (WebCore::WebGLArray::isFloatArray):
+        (WebCore::WebGLArray::buffer):
+        (WebCore::WebGLArray::baseAddress):
+        (WebCore::WebGLArray::byteOffset):
+        * html/canvas/WebGLArray.idl:
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::WebGLArrayBuffer):
+        (WebCore::WebGLArrayBuffer::data):
+        (WebCore::WebGLArrayBuffer::byteLength):
+        (WebCore::WebGLArrayBuffer::~WebGLArrayBuffer):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLByteArray.cpp:
+        (WebCore::WebGLByteArray::create):
+        (WebCore::WebGLByteArray::byteLength):
+        (WebCore::WebGLByteArray::slice):
+        (WebCore::WebGLByteArray::set):
+        * html/canvas/WebGLByteArray.h:
+        (WebCore::WebGLByteArray::isByteArray):
+        (WebCore::WebGLByteArray::data):
+        (WebCore::WebGLByteArray::set):
+        (WebCore::WebGLByteArray::get):
+        (WebCore::WebGLByteArray::item):
+        * html/canvas/WebGLByteArray.idl:
+        * html/canvas/WebGLFloatArray.cpp:
+        (WebCore::WebGLFloatArray::create):
+        (WebCore::WebGLFloatArray::WebGLFloatArray):
+        (WebCore::WebGLFloatArray::length):
+        (WebCore::WebGLFloatArray::byteLength):
+        (WebCore::WebGLFloatArray::slice):
+        (WebCore::WebGLFloatArray::set):
+        * html/canvas/WebGLFloatArray.h:
+        (WebCore::WebGLFloatArray::isFloatArray):
+        (WebCore::WebGLFloatArray::data):
+        (WebCore::WebGLFloatArray::set):
+        (WebCore::WebGLFloatArray::get):
+        (WebCore::WebGLFloatArray::item):
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLIntArray.cpp:
+        (WebCore::WebGLIntArray::create):
+        (WebCore::WebGLIntArray::WebGLIntArray):
+        (WebCore::WebGLIntArray::length):
+        (WebCore::WebGLIntArray::byteLength):
+        (WebCore::WebGLIntArray::slice):
+        (WebCore::WebGLIntArray::set):
+        * html/canvas/WebGLIntArray.h:
+        (WebCore::WebGLIntArray::isIntArray):
+        (WebCore::WebGLIntArray::data):
+        (WebCore::WebGLIntArray::set):
+        (WebCore::WebGLIntArray::get):
+        (WebCore::WebGLIntArray::item):
+        * html/canvas/WebGLIntArray.idl:
+        * html/canvas/WebGLShortArray.cpp:
+        (WebCore::WebGLShortArray::create):
+        (WebCore::WebGLShortArray::WebGLShortArray):
+        (WebCore::WebGLShortArray::length):
+        (WebCore::WebGLShortArray::byteLength):
+        (WebCore::WebGLShortArray::slice):
+        (WebCore::WebGLShortArray::set):
+        * html/canvas/WebGLShortArray.h:
+        (WebCore::WebGLShortArray::isShortArray):
+        (WebCore::WebGLShortArray::data):
+        (WebCore::WebGLShortArray::set):
+        (WebCore::WebGLShortArray::get):
+        (WebCore::WebGLShortArray::item):
+        * html/canvas/WebGLShortArray.idl:
+        * html/canvas/WebGLUnsignedByteArray.cpp:
+        (WebCore::WebGLUnsignedByteArray::create):
+        (WebCore::WebGLUnsignedByteArray::WebGLUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::length):
+        (WebCore::WebGLUnsignedByteArray::byteLength):
+        (WebCore::WebGLUnsignedByteArray::slice):
+        (WebCore::WebGLUnsignedByteArray::set):
+        * html/canvas/WebGLUnsignedByteArray.h:
+        (WebCore::WebGLUnsignedByteArray::isUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::data):
+        (WebCore::WebGLUnsignedByteArray::set):
+        (WebCore::WebGLUnsignedByteArray::get):
+        (WebCore::WebGLUnsignedByteArray::item):
+        * html/canvas/WebGLUnsignedByteArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.cpp:
+        (WebCore::WebGLUnsignedIntArray::create):
+        (WebCore::WebGLUnsignedIntArray::WebGLUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::length):
+        (WebCore::WebGLUnsignedIntArray::byteLength):
+        (WebCore::WebGLUnsignedIntArray::slice):
+        (WebCore::WebGLUnsignedIntArray::set):
+        * html/canvas/WebGLUnsignedIntArray.h:
+        (WebCore::WebGLUnsignedIntArray::isUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::data):
+        (WebCore::WebGLUnsignedIntArray::set):
+        (WebCore::WebGLUnsignedIntArray::get):
+        (WebCore::WebGLUnsignedIntArray::item):
+        * html/canvas/WebGLUnsignedIntArray.idl:
+        * html/canvas/WebGLUnsignedShortArray.cpp:
+        (WebCore::WebGLUnsignedShortArray::create):
+        (WebCore::WebGLUnsignedShortArray::WebGLUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::length):
+        (WebCore::WebGLUnsignedShortArray::byteLength):
+        (WebCore::WebGLUnsignedShortArray::slice):
+        (WebCore::WebGLUnsignedShortArray::set):
+        * html/canvas/WebGLUnsignedShortArray.h:
+        (WebCore::WebGLUnsignedShortArray::isUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::data):
+        (WebCore::WebGLUnsignedShortArray::set):
+        (WebCore::WebGLUnsignedShortArray::get):
+        (WebCore::WebGLUnsignedShortArray::item):
+        * html/canvas/WebGLUnsignedShortArray.idl:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Declare constants as extern "C".
+
+2009-11-15  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Enable support for webkit-box-shadow in Cairo builds.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        Covered by existing fast/box-shadow tests.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:  Add
+          support for fillRect shadows.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Don't try to include a file that's not
+        in WebKitSupportLibrary.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31494
+        Add unauthenticated proxy support to SocketStreamHandleCFNet
+
+        Cannot be tested in DRT.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::chooseProxy): Fetch proxy information from OS.
+        (WebCore::SocketStreamHandle::createStreams): Apply it to the newly created streams.
+
+2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Broken back/forward after using ErrorPageExtension to set error page
+        https://bugs.webkit.org/show_bug.cgi?id=30573
+
+        Make FrameLoader::checkLoadCompleteForThisFrame method
+        to check for any working DocumentLoader instance (through
+        activeDocumentLoader()) instead of only checking for
+        'm_provisionalDocumentLoader' in order to decide to if
+        it is going to reset of not the back and forward history.
+        after an error page has been loaded.
+
+        Test: LayoutTests/fast/history/back-forward-reset-after-error-handling.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2009-11-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="directory"
+        https://bugs.webkit.org/show_bug.cgi?id=31516
+
+        Test: platform/mac/accessibility/aria-directory.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isOrderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):
+
+2009-11-15  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by George Staikos.
+        
+        Compare UChars single unit at a time as opposed to the uint32_t
+        approach as casting to unaligned addresses may cause a bus failure
+        on ARMv5 and below. This change replicates the same defines that
+        exists in AtomicString.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=31475
+        
+        * platform/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2009-11-15  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Wrap some SVG code in V8DOMWrapper with an ENABLE(SVG) test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31490
+
+        * bindings/v8/V8DOMWrapper.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. The FileChooser constructor doesn't need to be redefined.
+
+        * platform/haiku/FileChooserHaiku.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. ColorSpace name had a wrong CamelCase.
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r50999.
+        http://trac.webkit.org/changeset/50999
+
+        Need to fix some issues in the Windows build. Missed some places where
+        RenderTextControl::isEdited is called.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setUserEdited):
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::isEdited):
+        (WebCore::RenderTextControl::setEdited):
+        (WebCore::RenderTextControl::isUserEdited):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6946165> Would like to be able to specify the number of visible lines when using -webkit-line-clamp
+
+        Test: fast/overflow/line-clamp.html
+
+        * css/CSSComputedStyleDeclaration.cpp: (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Updated to handle different types of values.
+        * css/CSSParser.cpp: (WebCore::CSSParser::parseValue): ditto.
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::applyProperty): ditto.
+
+        * rendering/RenderFlexibleBox.cpp: (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        Use the line count value if available.  Otherwise, convert the percentage to the line count, as we did before.  Also,
+        if there is anchor as the last child box, still allow adding the ellipsis.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively): Call isNone on the LineClampValue to see if the line-clamp property has been set.
+        (WebCore::RenderLayer::scrollRectToVisible): ditto.
+
+        * WebCore.xcodeproj/project.pbxproj: Added LineClampValue.h
+        * rendering/style/LineClampValue.h: Added.
+        (WebCore::LineClampValue::LineClampValue):
+        (WebCore::LineClampValue::value):
+        (WebCore::LineClampValue::isPercentage):
+        (WebCore::LineClampValue::isNone):
+        (WebCore::LineClampValue::operator==):
+        (WebCore::LineClampValue::operator!=):
+        * rendering/style/RenderStyleConstants.h: (WebCore::): Define ELineClampType enum for percentage or line count.
+
+        * rendering/style/RenderStyle.h: Use LineClampValue.
+        (WebCore::InheritedFlags::lineClamp):
+        (WebCore::InheritedFlags::setLineClamp):
+        (WebCore::InheritedFlags::initialLineClamp):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2009-11-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7287487> 
+        Do not use QuickTime version to detect media controller theme
+
+        * WebCore.base.exp: Export wkMediaControllerThemeAvailable
+        * platform/mac/WebCoreSystemInterface.h: Ditto.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme): Use wkMediaControllerThemeAvailable instead of the
+        QuickTime version to see if it is possible to use MediaControllerThemeQuickTime.
+
+2009-11-14  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Recognizes date/datetime/datetime-local/month/time/week types of INPUT element.
+          They have no dedicated UI and no type validation for now.
+        - Clean up setInputType() and formControlType() of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29004
+
+        Test: fast/forms/input-type-change3.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::createTypeMap):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::createFormControlTypes):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::isTextField):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+
+2009-11-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: checkbox does not determine its label from text content
+        https://bugs.webkit.org/show_bug.cgi?id=31456
+
+        Test: accessibility/aria-checkbox-text.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-11-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Fix build to catch up with http://trac.webkit.org/changeset/50973.
+        This is just enough changes to unbreak the port.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * loader/FrameLoaderClient.h:
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Provide an empty implementation of this method because I don't know
+        what it is supposed to do on Chromium.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoader.h: Make dispatchDidClearWindowObjectsInAllWorlds()
+        public, as Chromium's V8Proxy calls it.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix to Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): 
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * platform/text/TextBoundaries.cpp: Use longer path to refer to Unicode.h.
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.  Should fix failure #4.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::getAllWorlds):
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Windows and Chromium builds after http://trac.webkit.org/changeset/50977.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        * WebCore.gypi: Rename TextBoundariesICU -> TextBoundaries
+        * WebCore.vcproj/WebCore.vcproj: Rename TextBoundariesICU -> TextBoundaries
+
+2009-11-12  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        LocalStorage quota should include key sizes in its count
+        https://bugs.webkit.org/show_bug.cgi?id=31451
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setItem):
+            Count keys in the quota when adding a new item.
+        (WebCore::StorageMap::removeItem):
+            Remove the key's length from the quota if we're removing the item.
+        (WebCore::StorageMap::importItem):
+            Assume that we're adding things for the first time.
+            Count keys in the quota.
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Moving TextBoundariesICU.cpp to TextBoundaries.cpp
+        by removing the direct ICU dependency and replacing it
+        with WTF functions and WebCore's own TextBreakIterator
+        abstractions.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/text/TextBoundaries.cpp: Added.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+        * platform/text/TextBoundariesICU.cpp: Removed.
+        * platform/text/TextBreakIterator.h:
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::textBreakLast):
+        (WebCore::textBreakPrevious):
+
+2009-11-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebCore::externalRepresentation should update layout before getting render object
+        https://bugs.webkit.org/show_bug.cgi?id=31459
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Tell FrameLoaderClient when window objects in isolated worlds are
+        cleared
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Test: http/tests/security/isolatedWorld/didClearWindowObject.html
+
+        Reviewed by Dave Hyatt.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::getAllWorlds): Added. Copies all the
+        worlds in m_worldSet to the passed-in Vector.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): Added. Calls through to
+        WebCoreJSClientData.
+        (WebCore::ScriptController::initScript): Changed to call
+        FrameLoader::dispatchDidClearWindowObjectInWorld.
+
+        * bindings/js/ScriptController.h: Added getAllWorlds.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Updated for FrameLoaderClient change.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::begin):
+        Changed to call dispatchDidClearWindowObjectsInAllWorlds.
+
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        Added. Retrieves all the worlds, then calls through to
+        dispatchDidClearWindowObjectInWorld for each one.
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld): Replaces
+        dispatchWindowObjectAvailable. Calls up to the client, then, if the
+        world is the mainThreadNormalWorld(), tells the Inspector about it,
+        too.
+
+        * loader/FrameLoader.h: Replaced dispatchWindowObjectAvailable with
+        dispatchDidClearWindowObjectInWorld. Added
+        dispatchDidClearWindowObjectsInAllWorlds.
+
+        * loader/FrameLoaderClient.h: Replaced windowObjectCleared with
+        dispatchDidClearWindowObjectForWorld.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix SVG context assignment for pod types.
+        https://bugs.webkit.org/show_bug.cgi?id=31497
+
+        I broke this in r50958.
+
+        Tested by svg/custom/viewport-update2.svg.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-11-13  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Bring the platform/android files inline with Android 2.0
+        https://bugs.webkit.org/show_bug.cgi?id=31423
+
+        No new tests required: these are all Android-specific files.
+
+        * platform/android/ClipboardAndroid.cpp:
+        (WebCore::ClipboardAndroid::files):
+        * platform/android/ClipboardAndroid.h:
+        * platform/android/FileChooserAndroid.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        (WebCore::fileButtonChooseFileLabel):
+        * platform/android/KeyEventAndroid.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeAndroid::baselinePosition):
+        (WebCore::RenderThemeAndroid::paintButton):
+        (WebCore::adjustMenuListStyleCommon):
+        (WebCore::RenderThemeAndroid::paintCombo):
+        * platform/android/ScreenAndroid.cpp:
+        * platform/android/ScrollViewAndroid.cpp:
+        (WebCore::ScrollView::platformOffscreenContentRectangle):
+        * platform/android/TemporaryLinkStubs.cpp:
+        (JSC::Bindings::dispatchJNICall):
+        * platform/android/WidgetAndroid.cpp:
+        (WebCore::Widget::setFrameRect):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * WebCore.pro:
+
+2009-11-13  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Implement composition events introduced in DOM Level 3.
+        This change adds a new IDL which defines the composition events, adds a class which
+        implements the composition events, and sends the composition events according to
+        the specification.
+        https://bugs.webkit.org/show_bug.cgi?id=26310
+
+        Test: fast/events/ime-composition-events-001.html
+
+        * DerivedSources.make: Added CompositionEvent so we can compile "CompositionEvent.idl".
+        * GNUmakefile.am: Added "CompositionEvent.{cpp,h,idl}".
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: Added "CompositionEvent.{cpp,h,idl}" and "JSCompositionEvent.{cpp,h}".
+        * WebCoreSources.bkl: Added "JSCompositionEvent.{cpp,h}".
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS): Call isCompositionEvent() to create the CompositionEvent wrapper.
+        * bindings/v8/DOMObjectsInclude.h: Added "JSCompositionEvent.h".
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added "JSCompositionEvent.cpp".
+        * bindings/v8/V8DOMWrapper.cpp: Call isCompositionEvent() to identify an event as a CompositionEvent.
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp: Added "V8CompositionEvent.h".
+        * bindings/v8/V8Index.h: Added V8Index::COMPOSITIONEVENT.
+        * dom/CompositionEvent.cpp: Implements the CompositionEvent class.
+        (WebCore::CompositionEvent::CompositionEvent):
+        (WebCore::CompositionEvent::~CompositionEvent):
+        (WebCore::CompositionEvent::initCompositionEvent):
+        (WebCore::CompositionEvent::isCompositionEvent):
+        * dom/CompositionEvent.h: Declares the CompositionEvent class.
+        (WebCore::CompositionEvent::create):
+        (WebCore::CompositionEvent::data):
+        * dom/CompositionEvent.idl: Added the IDL of DOM CompositionEvent.
+        * dom/Event.cpp:
+        (WebCore::Event::isCompositionEvent): Added a method to identify an event is a CompositionEvent.
+        * dom/Event.h:
+        * dom/EventNames.h: Added composition{start,update,end} to eventNames.
+        * editing/Editor.cpp:
+        (WebCore::Editor::confirmComposition): Sent a CompositionEnd event.
+        (WebCore::Editor::setComposition): Sent a Composition{Start,Update,End} event.
+
+2009-11-13  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a link error in unofficial GCC 4.4 builds on Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31477
+
+        * bindings/v8/V8Binding.cpp:  Add explicit instantiations of v8StringToWebCoreString template.
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Debug build after http://trac.webkit.org/changeset/50960.
+
+        The CounterNode class does not support all methods necessary to efficiently update the counter tree as needed per CSS2.1
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        * rendering/RenderCounter.cpp:
+        (WebCore::destroyCounterNodeChildren):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        We currently fill a path with solid color instead of filling
+        a clipping path. This causes problems on some composite operators,
+        since Cairo modifies the area outside the path.
+        This fixes the behavior of WebKitGtk on fast/canvas/canvas-composite-alpha.html
+
+        Thanks to Benjamin Otte for tracking the bug down.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31440
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * storage/DatabaseTracker.h:
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/chromium/QuotaTracker.cpp:
+        (WebCore::QuotaTracker::updateDatabaseSize):
+        * storage/chromium/QuotaTracker.h:
+
+2009-11-13  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        The CounterNode class is missing some basic tree navigation methods common in other WebKit trees such as the rendering tree
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+        Added tree navigation methods that permit full implementation of CSS2.1
+        counter feature without using recursion proportional to the counter
+        tree depth.
+        No new tests because I did not find any bug that is fixed by this
+        commit yet, this just reduces the size of the patch for 11031 and
+        helps respond to some concerns regarding that patch.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+
+        (WebCore::CounterNode::nextInPreOrderAfterChildren):
+        (WebCore::CounterNode::nextInPreOrder):
+        Added to support non-recursive tree traversal necessary for
+        efficient full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::lastDescendant):
+        (WebCore::CounterNode::previousInPreOrder):
+        Moved this methods such that they occupy a place similar to that of
+        identically named methods on the render tree. This allows for their
+        broader use needed in full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::resetRenderer):
+        (WebCore::CounterNode::resetRenderers):
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::insertAfter):
+        (WebCore::CounterNode::removeChild):
+        Changed such that insertion/removal of a counter, triggers not only
+        recalculation of PrefixWidths, but also reassesment of values in
+        counter nodes. This is the basis full implementation of CSS2.1
+        counters. It does not change current behavior by much because of
+        changes needed to the recalculation algorithm, but those are comming
+        in the patch for 11031.
+        (WebCore::showTreeAndMark):
+        * rendering/CounterNode.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::counter):
+        Only changed argument type to prepare for implementation of Darin
+        Adler's recommendation for the patch to 11031.
+
+        (WebCore::RenderCounter::invalidate):
+        (WebCore::destroyCounterNodeChildren):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::invalidateCountersInContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        * rendering/RenderObjectChildList.h:
+        Added the ability to restrict invalidation to counters with a given
+        identifier.
+        Also invalidated counters that are on the child container itself
+        which were missed by the previous algorithm, but were a valid case.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Protect SVG animated properties from destruction in bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31474
+
+        See http://crbug.com/26719.
+
+        Tested by LayoutTests/svg/custom/js-update-transform-addition.svg
+        under Valgrind.
+
+        Made sure we keep a reference to SVG properties while setting a
+        context:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::withSVGContext):
+
+2009-11-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Incorporate Benjamin Otte's recommendations to avoid
+        a buffer overrun, and small performance improvement.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::copyContextProperties): Correctly size output
+         storage for cairo_get_dash to avoid buffer overrun.
+        (WebCore::drawPathShadow): Prefer cairo_fill_extents
+         to slower cairo_stroke_extents when not drawing shadows.
+
+2009-11-13  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Do not register Chromium's HTML5 DB VFS as the default
+        VFS. Otherwise, other sqlite DB users in the same process will
+        stop working.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31462
+
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Explicitly cast "-1" to CFOptionFlags,
+        avoiding a sign mismatch warning.
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Release build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        Use ASSERT_UNUSED for unused stream parameter.
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31441
+        Implement SocketStreamHandleCFNet
+
+        Existing WebSocket tests now pass on Mac. No proxy support yet.
+
+        * platform/network/SocketStreamHandleClient.h:
+        * platform/network/cf/SocketStreamHandle.h:
+        (WebCore::SocketStreamHandle::shouldUseSSL):
+        (WebCore::SocketStreamHandle::refAuthenticationClient):
+        (WebCore::SocketStreamHandle::derefAuthenticationClient):
+        (WebCore::SocketStreamHandle::):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::chooseProxy):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::SocketStreamHandle::copyCFStreamDescription):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+        (WebCore::SocketStreamHandle::receivedCredential):
+        (WebCore::SocketStreamHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::SocketStreamHandle::receivedCancellation):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering (take 2).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Chromium: [REGRESSION] Crash while stopping on a breakpoint.
+        Rolling back r50890.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31467
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+        
+        This is the fix of a regression, caused by the shadow patch
+        from the bug above. Reinserted the save and restore calls
+        that were accidently removed by the previous patch.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Reverting r50908 since it makes inspector tests
+        time out.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+
+2009-11-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable 'console.profile()' and 'console.profileEnd()'
+        regardless of JAVASCRIPT_DEBUGGER.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31293
+
+        * WebCore.gypi:
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profile):
+        (WebCore::JSConsole::profileEnd):
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * page/Console.idl:
+
+2009-11-12  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Chromium build fix.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::evaluateInWorld): Add a dummy
+         method which isn't called in chromium to make things compile.
+
+2009-11-12  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+        
+        The document-open.html test was flaky at times. The test invokes the layout test plugin
+        which in its destroy stream handler opens a new document. This basically tears down the
+        stream and the associated plugin instance, which causes a crash when the plugin stream
+        dereferences an invalid m_client pointer which points to the PluginView instance which
+        is invalid at this time. Fix is to set the m_client pointer to NULL in the stop function
+        and check for the same.
+       
+        https://bugs.webkit.org/show_bug.cgi?id=31067
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::stop):
+        (WebCore::PluginStream::destroyStream):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Renaming some parameters passed to DB-related methods to better
+        indicate their purpose.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31449
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transformed reflected elements are clipped inside element with opacity
+        https://bugs.webkit.org/show_bug.cgi?id=30957
+        
+        transparencyClipBox() attemped to minimize the size of the transparency layer by mapping
+        each clip rect into painting space before taking the unions. This, however, did not work
+        correctly with combinations of reflections and transforms. Fixed by unioning the
+        clipRect and mapping through transforms along the way.
+        
+        Also leave some #ifdeffed code in beginTransparencyLayers() that makes it easy to see
+        where the transparency layers are.
+
+        Test: fast/reflections/opacity-reflection-transform.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        Improve SecurityOrigin::toString comment
+        https://bugs.webkit.org/show_bug.cgi?id=31041
+
+        * page/SecurityOrigin.h:
+
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+        * rendering/RenderTreeAsText.h:
+
+2009-11-12  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] The Android specific files in page/Android are out of date.
+        https://bugs.webkit.org/show_bug.cgi?id=31437
+
+        No tests required.
+
+        * page/android/DragControllerAndroid.cpp:
+        (WebCore::DragController::dragOperation): Added.
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::accessKeyModifiers): Added.
+        * page/android/InspectorControllerAndroid.cpp: Removed.
+
+2009-11-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Implement Canvas/SVG shadow support for Cairo.  This patch
+        uses the filter code from SVG Filters.  That means that it is
+        necessary to activate filters to see the shadows.
+
+        Test: fast/canvas/canvas-shadow.html
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj: Add new ImageBufferFilter files.
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (GraphicsContext::calculateShadowBufferDimensions): New helper routine.
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+        (WebCore::copyContextProperties):
+        (WebCore::drawPathShadow):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::createPlatformShadow):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw): Add filter effect.
+        * platform/graphics/filters/Filter.h: Correct 'const' signatures.
+        * platform/graphics/filters/ImageBufferFilter.cpp: Added.
+        * platform/graphics/filters/ImageBufferFilter.h: Added.
+        * svg/graphics/filters/SVGFilter.cpp: Correct 'const' signatures.
+        * svg/graphics/filters/SVGFilter.h: Correct 'const' signatures.
+
+2009-11-12  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add postTaskToMainThread to ScriptExecutionContext.
+        Move the code to post task to the main thread into a new method on ScriptExecutionContext,
+        to use as a helper implementation of the virtual ScriptExecutionContext::postTask(Task) in
+        contexts that live on the main thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31427
+
+        No new tests - simply moving the code.
+
+        * dom/Document.cpp:
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskData::PerformTaskData):
+        (WebCore::PerformTaskData::performTask):
+        (WebCore::ScriptExecutionContext::postTaskToMainThread):
+        * dom/ScriptExecutionContext.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix crash when removing compositing layers when GC is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=31429
+
+        Workaround <rdar://problem/7390716> by special-casing the removal
+        of all sublayers when GC is enabled.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::safeSetSublayers):
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The last of the V8 binding optimizations.
+        - Replace string-valued element accessors with a shared getter/setter function.
+        - Change error handling flow of control to avoid extra branches and function calls.
+        https://bugs.webkit.org/show_bug.cgi?id=31443
+        
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::getElementStringAttr):  Body of string-valued Element getter function.
+        (WebCore::setElementStringAttr):  Body of string-valued Element setter function.
+        * bindings/v8/V8Binding.h:
+
+2009-11-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/7267951>
+        Canvas methods should reject uses of NaN and Infinity.
+
+        Test: fast/canvas/canvas-with-illegal-args.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: profile timeline panel, fix obvious problems.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31432
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.hasStyleClass):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        Covered by existing tests.
+
+        * WebCore.base.exp: Update exported symbols to match what now exists
+        and is needed by WebKit.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Updated for function rename.
+
+        * bindings/js/ScriptController.cpp: Removed code that dealt with
+        worldIDs.
+        (WebCore::ScriptController::createWorld): Added. Returns a new world
+        suitable for use on the main thread.
+        (WebCore::ScriptController::executeScriptInWorld): Renamed from
+        executeScriptInIsolatedWorld, since this works just fine with a
+        "normal" world.
+
+        * bindings/js/ScriptController.h: Added createWorld, removed functions
+        that took worldIDs, renamed executeScriptInIsolatedWorld to
+        executeScriptInWorld.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        Updated for changes to UserScriptMap and ScriptController.
+
+        * page/Frame.h: Changed injectUserScriptsForWorld to take a
+        DOMWrapperWorld* instead of a worldID.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        Changed these functions to take a DOMWrapperWorld* instead of a
+        worldID. Also updated for changes to UserScript and UserStyleSheet.
+
+        * page/UserScript.h:
+        * page/UserStyleSheet.h: Changed not to hold a worldID, since it was
+        never used.
+
+        * page/UserScriptTypes.h:
+        * page/UserStyleSheetTypes.h: Changed UserScriptMap and
+        UserStyleSheetMap to use a RefPtr<DOMWrapperWorld> instead of a
+        worldID as their key type.
+
+
+2009-11-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31260>.
+        Web Inspector: Main Resources Other than HTML are mis-detected.
+        
+        Even if the resource is a main resource, look at its CachedResource type, 
+        because it might be an image, stylesheet, or JavaScript file, and we
+        want to show them all correctly.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResourceType): Move this method out so it can be called in multiple places.
+        (WebCore::InspectorResource::type): 
+        * inspector/InspectorResource.h:
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Table-driven setup for V8 binding template callback functions. 100k in code savings.
+        https://bugs.webkit.org/show_bug.cgi?id=31420
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Change generated ConfigureXXXTemplate fn
+            to call configureTemplate().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::configureTemplate):  New function; does all the standard configuration work.
+        (WebCore::createCallback):  De-inlined wrapper for FunctionTemplate creation.
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):  Just wrapped the very long fn parameter list.
+        (WebCore::batchConfigureCallbacks):  New function, used by configureTemplate.
+        (WebCore::batchConfigureConstants):  Just wrapped the very long fn parameter list.
+        * bindings/v8/V8Proxy.h:
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50876.
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7388969> Add DOM API for fullscreen video
+        
+        DOM API for fullscreen <video>.
+
+        Tests: media/media-fullscreen-inline.html
+               media/media-fullscreen-not-in-document.html
+
+        * dom/EventNames.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+        * html/HTMLAttributeNames.in:
+            Add onwebkitbeginfullscreen and onwebkitendfullscreen.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onwebkitbeginfullscreen and onwebkitendfullscreen.
+        (WebCore::HTMLMediaElement::enterFullscreen):
+            Schedule webkitbeginfullscreenEvent event, don't set m_isFullscreen unless we
+            actually do enter fullscreen.
+        (WebCore::HTMLMediaElement::exitFullscreen):
+            Schedule webkitendfullscreenEvent event.
+        (WebCore::HTMLMediaElement::webkitEnterFullScreen):
+        (WebCore::HTMLMediaElement::webkitExitFullScreen):
+        (WebCore::HTMLMediaElement::webkitSupportsFullscreen):
+        (WebCore::HTMLMediaElement::webkitDisplayingFullscreen):
+            New, access to fullscreen properties and methods.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for fullscreen API.
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen):
+            Return false if a movie does not have video.
+
+        * page/DOMWindow.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-12  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30291
+
+        Fixes an issue where the returned drop effect is incorrect when
+        effectAllowed == "uninitialized".
+
+        According to section 7.9.2 of the HTML 5 spec.
+        <http://dev.w3.org/html5/spec/Overview.html#the-dragevent-and-datatransfer-interfaces>
+        when effectAllowed = "uninitialized" the resulting dropEffect should be the
+        user-specified dropEffect (i.e. "copy", "move", "link") and "none" for any
+        other case.
+        
+        No test cases are included because we have an existing test case from
+        bug #24731.
+
+        * dom/Clipboard.cpp:
+        (WebCore::dragOpFromIEOp): Added case for op == "uninitialized".
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not highlight node on refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31419
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Minor timeline fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31417
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype._updateDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        SnowLeopard build fix.
+
+        Renamed initWithClient to initWithAuthenticationClient.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (-[WebCoreAuthenticationClientAsChallengeSender initWithAuthenticationClient:]):
+        (WebCore::AuthenticationChallenge::setAuthenticationClient):
+
+2009-11-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA: add alert type roles
+        https://bugs.webkit.org/show_bug.cgi?id=31392
+
+        Test: platform/mac/accessibility/aria-alerts.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31386
+        Make Mac AuthenticationChallenge usable from cross-platform code
+
+        No change in behavior, so no tests.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        Don't store m_currentCFChallenge, which was only used for a single assertion. Unlike the
+        NSURLConnection case, CF challenge doesn't carry a sender with it, so the copy in web challenge
+        is identical.
+
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Added a setter to match the new
+        Mac interface. Previously, one had to create a new AuthenticationChallenge to replace client.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Fixed assertions after removal
+        of m_currentCFChallenge. Also, there is no need to set client now, as it's guaranteed to
+        be already set.
+
+        * platform/network/mac/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::m_sender): Explained the existence of this member to the
+        best of my understanding.
+        (WebCore::AuthenticationChallenge::m_nsChallenge): Renamed from m_macChallenge to prevent
+        confusion with "mac" and "web" challenges in ResourceHandleInternal.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCoreAuthenticationClientAsChallengeSender): Added a Obj-C wrapper for AuthenticationClient,
+        making it possible to use the latter with NSURLAuthenticationChallenge.
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge): Updated for m_macChallenge ->
+        m_nsChallenge renaming.
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Wrap the client in Obj-C and
+        set it as sender (or unset, if client is null).
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCoreResourceHandleAsDelegate) WebCoreResourceHandleAsDelegate no longer doubles as
+        authentication challenge sender.
+        (WebCore::ResourceHandle::~ResourceHandle): A navigation can happen underneath an
+        authentication sheet.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Form m_currentWebChallenge
+        using the new setAuthenticationClient() method.
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge): Fixed an incorrect assertion.
+        Since didCancelAuthenticationChallenge is called by connection, the passed challenge is
+        the original Mac one, not the one we created for use with authentication sheet. I don't
+        know when a connection would cancel authentication in practice, so I haven't tested this.
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoint sidebar entries should allow click over entire list item
+        https://bugs.webkit.org/show_bug.cgi?id=31411
+
+        No new tests; no new functionality, small usability change. 
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.breakpointClicked):
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoints in named evals are not restored after a reload
+        https://bugs.webkit.org/show_bug.cgi?id=31375
+
+        Manual test added
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        * manual-tests/inspector/bp-in-named-eval-after-reload.html: Added.
+
+2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Custom printing shrink factors
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        This reverts commit r49769. The public API for this needs to be reviewed
+        before its inclusion in Qt.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Resource errors/warnings not shown in the Resource tree.
+
+        Error/Warning bubbles are not displayed next to the resource in the 
+        Resources panel if those occur before the resource is attached to the tree.
+        https://bugs.webkit.org/show_bug.cgi?id=31404
+
+        Test: manual-tests/inspector/styled-error-bubbles-in-scripts.html
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Follow-up of r50726, don't block the UI thread when calling
+        gst_element_get_state(). Also fixed a compilation warning and some
+        static casts.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::playbackPosition):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setRate):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        don't pause pipeline if already paused, same for play()
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+
+2009-11-12  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by David Levin.
+
+        Support Gtk scrollwheel behavior for horizontal scrollbars on Linux
+        Chromium too.
+        https://bugs.webkit.org/show_bug.cgi?id=31292
+
+        No new tests. (Corresponding test for Gtk+ is
+        platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html)
+
+        * page/EventHandler.cpp:
+        * page/chromium/EventHandlerChromium.cpp:
+
+2009-11-12  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent text inside a multi-column block from being split into columns.
+        
+        If the tentative height of a multi-column block was too small, we need to
+        expand the block height and try to layout again, in order to prevent text
+        from being split into different columns.
+
+        CSS Multicolumn text is split awkwardly
+        https://bugs.webkit.org/show_bug.cgi?id=22249
+
+        Test: fast/multicol/single-line.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutColumns):
+        * rendering/RenderBlock.h:
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::setTruncatedAt):
+        (WebCore::RenderView::setMinimumColumnHeight):
+        (WebCore::RenderView::minimumColumnHeight):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that RenderFileUploadControl isn't initialized with multiple files.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        Test: fast/forms/input-file-re-render.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing Chromium's POSIX VFS implementation, by adding the required
+        "used file descriptors" logic.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31275
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        need to implement aria tree roles
+        https://bugs.webkit.org/show_bug.cgi?id=31284
+
+        Tests: platform/mac/accessibility/aria-multiselectable.html
+               platform/mac/accessibility/aria-tree.html
+
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::ariaTreeRows):
+        (WebCore::AccessibilityObject::ariaTreeItemContent):
+        (WebCore::AccessibilityObject::ariaTreeItemDisclosedRows):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::isTree):
+        (WebCore::AccessibilityObject::isTreeItem):
+        (WebCore::AccessibilityObject::setIsExpanded):
+        (WebCore::AccessibilityObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityObject::hierarchicalLevel):
+        (WebCore::AccessibilityObject::setSelectedRows):
+        (WebCore::AccessibilityObject::performDefaultAction):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hierarchicalLevel):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::AccessibilityRenderObject::setElementAttributeValue):
+        (WebCore::AccessibilityRenderObject::elementAttributeValue):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::isSelected):
+        (WebCore::AccessibilityRenderObject::setSelected):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::createARIARoleMap):
+        (WebCore::AccessibilityRenderObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (RoleEntry::):
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix after @r50760 with ENABLE_FILTERS.
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply): Supply ColorSpace to fillRect.
+        * svg/graphics/filters/SVGFEFlood.cpp: Supply ColorSpace argument
+          to fillRect.
+
+2009-11-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix WebSocket frame parser of frame_type with high-order bit set.
+        https://bugs.webkit.org/show_bug.cgi?id=30668
+
+        If buffer is smaller than frame's length, it should break the loop
+        instead of reading next byte.
+
+        Tests: websocket/tests/frame-length-longer-than-buffer.html
+               websocket/tests/frame-length-skip.html
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-11-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] Remove t2embed.dll functions from FontCustomPlatformData.cpp for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=31345
+
+        Remove dependency on t2embed.dll so that Chromium for Windows can start even if t2embed.dll cannot be accessed.
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Remove TTDeleteEmbeddedFont() call. Always use RemoveFontMemResourceEx().
+        (WebCore::FontCustomPlatformData::fontPlatformData): Remove TTGetNewFontName() call.
+        (WebCore::createFontCustomPlatformData): Remove TTLoadEmbeddedFont() call. Always use AddFontMemResourceEx() via renameAndActivateFont() in opentype/OpenTypeUtility.h. Remove EOTStream class as well.
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Windows build fix. No review needed. 
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31382
+        Make -webkit-color-correction work with shadows
+
+        From canvas, just send DeviceColorSpace to setShadow() for now. 
+        Will fix soon when I address https://bugs.webkit.org/show_bug.cgi?id=31319
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow):
+        (WebCore::CanvasRenderingContext2D::applyShadow):
+
+        setShadow() and setPlatformShadow() now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setShadow):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::createCGColorWithColorSpace): New helper to create a 
+        color in a ColorSpace.
+        (WebCore::setCGFillColor): Call new helper.
+        (WebCore::setCGStrokeColor): Call new helper.
+        (WebCore::GraphicsContext::setPlatformShadow): Call new helper.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Send appropriate ColorSpace to setShadow().
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paintDecoration):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Attempt to keep ports building.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Print the file text of a file upload control in DumpRenderTree for ease of tests.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        (WebCore::RenderFileUploadControl::fileTextValue):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::isFileUploadControl):
+        (WebCore::toRenderFileUploadControl):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isFileUploadControl):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+
+2009-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM Wrappers for some nodes may not be marked.
+        https://bugs.webkit.org/show_bug.cgi?id=31380
+
+        Some markChildren methods are calling getCachedDOMNodeWrapper, which will find
+        the wrapper for the current world only.  This means that wrappers may be GC'ed
+        prematurely, and properties lost.
+
+        Move to a model more like markDOMObjectWrapper, mark wrappers for all worlds.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren):
+
+2009-11-11  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        bindings/js/ScriptObject.cpp is missing and ENABLE(INSPECTOR) guard.
+        https://bugs.webkit.org/show_bug.cgi?id=31384
+
+        No functionality change so no tests required.
+
+        * bindings/js/ScriptObject.cpp: Add ENABLE(INSPECTOR) guard around the JSInspectorBackend.h include.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The Big De-Inlining. 450k code size reduction (32-bit x86.)
+        - Various inline functions in V8Binding.h made non-inline.
+        - Some renaming for consistency.
+        - New function createRawTemplate().
+        https://bugs.webkit.org/show_bug.cgi?id=31383
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8DOMWrapperToNative):
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toInt32):
+        (WebCore::toWebCoreString):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::toAtomicWebCoreStringWithNullCheck):
+        (WebCore::toWebCoreStringWithNullOrUndefinedCheck):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::v8Boolean):
+        (WebCore::v8UndetectableString):
+        (WebCore::v8StringOrNull):
+        (WebCore::v8StringOrUndefined):
+        (WebCore::v8StringOrFalse):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8ExternalString):
+        (WebCore::createRawTemplate):  New function.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8DOMWrapperTo):
+        (WebCore::v8DOMWrapperToNode):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        More V8 de-inlining (outlining?) Abstracted a chunk of boilerplate code from every
+        event-listener setter into a new subroutine transferHiddenDependency().
+        https://bugs.webkit.org/show_bug.cgi?id=31377
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Replace boilerplate with call to transferHiddenDependency().
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::transferHiddenDependency):  New.
+        * bindings/v8/V8Utilities.h:  Declaration of transferHiddenDependency.
+
+2009-11-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        If we are on Windows, don't try and get the kCGColorSpaceSRGB ColorSpace,
+        because there is a CG bug preventing this from working.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that if Storage panel exists before calling its methods
+
+        https://bugs.webkit.org/show_bug.cgi?id=31343
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+        (WebInspector.addCookieDomain):
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        De-inline convertNodeToV8Object(), which expands to a lot of asm code and is inlined 136
+        times in the generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31368
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):  Moved body here from .h file
+        * bindings/v8/V8DOMWrapper.h:  Removed inline method body.
+
+2009-11-11  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Display the correct summary in the web inspector for the shorthands
+        border-color, border-width, border-style, margin, and padding.
+        https://bugs.webkit.org/show_bug.cgi?id=7987
+
+        Test: fast/css/shorthands-four-values.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::get4Values):
+        Display the summary information in the same way the shorthand would be
+        specified in a css rule.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make V8 bindings return NULL handles instead of calling v8::Undefined(). This has equivalent
+        meaning to the caller, saves code, and appears to save a few cycles at runtime too.
+        https://bugs.webkit.org/show_bug.cgi?id=31367
+
+        * bindings/scripts/CodeGeneratorV8.pm: Change "v8::Undefined()" to "v8::Handle<v8::Value>()"
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Optimize V8 getDOMNodeMap(), a hot function in Dromaeo DOM tests, by increasing inlining.
+
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::getCurrent):  Moved getCurrentMainThread to MainThreadDOMData::getCurrent
+            so it can be inlined by its caller.
+        * bindings/v8/DOMData.h:
+        * bindings/v8/MainThreadDOMData.cpp:
+        (WebCore::MainThreadDOMData::getCurrent):  Moved here from DOMData.cpp.
+        (WebCore::MainThreadDOMData::getMainThreadStore):  Added UNLIKELY macro to improve codegen.
+        (WebCore::MainThreadDOMData::getCurrentMainThreadStore):  Combination of getCurrentMainThread
+            and getStore, which inline both calls together.
+        * bindings/v8/MainThreadDOMData.h:
+        (WebCore::MainThreadDOMData::getStore):  Broke out nonvirtual getMainThreadStore for inlineability.
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):  Call new getCurrentMainThreadStore, which is faster.
+
+2009-11-11  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add methods to KURLGoogle.cpp declared in http://trac.webkit.org/changeset/50784 but not defined when using KURLGoogle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31357
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isSchemeFirstChar):
+        (WebCore::isSchemeChar):
+        (WebCore::KURL::hasPort):
+        (WebCore::KURL::removePort):
+        (WebCore::protocolIsValid):
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no reviewed.
+
+        Correct setPlatformFillColor and setPlatformStrokeColor calls
+        to match new ColorSpace-supporting signatures.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:  Add the
+          color space to the set[...]Color calls.
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31327
+        Clean up SocketStreamHandleClient interface
+
+        No change in behavior.
+
+        * platform/network/SocketStreamHandleClient.h: Removed willOpenStream and willSendData.
+        (WebCore::SocketStreamHandleClient::willOpenStream): Removed. This is currently not used by
+        the only client (WebSocketChannel), and it's not clear what this callback's semantics
+        should be.
+        (WebCore::SocketStreamHandleClient::willSendData): Ditto.
+        (WebCore::SocketStreamHandleClient::receivedCancellation): Removed, because it was misplaced.
+        For ResourceHandle, this method is called when the user cancels authentication sheet,
+        not when something happens with the stream.
+
+        * websockets/WebSocketChannel.h: Some WebSocketChannel methods were virtual without any
+        reason. Also, added didReceiveAuthenticationChallenge/didCancelAuthenticationChallenge.
+
+        * websockets/WebSocketChannel.cpp: Adjusted for the above change. Authentication-related
+        callbacks have no real implementation yet.
+
+2009-11-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the part of page directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31350
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class DragController         - instantiated at: WebCore/page/Page.cpp:107
+        class FocusController        - instantiated at: WebCore/page/Page.cpp:109
+        class Settings               - instantiated at: WebCore/page/Page.cpp:116
+        class PluginHalter           - instantiated at: WebCore/page/Page.cpp:160
+        struct ScheduledEvent        - instantiated at: WebCore/page/FrameView.cpp:1275
+        class UserScript             - instantiated at: WebCore/page/PageGroup.cpp:208
+        struct EventHandlerDragState - instantiated at: WebCore/page/EventHandler.cpp:182
+        class XSSAuditor             - instantiated at: WebCore/bindings/js/ScriptController.cpp:70
+        class UserStyleSheet         - instantiated at: WebCore/page/PageGroup.cpp:222
+
+        Inherits PropertyWrapperBase class from Noncopyable because (its child class) 
+        PropertyWrapper is instantiated by 'new' in 
+        WebCore/page/animation/AnimationBase.cpp:564 it is no need to be copyable.
+
+        * page/DragController.h:
+        * page/EventHandler.h:
+        * page/FocusController.h:
+        * page/FrameView.cpp:
+        * page/PluginHalter.h:
+        * page/Settings.h:
+        * page/UserScript.h:
+        * page/UserStyleSheet.h:
+        * page/XSSAuditor.h:
+        * page/animation/AnimationBase.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31323
+        Fix a few compiler warnings
+
+        No new tests as there is no new functionality.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Use explicit
+        parentheses to silence gcc 4.4 -Wparentheses warnings
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Set m_hasPendingGeometryChange to true by default, so that
+        at least one call to NPP_SetWindow is executed, which is
+        needed by the DRT plugin testing framework.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2009-11-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31348
+        [Qt] Remove unnecessary LUT creator from WebCore.pro
+
+        * WebCore.pro:
+
+2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Introduce a function for querying the input method status
+        in QWebPageClient.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-11  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Black artifacts in youtube.com/html5
+
+        Paint the video to the given size. It's the job of the callers to keep
+        track of aspect ratio. RenderVideo.cpp does it for the <video>
+        element.
+        https://bugs.webkit.org/show_bug.cgi?id=30925
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-11-11  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Cleaned up some missed capitalization style-guideline violations.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Make the default style background color valid.
+        Currently the color is transparent but invalid, this causes
+        list boxes in QtWebKit to be drawn with a black background
+        since r49242.
+        https://bugs.webkit.org/show_bug.cgi?id=31295
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialBackgroundColor):
+        * rendering/style/StyleBackgroundData.cpp:
+        (WebCore::StyleBackgroundData::StyleBackgroundData):
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Simplify the ownership model for worlds - rather than having a pair of weak references
+        between DOMWrapperWorld and ScriptController/ScriptCachedFrameData, give the latter an
+        ref pointer to the former.  This reduces complexity & cost of the caching entries in the
+        back forward cache.
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::forgetDocument):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        rename counter to makeCounterNode in RenderCounter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=31289
+
+        No new test because this is just a small refactoring.
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        (WebCore::makeCounterNode):
+        (WebCore::RenderCounter::originalText):
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 2 of 2.
+
+        Removed method EventHandler::dragSourceMovedTo, since it is no longer
+        needed. This method fired a drag event whenever the mouse moved, but
+        section 7.9.4 of the HTML 5 spec. defines the drag-and-drop processing
+        model independent of when the mouse moves. See "Among other changes..."
+        in the change log for patch 1 for more details.
+
+        * WebCore.DragSupport.exp:
+        * page/EventHandler.cpp: Removed method EventHandler::dragSourceMovedTo.
+        (WebCore::EventHandler::handleDrag): Updated comment about reentrancy issue.
+        * page/EventHandler.h:
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 1 of 2.
+
+        As per Section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>,
+        the drag event should always fire before the dragover event.
+
+        In fixing this bug, this patch also makes our drag processing model
+        conform to the HTML 5 spec.
+
+        Among the changes, this patch ensures that the drag event isn't fired outside
+        of the drag-and-drop processing loop, WebCore::EventHandler::updateDragAndDrop.
+        Currently, the drag event is fired whenever the mouse button is down and the OS
+        detects the mouse moved. But, as per the spec, the drag event should
+        fire approx. every 350ms so long as the mouse button is down.
+
+        Test: fast/events/drag-and-drop-fire-drag-dragover.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::canHandleDragAndDropForTarget): Formerly named handleDragAndDropForTarget.
+        Modified to determine when we are in the correct instance of EventHandler to service the drag
+        and drop operation.
+        (WebCore::EventHandler::updateDragAndDrop): Moved code from WebCore::EventHandler::dragSourceMovedTo
+        into this method.
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        (WebCore::EventHandler::clearDragState):
+        * page/EventHandler.h: Added field m_shouldOnlyFireDragOverEvent to determine whether
+        we should fire both drag and dragover events or only the dragover event.
+
+2009-11-10  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix crash in V8CustomXPathNSResolver (http://crbug.com/26726).
+        https://bugs.webkit.org/show_bug.cgi?id=31301
+
+        Tested by new fast/xpath/xpath-detached-iframe-resolver-crash.html.
+
+        Allowed passing V8Proxy for the calling JS context:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::create):
+        (WebCore::V8CustomXPathNSResolver::V8CustomXPathNSResolver):
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8CustomXPathNSResolver.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement URL decomposition IDL attributes for HTMLAnchorElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29972.
+
+        Add methods for setting different parts of the URL in href attribute.
+
+        Tests: fast/dom/HTMLAnchorElement/set-href-attribute-hash.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-hostname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-pathname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-port.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-protocol.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-search.html
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setPort):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::parsePortFromStringPosition):
+        (WebCore::HTMLAnchorElement::setHash):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setHostname):
+        (WebCore::HTMLAnchorElement::setPathname):
+        (WebCore::HTMLAnchorElement::setPort):
+        (WebCore::HTMLAnchorElement::setProtocol):
+        (WebCore::HTMLAnchorElement::setSearch):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAnchorElement.idl:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconURL):
+        * platform/KURL.cpp:
+        (WebCore::KURL::removePort):
+        (WebCore::KURL::setPort):
+        (WebCore::KURL::prettyURL):
+        (WebCore::protocolIsValid):
+        * platform/KURL.h:
+        (WebCore::KURL::canSetHostOrPort):
+        (WebCore::KURL::canSetPathname):
+        (WebCore::KURL::hasPort):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-10  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50760.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::paintBorder):
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider):
+        (WebCore::paintMediaVolumeSlider):
+        (WebCore::paintMediaTimelineContainer):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+
+2009-11-10  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Repro crash saving pcmag.com article as a webarchive.
+        <rdar://problem/7381219> and https://webkit.org/b/31322
+
+        Test: http/tests/webarchive/cross-origin-stylesheet-crash.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Walk the stylesheet itself instead
+          of creating a CSSRuleList (and subjecting ourselves to the security origin check)
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempt 2 to fix Tiger build. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::deviceRGBColorSpaceRef):
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Changes needed after r50760.
+
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Qt build fix.
+
+        * platform/network/ResourceHandle.h: Only inherit from AuthenticationClient on platforms
+        that use ResourceHandle as a delegate (Mac, CFNetwork, Curl).
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Tiger build fix. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31312
+        Decouple authentication panel callbacks from ResourceHandle
+
+        No change in functionality.
+
+        SocketStreamHandle also needs to request credentials, so it's not appropriate to store
+        ResourceHandle as delegate.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/AuthenticationClient.h: Added.
+        Added a new interface for listening to authentication panel notifications.
+
+        * WebCore.xcodeproj/project.pbxproj: Added AuthenticationClient.h. Let Visual Studio do what
+        it wants with the project file.
+
+        (WebCore::AuthenticationClient::ref): Using our usual method of exposing refcounting on an
+        interface class.
+        (WebCore::AuthenticationClient::deref): Ditto.
+
+        * platform/network/ResourceHandle.h:
+        (WebCore::ResourceHandle::refAuthenticationClient): Ditto.
+        (WebCore::ResourceHandle::derefAuthenticationClient): Ditto.
+
+        * platform/network/cf/AuthenticationCF.cpp:
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge):
+        (WebCore::AuthenticationChallenge::platformCompare):
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/chromium/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/curl/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        Keeping a reference to AuthenticationClient, not to ResourceHandle.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+       Second attempted gtk build fix. No review needed.
+
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix back/forwards cache with JSC isolated worlds.
+        https://bugs.webkit.org/show_bug.cgi?id=31310
+        <rdar://problem/7328111> Cached back navigation doesn't restore global object in extension isolated world
+
+        Store the global object for all worlds, not just the normal world.
+        Also maintain bidirectional weak references between the ScriptCachedFrameData and the DOMWrapperWorld,
+        so we can forget global objects if a world goes away.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::rememberScriptCachedFrameData):
+        (WebCore::DOMWrapperWorld::forgetScriptCachedFrameData):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::forgetWorld):
+        (WebCore::ScriptCachedFrameData::domWindow):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r50760.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempted build fix. (No review needed.)
+
+        * GNUmakefile.am: Adding ColorSpace.h
+
+2009-11-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by NOBODY - Build Fix.
+
+        Updated function calls to take a ColorSpace argument, passing
+        in DeviceColorSpace for now - this should be fixed. Also added
+        ColorSpace.h to WebCore project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+        * platform/win/WebCoreTextRenderer.cpp:
+        (WebCore::doDrawTextAtPoint):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-11-10  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimizations to Element::getAttribute
+        https://bugs.webkit.org/show_bug.cgi?id=30926
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):  User case-insensitive compare instead of lowercasing the name.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem):  Avoid redundant compares, and do fast/likely compares first.
+        * platform/text/PlatformString.h:
+        (WebCore::equalPossiblyIgnoringCase):  New inline method, used by both of the above.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7059710> 
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=31196 Implement -webkit-
+        color-correction for CSS colors
+
+        New exported symbol for GraphicsContext::fillColor() which now 
+        accepts a ColorSpace as an optional parameter.
+        * WebCore.base.exp:
+
+        Added a new file, ColorSpace.h, to define the ColorSpace enum.
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Computed Style for -webkit-color-correction
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Parse -webkit-color-correction
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+       Map CSS identifiers to the appropriate values of the ColorSpace enum
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ColorSpace):
+
+        New property -webkit-color-correction
+        * css/CSSPropertyNames.in:
+
+        Map -webkit-color-correction into the RenderStyle.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add new value sRGB.
+        * css/CSSValueKeywords.in:
+
+        Comment out the reference to sRGB since it will now be inherited as 
+        a value from CSSValueKeywords.
+        * css/SVGCSSValueKeywords.in:
+
+        Definition of the ColorSpace enum.
+        * platform/graphics/ColorSpace.h: Added.
+        (WebCore::):
+
+        These functions all now take a ColorSpace as a parameter.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::drawHighlightForText):
+
+        Return the appropriate ColorSpace.
+        (WebCore::GraphicsContext::strokeColorSpace):
+        (WebCore::GraphicsContext::fillColorSpace):
+
+        These functions all call other functions which require a ColorSpace 
+        as a parameter.
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+
+        All of the GraphicsContext functions that take a Color should now 
+        also take a ColorSpace.
+        * platform/graphics/GraphicsContext.h:
+
+        Added new member variables stokeColorSpace and fillColorSpace.
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+
+        Attempt to keep the Cairo port building with all of the massive 
+        changes to GraphicsContext.        
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef): New static function that returns a 
+        CGColorSpaceRef for the sRGB color space.
+        (WebCore::deviceRGBColorSpaceRef): New static function that returns 
+        a CGColorSpaceRef for the device RGB color space.
+
+        (WebCore::setCGFillColor): Now takes a ColorSpace parameter and 
+        sets the fill color to the specified color in the given ColorSpace.
+        (WebCore::setCGStrokeColor): Same, but for stroke.
+
+        (WebCore::setCGFillColorSpace): New static to set the 
+        CGFillColorSpace to the given ColorSpace
+        (WebCore::setCGStrokeColorSpace): Same, but for stroke.
+
+        Send ColorSpaces when appropriate, set ColorSpaces when 
+        appropriate, and check ColorSpaces when appropriate.
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Haiku building.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep QT building.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Wince building.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Attempt to keep WX building.
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Added functions colorSpace() and setColorSpace()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::colorSpace):
+        (WebCore::InheritedFlags::setColorSpace):
+
+        The ColorSpace is stored here.
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+        All of these call sites call GraphicsContext functions which now 
+        require ColorSpaces.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::paintCaret):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * inspector/InspectorController.cpp:
+        (WebCore::drawOutlinedQuad):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::paintScrollCorner):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paintScrollCorner):
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::updateGraphicsContext):
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillHorizontalSelectionGap):
+        (WebCore::RenderBlock::fillVerticalSelectionGap):
+        (WebCore::RenderBlock::fillLeftSelectionGap):
+        (WebCore::RenderBlock::fillRightSelectionGap):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::drawArcForBoxSide):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::paintScrollCorner):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::paintBoxDecorations):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintSelection):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+
+2009-11-10  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Speed up syntax highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=31291
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine): Replace the line content node.
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+
+2009-11-09  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove session storage setting
+        https://bugs.webkit.org/show_bug.cgi?id=31279
+
+        Remove session storage from Settings.  It was added temporarily so we could
+        disable it by default at runtime in Chromium.  We now disable these things in a
+        different way, so it's time to remove it.  Qt also depended on this setting for
+        a short period of time, but after talking to them we agreed that it should be
+        removed.
+
+        This bug is the second half of https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Carlson and Darin Adler.
+
+        WebCore part of making full-screen video pause during scrubbing.
+
+        * WebCore.Video.exp: Sorted and added HTMLMediaElement::beginScrubbing()
+        and HTMLMediaElement::endScrubbing().
+
+2009-11-10  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reapply 50562 reverted by 50588 due to issues with sandboxing (should be fine now).
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        WebKit coding style fixes.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::mimeTypeCache):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Remove build failure introduced by earlier build fix.
+
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Is this the last build fix? grep tells me yes.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Hopefully the last one.  Why aren't these autogenerated?
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Another chrome build fix.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Yet another chrome buildfix
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Chrome build fix.
+
+        * bindings/v8/V8Index.h:
+
+2009-11-10  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Removal of various and sundry style-violating nits.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Fix playback rate setter by remembering the rate was changed. Also
+        correctly handle reverse playback by doing a seek from end to
+        beginning of the media.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename 3D Canvas related classes to use WebGL prefix
+        https://bugs.webkit.org/show_bug.cgi?id=29095
+
+        Automatic rename of all WebGL related types from Canvas* to
+        WebGL* per more recent version of the WebGL spec.
+
+        Due to the automatic rename I've removed the 600+ line change list.
+
+2009-11-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feDisplacementMap is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=31255]
+
+        This is the implementation of the SVG filter effect
+        feDisplacementMap. 
+
+        Test: svg/filters/feDisplacementMap.svg
+
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+
+2009-11-09  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a comment about null strings and hash functions.
+        https://bugs.webkit.org/show_bug.cgi?id=29118
+
+        * platform/text/StringHash.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Compiler warnings in InspectorResource.h
+        https://bugs.webkit.org/show_bug.cgi?id=29231
+
+        Fix compilation warnings by removing addition operation on an enum type.
+
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::):
+        (WebCore::InspectorResource::Changes::hasChange):
+        (WebCore::InspectorResource::Changes::set):
+        (WebCore::InspectorResource::Changes::setAll):
+
+2009-11-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        <rdar://problem/7328395>
+        https://bugs.webkit.org/show_bug.cgi?id=31277
+
+        When an object tag's style changes (for example when child nodes are added/removed),
+        reuse its Frame (if it has one) instead of creating multiple Frames.
+
+        Test: fast/dom/HTMLObjectElement/children-changed.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved macro MMP_RULES (LINKEROPTION) into symbian instead of symbian-sbsv2,
+        since adjustment of RW-section base address will be needed for all new symbian
+        tool chains, specifically for arm and gcc compilation targets.
+        Also, change target address to 0xE00000 to be sufficient for all targets.
+
+        * WebCore.pro:
+
+2009-11-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash when inspecting
+        WebCore\manual-tests\inspector\dom-mutation.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=31259
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Few classes have virtual functions but non-virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=31269
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient::~QWebPageClient): Add virtual destructor.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Allow setting HTTP headers with empty value in XMLHTTPRequest
+        https://bugs.webkit.org/show_bug.cgi?id=31140
+
+        QtNetwork interprets null string as request to remove the header, not add it.
+        Replace null values with empty values before passing them to QtNetwork.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
+
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-09  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Fix handling of alpha channel when using wxWidgets 2.9: it was
+        simply ignored before resulting in transparent areas being black in PNG
+        images for example.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30823
+
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        No new tests as there is no functional change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyleSelector):
+        * editing/TextIterator.cpp:
+        (WebCore::pushFullyClippedState):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::parseNumberValueAndUnit):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+
+2009-11-09  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Clip graphics context to reduce calculation.
+
+        No new tests because this change only affects performance.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+
+2009-11-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        showTree(CounterNode*) generates too little info and has too many spaces.
+        https://bugs.webkit.org/show_bug.cgi?id=31212
+
+        No new tests as the change has no functional effect it is just for
+        improved debugging.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        Changed to also show addresses of parent, next and previous
+        siblings.
+
+2009-11-09  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Moves Mac implementation of setUseSecureKeyboardEntry to Frame.cpp and
+        enables it PLATFORM(CHROMIUM) in addition to PLATFORM(MAC).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31083
+
+        No new tests; implementation is unchanged.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setUseSecureKeyboardEntry):
+        * page/mac/FrameMac.mm:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Make XP_UNIX tests consistent
+        https://bugs.webkit.org/show_bug.cgi?id=31250
+
+        No new tests as there is no functional change.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Test if XP_UNIX is defined
+        instead of the value of the macro
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Test if the XP_UNIX is
+        defined instead of using the PLATFORM macro to be consistent
+        (WebCore::PluginView::getValue): Ditto.
+
+2009-11-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Thunk to the main thread from ~Database to deref Database's m_document.
+
+        If the Database was the Document's last referrer, then ~Document occurs on the
+        Database thread, and ASSERT(!m_styleRecalcTimer.isActive()) hits a main thread
+        ASSERT in debug builds.
+
+        * storage/Database.cpp:
+        (WebCore::derefDocument):
+        (WebCore::Database::~Database):
+
+2009-11-09  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Track "can have scrollbar" state within FrameView independently of the
+        individual scrollbar states in ScrollView.
+
+        rdar://problem/7215132, https://bugs.webkit.org/show_bug.cgi?id=29167
+        REGRESSION (r48064): mint.com loses scrollbars after coming out of
+        edit mode.
+
+        rdar://problem/7314421, https://bugs.webkit.org/show_bug.cgi?id=30517
+        REGRESSION (r48064): Extra scroll bars in GarageBand Lesson Store.
+
+        Test: fast/overflow/scrollbar-restored.html
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::setCanHaveScrollbars):
+        (WebCore::FrameView::updateCanHaveScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+2009-11-09  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: CSS syntax highlighter doesn't recognize negative numbers
+        https://bugs.webkit.org/show_bug.cgi?id=31257
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Debugger shortcuts (F8, F10, F11) have no effect if the Console view is open
+        https://bugs.webkit.org/show_bug.cgi?id=31252
+
+        Route F1-F12 keypresses in the Console view to the current panel if there is one.
+
+        Test: manual-tests/inspector/debugger-shortcuts-with-console-opened.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/utilities.js:
+        ():
+        * manual-tests/inspector/debugger-shortcuts-with-console-opened.html: Added.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Pass credentials provided by XMLHTTPRequest to the network request.
+        https://bugs.webkit.org/show_bug.cgi?id=31208
+
+        After r42483, the credentials are no longer passed to the network request
+        in the URL of the request.
+        Pass the credentials from XMLHTTPRequest to the network request, the same
+        way that other ports do.
+
+        After this patch LayoutTests/http/xmlhttprequest/basic-auth.html passes.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Unreviewed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Roll back r50657 because it breaks the MAC builds.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class IconDatabaseClient - WebCore/loader/icon/IconDatabase.cpp:89
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=31163
+
+        Inherits DocLoader class from Noncopyable because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:370 and 
+        it is no need to be copyable.
+
+        * loader/DocLoader.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's Tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=31162
+
+        Inherits Tokenizer class from Noncopyable because (its child class)
+        ImageTokenizer instantiated by 'new' in WebCore/loader/ImageDocument.cpp:178 
+        and it is no need to be copyable.
+
+        * dom/Tokenizer.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DeleteButtonController
+        https://bugs.webkit.org/show_bug.cgi?id=31105
+
+        Inherits DeleteButtonController class from Noncopyable because it is 
+        instantiated by 'new' in WebCore/editing/Editor.cpp:919 and
+        it is no need to be copyable.  
+
+        * editing/DeleteButtonController.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Expose Page::tabKeyCyclesThroughElements in the API
+        https://bugs.webkit.org/show_bug.cgi?id=30482
+
+        Expose Page::tabKeyCyclesThroughElements as a property of
+        WebKitWebView.
+
+        No new tests; fast/events/keypress-insert-tab.html is no longer skipped.
+
+        * platform/gtk/KeyEventGtk.cpp: Correct m_text for tab key presses.
+        (WebCore::singleCharacterString):
+
+2009-11-09  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Fix a crasher that occurred with text which included newline
+        chars in the markup.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (convertUniCharToUTF8):
+
+2009-11-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] The XML tokenizer reports a parse error twice if it occurs before the document element is found.
+        https://bugs.webkit.org/show_bug.cgi?id=31144
+
+        XMLTokenizer::doEnd() uses an additional logic to report a parse failure in
+        documents that end prematurely but are not considered invalid by QXmlStream.
+        This is to stay compatible with the libxml2 implementation.
+        However, that code path would be also hit in situations when it should not,
+        i.e. the error would have already been caught and handled. As a result, the
+        same error would be reported twice.
+
+        No new tests, because the problem is already covered by
+        fast/parser/xml-declaration-missing-ending-mark.html.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+
+2009-11-08  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector should support copy() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=31238
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyText): Added.
+        * inspector/InspectorBackend.h: Added copyText
+        * inspector/InspectorBackend.idl: Added copyText
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._copy): Added.
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-08  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 WorkerContextExecutionProxy does not handle SharedWorkers
+        https://bugs.webkit.org/show_bug.cgi?id=31226
+
+        Now checks to see what type of context is active and creates the
+        appropriate wrapper (DEDICATEDWORKERCONTEXT vs SHAREDWORKERCONTEXT).
+
+        Added support for converting to SharedWorkers and SharedWorkerContexts.
+
+        Test: Existing layout tests cover this case (start passing in Chrome).
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        Now generates the right type of DOMWrapper for SharedWorkerContexts.
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        Added support for SHAREDWORKERCONTEXT.
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        Added support for SharedWorker and SharedWorkerContext.
+
+2009-11-08  Johnny Ding  <johnnyding.webkit@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31224
+        [V8] Return StyleSheet object instead of HTMLStyleElement w/document.styleSheets named property getter.
+
+        Test: fast/dom/StyleSheet/get-stylesheet-byname.html
+
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: "Search again" on scripts panel switches
+        to the script this search started with.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31243
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.jumpToNextSearchResult):
+
+2009-11-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Simplify Icon interface.
+        https://bugs.webkit.org/show_bug.cgi?id=31154
+
+        - Remove Icon::createIconForFile().  createIconForFiles() covers
+          createIconForFile()'s role.
+        - Remove FileChooser::chooseIcon()
+        - Change the parameter types of FileChooser constructor and the
+          factory method, String -> const Vector<String>&, in order to
+          support initialization with multiple files.
+        - Remove the icon loading code in IconChromiumWin.cpp, which
+          doesn't work because of the sandbox.
+
+        No tests because it's just a refactoring.
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::create):
+        (WebCore::FileChooser::chooseFile):
+        (WebCore::FileChooser::chooseFiles):
+        * platform/FileChooser.h:
+        * platform/graphics/Icon.h:
+        * platform/graphics/chromium/IconChromiumLinux.cpp:
+        * platform/graphics/chromium/IconChromiumMac.cpp:
+        * platform/graphics/chromium/IconChromiumWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/gtk/IconGtk.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/haiku/IconHaiku.cpp:
+        * platform/graphics/mac/IconMac.mm:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/wx/IconWx.cpp:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31098
+
+        Allows same-origin plugin-based content to load.
+
+        Test: http/tests/security/xssAuditor/object-src-inject.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Modified to call XSSAuditor::isSameOriginResource.
+        (WebCore::XSSAuditor::canLoadObject): Ditto.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto. 
+        (WebCore::XSSAuditor::isSameOriginResource): Added.
+        * page/XSSAuditor.h:
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Changed this to not
+        use a date parser that needs ExecState passed.
+        
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        Build fix for https://bugs.webkit.org/show_bug.cgi?id=31219
+        Clean up GraphicsContext's current concept of ColorSpace
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] committing style edit
+        clears elements panel selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31242
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-11-08  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Holger Freyther.
+
+        ResourceRequest to be class instead of struct
+        https://bugs.webkit.org/show_bug.cgi?id=30670
+
+        Started as a compilation fix for Symbian where the compiler makes a distinction between
+        class and struct in function argument signatures.
+        Changed all forward declarations of ResourceRequest to have class in the forward
+        declaration instead of struct and changed the definition of ResourceRequest to be class
+        and added access qualifiers where missing. Additionally two references of friend
+        struct ResourceRequestBase changed to class instead.
+
+        * history/HistoryItem.h:
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.h:
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.h:
+        * loader/ResourceLoadNotifier.h:
+        * loader/SubresourceLoader.h:
+        * loader/SubresourceLoaderClient.h:
+        * loader/ThreadableLoader.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * platform/CrossThreadCopier.h:
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequest.h:
+        * platform/network/cf/ResourceRequestCFNet.h:
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/curl/ResourceRequest.h:
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/soup/ResourceRequest.h:
+        * xml/XMLHttpRequest.h:
+
+2009-11-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7363434> Crash inside RenderObject::localToAbsolute
+        below FrameView::layout
+        https://bugs.webkit.org/show_bug.cgi?id=31093
+
+        Test: fast/block/positioning/relative-positioned-inline-container.html
+
+        In <http://trac.webkit.org/changeset/19148>, setStaticY() was changed
+        to mark the object for layout, doing so without marking its ancestors.
+        However, RenderBlock::skipLeadingWhitespace and
+        RenderBlock::skipTrailingWhitespace() call setStaticY() on a relative-
+        positioned inline container, causing it to be marked for layout without
+        ever going back to give it layout, and thus layout could end with a
+        dirty object still in the tree, leading to all sorts of badness.
+
+        The fix is to revert setStaticY() to not marking the object dirty, and
+        instead do it in the call sites that require it, which are in
+        RenderBlock and RenderFlexibleBox.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::setStaticY):
+
+2009-11-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20780
+        
+        Fixes an issue where the onchange event handler is not fired when the 
+        input field is autocompleted.
+        
+        We cannot test this using DRT since DRT cannot emulate autocompletion.
+        So, a manual-test is included.
+
+        Tests: manual-tests/autocompletion-fire-onchange.html
+
+        * manual-tests/autocompletion-fire-onchange.html: Added.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-11-07  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Mark redrawn areas on image surfaces as dirty.
+
+        This is required to conform to the Cairo API, but is currently only
+        used by debugging tools like cairo-trace.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        (WebCore::putImageData):
+
+2009-11-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30878
+        [Gtk] atk_text_get_text() fails in entries when the end_offset is -1
+
+        If the end_offset is -1, use the String length as the end_offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_text):
+
+2009-11-06  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31219 Clean up 
+        GraphicsContext's current concept of ColorSpace
+
+        ColorSpace is now called ColorType. The variables on the state we 
+        appropriately re-named as well. I removed strokeColorSpace() and 
+        fillColorSpace() from GraphicsContext since they were never called. 
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::):
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::calculateDrawingMode):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-11-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31177>.
+        Web Inspector: Bind backspace to delete cookies and DOM Storage.
+        
+        Refactor editing code from DOMStorageDataGrid to DataGrid, so other
+        places in the inspector can use editing in DataGrid (added a FIXME for
+        some stuff that needs to be generalized).
+        
+        Also added deleting functionality to DataGrid, and implemented it for
+        Cookies and DOM Storage. The reason this patch is so big is because of
+        the refactoring of editing code, which won't be used yet in a cross-datagrid
+        way, but should be able to.
+        
+        Additionally, moved the callbacks members from DOMStorageDataGrid to
+        DOMStorageItemsView, which allowed us to delete DOMStorageDataGrid, to 
+        make the architecture of DOM Storage look a lot more like the Cookies view.
+        
+        Lastly, added a preventDefault call in ElementsTreeOutline to prevent the 
+        inspector from beeping at you when you delete an element.
+
+        * WebCore.gypi: Removed DOMStorageDataGrid.
+        * WebCore.vcproj/WebCore.vcproj: Removed DOMStorageDataGrid.
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMStorageDataGrid.js: Removed.
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._deleteButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._refreshButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._editingCallback):
+        (WebInspector.DOMStorageItemsView.prototype.deleteSelectedRow):
+        (WebInspector.DOMStorageItemsView.prototype._deleteCallback):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype._ondblclick): Moved from DOMStorageDataGrid to DataGrid + Refactoring.
+        (WebInspector.DataGrid.prototype._startEditingColumnOfDataGridNode): Ditto.
+        (WebInspector.DataGrid.prototype._startEditing): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted.moveToNextIfNeeded): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted): Ditto.
+        (WebInspector.DataGrid.prototype._editingCancelled): Ditto.
+        (WebInspector.DataGrid.prototype.handleKeyEvent): Added case for delete/backspace.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): Added preventDefault call.
+        * inspector/front-end/WebKit.qrc: Removed DOMStorageDataGrid.
+        * inspector/front-end/inspector.html: Removed DOMStorageDataGrid.
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added an ExecState parameter.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+
+        Updated for JavaScriptCore internal API change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue): Updated for namespace change.
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Pass 0 for ExecState, since we don't have one.
+        (This function probably shouldn't be using a JavaScript date parser
+        to begin with, but oh well.)
+
+2009-11-06  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        The associated webkit bug is https://bugs.webkit.org/show_bug.cgi?id=31067,
+        which affects Chromium only.
+        
+        Changes to V8HTMLDocumentCustom.cpp are as below:-
+        1. The HTMLDocumentOpen function would cause a crash in Chromium if
+           there was no calling javascript context. We now check for this case
+           and pass in NULL to the HTMLDocument::open function which can handle
+           a NULL document parameter.
+        2. The other functions like HTMLDocumentWrite, HTMLDocumentWriteln, etc
+           had ASSERTS for a NULL caller frame, which was bogus as it would crash
+           anyway. We now check for this case and return a failure.
+           
+        Changes to V8DOMWindowCustom.cpp are as below:-
+        1. Instead of failing the window.open call made by NPAPI for lack of a
+           calling javascript context, we now use the entered context as the calling
+           context.
+
+        Tests: plugins/document-open.html
+               plugins/window-open.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Geolocation error code UNKNOWN_ERROR is deprecated.
+        https://bugs.webkit.org/show_bug.cgi?id=31184
+
+        Remove this error code from PositionError, both for use from C++ code and from the JS object.
+
+        Updated fast/dom/Geolocation/error.html to test this.
+
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::): Remove ErrorCode::UNKNOWN_ERROR.
+        * page/PositionError.idl: Modified. Remove UNKNOWN_ERROR constant.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::startRequest): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::startUpdating): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+
+2009-11-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        The Implementation of feMorphology.
+        
+        Test: We have allready a test for feMorphology
+              svg/W3C-SVG-1.1/filters-morph-01-f.svg
+
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        V8DOMWindowCustom.cpp is missing WEB_SOCKETS guard on include.
+        https://bugs.webkit.org/show_bug.cgi?id=31209
+
+        Build fix only. No new tests possible.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Modified. Added WEB_SOCKETS guard on inclue of WebSockets.h.
+
+2009-11-06  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        V8 bindings do not support SharedWorkers as event targets
+        https://bugs.webkit.org/show_bug.cgi?id=31199
+
+        No new tests because existing layout tests suffice (they currently
+        crash on Chromium)
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        Added clause to create a DOM wrapper for SharedWorkers.
+
+2009-11-06  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not unnecessarly synchronzie in weak reference callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=31191
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject):
+
+2009-11-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix resource content search.
+        https://bugs.webkit.org/show_bug.cgi?id=31202
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-05  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix ASSERT(currentStyle = renderStyle()).
+        https://bugs.webkit.org/show_bug.cgi?id=31152
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid): We should have used "==" instead of "=".
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Revert 50562 because it broke Chromium. Not reviewed since this is a build fix and revert.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Cross-domain access to stylesheet text should not be allowed
+        https://bugs.webkit.org/show_bug.cgi?id=20527
+
+        Check whether whether the current document can read the cssRules from
+        the style sheet.  Firefox throws a security error here, but we return
+        null instead because that's what we usually do in these cases.
+
+        Test: http/tests/security/cannot-read-cssrules-redirect.html
+              http/tests/security/cannot-read-cssrules.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::cssRules):
+
+2009-11-05  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        If the Geolocation service fails to start, invoke the error callback asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=28276
+
+        All Geolocation callbacks must be invoked asynchronously.
+        See http://www.w3.org/TR/geolocation-API/#geolocation_interface
+
+        No new tests possible with current LayoutTestController.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::getCurrentPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::watchPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::startRequest): Modified. If the Geolocation service fails to start, set a fatal error on the notifier.
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/scripts/IDLStructure.pm:
+        * css/CSSInheritedValue.cpp:
+        * css/CSSInitialValue.cpp:
+        * css/CSSMediaRule.cpp:
+        * css/CSSNamespace.h:
+        * css/CSSProperty.cpp:
+        * css/CSSProperty.h:
+        * css/CSSRuleList.cpp:
+        * css/CSSRuleList.h:
+        * css/CSSSelector.h:
+        * css/CSSValueList.cpp:
+        * css/FontValue.cpp:
+        * css/MediaFeatureNames.cpp:
+        * css/MediaFeatureNames.h:
+        * css/Pair.h:
+        * css/SVGCSSStyleSelector.cpp:
+        * css/ShadowValue.cpp:
+        * css/StyleSheet.cpp:
+        * css/StyleSheetList.cpp:
+        * css/maketokenizer:
+        * dom/BeforeUnloadEvent.cpp:
+        * dom/BeforeUnloadEvent.h:
+        * dom/CSSMappedAttributeDeclaration.cpp:
+        * dom/EventNames.cpp:
+        * dom/EventTarget.cpp:
+        * dom/MappedAttributeEntry.h:
+        * dom/MouseRelatedEvent.h:
+        * dom/RangeException.h:
+        * dom/StyleElement.h:
+        * dom/Tokenizer.h:
+        * html/HTMLHeadElement.h:
+        * html/HTMLHeadingElement.cpp:
+        * html/HTMLHeadingElement.h:
+        * html/HTMLHtmlElement.h:
+        * html/HTMLImageLoader.h:
+        * html/HTMLMetaElement.h:
+        * html/HTMLModElement.cpp:
+        * html/HTMLModElement.h:
+        * html/HTMLOptionsCollection.cpp:
+        * html/HTMLPlugInElement.cpp:
+        * html/HTMLPreElement.cpp:
+        * html/HTMLPreElement.h:
+        * html/HTMLTableCellElement.cpp:
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        * html/HTMLTableColElement.h:
+        * html/HTMLTablePartElement.cpp:
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTitleElement.h:
+        * page/MouseEventWithHitTestResults.h:
+        * platform/StaticConstructors.h:
+        * platform/text/AtomicStringImpl.h:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * rendering/AutoTableLayout.h:
+        * rendering/CounterNode.cpp:
+        * rendering/EllipsisBox.cpp:
+        * rendering/EllipsisBox.h:
+        * rendering/FixedTableLayout.cpp:
+        * rendering/FixedTableLayout.h:
+        * rendering/HitTestRequest.h:
+        * rendering/HitTestResult.h:
+        * rendering/InlineRunBox.h:
+        * rendering/PointerEventsHitRules.cpp:
+        * rendering/PointerEventsHitRules.h:
+        * rendering/RenderBR.cpp:
+        * rendering/RenderBR.h:
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        * rendering/RenderFieldset.cpp:
+        * rendering/RenderFrameSet.cpp:
+        * rendering/RenderListItem.cpp:
+        * rendering/RenderTableRow.cpp:
+        * rendering/RenderView.h:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineTextBox.cpp:
+        * rendering/SVGInlineTextBox.h:
+        * rendering/TableLayout.h:
+        * rendering/break_lines.h:
+        * rendering/style/SVGRenderStyle.cpp:
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        * rendering/style/SVGRenderStyleDefs.h:
+        * svg/GradientAttributes.h:
+        * svg/LinearGradientAttributes.h:
+        * svg/PatternAttributes.h:
+        * svg/RadialGradientAttributes.h:
+        * svg/SVGAElement.cpp:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimateColorElement.cpp:
+        * svg/SVGAnimateColorElement.h:
+        * svg/SVGAnimateElement.cpp:
+        * svg/SVGAnimateElement.h:
+        * svg/SVGAnimateTransformElement.h:
+        * svg/SVGAnimatedPathData.cpp:
+        * svg/SVGAnimatedPathData.h:
+        * svg/SVGAnimatedPoints.cpp:
+        * svg/SVGAnimatedPoints.h:
+        * svg/SVGAnimationElement.cpp:
+        * svg/SVGCircleElement.cpp:
+        * svg/SVGClipPathElement.cpp:
+        * svg/SVGColor.cpp:
+        * svg/SVGColor.idl:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        * svg/SVGDefsElement.cpp:
+        * svg/SVGDescElement.cpp:
+        * svg/SVGDescElement.h:
+        * svg/SVGDocument.idl:
+        * svg/SVGElement.idl:
+        * svg/SVGElementInstanceList.cpp:
+        * svg/SVGElementInstanceList.h:
+        * svg/SVGEllipseElement.cpp:
+        * svg/SVGExternalResourcesRequired.cpp:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFuncAElement.cpp:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncBElement.cpp:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncGElement.cpp:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncRElement.cpp:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFEMergeElement.cpp:
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGGElement.cpp:
+        * svg/SVGGradientElement.cpp:
+        * svg/SVGHKernElement.idl:
+        * svg/SVGLangSpace.cpp:
+        * svg/SVGLangSpace.h:
+        * svg/SVGLength.cpp:
+        * svg/SVGLength.h:
+        * svg/SVGLength.idl:
+        * svg/SVGLengthList.cpp:
+        * svg/SVGLengthList.h:
+        * svg/SVGLineElement.cpp:
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGList.h:
+        * svg/SVGListTraits.h:
+        * svg/SVGLocatable.h:
+        * svg/SVGMaskElement.cpp:
+        * svg/SVGMatrix.idl:
+        * svg/SVGMetadataElement.cpp:
+        * svg/SVGMetadataElement.h:
+        * svg/SVGMetadataElement.idl:
+        * svg/SVGNumber.idl:
+        * svg/SVGNumberList.cpp:
+        * svg/SVGNumberList.h:
+        * svg/SVGPaint.cpp:
+        * svg/SVGPathElement.cpp:
+        * svg/SVGPathSeg.h:
+        * svg/SVGPathSegArc.cpp:
+        * svg/SVGPathSegArc.h:
+        * svg/SVGPathSegClosePath.cpp:
+        * svg/SVGPathSegClosePath.h:
+        * svg/SVGPathSegCurvetoCubic.cpp:
+        * svg/SVGPathSegCurvetoCubic.h:
+        * svg/SVGPathSegCurvetoCubicSmooth.cpp:
+        * svg/SVGPathSegCurvetoCubicSmooth.h:
+        * svg/SVGPathSegCurvetoQuadratic.cpp:
+        * svg/SVGPathSegCurvetoQuadratic.h:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.cpp:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.h:
+        * svg/SVGPathSegLineto.cpp:
+        * svg/SVGPathSegLineto.h:
+        * svg/SVGPathSegLinetoHorizontal.cpp:
+        * svg/SVGPathSegLinetoHorizontal.h:
+        * svg/SVGPathSegLinetoVertical.cpp:
+        * svg/SVGPathSegLinetoVertical.h:
+        * svg/SVGPathSegMoveto.cpp:
+        * svg/SVGPathSegMoveto.h:
+        * svg/SVGPatternElement.cpp:
+        * svg/SVGPoint.idl:
+        * svg/SVGPointList.cpp:
+        * svg/SVGPointList.h:
+        * svg/SVGPolyElement.cpp:
+        * svg/SVGPolygonElement.cpp:
+        * svg/SVGPolygonElement.h:
+        * svg/SVGPolylineElement.cpp:
+        * svg/SVGPolylineElement.h:
+        * svg/SVGPreserveAspectRatio.cpp:
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRect.idl:
+        * svg/SVGRectElement.cpp:
+        * svg/SVGRenderingIntent.h:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGSetElement.cpp:
+        * svg/SVGSetElement.h:
+        * svg/SVGStopElement.cpp:
+        * svg/SVGStringList.cpp:
+        * svg/SVGStringList.h:
+        * svg/SVGStylable.cpp:
+        * svg/SVGStylable.h:
+        * svg/SVGStyleElement.cpp:
+        * svg/SVGStyleElement.h:
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledLocatableElement.cpp:
+        * svg/SVGStyledLocatableElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        * svg/SVGSymbolElement.cpp:
+        * svg/SVGTRefElement.cpp:
+        * svg/SVGTSpanElement.cpp:
+        * svg/SVGTSpanElement.h:
+        * svg/SVGTests.h:
+        * svg/SVGTextElement.cpp:
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        * svg/SVGTextPositioningElement.cpp:
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTitleElement.cpp:
+        * svg/SVGTitleElement.h:
+        * svg/SVGTransform.cpp:
+        * svg/SVGTransform.h:
+        * svg/SVGTransform.idl:
+        * svg/SVGTransformList.cpp:
+        * svg/SVGTransformList.h:
+        * svg/SVGTransformable.h:
+        * svg/SVGURIReference.h:
+        * svg/SVGUnitTypes.h:
+        * svg/SVGUseElement.cpp:
+        * svg/SVGViewElement.cpp:
+        * svg/SVGZoomAndPan.cpp:
+        * svg/SVGZoomAndPan.h:
+        * svg/SVGZoomEvent.cpp:
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION Clean up security origin usage in DOM Storage.
+        https://bugs.webkit.org/show_bug.cgi?id=31188
+
+        Clean up security origin usage in DOM Storage.  This fixes a bug in my
+        refactoring here: https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Instead of having StorageAreaSync's constructor (which is called in the
+        constructor for StorageAreaImpl) calling a method on StoargeAreaImpl to get the
+        database identifier, simply have StorageAreaImpl pass the identifier into
+        StorageAreaSync.
+
+        No test because there's no change in externally observable behavior.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::create):
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need notification of scrolling frame
+        https://bugs.webkit.org/show_bug.cgi?id=31145
+
+        Adds FrameLoaderClient::didChangeScrollOffset that is called when
+        the frame scrolls. This will be used to know when history state
+        needs to be updated.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didChangeScrollOffset):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::valueChanged):
+
+2009-11-05  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Update bindings to use new API for external arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31181
+
+        No new tests; covered by existing WebGL tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/custom/V8CanvasArrayCustom.h:
+        (WebCore::constructCanvasArray):
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        50561 introduces a custom method for SVGMatrix, we need to implement
+        this in V8.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Adding definition for V8SVGMatrixMultiply.
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Implement V8SVGMatrixMultiply according to the same method in JSC.
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50569 since it broke QT.  Build fix and just a revert, so no review.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setSessionStorageEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::sessionStorageEnabled):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Web Inspector doesn't show CSS rules properly for iframes
+
+        https://bugs.webkit.org/show_bug.cgi?id=30884
+
+        Test: inspector/styles-iframe.html
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getStyles):
+        (InjectedScript.getComputedStyle):
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        (WebInspector.evaluateForTestInFrontend.invokeMethod):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-11-05  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Geoffrey Garen and Dimitri Glazkov.
+
+        Rehashing of EventListenerMap leads to loss of EvenListenerList.
+        https://bugs.webkit.org/show_bug.cgi?id=31027
+
+        Tested by new fast/events/event-listener-map-rehash-crash.html.
+
+        EventListenerMap modified to store pointers to listener vectors:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTargetData::~EventTargetData):
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+
+        Usages updated after interface changes:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree):
+
+2009-11-05  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Add missing initialization for m_createdByParser.
+        https://bugs.webkit.org/show_bug.cgi?id=31089
+
+        Test: fast/dom/beforeload/pi-before-load.xhtml in Valgrind
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::ProcessingInstruction):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 2/2.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Bug 31108 - [V8] REGRESSION: Pause on exception is broken
+        https://bugs.webkit.org/show_bug.cgi?id=31108
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        We should not bubble up events if we drag something to an iframe that
+        has an invalid source.
+        https://bugs.webkit.org/show_bug.cgi?id=30469
+
+        Test: http/tests/misc/bubble-drag-events.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDragAndDropForTarget):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        * page/EventHandler.h:
+        (WebCore::EventHandler::):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: speed up Timelines Clear by a factor of thousands.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31160
+
+        * inspector/front-end/utilities.js:
+        (Element.prototype.removeChildren):
+
+2009-11-05  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If high memory usage is detected, hint to V8 that it might be due
+        to external objects retained by V8 objects.
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GetMemoryUsageInMB):
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Jeff Schiller  <codedread@gmail.com>
+
+        Reviewed by Simon Fraser.
+
+        Correct order of matrix multiplication for SVGMatrix.
+        https://bugs.webkit.org/show_bug.cgi?id=16062
+
+        Test: svg/dom/SVGMatrix-interface.xhtml
+
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::multiply):
+        * svg/SVGMatrix.idl:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make resource-related records in timeline
+        actually take some time.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31139
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        This is a re-submit of 50519.  LocalStorageTask should have never been ref
+        counted.  I've removed that and switched a PassRefPtr over to a PassOwnPtr.
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Calling databaseIdentifier on LocalStorage's background thread is not safe.
+        https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Calling SecurityOrigin::databaseIdentifier on LocalStorage's background thread
+        is not safe.  databaseIdentifier does a bunch of string concatenation which
+        ref-counts StringImpls in some cases.  This was caught by valgrind thread
+        sanitizer: http://code.google.com/p/chromium/issues/detail?id=25645
+
+        There's no way to test for such racyness, unfortunately.
+
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::fullDatabaseFilename):
+        * storage/StorageSyncManager.h:
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Clean up StorageAreaSync
+        https://bugs.webkit.org/show_bug.cgi?id=31100
+
+        Major fixes: Break the ref count cycle for StorageArea on the main
+        thread, not the background thread since the latter is not safe.
+        Length() needs to block on the import completing.
+
+        Small fixes: setItem needs to handle the copy on write case even if it
+        has an exception.  setItem and removeItem should just bail from the
+        the function if the value hasn't changed rather than wrapping the end
+        in an if block.  Clear should only send an event if it wasn't already
+        cleared.  StorageAreaSync should assert that the final sync was
+        scheduled.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::length):
+          Forgot to block on the import.
+        (WebCore::StorageAreaImpl::key):
+        (WebCore::StorageAreaImpl::setItem):
+          Handle the copy on write case even when there's an exception.
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::performImport):
+        (WebCore::StorageAreaSync::markImported):
+        (WebCore::StorageAreaSync::blockUntilImportComplete):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResource
+        https://bugs.webkit.org/show_bug.cgi?id=31114
+
+        Inherits CachedResource class from Noncopyable because its (its child
+        class) CachedCSSStyleSheet instantiated by 'new' in WebCore/loader/Cache.cpp:75 
+        and it is no need to be copyable.
+
+        * loader/CachedResource.h:
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Separate the difference between HAVE(CGINTERPOLATION_MEDIUM), which
+        is true when building on 10.6 or later, and USE(CGINTERPOLATION_MEDIUM)
+        which is true when targeting 10.6 or later.
+
+        HAVE(CGINTERPOLATION_MEDIUM) indicates that kCGInterpolationMedium
+        is present in the CGInterpolationQuality enum, and must be handled
+        by a switch that has cases for each enumerated value.
+
+        USE(CGINTERPOLATION_MEDIUM) indicates that the product will only run
+        on 10.6 or later, and that CoreGraphics will understand when
+        InterpolationMedium is mapped to kCGInterpolationMedium at runtime.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+
+2009-11-04  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix buffer overrun in WebCore::Page::userStyleSheetLocationChanged()
+        https://bugs.webkit.org/show_bug.cgi?id=31138
+
+        Test: LayoutTests/platform/mac/fast/loader/user-stylesheet-fast-path.html in Valgrind
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-11-04  Timothy Hatcher  <timothy@apple.com>
+
+        Update the Web Inspector Timeline panel to better match the mock-up.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31150
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        * inspector/front-end/inspector.css:
+
+2009-11-05  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25439
+        Deleting when in front of a block image removes character from previous paragraph
+
+        Added editing/deleting/25439-{1,2,3}.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Block images, tables and HRs cannot 
+        be made inline with other content.  Instead of merging, just move the caret to just before 
+        the selection we deleted.
+        * editing/htmlediting.cpp:
+        (WebCore::firstInSpecialElement): Added a FIXME.  This function begins iterating up from pos.node(), which 
+        doesn't necessarily contain pos (suppose pos was [img, 0]).
+        (WebCore::lastInSpecialElement): Ditto.
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Moved from visible_units.cpp.  Added a check for non-inline images.
+        * editing/htmlediting.h:
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph): Use moved/renamed function.  Removed FIXME.  The problem causing 
+        5027702 is now squarely in first/lastInSpecialElement
+        (WebCore::endOfParagraph): Ditto.
+        
+2009-11-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Hang in Mail on attempting to change indent level.
+        <rdar://problem/7131805>
+        https://bugs.webkit.org/show_bug.cgi?id=31127
+
+        The hang was caused by an infinite loop inside outdentRegion.
+        The code did not account for the fact that, when a list item
+        contains multiple paragraphs, outdent moves all paragraphs at
+        once, invalidating some of the positions we keep track of in the loop.
+        Some code refactoring has also been done to minimize duplicated code.
+        
+        Test: editing/execCommand/outdent-multiparagraph-list.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Moved code in common with
+        outdentRegion to doApply.
+        (WebCore::IndentOutdentCommand::outdentRegion): Fixed endless loop.
+        (WebCore::IndentOutdentCommand::doApply): Some code refactoring.
+        * editing/IndentOutdentCommand.h: Added VisiblePosition parameters to
+        indentRegion and outdentRegion.
+
+2009-11-04  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider doesn't have a thumb
+        https://bugs.webkit.org/show_bug.cgi?id=31135
+
+        Fixed an incorrect if statement that prevents volume slider
+        being updated.
+
+        The statement checks if the slider value equals to the current
+        volume value of the media control to avoid updating the volume
+        slider. Updating the volume slider control shouldn't be within
+        this condition because we explicitly set them to be equals
+        during creation of the controls and also when mouse events are
+        received on the volume control.
+
+        No new tests because existing code breaks:
+        LayoutTests/media/video-volume-slider.html
+
+        It should now start passing on Chromium.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Update the volume slider regardless of the current volume value
+        of the media control.
+
+2009-11-04  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by David Levin.
+
+        Need to properly disable applicationCache at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30417
+
+        Adding applicationCacheEnabled bit to V8 RuntimeEnabledFeatures.
+
+        No new exposed functionality, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setApplicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::applicationCacheEnabled):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-11-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31143
+        Assertion failure in CredentialStorage::set() when proxy credentials are being set
+
+        No test, cannot test proxy behavior.
+
+        * platform/network/CredentialStorage.cpp: (WebCore::CredentialStorage::set): Account for the
+        possibility of null url. Release mode changes are likely inconsequential - e.g. we used to
+        add "://" to origin set, which is weird, but safe.
+
+2009-11-04  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Leftover Breakpoints in the Sidebar Pane
+        https://bugs.webkit.org/show_bug.cgi?id=30659
+
+        No new tests.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-11-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Use a different method to identify the webkit port in
+        InspectorBackent::platform().
+        This corrects the inspector expected behavior with Qt on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=31116
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::platform):
+        (WebCore::InspectorBackend::port):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/InspectorControllerStub.js:
+        (.WebInspector.InspectorControllerStub.prototype.port):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.toolbarDragStart):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Update Cairo requirement to 1.6.
+
+        Also remove all conditional code and workarounds for older versions of
+        Cairo.
+        In particular, gain image quality by removing the use of
+        CAIRO_FILTER_NEAREST when rendering images and use the default
+        bilinear filter instead.
+        https://bugs.webkit.org/show_bug.cgi?id=19266
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::boundingRect):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozWidget):
+
+2009-11-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Restore removed string conversion after cleanup.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Need to implement ARIA role="combobox"
+        https://bugs.webkit.org/show_bug.cgi?id=31096
+
+        Test: accessibility/aria-combobox.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isComboBox):
+        (WebCore::AccessibilityObject::isExpanded):
+        (WebCore::AccessibilityObject::expandObject):
+        (WebCore::AccessibilityObject::increment):
+        (WebCore::AccessibilityObject::decrement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::expandObject):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes naming inconsistencies in TimelineRecordFactory.
+        https://bugs.webkit.org/show_bug.cgi?id=31132
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadRecord):
+        (WebCore::TimelineRecordFactory::createEvaluateScriptRecord):
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+        (WebCore::TimelineRecordFactory::createPaintRecord):
+        * inspector/TimelineRecordFactory.h:
+
+2009-11-04  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Followon to bug 31080, which protects Timeline
+        instrumentation in the case where InspectorTimelineAgent
+        is enabled or disabled during an event dispatch.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31121
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::inspectorTimelineAgent):
+        (WebCore::DOMWindow::dispatchEvent):
+        * page/DOMWindow.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50519 while I work out what went wrong.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThreadStart):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add basic support for resource events and marks.
+        Couple of drive-by fixes. Enabling the panel!
+
+        https://bugs.webkit.org/show_bug.cgi?id=31130
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClicked):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Eric Seidel.
+
+        [wx] Small cleanup: avoid unnecessary wxString::mb_str() calls.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds lightweight network resources to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31065
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-11-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] ASSERT failure when receiving 401 HTTP Authentication response.
+        https://bugs.webkit.org/show_bug.cgi?id=31077
+
+        Allow sending the response body under the same conditions that we
+        allow it to finish without reporting an error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-04  Adam Roben  <aroben@apple.com>
+
+        Sort WebCore.base.exp
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebCore.base.exp: Sorted.
+
+2009-11-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rollout.
+
+        Revert r50496 because it broke all layout tests on QtBuildBot.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::fontCache):
+        (WebCore::FontCache::FontCache):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
+        (WebCore::FontPlatformDataCacheKey::):
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::FontPlatformDataCacheKey::hash):
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
+        (WebCore::FontPlatformDataCacheKeyHash::hash):
+        (WebCore::FontPlatformDataCacheKeyHash::equal):
+        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        (WebCore::FontCache::getCachedFontData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::releaseFontData):
+        (WebCore::FontCache::purgeInactiveFontData):
+        (WebCore::FontCache::addClient):
+        (WebCore::FontCache::removeClient):
+        (WebCore::FontCache::invalidate):
+        * platform/graphics/qt/FontFallbackListQt.cpp: Added.
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::determinePitch):
+        (WebCore::FontFallbackList::fontDataAt):
+        (WebCore::FontFallbackList::fontDataForCharacters):
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31044
+        [Gtk] assertion when webkit_accessible_get_index_in_parent attempts to get parent of the web view
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkParentOfWebView):
+        (webkit_accessible_get_index_in_parent):
+        (webkit_accessible_get_parent):
+
+2009-11-04  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Initial version of this patch by Jürg Billeter and Naiem Shaik.
+        Patch 2/4 - Moving TextCodecs to GLib
+        
+        Added probing for a hard-coded lists of text encodings.
+        The basis of this list is taken from the encodings supported by iconv,
+        then extended by e.g. tis-620, windows-1251, euc-kr, windows-1253 and
+        a number of Chinese ones.
+
+        Probing is necessary with the current design of text codecs
+        as iconv/GLib do not support enumerating available encodings.
+
+        * GNUmakefile.am:
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * platform/text/gtk/TextCodecGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::newTextCodecGtk):
+        (WebCore::TextCodecGtk::isEncodingAvailable):
+        (WebCore::TextCodecGtk::registerEncodingNames):
+        (WebCore::TextCodecGtk::registerCodecs):
+        (WebCore::TextCodecGtk::registerBaseEncodingNames):
+        (WebCore::TextCodecGtk::registerBaseCodecs):
+        (WebCore::TextCodecGtk::registerExtendedEncodingNames):
+        (WebCore::TextCodecGtk::registerExtendedCodecs):
+        (WebCore::TextCodecGtk::TextCodecGtk):
+        (WebCore::TextCodecGtk::~TextCodecGtk):
+        (WebCore::TextCodecGtk::releaseIConv):
+        (WebCore::TextCodecGtk::createIConvDecoder):
+        (WebCore::TextCodecGtk::createIConvEncoder):
+        (WebCore::TextCodecGtk::decode):
+        (WebCore::TextCodecGtk::encode):
+        * platform/text/gtk/TextCodecGtk.h: Added.
+
+2009-11-04  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Unify redudant methods which will always return the same value.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31035
+        [GTK] some accessibility tests hitting assertion in debug builds
+
+        Removes the assertions in webkit_accessible_ref_child; adds sanity checks.
+        Any app or AT can attempt to ref a child at a bogus index.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_ref_child):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Use gst_element_class_set_details_simple()
+
+        Cosmetic change, just code simplification
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_base_init):
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds paint rectangle information to TimelineAgent's didPaint callback.
+        https://bugs.webkit.org/show_bug.cgi?id=31087
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createPaintTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-11-04  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        This patch adds API to the console object for annotating the
+        inspector timeline. This allows developers to mark logical
+        checkpoints in their apps and have them overlaid in the event
+        record tree.
+
+        tests updated: LayoutTests/fast/dom/Window/window-properties.html
+        https://bugs.webkit.org/show_bug.cgi?id=31082
+
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::markTimeline):
+        * inspector/InspectorController.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * page/Console.cpp:
+        (WebCore::Console::markTimeline):
+        * page/Console.h:
+        * page/Console.idl:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed build fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-02  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Handle fonts like the other ports
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29856
+
+        Test: svg/text/text-font-invalid.html
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformData::FontPlatformData):
+        Added a boolean to identify deleted value in the hash table.
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Leopard build fix
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):
+        (WebCore::core):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix an assertion failure in core(NSURLProtectionSpace *) by handling NTLM
+        authentication in AuthenticationMac
+
+        * platform/network/mac/AuthenticationMac.mm:
+
+2009-11-03  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes a problem where the timeline instrumentation crashes if
+        timeline profiling is enabled or disabled in the middle of an
+        event dispatch.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31080
+
+        Test: inspector/timeline-trivial.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::fired):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Allow a frame to go back to copy-on-scroll when it ceases being overlapped
+
+        The code was not testing slow-scrolling frames for overlappedness, thinking the answer
+        would not matter. That is not the case if the only reason for the slow-scrolling is
+        being overlapped.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped): Added. Returns whether there is any
+        reason besides being overlapped that the frame would need to fully repaint on scroll.
+        * page/FrameView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Use useSlowRepaintsIfNotOverlapped().
+
+2009-11-03  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Qt build fix.
+
+        Need to use right capitalization for include file.
+
+        * page/Navigator.cpp:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate from top bar filters to check boxes in Timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31081
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClick):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clear overview on Clear action and panel reset.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31078
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-03  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Imported action and rules python files that WebCore.gyp depends on. 
+        These files used to live in chromium.org and deal mostly with auto-generation
+        of code by wrapping existing webkit perl scripts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31071
+
+        * WebCore.gyp/WebCore.gyp: Fixed paths in actions and rules.
+        * WebCore.gyp/scripts/action_csspropertynames.py: Added.
+        * WebCore.gyp/scripts/action_cssvaluekeywords.py: Added.
+        * WebCore.gyp/scripts/action_makenames.py: Added.
+        * WebCore.gyp/scripts/action_maketokenizer.py: Added.
+        * WebCore.gyp/scripts/action_useragentstylesheets.py: Added.
+        * WebCore.gyp/scripts/rule_binding.py: Added.
+        * WebCore.gyp/scripts/rule_bison.py: Added.
+        * WebCore.gyp/scripts/rule_gperf.py: Added.
+
+2009-11-03  Bradley Green  <brg@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Implement window.navigator.registerProtocolHandler in webkit,
+        https://bugs.webkit.org/b/29651
+
+        Also implemented its sister API window.navigator.registerContentHandler.
+
+        These methods are as described in the HTML5 specification which can be
+        found here,
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registerprotocolhandler
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registercontenthandler
+
+        As specified in the document, the behavior of the browser is determined
+        by the current registered handler.  The state of a registered handler
+        can change at any time, with the user clearing a registered handler,
+        registering a different page as handler, or deferring the hander to the
+        OS.  If webkit was to track the state of the currently registered
+        handlers, it would need more APIs and complexity to keep in sync with
+        user actions reported to webkit from the UA.  For simplicity, the state
+        of protocol handlers should be kept isolated from webkit and webkit only
+        notifies the UA that a page has made the call.  The UA is then
+        responsible for correctly handling the registerProtocolHandler call and
+        the redirects which result from registration.
+
+        We do however follow the specification in insuring that the reserved
+        schemes and mimeTypes are not passed to the UA as custom handler
+        registration tests.  We also insure that the "%s" token is present as
+        required by the specification.
+
+        Updated test expectations for window.clientInformation and navigator
+        objects.
+
+        Tests: fast/dom/registerContentHandler.html
+               fast/dom/registerProtocolHandler.html
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::registerProtocolHandler):
+        (WebCore::Chrome::registerContentHandler):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::registerProtocolHandler):
+        (WebCore::ChromeClient::registerContentHandler):
+        * page/Navigator.cpp:
+        (WebCore::verifyCustomHandlerURL):
+        (WebCore::verifyProtocolHandlerScheme):
+        (WebCore::Navigator::registerProtocolHandler):
+        (WebCore::verifyProtocolHandlerMimeType):
+        (WebCore::Navigator::registerContentHandler):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+
+2009-11-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31079 - Remove #include "Page.h" from Document.h
+
+        No new tests. (No change in functionality)
+
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorTimelineAgent): Moved from Document.h
+        * dom/Document.h:
+
+        Include "Page.h" directly:
+        * html/HTMLVideoElement.cpp:
+        * loader/RedirectScheduler.cpp:
+        * page/History.cpp:
+        * rendering/MediaControlElements.cpp:
+        * storage/StorageAreaImpl.cpp:
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hover over JS "things" in source and see their values
+        https://bugs.webkit.org/show_bug.cgi?id=30913
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: update timeline content boundaries on timer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31072
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31070
+        Fix <rdar://problem/7194735> Crashes at RenderText::RenderText()
+        Fix <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        Tests: plugins/attach-during-destroy.html
+               plugins/destroy-reentry.html
+
+        These crashes were caused by plug-in code running during detach(),
+        causing re-entry into RenderWidget::destroy() in one case and a call
+        into attach() in the other. The fix is to prevent plug-in code from
+        being called at certain unsafe times (during attach(), detach(), and
+        recalcStyle()) by deferring changes to the widget hierarchy.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Suspend widget hierarchy updates
+            during style recalculation.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attach): Suspend widget hierarchy updates during
+            attach().
+        (WebCore::Element::detach): Suspend widget hierarchy updates during
+            detach().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::widgetNewParentMap): Returns a static map of pending changes
+            to the widget hierarchy.
+        (WebCore::RenderWidget::suspendWidgetHierarchyUpdates): Increments the
+            suspend count.
+        (WebCore::RenderWidget::resumeWidgetHierarchyUpdates): Decrements the
+            suspend count. If the count is going to be zero, updates the widget
+            hierarchy by executing the pending changes stored in the map.
+        (WebCore::moveWidgetToParentSoon): Updates the widget hierarchy
+            immediately or makes or updates an entry in the map, depending on
+            whether updates are suspended.
+        (WebCore::RenderWidget::destroy): Removed earlier bandaid fix for
+            <rdar://problem/6937089>.
+        (WebCore::RenderWidget::setWidgetGeometry): Assert that widget updates
+            are not suspended, because this function updates the widget’s
+            bounds, which can result in arbitrary native and JavaScript code
+            execution. I think this assertion is true thanks to some deferred-
+            update mechanisms that have already been deployed in other places
+            in the code.
+        (WebCore::RenderWidget::setWidget): Call moveWidgetToParentSoon instead
+            of changing the widget hierarchy directly.
+        * rendering/RenderWidget.h: Declared suspendWidgetHierarchyUpdates()
+            and resumeWidgetHierarchyUpdates().
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: only show timeline records that contribute
+        to the current window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31069
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-03  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Watch expression editor should stay open after Add button was clicked
+        https://bugs.webkit.org/show_bug.cgi?id=31049
+
+        No new tests, was a regression, use existing manual test.
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+
+2009-11-03  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix an off-by-one in the CSS lexer that causes memory corruption in
+        hard-to-trigger circumstances.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30827
+
+        Test: fast/css/end-of-buffer-crash.html
+
+        * css/maketokenizer: Add comments, fix off-by-one.
+
+2009-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash due to double-destroy related to CSS run-in property
+        https://bugs.webkit.org/show_bug.cgi?id=31034
+        rdar://problem/7328458
+
+        Test: fast/css/run-in-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy): Reorder destruction so the
+        continuation is destroyed after anonymous children. See comment
+        in the code for more details of why this is right.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy): Ditto.
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix exception in ElementsPanel.js when moving pointer out of crumbs and window
+
+        There might be no new node under mouse if the pointer is moved out of the window
+        in which case we get an exception.
+        https://bugs.webkit.org/show_bug.cgi?id=31061
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._mouseMovedOutOfCrumbs):
+
+2009-11-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the dom directory of WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31053
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and these are no need to be copyable:
+
+        class EventNames - 'new' call: WebCore/platform/ThreadGlobalData.cpp:73
+        struct PerformTaskContext - 'new' call: WebCore/dom/Document.cpp:4581
+        class EventData - 'new' call: WebCore/dom/MessagePortChannel.cpp:38
+        struct NodeListsNodeData - 'new' call: WebCore/dom/NodeRareData.h:51 
+        struct EventTargetData - 'new' call: WebCore/dom/NodeRareData.h:100
+        class NodeRareData - 'new' call: WebCore/dom/Node.cpp:552
+
+        Inherits QualifiedName class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/editing/markup.cpp:319
+
+        * dom/Document.cpp:
+        * dom/EventNames.h:
+        * dom/EventTarget.h:
+        * dom/MessagePortChannel.h:
+        * dom/NodeRareData.h:
+        * dom/QualifiedName.h:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement timeline summary panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31064
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Toggle off 'Search for node' when the Inspector window is closing
+
+        Searching for node should be toggled off when the Inspector window is closed,
+        in a platform-independent manner.
+        https://bugs.webkit.org/show_bug.cgi?id=31059
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-11-03  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Prepare for heap profiles upstreaming:
+        - pass profile type id from InspectorController;
+        - this makes WebInspector.CPUProfile redundant---removed;
+        - support multiple profile types when populating profiles.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31052
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-11-03  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        UMR in WebCore::AccessibilityRenderObject::children(); m_childrenDirty uninitialized in constructor
+        https://bugs.webkit.org/show_bug.cgi?id=31063
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement Timeline Window, wire it to the bottom timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31056
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.get items):
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._resizeWindow):
+        (WebInspector.TimelinePanel.prototype._windowResizeDragging):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._windowDragging):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelinePanel.prototype._endWindowDragging):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make QWebPluginDatabase private API for now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30775
+
+        * WebCore.pro:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Extended the conversion of the WebCore ResourceRequest to the
+        QNetworkRequest with a mandatory originating object argument,
+        which is meant to be the QWebFrame the request belongs to.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: monitorEvent should be monitorEvents
+        https://bugs.webkit.org/show_bug.cgi?id=31042
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Antti Koivisto.
+
+        [Qt] Build fix for Windows CE
+
+        * plugins/PluginDatabase.cpp:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Levin.
+
+        fix accessibility webkit-style-check errors
+        https://bugs.webkit.org/show_bug.cgi?id=29672
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::remove):
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        (WebCore::AXObjectCache::removeAXID):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::enableAccessibility):
+        (WebCore::AXObjectCache::enableEnhancedUserInterfaceAccessibility):
+        (WebCore::AXObjectCache::accessibilityEnabled):
+        (WebCore::AXObjectCache::accessibilityEnhancedUserInterfaceEnabled):
+        (WebCore::AXObjectCache::isIDinUse):
+        (WebCore::AXObjectCache::objectFromAXID):
+        (WebCore::AXObjectCache::):
+        (WebCore::AXObjectCache::handleActiveDescendantChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        (WebCore::AXObjectCache::detachWrapper):
+        (WebCore::AXObjectCache::attachWrapper):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
+        * accessibility/AccessibilityAllInOne.cpp:
+        * accessibility/AccessibilityImageMapLink.cpp:
+        * accessibility/AccessibilityList.h:
+        (WebCore::AccessibilityList::isList):
+        * accessibility/AccessibilityListBox.cpp:
+        * accessibility/AccessibilityListBox.h:
+        (WebCore::AccessibilityListBox::isListBox):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::isListBoxOption):
+        * accessibility/AccessibilityMediaControls.h:
+        (WebCore::AccessibilityMediaControl::~AccessibilityMediaControl):
+        (WebCore::AccessibilityMediaTimeline::~AccessibilityMediaTimeline):
+        (WebCore::AccessibilityMediaTimeline::isMediaTimeline):
+        (WebCore::AccessibilityMediaControlsContainer::~AccessibilityMediaControlsContainer):
+        (WebCore::AccessibilityMediaControlsContainer::roleValue):
+        (WebCore::AccessibilityMediaControlsContainer::accessibilityIsIgnored):
+        (WebCore::AccessibilityMediaTimeDisplay::~AccessibilityMediaTimeDisplay):
+        (WebCore::AccessibilityMediaTimeDisplay::roleValue):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::parentObjectUnignored):
+        (WebCore::AccessibilityObject::rightLineVisiblePositionRange):
+        (WebCore::replacedNodeNeedsCharacter):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        (WebCore::AccessibilityObject::lengthForVisiblePositionRange):
+        (WebCore::AccessibilityObject::actionVerb):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::PlainTextRange::isNull):
+        (WebCore::AccessibilityObject::isAccessibilityRenderObject):
+        (WebCore::AccessibilityObject::isAnchor):
+        (WebCore::AccessibilityObject::isAttachment):
+        (WebCore::AccessibilityObject::isHeading):
+        (WebCore::AccessibilityObject::isLink):
+        (WebCore::AccessibilityObject::isImage):
+        (WebCore::AccessibilityObject::isNativeImage):
+        (WebCore::AccessibilityObject::isImageButton):
+        (WebCore::AccessibilityObject::isPasswordField):
+        (WebCore::AccessibilityObject::isTextControl):
+        (WebCore::AccessibilityObject::isNativeTextControl):
+        (WebCore::AccessibilityObject::isWebArea):
+        (WebCore::AccessibilityObject::isCheckboxOrRadio):
+        (WebCore::AccessibilityObject::isListBox):
+        (WebCore::AccessibilityObject::isFileUploadButton):
+        (WebCore::AccessibilityObject::isProgressIndicator):
+        (WebCore::AccessibilityObject::isSlider):
+        (WebCore::AccessibilityObject::isControl):
+        (WebCore::AccessibilityObject::isList):
+        (WebCore::AccessibilityObject::isDataTable):
+        (WebCore::AccessibilityObject::isTableRow):
+        (WebCore::AccessibilityObject::isTableColumn):
+        (WebCore::AccessibilityObject::isTableCell):
+        (WebCore::AccessibilityObject::isFieldset):
+        (WebCore::AccessibilityObject::isGroup):
+        (WebCore::AccessibilityObject::isChecked):
+        (WebCore::AccessibilityObject::isEnabled):
+        (WebCore::AccessibilityObject::isSelected):
+        (WebCore::AccessibilityObject::isFocused):
+        (WebCore::AccessibilityObject::isHovered):
+        (WebCore::AccessibilityObject::isIndeterminate):
+        (WebCore::AccessibilityObject::isLoaded):
+        (WebCore::AccessibilityObject::isMultiSelect):
+        (WebCore::AccessibilityObject::isOffScreen):
+        (WebCore::AccessibilityObject::isPressed):
+        (WebCore::AccessibilityObject::isReadOnly):
+        (WebCore::AccessibilityObject::isVisited):
+        (WebCore::AccessibilityObject::isRequired):
+        (WebCore::AccessibilityObject::canSetFocusAttribute):
+        (WebCore::AccessibilityObject::canSetTextRangeAttributes):
+        (WebCore::AccessibilityObject::canSetValueAttribute):
+        (WebCore::AccessibilityObject::hasIntValue):
+        (WebCore::AccessibilityObject::accessibilityShouldUseUniqueId):
+        (WebCore::AccessibilityObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::parentObjectIfExists):
+        (WebCore::AccessibilityRenderObject::parentObject):
+        (WebCore::AccessibilityRenderObject::isMenuRelated):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isFocused):
+        (WebCore::AccessibilityRenderObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityRenderObject::doAXRangeForLine):
+        (WebCore::AccessibilityRenderObject::doAXStringForRange):
+        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
+        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::isPresentationalChildOfAriaRole):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        (WebCore::AccessibilityRenderObject::actionVerb):
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::isAccessibilityRenderObject):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation):
+        * accessibility/AccessibilitySlider.h:
+        (WebCore::AccessibilitySlider::~AccessibilitySlider):
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        (WebCore::AccessibilitySlider::isSlider):
+        (WebCore::AccessibilitySlider::canSetValueAttribute):
+        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        (WebCore::AccessibilitySliderThumb::setParentObject):
+        (WebCore::AccessibilitySliderThumb::parentObject):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        * accessibility/AccessibilityTableColumn.cpp:
+        * accessibility/AccessibilityTableHeaderContainer.cpp:
+        (WebCore::AccessibilityTableHeaderContainer::addChildren):
+        * accessibility/AccessibilityTableRow.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.h:
+
+2009-11-02  Darin Fisher  <darin@chromium.org>
+
+        Fixing JSC build bustage.
+
+        * bindings/js/ScriptController.cpp: Added missing #include
+
+2009-10-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Give the FrameLoaderClient the ability to override Settings::isJavaScriptEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30967
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/V8Proxy.cpp: Move implementation of isEnabled to ScriptController
+        * bindings/v8/V8Proxy.h: Ditto
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowJavaScript):
+        * platform/chromium/ChromiumBridge.h: Delete uiResourceProtocol function
+
+2009-11-02  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        Fix a typo in Mark's last commit.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Re-enable support for web archives on Windows.  It was mistakenly disabled in r50438.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * WebCore.pro: Add SharedBufferCF.cpp and SmartReplaceCF.cpp
+        to the Darwin build.
+        * loader/archive/ArchiveFactory.cpp: Change the support for 
+        legacy WebArchive from all CF platforms to Mac and Chromium 
+        CF platforms.
+        (WebCore::archiveMIMETypes):
+        * platform/text/AtomicString.h: Remove PLATFORM(QT) &&
+        PLATFORM(DARWIN) test as it is redundant now.
+        * platform/text/PlatformString.h: Ditto.
+        * platform/text/StringImpl.h: Ditto.
+        * platform/text/cf/StringCF.cpp: Ditto.
+        * platform/text/cf/StringImplCF.cpp: Ditto.
+
+2009-11-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Actually declare getPluginMimeTypeFromExtension in a header.
+        https://bugs.webkit.org/show_bug.cgi?id=30985
+
+        Our current code does not conform to our style guide.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp:
+        * plugins/chromium/PluginDataChromium.cpp:
+        * plugins/chromium/PluginDataChromium.h: Added.
+
+2009-11-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7038305> REGRESSION (Safari 4.0.2 - ToT): After navigating back to a known phishy page, the "Ignore warning" button appears highlighted (along with the "Go Back" button)
+
+        This bug is timing dependent, and not always reproducible.  I could not think of a way to add a 
+        layout test that would demonstrate the problem and fix.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::checkbox): Update style.
+        (WebCore::paintCheckbox): ditto.
+        (WebCore::radio): ditto.
+        (WebCore::paintRadio): ditto.
+        (WebCore::setupButtonCell): Added convenience method.
+        (WebCore::button): Use a separate NSButtonCell for defaultButtons and regular buttons.
+        (WebCore::paintButton): Don't check for the key window here.  Consider that when deciding if the button should have the default style in RenderTheme.
+        * rendering/RenderTheme.cpp: (WebCore::RenderTheme::isDefault): Only consider a button to be default if the page is active.  This fixes 
+        a problem I noticed where the button would flicker crazily if the page with the default button was in the background.
+
+2009-11-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Minor RenderWidget clean-up in preparation for deferring widget tree
+        mutation when it is not safe.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::RenderWidget): Initialize m_refCount to 1
+        instead of calling ref().
+        (WebCore::RenderWidget::destroy): Call setWidget(0) instead of
+        repeating what it does.
+        (WebCore::RenderWidget::setWidgetGeometry): Now returns a boolean
+        indicating whether the bounds have changed.
+        (WebCore::RenderWidget::setWidget): Replaced all-encompassing if
+        statement with an early return.
+        (WebCore::RenderWidget::updateWidgetPosition): Call setWidgetGeometry().
+        * rendering/RenderWidget.h:
+
+2009-11-02  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker and SQLTransactionClient
+        implementations.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30701
+
+        * storage/chromium: Added.
+        * storage/chromium/DatabaseObserver.h: Added.
+        * storage/chromium/DatabaseTrackerChromium.cpp: Added.
+        * storage/chromium/QuotaTracker.cpp: Added.
+        * storage/chromium/QuotaTracker.h: Added.
+        * storage/chromium/SQLTransactionClientChromium.cpp: Added.
+
+2009-11-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson and Dan Bernstein.
+
+        Safari crashes when calling execCommand on formatted html in special case
+        <rdar://problem/7318656>
+        https://bugs.webkit.org/show_bug.cgi?id=31023
+
+        Test: editing/execCommand/align-in-span.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock): Modified comment on containingBlock returning NULL.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setSelectionState): Added check for NULL return from containingBlock,
+        since it is possible when dealing with orphaned trees.
+
+2009-11-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Exception checks were being too aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=31005
+
+        Several calls in CanvasRenderingContext3D are allowed to
+        have a null value passed, which indicated that the 
+        object is being unbound. Handle this case and the corresponding
+        null handling in GraphicsContext3DMac.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+
+2009-11-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Each JS execution in console adds extra item into "scripts" combo
+        https://bugs.webkit.org/show_bug.cgi?id=30212
+
+        Added manual test
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * manual-tests/inspector/hidden-evals.html: Added.
+
+2009-11-02  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a missed case for InspectorTimeline, DOMWindow dispatch of DOM events.
+        https://bugs.webkit.org/show_bug.cgi?id=31030
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners): Checks DOMWindow for listeners.
+        (WebCore::Node::dispatchGenericEvent):
+
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        No new tests since no new functionality. Storage, MessagePorts and Workers tests cover this.
+
+        There are a lot of files but most changes are simply replace RefPtr and PassRefPtr with
+        OwnPtr and PassOwnPtr when dealing with Tasks.
+
+        ScriptExecutionContext::Task, DatabaseTask and WorkerRunLoop::Task are no longer
+        threadsafe refcounted, but simply Noncopyable.
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ProcessMessagesSoonTask::create):
+        * dom/ScriptExecutionContext.h:
+        * dom/default/PlatformMessagePortChannel.cpp:
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
+        * loader/FrameLoader.cpp:
+        (WebCore::HashChangeEventTask::create):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::create):
+        * storage/Database.cpp:
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::Database::tableNames):
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
+        (WebCore::DatabaseThread::scheduleTask):
+        (WebCore::DatabaseThread::scheduleImmediateTask):
+        (WebCore::SameDatabasePredicate::operator()):
+        * storage/DatabaseThread.h:
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::localStorageThread):
+        * storage/LocalStorageThread.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        (WebCore::SharedWorkerConnectTask::create):
+        * workers/GenericWorkerTask.h:
+        (WebCore::GenericWorkerTask1::create):
+        (WebCore::GenericWorkerTask2::create):
+        (WebCore::GenericWorkerTask3::create):
+        (WebCore::GenericWorkerTask4::create):
+        (WebCore::GenericWorkerTask5::create):
+        (WebCore::GenericWorkerTask6::create):
+        (WebCore::GenericWorkerTask7::create):
+        (WebCore::GenericWorkerTask8::create):
+        (WebCore::createCallbackTask):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::postTask):
+        * workers/WorkerContext.h:
+        * workers/WorkerLoaderProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::WorkerExceptionTask::create):
+        (WebCore::WorkerContextDestroyedTask::create):
+        (WebCore::WorkerTerminateTask::create):
+        (WebCore::WorkerThreadActivityReportTask::create):
+        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToLoader):
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::ModePredicate::operator()):
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::postTask):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        (WebCore::WorkerRunLoop::Task::create):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        (WebCore::WorkerRunLoop::Task::Task):
+        * workers/WorkerRunLoop.h:
+        (WebCore::WorkerRunLoop::Task::~Task):
+        (WebCore::WorkerRunLoop::Task::mode):
+
+2009-11-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Failing media/video-played-reset.html
+        https://bugs.webkit.org/show_bug.cgi?id=30589
+
+        new m_seekTime attribute to keep track of the seek position
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Remove Referer when redirecting to non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31021
+
+        Remove referer from HTTP headers when redirecting to a non-secure
+        site.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-11-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18539
+        multipart/form-data not being parsed correctly on server due to '+' in boundary string
+
+        No test - the characters that the boundary is made of are not deterministic.
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::FormDataBuilder::generateUniqueBoundaryString):
+        Don't ever put a '+' in boundary string, either. Removed a FIXME to bring '/' back once
+        GMail is fixed - I don't think we'll ever want to allow non-alphanumeric characters, as
+        they cause problems on many web sites.
+
+2009-10-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30969
+        A no-prefix XPath node test should not match no-namespace elements in HTML document
+
+        Test: fast/xpath/null-namespace-in-html.html
+
+        * xml/XPathStep.cpp: (WebCore::XPath::nodeMatchesBasicTest): Special case non-HTML elements
+        in HTML documents (as these are the ones that can have null namespace).
+
+2009-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] No timeline marks on resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31013
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+
+2009-11-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Possible crash in RenderSlider::layout.
+        https://bugs.webkit.org/show_bug.cgi?id=31016
+
+        Fix out of place line of code.
+
+        Test: scrollbars/overflow-scrollbar-combinations.html
+        This crash only seems to repro when WebKit draws the play controls,
+        so the crash repros in chromium running this test but not WebKit
+        nightlies which use QuickTime to draw the controls.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+
+2009-11-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix Qt build on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30905
+
+        * WebCore.pro:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::create):
+
+2009-11-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        QWebView crash fix.
+
+        The QWebView should not crash if the stop() method is called from
+        a function triggered by the loadProgress signal.
+
+        A null pointer protection was added in the ProgressTracker::incrementProgress.
+
+        New autotest was created.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29425
+
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::incrementProgress):
+
+2009-11-02  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leftover from profiles panel generalization.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31010
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+
+2009-11-02  Kai Koehne  <kai.koehne@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Remove implementation of ImageDecocerQt::clearFrameBufferCache.
+        The implementation was buggy, and will visually break repeating
+        animations anyway.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31009
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+
+2009-11-02  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to the reported content language.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_document_get_locale):
+
+2009-11-02  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Rewrite CSSSourceSyntaxHighlighter so it shares more code
+        https://bugs.webkit.org/show_bug.cgi?id=30907
+
+        Test: inspector/css-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        (WebInspector.SourceSyntaxHighlighter):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Support ARIA "tab" roles
+        https://bugs.webkit.org/show_bug.cgi?id=30842
+
+        Implement support for ARIA "tab", "tabpanel" and "tablist".
+        As a consequence, we also needed to implement aria-selected
+        and aria-controls.
+
+        Tests: accessibility/aria-controls-with-tabs.html
+               accessibility/aria-tab-roles.html
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * html/HTMLAttributeNames.in:
+
+2009-10-27  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        This is the WebKit-side change needed to fix canvas.getImageData() for
+        Chromium.  The unpremultiply code in Skia assumes that unpremultiplied
+        values should be rounded, while CG does not.  In addition, the fixed
+        point inversion used by Skia introduces slight inaccuracies that make
+        us fail this test.  This change brings Chromium in line with
+        the CG path.
+        https://bugs.webkit.org/show_bug.cgi?id=30825
+
+        Covered by LayoutTests/fast/canvas/canvas-getImageData.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds window event dispatches to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31002
+
+        * English.lproj/localizedStrings.js:
+        * dom/Node.cpp: Updated call site to willDispatchEvent and didDispatchEvent.
+        (WebCore::Node::dispatchGenericEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchEvent): Renamed.
+        (WebCore::InspectorTimelineAgent::didDispatchEvent): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEventDispatchRecord): Renamed.
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchEvent):
+
+2009-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Convert script tag event into a more generic
+        script eval event in timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30999
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::didEvaluateScript):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEvaluateScriptTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+
+2009-11-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Fix for loop to use an size_t instead of unsigned and some spacing
+        style fixes.
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Does not send DOM dispatches to the InspectorTimelineAgent if there
+        are no event listeners.
+        https://bugs.webkit.org/show_bug.cgi?id=30995
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+        (WebCore::Node::dispatchGenericEvent):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-01  Roland Steiner  <rolandsteiner@chromium.org>
+
+        No review (build fix).
+
+        Add missing files for Ruby implementation to WebCore.vcproj
+        (Fix build break after 50397)
+        https://bugs.webkit.org/show_bug.cgi?id=31001
+
+        No new tests. (No functional change)
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-02  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        First rudimentary implementation of HTML5 ruby rendering support.
+
+        Following the HTML 5 spec, the box object model for a <ruby> element allows several runs of ruby
+        bases with their respective ruby texts looks as follows:
+
+        1 RenderRuby object, corresponding to the whole <ruby> HTML element
+             1+ RenderRubyRun (anonymous)
+                 0 or 1 RenderRubyText - shuffled to the front in order to re-use existing block layouting
+                     0-n inline object(s)
+                 0 or 1 RenderRubyBase - contains the inline objects that make up the ruby base
+                     1-n inline object(s)
+
+        Note: <rp> elements are defined as having 'display:none' and thus normally are not assigned a renderer.
+        
+        New layout tests will be committed in a follow-up patch under fast/ruby.
+
+        Makefiles, etc.
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS
+        * css/html.css: Added <ruby> and <rt>
+
+        Existing render files:
+        * rendering/RenderBlock.cpp: make moveChild a member function moveChildTo
+        (WebCore::RenderBlock::moveChildTo):
+        (WebCore::RenderBlock::makeChildrenNonInline):
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlock.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): instantiate ruby renderers based on element name
+        * rendering/RenderObject.h: add query methods for ruby renderers
+        (WebCore::RenderObject::isRuby):
+        (WebCore::RenderObject::isRubyBase):
+        (WebCore::RenderObject::isRubyRun):
+        (WebCore::RenderObject::isRubyText):
+
+        New ruby renderers:
+        * rendering/RenderRuby.cpp: Added.
+        (WebCore::lastRubyRun):
+        (WebCore::findRubyRunParent):
+        (WebCore::RenderRubyAsInline::RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::~RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::isChildAllowed):
+        (WebCore::RenderRubyAsInline::addChild):
+        (WebCore::RenderRubyAsInline::removeChild):
+        (WebCore::RenderRubyAsBlock::RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::~RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::isChildAllowed):
+        (WebCore::RenderRubyAsBlock::addChild):
+        (WebCore::RenderRubyAsBlock::removeChild):
+        * rendering/RenderRuby.h: Added.
+        (WebCore::RenderRubyAsInline::renderName):
+        (WebCore::RenderRubyAsInline::isRuby):
+        (WebCore::RenderRubyAsBlock::renderName):
+        (WebCore::RenderRubyAsBlock::isRuby):
+        * rendering/RenderRubyBase.cpp: Added.
+        (WebCore::RenderRubyBase::RenderRubyBase):
+        (WebCore::RenderRubyBase::~RenderRubyBase):
+        (WebCore::RenderRubyBase::isChildAllowed):
+        (WebCore::RenderRubyBase::splitToLeft):
+        (WebCore::RenderRubyBase::mergeWithRight):
+        * rendering/RenderRubyBase.h: Added.
+        (WebCore::RenderRubyBase::renderName):
+        (WebCore::RenderRubyBase::isRubyBase):
+        * rendering/RenderRubyRun.cpp: Added.
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::~RenderRubyRun):
+        (WebCore::RenderRubyRun::hasRubyText):
+        (WebCore::RenderRubyRun::hasRubyBase):
+        (WebCore::RenderRubyRun::isEmpty):
+        (WebCore::RenderRubyRun::rubyText):
+        (WebCore::RenderRubyRun::rubyBase):
+        (WebCore::RenderRubyRun::rubyBaseSafe):
+        (WebCore::RenderRubyRun::firstLineBlock):
+        (WebCore::RenderRubyRun::updateFirstLetter):
+        (WebCore::RenderRubyRun::isChildAllowed):
+        (WebCore::RenderRubyRun::addChild):
+        (WebCore::RenderRubyRun::removeChild):
+        (WebCore::RenderRubyRun::createRubyBase):
+        (WebCore::RenderRubyRun::staticCreateRubyRun):
+        * rendering/RenderRubyRun.h: Added.
+        (WebCore::RenderRubyRun::renderName):
+        (WebCore::RenderRubyRun::isRubyRun):
+        * rendering/RenderRubyText.cpp: Added.
+        (WebCore::RenderRubyText::RenderRubyText):
+        (WebCore::RenderRubyText::~RenderRubyText):
+        (WebCore::RenderRubyText::isChildAllowed):
+        * rendering/RenderRubyText.h: Added.
+        (WebCore::RenderRubyText::renderName):
+        (WebCore::RenderRubyText::isRubyText):
+
+2009-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30992
+        Node.isDefaultNamespace doesn't convert empty strings to null
+
+        Test: fast/dom/Node/default-namespace-empty-argument.html
+
+        * dom/Node.cpp: (WebCore::Node::isDefaultNamespace): Per DOM 3 Core, treat empty input
+        as null.
+
+2009-11-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Don't add '/' to the URL path if the it does not include '/' after the protocol component
+        https://bugs.webkit.org/show_bug.cgi?id=30971
+
+        Match IE8 behaviour, that does not add '/' if there is none after the protocol component.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix layering violations in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=30986
+
+        Remove uses of HTMLImageElement and HTMLCanvasElement
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2009-11-01  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to expected document attributes.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (documentAttributeValue):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+
+2009-11-03  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Implements what has been implemented in AT-SPI.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (GetAtkInterfaceTypeFromWAIType):
+        (getInterfaceMaskFromObject):
+        (atk_document_interface_init):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+        (webkit_accessible_document_get_locale):
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        No new tests as there is no functional change.
+
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer): Reorder 
+        initialization list to fix compiler warnings.
+
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        [Regression] monitorEvent doesn't work
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Web Inspector: Bug with Message Bubble in Syntax Highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=30990
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-10-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30982
+        createHTMLDocument doesn't escape ampersand and less-than in title
+
+        Test: fast/dom/DOMImplementation/createHTMLDocument-title.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createHTMLDocument):
+        Set document title after creating the document, avoiding parser intricacies.
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Double clicking on a breakpoints should not select text
+        https://bugs.webkit.org/show_bug.cgi?id=30950
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-11-01  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
+
+        [Crash (debug)] Combination of list-item and :after causes assertion failure
+        https://bugs.webkit.org/show_bug.cgi?id=30944
+
+        Test: fast/css/list-item-pseudo-nocrash.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2009-11-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30586
+        [GTK] Failing test media/video-src-empty.html
+
+        Correctly set network/ready state depending on GStreamer errors
+        received on the bus.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove obsolete null checks from CanvasRenderingContext3DMac
+        https://bugs.webkit.org/show_bug.cgi?id=30983
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebGL allows objects to be used with the wrong context
+        https://bugs.webkit.org/show_bug.cgi?id=30981
+
+        Simply add null checks and a few context guards to ensure we don't
+        deref null or attempt to use an object from a different context.
+
+        Tests: fast/canvas/webgl/incorrect-context-object-behaviour.html
+               fast/canvas/webgl/null-object-behaviour.html
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::attachShader):
+        (WebCore::CanvasRenderingContext3D::bindAttribLocation):
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::compileShader):
+        (WebCore::CanvasRenderingContext3D::detachShader):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::isBuffer):
+        (WebCore::CanvasRenderingContext3D::linkProgram):
+        (WebCore::CanvasRenderingContext3D::shaderSource):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryResult
+        https://bugs.webkit.org/show_bug.cgi?id=30857
+
+        Inherits MediaQueryResult class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:5984 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryEvaluator
+        https://bugs.webkit.org/show_bug.cgi?id=30854
+
+        Inherits MediaQueryEvaluator class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:401 and   
+        it is no need to be copyable.
+
+        * css/MediaQueryEvaluator.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleSet
+        https://bugs.webkit.org/show_bug.cgi?id=30852
+
+        Inherits CSSRuleSet class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:455 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.cpp:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleData
+        https://bugs.webkit.org/show_bug.cgi?id=30851
+
+        Inherits CSSRuleData class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.h:320 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleDataList
+        https://bugs.webkit.org/show_bug.cgi?id=30850
+
+        Inherits CSSRuleDataList class from Noncopyable because it has been
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:2715 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSNamespace
+        https://bugs.webkit.org/show_bug.cgi?id=30849
+
+        Inherits CSSNamespace struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSheet.cpp:141 and
+        it is no need to be copyable.
+
+        * css/CSSNamespace.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor DatabaseTask in preparation for removing threadsafe refcounting from it.
+        Move the synchronizer object out of the DatabaseTask so there is no need to keep
+        the pointer to Databasetask around after passing it to MessageQueue.
+        Also pass the references to return parameters to the task so it can update them.
+        https://bugs.webkit.org/show_bug.cgi?id=30941
+
+        No new tests, since this is just moving the code around, no change in functionality.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        (WebCore::Database::openAndVerifyVersion): Use new DatabaseTaskSynchronizer to wait for task completion.
+        (WebCore::Database::markAsDeletedAndClose): Ditto.
+        (WebCore::Database::tableNames): Ditto.
+        (WebCore::Database::stop): Use the boolean flag rather then 'killed' flag built into MessageQueue.
+        (WebCore::Database::scheduleTransaction): Transaction queue is a Deque now, change the way to fetch the transaction.
+        * storage/Database.h: Change the SQLTransaction queue to be a Deque rather then a MessageQueue.
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseTaskSynchronizer::DatabaseTaskSynchronizer):
+        (WebCore::DatabaseTaskSynchronizer::waitForTaskCompletion):
+        (WebCore::DatabaseTaskSynchronizer::taskCompleted):
+        (WebCore::DatabaseTask::DatabaseTask): Ctor takes DatabaseTaskSynchronizer which can be 0.
+        (WebCore::DatabaseTask::performTask): Signal completion. m_synchronizer should still be around since main thread is waiting on it.
+        (WebCore::DatabaseOpenTask::DatabaseOpenTask): Pass synchronizer and return parameters via constructor.
+        (WebCore::DatabaseCloseTask::DatabaseCloseTask): Ditto.
+        (WebCore::DatabaseTransactionTask::DatabaseTransactionTask): Ditto.
+        (WebCore::DatabaseTableNamesTask::DatabaseTableNamesTask): Ditto.
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+
+2009-10-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: In Mail, Undo does not restore some characters I have deleted at the end of a line
+        https://bugs.webkit.org/show_bug.cgi?id=30955
+        <rdar://problem/7067033>
+        
+        When the command is deleteWordBackward or deleteWordForward
+        we should not add to the open typing command, but
+        create a new one.
+        
+        Test: editing/undo/undo-deleteWord.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+        (WebCore::TypingCommand::forwardDeleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+
+2009-10-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make MediaPlayer constructor private
+        https://bugs.webkit.org/show_bug.cgi?id=30965
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): 
+        (WebCore::HTMLMediaElement::finishParsingChildren): Use MediaPlayer::create.
+
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::create): New.
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of headings is not correct
+
+        https://bugs.webkit.org/show_bug.cgi?id=30937
+
+        Reviewed by Alice Liu.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::stringRoleForMSAA):
+        (WebCore::AccessibilityObject::descriptionForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        If the element's tag name is one of h1, h2, h3, h4, h5, h6, return
+        true.
+        (WebCore::AccessibilityRenderObject::stringRoleForMSAA):
+        If the element should return its tag name as the role, return the tag
+        name.
+        (WebCore::AccessibilityRenderObject::positionalDescriptionForMSAA):
+        If the object is a heading, return the string "L" followed by the
+        heading level.
+        (WebCore::AccessibilityRenderObject::descriptionForMSAA):
+        If the object has a positional description, return it. Otherwise, get
+        the accessibility description, and prefix it with "Description" so that
+        MSAA clients know that it's not a positional description.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of links is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=30928
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::stringValueForMSAA):
+        Return the URL.
+        (WebCore::AccessibilityImageMapLink::nameForMSAA):
+        Return the alt text.
+
+        * accessibility/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::isLinked):
+        Return true.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isLinked):
+        (WebCore::AccessibilityObject::stringValueForMSAA):
+        (WebCore::AccessibilityObject::nameForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::isLinkable):
+        Return true if the element is considered "linkable" with respect to
+        accessibility.
+        (WebCore::AccessibilityRenderObject::stringValueForMSAA):
+        If the element is linkable, check whether it has a parent anchor
+        element. If so, return the anchor element's href.
+        (WebCore::AccessibilityRenderObject::isLinked):
+        Return true if the element is linkable and if it's parent anchor tag's
+        href is non-empty.
+        (WebCore::AccessibilityRenderObject::nameForMSAA):
+        For text nodes, return the text.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        This is similar to AX code that is already in place, except that this also informs the
+        chrome when there stops being a focused node. This is needed for a browser to show the
+        anchor for links that have keyboard focus.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::focusedNodeChanged):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::focusedNodeChanged):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+
+2009-10-30  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        openDatabase() with empty version sets db version up incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=28417
+
+        Test: storage/open-database-set-empty-version.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify): Raise an exception if the current database version does not match the expected version when the current version is the empty string.
+
+2009-10-30  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        Moving the notificationsEnabled bit from NotificationCenter
+        to the new V8 RuntimeEnabledFeatures object.
+
+        Just moving a bit around, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::notificationsEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        * notifications/NotificationCenter.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] More cleanup after r49949: remove ListenerGuard.
+        ListenerGuard is no longer needed since EventListeners do not depend on frame or v8 context.
+        https://bugs.webkit.org/show_bug.cgi?id=30943
+
+        Covered by fast/events/add-event-without-document.html which will now pass in Chromium.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        counterValueForElementById should return space-separated string for multiple counters
+        https://bugs.webkit.org/show_bug.cgi?id=30939
+
+        Test: fast/css/counters/counterValueForElementById.html
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+
+2009-10-30  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Add some comments to explain what is happening here.
+
+2009-10-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix Web Inspector crash on the errors/warnings counter click
+
+        RenderObject::createVisiblePosition(const Position& position)
+        understands "null Positions", so we can construct such a Position manually.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30499
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Third part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (nameFromChildren):
+        (webkit_accessible_get_name):
+        New convenience function to construct an object's name using the name(s) of
+        any children it has.
+
+        (atk_table_interface_init):
+        (webkit_accessible_table_get_column_description):
+        (webkit_accessible_table_get_row_description):
+        Implemented.
+
+        (webkit_accessible_table_get_column_header):
+        Stub function added so that webkit_accessible_table_get_column_description
+        could be implemented in the meantime.
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Second part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (cellAtIndex):
+        (webkit_accessible_table_get_column_at_index):
+        (webkit_accessible_table_get_row_at_index):
+        (webkit_accessible_table_get_caption):
+        (atk_table_interface_init):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+        * inspector/front-end/inspector.js:
+        (WebInspector.showTimelinePanel):
+
+2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        If the owner widget of the page has a palette set, we
+        should use that one. This was only working when the
+        owner was a QWebView. This patch fixes that.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: Wire CookieJarChromium to the cookies
+        backend. This is a final step of a 3-steps raw cookies
+        access implementation in Chromium.
+
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-10-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Chromium crash in console.log in "deeply recursive" function 
+
+        Check that result of 'frameSourceName' is not null handle
+        before casting it to String. 
+      
+        Allow V8Proxy::sourceName/sourceLineNumber() to report
+        that they have failed due to JavaScript stack overflow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30904
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::create):
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::sourceLineNumber):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQuery
+        https://bugs.webkit.org/show_bug.cgi?id=30856
+
+        Inherits MediaQuery class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4905 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryExp
+        https://bugs.webkit.org/show_bug.cgi?id=30855
+
+        Inherits MediaQueryExp class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4874.
+
+        * css/MediaQueryExp.h:
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-10-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Removed test for an impossible condition (a glyph in a right-to-left run not having
+        the RTL flag 0x800)
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make links mouse focusable only on GTK and QT.
+
+        Links are now always mouse focusable on GTK and QT. On other platforms
+        the link needs a tabIndex or it needs to be contentEditable.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Complete the fix for hit-testing and selection highlighting in ligatures for the ATSUI
+        code path.
+
+        * platform/graphics/mac/ComplexTextController.h: Added m_ltr member to ComplexTextRun.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): Skip over deleted
+        glyphs, but update indexes and advances correctly.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Initialize m_ltr.
+
+2009-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(3.2.3 - 4.0.2): Message composing: when I undo a color change to text in Mail, undo/redo behaves strangely
+        <rdar://problem/7115041>
+        https://bugs.webkit.org/show_bug.cgi?id=30892
+
+        This problem shows in any scenario where it is necessary to split a text
+        node to apply a style. SplitElementCommand and WrapContentsInDummySpanCommand both
+        have member variables initialized in the constructor to keep reference to elements
+        they need to operate upon. These reference are not updated when reapplying the command.
+        For this reason it is necessary to guarantee that unapply doesn not delete the references
+        and that these commands implement doReapply to correctly reuse the existing
+        elements.
+
+        Test: editing/undo/redo-style.html
+
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply): Added.
+        (WebCore::SplitElementCommand::doApply): Modified to call executeApply. 
+        (WebCore::SplitElementCommand::doUnapply): Doesn't release m_element1.
+        (WebCore::SplitElementCommand::doReapply): Added.
+        * editing/SplitElementCommand.h: Added doReapply and executeApply.
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::executeApply): Added.
+        (WebCore::WrapContentsInDummySpanCommand::doApply): Modified to call executeApply.
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply): Doesn't release m_dummySpan.
+        (WebCore::WrapContentsInDummySpanCommand::doReapply): Added.
+        * editing/WrapContentsInDummySpanCommand.h: Added doReapply and executeApply.
+
+2009-10-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        DOM Storage's condition variable needs to handle spurious wakeups
+        https://bugs.webkit.org/show_bug.cgi?id=30920
+
+        Add a boolean to keep track of whether it's been terminated.  Clean
+        up the locking code a tiny bit to make it easier to read.  There's
+        no way to reproduce this reliably in a LayoutTest.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Include ComplextTextController into Chromium Mac project.
+
+        * WebCore.gyp/WebCore.gyp: Added include rule for ComplextText* files.
+
+2009-10-29  Timothy Hatcher  <timothy@apple.com>
+
+        Fix tabbing through element attributes in the Web Insector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30429
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted): Don't call _updateTitle,
+        it is called for us when removeAttribute succeeds in the back-end.
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted): Ditto except for nodeValue.
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled): Don't call _updateTitle, editing code reverts.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle): Return early if we are editing.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Problem editing or selecting text containing ligatures
+        https://bugs.webkit.org/show_bug.cgi?id=30025
+
+        Test: platform/mac/fast/text/ligature-subdivision.html
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Initialize
+        m_characterInCurrentGlyph.
+        (WebCore::ComplexTextController::offsetForPosition): If the hit glyph spans multiple
+        characters, compute the hit character based on dividing the glyph’s total advance into
+        a number of equal intervals equal to the number of characters and assigning the hit to the
+        character corresponding to the hit interval.
+        (WebCore::ComplexTextController::advance): If the final offset occurs mid-glyph, advance
+        by a fraction of the glyph’s total advance.
+        * platform/graphics/mac/ComplexTextController.h: Added m_characterInCurrentGlyph.
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30918>.
+        Web Inspector: Datagrid Rows on Windows not properly aligned.
+        
+        Use line-height for the table rows to make sure the height
+        of our text and the height of the table rows are consistent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r50296.
+        http://trac.webkit.org/changeset/50296
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Remove build warning introduced by r50284.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Remove random crashes by removing retrieval of V8 context during garbage collection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30919
+
+        Unfortunately, I haven't been able to trigger this crash explicitly, so no test :(.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::jsWrapperForDOMObject): Added new "assume-it's-there" getter.
+        * bindings/v8/V8DOMWrapper.h: Added getter decl.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper): Changed to use explicit getter.
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Adjust the project files to sync up with
+        http://trac.webkit.org/changeset/50259
+
+        * WebCore.gypi: Renamed and added files.
+
+2009-10-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Implement DELETE HTTP method for XmlHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=30894
+
+        No new tests as this functionality is already tested by the 
+        xmlhttprequest LayoutTests. As this patch depends on an unreleased
+        version of the dependent QtNetwork library and the tests will be
+        enabled later once the dependent library is released (and the
+        buildbot is updated).
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/30483>.
+        Web Inspector: Always show the Local and Session Storage Views.
+        
+        Even if the length of the DOM Storage entry array is 0, still
+        generate the Datagrid because users can add things storage items
+        through the UI, so we should allow them to even if there isn't
+        anything there currently.
+
+        * English.lproj/localizedStrings.js: Removed "This Storage is Empty".
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+
+2009-10-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] Threading problems with some of the tests
+        https://bugs.webkit.org/show_bug.cgi?id=30814
+
+        Create strings shared among threads with crossThreadString
+        constructor method.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-29  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30308
+        
+        Add support for ARGB videos.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Create the Cairo image surface for ARGB32 or RGB24
+        depending on the buffer's caps.
+        
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        Handle ARGB video and convert GStreamer's ARGB to
+        Cairo's for displaying.
+
+2009-10-29  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] expose a method to access memory usage information in ChromiumBridge
+        Declare a static method to be implemented by http://codereview.chromium.org/332010/
+        https://bugs.webkit.org/show_bug.cgi?id=30829
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Implements the AtkSelection interface and enables the corresponding
+        (and expected) object:selection-changed event.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (optionFromList):
+        (optionFromSelection):
+        (atk_selection_interface_init):
+        (webkit_accessible_selection_add_selection):
+        (webkit_accessible_selection_clear_selection):
+        (webkit_accessible_selection_ref_selection):
+        (webkit_accessible_selection_get_selection_count):
+        (webkit_accessible_selection_is_child_selected):
+        (webkit_accessible_selection_remove_selection):
+        (webkit_accessible_selection_select_all_selection):
+        (GetAtkInterfaceTypeFromWAIType):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (AXObjectCache::postPlatformNotification):
+
+2009-10-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 30655 - Only plain text should be copied to clipboard for TextArea.
+        https://bugs.webkit.org/show_bug.cgi?id=30655
+
+        * editing/Editor.cpp:
+        (WebCore::nodeIsInTextFormControl):
+        (WebCore::Editor::cut):
+        (WebCore::Editor::copy):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hide timeline for now - not yet ready.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30912
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: deploy Web Inspector's images in WebCore.gypi.
+
+        * WebCore.gypi:
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: get rid of timelineProfilerEnabled method.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30911
+
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        * inspector/InspectorController.h:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Create stub methods for raw cookies access in ChromiumBridge.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=30910
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's RareData
+        https://bugs.webkit.org/show_bug.cgi?id=30858
+
+        Inherits RareData struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSSelector.h:259 and 
+        it is no need to be copyable.
+
+        * css/CSSSelector.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's ShorthandScope
+        https://bugs.webkit.org/show_bug.cgi?id=30859
+
+        Inherits ShorthandScope class from FastAllocBase because it is 
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:902 and 
+        it is no need to be copyable.        
+
+        * css/CSSParser.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's AXObjectCache
+        https://bugs.webkit.org/show_bug.cgi?id=30848
+
+        Inherits AXObjectCache class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:1537 and                                
+        it is no need to be copyable.
+
+        * accessibility/AXObjectCache.h:
+
+2009-10-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't run JavaScript URLs in view source mode
+        https://bugs.webkit.org/show_bug.cgi?id=30881
+
+        Just say no.
+
+        Test: http/tests/security/view-source-no-javascript-url.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fixes style problems pointed out by Evan Martin.
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        64-bit Leopard build fix after r50259
+        
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        Declared ATSUTextInserted in 64-bit.
+        (WebCore::fontHasMirroringInfo): Use %d format and cast to int.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Ditto.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextController.h:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Attempted Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30899
+        WebKit fails to build release on 32-bit Windows systems
+
+        * WebCore.vcproj/WebCore.vcproj: Excluded files from project.
+        * bindings/js/JSBindingsAllInOne.cpp: Added.
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fixed typos in color names.
+
+        * inspector/front-end/Color.js:
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Share code between the ATSUI- and Core Text-based Font implementations by doing the
+        following:
+        - Generalize CoreTextController as ComplexTextController, keeping the Core Text-specific
+          parts in ComplexTextControllerCoreText.cpp.
+        - Generalize FontMacCoreText as FontComplexTextMac using ComplexTextController
+        - Implement ATSUI-specific parts of ComplexTextController in ComplexTextControllerATSUI.
+        - Remove FontMacATSUI.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed CoreTextController.{cpp,h}, FontMacATSUI.mm,
+        and FontMacCoreText.cpp, and added ComplexTextController.{cpp,h},
+        ComplexTextControllerATSUI.cpp, ComplexTextControllerCoreText.cpp, and
+        FontComplexTextMac.cpp.
+
+        * platform/graphics/mac/ComplexTextController.cpp: Copied from CoreTextController.cpp and
+        kept the non-Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextController): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::offsetForPosition): Updated for renames and for
+        m_complexTextRuns holding references instead of objects.
+        (WebCore::ComplexTextController::collectComplexTextRuns): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::advance): Updated for renames.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Updated for renames and for
+        m_complexTextRuns holding references instead of objects, and changed to use the glyphs()
+        and advances() accessors.
+
+        * platform/graphics/mac/ComplexTextController.h: Copied from CoreTextController.h and
+        renamed CoreTextController to ComplexTextController and CoreTextRun to ComplexTextRun. Made
+        the latter RefCounted, added ATSUI-specific members to it, and made some other members
+        Core Text-specific. Renamed m_coreTextRuns to m_complexTextRuns and made it hold references
+        rather than objects.
+        (WebCore::ComplexTextController::ComplexTextRun::create):
+        (WebCore::ComplexTextController::ComplexTextRun::glyphs):
+        (WebCore::ComplexTextController::ComplexTextRun::advances):
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Added. Includes ATSUI-specific
+        parts of the ComplexTextController implementation. 
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): This ATSUI
+        callback populates the ComplexTextRun’s glyphs, advances and indices vectors. It is invoked
+        when the ComplexTextRun constructor calls ATSUGetGlyphBounds().
+        (WebCore::isArabicLamWithAlefLigature): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::shapeArabic): Helper function, adapted from FontMacATSUI.mm.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Sets up the
+        ATSUTextLayout, substituting the text buffer if necessary for things like shaping Arabic,
+        mirroring glyphs or directionality overrides, then calls ATSUGetGlyphBounds() in order to
+        get the glyphs, advances and indices vectors populated.
+        (WebCore::fontHasMirroringInfo): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto, somewhat cleaned up and simplified.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Constructs
+        ComplexTextRuns, either missing-glyphs ones or ATSUTextLayout-based ones.
+
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Copied from
+        CoreTextController.cpp and kept the Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Updated for renames,
+        including its own, and moved the code to initialize m_glyphs and m_advances here. Previously
+        this was done in adjustGlyphsAndAdvances().
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Updated for renames,
+        including its own.
+        * platform/graphics/mac/CoreTextController.cpp: Removed.
+        * platform/graphics/mac/CoreTextController.h: Removed.
+        * platform/graphics/mac/FontComplexTextMac.cpp: Renamed FontMacCoreText.cpp to this.
+        (WebCore::Font::selectionRectForComplexText): Changed to use ComplexTextController instead
+        of CoreTextController.
+        (WebCore::Font::drawComplexText): Ditto.
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText): Ditto.
+        * platform/graphics/mac/FontMacATSUI.mm: Removed.
+        * platform/graphics/mac/FontMacCoreText.cpp: Removed.
+
 2009-10-27  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Darin Adler.
@@ -44,7 +16715,7 @@
         * xml/XPathFunctions.cpp:
         (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
 
-2009-10-28  Adam Barth  <abarth@webkit.org>
+2009-10-29  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
diff --git a/WebCore/Configurations/FeatureDefines.xcconfig b/WebCore/Configurations/FeatureDefines.xcconfig
index 42aa3cf..cd462d6 100644
--- a/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/WebCore/Configurations/FeatureDefines.xcconfig
@@ -44,14 +44,13 @@ ENABLE_DATAGRID = ENABLE_DATAGRID;
 ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
 ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
-ENABLE_FILTERS = ;
+ENABLE_FILTERS = ENABLE_FILTERS;
 ENABLE_GEOLOCATION = ;
 ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
 ENABLE_MATHML = ;
 ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
-ENABLE_RUBY = ENABLE_RUBY;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
@@ -67,4 +66,4 @@ ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebCore/Configurations/Version.xcconfig b/WebCore/Configurations/Version.xcconfig
index fabc009..b3bf41d 100644
--- a/WebCore/Configurations/Version.xcconfig
+++ b/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 4;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebCore/DerivedSources.cpp b/WebCore/DerivedSources.cpp
index 1edbf7d..e96b606 100644
--- a/WebCore/DerivedSources.cpp
+++ b/WebCore/DerivedSources.cpp
@@ -34,7 +34,7 @@
 #include "JSCanvasRenderingContext.cpp"
 #include "JSCanvasRenderingContext2D.cpp"
 #if ENABLE(3D_CANVAS)    
-#include "JSCanvasRenderingContext3D.cpp"
+#include "JSWebGLRenderingContext.cpp"
 #endif
 #include "JSCDATASection.cpp"
 #include "JSCharacterData.cpp"
@@ -42,6 +42,7 @@
 #include "JSClientRectList.cpp"
 #include "JSClipboard.cpp"
 #include "JSComment.cpp"
+#include "JSCompositionEvent.cpp"
 #include "JSConsole.cpp"
 #include "JSCounter.cpp"
 #include "JSCSSCharsetRule.cpp"
@@ -180,6 +181,7 @@
 #include "JSPageTransitionEvent.cpp"
 #include "JSPlugin.cpp"
 #include "JSPluginArray.cpp"
+#include "JSPopStateEvent.cpp"
 #include "JSProcessingInstruction.cpp"
 #include "JSProgressEvent.cpp"
 #include "JSRange.cpp"
diff --git a/WebCore/DerivedSources.make b/WebCore/DerivedSources.make
index fd38707..8191222 100644
--- a/WebCore/DerivedSources.make
+++ b/WebCore/DerivedSources.make
@@ -70,32 +70,34 @@ DOM_CLASSES = \
     CSSValueList \
     CSSVariablesRule \
     CSSVariablesDeclaration \
-    CanvasActiveInfo \
-    CanvasArray \
-    CanvasArrayBuffer \
-    CanvasBuffer \
-    CanvasByteArray \
-    CanvasFloatArray \
-    CanvasFramebuffer \
+    WebGLActiveInfo \
+    WebGLArray \
+    WebGLArrayBuffer \
+    WebGLBuffer \
+    WebGLByteArray \
+    WebGLFloatArray \
+    WebGLFramebuffer \
     CanvasGradient \
-    CanvasIntArray \
+    WebGLIntArray \
     CanvasPattern \
-    CanvasProgram \
-    CanvasRenderbuffer \
+    WebGLProgram \
+    WebGLRenderbuffer \
     CanvasRenderingContext \
     CanvasRenderingContext2D \
-    CanvasRenderingContext3D \
-    CanvasShader \
-    CanvasShortArray \
-    CanvasTexture \
-    CanvasUnsignedByteArray \
-    CanvasUnsignedIntArray \
-    CanvasUnsignedShortArray \
+    WebGLRenderingContext \
+    WebGLShader \
+    WebGLShortArray \
+    WebGLTexture \
+    WebGLUniformLocation \
+    WebGLUnsignedByteArray \
+    WebGLUnsignedIntArray \
+    WebGLUnsignedShortArray \
     CharacterData \
     ClientRect \
     ClientRectList \
     Clipboard \
     Comment \
+    CompositionEvent \
     Console \
     Coordinates \
     Counter \
@@ -198,7 +200,9 @@ DOM_CLASSES = \
     HTMLVideoElement \
     History \
     ImageData \
+    InjectedScriptHost \
     InspectorBackend \
+    InspectorFrontendHost \
     KeyboardEvent \
     Location \
     Media \
@@ -224,6 +228,7 @@ DOM_CLASSES = \
     PageTransitionEvent \
     Plugin \
     PluginArray \
+    PopStateEvent \
     PositionError \
     ProcessingInstruction \
     ProgressEvent \
@@ -616,10 +621,6 @@ ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
     HTML_FLAGS := $(HTML_FLAGS) ENABLE_VIDEO=1
 endif
 
-ifeq ($(findstring ENABLE_RUBY,$(FEATURE_DEFINES)), ENABLE_RUBY)
-    HTML_FLAGS := $(HTML_FLAGS) ENABLE_RUBY=1
-endif
-
 ifdef HTML_FLAGS
 
 HTMLElementFactory.cpp HTMLNames.cpp : dom/make_names.pl html/HTMLTagNames.in html/HTMLAttributeNames.in
@@ -806,9 +807,12 @@ ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Pla
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.NPAPI.exp
 endif
 
-ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep WTF_USE_PLUGIN_HOST_PROCESS | cut -d' ' -f3), 1)
+# FIXME: WTF_USE_PLUGIN_HOST_PROCESS is only true when building for x86_64, but we shouldn't have to know about that here.
+ifeq ($(findstring x86_64,$(ARCHS)) $(findstring x86_64,$(VALID_ARCHS)), x86_64 x86_64)
+ifeq ($(shell gcc -arch x86_64 -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep WTF_USE_PLUGIN_HOST_PROCESS | cut -d' ' -f3), 1)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.PluginHostProcess.exp
 endif
+endif
 
 ifeq ($(findstring ENABLE_3D_RENDERING,$(FEATURE_DEFINES)), ENABLE_3D_RENDERING)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.3DRendering.exp
diff --git a/WebCore/English.lproj/localizedStrings.js b/WebCore/English.lproj/localizedStrings.js
index 0e150f0..e18a163 100644
--- a/WebCore/English.lproj/localizedStrings.js
+++ b/WebCore/English.lproj/localizedStrings.js
diff --git a/WebCore/GNUmakefile.am b/WebCore/GNUmakefile.am
index c4560ab..f8fa302 100644
--- a/WebCore/GNUmakefile.am
+++ b/WebCore/GNUmakefile.am
@@ -115,6 +115,7 @@ IDL_BINDINGS += \
 	WebCore/dom/ClientRectList.idl \
 	WebCore/dom/Clipboard.idl \
 	WebCore/dom/Comment.idl \
+	WebCore/dom/CompositionEvent.idl \
 	WebCore/dom/DOMCoreException.idl \
 	WebCore/dom/DOMImplementation.idl \
 	WebCore/dom/Document.idl \
@@ -140,6 +141,7 @@ IDL_BINDINGS += \
 	WebCore/dom/Notation.idl \
 	WebCore/dom/OverflowEvent.idl \
 	WebCore/dom/PageTransitionEvent.idl \
+	WebCore/dom/PopStateEvent.idl \
 	WebCore/dom/ProcessingInstruction.idl \
 	WebCore/dom/ProgressEvent.idl \
 	WebCore/dom/Range.idl \
@@ -151,20 +153,20 @@ IDL_BINDINGS += \
 	WebCore/dom/WebKitAnimationEvent.idl \
 	WebCore/dom/WebKitTransitionEvent.idl \
 	WebCore/dom/WheelEvent.idl \
-	WebCore/html/canvas/CanvasArray.idl \
-	WebCore/html/canvas/CanvasArrayBuffer.idl \
-	WebCore/html/canvas/CanvasByteArray.idl \
-	WebCore/html/canvas/CanvasFloatArray.idl \
+	WebCore/html/canvas/WebGLArray.idl \
+	WebCore/html/canvas/WebGLArrayBuffer.idl \
+	WebCore/html/canvas/WebGLByteArray.idl \
+	WebCore/html/canvas/WebGLFloatArray.idl \
 	WebCore/html/canvas/CanvasGradient.idl \
-	WebCore/html/canvas/CanvasIntArray.idl \
+	WebCore/html/canvas/WebGLIntArray.idl \
 	WebCore/html/canvas/CanvasPattern.idl \
 	WebCore/html/canvas/CanvasRenderingContext.idl \
 	WebCore/html/canvas/CanvasRenderingContext2D.idl \
-	WebCore/html/canvas/CanvasRenderingContext3D.idl \
-	WebCore/html/canvas/CanvasShortArray.idl \
-	WebCore/html/canvas/CanvasUnsignedByteArray.idl \
-	WebCore/html/canvas/CanvasUnsignedIntArray.idl \
-	WebCore/html/canvas/CanvasUnsignedShortArray.idl \
+	WebCore/html/canvas/WebGLRenderingContext.idl \
+	WebCore/html/canvas/WebGLShortArray.idl \
+	WebCore/html/canvas/WebGLUnsignedByteArray.idl \
+	WebCore/html/canvas/WebGLUnsignedIntArray.idl \
+	WebCore/html/canvas/WebGLUnsignedShortArray.idl \
 	WebCore/html/DataGridColumn.idl \
 	WebCore/html/DataGridColumnList.idl \
 	WebCore/html/File.idl \
@@ -245,7 +247,9 @@ IDL_BINDINGS += \
 	WebCore/html/ValidityState.idl \
 	WebCore/html/VoidCallback.idl \
 	WebCore/inspector/JavaScriptCallFrame.idl \
+	WebCore/inspector/InjectedScriptHost.idl \
 	WebCore/inspector/InspectorBackend.idl \
+	WebCore/inspector/InspectorFrontendHost.idl \
 	WebCore/notifications/Notification.idl \
 	WebCore/notifications/NotificationCenter.idl \
 	WebCore/page/BarInfo.idl \
@@ -372,7 +376,7 @@ webcore_sources += \
 	WebCore/bindings/js/JSExceptionBase.h \
 	WebCore/bindings/js/JSGeolocationCustom.cpp \
 	WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp \
- 	WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
+	WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLAppletElementCustom.h \
 	WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLCollectionCustom.cpp \
@@ -397,7 +401,8 @@ webcore_sources += \
 	WebCore/bindings/js/JSImageConstructor.cpp \
 	WebCore/bindings/js/JSImageConstructor.h \
 	WebCore/bindings/js/JSImageDataCustom.cpp \
-	WebCore/bindings/js/JSInspectorBackendCustom.cpp \
+	WebCore/bindings/js/JSInjectedScriptHostCustom.cpp \
+	WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp \
 	WebCore/bindings/js/JSInspectedObjectWrapper.cpp \
 	WebCore/bindings/js/JSInspectedObjectWrapper.h \
 	WebCore/bindings/js/JSInspectorCallbackWrapper.cpp \
@@ -428,6 +433,8 @@ webcore_sources += \
 	WebCore/bindings/js/JSPluginCustom.cpp \
 	WebCore/bindings/js/JSPluginElementFunctions.cpp \
 	WebCore/bindings/js/JSPluginElementFunctions.h \
+	WebCore/bindings/js/JSPopStateEventCustom.cpp \
+	WebCore/bindings/js/JSPopStateEventCustom.h \
 	WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp \
 	WebCore/bindings/js/JSQuarantinedObjectWrapper.h \
 	WebCore/bindings/js/JSStorageCustom.h \
@@ -465,8 +472,6 @@ webcore_sources += \
 	WebCore/bindings/js/ScriptInstance.h \
 	WebCore/bindings/js/ScriptObject.cpp \
 	WebCore/bindings/js/ScriptObject.h \
-	WebCore/bindings/js/ScriptObjectQuarantine.cpp \
-	WebCore/bindings/js/ScriptObjectQuarantine.h \
 	WebCore/bindings/js/ScriptSourceCode.h \
 	WebCore/bindings/js/ScriptSourceProvider.h \
 	WebCore/bindings/js/ScriptState.cpp \
@@ -663,8 +668,6 @@ webcore_sources += \
 	WebCore/dom/CheckedRadioButtons.h \
 	WebCore/dom/ChildNodeList.cpp \
 	WebCore/dom/ChildNodeList.h \
-	WebCore/dom/ClassNames.cpp \
-	WebCore/dom/ClassNames.h \
 	WebCore/dom/ClassNodeList.cpp \
 	WebCore/dom/ClassNodeList.h \
 	WebCore/dom/ClientRect.cpp \
@@ -678,6 +681,8 @@ webcore_sources += \
 	WebCore/dom/ClipboardEvent.h \
 	WebCore/dom/Comment.cpp \
 	WebCore/dom/Comment.h \
+	WebCore/dom/CompositionEvent.cpp \
+	WebCore/dom/CompositionEvent.h \
 	WebCore/dom/ContainerNode.cpp \
 	WebCore/dom/ContainerNode.h \
 	WebCore/dom/ContainerNodeAlgorithms.h \
@@ -768,6 +773,8 @@ webcore_sources += \
 	WebCore/dom/PageTransitionEvent.h \
 	WebCore/dom/Position.cpp \
 	WebCore/dom/Position.h \
+	WebCore/dom/PopStateEvent.cpp \
+	WebCore/dom/PopStateEvent.h \
 	WebCore/dom/PositionIterator.cpp \
 	WebCore/dom/PositionIterator.h \
 	WebCore/dom/ProcessingInstruction.cpp \
@@ -790,6 +797,8 @@ webcore_sources += \
 	WebCore/dom/SelectElement.h \
 	WebCore/dom/SelectorNodeList.cpp \
 	WebCore/dom/SelectorNodeList.h \
+	WebCore/dom/SpaceSplitString.cpp \
+	WebCore/dom/SpaceSplitString.h \
 	WebCore/dom/StaticNodeList.cpp \
 	WebCore/dom/StaticNodeList.h \
 	WebCore/dom/StyleElement.cpp \
@@ -1126,6 +1135,8 @@ webcore_sources += \
 	WebCore/html/HTMLUListElement.h \
 	WebCore/html/HTMLViewSourceDocument.cpp \
 	WebCore/html/HTMLViewSourceDocument.h \
+	WebCore/html/ISODateTime.cpp \
+	WebCore/html/ISODateTime.h \
 	WebCore/html/ImageData.cpp \
 	WebCore/html/ImageData.h \
 	WebCore/html/MediaError.h \
@@ -1164,6 +1175,8 @@ webcore_sources += \
 	WebCore/icu/unicode/uversion.h \
 	WebCore/inspector/ConsoleMessage.cpp \
 	WebCore/inspector/ConsoleMessage.h \
+	WebCore/inspector/InjectedScriptHost.cpp \
+	WebCore/inspector/InjectedScriptHost.h \
 	WebCore/inspector/InspectorBackend.cpp \
 	WebCore/inspector/InspectorBackend.h \
 	WebCore/inspector/InspectorDatabaseResource.cpp \
@@ -1177,6 +1190,8 @@ webcore_sources += \
 	WebCore/inspector/InspectorController.h \
 	WebCore/inspector/InspectorFrontend.cpp \
 	WebCore/inspector/InspectorFrontend.h \
+	WebCore/inspector/InspectorFrontendHost.cpp \
+	WebCore/inspector/InspectorFrontendHost.h \
 	WebCore/inspector/InspectorResource.cpp \
 	WebCore/inspector/InspectorResource.h \
 	WebCore/inspector/InspectorTimelineAgent.cpp \
@@ -1303,6 +1318,7 @@ webcore_sources += \
 	WebCore/page/ContextMenuClient.h \
 	WebCore/page/ContextMenuController.cpp \
 	WebCore/page/ContextMenuController.h \
+	WebCore/page/ContextMenuSelectionHandler.h \
 	WebCore/page/Coordinates.h \
 	WebCore/page/DOMSelection.cpp \
 	WebCore/page/DOMSelection.h \
@@ -1484,6 +1500,7 @@ webcore_sources += \
 	WebCore/platform/graphics/BitmapImage.h \
 	WebCore/platform/graphics/Color.cpp \
 	WebCore/platform/graphics/Color.h \
+	WebCore/platform/graphics/ColorSpace.h \
 	WebCore/platform/graphics/DashArray.h \
 	WebCore/platform/graphics/FloatPoint.cpp \
 	WebCore/platform/graphics/FloatPoint.h \
@@ -1583,6 +1600,7 @@ webcore_sources += \
 	WebCore/platform/graphics/transforms/TranslateTransformOperation.h \
 	WebCore/platform/network/AuthenticationChallengeBase.cpp \
 	WebCore/platform/network/AuthenticationChallengeBase.h \
+	WebCore/platform/network/AuthenticationClient.h \
 	WebCore/platform/network/Credential.cpp \
 	WebCore/platform/network/Credential.h \
 	WebCore/platform/network/DNS.h \
@@ -1634,14 +1652,10 @@ webcore_sources += \
 	WebCore/platform/text/StringImpl.cpp \
 	WebCore/platform/text/StringImpl.h \
 	WebCore/platform/text/TextBoundaries.h \
-	WebCore/platform/text/TextBoundariesICU.cpp \
+	WebCore/platform/text/TextBoundaries.cpp \
 	WebCore/platform/text/TextBreakIterator.h \
-	WebCore/platform/text/TextBreakIteratorICU.cpp \
-	WebCore/platform/text/TextBreakIteratorInternalICU.h \
 	WebCore/platform/text/TextCodec.cpp \
 	WebCore/platform/text/TextCodec.h \
-	WebCore/platform/text/TextCodecICU.cpp \
-	WebCore/platform/text/TextCodecICU.h \
 	WebCore/platform/text/TextCodecLatin1.cpp \
 	WebCore/platform/text/TextCodecLatin1.h \
 	WebCore/platform/text/TextCodecUTF16.cpp \
@@ -1775,6 +1789,14 @@ webcore_sources += \
 	WebCore/rendering/RenderReplaced.h \
 	WebCore/rendering/RenderReplica.cpp \
 	WebCore/rendering/RenderReplica.h \
+	WebCore/rendering/RenderRuby.cpp \
+	WebCore/rendering/RenderRuby.h \
+	WebCore/rendering/RenderRubyBase.cpp \
+	WebCore/rendering/RenderRubyBase.h \
+	WebCore/rendering/RenderRubyRun.cpp \
+	WebCore/rendering/RenderRubyRun.h \
+	WebCore/rendering/RenderRubyText.cpp \
+	WebCore/rendering/RenderRubyText.h \
 	WebCore/rendering/RenderScrollbar.cpp \
 	WebCore/rendering/RenderScrollbar.h \
 	WebCore/rendering/RenderScrollbarPart.cpp \
@@ -1845,6 +1867,7 @@ webcore_sources += \
 	WebCore/rendering/style/FillLayer.h \
 	WebCore/rendering/style/KeyframeList.cpp \
 	WebCore/rendering/style/KeyframeList.h \
+	WebCore/rendering/style/LineClampValue.h \
 	WebCore/rendering/style/NinePieceImage.cpp \
 	WebCore/rendering/style/NinePieceImage.h \
 	WebCore/rendering/style/OutlineValue.h \
@@ -2010,9 +2033,31 @@ webcoregtk_sources += \
 	WebCore/platform/network/soup/ResourceResponseSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequest.h \
 	WebCore/platform/network/soup/ResourceResponse.h \
-	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp \
 	WebCore/workers/SharedWorkerRepository.h
 
+# ----
+# icu unicode backend
+# ----
+if USE_ICU_UNICODE
+webcoregtk_sources += \
+	WebCore/platform/text/TextCodecICU.cpp \
+	WebCore/platform/text/TextCodecICU.h \
+	WebCore/platform/text/TextBreakIteratorICU.cpp \
+	WebCore/platform/text/TextBreakIteratorInternalICU.h \
+	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp
+endif
+
+# ----
+# glib unicode backend
+# ----
+if USE_GLIB_UNICODE
+webcoregtk_sources += \
+	WebCore/platform/text/gtk/TextCodecGtk.cpp \
+	WebCore/platform/text/gtk/TextCodecGtk.h \
+	WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
+endif
+
+
 # ---
 # Channel mesaging support
 # ---
@@ -2069,6 +2114,10 @@ FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
 webcore_cppflags += \
 	-DENABLE_JAVASCRIPT_DEBUGGER=1
 
+else
+webcore_cppflags += \
+	-DENABLE_JAVASCRIPT_DEBUGGER=0
+
 endif # END ENABLE_JAVASCRIPT_DEBUGGER
 
 # ----
@@ -2349,16 +2398,6 @@ webcore_libadd += \
 endif # END ENABLE_VIDEO
 
 # ----
-# Ruby Support
-# ----
-if ENABLE_RUBY
-
-HTML_FEATURES += ENABLE_RUBY=1
-webcore_cppflags += -DENABLE_RUBY=1
-
-endif # END ENABLE_RUBY
-
-# ----
 # XPath Support
 # ----
 if ENABLE_XPATH
@@ -2607,6 +2646,8 @@ webcore_sources += \
 	WebCore/platform/graphics/filters/Filter.h \
 	WebCore/platform/graphics/filters/FilterEffect.cpp \
 	WebCore/platform/graphics/filters/FilterEffect.h \
+	WebCore/platform/graphics/filters/ImageBufferFilter.cpp \
+	WebCore/platform/graphics/filters/ImageBufferFilter.h \
 	WebCore/platform/graphics/filters/SourceAlpha.cpp \
 	WebCore/platform/graphics/filters/SourceAlpha.h \
 	WebCore/platform/graphics/filters/SourceGraphic.cpp \
diff --git a/WebCore/WebCore.DragSupport.exp b/WebCore/WebCore.DragSupport.exp
index 2cfd076..30786ba 100644
--- a/WebCore/WebCore.DragSupport.exp
+++ b/WebCore/WebCore.DragSupport.exp
@@ -1,5 +1,4 @@
 __ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
-__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
 __ZN7WebCore12EventHandler17eventMayStartDragEP7NSEvent
 __ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
 __ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
diff --git a/WebCore/WebCore.Inspector.exp b/WebCore/WebCore.Inspector.exp
index 576994f..379b7a2 100644
--- a/WebCore/WebCore.Inspector.exp
+++ b/WebCore/WebCore.Inspector.exp
@@ -1,4 +1,4 @@
-__ZN7WebCore19InspectorController10setSettingERKNS_6StringERKNS0_7SettingE
+__ZN7WebCore19InspectorController10setSettingERKNS_6StringES3_
 __ZN7WebCore19InspectorController12attachWindowEv
 __ZN7WebCore19InspectorController12detachWindowEv
 __ZN7WebCore19InspectorController14enableDebuggerEv
@@ -16,3 +16,5 @@ __ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKNS_6StringE
 __ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
 __ZNK7WebCore19InspectorController7enabledEv
 __ZNK7WebCore19InspectorController7settingERKNS_6StringE
+__ZN7WebCore19InspectorController21startTimelineProfilerEv
+__ZN7WebCore19InspectorController20stopTimelineProfilerEv
diff --git a/WebCore/WebCore.Video.exp b/WebCore/WebCore.Video.exp
index 5d35698..57619b4 100644
--- a/WebCore/WebCore.Video.exp
+++ b/WebCore/WebCore.Video.exp
@@ -1,14 +1,16 @@
+__ZN7WebCore16HTMLMediaElement10screenRectEv
+__ZN7WebCore16HTMLMediaElement12endScrubbingEv
+__ZN7WebCore16HTMLMediaElement14beginScrubbingEv
+__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
 __ZN7WebCore16HTMLMediaElement4playEv
 __ZN7WebCore16HTMLMediaElement5pauseEv
-__ZNK7WebCore16HTMLMediaElement6volumeEv
-__ZNK7WebCore16HTMLMediaElement7canPlayEv
-__ZNK7WebCore16HTMLMediaElement8durationEv
-__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore16HTMLMediaElement6rewindEf
 __ZN7WebCore16HTMLMediaElement8setMutedEb
 __ZN7WebCore16HTMLMediaElement9setVolumeEfRi
-__ZN7WebCore16HTMLMediaElement6rewindEf
-__ZN7WebCore16HTMLMediaElement10screenRectEv
 __ZNK7WebCore16HTMLMediaElement11currentTimeEv
 __ZNK7WebCore16HTMLMediaElement13platformMediaEv
-__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
-__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
diff --git a/WebCore/WebCore.base.exp b/WebCore/WebCore.base.exp
index a8bed54..8df5524 100644
--- a/WebCore/WebCore.base.exp
+++ b/WebCore/WebCore.base.exp
@@ -145,6 +145,7 @@ __ZN7WebCore10StringImplcvP8NSStringEv
 __ZN7WebCore10StringImpldlEPv
 __ZN7WebCore10handCursorEv
 __ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLERKNS_6StringE
+__ZN7WebCore11BitmapImageC1EP7CGImagePNS_13ImageObserverE
 __ZN7WebCore11CachedFrame23cachedFramePlatformDataEv
 __ZN7WebCore11CachedFrame26setCachedFramePlatformDataEPNS_23CachedFramePlatformDataE
 __ZN7WebCore11EditCommand7reapplyEv
@@ -157,7 +158,6 @@ __ZN7WebCore11FrameLoader11loadArchiveEN3WTF10PassRefPtrINS_7ArchiveEEE
 __ZN7WebCore11FrameLoader11setEncodingERKNS_6StringEb
 __ZN7WebCore11FrameLoader12shouldReloadERKNS_4KURLES3_
 __ZN7WebCore11FrameLoader14detachChildrenEv
-__ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
 __ZN7WebCore11FrameLoader14stopAllLoadersENS_14DatabasePolicyE
 __ZN7WebCore11FrameLoader16detachFromParentEv
 __ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEENS_14ReferrerPolicyE
@@ -248,6 +248,7 @@ __ZN7WebCore12IconDatabase4openERKNS_6StringE
 __ZN7WebCore12IconDatabase5closeEv
 __ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
 __ZN7WebCore12RenderObject16repaintRectangleERKNS_7IntRectEb
+__ZN7WebCore12RenderWidget19showSubstituteImageEN3WTF10PassRefPtrINS_5ImageEEE
 __ZN7WebCore12SchedulePairC1EP9NSRunLoopPK10__CFString
 __ZN7WebCore12SharedBuffer10wrapNSDataEP6NSData
 __ZN7WebCore12SharedBuffer12createNSDataEv
@@ -282,7 +283,6 @@ __ZN7WebCore14DocumentLoader21addPlugInStreamLoaderEPNS_14ResourceLoaderE
 __ZN7WebCore14DocumentLoader22addAllArchiveResourcesEPNS_7ArchiveE
 __ZN7WebCore14DocumentLoader22cancelMainResourceLoadERKNS_13ResourceErrorE
 __ZN7WebCore14DocumentLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore14DocumentLoader32replaceRequestURLForAnchorScrollERKNS_4KURLE
 __ZN7WebCore14DocumentLoader7requestEv
 __ZN7WebCore14DocumentLoader8setFrameEPNS_5FrameE
 __ZN7WebCore14DocumentLoader8setTitleERKNS_6StringE
@@ -324,6 +324,7 @@ __ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
 __ZN7WebCore15BackForwardList9goForwardEv
 __ZN7WebCore15BackForwardListC1EPNS_4PageE
 __ZN7WebCore15BackForwardListD1Ev
+__ZN7WebCore15DOMWrapperWorldD1Ev
 __ZN7WebCore15DatabaseTracker12deleteOriginEPNS_14SecurityOriginE
 __ZN7WebCore15DatabaseTracker14deleteDatabaseEPNS_14SecurityOriginERKNS_6StringE
 __ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
@@ -341,7 +342,7 @@ __ZN7WebCore15FocusController15setFocusedFrameEN3WTF10PassRefPtrINS_5FrameEEE
 __ZN7WebCore15FocusController15setInitialFocusENS_14FocusDirectionEPNS_13KeyboardEventE
 __ZN7WebCore15FocusController18focusedOrMainFrameEv
 __ZN7WebCore15FocusController9setActiveEb
-__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorE
+__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorENS_10ColorSpaceE
 __ZN7WebCore15GraphicsContextC1EP9CGContext
 __ZN7WebCore15GraphicsContextD1Ev
 __ZN7WebCore15JSDOMWindowBase18commonJSGlobalDataEv
@@ -370,10 +371,10 @@ __ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEb
 __ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
 __ZN7WebCore16NavigationActionC1Ev
 __ZN7WebCore16ScriptController10initScriptEPNS_15DOMWrapperWorldE
-__ZN7WebCore16ScriptController12globalObjectEj
+__ZN7WebCore16ScriptController11createWorldEv
 __ZN7WebCore16ScriptController13executeScriptERKNS_6StringEb
 __ZN7WebCore16ScriptController18windowScriptObjectEv
-__ZN7WebCore16ScriptController28executeScriptInIsolatedWorldEjRKNS_6StringEb
+__ZN7WebCore16ScriptController20executeScriptInWorldEPNS_15DOMWrapperWorldERKNS_6StringEb
 __ZN7WebCore16VisibleSelectionC1EPKNS_5RangeENS_9EAffinityE
 __ZN7WebCore16VisibleSelectionC1ERKNS_15VisiblePositionES3_
 __ZN7WebCore16colorFromNSColorEP7NSColor
@@ -385,16 +386,15 @@ __ZN7WebCore16threadGlobalDataEv
 __ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
 __ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
 __ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
-__ZN7WebCore17HistoryController26saveDocumentAndScrollStateEv
 __ZN7WebCore17HTMLPlugInElement11getNPObjectEv
-__ZN7WebCore21mainThreadNormalWorldEv
+__ZN7WebCore17HistoryController26saveDocumentAndScrollStateEv
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
 __ZN7WebCore18deprecatedParseURLERKNS_6StringE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
+__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
 __ZN7WebCore19AnimationController20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
 __ZN7WebCore19AnimationController21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
-__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
-__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
 __ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
 __ZN7WebCore19SelectionController10setFocusedEb
 __ZN7WebCore19SelectionController12setSelectionERKNS_16VisibleSelectionEbbb
@@ -414,9 +414,13 @@ __ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
 __ZN7WebCore21JavaScriptDebugServer6sharedEv
 __ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
 __ZN7WebCore21PlatformKeyboardEventC1EP7NSEvent
+__ZN7WebCore21SerializedScriptValue11deserializeEPK15OpaqueJSContextPPK13OpaqueJSValue
+__ZN7WebCore21SerializedScriptValue6createEPK15OpaqueJSContextPK13OpaqueJSValuePS6_
+__ZN7WebCore21SerializedScriptValueD1Ev
 __ZN7WebCore21WindowsLatin1EncodingEv
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
 __ZN7WebCore21isBackForwardLoadTypeENS_13FrameLoadTypeE
+__ZN7WebCore21mainThreadNormalWorldEv
 __ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
 __ZN7WebCore22GeolocationServiceMock11setPositionEN3WTF10PassRefPtrINS_11GeopositionEEE
 __ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErrorEEE
@@ -424,7 +428,7 @@ __ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
 __ZN7WebCore22applicationIsAppleMailEv
 __ZN7WebCore22counterValueForElementEPNS_7ElementE
 __ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
-__ZN7WebCore22externalRepresentationEPNS_12RenderObjectE
+__ZN7WebCore22externalRepresentationEPNS_5FrameE
 __ZN7WebCore23ApplicationCacheStorage14setMaximumSizeEx
 __ZN7WebCore23ApplicationCacheStorage16storeCopyOfCacheERKNS_6StringEPNS_20ApplicationCacheHostE
 __ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKNS_6StringE
@@ -457,7 +461,6 @@ __ZN7WebCore31applicationIsMicrosoftMessengerEv
 __ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjb
 __ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
 __ZN7WebCore36InitializeLoggingChannelsIfNecessaryEv
-__ZN7WebCore33DebuggerCallFrame_evaluateInWorldERKN3JSC17DebuggerCallFrameERKNS0_7UStringERNS0_7JSValueE
 __ZN7WebCore3macERKNS_10CredentialE
 __ZN7WebCore3macERKNS_23AuthenticationChallengeE
 __ZN7WebCore4Font11setCodePathENS0_8CodePathE
@@ -473,6 +476,8 @@ __ZN7WebCore4KURLC1EP5NSURL
 __ZN7WebCore4Node17stopIgnoringLeaksEv
 __ZN7WebCore4Node18startIgnoringLeaksEv
 __ZN7WebCore4Page12setGroupNameERKNS_6StringE
+__ZN7WebCore4Page13didStopPluginEPNS_14HaltablePluginE
+__ZN7WebCore4Page14didStartPluginEPNS_14HaltablePluginE
 __ZN7WebCore4Page14setMediaVolumeEf
 __ZN7WebCore4Page15addSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
 __ZN7WebCore4Page15backForwardListEv
@@ -607,6 +612,7 @@ __ZN7WebCore8FormDataD1Ev
 __ZN7WebCore8IntPointC1ERK8_NSPoint
 __ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
 __ZN7WebCore8Settings14setJavaEnabledEb
+__ZN7WebCore8Settings15setWebGLEnabledEb
 __ZN7WebCore8Settings16setUsesPageCacheEb
 __ZN7WebCore8Settings16setZoomsTextOnlyEb
 __ZN7WebCore8Settings17setPluginsEnabledEb
@@ -616,18 +622,21 @@ __ZN7WebCore8Settings18setFixedFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings18setMinimumFontSizeEi
 __ZN7WebCore8Settings18setSerifFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings19setDatabasesEnabledEb
+__ZN7WebCore8Settings19setShowDebugBordersEb
 __ZN7WebCore8Settings20setCursiveFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings20setFantasyFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings20setJavaScriptEnabledEb
 __ZN7WebCore8Settings20setXSSAuditorEnabledEb
 __ZN7WebCore8Settings21setStandardFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings21setWebSecurityEnabledEb
+__ZN7WebCore8Settings21setShowRepaintCounterEb
 __ZN7WebCore8Settings22setLocalStorageEnabledEb
 __ZN7WebCore8Settings22setSansSerifFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings22setShowsURLsInToolTipsEb
 __ZN7WebCore8Settings23setDefaultFixedFontSizeEi
 __ZN7WebCore8Settings23setEditableLinkBehaviorENS_20EditableLinkBehaviorE
 __ZN7WebCore8Settings23setNeedsTigerMailQuirksEb
+__ZN7WebCore8Settings23setPluginAllowedRunTimeEj
 __ZN7WebCore8Settings23setUsesEncodingDetectorEb
 __ZN7WebCore8Settings24setApplicationChromeModeEb
 __ZN7WebCore8Settings24setTextAreasAreResizableEb
@@ -639,7 +648,6 @@ __ZN7WebCore8Settings25setShouldPrintBackgroundsEb
 __ZN7WebCore8Settings25setUserStyleSheetLocationERKNS_4KURLE
 __ZN7WebCore8Settings26setDefaultTextEncodingNameERKNS_6StringE
 __ZN7WebCore8Settings26setNeedsSiteSpecificQuirksEb
-__ZN7WebCore8Settings15setWebGLEnabledEb
 __ZN7WebCore8Settings27setFTPDirectoryTemplatePathERKNS_6StringE
 __ZN7WebCore8Settings27setLoadsImagesAutomaticallyEb
 __ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
@@ -680,14 +688,15 @@ __ZN7WebCore9FrameView15setMarginHeightEi
 __ZN7WebCore9FrameView16adjustPageHeightEPffff
 __ZN7WebCore9FrameView18updateControlTintsEv
 __ZN7WebCore9FrameView21flushDeferredRepaintsEv
+__ZN7WebCore9FrameView21scrollPositionChangedEv
 __ZN7WebCore9FrameView22setBaseBackgroundColorENS_5ColorE
 __ZN7WebCore9FrameView23layoutIfNeededRecursiveEv
+__ZN7WebCore9FrameView23updateCanHaveScrollbarsEv
 __ZN7WebCore9FrameView29forceLayoutWithPageWidthRangeEffb
 __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
 __ZN7WebCore9FrameView29syncCompositingStateRecursiveEv
 __ZN7WebCore9FrameView6createEPNS_5FrameE
 __ZN7WebCore9FrameView6createEPNS_5FrameERKNS_7IntSizeE
-__ZN7WebCore9FrameView21scrollPositionChangedEv
 __ZN7WebCore9HTMLNames10listingTagE
 __ZN7WebCore9HTMLNames11textareaTagE
 __ZN7WebCore9HTMLNames13blockquoteTagE
@@ -726,16 +735,16 @@ __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
 __ZN7WebCore9PageGroup14addVisitedLinkEPKtm
 __ZN7WebCore9PageGroup17closeLocalStorageEv
+__ZN7WebCore9PageGroup20addUserScriptToWorldEPNS_15DOMWrapperWorldERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS9_6VectorIS3_Lm0EEEEESD_NS_23UserScriptInjectionTimeE
 __ZN7WebCore9PageGroup20removeAllUserContentEv
 __ZN7WebCore9PageGroup21removeAllVisitedLinksEv
+__ZN7WebCore9PageGroup24addUserStyleSheetToWorldEPNS_15DOMWrapperWorldERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS9_6VectorIS3_Lm0EEEEESD_
+__ZN7WebCore9PageGroup25removeUserScriptFromWorldEPNS_15DOMWrapperWorldERKNS_4KURLE
+__ZN7WebCore9PageGroup26removeUserScriptsFromWorldEPNS_15DOMWrapperWorldE
 __ZN7WebCore9PageGroup26setShouldTrackVisitedLinksEb
+__ZN7WebCore9PageGroup29removeUserStyleSheetFromWorldEPNS_15DOMWrapperWorldERKNS_4KURLE
+__ZN7WebCore9PageGroup30removeUserStyleSheetsFromWorldEPNS_15DOMWrapperWorldE
 __ZN7WebCore9PageGroup9pageGroupERKNS_6StringE
-__ZN7WebCore9PageGroup25removeUserScriptFromWorldEjRKNS_4KURLE
-__ZN7WebCore9PageGroup29removeUserStyleSheetFromWorldEjRKNS_4KURLE
-__ZN7WebCore9PageGroup26removeUserScriptsFromWorldEj
-__ZN7WebCore9PageGroup24addUserStyleSheetToWorldEjRKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_
-__ZN7WebCore9PageGroup20addUserScriptToWorldEjRKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_NS_23UserScriptInjectionTimeE
-__ZN7WebCore9PageGroup30removeUserStyleSheetsFromWorldEj
 __ZN7WebCore9TimerBase4stopEv
 __ZN7WebCore9TimerBase5startEdd
 __ZN7WebCore9TimerBaseC2Ev
@@ -884,7 +893,7 @@ __ZNK7WebCore5Frame15selectionBoundsEb
 __ZNK7WebCore5Frame16inViewSourceModeEv
 __ZNK7WebCore5Frame17firstRectForRangeEPNS_5RangeE
 __ZNK7WebCore5Frame18documentTypeStringEv
-__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEEb
+__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEENS0_30SelectionRectRespectTransformsEb
 __ZNK7WebCore5Frame20selectionGranularityEv
 __ZNK7WebCore5Frame30applyEditingStyleToBodyElementEv
 __ZNK7WebCore5Frame31fontAttributesForSelectionStartEv
@@ -901,6 +910,7 @@ __ZNK7WebCore5Frame8documentEv
 __ZNK7WebCore5Frame8settingsEv
 __ZNK7WebCore5Frame9animationEv
 __ZNK7WebCore5Frame9domWindowEv
+__ZNK7WebCore5Frame9nodeImageEPNS_4NodeE
 __ZNK7WebCore5Frame9selectionEv
 __ZNK7WebCore5Range11startOffsetERi
 __ZNK7WebCore5Range12endContainerERi
@@ -951,15 +961,12 @@ __ZNK7WebCore8Document31displayStringModifiedByEncodingERKNS_6StringE
 __ZNK7WebCore8Document4bodyEv
 __ZNK7WebCore8Document6domainEv
 __ZNK7WebCore8IntPointcv8_NSPointEv
-__ZNK7WebCore8Position10downstreamEv
 __ZNK7WebCore8Position25leadingWhitespacePositionENS_9EAffinityEb
 __ZNK7WebCore8Position26trailingWhitespacePositionENS_9EAffinityEb
-__ZNK7WebCore8Position8upstreamEv
+__ZNK7WebCore8Position10downstreamENS0_27EditingBoundaryCrossingRuleE
+__ZNK7WebCore8Position8upstreamENS0_27EditingBoundaryCrossingRuleE
 __ZNK7WebCore9DOMWindow27pendingUnloadEventListenersEv
 __ZNK7WebCore9FloatRectcv7_NSRectEv
-__ZNK7WebCore5Frame9nodeImageEPNS_4NodeE
-__ZN7WebCore12RenderWidget19showSubstituteImageEN3WTF10PassRefPtrINS_5ImageEEE
-__ZN7WebCore11BitmapImageC1EP7CGImagePNS_13ImageObserverE
 __ZNK7WebCore9FrameTree12traverseNextEPKNS_5FrameE
 __ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
 __ZNK7WebCore9FrameTree20traverseNextWithWrapEb
@@ -975,9 +982,10 @@ __ZTVN7WebCore12ChromeClientE
 __ZTVN7WebCore17FileChooserClientE
 __ZTVN7WebCore17FrameLoaderClientE
 __ZTVN7WebCore25HistoryPropertyListWriterE
-__ZN7WebCore4Page13didStopPluginEPNS_14HaltablePluginE
-__ZN7WebCore4Page14didStartPluginEPNS_14HaltablePluginE
-__ZN7WebCore8Settings23setPluginAllowedRunTimeEj
+__ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
+__ZN7WebCore21SVGDocumentExtensions21sampleAnimationAtTimeERKNS_6StringEPNS_14SVGSMILElementEd
+__ZN7WebCore8Document19accessSVGExtensionsEv
+__ZN7WebCore8Document13svgExtensionsEv
 _filenameByFixingIllegalCharacters
 _hasCaseInsensitiveSubstring
 _hasCaseInsensitiveSuffix
@@ -986,6 +994,7 @@ _stringIsCaseInsensitiveEqualToString
 _suggestedFilenameWithMIMEType
 _wkAdvanceDefaultButtonPulseAnimation
 _wkCGContextGetShouldSmoothFonts
+_wkCopyCONNECTProxyResponse
 _wkCreateCustomCFReadStream
 _wkCreateNSURLConnectionDelegateProxy
 _wkCreateURLNPasteboardFlavorTypeName
@@ -1012,15 +1021,20 @@ _wkHitTestMediaUIPart
 _wkInitializeMaximumHTTPConnectionCountPerHost
 _wkIsLatchingWheelEvent
 _wkMeasureMediaUIPart
+_wkMediaControllerThemeAvailable
 _wkPopupMenu
 _wkQTIncludeOnlyModernMediaFileTypes
 _wkQTMovieDataRate
 _wkQTMovieGetType
+_wkQTMovieHasClosedCaptions
 _wkQTMovieMaxTimeLoaded
 _wkQTMovieMaxTimeLoadedChangeNotification
 _wkQTMovieMaxTimeSeekable
+_wkQTMovieSetShowClosedCaptions
 _wkQTMovieViewSetDrawSynchronously
 _wkSetCGFontRenderingMode
+_wkSetCONNECTProxyAuthorizationForStream
+_wkSetCONNECTProxyForStream
 _wkSetDragImage
 _wkSetNSURLConnectionDefersCallbacks
 _wkSetNSURLRequestShouldContentSniff
diff --git a/WebCore/WebCore.gyp/WebCore.gyp b/WebCore/WebCore.gyp/WebCore.gyp
index 055e3cb..374d01b 100644
--- a/WebCore/WebCore.gyp/WebCore.gyp
+++ b/WebCore/WebCore.gyp/WebCore.gyp
@@ -130,6 +130,7 @@
       '../platform/chromium',
       '../platform/graphics',
       '../platform/graphics/chromium',
+      '../platform/graphics/filters',
       '../platform/graphics/opentype',
       '../platform/graphics/skia',
       '../platform/graphics/transforms',
@@ -148,12 +149,15 @@
       '../platform/sql',
       '../platform/text',
       '../plugins',
+      '../plugins/chromium',
       '../rendering',
       '../rendering/style',
       '../storage',
+      '../storage/chromium',
       '../svg',
       '../svg/animation',
       '../svg/graphics',
+      '../svg/graphics/filters',
       '../websockets',
       '../workers',
       '../xml',
@@ -212,11 +216,6 @@
         # idl rule
         '<@(webcore_bindings_idl_files)',
       ],
-      'sources/': [
-        # SVG_FILTERS only.
-        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.idl$'],
-
-      ],
       'sources!': [
         # Custom bindings in bindings/v8/custom exist for these.
         '../dom/EventListener.idl',
@@ -226,13 +225,6 @@
         # JSC-only.
         '../inspector/JavaScriptCallFrame.idl',
 
-        # ENABLE_GEOLOCATION only.
-        '../page/Geolocation.idl',
-        '../page/Geoposition.idl',
-        '../page/PositionCallback.idl',
-        '../page/PositionError.idl',
-        '../page/PositionErrorCallback.idl',
-
         # Bindings with custom Objective-C implementations.
         '../page/AbstractView.idl',
 
@@ -240,7 +232,6 @@
         # Extra SVG bindings to exclude.
         '../svg/ElementTimeControl.idl',
         '../svg/SVGAnimatedPathData.idl',
-        '../svg/SVGComponentTransferFunctionElement.idl',
         '../svg/SVGExternalResourcesRequired.idl',
         '../svg/SVGFitToViewBox.idl',
         '../svg/SVGHKernElement.idl',
@@ -272,7 +263,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_csspropertynames.py',
+            'scripts/action_csspropertynames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)'
@@ -291,7 +282,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_cssvaluekeywords.py',
+            'scripts/action_cssvaluekeywords.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)'
@@ -314,7 +305,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            'scripts/action_makenames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)',
@@ -341,7 +332,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            'scripts/action_makenames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)',
@@ -370,7 +361,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_useragentstylesheets.py',
+            'scripts/action_useragentstylesheets.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)'
@@ -388,7 +379,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            'scripts/action_makenames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)',
@@ -408,7 +399,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            'scripts/action_makenames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)',
@@ -427,7 +418,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_maketokenizer.py',
+            'scripts/action_maketokenizer.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)'
@@ -445,7 +436,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/rule_bison.py',
+            'scripts/rule_bison.py',
             '<(RULE_INPUT_PATH)',
             '<(SHARED_INTERMEDIATE_DIR)/webkit'
           ],
@@ -468,7 +459,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/rule_gperf.py',
+            'scripts/rule_gperf.py',
             '<(RULE_INPUT_PATH)',
             '<(SHARED_INTERMEDIATE_DIR)/webkit'
           ],
@@ -513,7 +504,7 @@
           # behavior, change the output location.
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/rule_binding.py',
+            'scripts/rule_binding.py',
             '<(RULE_INPUT_PATH)',
             '<(SHARED_INTERMEDIATE_DIR)/webcore/bindings',
             '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
@@ -629,6 +620,7 @@
         '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
         '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
         '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+        '<(chromium_src_dir)/third_party/ots/ots.gyp:ots',
         '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
       ],
       'defines': [
@@ -655,6 +647,7 @@
         # filenames.
         ['exclude', '(android|cairo|cf|cg|curl|gtk|haiku|linux|mac|opentype|posix|qt|soup|symbian|win|wx)/'],
         ['exclude', '(?<!Chromium)(SVGAllInOne|Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
+        ['include', 'platform/graphics/opentype/OpenTypeSanitizer\\.cpp$'],
 
         # JSC-only.
         ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
@@ -664,13 +657,15 @@
         ['include', 'loader/appcache/ApplicationCacheHost\.h$'],
         ['include', 'loader/appcache/DOMApplicationCache\.(h|cpp)$'],
 
-        # SVG_FILTERS only.
-        ['exclude', '(platform|svg)/graphics/filters/'],
-        ['exclude', 'svg/Filter[^/]*\\.cpp$'],
-        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.cpp$'],
-
         # Exclude some DB-related files.
         ['exclude', 'platform/sql/SQLiteFileSystem.cpp'],
+        ['exclude', 'storage/DatabaseTracker.cpp'],
+        ['exclude', 'storage/DatabaseTrackerClient.h'],
+        ['exclude', 'storage/OriginQuotaManager.cpp'],
+        ['exclude', 'storage/OriginQuotaManager.h'],
+        ['exclude', 'storage/OriginUsageRecord.cpp'],
+        ['exclude', 'storage/OriginUsageRecord.h'],
+        ['exclude', 'storage/SQLTransactionClient.cpp'],
       ],
       'sources!': [
         # A few things can't be excluded by patterns.  List them individually.
@@ -891,6 +886,7 @@
 
             # Use native Mac font code from WebCore.
             ['include', 'platform/(graphics/)?mac/[^/]*Font[^/]*\\.(cpp|mm?)$'],
+            ['include', 'platform/graphics/mac/ComplexText[^/]*\\.(cpp|h)$'],
 
             # Cherry-pick some files that can't be included by broader regexps.
             # Some of these are used instead of Chromium platform files, see
@@ -906,7 +902,6 @@
             ['include', 'platform/mac/BlockExceptions\\.mm$'],
             ['include', 'platform/mac/LocalCurrentGraphicsContext\\.mm$'],
             ['include', 'platform/mac/PurgeableBufferMac\\.cpp$'],
-            ['include', 'platform/mac/ScrollbarThemeMac\\.mm$'],
             ['include', 'platform/mac/WebCoreSystemInterface\\.mm$'],
             ['include', 'platform/mac/WebCoreTextRenderer\\.mm$'],
             ['include', 'platform/text/mac/ShapeArabic\\.c$'],
@@ -921,8 +916,8 @@
             # platform/graphics/mac, included by regex above, instead.
             '../platform/graphics/chromium/FontCustomPlatformData.cpp',
 
-            # The Mac currently uses ScrollbarThemeMac.mm, included by regex
-            # above, instead of ScrollbarThemeChromium.cpp.
+            # The Mac currently uses ScrollbarThemeChromiumMac.mm, which is not
+            # related to ScrollbarThemeChromium.cpp.
             '../platform/chromium/ScrollbarThemeChromium.cpp',
 
             # The Mac uses ImageSourceCG.cpp from platform/graphics/cg, included
diff --git a/WebCore/WebCore.gyp/scripts/action_csspropertynames.py b/WebCore/WebCore.gyp/scripts/action_csspropertynames.py
new file mode 100644
index 0000000..60314d7
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_csspropertynames.py
@@ -0,0 +1,166 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# action_csspropertynames.py is a harness script to connect actions sections of
+# gyp-based builds to makeprop.pl.
+#
+# usage: action_makenames.py OUTPUTS -- INPUTS
+#
+# Exactly two outputs must be specified: a path to each of CSSPropertyNames.cpp
+# and CSSPropertyNames.h.
+#
+# Multiple inputs may be specified. One input must have a basename of
+# makeprop.pl; this is taken as the path to makeprop.pl. All other inputs are
+# paths to .in files that are used as input to makeprop.pl; at least one,
+# CSSPropertyNames.in, is required.
+
+
+import os
+import posixpath
+import shutil
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    (outputs, inputs) = SplitArgsIntoSections(args[1:])
+
+    # Make all output pathnames absolute so that they can be accessed after
+    # changing directory.
+    for index in xrange(0, len(outputs)):
+        outputs[index] = os.path.abspath(outputs[index])
+
+    outputDir = os.path.dirname(outputs[0])
+
+    # Look at the inputs and figure out which one is makeprop.pl and which are
+    # inputs to that script.
+    makepropInput = None
+    inFiles = []
+    for input in inputs:
+        # Make input pathnames absolute so they can be accessed after changing
+        # directory. On Windows, convert \ to / for inputs to the perl script to
+        # work around the intermix of activepython + cygwin perl.
+        inputAbs = os.path.abspath(input)
+        inputAbsPosix = inputAbs.replace(os.path.sep, posixpath.sep)
+        inputBasename = os.path.basename(input)
+        if inputBasename == 'makeprop.pl':
+            assert makepropInput == None
+            makepropInput = inputAbs
+        elif inputBasename.endswith('.in'):
+            inFiles.append(inputAbsPosix)
+        else:
+            assert False
+
+    assert makepropInput != None
+    assert len(inFiles) >= 1
+
+    # Change to the output directory because makeprop.pl puts output in its
+    # working directory.
+    os.chdir(outputDir)
+
+    # Merge all inFiles into a single file whose name will be the same as the
+    # first listed inFile, but in the output directory.
+    mergedPath = os.path.basename(inFiles[0])
+    merged = open(mergedPath, 'wb')    # 'wb' to get \n only on windows
+
+    # Make sure there aren't any duplicate lines in the in files.
+    lineDict = {}
+    for inFilePath in inFiles:
+        inFile = open(inFilePath)
+        for line in inFile:
+            line = line.rstrip()
+            if line.startswith('#'):
+                line = ''
+            if line == '':
+                continue
+            if line in lineDict:
+                raise KeyError, 'Duplicate value %s' % line
+            lineDict[line] = True
+            print >>merged, line
+        inFile.close()
+
+    merged.close()
+
+    # Build up the command.
+    command = ['perl', makepropInput]
+
+    # Do it. checkCall is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    # Don't leave behind the merged file or the .gperf file created by
+    # makeprop.
+    (root, ext) = os.path.splitext(mergedPath)
+    gperfPath = root + '.gperf'
+    os.unlink(gperfPath)
+    os.unlink(mergedPath)
+
+    # Go through the outputs. Any output that belongs in a different directory
+    # is moved. Do a copy and delete instead of rename for maximum portability.
+    # Note that all paths used in this section are still absolute.
+    for output in outputs:
+        thisOutputDir = os.path.dirname(output)
+        if thisOutputDir != outputDir:
+            outputBasename = os.path.basename(output)
+            src = os.path.join(outputDir, outputBasename)
+            dst = os.path.join(thisOutputDir, outputBasename)
+            shutil.copyfile(src, dst)
+            os.unlink(src)
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/action_cssvaluekeywords.py b/WebCore/WebCore.gyp/scripts/action_cssvaluekeywords.py
new file mode 100644
index 0000000..ebf895b
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_cssvaluekeywords.py
@@ -0,0 +1,172 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# action_cssvaluekeywords.py is a harness script to connect actions sections of
+# gyp-based builds to makevalues.pl.
+#
+# usage: action_cssvaluekeywords.py OUTPUTS -- INPUTS
+#
+# Exactly two outputs must be specified: a path to each of CSSValueKeywords.c
+# and CSSValueKeywords.h.
+#
+# Multiple inputs may be specified. One input must have a basename of
+# makevalues.pl; this is taken as the path to makevalues.pl. All other inputs
+# are paths to .in files that are used as input to makevalues.pl; at least
+# one, CSSValueKeywords.in, is required.
+
+
+import os
+import posixpath
+import shutil
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    (outputs, inputs) = SplitArgsIntoSections(args[1:])
+
+    # Make all output pathnames absolute so that they can be accessed after
+    # changing directory.
+    for index in xrange(0, len(outputs)):
+        outputs[index] = os.path.abspath(outputs[index])
+
+    outputDir = os.path.dirname(outputs[0])
+
+    # Look at the inputs and figure out which one is makevalues.pl and which are
+    # inputs to that script.
+    makevaluesInput = None
+    inFiles = []
+    for input in inputs:
+        # Make input pathnames absolute so they can be accessed after changing
+        # directory. On Windows, convert \ to / for inputs to the perl script to
+        # work around the intermix of activepython + cygwin perl.
+        inputAbs = os.path.abspath(input)
+        inputAbsPosix = inputAbs.replace(os.path.sep, posixpath.sep)
+        inputBasename = os.path.basename(input)
+        if inputBasename == 'makevalues.pl':
+            assert makevaluesInput == None
+            makevaluesInput = inputAbs
+        elif inputBasename.endswith('.in'):
+            inFiles.append(inputAbsPosix)
+        else:
+            assert False
+
+    assert makevaluesInput != None
+    assert len(inFiles) >= 1
+
+    # Change to the output directory because makevalues.pl puts output in its
+    # working directory.
+    os.chdir(outputDir)
+
+    # Merge all inFiles into a single file whose name will be the same as the
+    # first listed inFile, but in the output directory.
+    mergedPath = os.path.basename(inFiles[0])
+    merged = open(mergedPath, 'wb')    # 'wb' to get \n only on windows
+
+    # Make sure there aren't any duplicate lines in the in files. Lowercase
+    # everything because CSS values are case-insensitive.
+    lineDict = {}
+    for inFilePath in inFiles:
+        inFile = open(inFilePath)
+        for line in inFile:
+            line = line.rstrip()
+            if line.startswith('#'):
+                line = ''
+            if line == '':
+                continue
+            line = line.lower()
+            if line in lineDict:
+                raise KeyError, 'Duplicate value %s' % line
+            lineDict[line] = True
+            print >>merged, line
+        inFile.close()
+
+    merged.close()
+
+    # Build up the command.
+    command = ['perl', makevaluesInput]
+
+    # Do it. checkCall is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    # Don't leave behind the merged file or the .gperf file created by
+    # makevalues.
+    (root, ext) = os.path.splitext(mergedPath)
+    gperfPath = root + '.gperf'
+    os.unlink(gperfPath)
+    os.unlink(mergedPath)
+
+    # Go through the outputs. Any output that belongs in a different directory
+    # is moved. Do a copy and delete instead of rename for maximum portability.
+    # Note that all paths used in this section are still absolute.
+    for output in outputs:
+        thisOutputDir = os.path.dirname(output)
+        if thisOutputDir != outputDir:
+            outputBasename = os.path.basename(output)
+            src = os.path.join(outputDir, outputBasename)
+            dst = os.path.join(thisOutputDir, outputBasename)
+            shutil.copyfile(src, dst)
+            os.unlink(src)
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/action_makenames.py b/WebCore/WebCore.gyp/scripts/action_makenames.py
new file mode 100644
index 0000000..ecf543f
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_makenames.py
@@ -0,0 +1,174 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# action_makenames.py is a harness script to connect actions sections of
+# gyp-based builds to make_names.pl.
+#
+# usage: action_makenames.py OUTPUTS -- INPUTS [-- OPTIONS]
+#
+# Multiple OUTPUTS, INPUTS, and OPTIONS may be listed. The sections are
+# separated by -- arguments.
+#
+# The directory name of the first output is chosen as the directory in which
+# make_names will run. If the directory name for any subsequent output is
+# different, those files will be moved to the desired directory.
+#
+# Multiple INPUTS may be listed. An input with a basename matching
+# "make_names.pl" is taken as the path to that script. Inputs with names
+# ending in TagNames.in or tags.in are taken as tag inputs. Inputs with names
+# ending in AttributeNames.in or attrs.in are taken as attribute inputs. There
+# may be at most one tag input and one attribute input. A make_names.pl input
+# is required and at least one tag or attribute input must be present.
+#
+# OPTIONS is a list of additional options to pass to make_names.pl. This
+# section need not be present.
+
+
+import os
+import posixpath
+import shutil
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    sections = SplitArgsIntoSections(args[1:])
+    assert len(sections) == 2 or len(sections) == 3
+    (outputs, inputs) = sections[:2]
+    if len(sections) == 3:
+        options = sections[2]
+    else:
+        options = []
+
+    # Make all output pathnames absolute so that they can be accessed after
+    # changing directory.
+    for index in xrange(0, len(outputs)):
+        outputs[index] = os.path.abspath(outputs[index])
+
+    outputDir = os.path.dirname(outputs[0])
+
+    # Look at the inputs and figure out which ones are make_names.pl, tags, and
+    # attributes. There can be at most one of each, and those are the only
+    # input types supported. make_names.pl is required and at least one of tags
+    # and attributes is required.
+    makeNamesInput = None
+    tagInput = None
+    attrInput = None
+    for input in inputs:
+        # Make input pathnames absolute so they can be accessed after changing
+        # directory. On Windows, convert \ to / for inputs to the perl script to
+        # work around the intermix of activepython + cygwin perl.
+        inputAbs = os.path.abspath(input)
+        inputAbsPosix = inputAbs.replace(os.path.sep, posixpath.sep)
+        inputBasename = os.path.basename(input)
+        if inputBasename == 'make_names.pl':
+            assert makeNamesInput == None
+            makeNamesInput = inputAbs
+        elif inputBasename.endswith('TagNames.in') \
+             or inputBasename.endswith('tags.in'):
+            assert tagInput == None
+            tagInput = inputAbsPosix
+        elif inputBasename.endswith('AttributeNames.in') \
+             or inputBasename.endswith('attrs.in'):
+            assert attrInput == None
+            attrInput = inputAbsPosix
+        else:
+            assert False
+
+    assert makeNamesInput != None
+    assert tagInput != None or attrInput != None
+
+    # scriptsPath is a Perl include directory, located relative to
+    # makeNamesInput.
+    scriptsPath = os.path.normpath(
+        os.path.join(os.path.dirname(makeNamesInput), os.pardir, 'bindings', 'scripts'))
+
+    # Change to the output directory because make_names.pl puts output in its
+    # working directory.
+    os.chdir(outputDir)
+
+    # Build up the command.
+    command = ['perl', '-I', scriptsPath, makeNamesInput]
+    if tagInput != None:
+        command.extend(['--tags', tagInput])
+    if attrInput != None:
+        command.extend(['--attrs', attrInput])
+    command.extend(options)
+
+    # Do it. check_call is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    # Go through the outputs. Any output that belongs in a different directory
+    # is moved. Do a copy and delete instead of rename for maximum portability.
+    # Note that all paths used in this section are still absolute.
+    for output in outputs:
+        thisOutputDir = os.path.dirname(output)
+        if thisOutputDir != outputDir:
+            outputBasename = os.path.basename(output)
+            src = os.path.join(outputDir, outputBasename)
+            dst = os.path.join(thisOutputDir, outputBasename)
+            shutil.copyfile(src, dst)
+            os.unlink(src)
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/action_maketokenizer.py b/WebCore/WebCore.gyp/scripts/action_maketokenizer.py
new file mode 100644
index 0000000..f4a28ee
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_maketokenizer.py
@@ -0,0 +1,101 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: action_maketokenizer.py OUTPUTS -- INPUTS
+#
+# Multiple INPUTS may be listed. The sections are separated by -- arguments.
+#
+# OUTPUTS must contain a single item: a path to tokenizer.cpp.
+#
+# INPUTS must contain exactly two items. The first item must be the path to
+# maketokenizer. The second item must be the path to tokenizer.flex.
+
+
+import os
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    sections = SplitArgsIntoSections(args[1:])
+    assert len(sections) == 2
+    (outputs, inputs) = sections
+
+    assert len(outputs) == 1
+    output = outputs[0]
+
+    assert len(inputs) == 2
+    maketokenizer = inputs[0]
+    flexInput = inputs[1]
+
+    # Do it. check_call is new in 2.5, so simulate its behavior with call and
+    # assert.
+    outfile = open(output, 'wb')
+    p1 = subprocess.Popen(['flex', '-t', flexInput], stdout=subprocess.PIPE)
+    p2 = subprocess.Popen(['perl', maketokenizer], stdin=p1.stdout, stdout=outfile)
+
+    r1 = p1.wait()
+    r2 = p2.wait()
+    assert r1 == 0
+    assert r2 == 0
+
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/action_useragentstylesheets.py b/WebCore/WebCore.gyp/scripts/action_useragentstylesheets.py
new file mode 100644
index 0000000..6f017fc
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_useragentstylesheets.py
@@ -0,0 +1,102 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: action_useragentstylesheets.py OUTPUTS -- INPUTS
+#
+# Multiple OUTPUTS and INPUTS may be listed. The sections are separated by
+# -- arguments.
+#
+# OUTPUTS must contain two items, in order: a path to UserAgentStyleSheets.h
+# and a path to UserAgentStyleSheetsData.cpp.
+#
+# INPUTS must contain at least two items. The first item must be the path to
+# make-css-file-arrays.pl. The remaining items are paths to style sheets to
+# be fed to that script.
+
+
+import os
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    sections = SplitArgsIntoSections(args[1:])
+    assert len(sections) == 2
+    (outputs, inputs) = sections
+
+    assert len(outputs) == 2
+    outputH = outputs[0]
+    outputCpp = outputs[1]
+
+    makeCssFileArrays = inputs[0]
+    styleSheets = inputs[1:]
+
+    # Build up the command.
+    command = ['perl', makeCssFileArrays, outputH, outputCpp]
+    command.extend(styleSheets)
+
+    # Do it. check_call is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/rule_binding.py b/WebCore/WebCore.gyp/scripts/rule_binding.py
new file mode 100644
index 0000000..24d178f
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/rule_binding.py
@@ -0,0 +1,135 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: rule_binding.py INPUT CPPDIR HDIR -- INPUTS -- OPTIONS
+#
+# INPUT is an IDL file, such as Whatever.idl.
+#
+# CPPDIR is the directory into which V8Whatever.cpp will be placed. HDIR is
+# the directory into which V8Whatever.h will be placed.
+#
+# The first item in INPUTS is the path to generate-bindings.pl. Remaining
+# items in INPUTS are used to build the Perl module include path.
+#
+# OPTIONS are passed as-is to generate-bindings.pl as additional arguments.
+
+
+import errno
+import os
+import shlex
+import shutil
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    sections = SplitArgsIntoSections(args[1:])
+    assert len(sections) == 3, sections
+    (base, inputs, options) = sections
+
+    assert len(base) == 3, base
+    (input, cppdir, hdir) = base
+
+    assert len(inputs) > 1, inputs
+    generateBindings = inputs[0]
+    perlModules = inputs[1:]
+
+    includeDirs = []
+    for perlModule in perlModules:
+        includeDir = os.path.dirname(perlModule)
+        if not includeDir in includeDirs:
+            includeDirs.append(includeDir)
+
+    # The defines come in as one flat string. Split it up into distinct arguments.
+    if '--defines' in options:
+        definesIndex = options.index('--defines')
+        if definesIndex + 1 < len(options):
+            splitOptions = shlex.split(options[definesIndex + 1])
+            if splitOptions:
+                options[definesIndex + 1] = ' '.join(splitOptions)
+
+    # Build up the command.
+    command = ['perl', '-w']
+    for includeDir in includeDirs:
+        command.extend(['-I', includeDir])
+    command.append(generateBindings)
+    command.extend(options)
+    command.extend(['--outputDir', cppdir, input])
+
+    # Do it. check_call is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    # Both the .cpp and .h were generated in cppdir, but if hdir is different,
+    # the .h needs to move. Copy it instead of using os.rename for maximum
+    # portability in all cases.
+    if cppdir != hdir:
+        inputBasename = os.path.basename(input)
+        (root, ext) = os.path.splitext(inputBasename)
+        hname = 'V8%s.h' % root
+        hsrc = os.path.join(cppdir, hname)
+        hdst = os.path.join(hdir, hname)
+        shutil.copyfile(hsrc, hdst)
+        os.unlink(hsrc)
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/rule_bison.py b/WebCore/WebCore.gyp/scripts/rule_bison.py
new file mode 100644
index 0000000..eb85a4b
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/rule_bison.py
@@ -0,0 +1,102 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: rule_bison.py INPUT_FILE OUTPUT_DIR
+# INPUT_FILE is a path to either CSSGrammar.y or XPathGrammar.y.
+# OUTPUT_DIR is where the bison-generated .cpp and .h files should be placed.
+
+import errno
+import os
+import os.path
+import subprocess
+import sys
+
+assert len(sys.argv) == 3
+
+inputFile = sys.argv[1]
+outputDir = sys.argv[2]
+
+inputName = os.path.basename(inputFile)
+assert inputName == 'CSSGrammar.y' or inputName == 'XPathGrammar.y'
+prefix = {'CSSGrammar.y': 'cssyy', 'XPathGrammar.y': 'xpathyy'}[inputName]
+
+(inputRoot, inputExt) = os.path.splitext(inputName)
+
+# The generated .h will be in a different location depending on the bison
+# version.
+outputHTries = [
+    os.path.join(outputDir, inputRoot + '.cpp.h'),
+    os.path.join(outputDir, inputRoot + '.hpp'),
+]
+
+for outputHTry in outputHTries:
+    try:
+        os.unlink(outputHTry)
+    except OSError, e:
+        if e.errno != errno.ENOENT:
+            raise
+
+outputCpp = os.path.join(outputDir, inputRoot + '.cpp')
+
+returnCode = subprocess.call(['bison', '-d', '-p', prefix, inputFile, '-o', outputCpp])
+assert returnCode == 0
+
+# Find the name that bison used for the generated header file.
+outputHTmp = None
+for outputHTry in outputHTries:
+    try:
+        os.stat(outputHTry)
+        outputHTmp = outputHTry
+        break
+    except OSError, e:
+        if e.errno != errno.ENOENT:
+            raise
+
+assert outputHTmp != None
+
+# Read the header file in under the generated name and remove it.
+outputHFile = open(outputHTmp)
+outputHContents = outputHFile.read()
+outputHFile.close()
+os.unlink(outputHTmp)
+
+# Rewrite the generated header with #include guards.
+outputH = os.path.join(outputDir, inputRoot + '.h')
+
+outputHFile = open(outputH, 'w')
+print >>outputHFile, '#ifndef %sH' % inputRoot
+print >>outputHFile, '#define %sH' % inputRoot
+print >>outputHFile, outputHContents
+print >>outputHFile, '#endif'
+outputHFile.close()
diff --git a/WebCore/WebCore.gyp/scripts/rule_gperf.py b/WebCore/WebCore.gyp/scripts/rule_gperf.py
new file mode 100644
index 0000000..e76ed6f
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/rule_gperf.py
@@ -0,0 +1,85 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: rule_gperf.py INPUT_FILE OUTPUT_DIR
+# INPUT_FILE is a path to DocTypeStrings.gperf, HTMLEntityNames.gperf, or
+# ColorData.gperf.
+# OUTPUT_DIR is where the gperf-generated .cpp file should be placed. Because
+# some users want a .c file instead of a .cpp file, the .cpp file is copied
+# to .c when done.
+
+import posixpath
+import shutil
+import subprocess
+import sys
+
+assert len(sys.argv) == 3
+
+inputFile = sys.argv[1]
+outputDir = sys.argv[2]
+
+gperfCommands = {
+    'DocTypeStrings.gperf': [
+        '-CEot', '-L', 'ANSI-C', '-k*', '-N', 'findDoctypeEntry',
+        '-F', ',PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards'
+    ],
+    'HTMLEntityNames.gperf': [
+        '-a', '-L', 'ANSI-C', '-C', '-G', '-c', '-o', '-t', '-k*',
+        '-N', 'findEntity', '-D', '-s', '2'
+    ],
+    'ColorData.gperf': [
+        '-CDEot', '-L', 'ANSI-C', '-k*', '-N', 'findColor', '-D', '-s', '2'
+    ],
+}
+
+inputName = posixpath.basename(inputFile)
+assert inputName in gperfCommands
+
+(inputRoot, inputExt) = posixpath.splitext(inputName)
+outputCpp = posixpath.join(outputDir, inputRoot + '.cpp')
+
+#command = ['gperf', '--output-file', outputCpp]
+command = ['gperf']
+command.extend(gperfCommands[inputName])
+command.append(inputFile)
+
+ofile = open(outputCpp, 'w')
+
+# Do it. check_call is new in 2.5, so simulate its behavior with call and
+# assert.
+returnCode = subprocess.call(command, stdout=ofile.fileno())
+assert returnCode == 0
+
+outputC = posixpath.join(outputDir, inputRoot + '.c')
+shutil.copyfile(outputCpp, outputC)
diff --git a/WebCore/WebCore.gypi b/WebCore/WebCore.gypi
index c0baaf4..4a37c79 100644
--- a/WebCore/WebCore.gypi
+++ b/WebCore/WebCore.gypi
@@ -38,6 +38,7 @@
             'dom/ClientRectList.idl',
             'dom/Clipboard.idl',
             'dom/Comment.idl',
+            'dom/CompositionEvent.idl',
             'dom/DOMCoreException.idl',
             'dom/DOMImplementation.idl',
             'dom/Document.idl',
@@ -65,6 +66,7 @@
             'dom/Notation.idl',
             'dom/OverflowEvent.idl',
             'dom/PageTransitionEvent.idl',
+            'dom/PopStateEvent.idl',
             'dom/ProcessingInstruction.idl',
             'dom/ProgressEvent.idl',
             'dom/Range.idl',
@@ -76,28 +78,29 @@
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
-            'html/canvas/CanvasActiveInfo.idl',
-            'html/canvas/CanvasArray.idl',
-            'html/canvas/CanvasArrayBuffer.idl',
-            'html/canvas/CanvasBuffer.idl',
-            'html/canvas/CanvasByteArray.idl',
-            'html/canvas/CanvasFloatArray.idl',
-            'html/canvas/CanvasFramebuffer.idl',
+            'html/canvas/WebGLActiveInfo.idl',
+            'html/canvas/WebGLArray.idl',
+            'html/canvas/WebGLArrayBuffer.idl',
+            'html/canvas/WebGLBuffer.idl',
+            'html/canvas/WebGLByteArray.idl',
+            'html/canvas/WebGLFloatArray.idl',
+            'html/canvas/WebGLFramebuffer.idl',
             'html/canvas/CanvasGradient.idl',
-            'html/canvas/CanvasIntArray.idl',
+            'html/canvas/WebGLIntArray.idl',
             'html/canvas/CanvasPattern.idl',
             'html/canvas/CanvasPixelArray.idl',
-            'html/canvas/CanvasProgram.idl',
-            'html/canvas/CanvasRenderbuffer.idl',
+            'html/canvas/WebGLProgram.idl',
+            'html/canvas/WebGLRenderbuffer.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
-            'html/canvas/CanvasRenderingContext3D.idl',
-            'html/canvas/CanvasShader.idl',
-            'html/canvas/CanvasShortArray.idl',
-            'html/canvas/CanvasUnsignedByteArray.idl',
-            'html/canvas/CanvasUnsignedIntArray.idl',
-            'html/canvas/CanvasUnsignedShortArray.idl',
-            'html/canvas/CanvasTexture.idl',
+            'html/canvas/WebGLRenderingContext.idl',
+            'html/canvas/WebGLShader.idl',
+            'html/canvas/WebGLShortArray.idl',
+            'html/canvas/WebGLUniformLocation.idl',
+            'html/canvas/WebGLUnsignedByteArray.idl',
+            'html/canvas/WebGLUnsignedIntArray.idl',
+            'html/canvas/WebGLUnsignedShortArray.idl',
+            'html/canvas/WebGLTexture.idl',
             'html/DataGridColumn.idl',
             'html/DataGridColumnList.idl',
             'html/File.idl',
@@ -178,7 +181,9 @@
             'html/TimeRanges.idl',
             'html/ValidityState.idl',
             'html/VoidCallback.idl',
+            'inspector/InjectedScriptHost.idl',
             'inspector/InspectorBackend.idl',
+            'inspector/InspectorFrontendHost.idl',
             'inspector/JavaScriptCallFrame.idl',
             'loader/appcache/DOMApplicationCache.idl',
             'notifications/Notification.idl',
@@ -186,6 +191,7 @@
             'page/AbstractView.idl',
             'page/BarInfo.idl',
             'page/Console.idl',
+            'page/Coordinates.idl',
             'page/DOMSelection.idl',
             'page/DOMWindow.idl',
             'page/Geolocation.idl',
@@ -521,7 +527,8 @@
             'bindings/js/JSInspectedObjectWrapper.h',
             'bindings/js/JSInspectorCallbackWrapper.cpp',
             'bindings/js/JSInspectorCallbackWrapper.h',
-            'bindings/js/JSInspectorBackendCustom.cpp',
+            'bindings/js/JSInjectedScriptHostCustom.cpp',
+            'bindings/js/JSInspectorFrontendHostCustom.cpp',
             'bindings/js/JSJavaScriptCallFrameCustom.cpp',
             'bindings/js/JSLazyEventListener.cpp',
             'bindings/js/JSLazyEventListener.h',
@@ -617,8 +624,6 @@
             'bindings/js/ScriptInstance.h',
             'bindings/js/ScriptObject.cpp',
             'bindings/js/ScriptObject.h',
-            'bindings/js/ScriptObjectQuarantine.cpp',
-            'bindings/js/ScriptObjectQuarantine.h',
             'bindings/js/ScriptSourceCode.h',
             'bindings/js/ScriptSourceProvider.h',
             'bindings/js/ScriptState.cpp',
@@ -634,25 +639,30 @@
             'bindings/v8/ChildThreadDOMData.h',
             'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
             'bindings/v8/custom/V8AttrCustom.cpp',
-            'bindings/v8/custom/V8CanvasPixelArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasArrayCustom.h',
-            'bindings/v8/custom/V8CanvasArrayBufferCustom.cpp',
-            'bindings/v8/custom/V8CanvasByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasFloatArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasShortArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLArrayCustom.h',
+            'bindings/v8/custom/V8WebGLArrayBufferCustom.cpp',
+            'bindings/v8/custom/V8WebGLByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLFloatArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp',
             'bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp',
-            'bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp',
+            'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
             'bindings/v8/custom/V8ClientRectListCustom.cpp',
             'bindings/v8/custom/V8ClipboardCustom.cpp',
+            'bindings/v8/custom/V8CoordinatesCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
+            'bindings/v8/custom/V8ConsoleCustom.cpp',
             'bindings/v8/custom/V8CustomBinding.cpp',
             'bindings/v8/custom/V8CustomBinding.h',
             'bindings/v8/custom/V8CustomEventListener.cpp',
             'bindings/v8/custom/V8CustomEventListener.h',
+            'bindings/v8/custom/V8CustomPositionCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionCallback.h',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementCallback.cpp',
             'bindings/v8/custom/V8CustomSQLStatementCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp',
@@ -676,6 +686,8 @@
             'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
             'bindings/v8/custom/V8FileListCustom.cpp',
+            'bindings/v8/custom/V8GeolocationCustom.cpp',
+            'bindings/v8/custom/V8HistoryCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
             'bindings/v8/custom/V8HTMLAllCollectionCustom.cpp',
@@ -697,7 +709,8 @@
             'bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.h',
-            'bindings/v8/custom/V8InspectorBackendCustom.cpp',
+            'bindings/v8/custom/V8InjectedScriptHostCustom.cpp',
+            'bindings/v8/custom/V8InspectorFrontendHostCustom.cpp',
             'bindings/v8/custom/V8LocationCustom.cpp',
             'bindings/v8/custom/V8MessageChannelConstructor.cpp',
             'bindings/v8/custom/V8MessageEventCustom.cpp',
@@ -767,8 +780,6 @@
             'bindings/v8/ScriptInstance.h',
             'bindings/v8/ScriptObject.cpp',
             'bindings/v8/ScriptObject.h',
-            'bindings/v8/ScriptObjectQuarantine.cpp',
-            'bindings/v8/ScriptObjectQuarantine.h',
             'bindings/v8/ScriptScope.cpp',
             'bindings/v8/ScriptScope.h',
             'bindings/v8/ScriptSourceCode.h',
@@ -827,6 +838,8 @@
             'bindings/v8/WorkerContextExecutionProxy.cpp',
             'bindings/v8/WorkerScriptController.h',
             'bindings/v8/WorkerScriptController.cpp',
+            'bindings/v8/WorldContextHandle.cpp',
+            'bindings/v8/WorldContextHandle.h',
             'bindings/v8/npruntime.cpp',
             'bindings/v8/npruntime_impl.h',
             'bindings/v8/npruntime_internal.h',
@@ -987,8 +1000,6 @@
             'dom/CheckedRadioButtons.h',
             'dom/ChildNodeList.cpp',
             'dom/ChildNodeList.h',
-            'dom/ClassNames.cpp',
-            'dom/ClassNames.h',
             'dom/ClassNodeList.cpp',
             'dom/ClassNodeList.h',
             'dom/ClientRect.cpp',
@@ -1002,6 +1013,8 @@
             'dom/ClipboardEvent.h',
             'dom/Comment.cpp',
             'dom/Comment.h',
+            'dom/CompositionEvent.cpp',
+            'dom/CompositionEvent.h',
             'dom/ContainerNode.cpp',
             'dom/ContainerNode.h',
             'dom/ContainerNodeAlgorithms.h',
@@ -1088,6 +1101,8 @@
             'dom/OptionGroupElement.h',
             'dom/OverflowEvent.cpp',
             'dom/OverflowEvent.h',
+            'dom/PopStateEvent.cpp',
+            'dom/PopStateEvent.h',
             'dom/PageTransitionEvent.cpp',
             'dom/PageTransitionEvent.h',
             'dom/Position.cpp',
@@ -1114,6 +1129,8 @@
             'dom/SelectElement.h',
             'dom/SelectorNodeList.cpp',
             'dom/SelectorNodeList.h',
+            'dom/SpaceSplitString.cpp',
+            'dom/SpaceSplitString.h',
             'dom/StaticNodeList.cpp',
             'dom/StaticNodeList.h',
             'dom/StaticStringList.cpp',
@@ -1268,52 +1285,56 @@
             'history/HistoryItem.h',
             'history/PageCache.cpp',
             'history/PageCache.h',
-            'html/canvas/CanvasArray.cpp',
-            'html/canvas/CanvasArray.h',
-            'html/canvas/CanvasArrayBuffer.cpp',
-            'html/canvas/CanvasArrayBuffer.h',
-            'html/canvas/CanvasBuffer.cpp',
-            'html/canvas/CanvasBuffer.h',
-            'html/canvas/CanvasByteArray.cpp',
-            'html/canvas/CanvasByteArray.h',
-            'html/canvas/CanvasFloatArray.cpp',
-            'html/canvas/CanvasFloatArray.h',
-            'html/canvas/CanvasFramebuffer.cpp',
-            'html/canvas/CanvasFramebuffer.h',
+            'html/canvas/WebGLArray.cpp',
+            'html/canvas/WebGLArray.h',
+            'html/canvas/WebGLArrayBuffer.cpp',
+            'html/canvas/WebGLArrayBuffer.h',
+            'html/canvas/WebGLBuffer.cpp',
+            'html/canvas/WebGLBuffer.h',
+            'html/canvas/WebGLByteArray.cpp',
+            'html/canvas/WebGLByteArray.h',
+            'html/canvas/WebGLFloatArray.cpp',
+            'html/canvas/WebGLFloatArray.h',
+            'html/canvas/WebGLFramebuffer.cpp',
+            'html/canvas/WebGLFramebuffer.h',
+            'html/canvas/WebGLGetInfo.cpp',
+            'html/canvas/WebGLGetInfo.h',
             'html/canvas/CanvasGradient.cpp',
             'html/canvas/CanvasGradient.h',
-            'html/canvas/CanvasIntArray.cpp',
-            'html/canvas/CanvasIntArray.h',
+            'html/canvas/WebGLIntArray.cpp',
+            'html/canvas/WebGLIntArray.h',
             'html/canvas/CanvasObject.cpp',
             'html/canvas/CanvasObject.h',
             'html/canvas/CanvasPattern.cpp',
             'html/canvas/CanvasPattern.h',
             'html/canvas/CanvasPixelArray.cpp',
             'html/canvas/CanvasPixelArray.h',
-            'html/canvas/CanvasProgram.cpp',
-            'html/canvas/CanvasProgram.h',
-            'html/canvas/CanvasRenderbuffer.cpp',
-            'html/canvas/CanvasRenderbuffer.h',
+            'html/canvas/WebGLProgram.cpp',
+            'html/canvas/WebGLProgram.h',
+            'html/canvas/WebGLRenderbuffer.cpp',
+            'html/canvas/WebGLRenderbuffer.h',
             'html/canvas/CanvasRenderingContext.cpp',
             'html/canvas/CanvasRenderingContext.h',
             'html/canvas/CanvasRenderingContext2D.cpp',
             'html/canvas/CanvasRenderingContext2D.h',
-            'html/canvas/CanvasRenderingContext3D.cpp',
-            'html/canvas/CanvasRenderingContext3D.h',
-            'html/canvas/CanvasShader.cpp',
-            'html/canvas/CanvasShader.h',
-            'html/canvas/CanvasShortArray.cpp',
-            'html/canvas/CanvasShortArray.h',
+            'html/canvas/WebGLRenderingContext.cpp',
+            'html/canvas/WebGLRenderingContext.h',
+            'html/canvas/WebGLShader.cpp',
+            'html/canvas/WebGLShader.h',
+            'html/canvas/WebGLShortArray.cpp',
+            'html/canvas/WebGLShortArray.h',
             'html/canvas/CanvasStyle.cpp',
             'html/canvas/CanvasStyle.h',
-            'html/canvas/CanvasTexture.cpp',
-            'html/canvas/CanvasTexture.h',
-            'html/canvas/CanvasUnsignedByteArray.cpp',
-            'html/canvas/CanvasUnsignedByteArray.h',
-            'html/canvas/CanvasUnsignedIntArray.cpp',
-            'html/canvas/CanvasUnsignedIntArray.h',
-            'html/canvas/CanvasUnsignedShortArray.cpp',
-            'html/canvas/CanvasUnsignedShortArray.h',
+            'html/canvas/WebGLTexture.cpp',
+            'html/canvas/WebGLTexture.h',
+            'html/canvas/WebGLUniformLocation.cpp',
+            'html/canvas/WebGLUniformLocation.h',
+            'html/canvas/WebGLUnsignedByteArray.cpp',
+            'html/canvas/WebGLUnsignedByteArray.h',
+            'html/canvas/WebGLUnsignedIntArray.cpp',
+            'html/canvas/WebGLUnsignedIntArray.h',
+            'html/canvas/WebGLUnsignedShortArray.cpp',
+            'html/canvas/WebGLUnsignedShortArray.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1499,6 +1520,8 @@
             'html/HTMLVideoElement.h',
             'html/HTMLViewSourceDocument.cpp',
             'html/HTMLViewSourceDocument.h',
+            'html/ISODateTime.cpp',
+            'html/ISODateTime.h',
             'html/ImageData.cpp',
             'html/ImageData.h',
             'html/MediaError.h',
@@ -1513,6 +1536,8 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/InjectedScriptHost.cpp',
+            'inspector/InjectedScriptHost.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
@@ -1525,6 +1550,8 @@
             'inspector/InspectorDOMStorageResource.h',
             'inspector/InspectorFrontend.cpp',
             'inspector/InspectorFrontend.h',
+            'inspector/InspectorFrontendHost.cpp',
+            'inspector/InspectorFrontendHost.h',
             'inspector/InspectorResource.cpp',
             'inspector/InspectorResource.h',
             'inspector/InspectorTimelineAgent.cpp',
@@ -1732,6 +1759,7 @@
             'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
             'page/ContextMenuController.h',
+            'page/ContextMenuSelectionHandler.h',
             'page/DOMSelection.cpp',
             'page/DOMSelection.h',
             'page/DOMTimer.cpp',
@@ -1841,6 +1869,7 @@
             'platform/chromium/FramelessScrollView.cpp',
             'platform/chromium/FramelessScrollView.h',
             'platform/chromium/FramelessScrollViewClient.h',
+            'platform/chromium/GeolocationServiceChromium.cpp',
             'platform/chromium/KeyCodeConversion.h',
             'platform/chromium/KeyCodeConversionGtk.cpp',
             'platform/chromium/KeyboardCodesPosix.h',
@@ -1861,6 +1890,8 @@
             'platform/chromium/ScrollbarThemeChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.h',
             'platform/chromium/ScrollbarThemeChromiumLinux.cpp',
+            'platform/chromium/ScrollbarThemeChromiumMac.h',
+            'platform/chromium/ScrollbarThemeChromiumMac.mm',
             'platform/chromium/ScrollbarThemeChromiumWin.cpp',
             'platform/chromium/SearchPopupMenuChromium.cpp',
             'platform/chromium/SharedTimerChromium.cpp',
@@ -1947,6 +1978,11 @@
             'platform/graphics/filters/FEComposite.h',
             'platform/graphics/filters/FEGaussianBlur.cpp',
             'platform/graphics/filters/FEGaussianBlur.h',
+            'platform/graphics/filters/Filter.h',
+            'platform/graphics/filters/FilterEffect.cpp',
+            'platform/graphics/filters/FilterEffect.h',
+            'platform/graphics/filters/ImageBufferFilter.cpp',
+            'platform/graphics/filters/ImageBufferFilter.h',
             'platform/graphics/filters/SourceAlpha.cpp',
             'platform/graphics/filters/SourceAlpha.h',
             'platform/graphics/filters/SourceGraphic.cpp',
@@ -1974,17 +2010,18 @@
             'platform/graphics/gtk/VideoSinkGStreamer.h',
             'platform/graphics/mac/ColorMac.h',
             'platform/graphics/mac/ColorMac.mm',
-            'platform/graphics/mac/CoreTextController.cpp',
-            'platform/graphics/mac/CoreTextController.h',
+            'platform/graphics/mac/ComplexTextController.cpp',
+            'platform/graphics/mac/ComplexTextController.h',
+            'platform/graphics/mac/ComplexTextControllerATSUI.cpp',
+            'platform/graphics/mac/ComplexTextControllerCoreText.cpp',
             'platform/graphics/mac/FloatPointMac.mm',
             'platform/graphics/mac/FloatRectMac.mm',
             'platform/graphics/mac/FloatSizeMac.mm',
             'platform/graphics/mac/FontCacheMac.mm',
+            'platform/graphics/mac/FontComplexTextMac.cpp',
             'platform/graphics/mac/FontCustomPlatformData.cpp',
             'platform/graphics/mac/FontCustomPlatformData.h',
             'platform/graphics/mac/FontMac.mm',
-            'platform/graphics/mac/FontMacATSUI.mm',
-            'platform/graphics/mac/FontMacCoreText.cpp',
             'platform/graphics/mac/FontPlatformData.h',
             'platform/graphics/mac/FontPlatformDataMac.mm',
             'platform/graphics/mac/GlyphPageTreeNodeMac.cpp',
@@ -2005,6 +2042,8 @@
             'platform/graphics/mac/WebTiledLayer.h',
             'platform/graphics/mac/WebTiledLayer.mm',
             'platform/graphics/MediaPlayer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.h',
             'platform/graphics/opentype/OpenTypeUtilities.cpp',
             'platform/graphics/opentype/OpenTypeUtilities.h',
             'platform/graphics/qt/ColorQt.cpp',
@@ -2441,6 +2480,7 @@
             'platform/network/win/ResourceHandleWin.h',
             'platform/network/AuthenticationChallengeBase.cpp',
             'platform/network/AuthenticationChallengeBase.h',
+            'platform/network/AuthenticationClient.h',
             'platform/network/Credential.cpp',
             'platform/network/Credential.h',
             'platform/network/DNS.h',
@@ -2575,7 +2615,7 @@
             'platform/text/StringImpl.cpp',
             'platform/text/StringImpl.h',
             'platform/text/TextBoundaries.h',
-            'platform/text/TextBoundariesICU.cpp',
+            'platform/text/TextBoundaries.cpp',
             'platform/text/TextBreakIterator.h',
             'platform/text/TextBreakIteratorICU.cpp',
             'platform/text/TextBreakIteratorInternalICU.h',
@@ -2775,6 +2815,7 @@
             'platform/Widget.cpp',
             'platform/Widget.h',
             'plugins/chromium/PluginDataChromium.cpp',
+            'plugins/chromium/PluginDataChromium.h',
             'plugins/gtk/PluginDataGtk.cpp',
             'plugins/gtk/PluginPackageGtk.cpp',
             'plugins/gtk/PluginViewGtk.cpp',
@@ -2980,6 +3021,14 @@
             'rendering/RenderReplaced.h',
             'rendering/RenderReplica.cpp',
             'rendering/RenderReplica.h',
+            'rendering/RenderRuby.cpp',
+            'rendering/RenderRuby.h',
+            'rendering/RenderRubyBase.cpp',
+            'rendering/RenderRubyBase.h',
+            'rendering/RenderRubyRun.cpp',
+            'rendering/RenderRubyRun.h',
+            'rendering/RenderRubyText.cpp',
+            'rendering/RenderRubyText.h',
             'rendering/RenderSVGBlock.cpp',
             'rendering/RenderSVGBlock.h',
             'rendering/RenderSVGContainer.cpp',
@@ -3088,6 +3137,11 @@
             'rendering/break_lines.h',
             'storage/ChangeVersionWrapper.cpp',
             'storage/ChangeVersionWrapper.h',
+            'storage/chromium/DatabaseObserver.h',
+            'storage/chromium/DatabaseTrackerChromium.cpp',
+            'storage/chromium/QuotaTracker.cpp',
+            'storage/chromium/QuotaTracker.h',
+            'storage/chromium/SQLTransactionClientChromium.cpp',
             'storage/Database.cpp',
             'storage/Database.h',
             'storage/DatabaseAuthorizer.cpp',
@@ -3173,8 +3227,10 @@
             'svg/graphics/filters/SVGFETile.h',
             'svg/graphics/filters/SVGFETurbulence.cpp',
             'svg/graphics/filters/SVGFETurbulence.h',
-            'svg/graphics/filters/SVGFilterEffect.cpp',
-            'svg/graphics/filters/SVGFilterEffect.h',
+            'svg/graphics/filters/SVGFilter.cpp',
+            'svg/graphics/filters/SVGFilter.h',
+            'svg/graphics/filters/SVGFilterBuilder.cpp',
+            'svg/graphics/filters/SVGFilterBuilder.h',
             'svg/graphics/filters/SVGLightSource.cpp',
             'svg/graphics/filters/SVGLightSource.h',
             'svg/graphics/filters/SVGPointLightSource.h',
@@ -3207,12 +3263,6 @@
             'svg/ColorDistance.cpp',
             'svg/ColorDistance.h',
             'svg/ElementTimeControl.h',
-            'svg/Filter.cpp',
-            'svg/Filter.h',
-            'svg/FilterBuilder.h',
-            'svg/FilterBuilder.cpp',
-            'svg/FilterEffect.cpp',
-            'svg/FilterEffect.h',
             'svg/GradientAttributes.h',
             'svg/LinearGradientAttributes.h',
             'svg/PatternAttributes.h',
@@ -3595,7 +3645,9 @@
             'inspector/front-end/CallStackSidebarPane.js',
             'inspector/front-end/ChangesView.js',
             'inspector/front-end/Color.js',
+            'inspector/front-end/ConsolePanel.js',
             'inspector/front-end/ConsoleView.js',
+            'inspector/front-end/ContextMenu.js',
             'inspector/front-end/CookieItemsView.js',
             'inspector/front-end/Database.js',
             'inspector/front-end/DatabaseQueryView.js',
@@ -3603,7 +3655,6 @@
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DOMAgent.js',
             'inspector/front-end/DOMStorage.js',
-            'inspector/front-end/DOMStorageDataGrid.js',
             'inspector/front-end/DOMStorageItemsView.js',
             'inspector/front-end/Drawer.js',
             'inspector/front-end/ElementsPanel.js',
@@ -3611,7 +3662,8 @@
             'inspector/front-end/EventListenersSidebarPane.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/ImageView.js',
-            'inspector/front-end/InspectorControllerStub.js',
+            'inspector/front-end/InspectorBackendStub.js',
+            'inspector/front-end/InspectorFrontendHostStub.js',
             'inspector/front-end/InjectedScript.js',
             'inspector/front-end/InjectedScriptAccess.js',
             'inspector/front-end/inspector.js',
@@ -3648,6 +3700,8 @@
             'inspector/front-end/TestController.js',
             'inspector/front-end/TextPrompt.js',
             'inspector/front-end/TimelineAgent.js',
+            'inspector/front-end/TimelineOverviewPane.js',
+            'inspector/front-end/TimelineGrid.js',
             'inspector/front-end/TimelinePanel.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
             'inspector/front-end/treeoutline.js',
@@ -3664,6 +3718,7 @@
             'inspector/front-end/Images/clearConsoleButtonGlyph.png',
             'inspector/front-end/Images/closeButtons.png',
             'inspector/front-end/Images/consoleButtonGlyph.png',
+            'inspector/front-end/Images/consoleIcon.png',
             'inspector/front-end/Images/cookie.png',
             'inspector/front-end/Images/database.png',
             'inspector/front-end/Images/databaseTable.png',
@@ -3687,6 +3742,7 @@
             'inspector/front-end/Images/enableSolidButtonGlyph.png',
             'inspector/front-end/Images/errorIcon.png',
             'inspector/front-end/Images/errorMediumIcon.png',
+            'inspector/front-end/Images/errorRedDot.png',            
             'inspector/front-end/Images/excludeButtonGlyph.png',
             'inspector/front-end/Images/focusButtonGlyph.png',
             'inspector/front-end/Images/forward.png',
@@ -3749,6 +3805,7 @@
             'inspector/front-end/Images/statusbarResizerHorizontal.png',
             'inspector/front-end/Images/statusbarResizerVertical.png',
             'inspector/front-end/Images/storageIcon.png',
+            'inspector/front-end/Images/successGreenDot.png',
             'inspector/front-end/Images/timelineHollowPillBlue.png',
             'inspector/front-end/Images/timelineHollowPillGray.png',
             'inspector/front-end/Images/timelineHollowPillGreen.png',
@@ -3789,6 +3846,7 @@
             'inspector/front-end/Images/userInputPreviousIcon.png',
             'inspector/front-end/Images/userInputResultIcon.png',
             'inspector/front-end/Images/warningIcon.png',
+            'inspector/front-end/Images/warningOrangeDot.png',
             'inspector/front-end/Images/warningMediumIcon.png',
             'inspector/front-end/Images/warningsErrors.png',
             'inspector/front-end/Images/whiteConnectorPoint.png'
diff --git a/WebCore/WebCore.order b/WebCore/WebCore.order
index c1040e2..3144ec1 100644
--- a/WebCore/WebCore.order
+++ b/WebCore/WebCore.order
@@ -19747,8 +19747,6 @@ __ZN7WebCore15JSMimeTypeArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierER
 __ZN7WebCore13MimeTypeArray4itemEj
 __ZN7WebCore14jsMimeTypeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8MimeType4typeEv
-__ZNK7WebCore16JSDOMWindowShell21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
-__ZNK7WebCore11JSDOMWindow21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
 __ZNK7WebCore9RenderBox20firstLineBoxBaselineEv
 __ZN7WebCore10ClientRectC1Ev
 __ZN7WebCore10ClientRectC2Ev
diff --git a/WebCore/WebCore.pro b/WebCore/WebCore.pro
index 9a4e9d8..bfeee61 100644
--- a/WebCore/WebCore.pro
+++ b/WebCore/WebCore.pro
@@ -12,10 +12,13 @@ symbian: {
     DEPLOYMENT += webkitlibs
 
     TARGET.UID3 = 0x200267C2
+    # Need to guarantee that these come before system includes of /epoc32/include
+    MMP_RULES += "USERINCLUDE rendering"
+    MMP_RULES += "USERINCLUDE platform/text"
+    # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
+    # Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
+    MMP_RULES += "LINKEROPTION  armcc --rw-base 0xE00000"
 }
-# RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
-# base address to start from 0x800000 instead of the toolchain default 0x400000.
-symbian-sbsv2: MMP_RULES += "LINKEROPTION  armcc --rw-base 0x800000"
 
 include($$PWD/../WebKit.pri)
 
@@ -47,7 +50,6 @@ GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR${QMAKE_DIR_SEP}
 
 unix {
     QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
-    lessThan(QT_MINOR_VERSION, 4): QMAKE_PKGCONFIG_REQUIRES += QtXml
 }
 
 unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
@@ -128,7 +130,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 }
 
 !contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
-!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
+!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=1
 !contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
 #!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
 !contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
@@ -150,9 +152,6 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
 }
 
-# HTML5 ruby support
-!contains(DEFINES, ENABLE_RUBY=.): DEFINES += ENABLE_RUBY=1
-
 # HTML5 media support
 !contains(DEFINES, ENABLE_VIDEO=.) {
     contains(QT_CONFIG, phonon):DEFINES += ENABLE_VIDEO=1
@@ -180,7 +179,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     else:DEFINES += ENABLE_XSLT=0
 }
 
-DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
+DEFINES += WTF_CHANGES=1
 
 # Used to compute defaults for the build-webkit script
 CONFIG(compute_defaults) {
@@ -253,7 +252,6 @@ INCLUDEPATH = \
     $$INCLUDEPATH
 
 QT += network
-lessThan(QT_MINOR_VERSION, 4): QT += xml
 
 QMAKE_EXTRA_TARGETS += generated_files
 
@@ -299,10 +297,6 @@ STYLESHEETS_EMBED = \
     $$PWD/css/mediaControls.css \
     $$PWD/css/mediaControlsQt.css
 
-DOMLUT_FILES += \
-    bindings/js/JSDOMWindowBase.cpp \
-    bindings/js/JSWorkerContextBase.cpp
-
 IDL_BINDINGS += \
     css/Counter.idl \
     css/CSSCharsetRule.idl \
@@ -338,6 +332,7 @@ IDL_BINDINGS += \
     dom/Clipboard.idl \
     dom/CDATASection.idl \
     dom/Comment.idl \
+    dom/CompositionEvent.idl \
     dom/DocumentFragment.idl \
     dom/Document.idl \
     dom/DocumentType.idl \
@@ -365,6 +360,7 @@ IDL_BINDINGS += \
     dom/Notation.idl \
     dom/OverflowEvent.idl \
     dom/PageTransitionEvent.idl \
+    dom/PopStateEvent.idl \
     dom/ProcessingInstruction.idl \
     dom/ProgressEvent.idl \
     dom/RangeException.idl \
@@ -376,20 +372,20 @@ IDL_BINDINGS += \
     dom/WebKitAnimationEvent.idl \
     dom/WebKitTransitionEvent.idl \
     dom/WheelEvent.idl \
-    html/canvas/CanvasArray.idl \
-    html/canvas/CanvasArrayBuffer.idl \
-    html/canvas/CanvasByteArray.idl \
-    html/canvas/CanvasFloatArray.idl \
+    html/canvas/WebGLArray.idl \
+    html/canvas/WebGLArrayBuffer.idl \
+    html/canvas/WebGLByteArray.idl \
+    html/canvas/WebGLFloatArray.idl \
     html/canvas/CanvasGradient.idl \
-    html/canvas/CanvasIntArray.idl \
+    html/canvas/WebGLIntArray.idl \
     html/canvas/CanvasPattern.idl \
     html/canvas/CanvasRenderingContext.idl \
     html/canvas/CanvasRenderingContext2D.idl \
-    html/canvas/CanvasRenderingContext3D.idl \
-    html/canvas/CanvasShortArray.idl \
-    html/canvas/CanvasUnsignedByteArray.idl \
-    html/canvas/CanvasUnsignedIntArray.idl \
-    html/canvas/CanvasUnsignedShortArray.idl \
+    html/canvas/WebGLRenderingContext.idl \
+    html/canvas/WebGLShortArray.idl \
+    html/canvas/WebGLUnsignedByteArray.idl \
+    html/canvas/WebGLUnsignedIntArray.idl \
+    html/canvas/WebGLUnsignedShortArray.idl \
     html/DataGridColumn.idl \
     html/DataGridColumnList.idl \
     html/File.idl \
@@ -470,7 +466,9 @@ IDL_BINDINGS += \
     html/TimeRanges.idl \
     html/ValidityState.idl \
     html/VoidCallback.idl \
+    inspector/InjectedScriptHost.idl \
     inspector/InspectorBackend.idl \
+    inspector/InspectorFrontendHost.idl \
     inspector/JavaScriptCallFrame.idl \
     loader/appcache/DOMApplicationCache.idl \
     page/BarInfo.idl \
@@ -499,6 +497,30 @@ IDL_BINDINGS += \
     storage/SQLResultSet.idl \
     storage/SQLResultSetRowList.idl \
     storage/SQLTransaction.idl \
+    websockets/WebSocket.idl \
+    workers/AbstractWorker.idl \
+    workers/DedicatedWorkerContext.idl \
+    workers/SharedWorker.idl \
+    workers/SharedWorkerContext.idl \
+    workers/Worker.idl \
+    workers/WorkerContext.idl \
+    workers/WorkerLocation.idl \
+    xml/DOMParser.idl \
+    xml/XMLHttpRequest.idl \
+    xml/XMLHttpRequestException.idl \
+    xml/XMLHttpRequestProgressEvent.idl \
+    xml/XMLHttpRequestUpload.idl \
+    xml/XMLSerializer.idl \
+    xml/XPathNSResolver.idl \
+    xml/XPathException.idl \
+    xml/XPathExpression.idl \
+    xml/XPathResult.idl \
+    xml/XPathEvaluator.idl \
+    xml/XSLTProcessor.idl
+
+contains(DEFINES, ENABLE_SVG=1) {
+
+  IDL_BINDINGS += \
     svg/SVGZoomEvent.idl \
     svg/SVGAElement.idl \
     svg/SVGAltGlyphElement.idl \
@@ -631,28 +653,9 @@ IDL_BINDINGS += \
     svg/SVGTSpanElement.idl \
     svg/SVGUnitTypes.idl \
     svg/SVGUseElement.idl \
-    svg/SVGViewElement.idl \
-    websockets/WebSocket.idl \
-    workers/AbstractWorker.idl \
-    workers/DedicatedWorkerContext.idl \
-    workers/SharedWorker.idl \
-    workers/SharedWorkerContext.idl \
-    workers/Worker.idl \
-    workers/WorkerContext.idl \
-    workers/WorkerLocation.idl \
-    xml/DOMParser.idl \
-    xml/XMLHttpRequest.idl \
-    xml/XMLHttpRequestException.idl \
-    xml/XMLHttpRequestProgressEvent.idl \
-    xml/XMLHttpRequestUpload.idl \
-    xml/XMLSerializer.idl \
-    xml/XPathNSResolver.idl \
-    xml/XPathException.idl \
-    xml/XPathExpression.idl \
-    xml/XPathResult.idl \
-    xml/XPathEvaluator.idl \
-    xml/XSLTProcessor.idl
+    svg/SVGViewElement.idl
 
+}
 
 SOURCES += \
     accessibility/AccessibilityImageMapLink.cpp \
@@ -723,8 +726,9 @@ SOURCES += \
     bindings/js/JSHTMLSelectElementCustom.cpp \
     bindings/js/JSImageConstructor.cpp \
     bindings/js/JSImageDataCustom.cpp \
+    bindings/js/JSInjectedScriptHostCustom.cpp \
     bindings/js/JSInspectedObjectWrapper.cpp \
-    bindings/js/JSInspectorBackendCustom.cpp \
+    bindings/js/JSInspectorFrontendHostCustom.cpp \
     bindings/js/JSInspectorCallbackWrapper.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
@@ -757,6 +761,7 @@ SOURCES += \
     bindings/js/JSEventListener.cpp \
     bindings/js/JSLazyEventListener.cpp \
     bindings/js/JSPluginElementFunctions.cpp \
+    bindings/js/JSPopStateEventCustom.cpp \
     bindings/js/ScriptArray.cpp \
     bindings/js/ScriptCachedFrameData.cpp \
     bindings/js/ScriptCallFrame.cpp \
@@ -765,7 +770,6 @@ SOURCES += \
     bindings/js/ScriptEventListener.cpp \
     bindings/js/ScriptFunctionCall.cpp \
     bindings/js/ScriptObject.cpp \
-    bindings/js/ScriptObjectQuarantine.cpp \
     bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
@@ -852,13 +856,13 @@ SOURCES += \
     dom/CharacterData.cpp \
     dom/CheckedRadioButtons.cpp \
     dom/ChildNodeList.cpp \
-    dom/ClassNames.cpp \
     dom/ClassNodeList.cpp \
     dom/ClientRect.cpp \
     dom/ClientRectList.cpp \
     dom/Clipboard.cpp \
     dom/ClipboardEvent.cpp \
     dom/Comment.cpp \
+    dom/CompositionEvent.cpp \
     dom/ContainerNode.cpp \
     dom/CSSMappedAttributeDeclaration.cpp \
     dom/Document.cpp \
@@ -898,6 +902,7 @@ SOURCES += \
     dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
     dom/PageTransitionEvent.cpp \
+    dom/PopStateEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
     dom/ProcessingInstruction.cpp \
@@ -909,6 +914,7 @@ SOURCES += \
     dom/ScriptExecutionContext.cpp \
     dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
+    dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
     dom/StyleElement.cpp \
@@ -1073,16 +1079,19 @@ SOURCES += \
     html/HTMLTokenizer.cpp \
     html/HTMLUListElement.cpp \
     html/HTMLViewSourceDocument.cpp \
+    html/ISODateTime.cpp \
     html/ImageData.cpp \
     html/PreloadScanner.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/InjectedScriptHost.cpp \
     inspector/InspectorBackend.cpp \
     inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDOMAgent.cpp \
     inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorFrontend.cpp \
+    inspector/InspectorFrontendHost.cpp \
     inspector/InspectorResource.cpp \
     inspector/InspectorTimelineAgent.cpp \
     inspector/TimelineRecordFactory.cpp \
@@ -1188,8 +1197,8 @@ SOURCES += \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
     platform/image-decoders/qt/RGBA32BufferQt.cpp \
-    platform/graphics/filters/FEGaussianBlur.cpp \
     platform/graphics/FontDescription.cpp \
+    platform/graphics/FontFallbackList.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
     platform/graphics/Color.cpp \
@@ -1200,6 +1209,7 @@ SOURCES += \
     platform/graphics/FloatSize.cpp \
     platform/graphics/FontData.cpp \
     platform/graphics/Font.cpp \
+    platform/graphics/FontCache.cpp \
     platform/graphics/GeneratedImage.cpp \
     platform/graphics/Gradient.cpp \
     platform/graphics/GraphicsContext.cpp \
@@ -1311,6 +1321,10 @@ SOURCES += \
     rendering/RenderPartObject.cpp \
     rendering/RenderReplaced.cpp \
     rendering/RenderReplica.cpp \
+    rendering/RenderRuby.cpp \
+    rendering/RenderRubyBase.cpp \
+    rendering/RenderRubyRun.cpp \
+    rendering/RenderRubyText.cpp \
     rendering/RenderScrollbar.cpp \
     rendering/RenderScrollbarPart.cpp \
     rendering/RenderScrollbarTheme.cpp \
@@ -1437,7 +1451,6 @@ HEADERS += \
     bindings/js/ScriptEventListener.h \
     bindings/js/ScriptFunctionCall.h \
     bindings/js/ScriptObject.h \
-    bindings/js/ScriptObjectQuarantine.h \
     bindings/js/ScriptSourceCode.h \
     bindings/js/ScriptSourceProvider.h \
     bindings/js/ScriptState.h \
@@ -1529,7 +1542,6 @@ HEADERS += \
     dom/CharacterData.h \
     dom/CheckedRadioButtons.h \
     dom/ChildNodeList.h \
-    dom/ClassNames.h \
     dom/ClassNodeList.h \
     dom/ClientRect.h \
     dom/ClientRectList.h \
@@ -1586,6 +1598,7 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectElement.h \
     dom/SelectorNodeList.h \
+    dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
     dom/StyleElement.h \
@@ -1749,16 +1762,19 @@ HEADERS += \
     html/HTMLUListElement.h \
     html/HTMLVideoElement.h \
     html/HTMLViewSourceDocument.h \
+    html/ISODateTime.h \
     html/ImageData.h \
     html/PreloadScanner.h \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
+    inspector/InjectedScriptHost.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDOMStorageResource.h \
     inspector/InspectorFrontend.h \
+    inspector/InspectorFrontendHost.h \
     inspector/InspectorResource.h \
     inspector/InspectorTimelineAgent.h \
     inspector/JavaScriptCallFrame.h \
@@ -1824,6 +1840,7 @@ HEADERS += \
     page/Chrome.h \
     page/Console.h \
     page/ContextMenuController.h \
+    page/ContextMenuSelectionHandler.h \
     page/Coordinates.h \
     page/DOMSelection.h \
     page/DOMTimer.h \
@@ -1919,6 +1936,7 @@ HEADERS += \
     platform/Logging.h \
     platform/MIMETypeRegistry.h \
     platform/network/AuthenticationChallengeBase.h \
+    platform/network/AuthenticationClient.h \
     platform/network/Credential.h \
     platform/network/FormDataBuilder.h \
     platform/network/FormData.h \
@@ -2025,6 +2043,10 @@ HEADERS += \
     rendering/RenderPath.h \
     rendering/RenderReplaced.h \
     rendering/RenderReplica.h \
+    rendering/RenderRuby.h \
+    rendering/RenderRubyBase.h \
+    rendering/RenderRubyRun.h \
+    rendering/RenderRubyText.h \
     rendering/RenderScrollbar.h \
     rendering/RenderScrollbarPart.h \
     rendering/RenderScrollbarTheme.h \
@@ -2327,6 +2349,7 @@ HEADERS += \
     xml/XSLTExtensions.h \
     xml/XSLTProcessor.h \
     xml/XSLTUnicodeSort.h \
+    $$PWD/../WebKit/qt/Api/qwebplugindatabase_p.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
     $$PWD/platform/network/qt/DnsPrefetchHelper.h
 
@@ -2342,7 +2365,6 @@ SOURCES += \
     platform/graphics/qt/TransformationMatrixQt.cpp \
     platform/graphics/qt/ColorQt.cpp \
     platform/graphics/qt/FontQt.cpp \
-    platform/graphics/qt/FontQt43.cpp \
     platform/graphics/qt/FontPlatformDataQt.cpp \
     platform/graphics/qt/FloatPointQt.cpp \
     platform/graphics/qt/FloatRectQt.cpp \
@@ -2376,7 +2398,6 @@ SOURCES += \
     platform/qt/SharedBufferQt.cpp \
     platform/graphics/qt/FontCacheQt.cpp \
     platform/graphics/qt/FontCustomPlatformData.cpp \
-    platform/graphics/qt/FontFallbackListQt.cpp \
     platform/graphics/qt/GlyphPageTreeNodeQt.cpp \
     platform/graphics/qt/SimpleFontDataQt.cpp \
     platform/qt/KURLQt.cpp \
@@ -2398,7 +2419,7 @@ SOURCES += \
     platform/qt/LoggingQt.cpp \
     platform/text/qt/StringQt.cpp \
     platform/qt/TemporaryLinkStubs.cpp \
-    platform/text/qt/TextBoundaries.cpp \
+    platform/text/qt/TextBoundariesQt.cpp \
     platform/text/qt/TextBreakIteratorQt.cpp \
     platform/text/qt/TextCodecQt.cpp \
     platform/qt/WheelEventQt.cpp \
@@ -2432,7 +2453,9 @@ SOURCES += \
     mac {
         SOURCES += \
             platform/text/cf/StringCF.cpp \
-            platform/text/cf/StringImplCF.cpp
+            platform/text/cf/StringImplCF.cpp \
+            platform/cf/SharedBufferCF.cpp \
+            editing/SmartReplaceCF.cpp
         LIBS_PRIVATE += -framework Carbon -framework AppKit
     }
 
@@ -2443,20 +2466,6 @@ SOURCES += \
     }
     wince*: LIBS += -lmmtimer
 
-    # Files belonging to the Qt 4.3 build
-    lessThan(QT_MINOR_VERSION, 4) {
-        HEADERS += \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface.h \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface_p.h \
-            $$PWD/../WebKit/qt/Api/qcookiejar.h
-
-        SOURCES += \
-            ../WebKit/qt/Api/qwebnetworkinterface.cpp \
-            ../WebKit/qt/Api/qcookiejar.cpp
-
-        DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-     }
-
 contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
@@ -2500,13 +2509,15 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
         }
     
         win32-* {
-            INCLUDEPATH += $$PWD/plugins/win
+            INCLUDEPATH += $$PWD/plugins/win \
+                           $$PWD/platform/win
     
             SOURCES += page/win/PageWin.cpp \
                        plugins/win/PluginDatabaseWin.cpp \
                        plugins/win/PluginPackageWin.cpp \
                        plugins/win/PluginMessageThrottlerWin.cpp \
-                       plugins/win/PluginViewWin.cpp
+                       plugins/win/PluginViewWin.cpp \
+                       platform/win/BitmapInfo.cpp
     
             LIBS += \
                 -ladvapi32 \
@@ -3175,14 +3186,6 @@ idl.depends = $$PWD/bindings/scripts/generate-bindings.pl \
 idl.CONFIG += target_predeps
 addExtraCompilerWithHeader(idl)
 
-# GENERATOR 2-A: LUT creator
-domlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
-domlut.commands = perl $$PWD/../JavaScriptCore/create_hash_table ${QMAKE_FILE_NAME} -n WebCore > ${QMAKE_FILE_OUT}
-domlut.depend = ${QMAKE_FILE_NAME}
-domlut.input = DOMLUT_FILES
-domlut.CONFIG += no_link
-addExtraCompiler(domlut)
-
 # GENERATOR 3: tokenizer (flex)
 tokenizer.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
 tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$PWD/css/maketokenizer > ${QMAKE_FILE_OUT}
diff --git a/WebCore/WebCore.qrc b/WebCore/WebCore.qrc
index 69f860a..6da93c6 100644
--- a/WebCore/WebCore.qrc
+++ b/WebCore/WebCore.qrc
@@ -12,5 +12,6 @@
     <file alias="copyCursor.png">Resources/copyCursor.png</file>
     <file alias="progressCursor.png">Resources/progressCursor.png</file>
     <file alias="aliasCursor.png">Resources/aliasCursor.png</file>
+    <file alias="deleteButton.png">Resources/deleteButton.png</file>
 </qresource>
 </RCC>
diff --git a/WebCore/WebCore.vcproj/QTMovieWin.vcproj b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
index 714f6ee..901d24d 100644
--- a/WebCore/WebCore.vcproj/QTMovieWin.vcproj
+++ b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
@@ -39,7 +39,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QTInternalSDK\CIncludes&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

 				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

 				DisableSpecificWarnings="4819"

 			/>

@@ -57,7 +57,7 @@
 				Name="VCLinkerTool"

 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QTInternalSDK\Libraries&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

 				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

@@ -112,7 +112,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QTInternalSDK\CIncludes&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

 				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

 				DisableSpecificWarnings="4819"

 			/>

@@ -130,7 +130,7 @@
 				Name="VCLinkerTool"

 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QTInternalSDK\Libraries&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

 				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

@@ -184,7 +184,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QTInternalSDK\CIncludes&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

 				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

 				DisableSpecificWarnings="4819"

 			/>

@@ -202,7 +202,7 @@
 				Name="VCLinkerTool"

 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QTInternalSDK\Libraries&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

 				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

@@ -256,7 +256,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QTInternalSDK\CIncludes&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

 				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

 				DisableSpecificWarnings="4819"

 			/>

@@ -274,7 +274,7 @@
 				Name="VCLinkerTool"

 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QTInternalSDK\Libraries&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

 				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

diff --git a/WebCore/WebCore.vcproj/WebCore.vcproj b/WebCore/WebCore.vcproj/WebCore.vcproj
index d5ef6f4..09945f5 100644
--- a/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -38,7 +38,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -67,7 +68,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -94,7 +95,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -123,7 +125,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -149,7 +151,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -178,7 +181,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -204,7 +207,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -233,7 +237,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -260,7 +264,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -289,7 +294,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -315,7 +320,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -344,7 +350,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -1281,6 +1287,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCompositionEvent.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCompositionEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSConsole.cpp"

 				>

 				<FileConfiguration

@@ -7669,118 +7731,30 @@
 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInjectedScriptHost.cpp"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInjectedScriptHost.h"

 				>

-				<FileConfiguration

-					Name="Debug|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Internal|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Cairo|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_Cairo|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_All|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

 				>

-				<FileConfiguration

-					Name="Debug|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Internal|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Cairo|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_Cairo|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_All|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.h"

 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorFrontendHost.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorFrontendHost.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSJavaScriptCallFrame.cpp"

 				>

 				<FileConfiguration

@@ -9237,6 +9211,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPopStateEvent.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPopStateEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.cpp"

 				>

 				<FileConfiguration

@@ -20497,6 +20527,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\ContextMenuSelectionHandler.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\Coordinates.h"

 				>

 			</File>

@@ -21992,6 +22026,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\TextRenderingMode.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\win\WCDataObject.cpp"

 					>

 					<FileConfiguration

@@ -22054,6 +22092,68 @@
 					>

 				</File>

 				<File

+					RelativePath="..\WebCorePrefix.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\WebCorePrefix.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\win\WebCoreTextRenderer.cpp"

 					>

 				</File>

@@ -22126,6 +22226,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\ColorPath.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\FloatPoint.cpp"

 					>

 				</File>

@@ -22334,6 +22438,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\GraphicsLayer.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\graphics\GraphicsLayer.h"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\graphics\GraphicsLayerClient.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\GraphicsTypes.cpp"

 					>

 				</File>

@@ -22833,6 +22949,14 @@
 						>

 					</File>

 					<File

+						RelativePath="..\platform\graphics\win\GraphicsLayerCACF.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\GraphicsLayerCACF.h"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\graphics\win\IconWin.cpp"

 						>

 					</File>

@@ -23028,6 +23152,30 @@
 						RelativePath="..\platform\graphics\win\UniscribeController.h"

 						>

 					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFContextFlusher.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFContextFlusher.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFLayer.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFLayer.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFLayerRenderer.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFLayerRenderer.h"

+						>

+					</File>

 				</Filter>

 				<Filter

 					Name="cg"

@@ -23937,6 +24085,14 @@
 						>

 					</File>

 					<File

+						RelativePath="..\platform\graphics\filters\ImageBufferFilter.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\ImageBufferFilter.h"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\graphics\filters\SourceAlpha.cpp"

 						>

 					</File>

@@ -23966,6 +24122,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\AuthenticationClient.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\Credential.cpp"

 					>

 				</File>

@@ -24157,6 +24317,26 @@
 						</FileConfiguration>

 					</File>

 					<File

+						RelativePath="..\platform\network\cf\CredentialStorageCFNet.cpp"

+						>

+						<FileConfiguration

+							Name="Debug_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

 						RelativePath="..\platform\network\cf\DNSCFNet.cpp"

 						>

 						<FileConfiguration

@@ -24217,6 +24397,14 @@
 						</FileConfiguration>

 					</File>

 					<File

+						RelativePath="..\platform\network\cf\LoaderRunLoopCF.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\network\cf\LoaderRunLoopCF.h"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\network\cf\ResourceError.h"

 						>

 						<FileConfiguration

@@ -25102,11 +25290,11 @@
 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\TextBoundaries.h"

+					RelativePath="..\platform\text\TextBoundaries.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\TextBoundariesICU.cpp"

+					RelativePath="..\platform\text\TextBoundaries.h"

 					>

 				</File>

 				<File

@@ -27015,6 +27203,22 @@
 				>

 			</File>

 			<File

+				RelativePath="..\rendering\RenderLayerBacking.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderLayerBacking.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderLayerCompositor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderLayerCompositor.h"

+				>

+			</File>

+			<File

 				RelativePath="..\rendering\RenderLineBoxList.cpp"

 				>

 			</File>

@@ -27167,6 +27371,38 @@
 				>

 			</File>

 			<File

+				RelativePath="..\rendering\RenderRuby.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRuby.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyBase.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyBase.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyRun.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyRun.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyText.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyText.h"

+				>

+			</File>

+			<File

 				RelativePath="..\rendering\RenderScrollbar.cpp"

 				>

 			</File>

@@ -28207,14 +28443,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\dom\ClassNames.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\dom\ClassNames.h"

-				>

-			</File>

-			<File

 				RelativePath="..\dom\ClassNodeList.cpp"

 				>

 			</File>

@@ -28267,6 +28495,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\CompositionEvent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\CompositionEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\ContainerNode.cpp"

 				>

 			</File>

@@ -28611,6 +28847,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\PopStateEvent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\PopStateEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\Position.cpp"

 				>

 			</File>

@@ -28707,6 +28951,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\SpaceSplitString.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\SpaceSplitString.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\StaticNodeList.cpp"

 				>

 			</File>

@@ -33691,6 +33943,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\ISODateTime.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\ISODateTime.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\MediaError.h"

 				>

 			</File>

@@ -33744,6 +34004,54 @@
 				<File

 					RelativePath="..\bindings\js\GCController.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\GCController.h"

@@ -33752,22 +34060,218 @@
 				<File

 					RelativePath="..\bindings\js\JSAbstractWorkerCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSAttrCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSAudioConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSAudioConstructor.h"

 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSBindingsAllInOne.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSCallbackData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCallbackData.h"

@@ -33776,42 +34280,522 @@
 				<File

 					RelativePath="..\bindings\js\JSCanvasRenderingContext2DCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCanvasRenderingContextCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCDATASectionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSClipboardCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSConsoleCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCoordinatesCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCSSRuleCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCSSRuleListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCSSStyleDeclarationCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCSSValueCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomPositionCallback.cpp"

@@ -33824,6 +34808,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomSQLStatementCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomSQLStatementCallback.h"

@@ -33832,6 +34864,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomSQLStatementErrorCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomSQLStatementErrorCallback.h"

@@ -33840,6 +34920,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomSQLTransactionCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomSQLTransactionCallback.h"

@@ -33848,6 +34976,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomSQLTransactionErrorCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomSQLTransactionErrorCallback.h"

@@ -33856,6 +35032,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomVoidCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomVoidCallback.h"

@@ -33864,6 +35088,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomXPathNSResolver.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomXPathNSResolver.h"

@@ -33872,42 +35144,470 @@
 				<File

 					RelativePath="..\bindings\js\JSDatabaseCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDataGridColumnListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDataGridDataSource.cpp"

 					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSDataGridDataSource.cpp"

-					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDedicatedWorkerContextCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDesktopNotificationsCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDocumentCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDocumentFragmentCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMApplicationCacheCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMBinding.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMBinding.h"

@@ -33916,6 +35616,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDOMGlobalObject.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMGlobalObject.h"

@@ -33924,6 +35672,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDOMWindowBase.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMWindowBase.h"

@@ -33932,6 +35728,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDOMWindowCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMWindowCustom.h"

@@ -33940,6 +35784,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDOMWindowShell.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMWindowShell.h"

@@ -33948,14 +35840,158 @@
 				<File

 					RelativePath="..\bindings\js\JSElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventListener.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventListener.h"

@@ -33964,6 +36000,54 @@
 				<File

 					RelativePath="..\bindings\js\JSEventSourceConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventSourceConstructor.h"

@@ -33972,10 +36056,106 @@
 				<File

 					RelativePath="..\bindings\js\JSEventSourceCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventTarget.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventTarget.h"

@@ -33984,6 +36164,54 @@
 				<File

 					RelativePath="..\bindings\js\JSExceptionBase.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSExceptionBase.h"

@@ -33996,58 +36224,730 @@
 				<File

 					RelativePath="..\bindings\js\JSHistoryCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLAllCollectionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLAppletElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLCanvasElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLCollectionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLDataGridElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLDocumentCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLEmbedElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLFormElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLFrameElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLFrameSetElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLIFrameElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLInputElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLInputElementCustom.h"

@@ -34056,14 +36956,158 @@
 				<File

 					RelativePath="..\bindings\js\JSHTMLObjectElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLOptionsCollectionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLSelectElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLSelectElementCustom.h"

@@ -34072,6 +37116,54 @@
 				<File

 					RelativePath="..\bindings\js\JSImageConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSImageConstructor.h"

@@ -34080,18 +37172,214 @@
 				<File

 					RelativePath="..\bindings\js\JSImageDataCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSInspectedObjectWrapper.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSInspectedObjectWrapper.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSInspectorBackendCustom.cpp"

+					RelativePath="..\bindings\js\JSInjectedScriptHostCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSInspectorFrontendHostCustom.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSInspectorCallbackWrapper.cpp"

@@ -34104,10 +37392,106 @@
 				<File

 					RelativePath="..\bindings\js\JSJavaScriptCallFrameCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSLazyEventListener.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSLazyEventListener.h"

@@ -34116,10 +37500,106 @@
 				<File

 					RelativePath="..\bindings\js\JSLocationCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessageChannelConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessageChannelConstructor.h"

@@ -34128,14 +37608,158 @@
 				<File

 					RelativePath="..\bindings\js\JSMessageChannelCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessageEventCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessagePortCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessagePortCustom.h"

@@ -34144,22 +37768,262 @@
 				<File

 					RelativePath="..\bindings\js\JSMimeTypeArrayCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNamedNodeMapCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNavigatorCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeFilterCondition.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeFilterCondition.h"

@@ -34168,18 +38032,210 @@
 				<File

 					RelativePath="..\bindings\js\JSNodeFilterCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeIteratorCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSOptionConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSOptionConstructor.h"

@@ -34188,22 +38244,218 @@
 				<File

 					RelativePath="..\bindings\js\JSPluginArrayCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSPluginCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSPluginElementFunctions.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSPluginElementFunctions.h"

 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSPopStateEventCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSQuarantinedObjectWrapper.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSQuarantinedObjectWrapper.h"

@@ -34212,6 +38464,54 @@
 				<File

 					RelativePath="..\bindings\js\JSSharedWorkerConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSharedWorkerConstructor.h"

@@ -34220,46 +38520,574 @@
 				<File

 					RelativePath="..\bindings\js\JSSharedWorkerCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSQLResultSetRowListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSQLTransactionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSStorageCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSStyleSheetCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSStyleSheetListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGElementInstanceCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGLengthCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGMatrixCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGPathSegCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGPathSegListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGPODTypeWrapper.h"

@@ -34268,6 +39096,54 @@
 				<File

 					RelativePath="..\bindings\js\JSSVGPointListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGTransformListCustom.cpp"

@@ -34276,14 +39152,158 @@
 				<File

 					RelativePath="..\bindings\js\JSTextCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSTreeWalkerCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWebKitCSSMatrixConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWebKitCSSMatrixConstructor.h"

@@ -34292,6 +39312,54 @@
 				<File

 					RelativePath="..\bindings\js\JSWebKitPointConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWebKitPointConstructor.h"

@@ -34300,6 +39368,54 @@
 				<File

 					RelativePath="..\bindings\js\JSWebSocketConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWebSocketConstructor.h"

@@ -34308,10 +39424,106 @@
 				<File

 					RelativePath="..\bindings\js\JSWebSocketCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWorkerConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWorkerConstructor.h"

@@ -34320,6 +39532,54 @@
 				<File

 					RelativePath="..\bindings\js\JSWorkerContextBase.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWorkerContextBase.h"

@@ -34328,14 +39588,106 @@
 				<File

 					RelativePath="..\bindings\js\JSWorkerContextCustom.cpp"

 					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSWorkerCustom.cpp"

-					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXMLHttpRequestConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXMLHttpRequestConstructor.h"

@@ -34344,14 +39696,158 @@
 				<File

 					RelativePath="..\bindings\js\JSXMLHttpRequestCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXMLHttpRequestUploadCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXSLTProcessorConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXSLTProcessorConstructor.h"

@@ -34360,10 +39856,106 @@
 				<File

 					RelativePath="..\bindings\js\JSXSLTProcessorCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScheduledAction.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScheduledAction.h"

@@ -34372,6 +39964,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptArray.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptArray.h"

@@ -34380,6 +40020,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptCachedFrameData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptCachedFrameData.h"

@@ -34388,6 +40076,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptCallFrame.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptCallFrame.h"

@@ -34396,6 +40132,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptCallStack.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptCallStack.h"

@@ -34404,6 +40188,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptController.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptController.h"

@@ -34412,10 +40244,106 @@
 				<File

 					RelativePath="..\bindings\js\ScriptControllerWin.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptEventListener.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptEventListener.h"

@@ -34424,6 +40352,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptFunctionCall.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptFunctionCall.h"

@@ -34442,14 +40418,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\ScriptObjectQuarantine.cpp"

-					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\ScriptObjectQuarantine.h"

-					>

-				</File>

-				<File

 					RelativePath="..\bindings\js\ScriptSourceCode.h"

 					>

 				</File>

@@ -34460,6 +40428,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptState.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptState.h"

@@ -34480,6 +40496,54 @@
 				<File

 					RelativePath="..\bindings\js\SerializedScriptValue.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\SerializedScriptValue.h"

@@ -34492,6 +40556,54 @@
 				<File

 					RelativePath="..\bindings\js\WorkerScriptController.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\WorkerScriptController.h"

@@ -36155,6 +42267,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InjectedScriptHost.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InjectedScriptHost.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorBackend.cpp"

 				>

 			</File>

@@ -36207,6 +42327,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorFrontendHost.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorFrontendHost.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorResource.cpp"

 				>

 			</File>

@@ -36302,10 +42430,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ConsolePanel.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\ConsoleView.js"

 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ContextMenu.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\Database.js"

 					>

 				</File>

@@ -36330,10 +42466,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\DOMStorageDataGrid.js"

-					>

-				</File>

-				<File

 					RelativePath="..\inspector\front-end\DOMStorageItemsView.js"

 					>

 				</File>

@@ -36518,6 +42650,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\TimelineGrid.js"

+					>

+				</File>

+				<File

+					RelativePath="..\inspector\front-end\TimelineOverviewPane.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\TimelinePanel.js"

 					>

 				</File>

@@ -36919,72 +43059,6 @@
 			RelativePath="..\config.h"

 			>

 		</File>

-		<File

-			RelativePath="..\platform\graphics\TextRenderingMode.h"

-			>

-		</File>

-		<File

-			RelativePath="..\WebCorePrefix.cpp"

-			>

-			<FileConfiguration

-				Name="Debug|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Release|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Debug_Internal|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Debug_Cairo|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Release_Cairo|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Debug_All|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-		</File>

-		<File

-			RelativePath="..\WebCorePrefix.h"

-			>

-		</File>

 	</Files>

 	<Globals>

 	</Globals>

diff --git a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index 8727a4d..7cf70b0 100644
--- a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -8,9 +8,10 @@
 	<Tool
 		Name="VCCLCompilerTool"
 		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"
-		PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DATALIST;ENABLE_DOM_STORAGE;ENABLE_EVENTSOURCE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"
+		PreprocessorDefinitions="__WIN32__;DISABLE_3D_RENDERING;WEBCORE_CONTEXT_MENUS;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DATALIST;ENABLE_DOM_STORAGE;ENABLE_EVENTSOURCE;ENABLE_FILTERS;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
+		ProgramDataBaseFileName="$(OutDir)\$(TargetName).vc80.pdb"
 		ForcedIncludeFiles="WebCorePrefix.h"
 	/>
 	<Tool
diff --git a/WebCore/WebCore.vcproj/build-generated-files.sh b/WebCore/WebCore.vcproj/build-generated-files.sh
index 06b3c6d..f2ec855 100644
--- a/WebCore/WebCore.vcproj/build-generated-files.sh
+++ b/WebCore/WebCore.vcproj/build-generated-files.sh
@@ -59,5 +59,5 @@ mkdir -p "${BUILT_PRODUCTS_DIR}/DerivedSources"
 cd "${BUILT_PRODUCTS_DIR}/DerivedSources"
 
 export WebCore="${XSRCROOT}"
-export FEATURE_DEFINES="ENABLE_CHANNEL_MESSAGING ENABLE_DATABASE ENABLE_DATAGRID ENABLE_DATALIST ENABLE_DOM_STORAGE ENABLE_EVENTSOURCE ENABLE_ICONDATABASE ENABLE_JAVASCRIPT_DEBUGGER ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_RUBY ENABLE_SHARED_WORKERS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WEB_SOCKETS ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
+export FEATURE_DEFINES="ENABLE_CHANNEL_MESSAGING ENABLE_DATABASE ENABLE_DATAGRID ENABLE_DATALIST ENABLE_DOM_STORAGE ENABLE_EVENTSOURCE ENABLE_FILTERS ENABLE_ICONDATABASE ENABLE_JAVASCRIPT_DEBUGGER ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_SHARED_WORKERS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WEB_SOCKETS ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
 make -f "$WebCore/DerivedSources.make" -j ${NUMCPUS} || exit 1
diff --git a/WebCore/WebCore.xcodeproj/project.pbxproj b/WebCore/WebCore.xcodeproj/project.pbxproj
index 7f8f811..2d0b804 100644
--- a/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -90,10 +90,10 @@
 		087281580F26B9B600AFC596 /* OptionGroupElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 087281540F26B9B600AFC596 /* OptionGroupElement.h */; };
 		08744BAA0EDB7D86004C9E63 /* WMLOnEventElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08744BA90EDB7D86004C9E63 /* WMLOnEventElement.cpp */; };
 		08744BAE0EDB7D92004C9E63 /* WMLOnEventElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08744BAD0EDB7D92004C9E63 /* WMLOnEventElement.h */; };
-		0878B1FD10874E3F00A55097 /* SVGAnimatedProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */; };
+		0878B1FD10874E3F00A55097 /* SVGAnimatedProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0878B1FE10874E3F00A55097 /* SynchronizablePropertyController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0878B1FA10874E3F00A55097 /* SynchronizablePropertyController.cpp */; };
-		0878B1FF10874E3F00A55097 /* SynchronizablePropertyController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FB10874E3F00A55097 /* SynchronizablePropertyController.h */; };
-		0878B20010874E3F00A55097 /* SynchronizableTypeWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FC10874E3F00A55097 /* SynchronizableTypeWrapper.h */; };
+		0878B1FF10874E3F00A55097 /* SynchronizablePropertyController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FB10874E3F00A55097 /* SynchronizablePropertyController.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0878B20010874E3F00A55097 /* SynchronizableTypeWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FC10874E3F00A55097 /* SynchronizableTypeWrapper.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		087FFA0F0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 087FFA0D0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp */; };
 		087FFA100EFF3ED3009DBD88 /* WMLInsertedLegendElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 087FFA0E0EFF3ED3009DBD88 /* WMLInsertedLegendElement.h */; };
 		08807B760ED709AB003F6975 /* WMLGoElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08807B6A0ED709AB003F6975 /* WMLGoElement.cpp */; };
@@ -156,6 +156,11 @@
 		0B9056F80F2685F30095FF6A /* WorkerThreadableLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0B9056F60F2685F30095FF6A /* WorkerThreadableLoader.cpp */; };
 		0B9056F90F2685F30095FF6A /* WorkerThreadableLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B9056F70F2685F30095FF6A /* WorkerThreadableLoader.h */; settings = {ATTRIBUTES = (); }; };
 		0BE030A20F3112FB003C1A46 /* RenderLineBoxList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BE030A10F3112FB003C1A46 /* RenderLineBoxList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0C3F1F5A10C8871200D72CE1 /* WebGLUniformLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0C3F1F5710C8871200D72CE1 /* WebGLUniformLocation.cpp */; };
+		0C3F1F5B10C8871200D72CE1 /* WebGLUniformLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0C3F1F5810C8871200D72CE1 /* WebGLUniformLocation.h */; };
+		0C3F1F5C10C8871200D72CE1 /* WebGLUniformLocation.idl in Resources */ = {isa = PBXBuildFile; fileRef = 0C3F1F5910C8871200D72CE1 /* WebGLUniformLocation.idl */; };
+		0C45342710CDBBFA00869157 /* JSWebGLUniformLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0C45342510CDBBFA00869157 /* JSWebGLUniformLocation.cpp */; };
+		0C45342810CDBBFA00869157 /* JSWebGLUniformLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */; };
 		0F11A54F0F39233100C37884 /* RenderSelectionInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F11A54E0F39233100C37884 /* RenderSelectionInfo.h */; };
 		0F15DA8A0F3AAEE70000CE47 /* AnimationControllerPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F15DA890F3AAEE70000CE47 /* AnimationControllerPrivate.h */; };
 		0F500AAF0F54DB1B00EEF928 /* TransformState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F500AAE0F54DB1B00EEF928 /* TransformState.h */; };
@@ -205,6 +210,14 @@
 		1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1449E286107D4DB400B5793F /* JSCallbackData.cpp */; };
 		1477E7760BF4134A00152872 /* PageCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1477E7740BF4134A00152872 /* PageCache.cpp */; };
 		1477E7770BF4134A00152872 /* PageCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1477E7750BF4134A00152872 /* PageCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1479FAED109AE37500DED655 /* RenderRuby.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1479FAE5109AE37500DED655 /* RenderRuby.cpp */; };
+		1479FAEE109AE37500DED655 /* RenderRuby.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479FAE6109AE37500DED655 /* RenderRuby.h */; };
+		1479FAEF109AE37500DED655 /* RenderRubyBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1479FAE7109AE37500DED655 /* RenderRubyBase.cpp */; };
+		1479FAF0109AE37500DED655 /* RenderRubyBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479FAE8109AE37500DED655 /* RenderRubyBase.h */; };
+		1479FAF1109AE37500DED655 /* RenderRubyRun.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1479FAE9109AE37500DED655 /* RenderRubyRun.cpp */; };
+		1479FAF2109AE37500DED655 /* RenderRubyRun.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479FAEA109AE37500DED655 /* RenderRubyRun.h */; };
+		1479FAF3109AE37500DED655 /* RenderRubyText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1479FAEB109AE37500DED655 /* RenderRubyText.cpp */; };
+		1479FAF4109AE37500DED655 /* RenderRubyText.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479FAEC109AE37500DED655 /* RenderRubyText.h */; };
 		148AFDA50AF58360008CC700 /* ExceptionHandlers.h in Headers */ = {isa = PBXBuildFile; fileRef = 148AFDA30AF58360008CC700 /* ExceptionHandlers.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		148AFDA60AF58360008CC700 /* ExceptionHandlers.mm in Sources */ = {isa = PBXBuildFile; fileRef = 148AFDA40AF58360008CC700 /* ExceptionHandlers.mm */; };
 		14993BE50B2F2B1C0050497F /* FocusController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14993BE30B2F2B1C0050497F /* FocusController.cpp */; };
@@ -530,6 +543,7 @@
 		1CB4214B0AF2B2CA0085AD91 /* DOMElementInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85E711490AC5D5340053270F /* DOMElementInternal.h */; };
 		1CB4214C0AF2B2CA0085AD91 /* DOMHTMLElementInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85E711580AC5D5340053270F /* DOMHTMLElementInternal.h */; };
 		1CB4214D0AF2B2CA0085AD91 /* DOMRangeInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 8538F05A0AD722F1006A81D1 /* DOMRangeInternal.h */; };
+		1CCA732210ADD44A00FD440D /* DOMHTMLInputElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CCA732110ADD43E00FD440D /* DOMHTMLInputElementPrivate.h */; };
 		1CDC14050DD3934C006EACD3 /* localizedStrings.js in Resources */ = {isa = PBXBuildFile; fileRef = BCC64F5F0DCFB84E0081EF3B /* localizedStrings.js */; };
 		1CE24F970D7CAF0E007E04C2 /* SchedulePairMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1CE24F960D7CAF0E007E04C2 /* SchedulePairMac.mm */; };
 		1CE83AC30ADAFFD7009354F6 /* DeleteButtonController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1C4C8EFF0AD85D87009475CE /* DeleteButtonController.cpp */; };
@@ -664,10 +678,6 @@
 		371F53E90D2704F900ECE0D5 /* CSSUnicodeRangeValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 371F53E70D2704F900ECE0D5 /* CSSUnicodeRangeValue.h */; };
 		371F53EA0D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 371F53E80D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp */; };
 		37202199106213C600F25C4B /* FontSmoothingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 37202198106213C600F25C4B /* FontSmoothingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		3724CA570E68A7E400DB4384 /* CoreTextController.h in Headers */ = {isa = PBXBuildFile; fileRef = 3724CA540E68A7E400DB4384 /* CoreTextController.h */; };
-		3724CA580E68A7E400DB4384 /* CoreTextController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA550E68A7E400DB4384 /* CoreTextController.cpp */; };
-		3724CA590E68A7E400DB4384 /* FontMacATSUI.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */; };
-		3724CA7E0E68B20500DB4384 /* FontMacCoreText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA7D0E68B20500DB4384 /* FontMacCoreText.cpp */; };
 		3744570F0DB05FA500AE0992 /* SVGGlyphMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 3744570E0DB05FA500AE0992 /* SVGGlyphMap.h */; };
 		3774ABA50FA21EB400AD7DE9 /* OverlapTestRequestClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		377C4CDF1014E9F600B9AE42 /* PlaceholderDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 377C4CDD1014E9F600B9AE42 /* PlaceholderDocument.h */; };
@@ -677,6 +687,11 @@
 		37919C240B7D188600A56998 /* PositionIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 37919C220B7D188600A56998 /* PositionIterator.h */; settings = {ATTRIBUTES = (); }; };
 		37ACCE420DA2980F0089E602 /* FontRenderingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 37ACCE410DA2980F0089E602 /* FontRenderingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37ACCF690DA414E70089E602 /* FontDescription.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37ACCE620DA2AA960089E602 /* FontDescription.cpp */; };
+		37C2360B1097EDED00EF9F72 /* FontComplexTextMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37C2360A1097EDED00EF9F72 /* FontComplexTextMac.cpp */; };
+		37C236101097EE7700EF9F72 /* ComplexTextController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37C2360E1097EE7700EF9F72 /* ComplexTextController.cpp */; };
+		37C236111097EE7700EF9F72 /* ComplexTextController.h in Headers */ = {isa = PBXBuildFile; fileRef = 37C2360F1097EE7700EF9F72 /* ComplexTextController.h */; };
+		37C238211098C84200EF9F72 /* ComplexTextControllerATSUI.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37C2381F1098C84200EF9F72 /* ComplexTextControllerATSUI.cpp */; };
+		37C238221098C84200EF9F72 /* ComplexTextControllerCoreText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37C238201098C84200EF9F72 /* ComplexTextControllerCoreText.cpp */; };
 		37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */; };
@@ -685,7 +700,6 @@
 		411046410FA222A600BA436A /* ScriptEventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 4110463F0FA222A600BA436A /* ScriptEventListener.h */; };
 		411046420FA222A600BA436A /* ScriptEventListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 411046400FA222A600BA436A /* ScriptEventListener.cpp */; };
 		4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */; };
-		412A68470F6B03DD000EA66E /* ScriptObjectQuarantine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */; };
 		415B7C570FF598E6006770F7 /* JSAbstractWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */; };
 		415B7C580FF598E6006770F7 /* JSSharedWorkerConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */; };
 		415B7C630FF5A767006770F7 /* JSSharedWorkerConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */; };
@@ -704,7 +718,6 @@
 		416F45F00ED7B311008215B6 /* ScriptString.h in Headers */ = {isa = PBXBuildFile; fileRef = 416F45EF0ED7B311008215B6 /* ScriptString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		418F88040FF957AE0080F045 /* JSAbstractWorker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */; };
 		418F88050FF957AF0080F045 /* JSAbstractWorker.h in Headers */ = {isa = PBXBuildFile; fileRef = 418F88030FF957AE0080F045 /* JSAbstractWorker.h */; };
-		419536510F68222400D0C679 /* ScriptObjectQuarantine.h in Headers */ = {isa = PBXBuildFile; fileRef = 419536500F68222400D0C679 /* ScriptObjectQuarantine.h */; };
 		41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */; };
 		41A3D58F101C152D00316D07 /* DedicatedWorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 41A3D58D101C152D00316D07 /* DedicatedWorkerThread.h */; };
 		41BF700B0FE86F49005E8DEC /* MessagePortChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41BF70090FE86F49005E8DEC /* MessagePortChannel.cpp */; };
@@ -764,7 +777,7 @@
 		46F9D5DD0B0D60170028EE36 /* aliasCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DA0B0D60170028EE36 /* aliasCursor.png */; };
 		46F9D5DE0B0D60170028EE36 /* noDropCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DB0B0D60170028EE36 /* noDropCursor.png */; };
 		46F9D5DF0B0D60170028EE36 /* progressCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DC0B0D60170028EE36 /* progressCursor.png */; };
-		492273A31083B3B100EE5C84 /* JSCanvasArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 492273A21083B3B100EE5C84 /* JSCanvasArrayCustom.cpp */; };
+		492273A31083B3B100EE5C84 /* JSWebGLArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 492273A21083B3B100EE5C84 /* JSWebGLArrayCustom.cpp */; };
 		49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */; };
 		49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FB4102CF23C00187DD3 /* CanvasGradient.h */; };
 		49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */; };
@@ -789,40 +802,40 @@
 		498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */ = {isa = PBXBuildFile; fileRef = 498391560F1E776900C23782 /* WebKitCSSMatrix.h */; };
 		498391630F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */; };
 		498391640F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */; };
-		49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */; };
-		49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */; };
-		49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */; };
-		49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */; };
-		49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */; };
-		49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */; };
-		49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */; };
-		49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9891042D2D30009D447 /* JSCanvasProgram.h */; };
-		49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */; };
-		49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */; };
-		49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */; };
-		49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9901042D2D30009D447 /* JSCanvasShader.h */; };
-		49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */; };
-		49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9921042D2D30009D447 /* JSCanvasTexture.h */; };
-		49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */; };
-		49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9A91042D32E0009D447 /* CanvasBuffer.h */; };
-		49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */; };
-		49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */; };
-		49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */; };
-		49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */; };
+		49C7B9931042D2D30009D447 /* JSWebGLBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */; };
+		49C7B9941042D2D30009D447 /* JSWebGLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */; };
+		49C7B9951042D2D30009D447 /* JSWebGLByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9821042D2D30009D447 /* JSWebGLByteArray.cpp */; };
+		49C7B9961042D2D30009D447 /* JSWebGLByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9831042D2D30009D447 /* JSWebGLByteArray.h */; };
+		49C7B9971042D2D30009D447 /* JSWebGLFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9841042D2D30009D447 /* JSWebGLFramebuffer.cpp */; };
+		49C7B9981042D2D30009D447 /* JSWebGLFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9851042D2D30009D447 /* JSWebGLFramebuffer.h */; };
+		49C7B99B1042D2D30009D447 /* JSWebGLProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9881042D2D30009D447 /* JSWebGLProgram.cpp */; };
+		49C7B99C1042D2D30009D447 /* JSWebGLProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9891042D2D30009D447 /* JSWebGLProgram.h */; };
+		49C7B99D1042D2D30009D447 /* JSWebGLRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98A1042D2D30009D447 /* JSWebGLRenderbuffer.cpp */; };
+		49C7B99E1042D2D30009D447 /* JSWebGLRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B98B1042D2D30009D447 /* JSWebGLRenderbuffer.h */; };
+		49C7B9A21042D2D30009D447 /* JSWebGLShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98F1042D2D30009D447 /* JSWebGLShader.cpp */; };
+		49C7B9A31042D2D30009D447 /* JSWebGLShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9901042D2D30009D447 /* JSWebGLShader.h */; };
+		49C7B9A41042D2D30009D447 /* JSWebGLTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9911042D2D30009D447 /* JSWebGLTexture.cpp */; };
+		49C7B9A51042D2D30009D447 /* JSWebGLTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9921042D2D30009D447 /* JSWebGLTexture.h */; };
+		49C7B9C81042D32F0009D447 /* WebGLBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9A81042D32E0009D447 /* WebGLBuffer.cpp */; };
+		49C7B9C91042D32F0009D447 /* WebGLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9A91042D32E0009D447 /* WebGLBuffer.h */; };
+		49C7B9CB1042D32F0009D447 /* WebGLByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AB1042D32E0009D447 /* WebGLByteArray.cpp */; };
+		49C7B9CC1042D32F0009D447 /* WebGLByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AC1042D32E0009D447 /* WebGLByteArray.h */; };
+		49C7B9CE1042D32F0009D447 /* WebGLFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AE1042D32E0009D447 /* WebGLFramebuffer.cpp */; };
+		49C7B9CF1042D32F0009D447 /* WebGLFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AF1042D32E0009D447 /* WebGLFramebuffer.h */; };
 		49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B41042D32F0009D447 /* CanvasObject.cpp */; };
 		49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B51042D32F0009D447 /* CanvasObject.h */; };
-		49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */; };
-		49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B71042D32F0009D447 /* CanvasProgram.h */; };
-		49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */; };
-		49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */; };
+		49C7B9D61042D32F0009D447 /* WebGLProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B61042D32F0009D447 /* WebGLProgram.cpp */; };
+		49C7B9D71042D32F0009D447 /* WebGLProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B71042D32F0009D447 /* WebGLProgram.h */; };
+		49C7B9D91042D32F0009D447 /* WebGLRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B91042D32F0009D447 /* WebGLRenderbuffer.cpp */; };
+		49C7B9DA1042D32F0009D447 /* WebGLRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BA1042D32F0009D447 /* WebGLRenderbuffer.h */; };
 		49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */; };
 		49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */; };
-		49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */; };
-		49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */; };
-		49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C21042D32F0009D447 /* CanvasShader.cpp */; };
-		49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C31042D32F0009D447 /* CanvasShader.h */; };
-		49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */; };
-		49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C61042D32F0009D447 /* CanvasTexture.h */; };
+		49C7B9DF1042D32F0009D447 /* WebGLRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BF1042D32F0009D447 /* WebGLRenderingContext.cpp */; };
+		49C7B9E01042D32F0009D447 /* WebGLRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C01042D32F0009D447 /* WebGLRenderingContext.h */; };
+		49C7B9E21042D32F0009D447 /* WebGLShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C21042D32F0009D447 /* WebGLShader.cpp */; };
+		49C7B9E31042D32F0009D447 /* WebGLShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C31042D32F0009D447 /* WebGLShader.h */; };
+		49C7B9E51042D32F0009D447 /* WebGLTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C51042D32F0009D447 /* WebGLTexture.cpp */; };
+		49C7B9E61042D32F0009D447 /* WebGLTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C61042D32F0009D447 /* WebGLTexture.h */; };
 		49C7B9FC1042D3650009D447 /* GraphicsContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */; };
 		49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */; };
@@ -854,69 +867,69 @@
 		49E912AC0EFAC906009D0CAF /* AnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49E912A70EFAC906009D0CAF /* AnimationList.cpp */; };
 		49E912AD0EFAC906009D0CAF /* AnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A80EFAC906009D0CAF /* AnimationList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49E912AE0EFAC906009D0CAF /* TimingFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A90EFAC906009D0CAF /* TimingFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDC710503C2300099FAB /* CanvasArray.cpp */; };
-		49EECDE010503C2400099FAB /* CanvasArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDC810503C2300099FAB /* CanvasArray.h */; };
-		49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */; };
-		49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */; };
-		49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */; };
-		49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCE10503C2300099FAB /* CanvasFloatArray.h */; };
-		49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD010503C2300099FAB /* CanvasIntArray.cpp */; };
-		49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD110503C2300099FAB /* CanvasIntArray.h */; };
-		49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD310503C2300099FAB /* CanvasShortArray.cpp */; };
-		49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD410503C2300099FAB /* CanvasShortArray.h */; };
-		49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */; };
-		49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */; };
-		49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */; };
-		49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */; };
-		49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */; };
-		49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */; };
-		49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */; };
-		49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */; };
-		49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */; };
-		49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */; };
-		49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */; };
-		49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF7105070C400099FAB /* JSCanvasIntArray.h */; };
-		49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */; };
-		49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF9105070C400099FAB /* JSCanvasShortArray.h */; };
-		49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */; };
-		49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */; };
-		49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */; };
-		49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */; };
-		49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */; };
-		49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */; };
-		49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF19105072F300099FAB /* JSCanvasArray.cpp */; };
-		49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF1A105072F300099FAB /* JSCanvasArray.h */; };
-		49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */; };
-		49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */; };
-		49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */; };
-		49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */; };
-		49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */; };
-		49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */; };
-		49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */; };
-		49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */; };
-		49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */; };
-		49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */; };
-		49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */; };
-		49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */; };
-		49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */; };
-		49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */; };
-		49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */; };
-		49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */; };
-		49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */; };
-		49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */; };
-		49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */; };
-		49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */; };
-		49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */; };
-		49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */; };
-		49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */; };
+		49EECDDF10503C2400099FAB /* WebGLArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDC710503C2300099FAB /* WebGLArray.cpp */; };
+		49EECDE010503C2400099FAB /* WebGLArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDC810503C2300099FAB /* WebGLArray.h */; };
+		49EECDE210503C2400099FAB /* WebGLArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCA10503C2300099FAB /* WebGLArrayBuffer.cpp */; };
+		49EECDE310503C2400099FAB /* WebGLArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCB10503C2300099FAB /* WebGLArrayBuffer.h */; };
+		49EECDE510503C2400099FAB /* WebGLFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCD10503C2300099FAB /* WebGLFloatArray.cpp */; };
+		49EECDE610503C2400099FAB /* WebGLFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCE10503C2300099FAB /* WebGLFloatArray.h */; };
+		49EECDE810503C2400099FAB /* WebGLIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD010503C2300099FAB /* WebGLIntArray.cpp */; };
+		49EECDE910503C2400099FAB /* WebGLIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD110503C2300099FAB /* WebGLIntArray.h */; };
+		49EECDEB10503C2400099FAB /* WebGLShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD310503C2300099FAB /* WebGLShortArray.cpp */; };
+		49EECDEC10503C2400099FAB /* WebGLShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD410503C2300099FAB /* WebGLShortArray.h */; };
+		49EECDEE10503C2400099FAB /* WebGLUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD610503C2300099FAB /* WebGLUnsignedByteArray.cpp */; };
+		49EECDEF10503C2400099FAB /* WebGLUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD710503C2300099FAB /* WebGLUnsignedByteArray.h */; };
+		49EECDF110503C2400099FAB /* WebGLUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD910503C2300099FAB /* WebGLUnsignedIntArray.cpp */; };
+		49EECDF210503C2400099FAB /* WebGLUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDA10503C2300099FAB /* WebGLUnsignedIntArray.h */; };
+		49EECDF410503C2400099FAB /* WebGLUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDDC10503C2300099FAB /* WebGLUnsignedShortArray.cpp */; };
+		49EECDF510503C2400099FAB /* WebGLUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDD10503C2400099FAB /* WebGLUnsignedShortArray.h */; };
+		49EECF00105070C400099FAB /* JSWebGLArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF2105070C400099FAB /* JSWebGLArrayBuffer.cpp */; };
+		49EECF01105070C400099FAB /* JSWebGLArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF3105070C400099FAB /* JSWebGLArrayBuffer.h */; };
+		49EECF02105070C400099FAB /* JSWebGLFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF4105070C400099FAB /* JSWebGLFloatArray.cpp */; };
+		49EECF03105070C400099FAB /* JSWebGLFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF5105070C400099FAB /* JSWebGLFloatArray.h */; };
+		49EECF04105070C400099FAB /* JSWebGLIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF6105070C400099FAB /* JSWebGLIntArray.cpp */; };
+		49EECF05105070C400099FAB /* JSWebGLIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF7105070C400099FAB /* JSWebGLIntArray.h */; };
+		49EECF06105070C400099FAB /* JSWebGLShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF8105070C400099FAB /* JSWebGLShortArray.cpp */; };
+		49EECF07105070C400099FAB /* JSWebGLShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF9105070C400099FAB /* JSWebGLShortArray.h */; };
+		49EECF08105070C400099FAB /* JSWebGLUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFA105070C400099FAB /* JSWebGLUnsignedByteArray.cpp */; };
+		49EECF09105070C400099FAB /* JSWebGLUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFB105070C400099FAB /* JSWebGLUnsignedByteArray.h */; };
+		49EECF0A105070C400099FAB /* JSWebGLUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFC105070C400099FAB /* JSWebGLUnsignedIntArray.cpp */; };
+		49EECF0B105070C400099FAB /* JSWebGLUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFD105070C400099FAB /* JSWebGLUnsignedIntArray.h */; };
+		49EECF0C105070C400099FAB /* JSWebGLUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFE105070C400099FAB /* JSWebGLUnsignedShortArray.cpp */; };
+		49EECF0D105070C400099FAB /* JSWebGLUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFF105070C400099FAB /* JSWebGLUnsignedShortArray.h */; };
+		49EECF1B105072F300099FAB /* JSWebGLArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF19105072F300099FAB /* JSWebGLArray.cpp */; };
+		49EECF1C105072F300099FAB /* JSWebGLArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF1A105072F300099FAB /* JSWebGLArray.h */; };
+		49EECF7810508D9C00099FAB /* JSWebGLByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7110508D9C00099FAB /* JSWebGLByteArrayCustom.cpp */; };
+		49EECF7910508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7210508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp */; };
+		49EECF7A10508D9C00099FAB /* JSWebGLIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7310508D9C00099FAB /* JSWebGLIntArrayCustom.cpp */; };
+		49EECF7B10508D9C00099FAB /* JSWebGLShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7410508D9C00099FAB /* JSWebGLShortArrayCustom.cpp */; };
+		49EECF7C10508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7510508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp */; };
+		49EECF7D10508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7610508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp */; };
+		49EECF7E10508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7710508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp */; };
+		49EECFAB1050938200099FAB /* JSWebGLArrayBufferConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF991050938200099FAB /* JSWebGLArrayBufferConstructor.cpp */; };
+		49EECFAC1050938200099FAB /* JSWebGLArrayBufferConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9A1050938200099FAB /* JSWebGLArrayBufferConstructor.h */; };
+		49EECFAD1050938200099FAB /* JSWebGLByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9B1050938200099FAB /* JSWebGLByteArrayConstructor.cpp */; };
+		49EECFAE1050938200099FAB /* JSWebGLByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9C1050938200099FAB /* JSWebGLByteArrayConstructor.h */; };
+		49EECFAF1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9D1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp */; };
+		49EECFB01050938200099FAB /* JSWebGLFloatArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9E1050938200099FAB /* JSWebGLFloatArrayConstructor.h */; };
+		49EECFB11050938200099FAB /* JSWebGLIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9F1050938200099FAB /* JSWebGLIntArrayConstructor.cpp */; };
+		49EECFB21050938200099FAB /* JSWebGLIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA01050938200099FAB /* JSWebGLIntArrayConstructor.h */; };
+		49EECFB51050938200099FAB /* JSWebGLShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA31050938200099FAB /* JSWebGLShortArrayConstructor.cpp */; };
+		49EECFB61050938200099FAB /* JSWebGLShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA41050938200099FAB /* JSWebGLShortArrayConstructor.h */; };
+		49EECFB71050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA51050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp */; };
+		49EECFB81050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA61050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h */; };
+		49EECFB91050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA71050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp */; };
+		49EECFBA1050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA81050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h */; };
+		49EECFBB1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA91050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp */; };
+		49EECFBC1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFAA1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h */; };
 		49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */; };
 		49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */; };
 		49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */; };
 		49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */; };
-		49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */; };
-		49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */; };
+		49EED1461051969400099FAB /* JSWebGLRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED1401051969400099FAB /* JSWebGLRenderingContext.cpp */; };
+		49EED1471051969400099FAB /* JSWebGLRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED1411051969400099FAB /* JSWebGLRenderingContext.h */; };
 		49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */; };
-		49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */; };
+		49EED14F1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */; };
 		49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */; };
 		4A8C96EB0BE69032004EEFF0 /* SelectionControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */; };
 		4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B2708C50AF19EE40065127F /* Pasteboard.h */; };
@@ -1013,6 +1026,12 @@
 		51741D100B07259A00ED442C /* BackForwardList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51741D0C0B07259A00ED442C /* BackForwardList.cpp */; };
 		51741D110B07259A00ED442C /* HistoryItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 51741D0D0B07259A00ED442C /* HistoryItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51741D120B07259A00ED442C /* HistoryItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51741D0E0B07259A00ED442C /* HistoryItem.cpp */; };
+		5174E20A10A1F44F00F95E6F /* PopStateEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 5174E20810A1F44F00F95E6F /* PopStateEvent.h */; };
+		5174E20C10A1F49A00F95E6F /* PopStateEvent.idl in Resources */ = {isa = PBXBuildFile; fileRef = 5174E20B10A1F49A00F95E6F /* PopStateEvent.idl */; };
+		5189F01810B3781300F3C739 /* JSPopStateEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F01710B3781300F3C739 /* JSPopStateEventCustom.cpp */; };
+		5189F01D10B37BD900F3C739 /* JSPopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */; };
+		5189F01E10B37BD900F3C739 /* JSPopStateEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */; };
+		5189F0DE10B46B0E00F3C739 /* PopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */; };
 		518A34C11026C831001B6896 /* WebSocket.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34BE1026C831001B6896 /* WebSocket.cpp */; };
 		518A34C21026C831001B6896 /* WebSocket.h in Headers */ = {isa = PBXBuildFile; fileRef = 518A34BF1026C831001B6896 /* WebSocket.h */; };
 		518A34C71026C8C9001B6896 /* JSWebSocketConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34C41026C8C9001B6896 /* JSWebSocketConstructor.cpp */; };
@@ -1082,6 +1101,8 @@
 		54C50F7B0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 54C50F7A0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp */; };
 		550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 550A0BC7085F6039007353D6 /* QualifiedName.cpp */; };
 		550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */ = {isa = PBXBuildFile; fileRef = 550A0BC8085F6039007353D6 /* QualifiedName.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		599D1E3210C97D6E00E0EF12 /* jni_utility_private.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 599D1E3010C97D6E00E0EF12 /* jni_utility_private.cpp */; };
+		599D1E3310C97D6E00E0EF12 /* jni_utility_private.h in Headers */ = {isa = PBXBuildFile; fileRef = 599D1E3110C97D6E00E0EF12 /* jni_utility_private.h */; };
 		59C77F2A10545B3B00506104 /* GeolocationServiceMock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59C77F2810545B3B00506104 /* GeolocationServiceMock.cpp */; };
 		59C77F2B10545B3B00506104 /* GeolocationServiceMock.h in Headers */ = {isa = PBXBuildFile; fileRef = 59C77F2910545B3B00506104 /* GeolocationServiceMock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D15E3AB0F9E6AC1009E0E3F /* XMLTokenizerScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D15E3A90F9E6AC1009E0E3F /* XMLTokenizerScope.cpp */; };
@@ -1190,6 +1211,8 @@
 		65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DF323609D1DE65000BE325 /* JSCanvasPattern.h */; };
 		65DF326109D1E199000BE325 /* UserAgentStyleSheetsData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 656581AF09D14EE6000E61D7 /* UserAgentStyleSheetsData.cpp */; };
 		65FEA86909833ADE00BED4AB /* Page.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65FEA86809833ADE00BED4AB /* Page.cpp */; };
+		6E47E66010B7944B00B186C8 /* WebGLGetInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E47E65E10B7944B00B186C8 /* WebGLGetInfo.cpp */; };
+		6E47E66110B7944B00B186C8 /* WebGLGetInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E47E65F10B7944B00B186C8 /* WebGLGetInfo.h */; };
 		72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 72626E010EF022FE00A07E20 /* FontFastPath.cpp */; };
 		754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 754133A7102E00E800075D00 /* InspectorTimelineAgent.h */; };
 		754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */; };
@@ -1206,6 +1229,19 @@
 		7693BAD3106C2DCA007B0823 /* PluginHalter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7693BACF106C2DCA007B0823 /* PluginHalter.cpp */; };
 		7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BAD0106C2DCA007B0823 /* PluginHalter.h */; };
 		7693BAD5106C2DCA007B0823 /* PluginHalterClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79AC9218109945C80021266E /* JSCompositionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79AC9216109945C80021266E /* JSCompositionEvent.cpp */; };
+		79AC9219109945C80021266E /* JSCompositionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 79AC9217109945C80021266E /* JSCompositionEvent.h */; };
+		79F2F5A11091939A000D87CB /* CompositionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79F2F59E1091939A000D87CB /* CompositionEvent.cpp */; };
+		79F2F5A21091939A000D87CB /* CompositionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 79F2F59F1091939A000D87CB /* CompositionEvent.h */; };
+		7A0E76D510BF050700A0276E /* JSInjectedScriptHostCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E76D410BF050700A0276E /* JSInjectedScriptHostCustom.cpp */; };
+		7A0E76DA10BF059800A0276E /* JSInjectedScriptHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E76D810BF059800A0276E /* JSInjectedScriptHost.cpp */; };
+		7A0E76DB10BF059800A0276E /* JSInjectedScriptHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E76D910BF059800A0276E /* JSInjectedScriptHost.h */; };
+		7A0E76F910BF08ED00A0276E /* InjectedScriptHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E76F610BF08ED00A0276E /* InjectedScriptHost.cpp */; };
+		7A0E76FA10BF08ED00A0276E /* InjectedScriptHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E76F710BF08ED00A0276E /* InjectedScriptHost.h */; };
+		7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E770B10C00A8800A0276E /* InspectorFrontendHost.cpp */; };
+		7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E770C10C00A8800A0276E /* InspectorFrontendHost.h */; };
+		7A0E771E10C00DB100A0276E /* JSInspectorFrontendHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */; };
+		7A0E771F10C00DB100A0276E /* JSInspectorFrontendHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E771D10C00DB100A0276E /* JSInspectorFrontendHost.h */; };
 		7A1E88F5101CC384000C4DF5 /* ScriptArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */; };
 		7A1E88F6101CC384000C4DF5 /* ScriptArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A1E88F4101CC384000C4DF5 /* ScriptArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7A24587B1021EAF4000A00AA /* InspectorDOMAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */; };
@@ -1214,7 +1250,8 @@
 		7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */; };
 		7A74ECBA101839A600BF939E /* InspectorBackend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECB8101839A500BF939E /* InspectorBackend.cpp */; };
 		7A74ECBB101839A600BF939E /* InspectorBackend.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A74ECB9101839A600BF939E /* InspectorBackend.h */; };
-		7A74ECBD101839DA00BF939E /* JSInspectorBackendCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECBC101839DA00BF939E /* JSInspectorBackendCustom.cpp */; };
+		7A74ECBD101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECBC101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp */; };
+		7ADE722610CBBB9B006B3B3A /* ContextMenuSelectionHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 7ADE722510CBBB9B006B3B3A /* ContextMenuSelectionHandler.h */; };
 		7AED3E050FBB1EAA00D2B03C /* InspectorFrontend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */; };
 		7AED3E060FBB1EAA00D2B03C /* InspectorFrontend.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */; };
 		84224183107E77F400766A87 /* JSSVGFEMorphologyElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84224181107E77F400766A87 /* JSSVGFEMorphologyElement.cpp */; };
@@ -2237,6 +2274,7 @@
 		938192030F87E1E600D5352A /* BinaryPropertyList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 938192020F87E1E600D5352A /* BinaryPropertyList.cpp */; };
 		938192050F87E1EC00D5352A /* BinaryPropertyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 938192040F87E1EC00D5352A /* BinaryPropertyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9382AAB40D8C386100F357A6 /* NodeWithIndex.h in Headers */ = {isa = PBXBuildFile; fileRef = 9382AAB10D8C386100F357A6 /* NodeWithIndex.h */; };
+		9382DF5810A8D5C900925652 /* ColorSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = 9382DF5710A8D5C900925652 /* ColorSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93831B570D087D6000E5C984 /* ExceptionCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93831B560D087D6000E5C984 /* ExceptionCode.cpp */; };
 		938E65F109F09840008A48EC /* JSHTMLElementWrapperFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 938E65F009F09840008A48EC /* JSHTMLElementWrapperFactory.h */; };
 		938E65F709F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 938E65F609F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp */; };
@@ -2404,9 +2442,9 @@
 		A7CFB3D20B7ED10A0070C32D /* DragImage.h in Headers */ = {isa = PBXBuildFile; fileRef = A7CFB3D00B7ED10A0070C32D /* DragImage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7CFB3D50B7ED1180070C32D /* DragImageMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A7CFB3D40B7ED1180070C32D /* DragImageMac.mm */; };
 		A7D0318E0E93540300E24ACD /* JSImageDataCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */; };
-		A7D20F62107F406900A80392 /* JSCanvasActiveInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D20F60107F406900A80392 /* JSCanvasActiveInfo.cpp */; };
-		A7D20F63107F406900A80392 /* JSCanvasActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F61107F406900A80392 /* JSCanvasActiveInfo.h */; };
-		A7D20F6D107F438B00A80392 /* CanvasActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F6B107F438B00A80392 /* CanvasActiveInfo.h */; };
+		A7D20F62107F406900A80392 /* JSWebGLActiveInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */; };
+		A7D20F63107F406900A80392 /* JSWebGLActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */; };
+		A7D20F6D107F438B00A80392 /* WebGLActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */; };
 		A7D27FC40E0A599F0079AD2B /* SVGFETile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D27FC30E0A599F0079AD2B /* SVGFETile.cpp */; };
 		A7D3C5240B576B4B002CA450 /* PasteboardHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7D6B3490F61104500B79FD1 /* WorkerScriptLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */; };
@@ -3258,6 +3296,7 @@
 		AB23A32809BBA7D00067CC53 /* BeforeTextInsertedEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = AB23A32609BBA7D00067CC53 /* BeforeTextInsertedEvent.h */; };
 		AB247A6C0AFD6383003FA5FD /* RenderSlider.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AB247A6A0AFD6383003FA5FD /* RenderSlider.cpp */; };
 		AB247A6D0AFD6383003FA5FD /* RenderSlider.h in Headers */ = {isa = PBXBuildFile; fileRef = AB247A6B0AFD6383003FA5FD /* RenderSlider.h */; };
+		AB31C91E10AE1B8E000C7B92 /* LineClampValue.h in Headers */ = {isa = PBXBuildFile; fileRef = AB31C91D10AE1B8E000C7B92 /* LineClampValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		AB40484D0E083FA8007D6920 /* MediaDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AB40484B0E083FA8007D6920 /* MediaDocument.cpp */; };
 		AB40484E0E083FA8007D6920 /* MediaDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = AB40484C0E083FA8007D6920 /* MediaDocument.h */; };
 		AB4261D80A2F6C9700BDD17D /* missingImage.tiff in Resources */ = {isa = PBXBuildFile; fileRef = AB4261D70A2F6C9700BDD17D /* missingImage.tiff */; };
@@ -3293,7 +3332,7 @@
 		B22279850D00BF220071B782 /* SVGAnimatedPathData.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277EF0D00BF1F0071B782 /* SVGAnimatedPathData.h */; };
 		B22279870D00BF220071B782 /* SVGAnimatedPoints.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277F10D00BF1F0071B782 /* SVGAnimatedPoints.cpp */; };
 		B22279880D00BF220071B782 /* SVGAnimatedPoints.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277F20D00BF1F0071B782 /* SVGAnimatedPoints.h */; };
-		B222798D0D00BF220071B782 /* SVGAnimatedTemplate.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277F70D00BF1F0071B782 /* SVGAnimatedTemplate.h */; };
+		B222798D0D00BF220071B782 /* SVGAnimatedTemplate.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277F70D00BF1F0071B782 /* SVGAnimatedTemplate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B222798F0D00BF220071B782 /* SVGAnimateElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277F90D00BF1F0071B782 /* SVGAnimateElement.cpp */; };
 		B22279900D00BF220071B782 /* SVGAnimateElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277FA0D00BF1F0071B782 /* SVGAnimateElement.h */; };
 		B22279920D00BF220071B782 /* SVGAnimateMotionElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277FC0D00BF1F0071B782 /* SVGAnimateMotionElement.cpp */; };
@@ -3319,7 +3358,7 @@
 		B22279B30D00BF220071B782 /* SVGDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222781D0D00BF1F0071B782 /* SVGDocument.cpp */; };
 		B22279B40D00BF220071B782 /* SVGDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = B222781E0D00BF1F0071B782 /* SVGDocument.h */; };
 		B22279B60D00BF220071B782 /* SVGElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278200D00BF1F0071B782 /* SVGElement.cpp */; };
-		B22279B70D00BF220071B782 /* SVGElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278210D00BF1F0071B782 /* SVGElement.h */; };
+		B22279B70D00BF220071B782 /* SVGElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278210D00BF1F0071B782 /* SVGElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B22279B90D00BF220071B782 /* SVGElementInstance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278230D00BF1F0071B782 /* SVGElementInstance.cpp */; };
 		B22279BA0D00BF220071B782 /* SVGElementInstance.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278240D00BF1F0071B782 /* SVGElementInstance.h */; };
 		B22279BC0D00BF220071B782 /* SVGElementInstanceList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278260D00BF1F0071B782 /* SVGElementInstanceList.cpp */; };
@@ -3402,7 +3441,7 @@
 		B2227A2F0D00BF220071B782 /* SVGLangSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278990D00BF200071B782 /* SVGLangSpace.cpp */; };
 		B2227A300D00BF220071B782 /* SVGLangSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = B222789A0D00BF200071B782 /* SVGLangSpace.h */; };
 		B2227A320D00BF220071B782 /* SVGLength.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222789C0D00BF200071B782 /* SVGLength.cpp */; };
-		B2227A330D00BF220071B782 /* SVGLength.h in Headers */ = {isa = PBXBuildFile; fileRef = B222789D0D00BF200071B782 /* SVGLength.h */; };
+		B2227A330D00BF220071B782 /* SVGLength.h in Headers */ = {isa = PBXBuildFile; fileRef = B222789D0D00BF200071B782 /* SVGLength.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B2227A350D00BF220071B782 /* SVGLengthList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222789F0D00BF200071B782 /* SVGLengthList.cpp */; };
 		B2227A360D00BF220071B782 /* SVGLengthList.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278A00D00BF200071B782 /* SVGLengthList.h */; };
 		B2227A380D00BF220071B782 /* SVGLinearGradientElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278A20D00BF200071B782 /* SVGLinearGradientElement.cpp */; };
@@ -3664,7 +3703,7 @@
 		B27B285D0CEF0D7200D39D54 /* DOMSVGGlyphElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = B27B28300CEF0C3500D39D54 /* DOMSVGGlyphElement.h */; };
 		B27B285E0CEF0D7200D39D54 /* DOMSVGMissingGlyphElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = B27B28330CEF0C3500D39D54 /* DOMSVGMissingGlyphElement.h */; };
 		B28C6A270D00C44800334AA4 /* SVGDocumentExtensions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B28C6A1E0D00C44800334AA4 /* SVGDocumentExtensions.cpp */; };
-		B28C6A280D00C44800334AA4 /* SVGDocumentExtensions.h in Headers */ = {isa = PBXBuildFile; fileRef = B28C6A1F0D00C44800334AA4 /* SVGDocumentExtensions.h */; };
+		B28C6A280D00C44800334AA4 /* SVGDocumentExtensions.h in Headers */ = {isa = PBXBuildFile; fileRef = B28C6A1F0D00C44800334AA4 /* SVGDocumentExtensions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B28C6A290D00C44800334AA4 /* SVGImageLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B28C6A200D00C44800334AA4 /* SVGImageLoader.cpp */; };
 		B28C6A2A0D00C44800334AA4 /* SVGImageLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = B28C6A210D00C44800334AA4 /* SVGImageLoader.h */; };
 		B297BC700B3C14CF0045A590 /* JSSVGPathSegListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B297BC6F0B3C14CF0045A590 /* JSSVGPathSegListCustom.cpp */; };
@@ -4138,8 +4177,6 @@
 		BC4918C90BFEA050009D6316 /* JSHTMLIFrameElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC4918C30BFEA050009D6316 /* JSHTMLIFrameElement.h */; };
 		BC491B780C023EFD009D6316 /* JSHTMLMarqueeElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC491B760C023EFD009D6316 /* JSHTMLMarqueeElement.cpp */; };
 		BC491B790C023EFD009D6316 /* JSHTMLMarqueeElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC491B770C023EFD009D6316 /* JSHTMLMarqueeElement.h */; };
-		BC4BF9E40D11E133007D247F /* ClassNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC4BF9E20D11E133007D247F /* ClassNames.cpp */; };
-		BC4BF9E50D11E133007D247F /* ClassNames.h in Headers */ = {isa = PBXBuildFile; fileRef = BC4BF9E30D11E133007D247F /* ClassNames.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC4EDEF40C08F3FB007EDD49 /* JSHTMLAppletElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC4EDEF30C08F3FB007EDD49 /* JSHTMLAppletElementCustom.cpp */; };
 		BC5156E80C03B741008BB0EE /* DOMHTMLMarqueeElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = BC5156E50C03B741008BB0EE /* DOMHTMLMarqueeElement.h */; };
 		BC5156E90C03B741008BB0EE /* DOMHTMLMarqueeElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC5156E60C03B741008BB0EE /* DOMHTMLMarqueeElement.mm */; };
@@ -4310,7 +4347,6 @@
 		BC904B770D10998F00680D32 /* ClassNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = BC904B730D10998F00680D32 /* ClassNodeList.h */; };
 		BC926F800C0552470082776B /* JSHTMLFrameSetElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC926F7E0C0552470082776B /* JSHTMLFrameSetElement.cpp */; };
 		BC926F810C0552470082776B /* JSHTMLFrameSetElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC926F7F0C0552470082776B /* JSHTMLFrameSetElement.h */; };
-		BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */ = {isa = PBXBuildFile; fileRef = BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */; };
 		BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */; };
 		BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */; };
 		BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC946347107A936600857193 /* JSBeforeLoadEvent.h */; };
@@ -4554,6 +4590,8 @@
 		C6D74AD509AA282E000B0A52 /* ModifySelectionListLevel.h in Headers */ = {isa = PBXBuildFile; fileRef = C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */; };
 		C6D74AE409AA290A000B0A52 /* ModifySelectionListLevel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */; };
 		CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		D01A27AD10C9BFD800026A42 /* SpaceSplitString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D01A27AB10C9BFD800026A42 /* SpaceSplitString.cpp */; };
+		D01A27AE10C9BFD800026A42 /* SpaceSplitString.h in Headers */ = {isa = PBXBuildFile; fileRef = D01A27AC10C9BFD800026A42 /* SpaceSplitString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		D05CED290A40BB2C00C5AF38 /* FormatBlockCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D05CED270A40BB2C00C5AF38 /* FormatBlockCommand.cpp */; };
 		D05CED2A0A40BB2C00C5AF38 /* FormatBlockCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = D05CED280A40BB2C00C5AF38 /* FormatBlockCommand.h */; };
 		D06C0D8F0CFD11460065F43F /* RemoveFormatCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = D06C0D8D0CFD11460065F43F /* RemoveFormatCommand.h */; };
@@ -4593,6 +4631,7 @@
 		E10B9CCD0B747A44003ED890 /* DOMCustomXPathNSResolver.mm in Sources */ = {isa = PBXBuildFile; fileRef = E10B9CCB0B747A44003ED890 /* DOMCustomXPathNSResolver.mm */; };
 		E11C9D9B0EB3681200E409DB /* ScriptExecutionContext.h in Headers */ = {isa = PBXBuildFile; fileRef = E11C9D9A0EB3681200E409DB /* ScriptExecutionContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E11C9DB00EB3699500E409DB /* ScriptExecutionContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E11C9DAF0EB3699500E409DB /* ScriptExecutionContext.cpp */; };
+		E124748410AA161D00B79493 /* AuthenticationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = E124748310AA161D00B79493 /* AuthenticationClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E12719C70EEEC16800F61213 /* NavigatorBase.h in Headers */ = {isa = PBXBuildFile; fileRef = E12719C60EEEC16800F61213 /* NavigatorBase.h */; };
 		E12719CA0EEEC21300F61213 /* NavigatorBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E12719C90EEEC21300F61213 /* NavigatorBase.cpp */; };
 		E1271A0B0EEEC77A00F61213 /* WorkerNavigator.h in Headers */ = {isa = PBXBuildFile; fileRef = E1271A0A0EEEC77A00F61213 /* WorkerNavigator.h */; };
@@ -4627,6 +4666,7 @@
 		E1ADEDD50E76BD60004A1A5E /* DOMMessagePortInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADEDD40E76BD60004A1A5E /* DOMMessagePortInternal.h */; };
 		E1ADEDDA0E76BD93004A1A5E /* JSMessagePort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADEDD80E76BD93004A1A5E /* JSMessagePort.h */; };
 		E1ADEDDB0E76BD93004A1A5E /* JSMessagePort.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1ADEDD90E76BD93004A1A5E /* JSMessagePort.cpp */; };
+		E1B4CD2510B322E200BFFD7E /* CredentialStorageMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1B4CD2410B322E200BFFD7E /* CredentialStorageMac.mm */; };
 		E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1BE512B0CF6C512002EA959 /* XSLTUnicodeSort.cpp */; };
 		E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1BE512C0CF6C512002EA959 /* XSLTUnicodeSort.h */; };
 		E1C362EF0EAF2AA9007410BC /* JSWorkerLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = E1C362ED0EAF2AA9007410BC /* JSWorkerLocation.h */; };
@@ -4698,11 +4738,11 @@
 		E49626C30D80D94900E3405C /* PreloadScanner.h in Headers */ = {isa = PBXBuildFile; fileRef = E4D4ABE10D7542F100F96869 /* PreloadScanner.h */; };
 		E4AFCFA50DAF29A300F5F55C /* UnitBezier.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFCFA40DAF29A300F5F55C /* UnitBezier.h */; };
 		E4AFD00B0DAF335400F5F55C /* SMILTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4AFD0050DAF335400F5F55C /* SMILTime.cpp */; };
-		E4AFD00C0DAF335400F5F55C /* SMILTime.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD0060DAF335400F5F55C /* SMILTime.h */; };
+		E4AFD00C0DAF335400F5F55C /* SMILTime.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD0060DAF335400F5F55C /* SMILTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E4AFD00D0DAF335500F5F55C /* SMILTimeContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4AFD0070DAF335400F5F55C /* SMILTimeContainer.cpp */; };
 		E4AFD00E0DAF335500F5F55C /* SMILTimeContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD0080DAF335400F5F55C /* SMILTimeContainer.h */; };
 		E4AFD00F0DAF335500F5F55C /* SVGSMILElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4AFD0090DAF335400F5F55C /* SVGSMILElement.cpp */; };
-		E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD00A0DAF335400F5F55C /* SVGSMILElement.h */; };
+		E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD00A0DAF335400F5F55C /* SVGSMILElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E4C1789A0EE6903800824D69 /* CSSSelectorList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C178950EE6903800824D69 /* CSSSelectorList.cpp */; };
 		E4C1789B0EE6903800824D69 /* CSSSelectorList.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C178960EE6903800824D69 /* CSSSelectorList.h */; };
 		E4C279580CF9741900E97B98 /* RenderMedia.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C279560CF9741900E97B98 /* RenderMedia.cpp */; };
@@ -4716,6 +4756,8 @@
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		EDEC98030AED7E170059137F /* WebCorePrefix.h in Headers */ = {isa = PBXBuildFile; fileRef = EDEC98020AED7E170059137F /* WebCorePrefix.h */; };
+		F4EAF4AE10C742B1009100D3 /* OpenTypeSanitizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F4EAF4AC10C742B1009100D3 /* OpenTypeSanitizer.cpp */; };
+		F4EAF4AF10C742B1009100D3 /* OpenTypeSanitizer.h in Headers */ = {isa = PBXBuildFile; fileRef = F4EAF4AD10C742B1009100D3 /* OpenTypeSanitizer.h */; };
 		F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */; };
 		F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */; };
 		F5C041E30FFCA96D00839D4A /* DOMHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041DE0FFCA96D00839D4A /* DOMHTMLDataListElement.h */; };
@@ -4723,6 +4765,8 @@
 		F5C041E50FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E00FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h */; };
 		F5C041E60FFCA96D00839D4A /* JSHTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041E10FFCA96D00839D4A /* JSHTMLDataListElement.cpp */; };
 		F5C041E70FFCA96D00839D4A /* JSHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */; };
+		F5D3A57C106B83B300545297 /* ISODateTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5D3A57A106B83B300545297 /* ISODateTime.cpp */; };
+		F5D3A57D106B83B300545297 /* ISODateTime.h in Headers */ = {isa = PBXBuildFile; fileRef = F5D3A57B106B83B300545297 /* ISODateTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F916C48D0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F916C48B0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp */; };
 		F916C48E0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = F916C48C0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h */; };
 		F9F0ED7A0DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = F9F0ED770DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h */; };
@@ -4777,6 +4821,7 @@
 			dstPath = Versions/A/PrivateHeaders;
 			dstSubfolderSpec = 1;
 			files = (
+				1CCA732210ADD44A00FD440D /* DOMHTMLInputElementPrivate.h in Copy Generated Headers */,
 				5DF7F5C20F01F92A00526B4B /* CSSPropertyNames.h in Copy Generated Headers */,
 				8538F0300AD71CDB006A81D1 /* DOMAbstractView.h in Copy Generated Headers */,
 				1C11CCBC0AA6093700DADB20 /* DOMAttr.h in Copy Generated Headers */,
@@ -5311,6 +5356,11 @@
 		0B9056F60F2685F30095FF6A /* WorkerThreadableLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerThreadableLoader.cpp; sourceTree = "<group>"; };
 		0B9056F70F2685F30095FF6A /* WorkerThreadableLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerThreadableLoader.h; sourceTree = "<group>"; };
 		0BE030A10F3112FB003C1A46 /* RenderLineBoxList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderLineBoxList.h; sourceTree = "<group>"; };
+		0C3F1F5710C8871200D72CE1 /* WebGLUniformLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLUniformLocation.cpp; path = canvas/WebGLUniformLocation.cpp; sourceTree = "<group>"; };
+		0C3F1F5810C8871200D72CE1 /* WebGLUniformLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLUniformLocation.h; path = canvas/WebGLUniformLocation.h; sourceTree = "<group>"; };
+		0C3F1F5910C8871200D72CE1 /* WebGLUniformLocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLUniformLocation.idl; path = canvas/WebGLUniformLocation.idl; sourceTree = "<group>"; };
+		0C45342510CDBBFA00869157 /* JSWebGLUniformLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUniformLocation.cpp; sourceTree = "<group>"; };
+		0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUniformLocation.h; sourceTree = "<group>"; };
 		0F11A54E0F39233100C37884 /* RenderSelectionInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSelectionInfo.h; sourceTree = "<group>"; };
 		0F15DA890F3AAEE70000CE47 /* AnimationControllerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationControllerPrivate.h; path = animation/AnimationControllerPrivate.h; sourceTree = "<group>"; };
 		0F500AAE0F54DB1B00EEF928 /* TransformState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TransformState.h; sourceTree = "<group>"; };
@@ -5367,6 +5417,14 @@
 		1449E286107D4DB400B5793F /* JSCallbackData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackData.cpp; sourceTree = "<group>"; };
 		1477E7740BF4134A00152872 /* PageCache.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PageCache.cpp; sourceTree = "<group>"; };
 		1477E7750BF4134A00152872 /* PageCache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PageCache.h; sourceTree = "<group>"; };
+		1479FAE5109AE37500DED655 /* RenderRuby.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderRuby.cpp; sourceTree = "<group>"; };
+		1479FAE6109AE37500DED655 /* RenderRuby.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderRuby.h; sourceTree = "<group>"; };
+		1479FAE7109AE37500DED655 /* RenderRubyBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderRubyBase.cpp; sourceTree = "<group>"; };
+		1479FAE8109AE37500DED655 /* RenderRubyBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderRubyBase.h; sourceTree = "<group>"; };
+		1479FAE9109AE37500DED655 /* RenderRubyRun.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderRubyRun.cpp; sourceTree = "<group>"; };
+		1479FAEA109AE37500DED655 /* RenderRubyRun.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderRubyRun.h; sourceTree = "<group>"; };
+		1479FAEB109AE37500DED655 /* RenderRubyText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderRubyText.cpp; sourceTree = "<group>"; };
+		1479FAEC109AE37500DED655 /* RenderRubyText.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderRubyText.h; sourceTree = "<group>"; };
 		14813BF309EDF88E00F757E1 /* IDLParser.pm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text.script.perl; name = IDLParser.pm; path = scripts/IDLParser.pm; sourceTree = "<group>"; };
 		148AFDA30AF58360008CC700 /* ExceptionHandlers.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ExceptionHandlers.h; sourceTree = "<group>"; };
 		148AFDA40AF58360008CC700 /* ExceptionHandlers.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = ExceptionHandlers.mm; sourceTree = "<group>"; };
@@ -5725,6 +5783,7 @@
 		1CAF347E0A6C405200ABE06E /* WebScriptObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebScriptObject.h; sourceTree = "<group>"; };
 		1CAF347F0A6C405200ABE06E /* WebScriptObject.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebScriptObject.mm; sourceTree = "<group>"; };
 		1CAF34800A6C405200ABE06E /* WebScriptObjectPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebScriptObjectPrivate.h; sourceTree = "<group>"; };
+		1CCA732110ADD43E00FD440D /* DOMHTMLInputElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLInputElementPrivate.h; sourceTree = "<group>"; };
 		1CD0B6200AABDB5000D0A3FF /* PublicDOMInterfaces.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PublicDOMInterfaces.h; sourceTree = "<group>"; };
 		1CDD45E40BA9C84600F90147 /* DebugRelease.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = DebugRelease.xcconfig; sourceTree = "<group>"; };
 		1CDD45E50BA9C84600F90147 /* WebCore.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = WebCore.xcconfig; sourceTree = "<group>"; };
@@ -5875,10 +5934,6 @@
 		371F53E70D2704F900ECE0D5 /* CSSUnicodeRangeValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSUnicodeRangeValue.h; sourceTree = "<group>"; };
 		371F53E80D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSUnicodeRangeValue.cpp; sourceTree = "<group>"; };
 		37202198106213C600F25C4B /* FontSmoothingMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontSmoothingMode.h; sourceTree = "<group>"; };
-		3724CA540E68A7E400DB4384 /* CoreTextController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CoreTextController.h; sourceTree = "<group>"; };
-		3724CA550E68A7E400DB4384 /* CoreTextController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CoreTextController.cpp; sourceTree = "<group>"; };
-		3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FontMacATSUI.mm; sourceTree = "<group>"; };
-		3724CA7D0E68B20500DB4384 /* FontMacCoreText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontMacCoreText.cpp; sourceTree = "<group>"; };
 		3744570E0DB05FA500AE0992 /* SVGGlyphMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGGlyphMap.h; sourceTree = "<group>"; };
 		3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OverlapTestRequestClient.h; sourceTree = "<group>"; };
 		377C4CDD1014E9F600B9AE42 /* PlaceholderDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlaceholderDocument.h; sourceTree = "<group>"; };
@@ -5888,6 +5943,11 @@
 		37919C220B7D188600A56998 /* PositionIterator.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PositionIterator.h; sourceTree = "<group>"; };
 		37ACCE410DA2980F0089E602 /* FontRenderingMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontRenderingMode.h; sourceTree = "<group>"; };
 		37ACCE620DA2AA960089E602 /* FontDescription.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontDescription.cpp; sourceTree = "<group>"; };
+		37C2360A1097EDED00EF9F72 /* FontComplexTextMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontComplexTextMac.cpp; sourceTree = "<group>"; };
+		37C2360E1097EE7700EF9F72 /* ComplexTextController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ComplexTextController.cpp; sourceTree = "<group>"; };
+		37C2360F1097EE7700EF9F72 /* ComplexTextController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ComplexTextController.h; sourceTree = "<group>"; };
+		37C2381F1098C84200EF9F72 /* ComplexTextControllerATSUI.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ComplexTextControllerATSUI.cpp; sourceTree = "<group>"; };
+		37C238201098C84200EF9F72 /* ComplexTextControllerCoreText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ComplexTextControllerCoreText.cpp; sourceTree = "<group>"; };
 		37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreURLResponse.h; sourceTree = "<group>"; };
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
@@ -5896,7 +5956,6 @@
 		4110463F0FA222A600BA436A /* ScriptEventListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptEventListener.h; sourceTree = "<group>"; };
 		411046400FA222A600BA436A /* ScriptEventListener.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptEventListener.cpp; sourceTree = "<group>"; };
 		4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptState.cpp; sourceTree = "<group>"; };
-		412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptObjectQuarantine.cpp; sourceTree = "<group>"; };
 		415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAbstractWorkerCustom.cpp; sourceTree = "<group>"; };
 		415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerConstructor.cpp; sourceTree = "<group>"; };
 		415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSharedWorkerConstructor.h; sourceTree = "<group>"; };
@@ -5916,7 +5975,6 @@
 		416F45EF0ED7B311008215B6 /* ScriptString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptString.h; sourceTree = "<group>"; };
 		418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAbstractWorker.cpp; sourceTree = "<group>"; };
 		418F88030FF957AE0080F045 /* JSAbstractWorker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSAbstractWorker.h; sourceTree = "<group>"; };
-		419536500F68222400D0C679 /* ScriptObjectQuarantine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptObjectQuarantine.h; sourceTree = "<group>"; };
 		41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DedicatedWorkerThread.cpp; path = workers/DedicatedWorkerThread.cpp; sourceTree = "<group>"; };
 		41A3D58D101C152D00316D07 /* DedicatedWorkerThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DedicatedWorkerThread.h; path = workers/DedicatedWorkerThread.h; sourceTree = "<group>"; };
 		41BF70090FE86F49005E8DEC /* MessagePortChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MessagePortChannel.cpp; sourceTree = "<group>"; };
@@ -5991,7 +6049,7 @@
 		46F9D5DA0B0D60170028EE36 /* aliasCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = aliasCursor.png; sourceTree = "<group>"; };
 		46F9D5DB0B0D60170028EE36 /* noDropCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = noDropCursor.png; sourceTree = "<group>"; };
 		46F9D5DC0B0D60170028EE36 /* progressCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = progressCursor.png; sourceTree = "<group>"; };
-		492273A21083B3B100EE5C84 /* JSCanvasArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayCustom.cpp; sourceTree = "<group>"; };
+		492273A21083B3B100EE5C84 /* JSWebGLArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLArrayCustom.cpp; sourceTree = "<group>"; };
 		49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasGradient.cpp; path = canvas/CanvasGradient.cpp; sourceTree = "<group>"; };
 		49484FB4102CF23C00187DD3 /* CanvasGradient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasGradient.h; path = canvas/CanvasGradient.h; sourceTree = "<group>"; };
 		49484FB5102CF23C00187DD3 /* CanvasGradient.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasGradient.idl; path = canvas/CanvasGradient.idl; sourceTree = "<group>"; };
@@ -6022,49 +6080,49 @@
 		498391570F1E776900C23782 /* WebKitCSSMatrix.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitCSSMatrix.idl; sourceTree = "<group>"; };
 		498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitCSSMatrixConstructor.cpp; sourceTree = "<group>"; };
 		498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitCSSMatrixConstructor.h; sourceTree = "<group>"; };
-		49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasBuffer.cpp; sourceTree = "<group>"; };
-		49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasBuffer.h; sourceTree = "<group>"; };
-		49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArray.cpp; sourceTree = "<group>"; };
-		49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasByteArray.h; sourceTree = "<group>"; };
-		49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFramebuffer.cpp; sourceTree = "<group>"; };
-		49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFramebuffer.h; sourceTree = "<group>"; };
-		49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasProgram.cpp; sourceTree = "<group>"; };
-		49C7B9891042D2D30009D447 /* JSCanvasProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasProgram.h; sourceTree = "<group>"; };
-		49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderbuffer.cpp; sourceTree = "<group>"; };
-		49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderbuffer.h; sourceTree = "<group>"; };
-		49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShader.cpp; sourceTree = "<group>"; };
-		49C7B9901042D2D30009D447 /* JSCanvasShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShader.h; sourceTree = "<group>"; };
-		49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasTexture.cpp; sourceTree = "<group>"; };
-		49C7B9921042D2D30009D447 /* JSCanvasTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasTexture.h; sourceTree = "<group>"; };
-		49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasBuffer.cpp; path = canvas/CanvasBuffer.cpp; sourceTree = "<group>"; };
-		49C7B9A91042D32E0009D447 /* CanvasBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasBuffer.h; path = canvas/CanvasBuffer.h; sourceTree = "<group>"; };
-		49C7B9AA1042D32E0009D447 /* CanvasBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasBuffer.idl; path = canvas/CanvasBuffer.idl; sourceTree = "<group>"; };
-		49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasByteArray.cpp; path = canvas/CanvasByteArray.cpp; sourceTree = "<group>"; };
-		49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasByteArray.h; path = canvas/CanvasByteArray.h; sourceTree = "<group>"; };
-		49C7B9AD1042D32E0009D447 /* CanvasByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasByteArray.idl; path = canvas/CanvasByteArray.idl; sourceTree = "<group>"; };
-		49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasFramebuffer.cpp; path = canvas/CanvasFramebuffer.cpp; sourceTree = "<group>"; };
-		49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasFramebuffer.h; path = canvas/CanvasFramebuffer.h; sourceTree = "<group>"; };
-		49C7B9B01042D32E0009D447 /* CanvasFramebuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasFramebuffer.idl; path = canvas/CanvasFramebuffer.idl; sourceTree = "<group>"; };
+		49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLBuffer.cpp; sourceTree = "<group>"; };
+		49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLBuffer.h; sourceTree = "<group>"; };
+		49C7B9821042D2D30009D447 /* JSWebGLByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLByteArray.cpp; sourceTree = "<group>"; };
+		49C7B9831042D2D30009D447 /* JSWebGLByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLByteArray.h; sourceTree = "<group>"; };
+		49C7B9841042D2D30009D447 /* JSWebGLFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLFramebuffer.cpp; sourceTree = "<group>"; };
+		49C7B9851042D2D30009D447 /* JSWebGLFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLFramebuffer.h; sourceTree = "<group>"; };
+		49C7B9881042D2D30009D447 /* JSWebGLProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLProgram.cpp; sourceTree = "<group>"; };
+		49C7B9891042D2D30009D447 /* JSWebGLProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLProgram.h; sourceTree = "<group>"; };
+		49C7B98A1042D2D30009D447 /* JSWebGLRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLRenderbuffer.cpp; sourceTree = "<group>"; };
+		49C7B98B1042D2D30009D447 /* JSWebGLRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLRenderbuffer.h; sourceTree = "<group>"; };
+		49C7B98F1042D2D30009D447 /* JSWebGLShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLShader.cpp; sourceTree = "<group>"; };
+		49C7B9901042D2D30009D447 /* JSWebGLShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLShader.h; sourceTree = "<group>"; };
+		49C7B9911042D2D30009D447 /* JSWebGLTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLTexture.cpp; sourceTree = "<group>"; };
+		49C7B9921042D2D30009D447 /* JSWebGLTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLTexture.h; sourceTree = "<group>"; };
+		49C7B9A81042D32E0009D447 /* WebGLBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLBuffer.cpp; path = canvas/WebGLBuffer.cpp; sourceTree = "<group>"; };
+		49C7B9A91042D32E0009D447 /* WebGLBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLBuffer.h; path = canvas/WebGLBuffer.h; sourceTree = "<group>"; };
+		49C7B9AA1042D32E0009D447 /* WebGLBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLBuffer.idl; path = canvas/WebGLBuffer.idl; sourceTree = "<group>"; };
+		49C7B9AB1042D32E0009D447 /* WebGLByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLByteArray.cpp; path = canvas/WebGLByteArray.cpp; sourceTree = "<group>"; };
+		49C7B9AC1042D32E0009D447 /* WebGLByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLByteArray.h; path = canvas/WebGLByteArray.h; sourceTree = "<group>"; };
+		49C7B9AD1042D32E0009D447 /* WebGLByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLByteArray.idl; path = canvas/WebGLByteArray.idl; sourceTree = "<group>"; };
+		49C7B9AE1042D32E0009D447 /* WebGLFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLFramebuffer.cpp; path = canvas/WebGLFramebuffer.cpp; sourceTree = "<group>"; };
+		49C7B9AF1042D32E0009D447 /* WebGLFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLFramebuffer.h; path = canvas/WebGLFramebuffer.h; sourceTree = "<group>"; };
+		49C7B9B01042D32E0009D447 /* WebGLFramebuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLFramebuffer.idl; path = canvas/WebGLFramebuffer.idl; sourceTree = "<group>"; };
 		49C7B9B41042D32F0009D447 /* CanvasObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasObject.cpp; path = canvas/CanvasObject.cpp; sourceTree = "<group>"; };
 		49C7B9B51042D32F0009D447 /* CanvasObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasObject.h; path = canvas/CanvasObject.h; sourceTree = "<group>"; };
-		49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasProgram.cpp; path = canvas/CanvasProgram.cpp; sourceTree = "<group>"; };
-		49C7B9B71042D32F0009D447 /* CanvasProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasProgram.h; path = canvas/CanvasProgram.h; sourceTree = "<group>"; };
-		49C7B9B81042D32F0009D447 /* CanvasProgram.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasProgram.idl; path = canvas/CanvasProgram.idl; sourceTree = "<group>"; };
-		49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderbuffer.cpp; path = canvas/CanvasRenderbuffer.cpp; sourceTree = "<group>"; };
-		49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderbuffer.h; path = canvas/CanvasRenderbuffer.h; sourceTree = "<group>"; };
-		49C7B9BB1042D32F0009D447 /* CanvasRenderbuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderbuffer.idl; path = canvas/CanvasRenderbuffer.idl; sourceTree = "<group>"; };
+		49C7B9B61042D32F0009D447 /* WebGLProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLProgram.cpp; path = canvas/WebGLProgram.cpp; sourceTree = "<group>"; };
+		49C7B9B71042D32F0009D447 /* WebGLProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLProgram.h; path = canvas/WebGLProgram.h; sourceTree = "<group>"; };
+		49C7B9B81042D32F0009D447 /* WebGLProgram.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLProgram.idl; path = canvas/WebGLProgram.idl; sourceTree = "<group>"; };
+		49C7B9B91042D32F0009D447 /* WebGLRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLRenderbuffer.cpp; path = canvas/WebGLRenderbuffer.cpp; sourceTree = "<group>"; };
+		49C7B9BA1042D32F0009D447 /* WebGLRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLRenderbuffer.h; path = canvas/WebGLRenderbuffer.h; sourceTree = "<group>"; };
+		49C7B9BB1042D32F0009D447 /* WebGLRenderbuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLRenderbuffer.idl; path = canvas/WebGLRenderbuffer.idl; sourceTree = "<group>"; };
 		49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderingContext.cpp; path = canvas/CanvasRenderingContext.cpp; sourceTree = "<group>"; };
 		49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderingContext.h; path = canvas/CanvasRenderingContext.h; sourceTree = "<group>"; };
 		49C7B9BE1042D32F0009D447 /* CanvasRenderingContext.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderingContext.idl; path = canvas/CanvasRenderingContext.idl; sourceTree = "<group>"; };
-		49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderingContext3D.cpp; path = canvas/CanvasRenderingContext3D.cpp; sourceTree = "<group>"; };
-		49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderingContext3D.h; path = canvas/CanvasRenderingContext3D.h; sourceTree = "<group>"; };
-		49C7B9C11042D32F0009D447 /* CanvasRenderingContext3D.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderingContext3D.idl; path = canvas/CanvasRenderingContext3D.idl; sourceTree = "<group>"; };
-		49C7B9C21042D32F0009D447 /* CanvasShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasShader.cpp; path = canvas/CanvasShader.cpp; sourceTree = "<group>"; };
-		49C7B9C31042D32F0009D447 /* CanvasShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasShader.h; path = canvas/CanvasShader.h; sourceTree = "<group>"; };
-		49C7B9C41042D32F0009D447 /* CanvasShader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasShader.idl; path = canvas/CanvasShader.idl; sourceTree = "<group>"; };
-		49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasTexture.cpp; path = canvas/CanvasTexture.cpp; sourceTree = "<group>"; };
-		49C7B9C61042D32F0009D447 /* CanvasTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasTexture.h; path = canvas/CanvasTexture.h; sourceTree = "<group>"; };
-		49C7B9C71042D32F0009D447 /* CanvasTexture.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasTexture.idl; path = canvas/CanvasTexture.idl; sourceTree = "<group>"; };
+		49C7B9BF1042D32F0009D447 /* WebGLRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLRenderingContext.cpp; path = canvas/WebGLRenderingContext.cpp; sourceTree = "<group>"; };
+		49C7B9C01042D32F0009D447 /* WebGLRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLRenderingContext.h; path = canvas/WebGLRenderingContext.h; sourceTree = "<group>"; };
+		49C7B9C11042D32F0009D447 /* WebGLRenderingContext.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLRenderingContext.idl; path = canvas/WebGLRenderingContext.idl; sourceTree = "<group>"; };
+		49C7B9C21042D32F0009D447 /* WebGLShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLShader.cpp; path = canvas/WebGLShader.cpp; sourceTree = "<group>"; };
+		49C7B9C31042D32F0009D447 /* WebGLShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLShader.h; path = canvas/WebGLShader.h; sourceTree = "<group>"; };
+		49C7B9C41042D32F0009D447 /* WebGLShader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLShader.idl; path = canvas/WebGLShader.idl; sourceTree = "<group>"; };
+		49C7B9C51042D32F0009D447 /* WebGLTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLTexture.cpp; path = canvas/WebGLTexture.cpp; sourceTree = "<group>"; };
+		49C7B9C61042D32F0009D447 /* WebGLTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLTexture.h; path = canvas/WebGLTexture.h; sourceTree = "<group>"; };
+		49C7B9C71042D32F0009D447 /* WebGLTexture.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLTexture.idl; path = canvas/WebGLTexture.idl; sourceTree = "<group>"; };
 		49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GraphicsContext3D.h; sourceTree = "<group>"; };
 		49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Canvas3DLayer.h; sourceTree = "<group>"; };
 		49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = Canvas3DLayer.mm; sourceTree = "<group>"; };
@@ -6096,77 +6154,77 @@
 		49E912A70EFAC906009D0CAF /* AnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AnimationList.cpp; path = animation/AnimationList.cpp; sourceTree = "<group>"; };
 		49E912A80EFAC906009D0CAF /* AnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationList.h; path = animation/AnimationList.h; sourceTree = "<group>"; };
 		49E912A90EFAC906009D0CAF /* TimingFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TimingFunction.h; path = animation/TimingFunction.h; sourceTree = "<group>"; };
-		49EECDC710503C2300099FAB /* CanvasArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasArray.cpp; path = canvas/CanvasArray.cpp; sourceTree = "<group>"; };
-		49EECDC810503C2300099FAB /* CanvasArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasArray.h; path = canvas/CanvasArray.h; sourceTree = "<group>"; };
-		49EECDC910503C2300099FAB /* CanvasArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasArray.idl; path = canvas/CanvasArray.idl; sourceTree = "<group>"; };
-		49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasArrayBuffer.cpp; path = canvas/CanvasArrayBuffer.cpp; sourceTree = "<group>"; };
-		49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasArrayBuffer.h; path = canvas/CanvasArrayBuffer.h; sourceTree = "<group>"; };
-		49EECDCC10503C2300099FAB /* CanvasArrayBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasArrayBuffer.idl; path = canvas/CanvasArrayBuffer.idl; sourceTree = "<group>"; };
-		49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasFloatArray.cpp; path = canvas/CanvasFloatArray.cpp; sourceTree = "<group>"; };
-		49EECDCE10503C2300099FAB /* CanvasFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasFloatArray.h; path = canvas/CanvasFloatArray.h; sourceTree = "<group>"; };
-		49EECDCF10503C2300099FAB /* CanvasFloatArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasFloatArray.idl; path = canvas/CanvasFloatArray.idl; sourceTree = "<group>"; };
-		49EECDD010503C2300099FAB /* CanvasIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasIntArray.cpp; path = canvas/CanvasIntArray.cpp; sourceTree = "<group>"; };
-		49EECDD110503C2300099FAB /* CanvasIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasIntArray.h; path = canvas/CanvasIntArray.h; sourceTree = "<group>"; };
-		49EECDD210503C2300099FAB /* CanvasIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasIntArray.idl; path = canvas/CanvasIntArray.idl; sourceTree = "<group>"; };
-		49EECDD310503C2300099FAB /* CanvasShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasShortArray.cpp; path = canvas/CanvasShortArray.cpp; sourceTree = "<group>"; };
-		49EECDD410503C2300099FAB /* CanvasShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasShortArray.h; path = canvas/CanvasShortArray.h; sourceTree = "<group>"; };
-		49EECDD510503C2300099FAB /* CanvasShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasShortArray.idl; path = canvas/CanvasShortArray.idl; sourceTree = "<group>"; };
-		49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedByteArray.cpp; path = canvas/CanvasUnsignedByteArray.cpp; sourceTree = "<group>"; };
-		49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedByteArray.h; path = canvas/CanvasUnsignedByteArray.h; sourceTree = "<group>"; };
-		49EECDD810503C2300099FAB /* CanvasUnsignedByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedByteArray.idl; path = canvas/CanvasUnsignedByteArray.idl; sourceTree = "<group>"; };
-		49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedIntArray.cpp; path = canvas/CanvasUnsignedIntArray.cpp; sourceTree = "<group>"; };
-		49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedIntArray.h; path = canvas/CanvasUnsignedIntArray.h; sourceTree = "<group>"; };
-		49EECDDB10503C2300099FAB /* CanvasUnsignedIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedIntArray.idl; path = canvas/CanvasUnsignedIntArray.idl; sourceTree = "<group>"; };
-		49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedShortArray.cpp; path = canvas/CanvasUnsignedShortArray.cpp; sourceTree = "<group>"; };
-		49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedShortArray.h; path = canvas/CanvasUnsignedShortArray.h; sourceTree = "<group>"; };
-		49EECDDE10503C2400099FAB /* CanvasUnsignedShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedShortArray.idl; path = canvas/CanvasUnsignedShortArray.idl; sourceTree = "<group>"; };
-		49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayBuffer.cpp; sourceTree = "<group>"; };
-		49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArrayBuffer.h; sourceTree = "<group>"; };
-		49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArray.cpp; sourceTree = "<group>"; };
-		49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFloatArray.h; sourceTree = "<group>"; };
-		49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArray.cpp; sourceTree = "<group>"; };
-		49EECEF7105070C400099FAB /* JSCanvasIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasIntArray.h; sourceTree = "<group>"; };
-		49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArray.cpp; sourceTree = "<group>"; };
-		49EECEF9105070C400099FAB /* JSCanvasShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShortArray.h; sourceTree = "<group>"; };
-		49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArray.cpp; sourceTree = "<group>"; };
-		49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedByteArray.h; sourceTree = "<group>"; };
-		49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArray.cpp; sourceTree = "<group>"; };
-		49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedIntArray.h; sourceTree = "<group>"; };
-		49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArray.cpp; sourceTree = "<group>"; };
-		49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedShortArray.h; sourceTree = "<group>"; };
-		49EECF19105072F300099FAB /* JSCanvasArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArray.cpp; sourceTree = "<group>"; };
-		49EECF1A105072F300099FAB /* JSCanvasArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArray.h; sourceTree = "<group>"; };
-		49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayBufferConstructor.cpp; sourceTree = "<group>"; };
-		49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArrayBufferConstructor.h; sourceTree = "<group>"; };
-		49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasByteArrayConstructor.h; sourceTree = "<group>"; };
-		49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFloatArrayConstructor.h; sourceTree = "<group>"; };
-		49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasIntArrayConstructor.h; sourceTree = "<group>"; };
-		49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShortArrayConstructor.h; sourceTree = "<group>"; };
-		49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedByteArrayConstructor.h; sourceTree = "<group>"; };
-		49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedIntArrayConstructor.h; sourceTree = "<group>"; };
-		49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedShortArrayConstructor.h; sourceTree = "<group>"; };
+		49EECDC710503C2300099FAB /* WebGLArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLArray.cpp; path = canvas/WebGLArray.cpp; sourceTree = "<group>"; };
+		49EECDC810503C2300099FAB /* WebGLArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLArray.h; path = canvas/WebGLArray.h; sourceTree = "<group>"; };
+		49EECDC910503C2300099FAB /* WebGLArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLArray.idl; path = canvas/WebGLArray.idl; sourceTree = "<group>"; };
+		49EECDCA10503C2300099FAB /* WebGLArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLArrayBuffer.cpp; path = canvas/WebGLArrayBuffer.cpp; sourceTree = "<group>"; };
+		49EECDCB10503C2300099FAB /* WebGLArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLArrayBuffer.h; path = canvas/WebGLArrayBuffer.h; sourceTree = "<group>"; };
+		49EECDCC10503C2300099FAB /* WebGLArrayBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLArrayBuffer.idl; path = canvas/WebGLArrayBuffer.idl; sourceTree = "<group>"; };
+		49EECDCD10503C2300099FAB /* WebGLFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLFloatArray.cpp; path = canvas/WebGLFloatArray.cpp; sourceTree = "<group>"; };
+		49EECDCE10503C2300099FAB /* WebGLFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLFloatArray.h; path = canvas/WebGLFloatArray.h; sourceTree = "<group>"; };
+		49EECDCF10503C2300099FAB /* WebGLFloatArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLFloatArray.idl; path = canvas/WebGLFloatArray.idl; sourceTree = "<group>"; };
+		49EECDD010503C2300099FAB /* WebGLIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLIntArray.cpp; path = canvas/WebGLIntArray.cpp; sourceTree = "<group>"; };
+		49EECDD110503C2300099FAB /* WebGLIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLIntArray.h; path = canvas/WebGLIntArray.h; sourceTree = "<group>"; };
+		49EECDD210503C2300099FAB /* WebGLIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLIntArray.idl; path = canvas/WebGLIntArray.idl; sourceTree = "<group>"; };
+		49EECDD310503C2300099FAB /* WebGLShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLShortArray.cpp; path = canvas/WebGLShortArray.cpp; sourceTree = "<group>"; };
+		49EECDD410503C2300099FAB /* WebGLShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLShortArray.h; path = canvas/WebGLShortArray.h; sourceTree = "<group>"; };
+		49EECDD510503C2300099FAB /* WebGLShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLShortArray.idl; path = canvas/WebGLShortArray.idl; sourceTree = "<group>"; };
+		49EECDD610503C2300099FAB /* WebGLUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLUnsignedByteArray.cpp; path = canvas/WebGLUnsignedByteArray.cpp; sourceTree = "<group>"; };
+		49EECDD710503C2300099FAB /* WebGLUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLUnsignedByteArray.h; path = canvas/WebGLUnsignedByteArray.h; sourceTree = "<group>"; };
+		49EECDD810503C2300099FAB /* WebGLUnsignedByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLUnsignedByteArray.idl; path = canvas/WebGLUnsignedByteArray.idl; sourceTree = "<group>"; };
+		49EECDD910503C2300099FAB /* WebGLUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLUnsignedIntArray.cpp; path = canvas/WebGLUnsignedIntArray.cpp; sourceTree = "<group>"; };
+		49EECDDA10503C2300099FAB /* WebGLUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLUnsignedIntArray.h; path = canvas/WebGLUnsignedIntArray.h; sourceTree = "<group>"; };
+		49EECDDB10503C2300099FAB /* WebGLUnsignedIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLUnsignedIntArray.idl; path = canvas/WebGLUnsignedIntArray.idl; sourceTree = "<group>"; };
+		49EECDDC10503C2300099FAB /* WebGLUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLUnsignedShortArray.cpp; path = canvas/WebGLUnsignedShortArray.cpp; sourceTree = "<group>"; };
+		49EECDDD10503C2400099FAB /* WebGLUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLUnsignedShortArray.h; path = canvas/WebGLUnsignedShortArray.h; sourceTree = "<group>"; };
+		49EECDDE10503C2400099FAB /* WebGLUnsignedShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLUnsignedShortArray.idl; path = canvas/WebGLUnsignedShortArray.idl; sourceTree = "<group>"; };
+		49EECEF2105070C400099FAB /* JSWebGLArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLArrayBuffer.cpp; sourceTree = "<group>"; };
+		49EECEF3105070C400099FAB /* JSWebGLArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLArrayBuffer.h; sourceTree = "<group>"; };
+		49EECEF4105070C400099FAB /* JSWebGLFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLFloatArray.cpp; sourceTree = "<group>"; };
+		49EECEF5105070C400099FAB /* JSWebGLFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLFloatArray.h; sourceTree = "<group>"; };
+		49EECEF6105070C400099FAB /* JSWebGLIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLIntArray.cpp; sourceTree = "<group>"; };
+		49EECEF7105070C400099FAB /* JSWebGLIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLIntArray.h; sourceTree = "<group>"; };
+		49EECEF8105070C400099FAB /* JSWebGLShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLShortArray.cpp; sourceTree = "<group>"; };
+		49EECEF9105070C400099FAB /* JSWebGLShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLShortArray.h; sourceTree = "<group>"; };
+		49EECEFA105070C400099FAB /* JSWebGLUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedByteArray.cpp; sourceTree = "<group>"; };
+		49EECEFB105070C400099FAB /* JSWebGLUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedByteArray.h; sourceTree = "<group>"; };
+		49EECEFC105070C400099FAB /* JSWebGLUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedIntArray.cpp; sourceTree = "<group>"; };
+		49EECEFD105070C400099FAB /* JSWebGLUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedIntArray.h; sourceTree = "<group>"; };
+		49EECEFE105070C400099FAB /* JSWebGLUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedShortArray.cpp; sourceTree = "<group>"; };
+		49EECEFF105070C400099FAB /* JSWebGLUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedShortArray.h; sourceTree = "<group>"; };
+		49EECF19105072F300099FAB /* JSWebGLArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLArray.cpp; sourceTree = "<group>"; };
+		49EECF1A105072F300099FAB /* JSWebGLArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLArray.h; sourceTree = "<group>"; };
+		49EECF7110508D9C00099FAB /* JSWebGLByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLByteArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7210508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLFloatArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7310508D9C00099FAB /* JSWebGLIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLIntArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7410508D9C00099FAB /* JSWebGLShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLShortArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7510508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedByteArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7610508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedIntArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7710508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedShortArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF991050938200099FAB /* JSWebGLArrayBufferConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLArrayBufferConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9A1050938200099FAB /* JSWebGLArrayBufferConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLArrayBufferConstructor.h; sourceTree = "<group>"; };
+		49EECF9B1050938200099FAB /* JSWebGLByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLByteArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9C1050938200099FAB /* JSWebGLByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLByteArrayConstructor.h; sourceTree = "<group>"; };
+		49EECF9D1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLFloatArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9E1050938200099FAB /* JSWebGLFloatArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLFloatArrayConstructor.h; sourceTree = "<group>"; };
+		49EECF9F1050938200099FAB /* JSWebGLIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLIntArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA01050938200099FAB /* JSWebGLIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLIntArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA31050938200099FAB /* JSWebGLShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLShortArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA41050938200099FAB /* JSWebGLShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLShortArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA51050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedByteArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA61050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedByteArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA71050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedIntArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA81050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedIntArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA91050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedShortArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFAA1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedShortArrayConstructor.h; sourceTree = "<group>"; };
 		49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext.cpp; sourceTree = "<group>"; };
 		49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext.h; sourceTree = "<group>"; };
 		49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2D.cpp; sourceTree = "<group>"; };
 		49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext2D.h; sourceTree = "<group>"; };
-		49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext3D.cpp; sourceTree = "<group>"; };
-		49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext3D.h; sourceTree = "<group>"; };
+		49EED1401051969400099FAB /* JSWebGLRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLRenderingContext.cpp; sourceTree = "<group>"; };
+		49EED1411051969400099FAB /* JSWebGLRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLRenderingContext.h; sourceTree = "<group>"; };
 		49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2DCustom.cpp; sourceTree = "<group>"; };
-		49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext3DCustom.cpp; sourceTree = "<group>"; };
+		49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLRenderingContextCustom.cpp; sourceTree = "<group>"; };
 		49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContextCustom.cpp; sourceTree = "<group>"; };
 		4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = SelectionControllerMac.mm; path = mac/SelectionControllerMac.mm; sourceTree = "<group>"; };
 		4B2708C50AF19EE40065127F /* Pasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pasteboard.h; sourceTree = "<group>"; };
@@ -6280,6 +6338,12 @@
 		51741D0C0B07259A00ED442C /* BackForwardList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BackForwardList.cpp; sourceTree = "<group>"; };
 		51741D0D0B07259A00ED442C /* HistoryItem.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HistoryItem.h; sourceTree = "<group>"; };
 		51741D0E0B07259A00ED442C /* HistoryItem.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryItem.cpp; sourceTree = "<group>"; };
+		5174E20810A1F44F00F95E6F /* PopStateEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PopStateEvent.h; sourceTree = "<group>"; };
+		5174E20B10A1F49A00F95E6F /* PopStateEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PopStateEvent.idl; sourceTree = "<group>"; };
+		5189F01710B3781300F3C739 /* JSPopStateEventCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPopStateEventCustom.cpp; sourceTree = "<group>"; };
+		5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPopStateEvent.cpp; sourceTree = "<group>"; };
+		5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPopStateEvent.h; sourceTree = "<group>"; };
+		5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PopStateEvent.cpp; sourceTree = "<group>"; };
 		518A34BE1026C831001B6896 /* WebSocket.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocket.cpp; sourceTree = "<group>"; };
 		518A34BF1026C831001B6896 /* WebSocket.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocket.h; sourceTree = "<group>"; };
 		518A34C01026C831001B6896 /* WebSocket.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebSocket.idl; sourceTree = "<group>"; };
@@ -6361,6 +6425,8 @@
 		54C50F7A0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTokenizerLibxml2.cpp; sourceTree = "<group>"; };
 		550A0BC7085F6039007353D6 /* QualifiedName.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = QualifiedName.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		550A0BC8085F6039007353D6 /* QualifiedName.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = QualifiedName.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		599D1E3010C97D6E00E0EF12 /* jni_utility_private.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = jni_utility_private.cpp; path = jsc/jni_utility_private.cpp; sourceTree = "<group>"; };
+		599D1E3110C97D6E00E0EF12 /* jni_utility_private.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = jni_utility_private.h; path = jsc/jni_utility_private.h; sourceTree = "<group>"; };
 		59C77F2810545B3B00506104 /* GeolocationServiceMock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = GeolocationServiceMock.cpp; path = mock/GeolocationServiceMock.cpp; sourceTree = "<group>"; };
 		59C77F2910545B3B00506104 /* GeolocationServiceMock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GeolocationServiceMock.h; path = mock/GeolocationServiceMock.h; sourceTree = "<group>"; };
 		5D15E3A90F9E6AC1009E0E3F /* XMLTokenizerScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTokenizerScope.cpp; sourceTree = "<group>"; };
@@ -6480,6 +6546,8 @@
 		65DF323609D1DE65000BE325 /* JSCanvasPattern.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCanvasPattern.h; sourceTree = "<group>"; };
 		65F80697054D9F86008BF776 /* BlockExceptions.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = BlockExceptions.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65FEA86809833ADE00BED4AB /* Page.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Page.cpp; sourceTree = "<group>"; };
+		6E47E65E10B7944B00B186C8 /* WebGLGetInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLGetInfo.cpp; path = canvas/WebGLGetInfo.cpp; sourceTree = "<group>"; };
+		6E47E65F10B7944B00B186C8 /* WebGLGetInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLGetInfo.h; path = canvas/WebGLGetInfo.h; sourceTree = "<group>"; };
 		72626E010EF022FE00A07E20 /* FontFastPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFastPath.cpp; sourceTree = "<group>"; };
 		754133A7102E00E800075D00 /* InspectorTimelineAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTimelineAgent.h; sourceTree = "<group>"; };
 		754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTimelineAgent.cpp; sourceTree = "<group>"; };
@@ -6497,6 +6565,22 @@
 		7693BACF106C2DCA007B0823 /* PluginHalter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginHalter.cpp; sourceTree = "<group>"; };
 		7693BAD0106C2DCA007B0823 /* PluginHalter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginHalter.h; sourceTree = "<group>"; };
 		7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginHalterClient.h; sourceTree = "<group>"; };
+		79AC9216109945C80021266E /* JSCompositionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCompositionEvent.cpp; sourceTree = "<group>"; };
+		79AC9217109945C80021266E /* JSCompositionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCompositionEvent.h; sourceTree = "<group>"; };
+		79F2F59E1091939A000D87CB /* CompositionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CompositionEvent.cpp; sourceTree = "<group>"; };
+		79F2F59F1091939A000D87CB /* CompositionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CompositionEvent.h; sourceTree = "<group>"; };
+		79F2F5A01091939A000D87CB /* CompositionEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = CompositionEvent.idl; sourceTree = "<group>"; };
+		7A0E76D410BF050700A0276E /* JSInjectedScriptHostCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptHostCustom.cpp; sourceTree = "<group>"; };
+		7A0E76D810BF059800A0276E /* JSInjectedScriptHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptHost.cpp; sourceTree = "<group>"; };
+		7A0E76D910BF059800A0276E /* JSInjectedScriptHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInjectedScriptHost.h; sourceTree = "<group>"; };
+		7A0E76F610BF08ED00A0276E /* InjectedScriptHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptHost.cpp; sourceTree = "<group>"; };
+		7A0E76F710BF08ED00A0276E /* InjectedScriptHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptHost.h; sourceTree = "<group>"; };
+		7A0E76F810BF08ED00A0276E /* InjectedScriptHost.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = InjectedScriptHost.idl; sourceTree = "<group>"; };
+		7A0E770B10C00A8800A0276E /* InspectorFrontendHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontendHost.cpp; sourceTree = "<group>"; };
+		7A0E770C10C00A8800A0276E /* InspectorFrontendHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendHost.h; sourceTree = "<group>"; };
+		7A0E770D10C00A8800A0276E /* InspectorFrontendHost.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = InspectorFrontendHost.idl; sourceTree = "<group>"; };
+		7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInspectorFrontendHost.cpp; sourceTree = "<group>"; };
+		7A0E771D10C00DB100A0276E /* JSInspectorFrontendHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInspectorFrontendHost.h; sourceTree = "<group>"; };
 		7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptArray.cpp; sourceTree = "<group>"; };
 		7A1E88F4101CC384000C4DF5 /* ScriptArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptArray.h; sourceTree = "<group>"; };
 		7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorDOMAgent.cpp; sourceTree = "<group>"; };
@@ -6506,7 +6590,8 @@
 		7A74ECB61018399A00BF939E /* InspectorBackend.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = InspectorBackend.idl; sourceTree = "<group>"; };
 		7A74ECB8101839A500BF939E /* InspectorBackend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBackend.cpp; sourceTree = "<group>"; };
 		7A74ECB9101839A600BF939E /* InspectorBackend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorBackend.h; sourceTree = "<group>"; };
-		7A74ECBC101839DA00BF939E /* JSInspectorBackendCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInspectorBackendCustom.cpp; sourceTree = "<group>"; };
+		7A74ECBC101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInspectorFrontendHostCustom.cpp; sourceTree = "<group>"; };
+		7ADE722510CBBB9B006B3B3A /* ContextMenuSelectionHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContextMenuSelectionHandler.h; sourceTree = "<group>"; };
 		7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontend.cpp; sourceTree = "<group>"; };
 		7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontend.h; sourceTree = "<group>"; };
 		84224181107E77F400766A87 /* JSSVGFEMorphologyElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGFEMorphologyElement.cpp; sourceTree = "<group>"; };
@@ -7481,6 +7566,7 @@
 		938192020F87E1E600D5352A /* BinaryPropertyList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BinaryPropertyList.cpp; sourceTree = "<group>"; };
 		938192040F87E1EC00D5352A /* BinaryPropertyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BinaryPropertyList.h; sourceTree = "<group>"; };
 		9382AAB10D8C386100F357A6 /* NodeWithIndex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeWithIndex.h; sourceTree = "<group>"; };
+		9382DF5710A8D5C900925652 /* ColorSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorSpace.h; sourceTree = "<group>"; };
 		93831B560D087D6000E5C984 /* ExceptionCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionCode.cpp; sourceTree = "<group>"; };
 		938E65F009F09840008A48EC /* JSHTMLElementWrapperFactory.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLElementWrapperFactory.h; sourceTree = "<group>"; };
 		938E65F609F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLElementWrapperFactory.cpp; sourceTree = "<group>"; };
@@ -7624,10 +7710,10 @@
 		A7CFB3D00B7ED10A0070C32D /* DragImage.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DragImage.h; sourceTree = "<group>"; };
 		A7CFB3D40B7ED1180070C32D /* DragImageMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DragImageMac.mm; sourceTree = "<group>"; };
 		A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSImageDataCustom.cpp; sourceTree = "<group>"; };
-		A7D20F3B107F373800A80392 /* CanvasActiveInfo.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasActiveInfo.idl; path = canvas/CanvasActiveInfo.idl; sourceTree = "<group>"; };
-		A7D20F60107F406900A80392 /* JSCanvasActiveInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasActiveInfo.cpp; sourceTree = "<group>"; };
-		A7D20F61107F406900A80392 /* JSCanvasActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasActiveInfo.h; sourceTree = "<group>"; };
-		A7D20F6B107F438B00A80392 /* CanvasActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasActiveInfo.h; path = canvas/CanvasActiveInfo.h; sourceTree = "<group>"; };
+		A7D20F3B107F373800A80392 /* WebGLActiveInfo.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLActiveInfo.idl; path = canvas/WebGLActiveInfo.idl; sourceTree = "<group>"; };
+		A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLActiveInfo.cpp; sourceTree = "<group>"; };
+		A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLActiveInfo.h; sourceTree = "<group>"; };
+		A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLActiveInfo.h; path = canvas/WebGLActiveInfo.h; sourceTree = "<group>"; };
 		A7D27FC30E0A599F0079AD2B /* SVGFETile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFETile.cpp; sourceTree = "<group>"; };
 		A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardHelper.h; sourceTree = "<group>"; };
 		A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerScriptLoader.h; path = workers/WorkerScriptLoader.h; sourceTree = "<group>"; };
@@ -8223,6 +8309,7 @@
 		AB23A32609BBA7D00067CC53 /* BeforeTextInsertedEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = BeforeTextInsertedEvent.h; sourceTree = "<group>"; };
 		AB247A6A0AFD6383003FA5FD /* RenderSlider.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSlider.cpp; sourceTree = "<group>"; };
 		AB247A6B0AFD6383003FA5FD /* RenderSlider.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSlider.h; sourceTree = "<group>"; };
+		AB31C91D10AE1B8E000C7B92 /* LineClampValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LineClampValue.h; path = style/LineClampValue.h; sourceTree = "<group>"; };
 		AB40484B0E083FA8007D6920 /* MediaDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaDocument.cpp; sourceTree = "<group>"; };
 		AB40484C0E083FA8007D6920 /* MediaDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaDocument.h; sourceTree = "<group>"; };
 		AB4261D70A2F6C9700BDD17D /* missingImage.tiff */ = {isa = PBXFileReference; lastKnownFileType = image.tiff; path = missingImage.tiff; sourceTree = "<group>"; };
@@ -9259,8 +9346,6 @@
 		BC491B4E0C023E2D009D6316 /* HTMLMarqueeElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLMarqueeElement.idl; sourceTree = "<group>"; };
 		BC491B760C023EFD009D6316 /* JSHTMLMarqueeElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLMarqueeElement.cpp; sourceTree = "<group>"; };
 		BC491B770C023EFD009D6316 /* JSHTMLMarqueeElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLMarqueeElement.h; sourceTree = "<group>"; };
-		BC4BF9E20D11E133007D247F /* ClassNames.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ClassNames.cpp; sourceTree = "<group>"; };
-		BC4BF9E30D11E133007D247F /* ClassNames.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassNames.h; sourceTree = "<group>"; };
 		BC4EDEF30C08F3FB007EDD49 /* JSHTMLAppletElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLAppletElementCustom.cpp; sourceTree = "<group>"; };
 		BC5156E50C03B741008BB0EE /* DOMHTMLMarqueeElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLMarqueeElement.h; sourceTree = "<group>"; };
 		BC5156E60C03B741008BB0EE /* DOMHTMLMarqueeElement.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLMarqueeElement.mm; sourceTree = "<group>"; };
@@ -9705,6 +9790,8 @@
 		C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModifySelectionListLevel.h; sourceTree = "<group>"; };
 		C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModifySelectionListLevel.cpp; sourceTree = "<group>"; };
 		CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptSourceProvider.h; sourceTree = "<group>"; };
+		D01A27AB10C9BFD800026A42 /* SpaceSplitString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpaceSplitString.cpp; sourceTree = "<group>"; };
+		D01A27AC10C9BFD800026A42 /* SpaceSplitString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpaceSplitString.h; sourceTree = "<group>"; };
 		D05CED270A40BB2C00C5AF38 /* FormatBlockCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FormatBlockCommand.cpp; sourceTree = "<group>"; };
 		D05CED280A40BB2C00C5AF38 /* FormatBlockCommand.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FormatBlockCommand.h; sourceTree = "<group>"; };
 		D06C0D8D0CFD11460065F43F /* RemoveFormatCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoveFormatCommand.h; sourceTree = "<group>"; };
@@ -9744,6 +9831,7 @@
 		E10B9CCB0B747A44003ED890 /* DOMCustomXPathNSResolver.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMCustomXPathNSResolver.mm; sourceTree = "<group>"; };
 		E11C9D9A0EB3681200E409DB /* ScriptExecutionContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptExecutionContext.h; sourceTree = "<group>"; };
 		E11C9DAF0EB3699500E409DB /* ScriptExecutionContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptExecutionContext.cpp; sourceTree = "<group>"; };
+		E124748310AA161D00B79493 /* AuthenticationClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AuthenticationClient.h; sourceTree = "<group>"; };
 		E12719C60EEEC16800F61213 /* NavigatorBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorBase.h; sourceTree = "<group>"; };
 		E12719C90EEEC21300F61213 /* NavigatorBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigatorBase.cpp; sourceTree = "<group>"; };
 		E1271A0A0EEEC77A00F61213 /* WorkerNavigator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerNavigator.h; sourceTree = "<group>"; };
@@ -9780,6 +9868,7 @@
 		E1ADEDD40E76BD60004A1A5E /* DOMMessagePortInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMMessagePortInternal.h; sourceTree = "<group>"; };
 		E1ADEDD80E76BD93004A1A5E /* JSMessagePort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMessagePort.h; sourceTree = "<group>"; };
 		E1ADEDD90E76BD93004A1A5E /* JSMessagePort.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessagePort.cpp; sourceTree = "<group>"; };
+		E1B4CD2410B322E200BFFD7E /* CredentialStorageMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CredentialStorageMac.mm; sourceTree = "<group>"; };
 		E1BE512B0CF6C512002EA959 /* XSLTUnicodeSort.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLTUnicodeSort.cpp; sourceTree = "<group>"; };
 		E1BE512C0CF6C512002EA959 /* XSLTUnicodeSort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSLTUnicodeSort.h; sourceTree = "<group>"; };
 		E1C362ED0EAF2AA9007410BC /* JSWorkerLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWorkerLocation.h; sourceTree = "<group>"; };
@@ -9879,6 +9968,8 @@
 		ED501DC50B249F2900AE18D9 /* EditorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = EditorMac.mm; path = mac/EditorMac.mm; sourceTree = "<group>"; };
 		EDE3A4FF0C7A430600956A37 /* ColorMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorMac.h; sourceTree = "<group>"; };
 		EDEC98020AED7E170059137F /* WebCorePrefix.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebCorePrefix.h; sourceTree = "<group>"; tabWidth = 4; usesTabs = 0; };
+		F4EAF4AC10C742B1009100D3 /* OpenTypeSanitizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OpenTypeSanitizer.cpp; path = opentype/OpenTypeSanitizer.cpp; sourceTree = "<group>"; };
+		F4EAF4AD10C742B1009100D3 /* OpenTypeSanitizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OpenTypeSanitizer.h; path = opentype/OpenTypeSanitizer.h; sourceTree = "<group>"; };
 		F523D23B02DE4396018635CA /* HTMLDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDocument.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F523D23C02DE4396018635CA /* HTMLDocument.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDocument.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F523D23E02DE4396018635CA /* HTMLElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLElement.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -9916,6 +10007,8 @@
 		F5C2869302846DCD018635CA /* ApplicationServices.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = ApplicationServices.framework; path = /System/Library/Frameworks/ApplicationServices.framework; sourceTree = "<absolute>"; };
 		F5C2869402846DCD018635CA /* Carbon.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Carbon.framework; path = /System/Library/Frameworks/Carbon.framework; sourceTree = "<absolute>"; };
 		F5C2869502846DCD018635CA /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = /System/Library/Frameworks/Cocoa.framework; sourceTree = "<absolute>"; };
+		F5D3A57A106B83B300545297 /* ISODateTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ISODateTime.cpp; sourceTree = "<group>"; };
+		F5D3A57B106B83B300545297 /* ISODateTime.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ISODateTime.h; sourceTree = "<group>"; };
 		F8216299029F4FB501000131 /* JavaScriptCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = JavaScriptCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		F916C48B0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSXMLHttpRequestProgressEvent.cpp; sourceTree = "<group>"; };
 		F916C48C0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXMLHttpRequestProgressEvent.h; sourceTree = "<group>"; };
@@ -10187,6 +10280,7 @@
 		1A569CCE0D7E2B82007C3983 /* jni */ = {
 			isa = PBXGroup;
 			children = (
+				599D1E2F10C97D4C00E0EF12 /* jsc */,
 				1A569CCF0D7E2B82007C3983 /* jni_class.cpp */,
 				1A569CD00D7E2B82007C3983 /* jni_class.h */,
 				1A569CD10D7E2B82007C3983 /* jni_instance.cpp */,
@@ -10345,8 +10439,12 @@
 		1C5FAECA0DCFD8C900D58F78 /* Inspector */ = {
 			isa = PBXGroup;
 			children = (
+				7A0E76D810BF059800A0276E /* JSInjectedScriptHost.cpp */,
+				7A0E76D910BF059800A0276E /* JSInjectedScriptHost.h */,
 				41F060CB0F5EEB2B00A07EAC /* JSInspectorBackend.cpp */,
 				41F060CC0F5EEB2B00A07EAC /* JSInspectorBackend.h */,
+				7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */,
+				7A0E771D10C00DB100A0276E /* JSInspectorFrontendHost.h */,
 				1C5FAECF0DCFD90100D58F78 /* JSJavaScriptCallFrame.cpp */,
 				1C5FAED00DCFD90100D58F78 /* JSJavaScriptCallFrame.h */,
 			);
@@ -10359,6 +10457,9 @@
 				1C81B9590E97330800266E07 /* front-end */,
 				41F0618D0F5F069800A07EAC /* ConsoleMessage.cpp */,
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
+				7A0E76F610BF08ED00A0276E /* InjectedScriptHost.cpp */,
+				7A0E76F710BF08ED00A0276E /* InjectedScriptHost.h */,
+				7A0E76F810BF08ED00A0276E /* InjectedScriptHost.idl */,
 				7A74ECB8101839A500BF939E /* InspectorBackend.cpp */,
 				7A74ECB9101839A600BF939E /* InspectorBackend.h */,
 				7A74ECB61018399A00BF939E /* InspectorBackend.idl */,
@@ -10373,6 +10474,9 @@
 				41F061720F5F00AC00A07EAC /* InspectorDOMStorageResource.h */,
 				7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */,
 				7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */,
+				7A0E770B10C00A8800A0276E /* InspectorFrontendHost.cpp */,
+				7A0E770C10C00A8800A0276E /* InspectorFrontendHost.h */,
+				7A0E770D10C00A8800A0276E /* InspectorFrontendHost.idl */,
 				41F062000F5F0B6600A07EAC /* InspectorResource.cpp */,
 				41F061FF0F5F0B6600A07EAC /* InspectorResource.h */,
 				754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */,
@@ -10583,32 +10687,34 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
-				A7D20F6B107F438B00A80392 /* CanvasActiveInfo.h */,
-				A7D20F3B107F373800A80392 /* CanvasActiveInfo.idl */,
-				49EECDC710503C2300099FAB /* CanvasArray.cpp */,
-				49EECDC810503C2300099FAB /* CanvasArray.h */,
-				49EECDC910503C2300099FAB /* CanvasArray.idl */,
-				49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */,
-				49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */,
-				49EECDCC10503C2300099FAB /* CanvasArrayBuffer.idl */,
-				49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */,
-				49C7B9A91042D32E0009D447 /* CanvasBuffer.h */,
-				49C7B9AA1042D32E0009D447 /* CanvasBuffer.idl */,
-				49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */,
-				49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */,
-				49C7B9AD1042D32E0009D447 /* CanvasByteArray.idl */,
-				49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */,
-				49EECDCE10503C2300099FAB /* CanvasFloatArray.h */,
-				49EECDCF10503C2300099FAB /* CanvasFloatArray.idl */,
-				49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */,
-				49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */,
-				49C7B9B01042D32E0009D447 /* CanvasFramebuffer.idl */,
+				A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */,
+				A7D20F3B107F373800A80392 /* WebGLActiveInfo.idl */,
+				49EECDC710503C2300099FAB /* WebGLArray.cpp */,
+				49EECDC810503C2300099FAB /* WebGLArray.h */,
+				49EECDC910503C2300099FAB /* WebGLArray.idl */,
+				49EECDCA10503C2300099FAB /* WebGLArrayBuffer.cpp */,
+				49EECDCB10503C2300099FAB /* WebGLArrayBuffer.h */,
+				49EECDCC10503C2300099FAB /* WebGLArrayBuffer.idl */,
+				49C7B9A81042D32E0009D447 /* WebGLBuffer.cpp */,
+				49C7B9A91042D32E0009D447 /* WebGLBuffer.h */,
+				49C7B9AA1042D32E0009D447 /* WebGLBuffer.idl */,
+				49C7B9AB1042D32E0009D447 /* WebGLByteArray.cpp */,
+				49C7B9AC1042D32E0009D447 /* WebGLByteArray.h */,
+				49C7B9AD1042D32E0009D447 /* WebGLByteArray.idl */,
+				49EECDCD10503C2300099FAB /* WebGLFloatArray.cpp */,
+				49EECDCE10503C2300099FAB /* WebGLFloatArray.h */,
+				49EECDCF10503C2300099FAB /* WebGLFloatArray.idl */,
+				49C7B9AE1042D32E0009D447 /* WebGLFramebuffer.cpp */,
+				49C7B9AF1042D32E0009D447 /* WebGLFramebuffer.h */,
+				49C7B9B01042D32E0009D447 /* WebGLFramebuffer.idl */,
+				6E47E65E10B7944B00B186C8 /* WebGLGetInfo.cpp */,
+				6E47E65F10B7944B00B186C8 /* WebGLGetInfo.h */,
 				49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */,
 				49484FB4102CF23C00187DD3 /* CanvasGradient.h */,
 				49484FB5102CF23C00187DD3 /* CanvasGradient.idl */,
-				49EECDD010503C2300099FAB /* CanvasIntArray.cpp */,
-				49EECDD110503C2300099FAB /* CanvasIntArray.h */,
-				49EECDD210503C2300099FAB /* CanvasIntArray.idl */,
+				49EECDD010503C2300099FAB /* WebGLIntArray.cpp */,
+				49EECDD110503C2300099FAB /* WebGLIntArray.h */,
+				49EECDD210503C2300099FAB /* WebGLIntArray.idl */,
 				49C7B9B41042D32F0009D447 /* CanvasObject.cpp */,
 				49C7B9B51042D32F0009D447 /* CanvasObject.h */,
 				49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */,
@@ -10617,41 +10723,44 @@
 				49484FB9102CF23C00187DD3 /* CanvasPixelArray.cpp */,
 				49484FBA102CF23C00187DD3 /* CanvasPixelArray.h */,
 				49484FBB102CF23C00187DD3 /* CanvasPixelArray.idl */,
-				49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */,
-				49C7B9B71042D32F0009D447 /* CanvasProgram.h */,
-				49C7B9B81042D32F0009D447 /* CanvasProgram.idl */,
-				49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */,
-				49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */,
-				49C7B9BB1042D32F0009D447 /* CanvasRenderbuffer.idl */,
+				49C7B9B61042D32F0009D447 /* WebGLProgram.cpp */,
+				49C7B9B71042D32F0009D447 /* WebGLProgram.h */,
+				49C7B9B81042D32F0009D447 /* WebGLProgram.idl */,
+				49C7B9B91042D32F0009D447 /* WebGLRenderbuffer.cpp */,
+				49C7B9BA1042D32F0009D447 /* WebGLRenderbuffer.h */,
+				49C7B9BB1042D32F0009D447 /* WebGLRenderbuffer.idl */,
 				49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */,
 				49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */,
 				49C7B9BE1042D32F0009D447 /* CanvasRenderingContext.idl */,
 				49484FBC102CF23C00187DD3 /* CanvasRenderingContext2D.cpp */,
 				49484FBD102CF23C00187DD3 /* CanvasRenderingContext2D.h */,
 				49484FBE102CF23C00187DD3 /* CanvasRenderingContext2D.idl */,
-				49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */,
-				49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */,
-				49C7B9C11042D32F0009D447 /* CanvasRenderingContext3D.idl */,
-				49C7B9C21042D32F0009D447 /* CanvasShader.cpp */,
-				49C7B9C31042D32F0009D447 /* CanvasShader.h */,
-				49C7B9C41042D32F0009D447 /* CanvasShader.idl */,
-				49EECDD310503C2300099FAB /* CanvasShortArray.cpp */,
-				49EECDD410503C2300099FAB /* CanvasShortArray.h */,
-				49EECDD510503C2300099FAB /* CanvasShortArray.idl */,
+				49C7B9BF1042D32F0009D447 /* WebGLRenderingContext.cpp */,
+				49C7B9C01042D32F0009D447 /* WebGLRenderingContext.h */,
+				49C7B9C11042D32F0009D447 /* WebGLRenderingContext.idl */,
+				49C7B9C21042D32F0009D447 /* WebGLShader.cpp */,
+				49C7B9C31042D32F0009D447 /* WebGLShader.h */,
+				49C7B9C41042D32F0009D447 /* WebGLShader.idl */,
+				49EECDD310503C2300099FAB /* WebGLShortArray.cpp */,
+				49EECDD410503C2300099FAB /* WebGLShortArray.h */,
+				49EECDD510503C2300099FAB /* WebGLShortArray.idl */,
 				49484FBF102CF23C00187DD3 /* CanvasStyle.cpp */,
 				49484FC0102CF23C00187DD3 /* CanvasStyle.h */,
-				49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */,
-				49C7B9C61042D32F0009D447 /* CanvasTexture.h */,
-				49C7B9C71042D32F0009D447 /* CanvasTexture.idl */,
-				49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */,
-				49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */,
-				49EECDD810503C2300099FAB /* CanvasUnsignedByteArray.idl */,
-				49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */,
-				49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */,
-				49EECDDB10503C2300099FAB /* CanvasUnsignedIntArray.idl */,
-				49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */,
-				49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */,
-				49EECDDE10503C2400099FAB /* CanvasUnsignedShortArray.idl */,
+				49C7B9C51042D32F0009D447 /* WebGLTexture.cpp */,
+				49C7B9C61042D32F0009D447 /* WebGLTexture.h */,
+				49C7B9C71042D32F0009D447 /* WebGLTexture.idl */,
+				0C3F1F5710C8871200D72CE1 /* WebGLUniformLocation.cpp */,
+				0C3F1F5810C8871200D72CE1 /* WebGLUniformLocation.h */,
+				0C3F1F5910C8871200D72CE1 /* WebGLUniformLocation.idl */,
+				49EECDD610503C2300099FAB /* WebGLUnsignedByteArray.cpp */,
+				49EECDD710503C2300099FAB /* WebGLUnsignedByteArray.h */,
+				49EECDD810503C2300099FAB /* WebGLUnsignedByteArray.idl */,
+				49EECDD910503C2300099FAB /* WebGLUnsignedIntArray.cpp */,
+				49EECDDA10503C2300099FAB /* WebGLUnsignedIntArray.h */,
+				49EECDDB10503C2300099FAB /* WebGLUnsignedIntArray.idl */,
+				49EECDDC10503C2300099FAB /* WebGLUnsignedShortArray.cpp */,
+				49EECDDD10503C2400099FAB /* WebGLUnsignedShortArray.h */,
+				49EECDDE10503C2400099FAB /* WebGLUnsignedShortArray.idl */,
 			);
 			name = canvas;
 			sourceTree = "<group>";
@@ -10874,6 +10983,15 @@
 			path = websockets;
 			sourceTree = "<group>";
 		};
+		599D1E2F10C97D4C00E0EF12 /* jsc */ = {
+			isa = PBXGroup;
+			children = (
+				599D1E3010C97D6E00E0EF12 /* jni_utility_private.cpp */,
+				599D1E3110C97D6E00E0EF12 /* jni_utility_private.h */,
+			);
+			name = jsc;
+			sourceTree = "<group>";
+		};
 		59C77F101054591C00506104 /* mock */ = {
 			isa = PBXGroup;
 			children = (
@@ -10974,6 +11092,7 @@
 				656B84E70AEA1DAE00A095B4 /* mac */,
 				934F71370D5A6EFF00018D69 /* AuthenticationChallengeBase.cpp */,
 				934F71390D5A6F1000018D69 /* AuthenticationChallengeBase.h */,
+				E124748310AA161D00B79493 /* AuthenticationClient.h */,
 				514C76580CE923A1007EF3CD /* Credential.cpp */,
 				514C76590CE923A1007EF3CD /* Credential.h */,
 				51A052321058774F00CC9E95 /* CredentialStorage.cpp */,
@@ -11017,6 +11136,7 @@
 				934F71430D5A6F5300018D69 /* AuthenticationChallenge.h */,
 				514C76420CE9234E007EF3CD /* AuthenticationMac.h */,
 				514C76430CE9234E007EF3CD /* AuthenticationMac.mm */,
+				E1B4CD2410B322E200BFFD7E /* CredentialStorageMac.mm */,
 				514C76440CE9234E007EF3CD /* FormDataStreamMac.h */,
 				514C76450CE9234E007EF3CD /* FormDataStreamMac.mm */,
 				1A7FA6470DDA3CBA0028F8A5 /* NetworkStateNotifierMac.cpp */,
@@ -11121,6 +11241,7 @@
 				065AD4F20B0C2EDA005A2B1D /* ContextMenuClient.h */,
 				065AD4F30B0C2EDA005A2B1D /* ContextMenuController.cpp */,
 				065AD4F40B0C2EDA005A2B1D /* ContextMenuController.h */,
+				7ADE722510CBBB9B006B3B3A /* ContextMenuSelectionHandler.h */,
 				FE6FD4850F676E5700092873 /* Coordinates.h */,
 				FE6FD4860F676E5700092873 /* Coordinates.idl */,
 				BC5A86810C33676000EEA649 /* DOMSelection.cpp */,
@@ -11964,6 +12085,7 @@
 				85DF81230AA7787200486AD7 /* DOMHTMLImageElement.h */,
 				85DF81240AA7787200486AD7 /* DOMHTMLImageElement.mm */,
 				85F32AE40AA63B8700FF3184 /* DOMHTMLInputElement.h */,
+				1CCA732110ADD43E00FD440D /* DOMHTMLInputElementPrivate.h */,
 				85F32AE50AA63B8700FF3184 /* DOMHTMLInputElement.mm */,
 				859A9C410AA5E3BD00B694B2 /* DOMHTMLIsIndexElement.h */,
 				859A9C420AA5E3BD00B694B2 /* DOMHTMLIsIndexElement.mm */,
@@ -12702,6 +12824,8 @@
 				E446139A0CD6331000FADA75 /* HTMLVideoElement.idl */,
 				BCCD74E40A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp */,
 				BCCD74DB0A4C8D35005FDA6D /* HTMLViewSourceDocument.h */,
+				F5D3A57A106B83B300545297 /* ISODateTime.cpp */,
+				F5D3A57B106B83B300545297 /* ISODateTime.h */,
 				A77979130D6B9D0C003851B9 /* ImageData.cpp */,
 				A77979140D6B9D0C003851B9 /* ImageData.h */,
 				A77979150D6B9D0C003851B9 /* ImageData.idl */,
@@ -12752,48 +12876,50 @@
 		A83B79080CCAFF2B000B0825 /* HTML */ = {
 			isa = PBXGroup;
 			children = (
-				A7D20F60107F406900A80392 /* JSCanvasActiveInfo.cpp */,
-				A7D20F61107F406900A80392 /* JSCanvasActiveInfo.h */,
-				49EECF19105072F300099FAB /* JSCanvasArray.cpp */,
-				49EECF1A105072F300099FAB /* JSCanvasArray.h */,
-				49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */,
-				49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */,
-				49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */,
-				49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */,
-				49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */,
-				49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */,
-				49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */,
-				49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */,
-				49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */,
-				49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */,
+				A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */,
+				A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */,
+				49EECF19105072F300099FAB /* JSWebGLArray.cpp */,
+				49EECF1A105072F300099FAB /* JSWebGLArray.h */,
+				49EECEF2105070C400099FAB /* JSWebGLArrayBuffer.cpp */,
+				49EECEF3105070C400099FAB /* JSWebGLArrayBuffer.h */,
+				49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */,
+				49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */,
+				49C7B9821042D2D30009D447 /* JSWebGLByteArray.cpp */,
+				49C7B9831042D2D30009D447 /* JSWebGLByteArray.h */,
+				49EECEF4105070C400099FAB /* JSWebGLFloatArray.cpp */,
+				49EECEF5105070C400099FAB /* JSWebGLFloatArray.h */,
+				49C7B9841042D2D30009D447 /* JSWebGLFramebuffer.cpp */,
+				49C7B9851042D2D30009D447 /* JSWebGLFramebuffer.h */,
 				65DF323309D1DE65000BE325 /* JSCanvasGradient.cpp */,
 				65DF323409D1DE65000BE325 /* JSCanvasGradient.h */,
-				49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */,
-				49EECEF7105070C400099FAB /* JSCanvasIntArray.h */,
+				49EECEF6105070C400099FAB /* JSWebGLIntArray.cpp */,
+				49EECEF7105070C400099FAB /* JSWebGLIntArray.h */,
 				65DF323509D1DE65000BE325 /* JSCanvasPattern.cpp */,
 				65DF323609D1DE65000BE325 /* JSCanvasPattern.h */,
-				49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */,
-				49C7B9891042D2D30009D447 /* JSCanvasProgram.h */,
-				49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */,
-				49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */,
+				49C7B9881042D2D30009D447 /* JSWebGLProgram.cpp */,
+				49C7B9891042D2D30009D447 /* JSWebGLProgram.h */,
+				49C7B98A1042D2D30009D447 /* JSWebGLRenderbuffer.cpp */,
+				49C7B98B1042D2D30009D447 /* JSWebGLRenderbuffer.h */,
 				49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */,
 				49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */,
 				49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */,
 				49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */,
-				49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */,
-				49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */,
-				49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */,
-				49C7B9901042D2D30009D447 /* JSCanvasShader.h */,
-				49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */,
-				49EECEF9105070C400099FAB /* JSCanvasShortArray.h */,
-				49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */,
-				49C7B9921042D2D30009D447 /* JSCanvasTexture.h */,
-				49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */,
-				49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */,
-				49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */,
-				49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */,
-				49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */,
-				49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */,
+				49EED1401051969400099FAB /* JSWebGLRenderingContext.cpp */,
+				49EED1411051969400099FAB /* JSWebGLRenderingContext.h */,
+				49C7B98F1042D2D30009D447 /* JSWebGLShader.cpp */,
+				49C7B9901042D2D30009D447 /* JSWebGLShader.h */,
+				49EECEF8105070C400099FAB /* JSWebGLShortArray.cpp */,
+				49EECEF9105070C400099FAB /* JSWebGLShortArray.h */,
+				49C7B9911042D2D30009D447 /* JSWebGLTexture.cpp */,
+				49C7B9921042D2D30009D447 /* JSWebGLTexture.h */,
+				0C45342510CDBBFA00869157 /* JSWebGLUniformLocation.cpp */,
+				0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */,
+				49EECEFA105070C400099FAB /* JSWebGLUnsignedByteArray.cpp */,
+				49EECEFB105070C400099FAB /* JSWebGLUnsignedByteArray.h */,
+				49EECEFC105070C400099FAB /* JSWebGLUnsignedIntArray.cpp */,
+				49EECEFD105070C400099FAB /* JSWebGLUnsignedIntArray.h */,
+				49EECEFE105070C400099FAB /* JSWebGLUnsignedShortArray.cpp */,
+				49EECEFF105070C400099FAB /* JSWebGLUnsignedShortArray.h */,
 				BC77D1650FF19F550070887B /* JSDataGridColumn.cpp */,
 				BC77D1660FF19F550070887B /* JSDataGridColumn.h */,
 				BC77D1670FF19F550070887B /* JSDataGridColumnList.cpp */,
@@ -13367,6 +13493,8 @@
 			children = (
 				BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */,
 				BC946347107A936600857193 /* JSBeforeLoadEvent.h */,
+				79AC9216109945C80021266E /* JSCompositionEvent.cpp */,
+				79AC9217109945C80021266E /* JSCompositionEvent.h */,
 				2ECF7ADA10162B3800427DE7 /* JSErrorEvent.cpp */,
 				2ECF7ADB10162B3800427DE7 /* JSErrorEvent.h */,
 				14E8378309F85D1C00B85AE4 /* JSEvent.cpp */,
@@ -13389,6 +13517,8 @@
 				1A0D573F0A5C7867007EDD4C /* JSOverflowEvent.h */,
 				E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */,
 				E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */,
+				5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */,
+				5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */,
 				933A14B60B7D1D5200A53FFD /* JSTextEvent.cpp */,
 				933A14B70B7D1D5200A53FFD /* JSTextEvent.h */,
 				A86629CA09DA2B47009633A5 /* JSUIEvent.cpp */,
@@ -14002,17 +14132,18 @@
 				49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */,
 				EDE3A4FF0C7A430600956A37 /* ColorMac.h */,
 				B275354A0B053814002CE64F /* ColorMac.mm */,
-				3724CA550E68A7E400DB4384 /* CoreTextController.cpp */,
-				3724CA540E68A7E400DB4384 /* CoreTextController.h */,
+				37C2360E1097EE7700EF9F72 /* ComplexTextController.cpp */,
+				37C2360F1097EE7700EF9F72 /* ComplexTextController.h */,
+				37C2381F1098C84200EF9F72 /* ComplexTextControllerATSUI.cpp */,
+				37C238201098C84200EF9F72 /* ComplexTextControllerCoreText.cpp */,
 				B275354B0B053814002CE64F /* FloatPointMac.mm */,
 				B275354C0B053814002CE64F /* FloatRectMac.mm */,
 				B275354D0B053814002CE64F /* FloatSizeMac.mm */,
 				B2AFFC740D00A5C10030074D /* FontCacheMac.mm */,
+				37C2360A1097EDED00EF9F72 /* FontComplexTextMac.cpp */,
 				B2AFFC750D00A5C10030074D /* FontCustomPlatformData.cpp */,
 				B2AFFC760D00A5C10030074D /* FontCustomPlatformData.h */,
 				B2AFFC780D00A5C10030074D /* FontMac.mm */,
-				3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */,
-				3724CA7D0E68B20500DB4384 /* FontMacCoreText.cpp */,
 				B2AFFC790D00A5C10030074D /* FontPlatformData.h */,
 				B2AFFC7A0D00A5C10030074D /* FontPlatformDataMac.mm */,
 				B2AFFC7B0D00A5C10030074D /* GlyphPageTreeNodeMac.cpp */,
@@ -14040,6 +14171,7 @@
 		B2A015910AF6CD53006BCE0E /* graphics */ = {
 			isa = PBXGroup;
 			children = (
+				F4EAF4AB10C74268009100D3 /* opentype */,
 				B27535290B053814002CE64F /* cg */,
 				A75E8B7F0E1DE2B0007F2481 /* filters */,
 				B27535490B053814002CE64F /* mac */,
@@ -14048,6 +14180,7 @@
 				A89943260B42338700D7C802 /* BitmapImage.h */,
 				B27535380B053814002CE64F /* Color.cpp */,
 				B27535390B053814002CE64F /* Color.h */,
+				9382DF5710A8D5C900925652 /* ColorSpace.h */,
 				A8CB41020E85B8A50032C4F0 /* DashArray.h */,
 				B275353A0B053814002CE64F /* FloatPoint.cpp */,
 				B275353B0B053814002CE64F /* FloatPoint.h */,
@@ -14304,8 +14437,6 @@
 				934CC1160EDCAC7300A658F2 /* ScriptInstance.h */,
 				41F066E30F64BCF600A07EAC /* ScriptObject.cpp */,
 				41F066E20F64BCF600A07EAC /* ScriptObject.h */,
-				412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */,
-				419536500F68222400D0C679 /* ScriptObjectQuarantine.h */,
 				934CC1090EDB223900A658F2 /* ScriptSourceCode.h */,
 				CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */,
 				4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */,
@@ -14373,17 +14504,17 @@
 			children = (
 				415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */,
 				BC2ED6BB0C6BD2F000920BFF /* JSAttrCustom.cpp */,
-				492273A21083B3B100EE5C84 /* JSCanvasArrayCustom.cpp */,
-				49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */,
-				49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */,
-				49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */,
+				492273A21083B3B100EE5C84 /* JSWebGLArrayCustom.cpp */,
+				49EECF7110508D9C00099FAB /* JSWebGLByteArrayCustom.cpp */,
+				49EECF7210508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp */,
+				49EECF7310508D9C00099FAB /* JSWebGLIntArrayCustom.cpp */,
 				49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */,
-				49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */,
+				49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */,
 				49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */,
-				49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */,
-				49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */,
-				49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */,
-				49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */,
+				49EECF7410508D9C00099FAB /* JSWebGLShortArrayCustom.cpp */,
+				49EECF7510508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp */,
+				49EECF7610508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp */,
+				49EECF7710508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp */,
 				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
 				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
 				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
@@ -14445,7 +14576,8 @@
 				BC17F9650B64EBB8004A65CB /* JSHTMLSelectElementCustom.cpp */,
 				AB4CB4EA0B8BDA3D009F40B0 /* JSHTMLSelectElementCustom.h */,
 				A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */,
-				7A74ECBC101839DA00BF939E /* JSInspectorBackendCustom.cpp */,
+				7A0E76D410BF050700A0276E /* JSInjectedScriptHostCustom.cpp */,
+				7A74ECBC101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp */,
 				1C5FAEE60DCFDA6800D58F78 /* JSJavaScriptCallFrameCustom.cpp */,
 				BCE1C43F0D9830F4003B02F2 /* JSLocationCustom.cpp */,
 				E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */,
@@ -14461,6 +14593,7 @@
 				BCD9C2610C17AA67005C90A2 /* JSNodeListCustom.cpp */,
 				A9C6E64A0D7465E7006442E9 /* JSPluginArrayCustom.cpp */,
 				A9C6E64B0D7465E7006442E9 /* JSPluginCustom.cpp */,
+				5189F01710B3781300F3C739 /* JSPopStateEventCustom.cpp */,
 				51DCE8010CAC9F1C00488358 /* JSSQLResultSetRowListCustom.cpp */,
 				1AD2316D0CD269E700C1F194 /* JSSQLTransactionCustom.cpp */,
 				51D0C5150DAA90B7003B3831 /* JSStorageCustom.cpp */,
@@ -14506,6 +14639,7 @@
 				BC5EB69D0E81DAEB00B25965 /* FillLayer.h */,
 				BC5EBA0E0E823E4700B25965 /* KeyframeList.cpp */,
 				BC5EBA0F0E823E4700B25965 /* KeyframeList.h */,
+				AB31C91D10AE1B8E000C7B92 /* LineClampValue.h */,
 				BCEF43DF0E674110001C1287 /* NinePieceImage.cpp */,
 				BCEF43DC0E674012001C1287 /* NinePieceImage.h */,
 				BC5EB5DC0E81B8DD00B25965 /* OutlineValue.h */,
@@ -14745,22 +14879,22 @@
 			children = (
 				E4EEFFC60D34550C00469A58 /* JSAudioConstructor.cpp */,
 				E4EEFFC70D34550C00469A58 /* JSAudioConstructor.h */,
-				49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */,
-				49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */,
-				49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */,
-				49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */,
-				49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */,
-				49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */,
-				49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */,
-				49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */,
-				49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */,
-				49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */,
-				49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */,
-				49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */,
-				49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */,
-				49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */,
-				49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */,
-				49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */,
+				49EECF991050938200099FAB /* JSWebGLArrayBufferConstructor.cpp */,
+				49EECF9A1050938200099FAB /* JSWebGLArrayBufferConstructor.h */,
+				49EECF9B1050938200099FAB /* JSWebGLByteArrayConstructor.cpp */,
+				49EECF9C1050938200099FAB /* JSWebGLByteArrayConstructor.h */,
+				49EECF9D1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp */,
+				49EECF9E1050938200099FAB /* JSWebGLFloatArrayConstructor.h */,
+				49EECF9F1050938200099FAB /* JSWebGLIntArrayConstructor.cpp */,
+				49EECFA01050938200099FAB /* JSWebGLIntArrayConstructor.h */,
+				49EECFA31050938200099FAB /* JSWebGLShortArrayConstructor.cpp */,
+				49EECFA41050938200099FAB /* JSWebGLShortArrayConstructor.h */,
+				49EECFA51050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp */,
+				49EECFA61050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h */,
+				49EECFA71050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp */,
+				49EECFA81050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h */,
+				49EECFA91050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp */,
+				49EECFAA1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h */,
 				E0FEF371B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp */,
 				E0FEF371B67C53EAC1C1FBEE /* JSEventSourceConstructor.h */,
 				BC6C49F10D7DBA0500FFA558 /* JSImageConstructor.cpp */,
@@ -15021,6 +15155,15 @@
 			name = mac;
 			sourceTree = "<group>";
 		};
+		F4EAF4AB10C74268009100D3 /* opentype */ = {
+			isa = PBXGroup;
+			children = (
+				F4EAF4AC10C742B1009100D3 /* OpenTypeSanitizer.cpp */,
+				F4EAF4AD10C742B1009100D3 /* OpenTypeSanitizer.h */,
+			);
+			name = opentype;
+			sourceTree = "<group>";
+		};
 		F523D18402DE42E8018635CA /* css */ = {
 			isa = PBXGroup;
 			children = (
@@ -15312,6 +15455,14 @@
 				A871DFDF0A15376B00B12A68 /* RenderReplaced.h */,
 				BCA846D40DC67A350026C309 /* RenderReplica.cpp */,
 				BCA846D50DC67A350026C309 /* RenderReplica.h */,
+				1479FAE5109AE37500DED655 /* RenderRuby.cpp */,
+				1479FAE6109AE37500DED655 /* RenderRuby.h */,
+				1479FAE7109AE37500DED655 /* RenderRubyBase.cpp */,
+				1479FAE8109AE37500DED655 /* RenderRubyBase.h */,
+				1479FAE9109AE37500DED655 /* RenderRubyRun.cpp */,
+				1479FAEA109AE37500DED655 /* RenderRubyRun.h */,
+				1479FAEB109AE37500DED655 /* RenderRubyText.cpp */,
+				1479FAEC109AE37500DED655 /* RenderRubyText.h */,
 				BC3BE9900E9C1C7C00835588 /* RenderScrollbar.cpp */,
 				BC3BE9910E9C1C7C00835588 /* RenderScrollbar.h */,
 				BC3BE9AA0E9C242000835588 /* RenderScrollbarPart.cpp */,
@@ -15436,8 +15587,6 @@
 				93F925410F7EF5B8007E37C9 /* CheckedRadioButtons.h */,
 				A818721A0977D3C0005826D9 /* ChildNodeList.cpp */,
 				A81872150977D3C0005826D9 /* ChildNodeList.h */,
-				BC4BF9E20D11E133007D247F /* ClassNames.cpp */,
-				BC4BF9E30D11E133007D247F /* ClassNames.h */,
 				BC904B720D10998F00680D32 /* ClassNodeList.cpp */,
 				BC904B730D10998F00680D32 /* ClassNodeList.h */,
 				BCC065770F3CE1B700CD2D87 /* ClientRect.cpp */,
@@ -15455,6 +15604,9 @@
 				6550B697099DF0270090D781 /* Comment.cpp */,
 				6550B698099DF0270090D781 /* Comment.h */,
 				85089CC70A98C22600A275AA /* Comment.idl */,
+				79F2F59E1091939A000D87CB /* CompositionEvent.cpp */,
+				79F2F59F1091939A000D87CB /* CompositionEvent.h */,
+				79F2F5A01091939A000D87CB /* CompositionEvent.idl */,
 				A81872140977D3C0005826D9 /* ContainerNode.cpp */,
 				A81872110977D3C0005826D9 /* ContainerNode.h */,
 				A8C4A7F809D563270003AC8D /* CSSMappedAttributeDeclaration.cpp */,
@@ -15573,6 +15725,9 @@
 				E1284AD910447AEB00EAEB52 /* PageTransitionEvent.idl */,
 				41BF700D0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp */,
 				41BF700E0FE86F61005E8DEC /* PlatformMessagePortChannel.h */,
+				5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */,
+				5174E20810A1F44F00F95E6F /* PopStateEvent.h */,
+				5174E20B10A1F49A00F95E6F /* PopStateEvent.idl */,
 				BE91FC8C06133666005E3790 /* Position.cpp */,
 				BE91FC8B06133666005E3790 /* Position.h */,
 				37919C210B7D188600A56998 /* PositionIterator.cpp */,
@@ -15601,6 +15756,8 @@
 				084AEBE30FB505FA0038483E /* SelectElement.h */,
 				BC7FA6800D1F167900DB22A9 /* SelectorNodeList.cpp */,
 				BC7FA67F0D1F167900DB22A9 /* SelectorNodeList.h */,
+				D01A27AB10C9BFD800026A42 /* SpaceSplitString.cpp */,
+				D01A27AC10C9BFD800026A42 /* SpaceSplitString.h */,
 				BC7FA62C0D1F0EFF00DB22A9 /* StaticNodeList.cpp */,
 				BC7FA62B0D1F0EFF00DB22A9 /* StaticNodeList.h */,
 				A8C4A7EC09D563270003AC8D /* StyledElement.cpp */,
@@ -15752,30 +15909,30 @@
 				BCB16C280979C3BD00467741 /* CachedXSLStyleSheet.h in Headers */,
 				93F1995008245E59001E9ABC /* CachePolicy.h in Headers */,
 				49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */,
-				A7D20F6D107F438B00A80392 /* CanvasActiveInfo.h in Headers */,
-				49EECDE010503C2400099FAB /* CanvasArray.h in Headers */,
-				49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */,
-				49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */,
-				49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */,
-				49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */,
-				49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */,
+				A7D20F6D107F438B00A80392 /* WebGLActiveInfo.h in Headers */,
+				49EECDE010503C2400099FAB /* WebGLArray.h in Headers */,
+				49EECDE310503C2400099FAB /* WebGLArrayBuffer.h in Headers */,
+				49C7B9C91042D32F0009D447 /* WebGLBuffer.h in Headers */,
+				49C7B9CC1042D32F0009D447 /* WebGLByteArray.h in Headers */,
+				49EECDE610503C2400099FAB /* WebGLFloatArray.h in Headers */,
+				49C7B9CF1042D32F0009D447 /* WebGLFramebuffer.h in Headers */,
 				49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */,
-				49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */,
+				49EECDE910503C2400099FAB /* WebGLIntArray.h in Headers */,
 				49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */,
 				49484FC5102CF23C00187DD3 /* CanvasPattern.h in Headers */,
 				49484FC8102CF23C00187DD3 /* CanvasPixelArray.h in Headers */,
-				49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */,
-				49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */,
+				49C7B9D71042D32F0009D447 /* WebGLProgram.h in Headers */,
+				49C7B9DA1042D32F0009D447 /* WebGLRenderbuffer.h in Headers */,
 				49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */,
 				49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */,
-				49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */,
-				49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */,
-				49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */,
+				49C7B9E01042D32F0009D447 /* WebGLRenderingContext.h in Headers */,
+				49C7B9E31042D32F0009D447 /* WebGLShader.h in Headers */,
+				49EECDEC10503C2400099FAB /* WebGLShortArray.h in Headers */,
 				49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */,
-				49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */,
-				49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */,
-				49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */,
-				49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */,
+				49C7B9E61042D32F0009D447 /* WebGLTexture.h in Headers */,
+				49EECDEF10503C2400099FAB /* WebGLUnsignedByteArray.h in Headers */,
+				49EECDF210503C2400099FAB /* WebGLUnsignedIntArray.h in Headers */,
+				49EECDF510503C2400099FAB /* WebGLUnsignedShortArray.h in Headers */,
 				6550B69E099DF0270090D781 /* CDATASection.h in Headers */,
 				514185EE0CD65F0400763C99 /* ChangeVersionWrapper.h in Headers */,
 				6550B6A0099DF0270090D781 /* CharacterData.h in Headers */,
@@ -15785,7 +15942,6 @@
 				A81872200977D3C0005826D9 /* ChildNodeList.h in Headers */,
 				14D823520AF92A790004F057 /* Chrome.h in Headers */,
 				14D824080AF93AEB0004F057 /* ChromeClient.h in Headers */,
-				BC4BF9E50D11E133007D247F /* ClassNames.h in Headers */,
 				BC904B770D10998F00680D32 /* ClassNodeList.h in Headers */,
 				BCC0657E0F3CE1B700CD2D87 /* ClientRect.h in Headers */,
 				BCC065810F3CE1B700CD2D87 /* ClientRectList.h in Headers */,
@@ -15802,6 +15958,7 @@
 				6550B6A2099DF0270090D781 /* Comment.h in Headers */,
 				316FE1160E6E1DA700BF6088 /* CompositeAnimation.h in Headers */,
 				93309DDD099E64920056E581 /* CompositeEditCommand.h in Headers */,
+				79F2F5A21091939A000D87CB /* CompositionEvent.h in Headers */,
 				65C97AF308EA908800ACD273 /* config.h in Headers */,
 				BC0B36A50CD3C67C00AC7EB5 /* Console.h in Headers */,
 				41F0618E0F5F069800A07EAC /* ConsoleMessage.h in Headers */,
@@ -15815,7 +15972,6 @@
 				D8B6152F1032495100C8554A /* Cookie.h in Headers */,
 				9352088209BD45E900F2038D /* CookieJar.h in Headers */,
 				FE6FD4880F676E5700092873 /* Coordinates.h in Headers */,
-				3724CA570E68A7E400DB4384 /* CoreTextController.h in Headers */,
 				A80E6D040A1989CA007FB8C5 /* Counter.h in Headers */,
 				BC5EB9790E82069200B25965 /* CounterContent.h in Headers */,
 				BC5EB9510E82056B00B25965 /* CounterDirectives.h in Headers */,
@@ -16850,6 +17006,7 @@
 				BCCD74DC0A4C8D35005FDA6D /* HTMLViewSourceDocument.h in Headers */,
 				514C76710CE923A1007EF3CD /* HTTPHeaderMap.h in Headers */,
 				514C76730CE923A1007EF3CD /* HTTPParsers.h in Headers */,
+				F5D3A57D106B83B300545297 /* ISODateTime.h in Headers */,
 				B275356E0B053814002CE64F /* Icon.h in Headers */,
 				5126E6BC0A2E3B12005C29FA /* IconDatabase.h in Headers */,
 				51E1ECBE0C91C90400DC255B /* IconDatabaseClient.h in Headers */,
@@ -16909,35 +17066,35 @@
 				BC124F000C26447A009E2349 /* JSBarInfo.h in Headers */,
 				BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */,
 				1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */,
-				A7D20F63107F406900A80392 /* JSCanvasActiveInfo.h in Headers */,
-				49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */,
-				49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */,
-				49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */,
-				49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */,
-				49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */,
-				49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */,
-				49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */,
-				49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */,
-				49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */,
+				A7D20F63107F406900A80392 /* JSWebGLActiveInfo.h in Headers */,
+				49EECF1C105072F300099FAB /* JSWebGLArray.h in Headers */,
+				49EECF01105070C400099FAB /* JSWebGLArrayBuffer.h in Headers */,
+				49EECFAC1050938200099FAB /* JSWebGLArrayBufferConstructor.h in Headers */,
+				49C7B9941042D2D30009D447 /* JSWebGLBuffer.h in Headers */,
+				49C7B9961042D2D30009D447 /* JSWebGLByteArray.h in Headers */,
+				49EECFAE1050938200099FAB /* JSWebGLByteArrayConstructor.h in Headers */,
+				49EECF03105070C400099FAB /* JSWebGLFloatArray.h in Headers */,
+				49EECFB01050938200099FAB /* JSWebGLFloatArrayConstructor.h in Headers */,
+				49C7B9981042D2D30009D447 /* JSWebGLFramebuffer.h in Headers */,
 				65DF323A09D1DE65000BE325 /* JSCanvasGradient.h in Headers */,
-				49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */,
-				49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */,
+				49EECF05105070C400099FAB /* JSWebGLIntArray.h in Headers */,
+				49EECFB21050938200099FAB /* JSWebGLIntArrayConstructor.h in Headers */,
 				65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */,
-				49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */,
-				49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */,
+				49C7B99C1042D2D30009D447 /* JSWebGLProgram.h in Headers */,
+				49C7B99E1042D2D30009D447 /* JSWebGLRenderbuffer.h in Headers */,
 				49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */,
 				49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */,
-				49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */,
-				49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */,
-				49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */,
-				49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */,
-				49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */,
-				49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */,
-				49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */,
-				49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */,
-				49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */,
-				49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */,
-				49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */,
+				49EED1471051969400099FAB /* JSWebGLRenderingContext.h in Headers */,
+				49C7B9A31042D2D30009D447 /* JSWebGLShader.h in Headers */,
+				49EECF07105070C400099FAB /* JSWebGLShortArray.h in Headers */,
+				49EECFB61050938200099FAB /* JSWebGLShortArrayConstructor.h in Headers */,
+				49C7B9A51042D2D30009D447 /* JSWebGLTexture.h in Headers */,
+				49EECF09105070C400099FAB /* JSWebGLUnsignedByteArray.h in Headers */,
+				49EECFB81050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h in Headers */,
+				49EECF0B105070C400099FAB /* JSWebGLUnsignedIntArray.h in Headers */,
+				49EECFBA1050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h in Headers */,
+				49EECF0D105070C400099FAB /* JSWebGLUnsignedShortArray.h in Headers */,
+				49EECFBC1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h in Headers */,
 				93F9B7A10BA6032600854064 /* JSCDATASection.h in Headers */,
 				65DF31F409D1CC60000BE325 /* JSCharacterData.h in Headers */,
 				BCC065880F3CE2A700CD2D87 /* JSClientRect.h in Headers */,
@@ -16970,6 +17127,7 @@
 				51EC926A0CE90DD400F90308 /* JSCustomSQLTransactionErrorCallback.h in Headers */,
 				1A3417C90CECFF250049CBDE /* JSCustomVoidCallback.h in Headers */,
 				E10B937C0B73C00A003ED890 /* JSCustomXPathNSResolver.h in Headers */,
+				79AC9219109945C80021266E /* JSCompositionEvent.h in Headers */,
 				1AE82F900CAAFA9D002237AE /* JSDatabase.h in Headers */,
 				BC77D16A0FF19F560070887B /* JSDataGridColumn.h in Headers */,
 				BC77D16C0FF19F560070887B /* JSDataGridColumnList.h in Headers */,
@@ -17583,7 +17741,6 @@
 				41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */,
 				934CC1170EDCAC7300A658F2 /* ScriptInstance.h in Headers */,
 				41F066E40F64BCF600A07EAC /* ScriptObject.h in Headers */,
-				419536510F68222400D0C679 /* ScriptObjectQuarantine.h in Headers */,
 				934CC10A0EDB223900A658F2 /* ScriptSourceCode.h in Headers */,
 				CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */,
 				41C760B10EDE03D300C1655F /* ScriptState.h in Headers */,
@@ -17631,6 +17788,7 @@
 				4B3043C70AE0370300A82647 /* Sound.h in Headers */,
 				84A81F3E0FC7DFF000955300 /* SourceAlpha.h in Headers */,
 				84A81F420FC7E02700955300 /* SourceGraphic.h in Headers */,
+				D01A27AE10C9BFD800026A42 /* SpaceSplitString.h in Headers */,
 				93309E12099E64920056E581 /* SplitElementCommand.h in Headers */,
 				93309E14099E64920056E581 /* SplitTextNodeCommand.h in Headers */,
 				93309E16099E64920056E581 /* SplitTextNodeContainingElementCommand.h in Headers */,
@@ -18068,6 +18226,26 @@
 				7553CFE8108F473F00EA281E /* TimelineRecordFactory.h in Headers */,
 				BC97E23A109144950010D361 /* HTMLAllCollection.h in Headers */,
 				BC97E413109154FA0010D361 /* JSHTMLAllCollection.h in Headers */,
+				37C236111097EE7700EF9F72 /* ComplexTextController.h in Headers */,
+				1479FAEE109AE37500DED655 /* RenderRuby.h in Headers */,
+				1479FAF0109AE37500DED655 /* RenderRubyBase.h in Headers */,
+				1479FAF2109AE37500DED655 /* RenderRubyRun.h in Headers */,
+				1479FAF4109AE37500DED655 /* RenderRubyText.h in Headers */,
+				5174E20A10A1F44F00F95E6F /* PopStateEvent.h in Headers */,
+				E124748410AA161D00B79493 /* AuthenticationClient.h in Headers */,
+				9382DF5810A8D5C900925652 /* ColorSpace.h in Headers */,
+				AB31C91E10AE1B8E000C7B92 /* LineClampValue.h in Headers */,
+				5189F01E10B37BD900F3C739 /* JSPopStateEvent.h in Headers */,
+				6E47E66110B7944B00B186C8 /* WebGLGetInfo.h in Headers */,
+				7A0E76DB10BF059800A0276E /* JSInjectedScriptHost.h in Headers */,
+				7A0E76FA10BF08ED00A0276E /* InjectedScriptHost.h in Headers */,
+				7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */,
+				7A0E771F10C00DB100A0276E /* JSInspectorFrontendHost.h in Headers */,
+				F4EAF4AF10C742B1009100D3 /* OpenTypeSanitizer.h in Headers */,
+				599D1E3310C97D6E00E0EF12 /* jni_utility_private.h in Headers */,
+				7ADE722610CBBB9B006B3B3A /* ContextMenuSelectionHandler.h in Headers */,
+				0C3F1F5B10C8871200D72CE1 /* WebGLUniformLocation.h in Headers */,
+				0C45342810CDBBFA00869157 /* JSWebGLUniformLocation.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -18136,7 +18314,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				46F9D5DD0B0D60170028EE36 /* aliasCursor.png in Resources */,
-				BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */,
 				46D4F2490AF97E810035385A /* cellCursor.png in Resources */,
 				46D4F24A0AF97E810035385A /* contextMenuCursor.png in Resources */,
 				4614A1FE0B23A8D600446E1C /* copyCursor.png in Resources */,
@@ -18169,6 +18346,8 @@
 				85136CA80AED665900F90A3D /* westResizeCursor.png in Resources */,
 				1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */,
 				1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */,
+				5174E20C10A1F49A00F95E6F /* PopStateEvent.idl in Resources */,
+				0C3F1F5C10C8871200D72CE1 /* WebGLUniformLocation.idl in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -18252,7 +18431,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\ntouch \"$SRCROOT/Info.plist\"\n";
+			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\nif [[ \"${CONFIGURATION}\" != \"Production\" ]]; then\n    touch \"$SRCROOT/Info.plist\";\nfi;\n";
 		};
 		933457E60EBFDF6B00B80894 /* Check For Exit Time Destructors */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -18378,29 +18557,29 @@
 				BCB16C250979C3BD00467741 /* CachedXBLDocument.cpp in Sources */,
 				BCB16C270979C3BD00467741 /* CachedXSLStyleSheet.cpp in Sources */,
 				49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */,
-				49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */,
-				49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */,
-				49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */,
-				49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */,
-				49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */,
-				49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */,
+				49EECDDF10503C2400099FAB /* WebGLArray.cpp in Sources */,
+				49EECDE210503C2400099FAB /* WebGLArrayBuffer.cpp in Sources */,
+				49C7B9C81042D32F0009D447 /* WebGLBuffer.cpp in Sources */,
+				49C7B9CB1042D32F0009D447 /* WebGLByteArray.cpp in Sources */,
+				49EECDE510503C2400099FAB /* WebGLFloatArray.cpp in Sources */,
+				49C7B9CE1042D32F0009D447 /* WebGLFramebuffer.cpp in Sources */,
 				49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */,
-				49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */,
+				49EECDE810503C2400099FAB /* WebGLIntArray.cpp in Sources */,
 				49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */,
 				49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */,
 				49484FC7102CF23C00187DD3 /* CanvasPixelArray.cpp in Sources */,
-				49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */,
-				49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */,
+				49C7B9D61042D32F0009D447 /* WebGLProgram.cpp in Sources */,
+				49C7B9D91042D32F0009D447 /* WebGLRenderbuffer.cpp in Sources */,
 				49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */,
 				49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */,
-				49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */,
-				49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */,
-				49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */,
+				49C7B9DF1042D32F0009D447 /* WebGLRenderingContext.cpp in Sources */,
+				49C7B9E21042D32F0009D447 /* WebGLShader.cpp in Sources */,
+				49EECDEB10503C2400099FAB /* WebGLShortArray.cpp in Sources */,
 				49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */,
-				49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */,
-				49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */,
-				49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */,
-				49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */,
+				49C7B9E51042D32F0009D447 /* WebGLTexture.cpp in Sources */,
+				49EECDEE10503C2400099FAB /* WebGLUnsignedByteArray.cpp in Sources */,
+				49EECDF110503C2400099FAB /* WebGLUnsignedIntArray.cpp in Sources */,
+				49EECDF410503C2400099FAB /* WebGLUnsignedShortArray.cpp in Sources */,
 				6550B69D099DF0270090D781 /* CDATASection.cpp in Sources */,
 				514185EF0CD65F0400763C99 /* ChangeVersionWrapper.cpp in Sources */,
 				6550B69F099DF0270090D781 /* CharacterData.cpp in Sources */,
@@ -18409,7 +18588,6 @@
 				A81872250977D3C0005826D9 /* ChildNodeList.cpp in Sources */,
 				14D8238B0AF92DF60004F057 /* Chrome.cpp in Sources */,
 				ABAF22080C03B1C700B0BCF0 /* ChromeMac.mm in Sources */,
-				BC4BF9E40D11E133007D247F /* ClassNames.cpp in Sources */,
 				BC904B760D10998F00680D32 /* ClassNodeList.cpp in Sources */,
 				BCC0657D0F3CE1B700CD2D87 /* ClientRect.cpp in Sources */,
 				BCC065800F3CE1B700CD2D87 /* ClientRectList.cpp in Sources */,
@@ -18422,8 +18600,12 @@
 				B22279620D00BF220071B782 /* ColorDistance.cpp in Sources */,
 				B27535770B053814002CE64F /* ColorMac.mm in Sources */,
 				6550B6A1099DF0270090D781 /* Comment.cpp in Sources */,
+				37C236101097EE7700EF9F72 /* ComplexTextController.cpp in Sources */,
+				37C238211098C84200EF9F72 /* ComplexTextControllerATSUI.cpp in Sources */,
+				37C238221098C84200EF9F72 /* ComplexTextControllerCoreText.cpp in Sources */,
 				316FE1150E6E1DA700BF6088 /* CompositeAnimation.cpp in Sources */,
 				93309DDC099E64920056E581 /* CompositeEditCommand.cpp in Sources */,
+				79F2F5A11091939A000D87CB /* CompositionEvent.cpp in Sources */,
 				BC0B36A40CD3C67C00AC7EB5 /* Console.cpp in Sources */,
 				41F0618F0F5F069800A07EAC /* ConsoleMessage.cpp in Sources */,
 				A818721F0977D3C0005826D9 /* ContainerNode.cpp in Sources */,
@@ -18434,7 +18616,6 @@
 				06027CB30B1CC03D00884B2D /* ContextMenuItemMac.mm in Sources */,
 				93B6A0EA0B0BCA8400F5027A /* ContextMenuMac.mm in Sources */,
 				9352087709BD453400F2038D /* CookieJar.mm in Sources */,
-				3724CA580E68A7E400DB4384 /* CoreTextController.cpp in Sources */,
 				BC5EB9500E82056B00B25965 /* CounterDirectives.cpp in Sources */,
 				9392F1500AD1862300691BD4 /* CounterNode.cpp in Sources */,
 				D0B0556909C6700100307E43 /* CreateLinkCommand.cpp in Sources */,
@@ -18845,6 +19026,7 @@
 				B2C3DA600D006CD600EF6F26 /* Font.cpp in Sources */,
 				B2C3DA620D006CD600EF6F26 /* FontCache.cpp in Sources */,
 				B2AFFC7C0D00A5C10030074D /* FontCacheMac.mm in Sources */,
+				37C2360B1097EDED00EF9F72 /* FontComplexTextMac.cpp in Sources */,
 				B2AFFC7D0D00A5C10030074D /* FontCustomPlatformData.cpp in Sources */,
 				371F4F410D25B9AF00ECE0D5 /* FontData.cpp in Sources */,
 				37ACCF690DA414E70089E602 /* FontDescription.cpp in Sources */,
@@ -18853,8 +19035,6 @@
 				A80E6CEC0A1989CA007FB8C5 /* FontFamilyValue.cpp in Sources */,
 				72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */,
 				B2AFFC800D00A5C10030074D /* FontMac.mm in Sources */,
-				3724CA590E68A7E400DB4384 /* FontMacATSUI.mm in Sources */,
-				3724CA7E0E68B20500DB4384 /* FontMacCoreText.cpp in Sources */,
 				B2AFFC820D00A5C10030074D /* FontPlatformDataMac.mm in Sources */,
 				A80E6CF10A1989CA007FB8C5 /* FontValue.cpp in Sources */,
 				D05CED290A40BB2C00C5AF38 /* FormatBlockCommand.cpp in Sources */,
@@ -18984,6 +19164,7 @@
 				BCCD74E50A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp in Sources */,
 				0B8C56D40F28627F000502E1 /* HTTPHeaderMap.cpp in Sources */,
 				514C76720CE923A1007EF3CD /* HTTPParsers.cpp in Sources */,
+				F5D3A57C106B83B300545297 /* ISODateTime.cpp in Sources */,
 				5126E6BB0A2E3B12005C29FA /* IconDatabase.cpp in Sources */,
 				445C8DB710015FC90031531A /* IconDatabaseNone.cpp in Sources */,
 				1A2D753E0DE47FAB00F0A648 /* IconFetcher.cpp in Sources */,
@@ -19046,46 +19227,46 @@
 				BC124EFF0C26447A009E2349 /* JSBarInfo.cpp in Sources */,
 				BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */,
 				1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */,
-				A7D20F62107F406900A80392 /* JSCanvasActiveInfo.cpp in Sources */,
-				49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */,
-				49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */,
-				49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */,
-				492273A31083B3B100EE5C84 /* JSCanvasArrayCustom.cpp in Sources */,
-				49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */,
-				49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */,
-				49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */,
-				49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */,
-				49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */,
-				49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */,
-				49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */,
-				49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */,
+				A7D20F62107F406900A80392 /* JSWebGLActiveInfo.cpp in Sources */,
+				49EECF1B105072F300099FAB /* JSWebGLArray.cpp in Sources */,
+				49EECF00105070C400099FAB /* JSWebGLArrayBuffer.cpp in Sources */,
+				49EECFAB1050938200099FAB /* JSWebGLArrayBufferConstructor.cpp in Sources */,
+				492273A31083B3B100EE5C84 /* JSWebGLArrayCustom.cpp in Sources */,
+				49C7B9931042D2D30009D447 /* JSWebGLBuffer.cpp in Sources */,
+				49C7B9951042D2D30009D447 /* JSWebGLByteArray.cpp in Sources */,
+				49EECFAD1050938200099FAB /* JSWebGLByteArrayConstructor.cpp in Sources */,
+				49EECF7810508D9C00099FAB /* JSWebGLByteArrayCustom.cpp in Sources */,
+				49EECF02105070C400099FAB /* JSWebGLFloatArray.cpp in Sources */,
+				49EECFAF1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp in Sources */,
+				49EECF7910508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp in Sources */,
+				49C7B9971042D2D30009D447 /* JSWebGLFramebuffer.cpp in Sources */,
 				65DF323909D1DE65000BE325 /* JSCanvasGradient.cpp in Sources */,
-				49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */,
-				49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */,
-				49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */,
+				49EECF04105070C400099FAB /* JSWebGLIntArray.cpp in Sources */,
+				49EECFB11050938200099FAB /* JSWebGLIntArrayConstructor.cpp in Sources */,
+				49EECF7A10508D9C00099FAB /* JSWebGLIntArrayCustom.cpp in Sources */,
 				65DF323B09D1DE65000BE325 /* JSCanvasPattern.cpp in Sources */,
-				49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */,
-				49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */,
+				49C7B99B1042D2D30009D447 /* JSWebGLProgram.cpp in Sources */,
+				49C7B99D1042D2D30009D447 /* JSWebGLRenderbuffer.cpp in Sources */,
 				49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */,
 				49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */,
 				49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */,
-				49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */,
-				49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */,
+				49EED1461051969400099FAB /* JSWebGLRenderingContext.cpp in Sources */,
+				49EED14F1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp in Sources */,
 				49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */,
-				49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */,
-				49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */,
-				49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */,
-				49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */,
-				49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */,
-				49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */,
-				49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */,
-				49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */,
-				49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */,
-				49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */,
-				49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */,
-				49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */,
-				49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */,
-				49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */,
+				49C7B9A21042D2D30009D447 /* JSWebGLShader.cpp in Sources */,
+				49EECF06105070C400099FAB /* JSWebGLShortArray.cpp in Sources */,
+				49EECFB51050938200099FAB /* JSWebGLShortArrayConstructor.cpp in Sources */,
+				49EECF7B10508D9C00099FAB /* JSWebGLShortArrayCustom.cpp in Sources */,
+				49C7B9A41042D2D30009D447 /* JSWebGLTexture.cpp in Sources */,
+				49EECF08105070C400099FAB /* JSWebGLUnsignedByteArray.cpp in Sources */,
+				49EECFB71050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp in Sources */,
+				49EECF7C10508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp in Sources */,
+				49EECF0A105070C400099FAB /* JSWebGLUnsignedIntArray.cpp in Sources */,
+				49EECFB91050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp in Sources */,
+				49EECF7D10508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp in Sources */,
+				49EECF0C105070C400099FAB /* JSWebGLUnsignedShortArray.cpp in Sources */,
+				49EECFBB1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp in Sources */,
+				49EECF7E10508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp in Sources */,
 				93F9B7A00BA6032600854064 /* JSCDATASection.cpp in Sources */,
 				93BA59B20F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp in Sources */,
 				65DF31F309D1CC60000BE325 /* JSCharacterData.cpp in Sources */,
@@ -19094,6 +19275,7 @@
 				BCA83E4F0D7CE1E9003421A8 /* JSClipboard.cpp in Sources */,
 				BCA83E520D7CE205003421A8 /* JSClipboardCustom.cpp in Sources */,
 				93F9B6E00BA0FB7200854064 /* JSComment.cpp in Sources */,
+				79AC9218109945C80021266E /* JSCompositionEvent.cpp in Sources */,
 				BC98543D0CD3D98B00069BC1 /* JSConsole.cpp in Sources */,
 				C0DFC8700DB6841A003EAE7C /* JSConsoleCustom.cpp in Sources */,
 				FE6FD48D0F676E9300092873 /* JSCoordinates.cpp in Sources */,
@@ -19262,7 +19444,7 @@
 				A7D0318E0E93540300E24ACD /* JSImageDataCustom.cpp in Sources */,
 				C091588A0DB4209200E55AF4 /* JSInspectedObjectWrapper.cpp in Sources */,
 				41F060CD0F5EEB2B00A07EAC /* JSInspectorBackend.cpp in Sources */,
-				7A74ECBD101839DA00BF939E /* JSInspectorBackendCustom.cpp in Sources */,
+				7A74ECBD101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp in Sources */,
 				C091588C0DB4209200E55AF4 /* JSInspectorCallbackWrapper.cpp in Sources */,
 				1C5FAED10DCFD90100D58F78 /* JSJavaScriptCallFrame.cpp in Sources */,
 				1C5FAEE70DCFDA6800D58F78 /* JSJavaScriptCallFrameCustom.cpp in Sources */,
@@ -19772,7 +19954,6 @@
 				E11C9DB00EB3699500E409DB /* ScriptExecutionContext.cpp in Sources */,
 				41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */,
 				41F066E50F64BCF600A07EAC /* ScriptObject.cpp in Sources */,
-				412A68470F6B03DD000EA66E /* ScriptObjectQuarantine.cpp in Sources */,
 				4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */,
 				934CC0E10ED39D6F00A658F2 /* ScriptValue.cpp in Sources */,
 				BCAA90C30A7EBA60008B1229 /* Scrollbar.cpp in Sources */,
@@ -20203,6 +20384,25 @@
 				BC97E23B109144950010D361 /* HTMLAllCollection.cpp in Sources */,
 				BC97E412109154FA0010D361 /* JSHTMLAllCollection.cpp in Sources */,
 				BC97E42C10915B060010D361 /* JSHTMLAllCollectionCustom.cpp in Sources */,
+				1479FAED109AE37500DED655 /* RenderRuby.cpp in Sources */,
+				1479FAEF109AE37500DED655 /* RenderRubyBase.cpp in Sources */,
+				1479FAF1109AE37500DED655 /* RenderRubyRun.cpp in Sources */,
+				1479FAF3109AE37500DED655 /* RenderRubyText.cpp in Sources */,
+				5189F01810B3781300F3C739 /* JSPopStateEventCustom.cpp in Sources */,
+				5189F01D10B37BD900F3C739 /* JSPopStateEvent.cpp in Sources */,
+				5189F0DE10B46B0E00F3C739 /* PopStateEvent.cpp in Sources */,
+				E1B4CD2510B322E200BFFD7E /* CredentialStorageMac.mm in Sources */,
+				6E47E66010B7944B00B186C8 /* WebGLGetInfo.cpp in Sources */,
+				7A0E76D510BF050700A0276E /* JSInjectedScriptHostCustom.cpp in Sources */,
+				7A0E76DA10BF059800A0276E /* JSInjectedScriptHost.cpp in Sources */,
+				7A0E76F910BF08ED00A0276E /* InjectedScriptHost.cpp in Sources */,
+				7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */,
+				7A0E771E10C00DB100A0276E /* JSInspectorFrontendHost.cpp in Sources */,
+				F4EAF4AE10C742B1009100D3 /* OpenTypeSanitizer.cpp in Sources */,
+				D01A27AD10C9BFD800026A42 /* SpaceSplitString.cpp in Sources */,
+				599D1E3210C97D6E00E0EF12 /* jni_utility_private.cpp in Sources */,
+				0C3F1F5A10C8871200D72CE1 /* WebGLUniformLocation.cpp in Sources */,
+				0C45342710CDBBFA00869157 /* JSWebGLUniformLocation.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebCore/WebCorePrefix.cpp b/WebCore/WebCorePrefix.cpp
index b522e1d..e0f19a0 100644
--- a/WebCore/WebCorePrefix.cpp
+++ b/WebCore/WebCorePrefix.cpp
@@ -24,4 +24,3 @@
  */
 
 #include "WebCorePrefix.h"
-
diff --git a/WebCore/WebCorePrefix.h b/WebCore/WebCorePrefix.h
index 6d445c5..1ffb675 100644
--- a/WebCore/WebCorePrefix.h
+++ b/WebCore/WebCorePrefix.h
@@ -18,7 +18,7 @@
  *
  */
 
-/* This prefix file should contain only:
+/* This prefix file should contain only: 
  *    1) files to precompile for faster builds
  *    2) in one case at least: OS-X-specific performance bug workarounds
  *    3) the special trick to catch us using new or delete without including "config.h"
diff --git a/WebCore/WebCoreSources.bkl b/WebCore/WebCoreSources.bkl
index c579084..cd94ae6 100644
--- a/WebCore/WebCoreSources.bkl
+++ b/WebCore/WebCoreSources.bkl
@@ -111,8 +111,9 @@ This file contains the list of files needed to build WebCore.
         bindings/js/JSHTMLSelectElementCustom.cpp
         bindings/js/JSImageConstructor.cpp
         bindings/js/JSImageDataCustom.cpp
+        bindings/js/JSInjectedScriptHostCustom.cpp
         bindings/js/JSInspectedObjectWrapper.cpp
-        bindings/js/JSInspectorBackendCustom.cpp
+        bindings/js/JSInspectorFrontendHostCustom.cpp
         bindings/js/JSInspectorCallbackWrapper.cpp
         bindings/js/JSJavaScriptCallFrameCustom.cpp
         bindings/js/JSLocationCustom.cpp
@@ -155,7 +156,6 @@ This file contains the list of files needed to build WebCore.
         bindings/js/ScriptEventListener.cpp
         bindings/js/ScriptFunctionCall.cpp
         bindings/js/ScriptObject.cpp
-        bindings/js/ScriptObjectQuarantine.cpp
         bindings/js/ScriptState.cpp
         bindings/js/ScriptValue.cpp
         bindings/js/ScheduledAction.cpp
@@ -274,6 +274,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSClientRectList.cpp
         DerivedSources/WebCore/JSClipboard.cpp
         DerivedSources/WebCore/JSComment.cpp
+        DerivedSources/WebCore/JSCompositionEvent.cpp
         DerivedSources/WebCore/JSConsole.cpp
         DerivedSources/WebCore/JSCoordinates.cpp
         DerivedSources/WebCore/JSCounter.cpp
@@ -365,7 +366,9 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSHTMLUListElement.cpp
         DerivedSources/WebCore/JSHistory.cpp
         DerivedSources/WebCore/JSImageData.cpp
+        DerivedSources/WebCore/JSInjectedScriptHost.cpp
         DerivedSources/WebCore/JSInspectorBackend.cpp
+        DerivedSources/WebCore/JSInspectorFrontendHost.cpp
         DerivedSources/WebCore/JSJavaScriptCallFrame.cpp
         DerivedSources/WebCore/JSKeyboardEvent.cpp
         DerivedSources/WebCore/JSLocation.cpp
@@ -447,13 +450,13 @@ This file contains the list of files needed to build WebCore.
         dom/CharacterData.cpp
         dom/CheckedRadioButtons.cpp
         dom/ChildNodeList.cpp
-        dom/ClassNames.cpp
         dom/ClassNodeList.cpp
         dom/ClientRect.cpp
         dom/ClientRectList.cpp
         dom/Clipboard.cpp
         dom/ClipboardEvent.cpp
         dom/Comment.cpp
+        dom/CompositionEvent.cpp
         dom/ContainerNode.cpp
         dom/DOMImplementation.cpp
         dom/Document.cpp
@@ -502,6 +505,7 @@ This file contains the list of files needed to build WebCore.
         dom/ScriptExecutionContext.cpp
         dom/SelectElement.cpp
         dom/SelectorNodeList.cpp
+        dom/SpaceSplitString.cpp
         dom/StaticNodeList.cpp
         dom/StyleElement.cpp
         dom/StyledElement.cpp
@@ -672,6 +676,7 @@ This file contains the list of files needed to build WebCore.
         html/HTMLTokenizer.cpp
         html/HTMLUListElement.cpp
         html/HTMLViewSourceDocument.cpp
+        html/ISODateTime.cpp
         html/ImageData.cpp
         html/PreloadScanner.cpp
         html/ValidityState.cpp
@@ -679,7 +684,9 @@ This file contains the list of files needed to build WebCore.
 
     <set append="1" var="WEBCORE_SOURCES_INSPECTOR">
         inspector/ConsoleMessage.cpp
+        inspector/InjectedScriptHost.cpp
         inspector/InspectorBackend.cpp
+        inspector/InspectorFrontendHost.cpp
         inspector/InspectorDatabaseResource.cpp
         inspector/InspectorDOMAgent.cpp
         inspector/InspectorDOMStorageResource.cpp
diff --git a/WebCore/accessibility/AXObjectCache.cpp b/WebCore/accessibility/AXObjectCache.cpp
index 55199a3..6ec325a 100644
--- a/WebCore/accessibility/AXObjectCache.cpp
+++ b/WebCore/accessibility/AXObjectCache.cpp
@@ -30,12 +30,12 @@
 #include "AXObjectCache.h"
 
 #include "AccessibilityARIAGrid.h"
-#include "AccessibilityARIAGridRow.h"
 #include "AccessibilityARIAGridCell.h"
+#include "AccessibilityARIAGridRow.h"
+#include "AccessibilityImageMapLink.h"
 #include "AccessibilityList.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
-#include "AccessibilityImageMapLink.h"
 #include "AccessibilityMediaControls.h"
 #include "AccessibilityRenderObject.h"
 #include "AccessibilitySlider.h"
@@ -141,7 +141,10 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
             newObj = AccessibilityListBox::create(renderer);
-        else if (node && (nodeIsAriaType(node, "list") || node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+
+        // If the node is aria role="list" or the aria role is empty and its a ul/ol/dl type (it shouldn't be a list if aria says otherwise). 
+        else if (node && ((nodeIsAriaType(node, "list") || nodeIsAriaType(node, "directory"))
+                          || (nodeIsAriaType(node, nullAtom) && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))))
             newObj = AccessibilityList::create(renderer);
         
         // aria tables
@@ -191,23 +194,23 @@ AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole role)
     
     // will be filled in...
     switch (role) {
-        case ListBoxOptionRole:
-            obj = AccessibilityListBoxOption::create();
-            break;
-        case ImageMapLinkRole:
-            obj = AccessibilityImageMapLink::create();
-            break;
-        case ColumnRole:
-            obj = AccessibilityTableColumn::create();
-            break;            
-        case TableHeaderContainerRole:
-            obj = AccessibilityTableHeaderContainer::create();
-            break;   
-        case SliderThumbRole:
-            obj = AccessibilitySliderThumb::create();
-            break;
-        default:
-            obj = 0;
+    case ListBoxOptionRole:
+        obj = AccessibilityListBoxOption::create();
+        break;
+    case ImageMapLinkRole:
+        obj = AccessibilityImageMapLink::create();
+        break;
+    case ColumnRole:
+        obj = AccessibilityTableColumn::create();
+        break;            
+    case TableHeaderContainerRole:
+        obj = AccessibilityTableHeaderContainer::create();
+        break;   
+    case SliderThumbRole:
+        obj = AccessibilitySliderThumb::create();
+        break;
+    default:
+        obj = 0;
     }
     
     if (obj)
@@ -235,9 +238,8 @@ void AXObjectCache::remove(AXID axID)
     removeAXID(obj);
     
     // finally remove the object
-    if (!m_objects.take(axID)) {
+    if (!m_objects.take(axID))
         return;
-    }
     
     ASSERT(m_objects.size() >= m_idsInUse.size());    
 }
@@ -261,7 +263,7 @@ AXID AXObjectCache::platformGenerateAXID() const
     AXID objID = lastUsedID;
     do {
         ++objID;
-    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+    } while (!objID || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
 
     lastUsedID = objID;
 
@@ -292,7 +294,7 @@ void AXObjectCache::removeAXID(AccessibilityObject* obj)
         return;
     
     AXID objID = obj->axObjectID();
-    if (objID == 0)
+    if (!objID)
         return;
     ASSERT(!HashTraits<AXID>::isDeletedValue(objID));
     ASSERT(m_idsInUse.contains(objID));
diff --git a/WebCore/accessibility/AXObjectCache.h b/WebCore/accessibility/AXObjectCache.h
index 5a75f84..adfddcd 100644
--- a/WebCore/accessibility/AXObjectCache.h
+++ b/WebCore/accessibility/AXObjectCache.h
@@ -42,104 +42,105 @@ class WebCoreTextMarker;
 
 namespace WebCore {
 
-    class Node;
-    class Page;
-    class RenderObject;
-    class String;
-    class VisiblePosition;
-
-    struct TextMarkerData  {
-        AXID axID;
-        Node* node;
-        int offset;
-        EAffinity affinity;
-    };
-
-    class AXObjectCache {
-    public:
-        AXObjectCache();
-        ~AXObjectCache();
-
-        static AccessibilityObject* focusedUIElementForPage(const Page*);
-
-        // to be used with render objects
-        AccessibilityObject* getOrCreate(RenderObject*);
-        
-        // used for objects without backing elements
-        AccessibilityObject* getOrCreate(AccessibilityRole);
-        
-        // will only return the AccessibilityObject if it already exists
-        AccessibilityObject* get(RenderObject*);
-        
-        void remove(RenderObject*);
-        void remove(AXID);
-
-        void detachWrapper(AccessibilityObject*);
-        void attachWrapper(AccessibilityObject*);
-        void childrenChanged(RenderObject*);
-        void selectedChildrenChanged(RenderObject*);
-        void handleActiveDescendantChanged(RenderObject*);
-        void handleAriaRoleChanged(RenderObject*);
-        void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
-        void handleScrolledToAnchor(const Node* anchorNode);
-
-        static void enableAccessibility() { gAccessibilityEnabled = true; }
-        static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
-        
-        static bool accessibilityEnabled() { return gAccessibilityEnabled; }
-        static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
-
-        void removeAXID(AccessibilityObject*);
-        bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
-        AXID platformGenerateAXID() const;
-        AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
-
-        // Text marker utilities.
-        static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
-        static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
-
-        enum AXNotification {
-            AXCheckedStateChanged,
-            AXFocusedUIElementChanged,
-            AXLayoutComplete,
-            AXLoadComplete,
-            AXSelectedChildrenChanged,
-            AXSelectedTextChanged,
-            AXValueChanged,
-            AXScrolledToAnchor,
-        };
-        
-        void postNotification(RenderObject*, AXNotification, bool postToElement);
-
-    protected:
-        void postPlatformNotification(AccessibilityObject*, AXNotification);
-
-    private:
-        HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
-        HashMap<RenderObject*, AXID> m_renderObjectMapping;
-        static bool gAccessibilityEnabled;
-        static bool gAccessibilityEnhancedUserInterfaceEnabled;
-        
-        HashSet<AXID> m_idsInUse;
-        
-        Timer<AXObjectCache> m_notificationPostTimer;
-        Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
-        void notificationPostTimerFired(Timer<AXObjectCache>*);
-        
-        AXID getAXID(AccessibilityObject*);
-        bool nodeIsAriaType(Node* node, String role);
+class Node;
+class Page;
+class RenderObject;
+class String;
+class VisiblePosition;
+
+struct TextMarkerData {
+    AXID axID;
+    Node* node;
+    int offset;
+    EAffinity affinity;
+};
+
+class AXObjectCache : public Noncopyable {
+public:
+    AXObjectCache();
+    ~AXObjectCache();
+
+    static AccessibilityObject* focusedUIElementForPage(const Page*);
+
+    // to be used with render objects
+    AccessibilityObject* getOrCreate(RenderObject*);
+    
+    // used for objects without backing elements
+    AccessibilityObject* getOrCreate(AccessibilityRole);
+    
+    // will only return the AccessibilityObject if it already exists
+    AccessibilityObject* get(RenderObject*);
+    
+    void remove(RenderObject*);
+    void remove(AXID);
+
+    void detachWrapper(AccessibilityObject*);
+    void attachWrapper(AccessibilityObject*);
+    void childrenChanged(RenderObject*);
+    void selectedChildrenChanged(RenderObject*);
+    void handleActiveDescendantChanged(RenderObject*);
+    void handleAriaRoleChanged(RenderObject*);
+    void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
+    void handleScrolledToAnchor(const Node* anchorNode);
+
+    static void enableAccessibility() { gAccessibilityEnabled = true; }
+    static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
+    
+    static bool accessibilityEnabled() { return gAccessibilityEnabled; }
+    static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
+
+    void removeAXID(AccessibilityObject*);
+    bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
+    AXID platformGenerateAXID() const;
+    AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
+
+    // Text marker utilities.
+    static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
+    static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
+
+    enum AXNotification {
+        AXActiveDescendantChanged,
+        AXCheckedStateChanged,
+        AXFocusedUIElementChanged,
+        AXLayoutComplete,
+        AXLoadComplete,
+        AXSelectedChildrenChanged,
+        AXSelectedTextChanged,
+        AXValueChanged,
+        AXScrolledToAnchor,
     };
+    
+    void postNotification(RenderObject*, AXNotification, bool postToElement);
+
+protected:
+    void postPlatformNotification(AccessibilityObject*, AXNotification);
+
+private:
+    HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
+    HashMap<RenderObject*, AXID> m_renderObjectMapping;
+    static bool gAccessibilityEnabled;
+    static bool gAccessibilityEnhancedUserInterfaceEnabled;
+    
+    HashSet<AXID> m_idsInUse;
+    
+    Timer<AXObjectCache> m_notificationPostTimer;
+    Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
+    void notificationPostTimerFired(Timer<AXObjectCache>*);
+    
+    AXID getAXID(AccessibilityObject*);
+    bool nodeIsAriaType(Node*, String role);
+};
 
 #if !HAVE(ACCESSIBILITY)
-    inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
-    inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
-    inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
-    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
-    inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
-    inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
+inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
+inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
+inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
+inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
+inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
+inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
+inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
 #endif
 
 }
diff --git a/WebCore/accessibility/AccessibilityARIAGrid.cpp b/WebCore/accessibility/AccessibilityARIAGrid.cpp
index 69c4512..a0cf77a 100644
--- a/WebCore/accessibility/AccessibilityARIAGrid.cpp
+++ b/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -29,11 +29,11 @@
 #include "config.h"
 #include "AccessibilityARIAGrid.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -137,7 +137,7 @@ AccessibilityTableCell* AccessibilityARIAGrid::cellForColumnAndRow(unsigned colu
     if (column >= columnCount() || row >= rowCount())
         return 0;
     
-    AccessibilityObject *tableRow = m_rows[row].get();
+    AccessibilityObject* tableRow = m_rows[row].get();
     if (!tableRow)
         return 0;
     
diff --git a/WebCore/accessibility/AccessibilityAllInOne.cpp b/WebCore/accessibility/AccessibilityAllInOne.cpp
index 04124bd..ada50cd 100755
--- a/WebCore/accessibility/AccessibilityAllInOne.cpp
+++ b/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -25,6 +25,7 @@
 

 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.

 

+#include <AXObjectCache.cpp>

 #include <AccessibilityARIAGrid.cpp>

 #include <AccessibilityARIAGridCell.cpp>

 #include <AccessibilityARIAGridRow.cpp>

@@ -41,4 +42,3 @@
 #include <AccessibilityTableColumn.cpp>

 #include <AccessibilityTableHeaderContainer.cpp>

 #include <AccessibilityTableRow.cpp>

-#include <AXObjectCache.cpp>

diff --git a/WebCore/accessibility/AccessibilityImageMapLink.cpp b/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 943122e..06150b9 100644
--- a/WebCore/accessibility/AccessibilityImageMapLink.cpp
+++ b/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityImageMapLink.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "Document.h"
 #include "HTMLNames.h"
 #include "IntRect.h"
@@ -68,6 +68,18 @@ AccessibilityObject* AccessibilityImageMapLink::parentObject() const
     return m_mapElement->document()->axObjectCache()->getOrCreate(m_mapElement->renderer());
 }
     
+AccessibilityRole AccessibilityImageMapLink::roleValue() const
+{
+    if (!m_areaElement)
+        return WebCoreLinkRole;
+    
+    const AtomicString& ariaRole = m_areaElement->getAttribute(roleAttr);
+    if (!ariaRole.isEmpty())
+        return AccessibilityObject::ariaRoleToWebCoreRole(ariaRole);
+
+    return WebCoreLinkRole;
+}
+    
 Element* AccessibilityImageMapLink::actionElement() const
 {
     return anchorElement();
@@ -134,5 +146,15 @@ IntSize AccessibilityImageMapLink::size() const
 {
     return elementRect().size();
 }
-    
+
+String AccessibilityImageMapLink::stringValueForMSAA() const
+{
+    return url();
+}
+
+String AccessibilityImageMapLink::nameForMSAA() const
+{
+    return accessibilityDescription();
+}
+
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityImageMapLink.h b/WebCore/accessibility/AccessibilityImageMapLink.h
index 2c27e46..3024f37 100644
--- a/WebCore/accessibility/AccessibilityImageMapLink.h
+++ b/WebCore/accessibility/AccessibilityImageMapLink.h
@@ -47,7 +47,7 @@ public:
     void setHTMLMapElement(HTMLMapElement* element) { m_mapElement = element; }    
     void setParent(AccessibilityObject* parent) { m_parent = parent; }
         
-    virtual AccessibilityRole roleValue() const { return WebCoreLinkRole; }
+    virtual AccessibilityRole roleValue() const;
     virtual bool accessibilityIsIgnored() const { return false; }
     virtual bool isEnabled() const { return true; }
 
@@ -56,9 +56,13 @@ public:
     virtual Element* actionElement() const;
     virtual KURL url() const;
     virtual bool isLink() const { return true; } 
+    virtual bool isLinked() const { return true; }
     virtual String title() const;
     virtual String accessibilityDescription() const;
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String nameForMSAA() const;
+
     virtual IntSize size() const;
     virtual IntRect elementRect() const;
 
diff --git a/WebCore/accessibility/AccessibilityList.cpp b/WebCore/accessibility/AccessibilityList.cpp
index 95239b0..feceee5 100644
--- a/WebCore/accessibility/AccessibilityList.cpp
+++ b/WebCore/accessibility/AccessibilityList.cpp
@@ -55,6 +55,10 @@ PassRefPtr<AccessibilityList> AccessibilityList::create(RenderObject* renderer)
 
 bool AccessibilityList::accessibilityIsIgnored() const
 {
+    // Is the platform interested in the object?
+    if (accessibilityPlatformIncludesObject() == IgnoreObject)
+        return true;
+    
     // lists don't appear on tiger/leopard on the mac
 #if ACCESSIBILITY_LISTS
     return false;
@@ -83,7 +87,11 @@ bool AccessibilityList::isOrderedList() const
 {
     if (!m_renderer)
         return false;
-    
+
+    // ARIA says a directory is like a static table of contents, which sounds like an ordered list.
+    if (ariaRoleAttribute() == DirectoryRole)
+        return true;
+
     Node* node = m_renderer->node();
     return node && node->hasTagName(olTag);    
 }
diff --git a/WebCore/accessibility/AccessibilityList.h b/WebCore/accessibility/AccessibilityList.h
index 89befb2..b7265b2 100644
--- a/WebCore/accessibility/AccessibilityList.h
+++ b/WebCore/accessibility/AccessibilityList.h
@@ -47,7 +47,7 @@ public:
     static PassRefPtr<AccessibilityList> create(RenderObject*);
     virtual ~AccessibilityList();
     
-    virtual bool isList() const { return true; };
+    virtual bool isList() const { return true; }
     bool isUnorderedList() const;
     bool isOrderedList() const;
     bool isDefinitionList() const;
diff --git a/WebCore/accessibility/AccessibilityListBox.cpp b/WebCore/accessibility/AccessibilityListBox.cpp
index 1f37481..2a60294 100644
--- a/WebCore/accessibility/AccessibilityListBox.cpp
+++ b/WebCore/accessibility/AccessibilityListBox.cpp
@@ -31,9 +31,9 @@
 
 #include "AXObjectCache.h"
 #include "AccessibilityListBoxOption.h"
-#include "HitTestResult.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
+#include "HitTestResult.h"
 #include "RenderListBox.h"
 #include "RenderObject.h"
 
diff --git a/WebCore/accessibility/AccessibilityListBox.h b/WebCore/accessibility/AccessibilityListBox.h
index 3f3352d..ce1abe0 100644
--- a/WebCore/accessibility/AccessibilityListBox.h
+++ b/WebCore/accessibility/AccessibilityListBox.h
@@ -43,7 +43,7 @@ public:
     virtual ~AccessibilityListBox();
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
-    virtual bool isListBox() const { return true; };
+    virtual bool isListBox() const { return true; }
     
     virtual bool canSetFocusAttribute() const { return true; }
     virtual bool canSetSelectedChildrenAttribute() const;
diff --git a/WebCore/accessibility/AccessibilityListBoxOption.cpp b/WebCore/accessibility/AccessibilityListBoxOption.cpp
index 6e3bf98..6a77dac 100644
--- a/WebCore/accessibility/AccessibilityListBoxOption.cpp
+++ b/WebCore/accessibility/AccessibilityListBoxOption.cpp
@@ -34,12 +34,12 @@
 #include "Element.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
-#include "HTMLOptionElement.h"
 #include "HTMLOptGroupElement.h"
+#include "HTMLOptionElement.h"
 #include "HTMLSelectElement.h"
 #include "IntRect.h"
-#include "RenderObject.h"
 #include "RenderListBox.h"
+#include "RenderObject.h"
 
 using namespace std;
 
diff --git a/WebCore/accessibility/AccessibilityListBoxOption.h b/WebCore/accessibility/AccessibilityListBoxOption.h
index 933cdeb..f8fd5f0 100644
--- a/WebCore/accessibility/AccessibilityListBoxOption.h
+++ b/WebCore/accessibility/AccessibilityListBoxOption.h
@@ -63,7 +63,7 @@ public:
     virtual IntRect elementRect() const;
     virtual IntSize size() const;
     virtual AccessibilityObject* parentObject() const;
-    bool isListBoxOption() const { return true; };
+    bool isListBoxOption() const { return true; }
     
 private:
     HTMLElement* m_optionElement;
diff --git a/WebCore/accessibility/AccessibilityMediaControls.cpp b/WebCore/accessibility/AccessibilityMediaControls.cpp
index 7200de9..6151840 100644
--- a/WebCore/accessibility/AccessibilityMediaControls.cpp
+++ b/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -113,6 +113,8 @@ String AccessibilityMediaControl::controlTypeName() const
     DEFINE_STATIC_LOCAL(const String, mediaStatusDisplayName, ("StatusDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaCurrentTimeDisplay, ("CurrentTimeDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaShowClosedCaptionsButtonName, ("ShowClosedCaptionsButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaHideClosedCaptionsButtonName, ("HideClosedCaptionsButton"));
 
     switch (controlType()) {
     case MediaFullscreenButton:
@@ -139,6 +141,10 @@ String AccessibilityMediaControl::controlTypeName() const
         return mediaCurrentTimeDisplay;
     case MediaTimeRemainingDisplay:
         return mediaTimeRemainingDisplay;
+    case MediaShowClosedCaptionsButton:
+        return mediaShowClosedCaptionsButtonName;
+    case MediaHideClosedCaptionsButton:
+        return mediaHideClosedCaptionsButtonName;
 
     default:
         break;
@@ -187,6 +193,8 @@ AccessibilityRole AccessibilityMediaControl::roleValue() const
     case MediaReturnToRealtimeButton:
     case MediaUnMuteButton:
     case MediaPauseButton:
+    case MediaShowClosedCaptionsButton:
+    case MediaHideClosedCaptionsButton:
         return ButtonRole;
 
     case MediaStatusDisplay:
diff --git a/WebCore/accessibility/AccessibilityMediaControls.h b/WebCore/accessibility/AccessibilityMediaControls.h
index 9b306fd..6f51b2c 100644
--- a/WebCore/accessibility/AccessibilityMediaControls.h
+++ b/WebCore/accessibility/AccessibilityMediaControls.h
@@ -37,77 +37,77 @@
 
 namespace WebCore {
 
-    class AccessibilityMediaControl : public AccessibilityRenderObject {
+class AccessibilityMediaControl : public AccessibilityRenderObject {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControl() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControl() { }
 
-        virtual AccessibilityRole roleValue() const;
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const;
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String title() const;
-        virtual String accessibilityDescription() const;
-        virtual String helpText() const;
+    virtual String title() const;
+    virtual String accessibilityDescription() const;
+    virtual String helpText() const;
 
-    protected:
-        AccessibilityMediaControl(RenderObject*);
-        MediaControlElementType controlType() const;
-        String controlTypeName() const;
-    };
+protected:
+    AccessibilityMediaControl(RenderObject*);
+    MediaControlElementType controlType() const;
+    String controlTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeline : public AccessibilitySlider {
+class AccessibilityMediaTimeline : public AccessibilitySlider {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeline() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeline() { }
 
-        virtual bool isMediaTimeline() const { return true; }
+    virtual bool isMediaTimeline() const { return true; }
 
-        virtual String helpText() const;
-        virtual String valueDescription() const;
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual String helpText() const;
+    virtual String valueDescription() const;
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-    private:
-        AccessibilityMediaTimeline(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeline(RenderObject*);
+};
 
 
-    class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
+class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControlsContainer() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControlsContainer() { }
 
-        virtual AccessibilityRole roleValue() const { return ToolbarRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return ToolbarRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        virtual String helpText() const;
-        virtual String accessibilityDescription() const;
+    virtual String helpText() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaControlsContainer(RenderObject*);
-        bool controllingVideoElement() const;
-        const String elementTypeName() const;
-    };
+private:
+    AccessibilityMediaControlsContainer(RenderObject*);
+    bool controllingVideoElement() const;
+    const String elementTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
+class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeDisplay() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeDisplay() { }
 
-        virtual AccessibilityRole roleValue() const { return StaticTextRole; }
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const { return StaticTextRole; }
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String stringValue() const;
-        virtual String accessibilityDescription() const;
+    virtual String stringValue() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaTimeDisplay(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeDisplay(RenderObject*);
+};
 
 
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityObject.cpp b/WebCore/accessibility/AccessibilityObject.cpp
index d7093e4..585e4cb 100644
--- a/WebCore/accessibility/AccessibilityObject.cpp
+++ b/WebCore/accessibility/AccessibilityObject.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityObject.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "CharacterNames.h"
 #include "FloatRect.h"
 #include "FocusController.h"
@@ -85,8 +85,9 @@ void AccessibilityObject::detach()
 AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
 {
     AccessibilityObject* parent;
-    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject())
-        ;
+    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject()) {
+    }
+    
     return parent;
 }
 
@@ -275,7 +276,7 @@ VisiblePositionRange AccessibilityObject::rightLineVisiblePositionRange(const Vi
     VisiblePosition startPosition = startOfLine(nextVisiblePos);
 
     // fetch for a valid line start position
-    if (startPosition.isNull() ) {
+    if (startPosition.isNull()) {
         startPosition = visiblePos;
         nextVisiblePos = nextVisiblePos.next();
     } else
@@ -381,9 +382,8 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
 {
     // we should always be given a rendered node and a replaced node, but be safe
     // replaced nodes are either attachments (widgets) or images
-    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode()) {
+    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode())
         return false;
-    }
 
     // create an AX object, but skip it if it is not supposed to be seen
     AccessibilityObject* object = replacedNode->renderer()->document()->axObjectCache()->getOrCreate(replacedNode->renderer());
@@ -445,7 +445,7 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length()) {
             // Add a textual representation for list marker text
             String listMarkerText = listMarkerTextForNodeAndPosition(it.node(), visiblePositionRange.start);
             if (!listMarkerText.isEmpty())
@@ -459,9 +459,8 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
             ASSERT(node == it.range()->endContainer(exception));
             int offset = it.range()->startOffset(exception);
 
-            if (replacedNodeNeedsCharacter(node->childNode(offset))) {
+            if (replacedNodeNeedsCharacter(node->childNode(offset)))
                 resultVector.append(objectReplacementCharacter);
-            }
         }
     }
 
@@ -478,9 +477,9 @@ int AccessibilityObject::lengthForVisiblePositionRange(const VisiblePositionRang
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length())
             length += it.length();
-        } else {
+        else {
             // locate the node and starting offset for this replaced range
             int exception = 0;
             Node* node = it.range()->startContainer(exception);
@@ -754,6 +753,53 @@ AccessibilityObject* AccessibilityObject::anchorElementForNode(Node* node)
     return anchorRenderer->document()->axObjectCache()->getOrCreate(anchorRenderer);
 }
     
+void AccessibilityObject::ariaTreeRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole) 
+            result.append(obj);
+
+        // Now see if this item also has rows hiding inside of it.
+        obj->ariaTreeRows(result);
+    }
+}
+    
+void AccessibilityObject::ariaTreeItemContent(AccessibilityChildrenVector& result)
+{
+    // The ARIA tree item content are the item that are not other tree items or their containing groups.
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        AccessibilityRole role = obj->roleValue();
+        if (role == TreeItemRole || role == GroupRole)
+            continue;
+        
+        result.append(obj);
+    }
+}
+
+void AccessibilityObject::ariaTreeItemDisclosedRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole)
+            result.append(obj);
+        // If it's not a tree item, then descend into the group to find more tree items.
+        else 
+            obj->ariaTreeRows(result);
+    }    
+}
+    
 const String& AccessibilityObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -766,20 +812,20 @@ const String& AccessibilityObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, noAction, ());
 
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    default:
+        return noAction;
     }
 }
  
@@ -794,6 +840,93 @@ AccessibilityOrientation AccessibilityObject::orientation() const
 
     // A tie goes to horizontal.
     return AccessibilityOrientationHorizontal;
+}    
+
+typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
+
+struct RoleEntry {
+    String ariaRole;
+    AccessibilityRole webcoreRole;
+};
+
+static ARIARoleMap* createARIARoleMap()
+{
+    const RoleEntry roles[] = {
+        { "alert", ApplicationAlertRole },
+        { "alertdialog", ApplicationAlertDialogRole },
+        { "application", LandmarkApplicationRole },
+        { "article", DocumentArticleRole },
+        { "banner", LandmarkBannerRole },
+        { "button", ButtonRole },
+        { "checkbox", CheckBoxRole },
+        { "complementary", LandmarkComplementaryRole },
+        { "contentinfo", LandmarkContentInfoRole },
+        { "dialog", ApplicationDialogRole },
+        { "directory", DirectoryRole },
+        { "grid", TableRole },
+        { "gridcell", CellRole },
+        { "columnheader", ColumnHeaderRole },
+        { "combobox", ComboBoxRole },
+        { "definition", DefinitionListDefinitionRole },
+        { "document", DocumentRole },
+        { "rowheader", RowHeaderRole },
+        { "group", GroupRole },
+        { "heading", HeadingRole },
+        { "img", ImageRole },
+        { "link", WebCoreLinkRole },
+        { "list", ListRole },        
+        { "listitem", GroupRole },        
+        { "listbox", ListBoxRole },
+        { "log", ApplicationLogRole },
+        // "option" isn't here because it may map to different roles depending on the parent element's role
+        { "main", LandmarkMainRole },
+        { "marquee", ApplicationMarqueeRole },
+        { "math", DocumentMathRole },
+        { "menu", MenuRole },
+        { "menubar", GroupRole },
+        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
+        { "menuitemcheckbox", MenuItemRole },
+        { "menuitemradio", MenuItemRole },
+        { "note", DocumentNoteRole },
+        { "navigation", LandmarkNavigationRole },
+        { "option", ListBoxOptionRole },
+        { "presentation", IgnoredRole },
+        { "progressbar", ProgressIndicatorRole },
+        { "radio", RadioButtonRole },
+        { "radiogroup", RadioGroupRole },
+        { "region", DocumentRegionRole },
+        { "row", RowRole },
+        { "range", SliderRole },
+        { "scrollbar", ScrollBarRole },
+        { "search", LandmarkSearchRole },
+        { "separator", SplitterRole },
+        { "slider", SliderRole },
+        { "spinbutton", ProgressIndicatorRole },
+        { "status", ApplicationStatusRole },
+        { "tab", TabRole },
+        { "tablist", TabListRole },
+        { "tabpanel", TabPanelRole },
+        { "text", StaticTextRole },
+        { "textbox", TextAreaRole },
+        { "timer", ApplicationTimerRole },
+        { "toolbar", ToolbarRole },
+        { "tooltip", UserInterfaceTooltipRole },
+        { "tree", TreeRole },
+        { "treeitem", TreeItemRole }
+    };
+    ARIARoleMap* roleMap = new ARIARoleMap;
+    
+    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
+    for (unsigned i = 0; i < numRoles; ++i)
+        roleMap->set(roles[i].ariaRole, roles[i].webcoreRole);
+    return roleMap;
+}
+
+AccessibilityRole AccessibilityObject::ariaRoleToWebCoreRole(const String& value)
+{
+    ASSERT(!value.isEmpty());
+    static const ARIARoleMap* roleMap = createARIARoleMap();
+    return roleMap->get(value);
 }
     
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityObject.h b/WebCore/accessibility/AccessibilityObject.h
index 8fc40e8..8e46311 100644
--- a/WebCore/accessibility/AccessibilityObject.h
+++ b/WebCore/accessibility/AccessibilityObject.h
@@ -161,6 +161,12 @@ enum AccessibilityRole {
     AnnotationRole,
     SliderThumbRole,
     IgnoredRole,
+    TabRole,
+    TabListRole,
+    TabPanelRole,
+    TreeRole,
+    TreeItemRole,
+    DirectoryRole,
     
     // ARIA Grouping roles
     LandmarkApplicationRole,
@@ -171,6 +177,9 @@ enum AccessibilityRole {
     LandmarkNavigationRole,
     LandmarkSearchRole,
     
+    ApplicationAlertRole,
+    ApplicationAlertDialogRole,
+    ApplicationDialogRole,
     ApplicationLogRole,
     ApplicationMarqueeRole,
     ApplicationStatusRole,
@@ -178,6 +187,7 @@ enum AccessibilityRole {
     
     DocumentRole,
     DocumentArticleRole,
+    DocumentMathRole,
     DocumentNoteRole,
     DocumentRegionRole,
     
@@ -225,7 +235,7 @@ struct PlainTextRange {
         , length(l)
     { }
     
-    bool isNull() const { return start == 0 && length == 0; }
+    bool isNull() const { return !start && !length; }
 };
 
 class AccessibilityObject : public RefCounted<AccessibilityObject> {
@@ -237,64 +247,75 @@ public:
         
     typedef Vector<RefPtr<AccessibilityObject> > AccessibilityChildrenVector;
     
-    virtual bool isAccessibilityRenderObject() const { return false; };
-    virtual bool isAnchor() const { return false; };
-    virtual bool isAttachment() const { return false; };
-    virtual bool isHeading() const { return false; };
-    virtual bool isLink() const { return false; };
-    virtual bool isImage() const { return false; };
-    virtual bool isNativeImage() const { return false; };
-    virtual bool isImageButton() const { return false; };
-    virtual bool isPasswordField() const { return false; };
-    virtual bool isTextControl() const { return false; };
-    virtual bool isNativeTextControl() const { return false; };
-    virtual bool isWebArea() const { return false; };
-    virtual bool isCheckboxOrRadio() const { return false; };
-    virtual bool isListBox() const { return roleValue() == ListBoxRole; };
+    virtual bool isAccessibilityRenderObject() const { return false; }
+    virtual bool isAnchor() const { return false; }
+    virtual bool isAttachment() const { return false; }
+    virtual bool isHeading() const { return false; }
+    virtual bool isLink() const { return false; }
+    virtual bool isImage() const { return false; }
+    virtual bool isNativeImage() const { return false; }
+    virtual bool isImageButton() const { return false; }
+    virtual bool isPasswordField() const { return false; }
+    virtual bool isTextControl() const { return false; }
+    virtual bool isNativeTextControl() const { return false; }
+    virtual bool isWebArea() const { return false; }
+    virtual bool isCheckboxOrRadio() const { return false; }
+    virtual bool isListBox() const { return roleValue() == ListBoxRole; }
     virtual bool isMediaTimeline() const { return false; }
     virtual bool isMenuRelated() const { return false; }
     virtual bool isMenu() const { return false; }
     virtual bool isMenuBar() const { return false; }
     virtual bool isMenuButton() const { return false; }
     virtual bool isMenuItem() const { return false; }
-    virtual bool isFileUploadButton() const { return false; };
+    virtual bool isFileUploadButton() const { return false; }
     virtual bool isInputImage() const { return false; }
-    virtual bool isProgressIndicator() const { return false; };
-    virtual bool isSlider() const { return false; };
-    virtual bool isControl() const { return false; };
-    virtual bool isList() const { return false; };
-    virtual bool isDataTable() const { return false; };
-    virtual bool isTableRow() const { return false; };
-    virtual bool isTableColumn() const { return false; };
-    virtual bool isTableCell() const { return false; };
-    virtual bool isFieldset() const { return false; };
-    virtual bool isGroup() const { return false; };
+    virtual bool isProgressIndicator() const { return false; }
+    virtual bool isSlider() const { return false; }
+    virtual bool isControl() const { return false; }
+    virtual bool isList() const { return false; }
+    virtual bool isDataTable() const { return false; }
+    virtual bool isTableRow() const { return false; }
+    virtual bool isTableColumn() const { return false; }
+    virtual bool isTableCell() const { return false; }
+    virtual bool isFieldset() const { return false; }
+    virtual bool isGroup() const { return false; }
+    bool isTabList() const { return roleValue() == TabListRole; }
+    bool isTabItem() const { return roleValue() == TabRole; }
     bool isRadioGroup() const { return roleValue() == RadioGroupRole; }
+    bool isComboBox() const { return roleValue() == ComboBoxRole; }
+    bool isTree() const { return roleValue() == TreeRole; }
+    bool isTreeItem() const { return roleValue() == TreeItemRole; }
+    bool isScrollbar() const { return roleValue() == ScrollBarRole; }
+    bool isButton() const { return roleValue() == ButtonRole; }
     
-    virtual bool isChecked() const { return false; };
-    virtual bool isEnabled() const { return false; };
-    virtual bool isSelected() const { return false; };
-    virtual bool isFocused() const { return false; };
-    virtual bool isHovered() const { return false; };
-    virtual bool isIndeterminate() const { return false; };
-    virtual bool isLoaded() const { return false; };
-    virtual bool isMultiSelect() const { return false; };
-    virtual bool isOffScreen() const { return false; };
-    virtual bool isPressed() const { return false; };
-    virtual bool isReadOnly() const { return false; };
-    virtual bool isVisited() const { return false; };
-    virtual bool isRequired() const { return false; };
-
-    virtual bool canSetFocusAttribute() const { return false; };
-    virtual bool canSetTextRangeAttributes() const { return false; };
-    virtual bool canSetValueAttribute() const { return false; };
+    virtual bool isChecked() const { return false; }
+    virtual bool isEnabled() const { return false; }
+    virtual bool isSelected() const { return false; }
+    virtual bool isFocused() const { return false; }
+    virtual bool isHovered() const { return false; }
+    virtual bool isIndeterminate() const { return false; }
+    virtual bool isLoaded() const { return false; }
+    virtual bool isMultiSelect() const { return false; }
+    virtual bool isOffScreen() const { return false; }
+    virtual bool isPressed() const { return false; }
+    virtual bool isReadOnly() const { return false; }
+    virtual bool isVisited() const { return false; }
+    virtual bool isRequired() const { return false; }
+    virtual bool isLinked() const { return false; }
+    virtual bool isExpanded() const { return false; }
+    virtual void setIsExpanded(bool) { }
+
+    virtual bool canSetFocusAttribute() const { return false; }
+    virtual bool canSetTextRangeAttributes() const { return false; }
+    virtual bool canSetValueAttribute() const { return false; }
     virtual bool canSetSelectedAttribute() const { return false; }
     virtual bool canSetSelectedChildrenAttribute() const { return false; }
+    virtual bool canSetExpandedAttribute() const { return false; }
     
-    virtual bool hasIntValue() const { return false; };
+    virtual bool hasIntValue() const { return false; }
 
-    bool accessibilityShouldUseUniqueId() const { return true; };
-    virtual bool accessibilityIsIgnored() const  { return true; };
+    bool accessibilityShouldUseUniqueId() const { return true; }
+    virtual bool accessibilityIsIgnored() const  { return true; }
 
     virtual int headingLevel() const { return 0; }
     virtual int intValue() const { return 0; }
@@ -303,9 +324,21 @@ public:
     virtual float maxValueForRange() const { return 0.0f; }
     virtual float minValueForRange() const { return 0.0f; }
     virtual AccessibilityObject* selectedRadioButton() { return 0; }
+    virtual AccessibilityObject* selectedTabItem() { return 0; }    
     virtual int layoutCount() const { return 0; }
     static bool isARIAControl(AccessibilityRole);
     static bool isARIAInput(AccessibilityRole);
+    virtual bool supportsARIAOwns() const { return false; }
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const { }
+    virtual bool supportsARIAFlowTo() const { return false; }
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const { }
+    
+    // ARIA drag and drop
+    virtual bool supportsARIADropping() { return false; }
+    virtual bool supportsARIADragging() { return false; }
+    virtual bool isARIAGrabbed() { return false; }
+    virtual void setARIAGrabbed(bool) { }
+    virtual void determineARIADropEffects(Vector<String>&) { }
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const { return 0; }
     virtual AccessibilityObject* focusedUIElement() const { return 0; }
@@ -331,7 +364,6 @@ public:
 
     void setRoleValue(AccessibilityRole role) { m_role = role; }
     virtual AccessibilityRole roleValue() const { return m_role; }
-    virtual String ariaAccessibilityName(const String&) const { return String(); }
     virtual String ariaLabeledByAttribute() const { return String(); }
     virtual String ariaDescribedByAttribute() const { return String(); }
     virtual String accessibilityDescription() const { return String(); }
@@ -370,20 +402,22 @@ public:
     virtual FrameView* topDocumentFrameView() const { return 0; }
     virtual FrameView* documentFrameView() const;
     virtual String language() const;
-
+    virtual unsigned hierarchicalLevel() const { return 0; }
+    
     virtual void setFocused(bool) { }
     virtual void setSelectedText(const String&) { }
     virtual void setSelectedTextRange(const PlainTextRange&) { }
     virtual void setValue(const String&) { }
     virtual void setSelected(bool) { }
-
+    virtual void setSelectedRows(AccessibilityChildrenVector&) { }
+    
     virtual void makeRangeVisible(const PlainTextRange&) { }
     virtual bool press() const;
     bool performDefaultAction() const { return press(); }
-
+    
     virtual AccessibilityOrientation orientation() const;
-    virtual void increment() { };
-    virtual void decrement() { };
+    virtual void increment() { }
+    virtual void decrement() { }
 
     virtual void childrenChanged() { }
     virtual const AccessibilityChildrenVector& children() { return m_children; }
@@ -392,10 +426,13 @@ public:
     virtual bool hasChildren() const { return m_haveChildren; }
     virtual void selectedChildren(AccessibilityChildrenVector&) { }
     virtual void visibleChildren(AccessibilityChildrenVector&) { }
+    virtual void tabChildren(AccessibilityChildrenVector&) { }
     virtual bool shouldFocusActiveDescendant() const { return false; }
     virtual AccessibilityObject* activeDescendant() const { return 0; }    
     virtual void handleActiveDescendantChanged() { }
 
+    static AccessibilityRole ariaRoleToWebCoreRole(const String&);
+    
     virtual VisiblePositionRange visiblePositionRange() const { return VisiblePositionRange(); }
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const { return VisiblePositionRange(); }
     
@@ -446,6 +483,18 @@ public:
 
     unsigned doAXLineForIndex(unsigned);
 
+    virtual String stringValueForMSAA() const { return String(); }
+    virtual String stringRoleForMSAA() const { return String(); }
+    virtual String nameForMSAA() const { return String(); }
+    virtual String descriptionForMSAA() const { return String(); }
+    
+    // Used by an ARIA tree to get all its rows.
+    void ariaTreeRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get all of its direct rows that it can disclose.
+    void ariaTreeItemDisclosedRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get only its content, and not its child tree items and groups. 
+    void ariaTreeItemContent(AccessibilityChildrenVector&);
+    
 #if HAVE(ACCESSIBILITY)
 #if PLATFORM(GTK)
     AccessibilityObjectWrapper* wrapper() const;
diff --git a/WebCore/accessibility/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
index 4c50b9a..c57dd92 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -30,8 +30,8 @@
 #include "AccessibilityRenderObject.h"
 
 #include "AXObjectCache.h"
-#include "AccessibilityListBox.h"
 #include "AccessibilityImageMapLink.h"
+#include "AccessibilityListBox.h"
 #include "CharacterNames.h"
 #include "EventNames.h"
 #include "FloatRect.h"
@@ -84,6 +84,7 @@ AccessibilityRenderObject::AccessibilityRenderObject(RenderObject* renderer)
     : AccessibilityObject()
     , m_renderer(renderer)
     , m_ariaRole(UnknownRole)
+    , m_childrenDirty(false)
 {
     updateAccessibilityRole();
 #ifndef NDEBUG
@@ -166,7 +167,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
 
@@ -178,7 +179,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObject() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
     
@@ -296,10 +297,10 @@ bool AccessibilityRenderObject::isSlider() const
 bool AccessibilityRenderObject::isMenuRelated() const
 {
     AccessibilityRole role = roleValue();
-    return  role == MenuRole ||
-            role == MenuBarRole ||
-            role == MenuButtonRole ||
-            role == MenuItemRole;
+    return role == MenuRole 
+        || role == MenuBarRole
+        || role == MenuButtonRole
+        || role == MenuItemRole;
 }    
 
 bool AccessibilityRenderObject::isMenu() const
@@ -505,6 +506,24 @@ AccessibilityObject* AccessibilityRenderObject::selectedRadioButton()
     }
     return 0;
 }
+
+AccessibilityObject* AccessibilityRenderObject::selectedTabItem()
+{
+    if (!isTabList())
+        return 0;
+    
+    // Find the child tab item that is selected (ie. the intValue == 1).
+    AccessibilityObject::AccessibilityChildrenVector tabs;
+    tabChildren(tabs);
+    
+    int count = tabs.size();
+    for (int i = 0; i < count; ++i) {
+        AccessibilityObject* object = m_children[i].get();
+        if (object->isTabItem() && object->intValue() == 1)
+            return object;
+    }
+    return 0;
+}
     
 const AtomicString& AccessibilityRenderObject::getAttribute(const QualifiedName& attribute) const
 {
@@ -693,6 +712,40 @@ String AccessibilityRenderObject::helpText() const
     return String();
 }
     
+unsigned AccessibilityRenderObject::hierarchicalLevel() const
+{
+    if (!m_renderer)
+        return 0;
+
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(node);
+    String ariaLevel = element->getAttribute(aria_levelAttr);
+    if (!ariaLevel.isEmpty())
+        return ariaLevel.toInt();
+    
+    // Only tree item will calculate its level through the DOM currently.
+    if (roleValue() != TreeItemRole)
+        return 0;
+    
+    // Hierarchy leveling starts at 0.
+    // We measure tree hierarchy by the number of groups that the item is within.
+    unsigned level = 0;
+    AccessibilityObject* parent = parentObject();
+    while (parent) {
+        AccessibilityRole parentRole = parent->roleValue();
+        if (parentRole == GroupRole)
+            level++;
+        else if (parentRole == TreeRole)
+            break;
+        
+        parent = parent->parentObject();
+    }
+    
+    return level;
+}
+    
 String AccessibilityRenderObject::language() const
 {
     if (!m_renderer)
@@ -780,7 +833,7 @@ String AccessibilityRenderObject::valueDescription() const
     
 float AccessibilityRenderObject::valueForRange() const
 {
-    if (!isProgressIndicator() && !isSlider())
+    if (!isProgressIndicator() && !isSlider() && !isScrollbar())
         return 0.0f;
 
     return getAttribute(aria_valuenowAttr).toFloat();
@@ -807,6 +860,9 @@ String AccessibilityRenderObject::stringValue() const
     if (!m_renderer || isPasswordField())
         return String();
     
+    if (ariaRoleAttribute() == StaticTextRole)
+        return text();
+        
     if (m_renderer->isText())
         return textUnderElement();
     
@@ -864,56 +920,67 @@ static String accessibleNameForNode(Node* node)
     return String();
 }
 
-String AccessibilityRenderObject::ariaAccessibilityName(const String& s) const
+String AccessibilityRenderObject::accessibilityDescriptionForElements(Vector<Element*> &elements) const
 {
+    Vector<UChar> ariaLabel;
+    unsigned size = elements.size();
+    for (unsigned i = 0; i < size; ++i) {
+        Element* idElement = elements[i];
+        
+        String nameFragment = accessibleNameForNode(idElement);
+        ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
+            nameFragment = accessibleNameForNode(n);
+            ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        }
+            
+        if (i != size - 1)
+            ariaLabel.append(' ');
+    }
+    return String::adopt(ariaLabel);
+}
+
+    
+void AccessibilityRenderObject::elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& attribute) const
+{
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+
     Document* document = m_renderer->document();
     if (!document)
-        return String();
-
-    String idList = s;
+        return;
+    
+    String idList = getAttribute(attribute).string();
+    if (idList.isEmpty())
+        return;
+    
     idList.replace('\n', ' ');
     Vector<String> idVector;
     idList.split(' ', idVector);
-
-    Vector<UChar> ariaLabel;
+    
     unsigned size = idVector.size();
     for (unsigned i = 0; i < size; ++i) {
         String idName = idVector[i];
         Element* idElement = document->getElementById(idName);
-        if (idElement) {
-            String nameFragment = accessibleNameForNode(idElement);
-            ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
-                nameFragment = accessibleNameForNode(n);
-                ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            }
-            
-            if (i != size - 1)
-                ariaLabel.append(' ');
-        }
+        if (idElement)
+            elements.append(idElement);
     }
-    return String::adopt(ariaLabel);
 }
-
+    
+void AccessibilityRenderObject::ariaLabeledByElements(Vector<Element*>& elements) const
+{
+    elementsFromAttribute(elements, aria_labeledbyAttr);
+    if (!elements.size())
+        elementsFromAttribute(elements, aria_labelledbyAttr);
+}
+   
 String AccessibilityRenderObject::ariaLabeledByAttribute() const
 {
-    Node* node = m_renderer->node();
-    if (!node)
-        return String();
-
-    if (!node->isElementNode())
-        return String();
-
-    // The ARIA spec uses the British spelling: "labelled." It seems prudent to support the American
-    // spelling ("labeled") as well.
-    String idList = getAttribute(aria_labeledbyAttr).string();
-    if (idList.isEmpty()) {
-        idList = getAttribute(aria_labelledbyAttr).string();
-        if (idList.isEmpty())
-            return String();
-    }
-
-    return ariaAccessibilityName(idList);
+    Vector<Element*> elements;
+    ariaLabeledByElements(elements);
+    
+    return accessibilityDescriptionForElements(elements);
 }
 
 static HTMLLabelElement* labelForElement(Element* element)
@@ -990,6 +1057,8 @@ String AccessibilityRenderObject::title() const
         || ariaRole == MenuItemRole
         || ariaRole == MenuButtonRole
         || ariaRole == RadioButtonRole
+        || ariaRole == CheckBoxRole
+        || ariaRole == TabRole
         || isHeading())
         return textUnderElement();
     
@@ -1001,11 +1070,10 @@ String AccessibilityRenderObject::title() const
 
 String AccessibilityRenderObject::ariaDescribedByAttribute() const
 {
-    String idList = getAttribute(aria_describedbyAttr).string();
-    if (idList.isEmpty())
-        return String();
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_describedbyAttr);
     
-    return ariaAccessibilityName(idList);
+    return accessibilityDescriptionForElements(elements);
 }
 
 String AccessibilityRenderObject::accessibilityDescription() const
@@ -1032,7 +1100,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
     }
     
     if (isWebArea()) {
-        Document *document = m_renderer->document();
+        Document* document = m_renderer->document();
         Node* owner = document->ownerElement();
         if (owner) {
             if (owner->hasTagName(frameTag) || owner->hasTagName(iframeTag)) {
@@ -1048,12 +1116,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
         if (owner && owner->isHTMLElement())
             return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
     }
-    
-    if (roleValue() == DefinitionListTermRole)
-        return AXDefinitionListTermText();
-    if (roleValue() == DefinitionListDefinitionRole)
-        return AXDefinitionListDefinitionText();
-    
+
     return String();
 }
 
@@ -1198,6 +1261,8 @@ void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildren
 // or an internal anchor connection
 void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& linkedUIElements) const
 {
+    ariaFlowToElements(linkedUIElements);
+
     if (isAnchor()) {
         AccessibilityObject* linkedAXElement = internalLinkElement();
         if (linkedAXElement)
@@ -1208,6 +1273,71 @@ void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& li
         addRadioButtonGroupMembers(linkedUIElements);
 }
 
+bool AccessibilityRenderObject::hasTextAlternative() const
+{
+    // ARIA: section 2A, bullet #3 says if aria-labeledby or aria-label appears, it should
+    // override the "label" element association.
+    if (!ariaLabeledByAttribute().isEmpty() || !getAttribute(aria_labelAttr).string().isEmpty())
+        return true;
+        
+    return false;   
+}
+    
+bool AccessibilityRenderObject::supportsARIAFlowTo() const
+{
+    return !getAttribute(aria_flowtoAttr).string().isEmpty();
+}
+    
+void AccessibilityRenderObject::ariaFlowToElements(AccessibilityChildrenVector& flowTo) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_flowtoAttr);
+    
+    AXObjectCache* cache = axObjectCache();
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* flowToElement = cache->getOrCreate(element->renderer());
+        if (flowToElement)
+            flowTo.append(flowToElement);
+    }
+        
+}
+    
+bool AccessibilityRenderObject::supportsARIADropping()
+{
+    const AtomicString& dropEffect = getAttribute(aria_dropeffectAttr).string();
+    return !dropEffect.isEmpty();
+}
+
+bool AccessibilityRenderObject::supportsARIADragging()
+{
+    const AtomicString& grabbed = getAttribute(aria_grabbedAttr).string();
+    return equalIgnoringCase(grabbed, "true") || equalIgnoringCase(grabbed, "false");   
+}
+
+bool AccessibilityRenderObject::isARIAGrabbed()
+{
+    return elementAttributeValue(aria_grabbedAttr);
+}
+
+void AccessibilityRenderObject::setARIAGrabbed(bool grabbed)
+{
+    setElementAttributeValue(aria_grabbedAttr, grabbed);
+}
+
+void AccessibilityRenderObject::determineARIADropEffects(Vector<String>& effects)
+{
+    String dropEffects = getAttribute(aria_dropeffectAttr).string();
+    if (dropEffects.isEmpty()) {
+        effects.clear();
+        return;
+    }
+    
+    dropEffects.replace('\n', ' ');
+    dropEffects.split(' ', effects);
+}
+    
 bool AccessibilityRenderObject::exposesTitleUIElement() const
 {
     if (!isControl())
@@ -1217,6 +1347,9 @@ bool AccessibilityRenderObject::exposesTitleUIElement() const
     if (isCheckboxOrRadio() && getAttribute(titleAttr).isEmpty())
         return false;
     
+    if (hasTextAlternative())
+        return false;
+    
     return true;
 }
     
@@ -1256,9 +1389,19 @@ bool AccessibilityRenderObject::ariaIsHidden() const
     return false;
 }
 
+bool AccessibilityRenderObject::isDescendantOfBarrenParent() const
+{
+    for (AccessibilityObject* object = parentObject(); object; object = object->parentObject()) {
+        if (!object->canHaveChildren())
+            return true;
+    }
+    
+    return false;
+}
+    
 bool AccessibilityRenderObject::accessibilityIsIgnored() const
 {
-    // is the platform is interested in this object?
+    // Is the platform interested in this object?
     AccessibilityObjectPlatformInclusion decision = accessibilityPlatformIncludesObject();
     if (decision == IncludeObject)
         return false;
@@ -1276,6 +1419,10 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (isPresentationalChildOfAriaRole())
         return true;
         
+    // If this element is within a parent that cannot have children, it should not be exposed.
+    if (isDescendantOfBarrenParent())
+        return true;    
+    
     if (roleValue() == IgnoredRole)
         return true;
     
@@ -1288,7 +1435,7 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
     AccessibilityObject* controlObject = correspondingControlForLabelElement();
-    if (controlObject && !controlObject->exposesTitleUIElement())
+    if (controlObject && !controlObject->exposesTitleUIElement() && controlObject->isCheckboxOrRadio())
         return true;
         
     AccessibilityRole ariaRole = ariaRoleAttribute();
@@ -1300,8 +1447,8 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // NOTE: BRs always have text boxes now, so the text box check here can be removed
     if (m_renderer->isText()) {
         // static text beneath MenuItems and MenuButtons are just reported along with the menu item, so it's ignored on an individual level
-        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole ||
-            parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
+        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole
+            || parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
             return true;
         RenderText* renderText = toRenderText(m_renderer);
         if (m_renderer->isBR() || !renderText->firstTextBox())
@@ -1388,6 +1535,10 @@ int AccessibilityRenderObject::layoutCount() const
 
 String AccessibilityRenderObject::text() const
 {
+    // If this is a user defined static text, use the accessible name computation.
+    if (ariaRoleAttribute() == StaticTextRole)
+        return accessibilityDescription();
+    
     if (!isTextControl() || isPasswordField())
         return String();
     
@@ -1545,6 +1696,46 @@ bool AccessibilityRenderObject::isVisited() const
     return m_renderer->style()->pseudoState() == PseudoVisited;
 }
     
+bool AccessibilityRenderObject::isExpanded() const
+{
+    if (equalIgnoringCase(getAttribute(aria_expandedAttr).string(), "true"))
+        return true;
+    
+    return false;  
+}
+
+void AccessibilityRenderObject::setElementAttributeValue(const QualifiedName& attributeName, bool value)
+{
+    if (!m_renderer)
+        return;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+    
+    Element* element = static_cast<Element*>(node);
+    element->setAttribute(attributeName, (value) ? "true" : "false");        
+}
+    
+bool AccessibilityRenderObject::elementAttributeValue(const QualifiedName& attributeName)
+{
+    if (!m_renderer)
+        return false;
+    
+    return equalIgnoringCase(getAttribute(attributeName).string(), "true");
+}
+    
+void AccessibilityRenderObject::setIsExpanded(bool isExpanded)
+{
+    // Combo boxes and tree items can be expanded (in different ways on different platforms).
+    // That action translates into setting the aria-expanded attribute to true.
+    AccessibilityRole role = roleValue();
+    if (role != ComboBoxRole && role != TreeItemRole)
+        return;
+    
+    setElementAttributeValue(aria_expandedAttr, isExpanded);
+}
+    
 bool AccessibilityRenderObject::isRequired() const
 {
     if (equalIgnoringCase(getAttribute(aria_requiredAttr).string(), "true"))
@@ -1562,9 +1753,56 @@ bool AccessibilityRenderObject::isSelected() const
     if (!node)
         return false;
     
+    String ariaSelected = getAttribute(aria_selectedAttr).string();
+    if (equalIgnoringCase(ariaSelected, "true"))
+        return true;    
+    
+    if (isTabItem() && isTabItemSelected())
+        return true;
+
     return false;
 }
 
+bool AccessibilityRenderObject::isTabItemSelected() const
+{
+    if (!isTabItem() || !m_renderer)
+        return false;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return false;
+    
+    // The ARIA spec says a tab item can also be selected if it is aria-labeled by a tabpanel
+    // that has keyboard focus inside of it, or if a tabpanel in its aria-controls list has KB
+    // focus inside of it.
+    AccessibilityObject* focusedElement = focusedUIElement();
+    if (!focusedElement)
+        return false;
+    
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_controlsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* tabPanel = axObjectCache()->getOrCreate(element->renderer());
+
+        // A tab item should only control tab panels.
+        if (!tabPanel || tabPanel->roleValue() != TabPanelRole)
+            continue;
+        
+        AccessibilityObject* checkFocusElement = focusedElement;
+        // Check if the focused element is a descendant of the element controlled by the tab item.
+        while (checkFocusElement) {
+            if (tabPanel == checkFocusElement)
+                return true;
+            checkFocusElement = checkFocusElement->parentObject();
+        }
+    }
+    
+    return false;
+}
+    
 bool AccessibilityRenderObject::isFocused() const
 {
     if (!m_renderer)
@@ -1580,8 +1818,8 @@ bool AccessibilityRenderObject::isFocused() const
     
     // A web area is represented by the Document node in the DOM tree, which isn't focusable.
     // Check instead if the frame's selection controller is focused
-    if (focusedNode == m_renderer->node() || 
-        (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
+    if (focusedNode == m_renderer->node()
+        || (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
         return true;
     
     return false;
@@ -1613,6 +1851,26 @@ void AccessibilityRenderObject::changeValueByPercent(float percentChange)
     axObjectCache()->postNotification(m_renderer, AXObjectCache::AXValueChanged, true);
 }
     
+void AccessibilityRenderObject::setSelected(bool enabled)
+{
+    setElementAttributeValue(aria_selectedAttr, enabled);
+}
+
+void AccessibilityRenderObject::setSelectedRows(AccessibilityChildrenVector& selectedRows)
+{
+    // Setting selected rows only works on trees for now.
+    if (roleValue() != TreeRole)
+        return;
+    
+    bool isMultiselectable = elementAttributeValue(aria_multiselectableAttr);
+    unsigned count = selectedRows.size();
+    if (count > 1 && !isMultiselectable)
+        count = 1;
+    
+    for (unsigned k = 0; k < count; ++k)
+        selectedRows[k]->setSelected(true);
+}
+    
 void AccessibilityRenderObject::setValue(const String& string)
 {
     if (!m_renderer)
@@ -1632,6 +1890,29 @@ void AccessibilityRenderObject::setValue(const String& string)
     }
 }
 
+void AccessibilityRenderObject::ariaOwnsElements(AccessibilityChildrenVector& axObjects) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_ownsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        RenderObject* render = elements[k]->renderer();
+        AccessibilityObject* obj = axObjectCache()->getOrCreate(render);
+        if (obj)
+            axObjects.append(obj);
+    }
+}
+
+bool AccessibilityRenderObject::supportsARIAOwns() const
+{
+    if (!m_renderer)
+        return false;
+    const AtomicString& ariaOwns = getAttribute(aria_ownsAttr).string();
+
+    return !ariaOwns.isEmpty();
+}
+    
 bool AccessibilityRenderObject::isEnabled() const
 {
     ASSERT(m_renderer);
@@ -1777,7 +2058,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRange() const
 
 VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsigned lineCount) const
 {
-    if (lineCount == 0 || !m_renderer)
+    if (!lineCount || !m_renderer)
         return VisiblePositionRange();
     
     // iterate over the lines
@@ -1785,7 +2066,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsi
     // last offset of the last line
     VisiblePosition visiblePos = m_renderer->document()->renderer()->positionForCoordinates(0, 0);
     VisiblePosition savedVisiblePos;
-    while (--lineCount != 0) {
+    while (--lineCount) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -1900,9 +2181,8 @@ void AccessibilityRenderObject::setSelectedVisiblePositionRange(const VisiblePos
         return;
     
     // make selection and tell the document to use it. if it's zero length, then move to that position
-    if (range.start == range.end) {
+    if (range.start == range.end)
         m_renderer->document()->frame()->selection()->moveTo(range.start, true);
-    }
     else {
         VisibleSelection newSelection = VisibleSelection(range.start, range.end);
         m_renderer->document()->frame()->selection()->setSelection(newSelection);
@@ -1998,7 +2278,7 @@ PlainTextRange AccessibilityRenderObject::doAXRangeForLine(unsigned lineNumber)
     // iterate to the specified line
     VisiblePosition visiblePos = visiblePositionForIndex(0);
     VisiblePosition savedVisiblePos;
-    for (unsigned lineCount = lineNumber; lineCount != 0; lineCount -= 1) {
+    for (unsigned lineCount = lineNumber; lineCount; lineCount -= 1) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -2053,8 +2333,8 @@ String AccessibilityRenderObject::doAXStringForRange(const PlainTextRange& range
     if (isPasswordField())
         return String();
     
-    if (range.length == 0)
-        return "";
+    if (!range.length)
+        return String();
     
     if (!isTextControl())
         return String();
@@ -2081,7 +2361,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTM
     if (!area)
         return 0;
     
-    HTMLMapElement *map = static_cast<HTMLMapElement*>(area->parent());
+    HTMLMapElement* map = static_cast<HTMLMapElement*>(area->parent());
     AccessibilityObject* parent = accessibilityParentForImageMap(map);
     if (!parent)
         return 0;
@@ -2159,14 +2439,14 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
     case ProgressIndicatorRole:
     case ToolbarRole:
     case OutlineRole:
+    case TreeRole:
+    case GridRole:
     /* FIXME: replace these with actual roles when they are added to AccessibilityRole
     composite
     alert
     alertdialog
-    grid
     status
     timer
-    tree
     */
         return true;
     default:
@@ -2176,19 +2456,22 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
 
 AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
 {
-    if (renderer()->node() && !renderer()->node()->isElementNode())
+    if (!m_renderer)
         return 0;
-    Element* element = static_cast<Element*>(renderer()->node());
+    
+    if (m_renderer->node() && !m_renderer->node()->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(m_renderer->node());
         
     String activeDescendantAttrStr = element->getAttribute(aria_activedescendantAttr).string();
     if (activeDescendantAttrStr.isNull() || activeDescendantAttrStr.isEmpty())
         return 0;
     
-    Element* target = renderer()->document()->getElementById(activeDescendantAttrStr);
+    Element* target = document()->getElementById(activeDescendantAttrStr);
     if (!target)
         return 0;
     
-    AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
+    AccessibilityObject* obj = axObjectCache()->getOrCreate(target->renderer());
     if (obj && obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
@@ -2207,7 +2490,7 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotification(activedescendant->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
+        doc->axObjectCache()->postNotification(m_renderer, AXObjectCache::AXActiveDescendantChanged, true);
 }
 
 AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElement() const
@@ -2247,80 +2530,6 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     
     return 0;
 }
-    
-typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
-
-struct RoleEntry {
-    String ariaRole;
-    AccessibilityRole webcoreRole;
-};
-
-static const ARIARoleMap& createARIARoleMap()
-{
-    const RoleEntry roles[] = {
-        { "application", LandmarkApplicationRole },
-        { "article", DocumentArticleRole },
-        { "banner", LandmarkBannerRole },
-        { "button", ButtonRole },
-        { "checkbox", CheckBoxRole },
-        { "complementary", LandmarkComplementaryRole },
-        { "contentinfo", LandmarkContentInfoRole },
-        { "grid", TableRole },
-        { "gridcell", CellRole },
-        { "columnheader", ColumnHeaderRole },
-        { "definition", DefinitionListDefinitionRole },
-        { "document", DocumentRole },
-        { "rowheader", RowHeaderRole },
-        { "group", GroupRole },
-        { "heading", HeadingRole },
-        { "img", ImageRole },
-        { "link", WebCoreLinkRole },
-        { "list", ListRole },        
-        { "listitem", GroupRole },        
-        { "listbox", ListBoxRole },
-        { "log", ApplicationLogRole },
-        // "option" isn't here because it may map to different roles depending on the parent element's role
-        { "main", LandmarkMainRole },
-        { "marquee", ApplicationMarqueeRole },
-        { "menu", MenuRole },
-        { "menubar", GroupRole },
-        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
-        { "menuitemcheckbox", MenuItemRole },
-        { "menuitemradio", MenuItemRole },
-        { "note", DocumentNoteRole },
-        { "navigation", LandmarkNavigationRole },
-        { "option", ListBoxOptionRole },
-        { "presentation", IgnoredRole },
-        { "progressbar", ProgressIndicatorRole },
-        { "radio", RadioButtonRole },
-        { "radiogroup", RadioGroupRole },
-        { "region", DocumentRegionRole },
-        { "row", RowRole },
-        { "range", SliderRole },
-        { "search", LandmarkSearchRole },
-        { "separator", SplitterRole },
-        { "slider", SliderRole },
-        { "spinbutton", ProgressIndicatorRole },
-        { "status", ApplicationStatusRole },
-        { "textbox", TextAreaRole },
-        { "timer", ApplicationTimerRole },
-        { "toolbar", ToolbarRole },
-        { "tooltip", UserInterfaceTooltipRole }
-    };
-    ARIARoleMap& roleMap = *new ARIARoleMap;
-        
-    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
-    for (unsigned i = 0; i < numRoles; ++i)
-        roleMap.set(roles[i].ariaRole, roles[i].webcoreRole);
-    return roleMap;
-}
-
-static AccessibilityRole ariaRoleToWebCoreRole(String value)
-{
-    ASSERT(!value.isEmpty() && !value.isNull());
-    static const ARIARoleMap& roleMap = createARIARoleMap();
-    return roleMap.get(value);
-}
 
 AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
 {
@@ -2332,14 +2541,14 @@ AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
     if (role)
         return role;
     // selects and listboxes both have options as child roles, but they map to different roles within WebCore
-    if (equalIgnoringCase(ariaRole,"option")) {
+    if (equalIgnoringCase(ariaRole, "option")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
             return MenuItemRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == ListBoxRole)
             return ListBoxOptionRole;
     }
     // an aria "menuitem" may map to MenuButton or MenuItem depending on its parent
-    if (equalIgnoringCase(ariaRole,"menuitem")) {
+    if (equalIgnoringCase(ariaRole, "menuitem")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == GroupRole)
             return MenuButtonRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
@@ -2418,7 +2627,7 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     if (m_renderer->isMenuList())
         return PopUpButtonRole;
     
-    if (headingLevel() != 0)
+    if (headingLevel())
         return HeadingRole;
     
     if (node && node->hasTagName(ddTag))
@@ -2436,12 +2645,24 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     return UnknownRole;
 }
 
+AccessibilityOrientation AccessibilityRenderObject::orientation() const
+{
+    const AtomicString& ariaOrientation = getAttribute(aria_orientationAttr).string();
+    if (equalIgnoringCase(ariaOrientation, "horizontal"))
+        return AccessibilityOrientationHorizontal;
+    if (equalIgnoringCase(ariaOrientation, "vertical"))
+        return AccessibilityOrientationVertical;
+    
+    return AccessibilityObject::orientation();
+}
+    
 bool AccessibilityRenderObject::isPresentationalChildOfAriaRole() const
 {
     // Walk the parent chain looking for a parent that has presentational children
     AccessibilityObject* parent;
     for (parent = parentObject(); parent && !parent->ariaRoleHasPresentationalChildren(); parent = parent->parentObject())
-        ;
+    { }
+    
     return parent;
 }
     
@@ -2474,20 +2695,27 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
         return false;
 
     switch (roleValue()) {
-        case WebCoreLinkRole:
-        case ImageMapLinkRole:
-        case TextFieldRole:
-        case TextAreaRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case SliderRole:
-            return true;
-        default:
-            return false;
+    case WebCoreLinkRole:
+    case ImageMapLinkRole:
+    case TextFieldRole:
+    case TextAreaRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case SliderRole:
+        return true;
+    default:
+        return false;
     }
 }
+    
+bool AccessibilityRenderObject::canSetExpandedAttribute() const
+{
+    // An object can be expanded if it aria-expanded is true or false.
+    String ariaExpanded = getAttribute(aria_expandedAttr).string();
+    return equalIgnoringCase(ariaExpanded, "true") || equalIgnoringCase(ariaExpanded, "false");
+}
 
 bool AccessibilityRenderObject::canSetValueAttribute() const
 {
@@ -2531,16 +2759,18 @@ bool AccessibilityRenderObject::canHaveChildren() const
     
     // Elements that should not have children
     switch (roleValue()) {
-        case ImageRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case StaticTextRole:
-        case ListBoxOptionRole:
-            return false;
-        default:
-            return true;
+    case ImageRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case TabRole:
+    case StaticTextRole:
+    case ListBoxOptionRole:
+    case ScrollBarRole:
+        return false;
+    default:
+        return true;
     }
 }
 
@@ -2604,17 +2834,42 @@ void AccessibilityRenderObject::addChildren()
     }
 }
 
+void AccessibilityRenderObject::ariaTreeSelectedRows(AccessibilityChildrenVector& result)
+{
+    // Get all the rows. 
+    AccessibilityChildrenVector allRows;
+    ariaTreeRows(allRows);
+
+    // Determine which rows are selected.
+    bool isMultiselectable = elementAttributeValue(aria_multiselectableAttr);
+
+    // Prefer active descendant over aria-selected.
+    AccessibilityObject* activeDesc = activeDescendant();
+    if (activeDesc && activeDesc->isTreeItem()) {
+        result.append(activeDesc);    
+        if (!isMultiselectable)
+            return;
+    }
+
+    unsigned count = allRows.size();
+    for (unsigned k = 0; k < count; ++k) {
+        if (allRows[k]->isSelected()) {
+            result.append(allRows[k]);
+            if (!isMultiselectable)
+                break;
+        }
+    }
+}
+    
 void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildrenVector& result)
 {
     AccessibilityObject* child = firstChild();
-    bool isMultiselectable = false;
     
     Element* element = static_cast<Element*>(renderer()->node());        
     if (!element || !element->isElementNode()) // do this check to ensure safety of static_cast above
         return;
 
-    String multiselectablePropertyStr = element->getAttribute("aria-multiselectable").string();
-    isMultiselectable = equalIgnoringCase(multiselectablePropertyStr, "true");
+    bool isMultiselectable = elementAttributeValue(aria_multiselectableAttr);
     
     while (child) {
         // every child should have aria-role option, and if so, check for selected attribute/state
@@ -2625,7 +2880,7 @@ void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildre
         if (childRenderer && ariaRole == ListBoxOptionRole) {
             Element* childElement = static_cast<Element*>(childRenderer->node());
             if (childElement && childElement->isElementNode()) { // do this check to ensure safety of static_cast above
-                String selectedAttrString = childElement->getAttribute("aria-selected").string();
+                String selectedAttrString = childElement->getAttribute(aria_selectedAttr).string();
                 if (equalIgnoringCase(selectedAttrString, "true")) {
                     result.append(child);
                     if (isMultiselectable)
@@ -2642,11 +2897,11 @@ void AccessibilityRenderObject::selectedChildren(AccessibilityChildrenVector& re
     ASSERT(result.isEmpty());
 
     // only listboxes should be asked for their selected children. 
-    if (ariaRoleAttribute() != ListBoxRole) { // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
-        ASSERT_NOT_REACHED(); 
-        return;
-    }
-    return ariaListboxSelectedChildren(result);
+    AccessibilityRole role = roleValue();
+    if (role == ListBoxRole) // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
+        ariaListboxSelectedChildren(result);
+    else if (role == TreeRole)
+        ariaTreeSelectedRows(result);
 }
 
 void AccessibilityRenderObject::ariaListboxVisibleChildren(AccessibilityChildrenVector& result)      
@@ -2673,6 +2928,17 @@ void AccessibilityRenderObject::visibleChildren(AccessibilityChildrenVector& res
     return ariaListboxVisibleChildren(result);
 }
  
+void AccessibilityRenderObject::tabChildren(AccessibilityChildrenVector& result)
+{
+    ASSERT(roleValue() == TabListRole);
+    
+    unsigned length = m_children.size();
+    for (unsigned i = 0; i < length; ++i) {
+        if (m_children[i]->isTabItem())
+            result.append(m_children[i]);
+    }
+}
+    
 const String& AccessibilityRenderObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -2685,20 +2951,20 @@ const String& AccessibilityRenderObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, noAction, ());
     
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    default:
+        return noAction;
     }
 }
      
@@ -2711,4 +2977,101 @@ void AccessibilityRenderObject::updateBackingStore()
     m_renderer->document()->updateLayoutIgnorePendingStylesheets();
 }
 
+static bool isLinkable(const AccessibilityRenderObject& object)
+{
+    if (!object.renderer())
+        return false;
+
+    // See https://wiki.mozilla.org/Accessibility/AT-Windows-API for the elements
+    // Mozilla considers linkable.
+    return object.isLink() || object.isImage() || object.renderer()->isText();
+}
+
+String AccessibilityRenderObject::stringValueForMSAA() const
+{
+    if (isLinkable(*this)) {
+        Element* anchor = anchorElement();
+        if (anchor && anchor->hasTagName(aTag))
+            return static_cast<HTMLAnchorElement*>(anchor)->href();
+    }
+
+    return stringValue();
+}
+
+bool AccessibilityRenderObject::isLinked() const
+{
+    if (!isLinkable(*this))
+        return false;
+
+    Element* anchor = anchorElement();
+    if (!anchor || !anchor->hasTagName(aTag))
+        return false;
+
+    return !static_cast<HTMLAnchorElement*>(anchor)->href().isEmpty();
+}
+
+String AccessibilityRenderObject::nameForMSAA() const
+{
+    if (m_renderer && m_renderer->isText())
+        return textUnderElement();
+
+    return title();
+}
+
+static bool shouldReturnTagNameAsRoleForMSAA(const Element& element)
+{
+    // See "document structure",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    // FIXME: Add the other tag names that should be returned as the role.
+    return element.hasTagName(h1Tag) || element.hasTagName(h2Tag) 
+        || element.hasTagName(h3Tag) || element.hasTagName(h4Tag)
+        || element.hasTagName(h5Tag) || element.hasTagName(h6Tag);
+}
+
+String AccessibilityRenderObject::stringRoleForMSAA() const
+{
+    if (!m_renderer)
+        return String();
+
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return String();
+
+    Element* element = static_cast<Element*>(node);
+    if (!shouldReturnTagNameAsRoleForMSAA(*element))
+        return String();
+
+    return element->tagName();
+}
+
+String AccessibilityRenderObject::positionalDescriptionForMSAA() const
+{
+    // See "positional descriptions",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    if (isHeading())
+        return "L" + String::number(headingLevel());
+
+    // FIXME: Add positional descriptions for other elements.
+    return String();
+}
+
+String AccessibilityRenderObject::descriptionForMSAA() const
+{
+    String description = positionalDescriptionForMSAA();
+    if (!description.isEmpty())
+        return description;
+
+    description = accessibilityDescription();
+    if (!description.isEmpty()) {
+        // From the Mozilla MSAA implementation:
+        // "Signal to screen readers that this description is speakable and is not
+        // a formatted positional information description. Don't localize the
+        // 'Description: ' part of this string, it will be parsed out by assistive
+        // technologies."
+        return "Description: " + description;
+    }
+
+    return String();
+}
+
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityRenderObject.h b/WebCore/accessibility/AccessibilityRenderObject.h
index c6fd748..d537881 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/WebCore/accessibility/AccessibilityRenderObject.h
@@ -62,7 +62,7 @@ public:
     static PassRefPtr<AccessibilityRenderObject> create(RenderObject*);
     virtual ~AccessibilityRenderObject();
     
-    bool isAccessibilityRenderObject() const { return true; };
+    bool isAccessibilityRenderObject() const { return true; }
     
     virtual bool isAnchor() const;
     virtual bool isAttachment() const;
@@ -102,12 +102,16 @@ public:
     virtual bool isReadOnly() const;
     virtual bool isVisited() const;        
     virtual bool isRequired() const;
+    virtual bool isLinked() const;
+    virtual bool isExpanded() const;
+    virtual void setIsExpanded(bool);
 
     const AtomicString& getAttribute(const QualifiedName&) const;
     virtual bool canSetFocusAttribute() const;
     virtual bool canSetTextRangeAttributes() const;
     virtual bool canSetValueAttribute() const;
-    
+    virtual bool canSetExpandedAttribute() const;
+
     virtual bool hasIntValue() const;
     
     virtual bool accessibilityIsIgnored() const;
@@ -119,6 +123,7 @@ public:
     virtual float maxValueForRange() const;
     virtual float minValueForRange() const;
     virtual AccessibilityObject* selectedRadioButton();
+    virtual AccessibilityObject* selectedTabItem();
     virtual int layoutCount() const;
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
@@ -136,6 +141,8 @@ public:
     virtual AccessibilityObject* correspondingControlForLabelElement() const;
     virtual AccessibilityObject* correspondingLabelForControlElement() const;
 
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const;
+    virtual bool supportsARIAOwns() const;
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
@@ -167,7 +174,6 @@ public:
     virtual PlainTextRange selectedTextRange() const;
     virtual VisibleSelection selection() const;
     virtual String stringValue() const;
-    virtual String ariaAccessibilityName(const String&) const;
     virtual String ariaLabeledByAttribute() const;
     virtual String title() const;
     virtual String ariaDescribedByAttribute() const;
@@ -185,13 +191,17 @@ public:
     virtual void getDocumentLinks(AccessibilityChildrenVector&);
     virtual FrameView* documentFrameView() const;
     virtual String language() const;
-    
+    virtual unsigned hierarchicalLevel() const;
+
     virtual const AccessibilityChildrenVector& children();
     
     virtual void setFocused(bool);
     virtual void setSelectedTextRange(const PlainTextRange&);
     virtual void setValue(const String&);
+    virtual void setSelected(bool);
+    virtual void setSelectedRows(AccessibilityChildrenVector&);
     virtual void changeValueByPercent(float percentChange);
+    virtual AccessibilityOrientation orientation() const;
     virtual void increment();
     virtual void decrement();
     
@@ -201,6 +211,7 @@ public:
     virtual bool canHaveChildren() const;
     virtual void selectedChildren(AccessibilityChildrenVector&);
     virtual void visibleChildren(AccessibilityChildrenVector&);
+    virtual void tabChildren(AccessibilityChildrenVector&);
     virtual bool shouldFocusActiveDescendant() const;
     virtual AccessibilityObject* activeDescendant() const;
     virtual void handleActiveDescendantChanged();
@@ -209,6 +220,14 @@ public:
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const;
     virtual IntRect boundsForVisiblePositionRange(const VisiblePositionRange&) const;
     virtual void setSelectedVisiblePositionRange(const VisiblePositionRange&) const;
+    virtual bool supportsARIAFlowTo() const;
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const;
+
+    virtual bool supportsARIADropping();
+    virtual bool supportsARIADragging();
+    virtual bool isARIAGrabbed();
+    virtual void setARIAGrabbed(bool);
+    virtual void determineARIADropEffects(Vector<String>&);
     
     virtual VisiblePosition visiblePositionForPoint(const IntPoint&) const;
     virtual VisiblePosition visiblePositionForIndex(unsigned indexValue, bool lastIndexOK) const;    
@@ -224,13 +243,19 @@ public:
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const;
     
     virtual void updateBackingStore();
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String stringRoleForMSAA() const;
+    virtual String nameForMSAA() const;
+    virtual String descriptionForMSAA() const;
+
 protected:
     RenderObject* m_renderer;
     AccessibilityRole m_ariaRole;
     mutable bool m_childrenDirty;
     
     void setRenderObject(RenderObject* renderer) { m_renderer = renderer; }
+    void ariaLabeledByElements(Vector<Element*>& elements) const;
     
     virtual bool isDetached() const { return !m_renderer; }
 
@@ -238,18 +263,30 @@ private:
     void ariaListboxSelectedChildren(AccessibilityChildrenVector&);
     void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
     bool ariaIsHidden() const;
+    bool isDescendantOfBarrenParent() const;
+    bool hasTextAlternative() const;
+    String positionalDescriptionForMSAA() const;
 
     Element* menuElementForMenuButton() const;
     Element* menuItemElementForMenu() const;
     AccessibilityRole determineAccessibilityRole();
     AccessibilityRole determineAriaRoleAttribute() const;
 
+    bool isTabItemSelected() const;
     IntRect checkboxOrRadioRect() const;
     void addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const;
     AccessibilityObject* internalLinkElement() const;
     AccessibilityObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;
     AccessibilityObject* accessibilityParentForImageMap(HTMLMapElement* map) const;
 
+    void ariaTreeSelectedRows(AccessibilityChildrenVector&);
+    
+    bool elementAttributeValue(const QualifiedName&);
+    void setElementAttributeValue(const QualifiedName&, bool);
+    
+    String accessibilityDescriptionForElements(Vector<Element*> &elements) const;
+    void elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& name) const;
+    
     void markChildrenDirty() const { m_childrenDirty = true; }
 };
     
diff --git a/WebCore/accessibility/AccessibilitySlider.cpp b/WebCore/accessibility/AccessibilitySlider.cpp
index 5aca672..77f4dcc 100644
--- a/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/WebCore/accessibility/AccessibilitySlider.cpp
@@ -68,18 +68,18 @@ AccessibilityOrientation AccessibilitySlider::orientation() const
     
     ControlPart styleAppearance = style->appearance();
     switch (styleAppearance) {
-        case SliderThumbHorizontalPart:
-        case SliderHorizontalPart:
-        case MediaSliderPart:
-            return AccessibilityOrientationHorizontal;
+    case SliderThumbHorizontalPart:
+    case SliderHorizontalPart:
+    case MediaSliderPart:
+        return AccessibilityOrientationHorizontal;
+    
+    case SliderThumbVerticalPart: 
+    case SliderVerticalPart:
+    case MediaVolumeSliderPart:
+        return AccessibilityOrientationVertical;
         
-        case SliderThumbVerticalPart: 
-        case SliderVerticalPart:
-        case MediaVolumeSliderPart:
-            return AccessibilityOrientationVertical;
-            
-        default:
-            return AccessibilityOrientationHorizontal;
+    default:
+        return AccessibilityOrientationHorizontal;
     }
 }
     
diff --git a/WebCore/accessibility/AccessibilitySlider.h b/WebCore/accessibility/AccessibilitySlider.h
index 254ebdd..e1e3812 100644
--- a/WebCore/accessibility/AccessibilitySlider.h
+++ b/WebCore/accessibility/AccessibilitySlider.h
@@ -33,58 +33,58 @@
 
 namespace WebCore {
 
-    class HTMLInputElement;
+class HTMLInputElement;
 
-    class AccessibilitySlider : public AccessibilityRenderObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySlider> create(RenderObject*);
-        virtual ~AccessibilitySlider() { }
+class AccessibilitySlider : public AccessibilityRenderObject {
+    
+public:
+    static PassRefPtr<AccessibilitySlider> create(RenderObject*);
+    virtual ~AccessibilitySlider() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        virtual bool isSlider() const { return true; }
+    virtual bool isSlider() const { return true; }
 
-        virtual const AccessibilityChildrenVector& children();
-        virtual void addChildren();
+    virtual const AccessibilityChildrenVector& children();
+    virtual void addChildren();
 
-        virtual bool canSetValueAttribute() const { return true; };
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual bool canSetValueAttribute() const { return true; }
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-        virtual void setValue(const String&);
-        virtual float valueForRange() const;
-        virtual float maxValueForRange() const;
-        virtual float minValueForRange() const;
-        virtual AccessibilityOrientation orientation() const;
+    virtual void setValue(const String&);
+    virtual float valueForRange() const;
+    virtual float maxValueForRange() const;
+    virtual float minValueForRange() const;
+    virtual AccessibilityOrientation orientation() const;
 
-    protected:
-        AccessibilitySlider(RenderObject*);
+protected:
+    AccessibilitySlider(RenderObject*);
 
-    private:
-        HTMLInputElement* element() const;
-    };
+private:
+    HTMLInputElement* element() const;
+};
 
-    class AccessibilitySliderThumb : public AccessibilityObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySliderThumb> create();
-        virtual ~AccessibilitySliderThumb() { }
+class AccessibilitySliderThumb : public AccessibilityObject {
+    
+public:
+    static PassRefPtr<AccessibilitySliderThumb> create();
+    virtual ~AccessibilitySliderThumb() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
-        virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
+    void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
+    virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
 
-        virtual IntSize size() const;
-        virtual IntRect elementRect() const;
+    virtual IntSize size() const;
+    virtual IntRect elementRect() const;
 
-    private:
-        AccessibilitySliderThumb();
+private:
+    AccessibilitySliderThumb();
 
-        AccessibilitySlider* m_parentSlider;
-    };
+    AccessibilitySlider* m_parentSlider;
+};
 
 
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityTable.cpp b/WebCore/accessibility/AccessibilityTable.cpp
index 928ef2c..9ac1046 100644
--- a/WebCore/accessibility/AccessibilityTable.cpp
+++ b/WebCore/accessibility/AccessibilityTable.cpp
@@ -29,15 +29,15 @@
 #include "config.h"
 #include "AccessibilityTable.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "HTMLNames.h"
-#include "HTMLTableElement.h"
 #include "HTMLTableCaptionElement.h"
 #include "HTMLTableCellElement.h"
+#include "HTMLTableElement.h"
 #include "RenderObject.h"
 #include "RenderTable.h"
 #include "RenderTableCell.h"
@@ -149,8 +149,8 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
             HTMLTableCellElement* cellElement = static_cast<HTMLTableCellElement*>(cellNode);
             
             // in this case, the developer explicitly assigned a "data" table attribute
-            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty() || 
-                !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
+            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty()
+                || !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
                 return true;
             
             RenderStyle* renderStyle = cell->style();
@@ -158,15 +158,15 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
                 continue;
 
             // a cell needs to have matching bordered sides, before it can be considered a bordered cell.
-            if ((cell->borderTop() > 0 && cell->borderBottom() > 0) ||
-                (cell->borderLeft() > 0 && cell->borderRight() > 0))
+            if ((cell->borderTop() > 0 && cell->borderBottom() > 0)
+                || (cell->borderLeft() > 0 && cell->borderRight() > 0))
                 borderedCellCount++;
             
             // if the cell has a different color from the table and there is cell spacing,
             // then it is probably a data table cell (spacing and colors take the place of borders)
             Color cellColor = renderStyle->backgroundColor();
-            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0 && 
-                tableBGColor != cellColor && cellColor.alpha() != 1)
+            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0
+                && tableBGColor != cellColor && cellColor.alpha() != 1)
                 backgroundDifferenceCellCount++;
             
             // if we've found 10 "good" cells, we don't need to keep searching
diff --git a/WebCore/accessibility/AccessibilityTableColumn.cpp b/WebCore/accessibility/AccessibilityTableColumn.cpp
index e09d65e..ee8531e 100644
--- a/WebCore/accessibility/AccessibilityTableColumn.cpp
+++ b/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -29,12 +29,12 @@
 #include "config.h"
 #include "AccessibilityTableColumn.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "RenderTable.h"
-#include "RenderTableSection.h"
 #include "RenderTableCell.h"
+#include "RenderTableSection.h"
 
 using namespace std;
 
diff --git a/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp b/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
index af9de39..3a2a241 100644
--- a/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
+++ b/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableHeaderContainer.h"
 
-#include "AccessibilityTable.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTable.h"
 
 using namespace std;
 
@@ -79,9 +79,8 @@ void AccessibilityTableHeaderContainer::addChildren()
     static_cast<AccessibilityTable*>(m_parentTable)->columnHeaders(m_children);
     
     unsigned length = m_children.size();
-    for (unsigned k = 0; k < length; ++k) {
+    for (unsigned k = 0; k < length; ++k)
         m_headerRect.unite(m_children[k]->elementRect());
-    }
 }
 
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityTableRow.cpp b/WebCore/accessibility/AccessibilityTableRow.cpp
index 53b479e..71f8b2b 100644
--- a/WebCore/accessibility/AccessibilityTableRow.cpp
+++ b/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableRow.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "HTMLTableRowElement.h"
 #include "RenderObject.h"
diff --git a/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h b/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h
index d7238e1..85a65ed 100644
--- a/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h
+++ b/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h
@@ -27,6 +27,8 @@
 #ifndef AccessibilityObjectWrapper_h
 #define AccessibilityObjectWrapper_h
 
+#include <wtf/RefCounted.h>
+
 namespace WebCore {
 
     class AccessibilityObject;
@@ -41,8 +43,6 @@ namespace WebCore {
         AccessibilityObjectWrapper(AccessibilityObject* obj)
             : m_object(obj)
         {
-            // FIXME: Remove this once our immediate subclass no longer uses COM.
-            *addressOfCount() = 0;
         }
         AccessibilityObjectWrapper() : m_object(0) { }
 
diff --git a/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
index cc515ad..c30b006 100644
--- a/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
+++ b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
@@ -43,6 +43,10 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, AX
         if (!coreObject->isCheckboxOrRadio())
             return;
         g_signal_emit_by_name(coreObject->wrapper(), "state-change", "checked", coreObject->isChecked());
+    } else if (notification == AXSelectedChildrenChanged) {
+        if (!coreObject->isListBox())
+            return;
+        g_signal_emit_by_name(coreObject->wrapper(), "selection-changed");
     }
 }
 
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index c5f09ae..16ea948 100644
--- a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -35,6 +35,7 @@
 
 #include "AXObjectCache.h"
 #include "AccessibilityListBox.h"
+#include "AccessibilityListBoxOption.h"
 #include "AccessibilityRenderObject.h"
 #include "AccessibilityTable.h"
 #include "AccessibilityTableCell.h"
@@ -43,6 +44,7 @@
 #include "AtomicString.h"
 #include "CString.h"
 #include "Document.h"
+#include "DocumentType.h"
 #include "Editor.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -106,6 +108,11 @@ static AccessibilityObject* core(AtkAction* action)
     return core(ATK_OBJECT(action));
 }
 
+static AccessibilityObject* core(AtkSelection* selection)
+{
+    return core(ATK_OBJECT(selection));
+}
+
 static AccessibilityObject* core(AtkText* text)
 {
     return core(ATK_OBJECT(text));
@@ -131,39 +138,72 @@ static AccessibilityObject* core(AtkTable* table)
     return core(ATK_OBJECT(table));
 }
 
+static AccessibilityObject* core(AtkDocument* document)
+{
+    return core(ATK_OBJECT(document));
+}
+
+static const gchar* nameFromChildren(AccessibilityObject* object)
+{
+    if (!object)
+        return 0;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector children = object->children();
+    // Currently, object->stringValue() should be an empty String. This might not be the case down the road.
+    String name = object->stringValue();
+    for (unsigned i = 0; i < children.size(); ++i)
+        name += children.at(i).get()->stringValue();
+    return returnString(name);
+}
+
 static const gchar* webkit_accessible_get_name(AtkObject* object)
 {
     AccessibilityObject* coreObject = core(object);
+    if (!coreObject->isAccessibilityRenderObject())
+        return returnString(coreObject->stringValue());
+
+    AccessibilityRenderObject* renderObject = static_cast<AccessibilityRenderObject*>(coreObject);
     if (coreObject->isControl()) {
-        AccessibilityRenderObject* renderObject = static_cast<AccessibilityRenderObject*>(coreObject);
         AccessibilityObject* label = renderObject->correspondingLabelForControlElement();
-        if (label) {
-            AccessibilityRenderObject::AccessibilityChildrenVector children = label->children();
-            // Currently, label->stringValue() should be an empty String. This
-            // might not be the case down the road.
-            String name = label->stringValue();
-            for (unsigned i = 0; i < children.size(); ++i)
-                name += children.at(i).get()->stringValue();
-            return returnString(name);
+        if (label)
+            return returnString(nameFromChildren(label));
+    }
+
+    if (renderObject->isImage() || renderObject->isInputImage()) {
+        Node* node = renderObject->renderer()->node();
+        if (node && node->isHTMLElement()) {
+            // Get the attribute rather than altText String so as not to fall back on title.
+            String alt = static_cast<HTMLElement*>(node)->getAttribute(HTMLNames::altAttr);
+            if (!alt.isEmpty())
+                return returnString(alt);
         }
     }
+
     return returnString(coreObject->stringValue());
 }
 
 static const gchar* webkit_accessible_get_description(AtkObject* object)
 {
     AccessibilityObject* coreObject = core(object);
+    Node* node = 0;
+    if (coreObject->isAccessibilityRenderObject())
+        node = static_cast<AccessibilityRenderObject*>(coreObject)->renderer()->node();
+    if (!node || !node->isHTMLElement() || coreObject->ariaRoleAttribute() != UnknownRole)
+        return returnString(coreObject->accessibilityDescription());
 
     // atk_table_get_summary returns an AtkObject. We have no summary object, so expose summary here.
-    if (coreObject->roleValue() == TableRole && coreObject->ariaRoleAttribute() == UnknownRole) {
-        Node* node = static_cast<AccessibilityRenderObject*>(coreObject)->renderer()->node();
-        if (node && node->isHTMLElement()) {
-            String summary = static_cast<HTMLTableElement*>(node)->summary();
-            if (!summary.isEmpty())
-                return returnString(summary);
-        }
+    if (coreObject->roleValue() == TableRole) {
+        String summary = static_cast<HTMLTableElement*>(node)->summary();
+        if (!summary.isEmpty())
+            return returnString(summary);
     }
 
+    // The title attribute should be reliably available as the object's descripton.
+    // We do not want to fall back on other attributes in its absence. See bug 25524.
+    String title = static_cast<HTMLElement*>(node)->title();
+    if (!title.isEmpty())
+        return returnString(title);
+
     return returnString(coreObject->accessibilityDescription());
 }
 
@@ -181,9 +221,9 @@ static void setAtkRelationSetFromCoreObject(AccessibilityObject* coreObject, Atk
     }
 }
 
-static gpointer webkit_accessible_parent_class = NULL;
+static gpointer webkit_accessible_parent_class = 0;
 
-static AtkObject* webkit_accessible_get_parent(AtkObject* object)
+static AtkObject* atkParentOfWebView(AtkObject* object)
 {
     AccessibilityObject* coreParent = core(object)->parentObjectUnignored();
 
@@ -203,7 +243,19 @@ static AtkObject* webkit_accessible_get_parent(AtkObject* object)
     }
 
     if (!coreParent)
-        return NULL;
+        return 0;
+
+    return coreParent->wrapper();
+}
+
+static AtkObject* webkit_accessible_get_parent(AtkObject* object)
+{
+    AccessibilityObject* coreParent = core(object)->parentObjectUnignored();
+    if (!coreParent && core(object)->isWebArea())
+        return atkParentOfWebView(object);
+
+    if (!coreParent)
+        return 0;
 
     return coreParent->wrapper();
 }
@@ -216,14 +268,14 @@ static gint webkit_accessible_get_n_children(AtkObject* object)
 static AtkObject* webkit_accessible_ref_child(AtkObject* object, gint index)
 {
     AccessibilityObject* coreObject = core(object);
+    AccessibilityObject::AccessibilityChildrenVector children = coreObject->children();
+    if (index < 0 || static_cast<unsigned>(index) >= children.size())
+        return 0;
 
-    g_return_val_if_fail(index >= 0, NULL);
-    g_return_val_if_fail(static_cast<size_t>(index) < coreObject->children().size(), NULL);
-
-    AccessibilityObject* coreChild = coreObject->children().at(index).get();
+    AccessibilityObject* coreChild = children.at(index).get();
 
     if (!coreChild)
-        return NULL;
+        return 0;
 
     AtkObject* child = coreChild->wrapper();
     atk_object_set_parent(child, object);
@@ -237,7 +289,20 @@ static gint webkit_accessible_get_index_in_parent(AtkObject* object)
     AccessibilityObject* coreObject = core(object);
     AccessibilityObject* parent = coreObject->parentObjectUnignored();
 
-    g_return_val_if_fail(parent, 0);
+    if (!parent && core(object)->isWebArea()) {
+        AtkObject* atkParent = atkParentOfWebView(object);
+        if (!atkParent)
+            return -1;
+
+        unsigned count = atk_object_get_n_accessible_children(atkParent);
+        for (unsigned i = 0; i < count; ++i) {
+            AtkObject* child = atk_object_ref_accessible_child(atkParent, i);
+            bool childIsObject = child == object;
+            g_object_unref(child);
+            if (childIsObject)
+                return i;
+        }
+    }
 
     AccessibilityObject::AccessibilityChildrenVector children = parent->children();
     unsigned count = children.size();
@@ -246,7 +311,7 @@ static gint webkit_accessible_get_index_in_parent(AtkObject* object)
             return i;
     }
 
-    return 0;
+    return -1;
 }
 
 static AtkAttributeSet* addAttributeToSet(AtkAttributeSet* attributeSet, const char* name, const char* value)
@@ -261,7 +326,7 @@ static AtkAttributeSet* addAttributeToSet(AtkAttributeSet* attributeSet, const c
 
 static AtkAttributeSet* webkit_accessible_get_attributes(AtkObject* object)
 {
-    AtkAttributeSet* attributeSet = NULL;
+    AtkAttributeSet* attributeSet = 0;
 
     int headingLevel = core(object)->headingLevel();
     if (headingLevel) {
@@ -361,21 +426,21 @@ static AtkRole atkRole(AccessibilityRole role)
 
 static AtkRole webkit_accessible_get_role(AtkObject* object)
 {
-    AccessibilityObject* AXObject = core(object);
+    AccessibilityObject* axObject = core(object);
 
-    if (!AXObject)
+    if (!axObject)
         return ATK_ROLE_UNKNOWN;
 
     // WebCore does not seem to have a role for list items
-    if (AXObject->isGroup()) {
-        AccessibilityObject* parent = AXObject->parentObjectUnignored();
+    if (axObject->isGroup()) {
+        AccessibilityObject* parent = axObject->parentObjectUnignored();
         if (parent && parent->isList())
             return ATK_ROLE_LIST_ITEM;
     }
 
     // WebCore does not know about paragraph role, label role, or section role
-    if (AXObject->isAccessibilityRenderObject()) {
-        Node* node = static_cast<AccessibilityRenderObject*>(AXObject)->renderer()->node();
+    if (axObject->isAccessibilityRenderObject()) {
+        Node* node = static_cast<AccessibilityRenderObject*>(axObject)->renderer()->node();
         if (node) {
             if (node->hasTagName(HTMLNames::pTag))
                 return ATK_ROLE_PARAGRAPH;
@@ -387,10 +452,10 @@ static AtkRole webkit_accessible_get_role(AtkObject* object)
     }
 
     // Note: Why doesn't WebCore have a password field for this
-    if (AXObject->isPasswordField())
+    if (axObject->isPasswordField())
         return ATK_ROLE_PASSWORD_TEXT;
 
-    return atkRole(AXObject->roleValue());
+    return atkRole(axObject->roleValue());
 }
 
 static void setAtkStateSetFromCoreObject(AccessibilityObject* coreObject, AtkStateSet* stateSet)
@@ -549,15 +614,15 @@ webkit_accessible_get_type(void)
     if (g_once_init_enter(&type_volatile)) {
         static const GTypeInfo tinfo = {
             sizeof(WebKitAccessibleClass),
-            (GBaseInitFunc)NULL,
-            (GBaseFinalizeFunc)NULL,
-            (GClassInitFunc)webkit_accessible_class_init,
-            (GClassFinalizeFunc)NULL,
-            NULL, /* class data */
+            (GBaseInitFunc) 0,
+            (GBaseFinalizeFunc) 0,
+            (GClassInitFunc) webkit_accessible_class_init,
+            (GClassFinalizeFunc) 0,
+            0, /* class data */
             sizeof(WebKitAccessible), /* instance size */
             0, /* nb preallocs */
-            (GInstanceInitFunc)NULL,
-            NULL /* value table */
+            (GInstanceInitFunc) 0,
+            0 /* value table */
         };
 
         GType type = g_type_register_static(ATK_TYPE_OBJECT,
@@ -581,7 +646,7 @@ static gint webkit_accessible_action_get_n_actions(AtkAction* action)
 
 static const gchar* webkit_accessible_action_get_description(AtkAction* action, gint i)
 {
-    g_return_val_if_fail(i == 0, NULL);
+    g_return_val_if_fail(i == 0, 0);
     // TODO: Need a way to provide/localize action descriptions.
     notImplemented();
     return "";
@@ -589,14 +654,14 @@ static const gchar* webkit_accessible_action_get_description(AtkAction* action,
 
 static const gchar* webkit_accessible_action_get_keybinding(AtkAction* action, gint i)
 {
-    g_return_val_if_fail(i == 0, NULL);
+    g_return_val_if_fail(i == 0, 0);
     // FIXME: Construct a proper keybinding string.
     return returnString(core(action)->accessKey().string());
 }
 
 static const gchar* webkit_accessible_action_get_name(AtkAction* action, gint i)
 {
-    g_return_val_if_fail(i == 0, NULL);
+    g_return_val_if_fail(i == 0, 0);
     return returnString(core(action)->actionVerb());
 }
 
@@ -609,6 +674,145 @@ static void atk_action_interface_init(AtkActionIface* iface)
     iface->get_name = webkit_accessible_action_get_name;
 }
 
+// Selection (for controls)
+
+static AccessibilityObject* optionFromList(AtkSelection* selection, gint i)
+{
+    AccessibilityObject* coreSelection = core(selection);
+    if (!coreSelection || i < 0)
+        return 0;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector options = core(selection)->children();
+    if (i < static_cast<gint>(options.size()))
+        return options.at(i).get();
+
+    return 0;
+}
+
+static AccessibilityObject* optionFromSelection(AtkSelection* selection, gint i)
+{
+    // i is the ith selection as opposed to the ith child.
+
+    AccessibilityObject* coreSelection = core(selection);
+    if (!coreSelection || i < 0)
+        return 0;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+    if (coreSelection->isListBox())
+        static_cast<AccessibilityListBox*>(coreSelection)->selectedChildren(selectedItems);
+
+    // TODO: Combo boxes
+
+    if (i < static_cast<gint>(selectedItems.size()))
+        return selectedItems.at(i).get();
+
+    return 0;
+}
+
+static gboolean webkit_accessible_selection_add_selection(AtkSelection* selection, gint i)
+{
+    AccessibilityObject* option = optionFromList(selection, i);
+    if (option && core(selection)->isListBox()) {
+        AccessibilityListBoxOption* listBoxOption = static_cast<AccessibilityListBoxOption*>(option);
+        listBoxOption->setSelected(true);
+        return listBoxOption->isSelected();
+    }
+
+    return false;
+}
+
+static gboolean webkit_accessible_selection_clear_selection(AtkSelection* selection)
+{
+    AccessibilityObject* coreSelection = core(selection);
+    if (!coreSelection)
+        return false;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+    if (coreSelection->isListBox()) {
+        // Set the list of selected items to an empty list; then verify that it worked.
+        AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(coreSelection);
+        listBox->setSelectedChildren(selectedItems);
+        listBox->selectedChildren(selectedItems);
+        return selectedItems.size() == 0;
+    }
+    return false;
+}
+
+static AtkObject* webkit_accessible_selection_ref_selection(AtkSelection* selection, gint i)
+{
+    AccessibilityObject* option = optionFromSelection(selection, i);
+    if (option) {
+        AtkObject* child = option->wrapper();
+        g_object_ref(child);
+        return child;
+    }
+
+    return 0;
+}
+
+static gint webkit_accessible_selection_get_selection_count(AtkSelection* selection)
+{
+    AccessibilityObject* coreSelection = core(selection);
+    if (coreSelection && coreSelection->isListBox()) {
+        AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+        static_cast<AccessibilityListBox*>(coreSelection)->selectedChildren(selectedItems);
+        return static_cast<gint>(selectedItems.size());
+    }
+
+    return 0;
+}
+
+static gboolean webkit_accessible_selection_is_child_selected(AtkSelection* selection, gint i)
+{
+    AccessibilityObject* option = optionFromList(selection, i);
+    if (option && core(selection)->isListBox())
+        return static_cast<AccessibilityListBoxOption*>(option)->isSelected();
+
+    return false;
+}
+
+static gboolean webkit_accessible_selection_remove_selection(AtkSelection* selection, gint i)
+{
+    // TODO: This is only getting called if i == 0. What is preventing the rest?
+    AccessibilityObject* option = optionFromSelection(selection, i);
+    if (option && core(selection)->isListBox()) {
+        AccessibilityListBoxOption* listBoxOption = static_cast<AccessibilityListBoxOption*>(option);
+        listBoxOption->setSelected(false);
+        return !listBoxOption->isSelected();
+    }
+
+    return false;
+}
+
+static gboolean webkit_accessible_selection_select_all_selection(AtkSelection* selection)
+{
+    AccessibilityObject* coreSelection = core(selection);
+    if (!coreSelection || !coreSelection->isMultiSelect())
+        return false;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector children = coreSelection->children();
+    if (coreSelection->isListBox()) {
+        AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(coreSelection);
+        listBox->setSelectedChildren(children);
+        AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+        listBox->selectedChildren(selectedItems);
+        return selectedItems.size() == children.size();
+    }
+
+    return false;
+}
+
+static void atk_selection_interface_init(AtkSelectionIface* iface)
+{
+    iface->add_selection = webkit_accessible_selection_add_selection;
+    iface->clear_selection = webkit_accessible_selection_clear_selection;
+    iface->ref_selection = webkit_accessible_selection_ref_selection;
+    iface->get_selection_count = webkit_accessible_selection_get_selection_count;
+    iface->is_child_selected = webkit_accessible_selection_is_child_selected;
+    iface->remove_selection = webkit_accessible_selection_remove_selection;
+    iface->select_all_selection = webkit_accessible_selection_select_all_selection;
+}
+
 // Text
 
 static gchar* webkit_accessible_text_get_text(AtkText* text, gint startOffset, gint endOffset)
@@ -616,6 +820,8 @@ static gchar* webkit_accessible_text_get_text(AtkText* text, gint startOffset, g
     AccessibilityObject* coreObject = core(text);
     String ret;
     unsigned start = startOffset;
+    if (endOffset == -1)
+        endOffset = coreObject->stringValue().length();
     int length = endOffset - startOffset;
 
     if (coreObject->isTextControl())
@@ -656,23 +862,24 @@ static gchar* convertUniCharToUTF8(const UChar* characters, gint length, int fro
 {
     CString stringUTF8 = UTF8Encoding().encode(characters, length, QuestionMarksForUnencodables);
     gchar* utf8String = utf8Substr(stringUTF8.data(), from, to);
-    if (!g_utf8_validate(utf8String, -1, NULL)) {
+    if (!g_utf8_validate(utf8String, -1, 0)) {
         g_free(utf8String);
         return 0;
     }
     gsize len = strlen(utf8String);
-    GString* ret = g_string_new_len(NULL, len);
+    GString* ret = g_string_new_len(0, len);
+    gchar* ptr = utf8String;
 
     // WebCore introduces line breaks in the text that do not reflect
     // the layout you see on the screen, replace them with spaces
     while (len > 0) {
         gint index, start;
-        pango_find_paragraph_boundary(utf8String, len, &index, &start);
-        g_string_append_len(ret, utf8String, index);
+        pango_find_paragraph_boundary(ptr, len, &index, &start);
+        g_string_append_len(ret, ptr, index);
         if (index == start)
             break;
         g_string_append_c(ret, ' ');
-        utf8String += start;
+        ptr += start;
         len -= start;
     }
 
@@ -691,7 +898,7 @@ static PangoLayout* getPangoLayoutForAtk(AtkText* textObject)
     if (!webView)
         return 0;
 
-    GString* str = g_string_new(NULL);
+    GString* str = g_string_new(0);
 
     AccessibilityRenderObject* accObject = static_cast<AccessibilityRenderObject*>(coreObject);
     if (!accObject)
@@ -701,12 +908,30 @@ static PangoLayout* getPangoLayoutForAtk(AtkText* textObject)
         return 0;
 
     // Create a string with the layout as it appears on the screen
-    InlineTextBox* box = renderText->firstTextBox();
-    while (box) {
-        gchar *text = convertUniCharToUTF8(renderText->characters(), renderText->textLength(), box->start(), box->end());
-        g_string_append(str, text);
-        g_string_append(str, "\n");
-        box = box->nextTextBox();
+    if (accObject->isTextControl()) {
+        unsigned textLength = accObject->textLength();
+        int lineNumber = 0;
+        PlainTextRange range = accObject->doAXRangeForLine(lineNumber);
+        while (range.length) {
+            // When a line of text wraps in a text area, the final space is removed.
+            if (range.start + range.length < textLength)
+                range.length -= 1;
+            String lineText = accObject->doAXStringForRange(range);
+            g_string_append(str, lineText.utf8().data());
+            g_string_append(str, "\n");
+            range = accObject->doAXRangeForLine(++lineNumber);
+        }
+    } else {
+        InlineTextBox* box = renderText->firstTextBox();
+        while (box) {
+            gchar* text = convertUniCharToUTF8(renderText->characters(), renderText->textLength(), box->start(), box->end());
+            g_string_append(str, text);
+            // Newline chars in the source result in separate text boxes, so check
+            // before adding a newline in the layout. See bug 25415 comment #78.
+            if (!box->nextOnLineExists())
+                g_string_append(str, "\n");
+            box = box->nextTextBox();
+        }
     }
 
     PangoLayout* layout = gtk_widget_create_pango_layout(static_cast<GtkWidget*>(webView), g_string_free(str, FALSE));
@@ -732,7 +957,7 @@ static gchar* webkit_accessible_text_get_text_before_offset(AtkText* text, gint
 static gunichar webkit_accessible_text_get_character_at_offset(AtkText* text, gint offset)
 {
     notImplemented();
-    return NULL;
+    return 0;
 }
 
 static gint webkit_accessible_text_get_caret_offset(AtkText* text)
@@ -744,13 +969,13 @@ static gint webkit_accessible_text_get_caret_offset(AtkText* text)
 static AtkAttributeSet* webkit_accessible_text_get_run_attributes(AtkText* text, gint offset, gint* start_offset, gint* end_offset)
 {
     notImplemented();
-    return NULL;
+    return 0;
 }
 
 static AtkAttributeSet* webkit_accessible_text_get_default_attributes(AtkText* text)
 {
     notImplemented();
-    return NULL;
+    return 0;
 }
 
 static void webkit_accessible_text_get_character_extents(AtkText* text, gint offset, gint* x, gint* y, gint* width, gint* height, AtkCoordType coords)
@@ -795,7 +1020,7 @@ static gint webkit_accessible_text_get_offset_at_point(AtkText* text, gint x, gi
     return range.start;
 }
 
-static bool selectionBelongsToObject(AccessibilityObject *coreObject, VisibleSelection& selection)
+static bool selectionBelongsToObject(AccessibilityObject* coreObject, VisibleSelection& selection)
 {
     if (!coreObject->isAccessibilityRenderObject())
         return false;
@@ -830,7 +1055,7 @@ static gchar* webkit_accessible_text_get_selection(AtkText* text, gint selection
     // the global one (the API is a bit confusing)
     if (selection_num != 0 || !selectionBelongsToObject(coreObject, selection)) {
         *start_offset = *end_offset = 0;
-        return NULL;
+        return 0;
     }
 
     *start_offset = selection.start().offsetInContainerNode();
@@ -1016,7 +1241,7 @@ static AtkObject* webkit_accessible_component_ref_accessible_at_point(AtkCompone
     IntPoint pos = atkToContents(core(component), coordType, x, y);
     AccessibilityObject* target = core(component)->doAccessibilityHitTest(pos);
     if (!target)
-        return NULL;
+        return 0;
     g_object_ref(target->wrapper());
     return target->wrapper();
 }
@@ -1033,7 +1258,7 @@ static gboolean webkit_accessible_component_grab_focus(AtkComponent* component)
     return core(component)->isFocused();
 }
 
-static void atk_component_interface_init(AtkComponentIface *iface)
+static void atk_component_interface_init(AtkComponentIface* iface)
 {
     iface->ref_accessible_at_point = webkit_accessible_component_ref_accessible_at_point;
     iface->get_extents = webkit_accessible_component_get_extents;
@@ -1080,32 +1305,68 @@ static AccessibilityTableCell* cell(AtkTable* table, guint row, guint column)
     return 0;
 }
 
-static gint cellIndex(AccessibilityTableCell* AXCell, AccessibilityTable* AXTable)
+static gint cellIndex(AccessibilityTableCell* axCell, AccessibilityTable* axTable)
 {
     // Calculate the cell's index as if we had a traditional Gtk+ table in
     // which cells are all direct children of the table, arranged row-first.
     AccessibilityObject::AccessibilityChildrenVector allCells;
-    AXTable->cells(allCells);
+    axTable->cells(allCells);
     AccessibilityObject::AccessibilityChildrenVector::iterator position;
-    position = std::find(allCells.begin(), allCells.end(), AXCell);
+    position = std::find(allCells.begin(), allCells.end(), axCell);
     if (position == allCells.end())
         return -1;
     return position - allCells.begin();
 }
 
+static AccessibilityTableCell* cellAtIndex(AtkTable* table, gint index)
+{
+    AccessibilityObject* accTable = core(table);
+    if (accTable->isAccessibilityRenderObject()) {
+        AccessibilityObject::AccessibilityChildrenVector allCells;
+        static_cast<AccessibilityTable*>(accTable)->cells(allCells);
+        if (0 <= index && static_cast<unsigned>(index) < allCells.size()) {
+            AccessibilityObject* accCell = allCells.at(index).get();
+            return static_cast<AccessibilityTableCell*>(accCell);
+        }
+    }
+    return 0;
+}
+
 static AtkObject* webkit_accessible_table_ref_at(AtkTable* table, gint row, gint column)
 {
-    AccessibilityTableCell* AXCell = cell(table, row, column);
-    if (!AXCell)
+    AccessibilityTableCell* axCell = cell(table, row, column);
+    if (!axCell)
         return 0;
-    return AXCell->wrapper();
+    return axCell->wrapper();
 }
 
 static gint webkit_accessible_table_get_index_at(AtkTable* table, gint row, gint column)
 {
-    AccessibilityTableCell* AXCell = cell(table, row, column);
-    AccessibilityTable* AXTable = static_cast<AccessibilityTable*>(core(table));
-    return cellIndex(AXCell, AXTable);
+    AccessibilityTableCell* axCell = cell(table, row, column);
+    AccessibilityTable* axTable = static_cast<AccessibilityTable*>(core(table));
+    return cellIndex(axCell, axTable);
+}
+
+static gint webkit_accessible_table_get_column_at_index(AtkTable* table, gint index)
+{
+    AccessibilityTableCell* axCell = cellAtIndex(table, index);
+    if (axCell){
+        pair<int, int> columnRange;
+        axCell->columnIndexRange(columnRange);
+        return columnRange.first;
+    }
+    return -1;
+}
+
+static gint webkit_accessible_table_get_row_at_index(AtkTable* table, gint index)
+{
+    AccessibilityTableCell* axCell = cellAtIndex(table, index);
+    if (axCell){
+        pair<int, int> rowRange;
+        axCell->rowIndexRange(rowRange);
+        return rowRange.first;
+    }
+    return -1;
 }
 
 static gint webkit_accessible_table_get_n_columns(AtkTable* table)
@@ -1126,10 +1387,10 @@ static gint webkit_accessible_table_get_n_rows(AtkTable* table)
 
 static gint webkit_accessible_table_get_column_extent_at(AtkTable* table, gint row, gint column)
 {
-    AccessibilityTableCell* AXCell = cell(table, row, column);
-    if (AXCell) {
+    AccessibilityTableCell* axCell = cell(table, row, column);
+    if (axCell) {
         pair<int, int> columnRange;
-        AXCell->columnIndexRange(columnRange);
+        axCell->columnIndexRange(columnRange);
         return columnRange.second;
     }
     return 0;
@@ -1137,15 +1398,22 @@ static gint webkit_accessible_table_get_column_extent_at(AtkTable* table, gint r
 
 static gint webkit_accessible_table_get_row_extent_at(AtkTable* table, gint row, gint column)
 {
-    AccessibilityTableCell* AXCell = cell(table, row, column);
-    if (AXCell) {
+    AccessibilityTableCell* axCell = cell(table, row, column);
+    if (axCell) {
         pair<int, int> rowRange;
-        AXCell->rowIndexRange(rowRange);
+        axCell->rowIndexRange(rowRange);
         return rowRange.second;
     }
     return 0;
 }
 
+static AtkObject* webkit_accessible_table_get_column_header(AtkTable* table, gint column)
+{
+    // FIXME: This needs to be implemented.
+    notImplemented();
+    return 0;
+}
+
 static AtkObject* webkit_accessible_table_get_row_header(AtkTable* table, gint row)
 {
     AccessibilityObject* accTable = core(table);
@@ -1163,39 +1431,139 @@ static AtkObject* webkit_accessible_table_get_row_header(AtkTable* table, gint r
     return 0;
 }
 
+static AtkObject* webkit_accessible_table_get_caption(AtkTable* table)
+{
+    AccessibilityObject* accTable = core(table);
+    if (accTable->isAccessibilityRenderObject()) {
+        Node* node = static_cast<AccessibilityRenderObject*>(accTable)->renderer()->node();
+        if (node && node->hasTagName(HTMLNames::tableTag)) {
+            HTMLTableCaptionElement* caption = static_cast<HTMLTableElement*>(node)->caption();
+            if (caption)
+                return AccessibilityObject::firstAccessibleObjectFromNode(caption->renderer()->node())->wrapper();
+        }
+    }
+    return 0;
+}
+
+static const gchar* webkit_accessible_table_get_column_description(AtkTable* table, gint column)
+{
+    AtkObject* columnHeader = atk_table_get_column_header(table, column);
+    if (columnHeader)
+        return returnString(nameFromChildren(core(columnHeader)));
+
+    return 0;
+}
+
+static const gchar* webkit_accessible_table_get_row_description(AtkTable* table, gint row)
+{
+    AtkObject* rowHeader = atk_table_get_row_header(table, row);
+    if (rowHeader)
+        return returnString(nameFromChildren(core(rowHeader)));
+
+    return 0;
+}
+
 static void atk_table_interface_init(AtkTableIface* iface)
 {
     iface->ref_at = webkit_accessible_table_ref_at;
     iface->get_index_at = webkit_accessible_table_get_index_at;
+    iface->get_column_at_index = webkit_accessible_table_get_column_at_index;
+    iface->get_row_at_index = webkit_accessible_table_get_row_at_index;
     iface->get_n_columns = webkit_accessible_table_get_n_columns;
     iface->get_n_rows = webkit_accessible_table_get_n_rows;
     iface->get_column_extent_at = webkit_accessible_table_get_column_extent_at;
     iface->get_row_extent_at = webkit_accessible_table_get_row_extent_at;
+    iface->get_column_header = webkit_accessible_table_get_column_header;
     iface->get_row_header = webkit_accessible_table_get_row_header;
+    iface->get_caption = webkit_accessible_table_get_caption;
+    iface->get_column_description = webkit_accessible_table_get_column_description;
+    iface->get_row_description = webkit_accessible_table_get_row_description;
+}
+
+static const gchar* documentAttributeValue(AtkDocument* document, const gchar* attribute)
+{
+    Document* coreDocument = core(document)->document();
+    if (!coreDocument)
+        return 0;
+
+    String value = String();
+    if (!g_ascii_strcasecmp(attribute, "DocType") && coreDocument->doctype())
+        value = coreDocument->doctype()->name();
+    else if (!g_ascii_strcasecmp(attribute, "Encoding"))
+        value = coreDocument->charset();
+    else if (!g_ascii_strcasecmp(attribute, "URI"))
+        value = coreDocument->documentURI();
+    if (!value.isEmpty())
+        return returnString(value);
+
+    return 0;
+}
+
+static const gchar* webkit_accessible_document_get_attribute_value(AtkDocument* document, const gchar* attribute)
+{
+    return documentAttributeValue(document, attribute);
+}
+
+static AtkAttributeSet* webkit_accessible_document_get_attributes(AtkDocument* document)
+{
+    AtkAttributeSet* attributeSet = 0;
+    const gchar* attributes [] = {"DocType", "Encoding", "URI"};
+
+    for (unsigned i = 0; i < G_N_ELEMENTS(attributes); i++) {
+        const gchar* value = documentAttributeValue(document, attributes[i]);
+        if (value)
+            attributeSet = addAttributeToSet(attributeSet, attributes[i], value);
+    }
+
+    return attributeSet;
+}
+
+static const gchar* webkit_accessible_document_get_locale(AtkDocument* document)
+{
+
+    // TODO: Should we fall back on lang xml:lang when the following comes up empty?
+    String language = static_cast<AccessibilityRenderObject*>(core(document))->language();
+    if (!language.isEmpty())
+        return returnString(language);
+
+    return 0;
+}
+
+static void atk_document_interface_init(AtkDocumentIface* iface)
+{
+    iface->get_document_attribute_value = webkit_accessible_document_get_attribute_value;
+    iface->get_document_attributes = webkit_accessible_document_get_attributes;
+    iface->get_document_locale = webkit_accessible_document_get_locale;
 }
 
 static const GInterfaceInfo AtkInterfacesInitFunctions[] = {
     {(GInterfaceInitFunc)atk_action_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
+    {(GInterfaceInitFunc)atk_selection_interface_init,
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_editable_text_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_text_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_component_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_image_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_table_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL}
+     (GInterfaceFinalizeFunc) 0, 0},
+    {(GInterfaceInitFunc)atk_document_interface_init,
+     (GInterfaceFinalizeFunc) 0, 0}
 };
 
 enum WAIType {
     WAI_ACTION,
+    WAI_SELECTION,
     WAI_EDITABLE_TEXT,
     WAI_TEXT,
     WAI_COMPONENT,
     WAI_IMAGE,
-    WAI_TABLE
+    WAI_TABLE,
+    WAI_DOCUMENT
 };
 
 static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
@@ -1203,6 +1571,8 @@ static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
   switch (type) {
   case WAI_ACTION:
       return ATK_TYPE_ACTION;
+  case WAI_SELECTION:
+      return ATK_TYPE_SELECTION;
   case WAI_EDITABLE_TEXT:
       return ATK_TYPE_EDITABLE_TEXT;
   case WAI_TEXT:
@@ -1213,6 +1583,8 @@ static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
       return ATK_TYPE_IMAGE;
   case WAI_TABLE:
       return ATK_TYPE_TABLE;
+  case WAI_DOCUMENT:
+      return ATK_TYPE_DOCUMENT;
   }
 
   return G_TYPE_INVALID;
@@ -1229,6 +1601,10 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
     if (!coreObject->actionVerb().isEmpty())
         interfaceMask |= 1 << WAI_ACTION;
 
+    // Selection
+    if (coreObject->isListBox())
+        interfaceMask |= 1 << WAI_SELECTION;
+
     // Text & Editable Text
     AccessibilityRole role = coreObject->roleValue();
 
@@ -1248,6 +1624,10 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
     if (role == TableRole)
         interfaceMask |= 1 << WAI_TABLE;
 
+    // Document
+    if (role == WebAreaRole)
+        interfaceMask |= 1 << WAI_DOCUMENT;
+
     return interfaceMask;
 }
 
@@ -1255,10 +1635,10 @@ static const char* getUniqueAccessibilityTypeName(guint16 interfaceMask)
 {
 #define WAI_TYPE_NAME_LEN (30) /* Enough for prefix + 5 hex characters (max) */
     static char name[WAI_TYPE_NAME_LEN + 1];
-    
+
     g_sprintf(name, "WAIType%x", interfaceMask);
     name[WAI_TYPE_NAME_LEN] = '\0';
-    
+
     return name;
 }
 
@@ -1266,15 +1646,15 @@ static GType getAccessibilityTypeFromObject(AccessibilityObject* coreObject)
 {
     static const GTypeInfo typeInfo = {
         sizeof(WebKitAccessibleClass),
-        (GBaseInitFunc) NULL,
-        (GBaseFinalizeFunc) NULL,
-        (GClassInitFunc) NULL,
-        (GClassFinalizeFunc) NULL,
-        NULL, /* class data */
+        (GBaseInitFunc) 0,
+        (GBaseFinalizeFunc) 0,
+        (GClassInitFunc) 0,
+        (GClassFinalizeFunc) 0,
+        0, /* class data */
         sizeof(WebKitAccessible), /* instance size */
         0, /* nb preallocs */
-        (GInstanceInitFunc) NULL,
-        NULL /* value table */
+        (GInstanceInitFunc) 0,
+        0 /* value table */
     };
 
     guint16 interfaceMask = getInterfaceMaskFromObject(coreObject);
@@ -1299,7 +1679,7 @@ static GType getAccessibilityTypeFromObject(AccessibilityObject* coreObject)
 WebKitAccessible* webkit_accessible_new(AccessibilityObject* coreObject)
 {
     GType type = getAccessibilityTypeFromObject(coreObject);
-    AtkObject* object = static_cast<AtkObject*>(g_object_new(type, NULL));
+    AtkObject* object = static_cast<AtkObject*>(g_object_new(type, 0));
 
     atk_object_initialize(object, coreObject);
 
diff --git a/WebCore/accessibility/mac/AXObjectCacheMac.mm b/WebCore/accessibility/mac/AXObjectCacheMac.mm
index 2f18cf3..bf1b22c 100644
--- a/WebCore/accessibility/mac/AXObjectCacheMac.mm
+++ b/WebCore/accessibility/mac/AXObjectCacheMac.mm
@@ -59,6 +59,13 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
     // Some notifications are unique to Safari and do not have NSAccessibility equivalents.
     String macNotification;
     switch (notification) {
+        case AXActiveDescendantChanged:
+            // An active descendant change for trees means a selected rows change.
+            if (obj->isTree())
+                macNotification = NSAccessibilitySelectedRowsChangedNotification;
+            else
+                macNotification = NSAccessibilityFocusedUIElementChangedNotification;                
+            break;
         case AXCheckedStateChanged:
             macNotification = "AXCheckedStateChanged";
             break;
diff --git a/WebCore/accessibility/mac/AccessibilityObjectMac.mm b/WebCore/accessibility/mac/AccessibilityObjectMac.mm
index 217af54..722b03e 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectMac.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectMac.mm
@@ -43,6 +43,24 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
 
 AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
 {
+    // Determine if this is in a tree. If so, we apply special behavior to make it work like an AXOutline.
+    AccessibilityObject* axObj = parentObject();
+    bool isInTree = false;
+    while (axObj) {
+        if (axObj->isTree()) {
+            isInTree = true;
+            break;
+        }
+        axObj = axObj->parentObjectUnignored();
+    }
+    
+    // If the object is in a tree, only tree items should be exposed (and the children of tree items).
+    if (isInTree) {
+        AccessibilityRole role = roleValue();
+        if (role != TreeItemRole && role != StaticTextRole)
+            return IgnoreObject;
+    }
+    
     return DefaultBehavior;
 }
     
diff --git a/WebCore/accessibility/mac/AccessibilityObjectWrapper.h b/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
index 3b584a9..910305b 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
@@ -29,7 +29,7 @@
 #ifndef AccessibilityObjectWrapper_h
 #define AccessibilityObjectWrapper_h
 
-#import <wtf/RefPtr.h>
+#include <wtf/RefPtr.h>
 
 #ifdef __OBJC__
 @class WebCoreTextMarker;
@@ -40,12 +40,11 @@ class WebCoreTextMarkerRange;
 #endif
 
 namespace WebCore {
-    class AccessibilityObject;
-    class VisiblePosition;
+class AccessibilityObject;
+class VisiblePosition;
 }
 
-@interface AccessibilityObjectWrapper : NSObject
-{
+@interface AccessibilityObjectWrapper : NSObject {
     WebCore::AccessibilityObject* m_object;
 }
  
diff --git a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index 58e5018..6099b3d 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -119,6 +119,18 @@ using namespace std;
 #define NSAccessibilityRequiredAttribute @"AXRequired"
 #endif
 
+#ifndef NSAccessibilityOwnsAttribute
+#define NSAccessibilityOwnsAttribute @"AXOwns"
+#endif
+
+#ifndef NSAccessibilityGrabbedAttribute
+#define NSAccessibilityGrabbedAttribute @"AXGrabbed"
+#endif
+
+#ifndef NSAccessibilityDropEffectsAttribute
+#define NSAccessibilityDropEffectsAttribute @"AXDropEffects"
+#endif
+
 #ifdef BUILDING_ON_TIGER
 typedef unsigned NSUInteger;
 #define NSAccessibilityValueDescriptionAttribute @"AXValueDescription"
@@ -569,6 +581,27 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
     return actions;
 }
 
+- (NSArray*)additionalAccessibilityAttributeNames
+{
+    if (!m_object)
+        return nil;
+
+    NSMutableArray *additional = [NSMutableArray array];
+    if (m_object->supportsARIAOwns())
+        [additional addObject:NSAccessibilityOwnsAttribute];
+
+    if (m_object->isScrollbar())
+        [additional addObject:NSAccessibilityOrientationAttribute];
+    
+    if (m_object->supportsARIADragging())
+        [additional addObject:NSAccessibilityGrabbedAttribute];
+
+    if (m_object->supportsARIADropping())
+        [additional addObject:NSAccessibilityDropEffectsAttribute];
+
+    return additional;
+}
+
 - (NSArray*)accessibilityAttributeNames
 {
     if (!m_object)
@@ -600,6 +633,11 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
     static NSArray* groupAttrs = nil;
     static NSArray* inputImageAttrs = nil;
     static NSArray* passwordFieldAttrs = nil;
+    static NSArray* tabListAttrs = nil;
+    static NSArray* comboBoxAttrs = nil;
+    static NSArray* outlineAttrs = nil;
+    static NSArray* outlineRowAttrs = nil;
+    static NSArray* buttonAttrs = nil;
     NSMutableArray* tempArray;
     if (attributes == nil) {
         attributes = [[NSArray alloc] initWithObjects: NSAccessibilityRoleAttribute,
@@ -739,6 +777,21 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         controlAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
+    if (buttonAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:attributes];
+        // Buttons should not expose AXValue.
+        [tempArray removeObject:NSAccessibilityValueAttribute];
+        [tempArray addObject:NSAccessibilityTitleUIElementAttribute];
+        [tempArray addObject:NSAccessibilityAccessKeyAttribute];
+        buttonAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];
+    }
+    if (comboBoxAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:controlAttrs];
+        [tempArray addObject:NSAccessibilityExpandedAttribute];
+        comboBoxAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];        
+    }
     if (tableAttrs == nil) {
         tempArray = [[NSMutableArray alloc] initWithArray:attributes];
         [tempArray addObject:NSAccessibilityRowsAttribute];
@@ -781,9 +834,8 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         [tempArray release];
     }
     if (inputImageAttrs == nil) {
-        tempArray = [[NSMutableArray alloc] initWithArray:controlAttrs];
+        tempArray = [[NSMutableArray alloc] initWithArray:buttonAttrs];
         [tempArray addObject:NSAccessibilityURLAttribute];
-        [tempArray addObject:NSAccessibilityAccessKeyAttribute];
         inputImageAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
@@ -794,53 +846,96 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         passwordFieldAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
+    if (tabListAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:attributes];
+        [tempArray addObject:NSAccessibilityTabsAttribute];
+        [tempArray addObject:NSAccessibilityContentsAttribute];
+        tabListAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];        
+    }
+    if (outlineAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:attributes];
+        [tempArray addObject:NSAccessibilitySelectedRowsAttribute];
+        [tempArray addObject:NSAccessibilityRowsAttribute];
+        [tempArray addObject:NSAccessibilityColumnsAttribute];
+        outlineAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];
+    }
+    if (outlineRowAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:tableRowAttrs];
+        [tempArray addObject:NSAccessibilityIndexAttribute];
+        [tempArray addObject:NSAccessibilityDisclosingAttribute];
+        [tempArray addObject:NSAccessibilityDisclosedByRowAttribute];
+        [tempArray addObject:NSAccessibilityDisclosureLevelAttribute];
+        [tempArray addObject:NSAccessibilityDisclosedRowsAttribute];
+        outlineRowAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];
+    }
     
-    if (m_object->isPasswordField())
-        return passwordFieldAttrs;
-
-    if (m_object->isWebArea())
-        return webAreaAttrs;
+    NSArray *objectAttributes = attributes;
     
-    if (m_object->isTextControl())
-        return textAttrs;
-
-    if (m_object->isAnchor() || m_object->isImage() || m_object->isLink())
-        return anchorAttrs;
-
-    if (m_object->isDataTable())
-        return tableAttrs;
-    if (m_object->isTableRow())
-        return tableRowAttrs;
-    if (m_object->isTableColumn())
-        return tableColAttrs;
-    if (m_object->isTableCell())
-        return tableCellAttrs;
-    
-    if (m_object->isListBox() || m_object->isList())
-        return listBoxAttrs;
-
-    if (m_object->isProgressIndicator() || m_object->isSlider())
-        return rangeAttrs;
-
-    if (m_object->isInputImage())
-        return inputImageAttrs;
-    
-    if (m_object->isControl())
-        return controlAttrs;
-    
-    if (m_object->isGroup())
-        return groupAttrs;
-    
-    if (m_object->isMenu())
-        return menuAttrs;
-    if (m_object->isMenuBar())
-        return menuBarAttrs;
-    if (m_object->isMenuButton())
-        return menuButtonAttrs;
-    if (m_object->isMenuItem())
-        return menuItemAttrs;
-
-    return attributes;
+    if (m_object->isPasswordField())
+        objectAttributes = passwordFieldAttrs;
+
+    else if (m_object->isWebArea())
+        objectAttributes = webAreaAttrs;
+    
+    else if (m_object->isTextControl())
+        objectAttributes = textAttrs;
+
+    else if (m_object->isAnchor() || m_object->isImage() || m_object->isLink())
+        objectAttributes = anchorAttrs;
+
+    else if (m_object->isDataTable())
+        objectAttributes = tableAttrs;
+    else if (m_object->isTableRow())
+        objectAttributes = tableRowAttrs;
+    else if (m_object->isTableColumn())
+        objectAttributes = tableColAttrs;
+    else if (m_object->isTableCell())
+        objectAttributes = tableCellAttrs;
+    
+    else if (m_object->isTree())
+        objectAttributes = outlineAttrs;
+    else if (m_object->isTreeItem())
+        objectAttributes = outlineRowAttrs;
+    
+    else if (m_object->isListBox() || m_object->isList())
+        objectAttributes = listBoxAttrs;
+
+    else if (m_object->isComboBox())
+        objectAttributes = comboBoxAttrs;
+    
+    else if (m_object->isProgressIndicator() || m_object->isSlider())
+        objectAttributes = rangeAttrs;
+
+    // These are processed in order because an input image is a button, and a button is a control.
+    else if (m_object->isInputImage())
+        objectAttributes = inputImageAttrs;
+    else if (m_object->isButton())
+        objectAttributes = buttonAttrs;
+    else if (m_object->isControl())
+        objectAttributes = controlAttrs;
+    
+    else if (m_object->isGroup())
+        objectAttributes = groupAttrs;
+    else if (m_object->isTabList())
+        objectAttributes = tabListAttrs;
+    
+    else if (m_object->isMenu())
+        objectAttributes = menuAttrs;
+    else if (m_object->isMenuBar())
+        objectAttributes = menuBarAttrs;
+    else if (m_object->isMenuButton())
+        objectAttributes = menuButtonAttrs;
+    else if (m_object->isMenuItem())
+        objectAttributes = menuItemAttrs;
+
+    NSArray *additionalAttributes = [self additionalAccessibilityAttributeNames];
+    if ([additionalAttributes count])
+        objectAttributes = [objectAttributes arrayByAddingObjectsFromArray:additionalAttributes];
+    
+    return objectAttributes;
 }
 
 - (VisiblePositionRange)visiblePositionRangeForTextMarkerRange:(WebCoreTextMarkerRange*) textMarkerRange
@@ -936,6 +1031,7 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { GroupRole, NSAccessibilityGroupRole },
         { RadioGroupRole, NSAccessibilityRadioGroupRole },
         { ListRole, NSAccessibilityListRole },
+        { DirectoryRole, NSAccessibilityListRole },
         { ScrollBarRole, NSAccessibilityScrollBarRole },
         { ValueIndicatorRole, NSAccessibilityValueIndicatorRole },
         { ImageRole, NSAccessibilityImageRole },
@@ -992,17 +1088,24 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { LandmarkMainRole, NSAccessibilityGroupRole },
         { LandmarkNavigationRole, NSAccessibilityGroupRole },
         { LandmarkSearchRole, NSAccessibilityGroupRole },
+        { ApplicationAlertRole, NSAccessibilityGroupRole },
+        { ApplicationAlertDialogRole, NSAccessibilityGroupRole },
+        { ApplicationDialogRole, NSAccessibilityGroupRole },
         { ApplicationLogRole, NSAccessibilityGroupRole },
         { ApplicationMarqueeRole, NSAccessibilityGroupRole },
         { ApplicationStatusRole, NSAccessibilityGroupRole },
         { ApplicationTimerRole, NSAccessibilityGroupRole },
         { DocumentRole, NSAccessibilityGroupRole },
         { DocumentArticleRole, NSAccessibilityGroupRole },
+        { DocumentMathRole, NSAccessibilityGroupRole },
         { DocumentNoteRole, NSAccessibilityGroupRole },
         { DocumentRegionRole, NSAccessibilityGroupRole },
         { UserInterfaceTooltipRole, NSAccessibilityGroupRole },
-        
-
+        { TabRole, NSAccessibilityRadioButtonRole },
+        { TabListRole, NSAccessibilityTabGroupRole },
+        { TabPanelRole, NSAccessibilityGroupRole },
+        { TreeRole, NSAccessibilityOutlineRole },
+        { TreeItemRole, NSAccessibilityRowRole },
     };
     AccessibilityRoleMap& roleMap = *new AccessibilityRoleMap;
     
@@ -1041,6 +1144,9 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         }
     }
     
+    if (m_object->isTreeItem())
+        return NSAccessibilityOutlineRowSubrole;
+    
     if (m_object->isList()) {
         AccessibilityList* listObject = static_cast<AccessibilityList*>(m_object);
         if (listObject->isUnorderedList() || listObject->isOrderedList())
@@ -1065,6 +1171,12 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             return @"AXLandmarkNavigation";
         case LandmarkSearchRole:
             return @"AXLandmarkSearch";
+        case ApplicationAlertRole:
+            return @"AXApplicationAlert";
+        case ApplicationAlertDialogRole:
+            return @"AXApplicationAlertDialog";
+        case ApplicationDialogRole:
+            return @"AXApplicationDialog";
         case ApplicationLogRole:
             return @"AXApplicationLog";
         case ApplicationMarqueeRole:
@@ -1077,14 +1189,23 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             return @"AXDocument";
         case DocumentArticleRole:
             return @"AXDocumentArticle";
+        case DocumentMathRole:
+            return @"AXDocumentMath";
         case DocumentNoteRole:
             return @"AXDocumentNote";
         case DocumentRegionRole:
             return @"AXDocumentRegion";
         case UserInterfaceTooltipRole:
             return @"AXUserInterfaceTooltip";
+        case TabPanelRole:
+            return @"AXTabPanel";
+        case DefinitionListTermRole:
+            return @"AXTerm";
+        case DefinitionListDefinitionRole:
+            return @"AXDefinition";
+        // Default doesn't return anything, so roles defined below can be chosen.
         default:
-            return nil;
+            break;
     }
     
     if (m_object->isMediaTimeline())
@@ -1122,6 +1243,12 @@ static NSString* roleValueToNSString(AccessibilityRole value)
                 return AXARIAContentGroupText(@"ARIALandmarkNavigation");
             case LandmarkSearchRole:
                 return AXARIAContentGroupText(@"ARIALandmarkSearch");
+            case ApplicationAlertRole:
+                return AXARIAContentGroupText(@"ARIAApplicationAlert");
+            case ApplicationAlertDialogRole:
+                return AXARIAContentGroupText(@"ARIAApplicationAlertDialog");
+            case ApplicationDialogRole:
+                return AXARIAContentGroupText(@"ARIAApplicationDialog");
             case ApplicationLogRole:
                 return AXARIAContentGroupText(@"ARIAApplicationLog");
             case ApplicationMarqueeRole:
@@ -1134,12 +1261,20 @@ static NSString* roleValueToNSString(AccessibilityRole value)
                 return AXARIAContentGroupText(@"ARIADocument");
             case DocumentArticleRole:
                 return AXARIAContentGroupText(@"ARIADocumentArticle");
+            case DocumentMathRole:
+                return AXARIAContentGroupText(@"ARIADocumentMath");
             case DocumentNoteRole:
                 return AXARIAContentGroupText(@"ARIADocumentNote");
             case DocumentRegionRole:
                 return AXARIAContentGroupText(@"ARIADocumentRegion");
             case UserInterfaceTooltipRole:
                 return AXARIAContentGroupText(@"ARIAUserInterfaceTooltip");
+            case TabPanelRole:
+                return AXARIAContentGroupText(@"ARIATabPanel");
+            case DefinitionListTermRole:
+                return AXDefinitionListTermText();
+            case DefinitionListDefinitionRole:
+                return AXDefinitionListDefinitionText();
         }
     }        
     
@@ -1158,6 +1293,10 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([axRole isEqualToString:@"AXHeading"])
         return AXHeadingText();
 
+    // AppKit also returns AXTab for the role description for a tab item.
+    if (m_object->isTabItem())
+        return NSAccessibilityRoleDescription(@"AXTab", nil);
+    
     // We should try the system default role description for all other roles.
     // If we get the same string back, then as a last resort, return unknown.
     NSString* defaultRoleDescription = NSAccessibilityRoleDescription(axRole, [self subrole]);
@@ -1195,6 +1334,16 @@ static NSString* roleValueToNSString(AccessibilityRole value)
                 return fv->platformWidget();
         }
         
+        // Tree item (changed to AXRows) can only report the tree (AXOutline) as its parent.
+        if (m_object->isTreeItem()) {
+            AccessibilityObject* parent = m_object->parentObjectUnignored();
+            while (parent) {
+                if (parent->isTree())
+                    return parent->wrapper();
+                parent = parent->parentObjectUnignored();
+            }
+        }
+        
         return m_object->parentObjectUnignored()->wrapper();
     }
 
@@ -1204,6 +1353,19 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             if (children != nil)
                 return children;
         }
+
+        // The tree's (AXOutline) children are supposed to be its rows and columns.
+        // The ARIA spec doesn't have columns, so we just need rows.
+        if (m_object->isTree())
+            return [self accessibilityAttributeValue:NSAccessibilityRowsAttribute];
+
+        // A tree item should only expose its content as its children (not its rows)
+        if (m_object->isTreeItem()) {
+            AccessibilityObject::AccessibilityChildrenVector contentCopy;
+            m_object->ariaTreeItemContent(contentCopy);
+            return convertToNSArray(contentCopy);
+        }
+        
         return convertToNSArray(m_object->children());
     }
     
@@ -1305,7 +1467,7 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             if ([[[self attachmentView] accessibilityAttributeNames] containsObject:NSAccessibilityValueAttribute]) 
                 return [[self attachmentView] accessibilityAttributeValue:NSAccessibilityValueAttribute];
         }
-        if (m_object->isProgressIndicator() || m_object->isSlider())
+        if (m_object->isProgressIndicator() || m_object->isSlider() || m_object->isScrollbar())
             return [NSNumber numberWithFloat:m_object->valueForRange()];
         if (m_object->hasIntValue())
             return [NSNumber numberWithInt:m_object->intValue()];
@@ -1318,6 +1480,16 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             return radioButton->wrapper();
         }
         
+        if (m_object->isTabList()) {
+            AccessibilityObject* tabItem = m_object->selectedTabItem();
+            if (!tabItem)
+                return nil;
+            return tabItem->wrapper();
+        }
+        
+        if (m_object->isTabItem())
+            return [NSNumber numberWithInt:m_object->isSelected()];
+        
         return m_object->stringValue();
     }
 
@@ -1359,6 +1531,31 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return accessKey;
     }
     
+    if ([attributeName isEqualToString:NSAccessibilityTabsAttribute]) {
+        if (m_object->isTabList()) {
+            AccessibilityObject::AccessibilityChildrenVector tabsChildren;
+            m_object->tabChildren(tabsChildren);
+            return convertToNSArray(tabsChildren);
+        }
+    }
+    
+    if ([attributeName isEqualToString:NSAccessibilityContentsAttribute]) {
+        // The contents of a tab list are all the children except the tabs.
+        if (m_object->isTabList()) {
+            AccessibilityObject::AccessibilityChildrenVector children = m_object->children();
+            AccessibilityObject::AccessibilityChildrenVector tabsChildren;
+            m_object->tabChildren(tabsChildren);
+
+            AccessibilityObject::AccessibilityChildrenVector contents;
+            unsigned childrenSize = children.size();
+            for (unsigned k = 0; k < childrenSize; ++k) {
+                if (tabsChildren.find(children[k]) == WTF::notFound)
+                    contents.append(children[k]);
+            }
+            return convertToNSArray(contents);
+        }
+    }    
+    
     if (m_object->isDataTable()) {
         // TODO: distinguish between visible and non-visible rows
         if ([attributeName isEqualToString:NSAccessibilityRowsAttribute] || 
@@ -1438,6 +1635,69 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         }  
     }
     
+    if (m_object->isTree()) {
+        if ([attributeName isEqualToString:NSAccessibilitySelectedRowsAttribute]) {
+            AccessibilityObject::AccessibilityChildrenVector selectedChildrenCopy;
+            m_object->selectedChildren(selectedChildrenCopy);
+            return convertToNSArray(selectedChildrenCopy);
+        }
+        if ([attributeName isEqualToString:NSAccessibilityRowsAttribute]) {
+            AccessibilityObject::AccessibilityChildrenVector rowsCopy;
+            m_object->ariaTreeRows(rowsCopy);
+            return convertToNSArray(rowsCopy);            
+        }
+        
+        // TreeRoles do not support columns, but Mac AX expects to be able to ask about columns at the least.
+        if ([attributeName isEqualToString:NSAccessibilityColumnsAttribute])
+            return [NSArray array];
+    }
+
+    if (m_object->isTreeItem()) {
+        if ([attributeName isEqualToString:NSAccessibilityIndexAttribute]) {
+            AccessibilityObject* parent = m_object->parentObject();
+            for (; parent && !parent->isTree(); parent = parent->parentObject())
+            { }
+            
+            if (!parent)
+                return nil;
+            
+            // Find the index of this item by iterating the parents.
+            AccessibilityObject::AccessibilityChildrenVector rowsCopy;
+            parent->ariaTreeRows(rowsCopy);
+            size_t count = rowsCopy.size();
+            for (size_t k = 0; k < count; ++k)
+                if (rowsCopy[k]->wrapper() == self)
+                    return [NSNumber numberWithUnsignedInt:k];
+            
+            return nil;
+        }
+        
+        // The rows that are considered inside this row. 
+        if ([attributeName isEqualToString:NSAccessibilityDisclosedRowsAttribute]) {
+            AccessibilityObject::AccessibilityChildrenVector rowsCopy;
+            m_object->ariaTreeItemDisclosedRows(rowsCopy);
+            return convertToNSArray(rowsCopy);    
+        }
+
+        // The row that contains this row. It should be the same as the first parent that is a treeitem.
+        if ([attributeName isEqualToString:NSAccessibilityDisclosedByRowAttribute]) {
+            AccessibilityObject* parent = m_object->parentObject();
+            while (parent) {
+                if (parent->isTreeItem())
+                    return parent->wrapper();
+                // If the parent is the tree itself, then this value == nil.
+                if (parent->isTree())
+                    return nil;
+                parent = parent->parentObject();
+            }
+            return nil;
+        }
+        if ([attributeName isEqualToString:NSAccessibilityDisclosureLevelAttribute])
+            return [NSNumber numberWithInt:m_object->hierarchicalLevel()];
+        if ([attributeName isEqualToString:NSAccessibilityDisclosingAttribute])
+            return [NSNumber numberWithBool:m_object->isExpanded()];
+    }
+    
     if ((m_object->isListBox() || m_object->isList()) && [attributeName isEqualToString:NSAccessibilityOrientationAttribute])
         return NSAccessibilityVerticalOrientationValue;
 
@@ -1504,9 +1764,32 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([attributeName isEqualToString:NSAccessibilityLanguageAttribute]) 
         return m_object->language();
     
+    if ([attributeName isEqualToString:NSAccessibilityExpandedAttribute])
+        return [NSNumber numberWithBool:m_object->isExpanded()];
+    
     if ([attributeName isEqualToString:NSAccessibilityRequiredAttribute])
         return [NSNumber numberWithBool:m_object->isRequired()];
 
+    if ([attributeName isEqualToString:NSAccessibilityOwnsAttribute]) {
+        AccessibilityObject::AccessibilityChildrenVector ariaOwns;
+        m_object->ariaOwnsElements(ariaOwns);
+        return convertToNSArray(ariaOwns);
+    }
+    
+    if ([attributeName isEqualToString:NSAccessibilityGrabbedAttribute])
+        return [NSNumber numberWithBool:m_object->isARIAGrabbed()];
+    
+    if ([attributeName isEqualToString:NSAccessibilityDropEffectsAttribute]) {
+        Vector<String> dropEffects;
+        m_object->determineARIADropEffects(dropEffects);
+        size_t length = dropEffects.size();
+
+        NSMutableArray* dropEffectsArray = [NSMutableArray arrayWithCapacity:length];
+        for (size_t i = 0; i < length; ++i)
+            [dropEffectsArray addObject:dropEffects[i]];
+        return dropEffectsArray;
+    }
+    
     // this is used only by DumpRenderTree for testing
     if ([attributeName isEqualToString:@"AXClickPoint"])
         return [NSValue valueWithPoint:m_object->clickPoint()];
@@ -1570,11 +1853,20 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([attributeName isEqualToString: NSAccessibilitySelectedChildrenAttribute])
         return m_object->canSetSelectedChildrenAttribute();
 
+    if ([attributeName isEqualToString:NSAccessibilityDisclosingAttribute])
+        return m_object->canSetExpandedAttribute();
+
+    if ([attributeName isEqualToString:NSAccessibilitySelectedRowsAttribute])
+        return YES;
+
     if ([attributeName isEqualToString: NSAccessibilitySelectedTextAttribute] ||
         [attributeName isEqualToString: NSAccessibilitySelectedTextRangeAttribute] ||
         [attributeName isEqualToString: NSAccessibilityVisibleCharacterRangeAttribute])
         return m_object->canSetTextRangeAttributes();
     
+    if ([attributeName isEqualToString:NSAccessibilityGrabbedAttribute])
+        return YES;
+    
     return NO;
 }
 
@@ -1736,9 +2028,13 @@ static NSString* roleValueToNSString(AccessibilityRole value)
 
 - (void)accessibilityPerformShowMenuAction
 {
-    // This needs to be performed in an iteration of the run loop that did not start from an AX call. 
-    // If it's the same run loop iteration, the menu open notification won't be sent
-    [self performSelector:@selector(accessibilityShowContextMenu) withObject:nil afterDelay:0.0];
+    if (m_object->roleValue() == ComboBoxRole)
+        m_object->setIsExpanded(true);
+    else {
+        // This needs to be performed in an iteration of the run loop that did not start from an AX call. 
+        // If it's the same run loop iteration, the menu open notification won't be sent
+        [self performSelector:@selector(accessibilityShowContextMenu) withObject:nil afterDelay:0.0];
+    }
 }
 
 - (void)accessibilityShowContextMenu
@@ -1852,7 +2148,15 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         } else if ([attributeName isEqualToString: NSAccessibilityVisibleCharacterRangeAttribute]) {
             m_object->makeRangeVisible(PlainTextRange(range.location, range.length));
         }
-    }
+    } else if ([attributeName isEqualToString:NSAccessibilityDisclosingAttribute])
+        m_object->setIsExpanded([number boolValue]);
+    else if ([attributeName isEqualToString:NSAccessibilitySelectedRowsAttribute]) {
+        AccessibilityObject::AccessibilityChildrenVector selectedRows;
+        convertToVector(array, selectedRows);
+        if (m_object->isTree())
+            m_object->setSelectedRows(selectedRows);
+    } else if ([attributeName isEqualToString:NSAccessibilityGrabbedAttribute])
+        m_object->setARIAGrabbed([number boolValue]);
 }
 
 static RenderObject* rendererForView(NSView* view)
@@ -2186,7 +2490,12 @@ static RenderObject* rendererForView(NSView* view)
     m_object->updateBackingStore();
     if (!m_object)
         return NSNotFound;
-
+    
+    // Tree objects return their rows as their children. We can use the original method
+    // here, because we won't gain any speed up.
+    if (m_object->isTree())
+        return [super accessibilityIndexOfChild:child];
+       
     const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
        
     if (children.isEmpty())
@@ -2212,6 +2521,11 @@ static RenderObject* rendererForView(NSView* view)
         return 0;
     
     if ([attribute isEqualToString:NSAccessibilityChildrenAttribute]) {
+        // Tree items object returns a different set of children than those that are in children()
+        // because an AXOutline (the mac role is becomes) has some odd stipulations.
+        if (m_object->isTree() || m_object->isTreeItem())
+            return [[self accessibilityAttributeValue:NSAccessibilityChildrenAttribute] count];
+        
         const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
         if (children.isEmpty())
             return [[self renderWidgetChildren] count];
@@ -2243,6 +2557,9 @@ static RenderObject* rendererForView(NSView* view)
             
             NSUInteger arrayLength = min(childCount - index, maxCount);
             return [children subarrayWithRange:NSMakeRange(index, arrayLength)];
+        } else if (m_object->isTree()) {
+            // Tree objects return their rows as their children. We can use the original method in this case.
+            return [super accessibilityArrayAttributeValues:attribute index:index maxCount:maxCount];
         }
         
         const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
diff --git a/WebCore/accessibility/win/AXObjectCacheWin.cpp b/WebCore/accessibility/win/AXObjectCacheWin.cpp
index a1bdcc0..863793c 100644
--- a/WebCore/accessibility/win/AXObjectCacheWin.cpp
+++ b/WebCore/accessibility/win/AXObjectCacheWin.cpp
@@ -74,6 +74,7 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
     DWORD msaaEvent;
     switch (notification) {
         case AXFocusedUIElementChanged:
+        case AXActiveDescendantChanged:
             msaaEvent = EVENT_OBJECT_FOCUS;
             break;
 
diff --git a/WebCore/bindings/ScriptControllerBase.cpp b/WebCore/bindings/ScriptControllerBase.cpp
index c232e84..72c9f45 100644
--- a/WebCore/bindings/ScriptControllerBase.cpp
+++ b/WebCore/bindings/ScriptControllerBase.cpp
@@ -62,6 +62,9 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture,
     if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
         return true;
 
+    if (m_frame->inViewSourceMode())
+        return true;
+
     const int javascriptSchemeLength = sizeof("javascript:") - 1;
 
     String script = decodeURLEscapeSequences(url.string().substring(javascriptSchemeLength));
@@ -70,8 +73,15 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture,
         result = executeScript(script, userGesture);
 
     String scriptResult;
+#if USE(JSC)
+    JSDOMWindowShell* shell = windowShell(mainThreadNormalWorld());
+    JSC::ExecState* exec = shell->window()->globalExec();
+    if (!result.getString(exec, scriptResult))
+        return true;
+#else
     if (!result.getString(scriptResult))
         return true;
+#endif
 
     // FIXME: We should always replace the document, but doing so
     //        synchronously can cause crashes:
diff --git a/WebCore/bindings/js/JSAttrCustom.cpp b/WebCore/bindings/js/JSAttrCustom.cpp
index 14457c4..3c01535 100644
--- a/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/WebCore/bindings/js/JSAttrCustom.cpp
@@ -65,10 +65,8 @@ void JSAttr::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->ownerElement()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->ownerElement())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSBindingsAllInOne.cpp b/WebCore/bindings/js/JSBindingsAllInOne.cpp
new file mode 100644
index 0000000..cf1049a
--- /dev/null
+++ b/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "GCController.cpp"
+#include "JSAbstractWorkerCustom.cpp"
+#include "JSAttrCustom.cpp"
+#include "JSAudioConstructor.cpp"
+#include "JSCDATASectionCustom.cpp"
+#include "JSCSSRuleCustom.cpp"
+#include "JSCSSRuleListCustom.cpp"
+#include "JSCSSStyleDeclarationCustom.cpp"
+#include "JSCSSValueCustom.cpp"
+#include "JSCallbackData.cpp"
+#include "JSCanvasRenderingContext2DCustom.cpp"
+#include "JSCanvasRenderingContextCustom.cpp"
+#include "JSClipboardCustom.cpp"
+#include "JSConsoleCustom.cpp"
+#include "JSCoordinatesCustom.cpp"
+#include "JSCustomSQLStatementCallback.cpp"
+#include "JSCustomSQLStatementErrorCallback.cpp"
+#include "JSCustomSQLTransactionCallback.cpp"
+#include "JSCustomSQLTransactionErrorCallback.cpp"
+#include "JSCustomVoidCallback.cpp"
+#include "JSCustomXPathNSResolver.cpp"
+#include "JSDOMApplicationCacheCustom.cpp"
+#include "JSDOMBinding.cpp"
+#include "JSDOMGlobalObject.cpp"
+#include "JSDOMWindowBase.cpp"
+#include "JSDOMWindowCustom.cpp"
+#include "JSDOMWindowShell.cpp"
+#include "JSDataGridColumnListCustom.cpp"
+#include "JSDataGridDataSource.cpp"
+#include "JSDatabaseCustom.cpp"
+#include "JSDedicatedWorkerContextCustom.cpp"
+#include "JSDesktopNotificationsCustom.cpp"
+#include "JSDocumentCustom.cpp"
+#include "JSDocumentFragmentCustom.cpp"
+#include "JSElementCustom.cpp"
+#include "JSEventCustom.cpp"
+#include "JSEventListener.cpp"
+#include "JSEventSourceConstructor.cpp"
+#include "JSEventSourceCustom.cpp"
+#include "JSEventTarget.cpp"
+#include "JSExceptionBase.cpp"
+#include "JSHTMLAllCollectionCustom.cpp"
+#include "JSHTMLAppletElementCustom.cpp"
+#include "JSHTMLCanvasElementCustom.cpp"
+#include "JSHTMLCollectionCustom.cpp"
+#include "JSHTMLDataGridElementCustom.cpp"
+#include "JSHTMLDocumentCustom.cpp"
+#include "JSHTMLElementCustom.cpp"
+#include "JSHTMLEmbedElementCustom.cpp"
+#include "JSHTMLFormElementCustom.cpp"
+#include "JSHTMLFrameElementCustom.cpp"
+#include "JSHTMLFrameSetElementCustom.cpp"
+#include "JSHTMLIFrameElementCustom.cpp"
+#include "JSHTMLInputElementCustom.cpp"
+#include "JSHTMLObjectElementCustom.cpp"
+#include "JSHTMLOptionsCollectionCustom.cpp"
+#include "JSHTMLSelectElementCustom.cpp"
+#include "JSHistoryCustom.cpp"
+#include "JSImageConstructor.cpp"
+#include "JSImageDataCustom.cpp"
+#include "JSInjectedScriptHostCustom.cpp"
+#include "JSInspectedObjectWrapper.cpp"
+#include "JSInspectorFrontendHostCustom.cpp"
+#include "JSJavaScriptCallFrameCustom.cpp"
+#include "JSLazyEventListener.cpp"
+#include "JSLocationCustom.cpp"
+#include "JSMessageChannelConstructor.cpp"
+#include "JSMessageChannelCustom.cpp"
+#include "JSMessageEventCustom.cpp"
+#include "JSMessagePortCustom.cpp"
+#include "JSMimeTypeArrayCustom.cpp"
+#include "JSNamedNodeMapCustom.cpp"
+#include "JSNavigatorCustom.cpp"
+#include "JSNodeCustom.cpp"
+#include "JSNodeFilterCondition.cpp"
+#include "JSNodeFilterCustom.cpp"
+#include "JSNodeIteratorCustom.cpp"
+#include "JSNodeListCustom.cpp"
+#include "JSOptionConstructor.cpp"
+#include "JSPluginArrayCustom.cpp"
+#include "JSPluginCustom.cpp"
+#include "JSPluginElementFunctions.cpp"
+#include "JSQuarantinedObjectWrapper.cpp"
+#include "JSSQLResultSetRowListCustom.cpp"
+#include "JSSQLTransactionCustom.cpp"
+#include "JSSVGElementInstanceCustom.cpp"
+#include "JSSVGLengthCustom.cpp"
+#include "JSSVGMatrixCustom.cpp"
+#include "JSSVGPathSegCustom.cpp"
+#include "JSSVGPathSegListCustom.cpp"
+#include "JSSVGPointListCustom.cpp"
+#include "JSSharedWorkerConstructor.cpp"
+#include "JSSharedWorkerCustom.cpp"
+#include "JSStorageCustom.cpp"
+#include "JSStyleSheetCustom.cpp"
+#include "JSStyleSheetListCustom.cpp"
+#include "JSTextCustom.cpp"
+#include "JSTreeWalkerCustom.cpp"
+#include "JSWebKitCSSMatrixConstructor.cpp"
+#include "JSWebKitPointConstructor.cpp"
+#include "JSWebSocketConstructor.cpp"
+#include "JSWebSocketCustom.cpp"
+#include "JSWorkerConstructor.cpp"
+#include "JSWorkerContextBase.cpp"
+#include "JSWorkerContextCustom.cpp"
+#include "JSWorkerCustom.cpp"
+#include "JSXMLHttpRequestConstructor.cpp"
+#include "JSXMLHttpRequestCustom.cpp"
+#include "JSXMLHttpRequestUploadCustom.cpp"
+#include "JSXSLTProcessorConstructor.cpp"
+#include "JSXSLTProcessorCustom.cpp"
+#include "ScheduledAction.cpp"
+#include "ScriptArray.cpp"
+#include "ScriptCachedFrameData.cpp"
+#include "ScriptCallFrame.cpp"
+#include "ScriptCallStack.cpp"
+#include "ScriptController.cpp"
+#include "ScriptControllerWin.cpp"
+#include "ScriptEventListener.cpp"
+#include "ScriptFunctionCall.cpp"
+#include "ScriptState.cpp"
+#include "SerializedScriptValue.cpp"
+#include "WorkerScriptController.cpp"
diff --git a/WebCore/bindings/js/JSCSSRuleCustom.cpp b/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 1b96c06..b0adf15 100644
--- a/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -54,7 +54,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSRule* rule)
     if (!rule)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), rule);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, rule);
     if (wrapper)
         return wrapper;
 
diff --git a/WebCore/bindings/js/JSCSSValueCustom.cpp b/WebCore/bindings/js/JSCSSValueCustom.cpp
index 87a5760..83c1d3a 100644
--- a/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -49,7 +49,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSValue* value)
     if (!value)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), value);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, value);
 
     if (wrapper)
         return wrapper;
diff --git a/WebCore/bindings/js/JSCallbackData.cpp b/WebCore/bindings/js/JSCallbackData.cpp
index 38292c7..e128f27 100644
--- a/WebCore/bindings/js/JSCallbackData.cpp
+++ b/WebCore/bindings/js/JSCallbackData.cpp
@@ -47,13 +47,8 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     ASSERT(globalObject());
 
     ExecState* exec = globalObject()->globalExec();
-    
-    JSValue function;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        function = callback()->get(exec, Identifier(exec, "handleEvent"));
-    }
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -64,7 +59,7 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     }
     
     globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = callInWorld(exec, function, callType, callData, callback(), args, m_isolatedWorld.get());
+    JSValue result = JSC::call(exec, function, callType, callData, callback(), args);
     globalObject()->globalData()->timeoutChecker.stop();
 
     Document::updateStyleForAllDocuments();
diff --git a/WebCore/bindings/js/JSCallbackData.h b/WebCore/bindings/js/JSCallbackData.h
index 5c86701..b939c01 100644
--- a/WebCore/bindings/js/JSCallbackData.h
+++ b/WebCore/bindings/js/JSCallbackData.h
@@ -48,7 +48,6 @@ public:
     JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
         : m_callback(callback)
         , m_globalObject(globalObject)
-        , m_isolatedWorld(currentWorld(globalObject->globalExec()))
     {
     }
     
@@ -65,7 +64,6 @@ public:
 private:
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
     JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-    RefPtr<DOMWrapperWorld> m_isolatedWorld;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index bb3500b..a271923 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -51,10 +51,10 @@ static JSValue toJS(ExecState* exec, CanvasStyle* style)
     return jsString(exec, style->color());
 }
 
-static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState* exec, JSValue value)
 {
     if (value.isString())
-        return CanvasStyle::create(asString(value)->value());
+        return CanvasStyle::create(asString(value)->value(exec));
     if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
@@ -102,13 +102,13 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value());
+                context->setFillColor(asString(args.at(0))->value(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setFillColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -139,13 +139,13 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value());
+                context->setStrokeColor(asString(args.at(0))->value(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setStrokeColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -298,7 +298,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 4:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value());
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec));
@@ -306,7 +306,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 5:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value(),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec),
                                    args.at(4).toFloat(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
deleted file mode 100644
index 3938ba1..0000000
--- a/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
+++ /dev/null
@@ -1,443 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasRenderingContext3D.h"
-
-#include "CanvasRenderingContext3D.h"
-#include "ExceptionCode.h"
-#include "HTMLCanvasElement.h"
-#include "HTMLImageElement.h"
-#include "JSCanvasFloatArray.h"
-#include "JSCanvasIntArray.h"
-#include "JSHTMLCanvasElement.h"
-#include "JSHTMLImageElement.h"
-#include "JSWebKitCSSMatrix.h"
-#include <runtime/Error.h>
-#include <wtf/FastMalloc.h>
-#include <wtf/OwnFastMallocPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned usage = args.at(2).toInt32(exec);
-
-    // If argument 1 is a number, we are initializing this buffer to that size
-    if (!args.at(1).isObject()) {
-        unsigned int count = args.at(1).toInt32(exec);
-        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
-        return jsUndefined();
-    }
-
-    CanvasArray* array = toCanvasArray(args.at(1));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
-    return jsUndefined();
-}
-
-JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned offset = args.at(1).toInt32(exec);
-    
-    CanvasArray* array = toCanvasArray(args.at(2));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
-    return jsUndefined();
-}
-
-// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 3)
-        return throwError(exec, SyntaxError);
-
-    ExceptionCode ec = 0;
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    unsigned level = args.at(1).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-    
-    if (args.size() > 5) {
-        // This must be the bare array case.
-        if (args.size() != 9)
-            return throwError(exec, SyntaxError);
-            
-        unsigned internalformat = args.at(2).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned width = args.at(3).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned height = args.at(4).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned border = args.at(5).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned format = args.at(6).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned type = args.at(7).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        CanvasArray* array = toCanvasArray(args.at(8));
-        if (exec->hadException())    
-            return jsUndefined();
-            
-        if (!array)
-            return throwError(exec, TypeError);
-        
-        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
-        // depending on the passed type parameter.
-        
-        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
-        return jsUndefined();
-    }
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(2);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 7 || args.size() > 9)
-        return throwError(exec, SyntaxError);
-
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned level = args.at(1).toInt32(exec);
-    unsigned xoff = args.at(2).toInt32(exec);
-    unsigned yoff = args.at(3).toInt32(exec);
-    unsigned width = args.at(4).toInt32(exec);
-    unsigned height = args.at(5).toInt32(exec);
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(6);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    ExceptionCode ec = 0;
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-template<typename T>
-void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
-{
-    array = 0;
-    
-    if (!value.isObject())
-        return;
-        
-    JSC::JSObject* object = asObject(value);
-    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
-    void* tempValues;
-    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
-        return;
-    
-    T* values = static_cast<T*>(tempValues);
-    for (int i = 0; i < length; ++i) {
-        JSC::JSValue v = object->get(exec, i);
-        if (exec->hadException())
-            return;
-        values[i] = static_cast<T>(v.toNumber(exec));
-    }
-
-    array = values;
-    size = length;
-}
-
-enum DataFunctionToCall {
-    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
-    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
-};
-
-enum DataFunctionMatrixToCall {
-    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
-};
-
-static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
-            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
-            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
-            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
-            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1fv(location, array, size); break;
-        case f_uniform2v: context->uniform2fv(location, array, size); break;
-        case f_uniform3v: context->uniform3fv(location, array, size); break;
-        case f_uniform4v: context->uniform4fv(location, array, size); break;
-        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
-        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
-        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
-        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
-            default: break;
-        }
-        return jsUndefined();
-    }
-    
-    int* array;
-    int size;
-    toArray<int>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1iv(location, array, size); break;
-        case f_uniform2v: context->uniform2iv(location, array, size); break;
-        case f_uniform3v: context->uniform3iv(location, array, size); break;
-        case f_uniform4v: context->uniform4iv(location, array, size); break;
-        default: break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    bool transpose = args.at(1).toBoolean(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(2), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
-        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
-        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
-    }
-    return jsUndefined();
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
index 0cd2aa3..df24eb7 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -29,8 +29,8 @@
 #include "CanvasRenderingContext2D.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "CanvasRenderingContext3D.h"
-#include "JSCanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 
 using namespace JSC;
@@ -44,7 +44,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasR
 
 #if ENABLE(3D_CANVAS)
     if (object->is3d())
-        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+        return getDOMObjectWrapper<JSWebGLRenderingContext>(exec, globalObject, static_cast<WebGLRenderingContext*>(object));
 #endif
     ASSERT(object->is2d());
     return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
deleted file mode 100644
index 23c197f..0000000
--- a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasUnsignedShortArrayConstructor_h
-#define JSCanvasUnsignedShortArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSConsoleCustom.cpp b/WebCore/bindings/js/JSConsoleCustom.cpp
index 9c48467..8366b39 100644
--- a/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSConsole.h"
 #include "JavaScriptProfile.h"
+#include "ScriptCallStack.h"
 #include <runtime/JSArray.h>
 
 #include "Console.h"
@@ -50,6 +51,22 @@ JSValue JSConsole::profiles(ExecState* exec) const
     return constructArray(exec, list);
 }
 
+JSValue JSConsole::profile(ExecState* exec, const ArgList& args)
+{
+    ScriptCallStack callStack(exec, args, 1);
+    const UString title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    impl()->profile(title, &callStack);
+    return jsUndefined();
+}
+
+JSValue JSConsole::profileEnd(ExecState* exec, const ArgList& args)
+{
+    ScriptCallStack callStack(exec, args, 1);
+    const UString title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    impl()->profileEnd(title, &callStack);
+    return jsUndefined();
+}
+
 #endif
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index c2884d7..07cfc74 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -90,7 +90,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     args.append(jsString(exec, prefix));
 
     m_globalObject->globalData()->timeoutChecker.start();
-    JSValue retval = callInWorld(exec, function, callType, callData, m_customResolver, args, currentWorld(m_globalObject->globalExec()));
+    JSValue retval = JSC::call(exec, function, callType, callData, m_customResolver, args);
     m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
index ef69c7b..f12c779 100644
--- a/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -45,6 +45,7 @@
 #include "KURL.h"
 #include "MessagePort.h"
 #include "RangeException.h"
+#include "ScriptCachedFrameData.h"
 #include "ScriptController.h"
 #include "Settings.h"
 #include "XMLHttpRequestException.h"
@@ -167,29 +168,6 @@ DOMWrapperWorld::~DOMWrapperWorld()
 
     for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
         forgetWorldOfDOMNodesForDocument(*iter, this);
-    for (HashSet<ScriptController*>::iterator iter = scriptControllersWithShells.begin(); iter != scriptControllersWithShells.end(); ++iter)
-        (*iter)->forgetWorld(this);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::JSGlobalData& globalData, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::ExecState* exec, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = exec->globalData().clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::~EnterDOMWrapperWorld()
-{
-    m_clientData->m_worldStack.removeLast();
 }
 
 class JSGlobalDataWorldIterator {
@@ -228,16 +206,9 @@ private:
     HashSet<DOMWrapperWorld*>::iterator m_end;
 };
 
-static inline DOMWrapperWorld* currentWorld(JSC::JSGlobalData& globalData)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
-}
-
 DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
 {
-    return currentWorld(exec->globalData());
+    return static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->world();
 }
 
 DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
@@ -250,16 +221,8 @@ DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
 DOMWrapperWorld* mainThreadNormalWorld()
 {
     ASSERT(isMainThread());
-    return normalWorld(*JSDOMWindow::commonJSGlobalData());
-}
-
-DOMWrapperWorld* mainThreadCurrentWorld()
-{
-    ASSERT(isMainThread());
-
-    JSGlobalData::ClientData* clientData = JSDOMWindowBase::commonJSGlobalData()->clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
+    static DOMWrapperWorld* cachedNormalWorld = normalWorld(*JSDOMWindow::commonJSGlobalData());
+    return cachedNormalWorld;
 }
 
 DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
@@ -274,28 +237,49 @@ const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const
     return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
 }
 
-//inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
-inline DOMObjectWrapperMap& DOMObjectWrapperMapFor(JSGlobalData& globalData)
+static inline DOMObjectWrapperMap& DOMObjectWrapperMapFor(JSC::ExecState* exec)
 {
-    return currentWorld(globalData)->m_wrappers;
+    return currentWorld(exec)->m_wrappers;
 }
 
-DOMObject* getCachedDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle) 
+bool hasCachedDOMObjectWrapper(JSGlobalData* globalData, void* objectHandle)
 {
-    return DOMObjectWrapperMapFor(globalData).get(objectHandle);
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.contains(objectHandle))
+            return true;
+    }
+    return false;
 }
 
-void cacheDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle, DOMObject* wrapper) 
+DOMObject* getCachedDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle) 
+{
+    return DOMObjectWrapperMapFor(exec).get(objectHandle);
+}
+
+void cacheDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle, DOMObject* wrapper) 
 {
     addWrapper(wrapper);
-    DOMObjectWrapperMapFor(globalData).set(objectHandle, wrapper);
+    DOMObjectWrapperMapFor(exec).set(objectHandle, wrapper);
+}
+
+bool hasCachedDOMNodeWrapper(Document* document, Node* node)
+{
+    if (!document)
+        return hasCachedDOMObjectWrapper(JSDOMWindow::commonJSGlobalData(), node);
+
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+        if (iter->second->contains(node))
+            return true;
+    }
+    return false;
 }
 
-JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
+JSNode* getCachedDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node)
 {
     if (document)
-        return document->getWrapperCache(mainThreadCurrentWorld())->get(node);
-    return static_cast<JSNode*>(DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
+        return document->getWrapperCache(currentWorld(exec))->get(node);
+    return static_cast<JSNode*>(DOMObjectWrapperMapFor(exec).get(node));
 }
 
 void forgetDOMObject(DOMObject* wrapper, void* objectHandle)
@@ -337,15 +321,15 @@ void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document)
     ASSERT(!wrapperSet().contains(wrapper));
 }
 
-void cacheDOMNodeWrapper(Document* document, Node* node, JSNode* wrapper)
+void cacheDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node, JSNode* wrapper)
 {
     if (!document) {
         addWrapper(wrapper);
-        DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
+        DOMObjectWrapperMapFor(exec).set(node, wrapper);
         return;
     }
     addWrapper(wrapper);
-    document->getWrapperCache(mainThreadCurrentWorld())->set(node, wrapper);
+    document->getWrapperCache(currentWorld(exec))->set(node, wrapper);
 }
 
 void forgetAllDOMNodesForDocument(Document* document)
@@ -537,6 +521,23 @@ void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void*
     }
 }
 
+void markDOMNodeWrapper(MarkStack& markStack, Document* document, Node* node)
+{
+    if (document) {
+        JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+        for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+            if (JSNode* wrapper = iter->second->get(node))
+                markStack.append(wrapper);
+        }
+        return;
+    }
+
+    for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
+        if (DOMObject* wrapper = worldIter->m_wrappers.get(node))
+            markStack.append(wrapper);
+    }
+}
+
 JSValue jsStringOrNull(ExecState* exec, const String& s)
 {
     if (s.isNull())
@@ -810,28 +811,4 @@ bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDe
     return false;
 }
 
-JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const UString& script, JSValue& exception)
-{
-    EnterDOMWrapperWorld worldEntry(debuggerCallFrame.dynamicGlobalObject()->globalExec(), debuggerWorld());
-    return debuggerCallFrame.evaluate(script, exception);
-}
-
-JSValue callInWorld(ExecState* exec, JSValue function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::call(exec, function, callType, callData, thisValue, args);
-}
-
-JSObject* constructInWorld(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::construct(exec, object, constructType, constructData, args);
-}
-
-Completion evaluateInWorld(ExecState* exec, ScopeChain& scopeChain, const SourceCode& sourceCode, JSValue thisValue, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::evaluate(exec, scopeChain, sourceCode, thisValue);
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
index ba41d85..3982dad 100644
--- a/WebCore/bindings/js/JSDOMBinding.h
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -42,6 +42,7 @@ namespace WebCore {
     class Node;
     class String;
     class ScriptController;
+    class ScriptCachedFrameData;
 
     typedef int ExceptionCode;
 
@@ -147,8 +148,6 @@ namespace WebCore {
 
         void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
         void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
-        void rememberScriptController(ScriptController* scriptController) { scriptControllersWithShells.add(scriptController); }
-        void forgetScriptController(ScriptController* scriptController) { scriptControllersWithShells.remove(scriptController); }
 
         // FIXME: can we make this private?
         DOMObjectWrapperMap m_wrappers;
@@ -156,7 +155,6 @@ namespace WebCore {
     private:
         JSC::JSGlobalData* m_globalData;
         HashSet<Document*> documentsWithWrappers;
-        HashSet<ScriptController*> scriptControllersWithShells;
     };
 
     // Map from static HashTable instances to per-GlobalData ones.
@@ -184,21 +182,23 @@ namespace WebCore {
     };
 
     class WebCoreJSClientData : public JSC::JSGlobalData::ClientData {
-        friend class EnterDOMWrapperWorld;
         friend class JSGlobalDataWorldIterator;
 
     public:
         WebCoreJSClientData(JSC::JSGlobalData* globalData)
             : m_normalWorld(globalData)
         {
-            m_worldStack.append(&m_normalWorld);
             m_worldSet.add(&m_normalWorld);
         }
         // FIXME: add a destructor to assert m_worldSet only contains m_normalWorld?
 
-        DOMWrapperWorld* currentWorld() { return m_worldStack.last(); }
         DOMWrapperWorld* normalWorld() { return &m_normalWorld; }
 
+        void getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
+        {
+            copyToVector(m_worldSet, worlds);
+        }
+
         void rememberWorld(DOMWrapperWorld* world)
         {
             ASSERT(!m_worldSet.contains(world));
@@ -212,34 +212,26 @@ namespace WebCore {
 
         DOMObjectHashTableMap hashTableMap;
     private:
-        Vector<DOMWrapperWorld*> m_worldStack;
         HashSet<DOMWrapperWorld*> m_worldSet;
         DOMWrapperWorld m_normalWorld;
     };
 
-    class EnterDOMWrapperWorld {
-    public:
-        EnterDOMWrapperWorld(JSC::JSGlobalData&, DOMWrapperWorld*);
-        EnterDOMWrapperWorld(JSC::ExecState*, DOMWrapperWorld*);
-        ~EnterDOMWrapperWorld();
-
-    private:
-        WebCoreJSClientData* m_clientData;
-    };
-
-    DOMObject* getCachedDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle);
-    void cacheDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle, DOMObject* wrapper);
+    bool hasCachedDOMObjectWrapper(JSC::JSGlobalData*, void* objectHandle);
+    DOMObject* getCachedDOMObjectWrapper(JSC::ExecState*, void* objectHandle);
+    void cacheDOMObjectWrapper(JSC::ExecState*, void* objectHandle, DOMObject* wrapper);
     void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document);
     void forgetDOMObject(DOMObject* wrapper, void* objectHandle);
 
-    JSNode* getCachedDOMNodeWrapper(Document*, Node*);
-    void cacheDOMNodeWrapper(Document*, Node*, JSNode* wrapper);
+    bool hasCachedDOMNodeWrapper(Document*, Node*);
+    JSNode* getCachedDOMNodeWrapper(JSC::ExecState*, Document*, Node*);
+    void cacheDOMNodeWrapper(JSC::ExecState*, Document*, Node*, JSNode* wrapper);
     void forgetAllDOMNodesForDocument(Document*);
     void forgetWorldOfDOMNodesForDocument(Document*, DOMWrapperWorld*);
     void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
     void markDOMNodesForDocument(JSC::MarkStack&, Document*);
     void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
+    void markDOMNodeWrapper(JSC::MarkStack& markStack, Document* document, Node* node);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
@@ -248,7 +240,6 @@ namespace WebCore {
 
     DOMWrapperWorld* currentWorld(JSC::ExecState*);
     DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
-    DOMWrapperWorld* mainThreadCurrentWorld();
     DOMWrapperWorld* mainThreadNormalWorld();
     inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
     inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
@@ -283,17 +274,17 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
+        ASSERT(!getCachedDOMObjectWrapper(exec, object));
         // FIXME: new (exec) could use a different globalData than the globalData this wrapper is cached on.
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        cacheDOMObjectWrapper(exec, object, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
             return wrapper;
         return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object);
     }
@@ -303,16 +294,16 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
         ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
+        ASSERT(!getCachedDOMObjectWrapper(exec, object));
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object, context);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        cacheDOMObjectWrapper(exec, object, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
             return wrapper;
         return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object, context);
     }
@@ -322,18 +313,18 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline JSNode* createDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         ASSERT(node);
-        ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+        ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, node);
         // FIXME: The entire function can be removed, once we fix caching.
         // This function is a one-off hack to make Nodes cache in the right global object.
-        cacheDOMNodeWrapper(node->document(), node, wrapper);
+        cacheDOMNodeWrapper(exec, node->document(), node, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         if (!node)
             return JSC::jsNull();
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node))
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node))
             return wrapper;
         return createDOMNodeWrapper<WrapperClass>(exec, globalObject, node);
     }
@@ -404,11 +395,6 @@ namespace WebCore {
     bool processingUserGesture(JSC::ExecState*);
     KURL completeURL(JSC::ExecState*, const String& relativeURL);
 
-    JSC::JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const JSC::UString& script, JSC::JSValue& exception);
-    JSC::JSValue callInWorld(JSC::ExecState*, JSC::JSValue function, JSC::CallType, const JSC::CallData&, JSC::JSValue thisValue, const JSC::ArgList&, DOMWrapperWorld*);
-    JSC::JSObject* constructInWorld(JSC::ExecState* exec, JSC::JSValue object, JSC::ConstructType constructType, const JSC::ConstructData& constructData, const JSC::ArgList& args, DOMWrapperWorld*);
-    JSC::Completion evaluateInWorld(JSC::ExecState*, JSC::ScopeChain&, const JSC::SourceCode&, JSC::JSValue thisValue, DOMWrapperWorld*);
-
 } // namespace WebCore
 
 #endif // JSDOMBinding_h
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.h b/WebCore/bindings/js/JSDOMGlobalObject.h
index 6b75a6f..647730c 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -66,17 +66,14 @@ namespace WebCore {
 
         virtual void markChildren(JSC::MarkStack&);
 
+        DOMWrapperWorld* world() { return d()->m_world.get(); }
+
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData()
-                : JSGlobalObjectData(destroyJSDOMGlobalObjectData)
-                , evt(0)
-            {
-            }
-
-            JSDOMGlobalObjectData(Destructor destructor)
+            JSDOMGlobalObjectData(DOMWrapperWorld* world, Destructor destructor = destroyJSDOMGlobalObjectData)
                 : JSGlobalObjectData(destructor)
                 , evt(0)
+                , m_world(world)
             {
             }
 
@@ -84,6 +81,7 @@ namespace WebCore {
             JSDOMConstructorMap constructors;
 
             Event* evt;
+            RefPtr<DOMWrapperWorld> m_world;
         };
 
     private:
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
index 86ff149..e3af13f 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -42,6 +42,13 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
+JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+    : JSDOMGlobalObjectData(shell->world(), destroyJSDOMWindowBaseData)
+    , impl(window)
+    , shell(shell)
+{
+}
+
 JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
@@ -53,11 +60,10 @@ JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRef
     addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
 }
 
-void JSDOMWindowBase::updateDocument(DOMWrapperWorld* world)
+void JSDOMWindowBase::updateDocument()
 {
     ASSERT(d()->impl->document());
     ExecState* exec = globalExec();
-    EnterDOMWrapperWorld worldEntry(exec, world);
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, this, d()->impl->document()), DontDelete | ReadOnly);
 }
 
diff --git a/WebCore/bindings/js/JSDOMWindowBase.h b/WebCore/bindings/js/JSDOMWindowBase.h
index 31e2486..66af344 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/WebCore/bindings/js/JSDOMWindowBase.h
@@ -47,7 +47,7 @@ namespace WebCore {
         JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        void updateDocument(DOMWrapperWorld*);
+        void updateDocument();
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -77,12 +77,7 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
-                , impl(window)
-                , shell(shell)
-            {
-            }
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell);
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2804b3c..66fe926 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -53,14 +53,14 @@
 #endif
 
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArrayConstructor.h"
-#include "JSCanvasUnsignedByteArrayConstructor.h"
-#include "JSCanvasIntArrayConstructor.h"
-#include "JSCanvasUnsignedIntArrayConstructor.h"
-#include "JSCanvasShortArrayConstructor.h"
-#include "JSCanvasUnsignedShortArrayConstructor.h"
-#include "JSCanvasFloatArrayConstructor.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArrayConstructor.h"
+#include "JSWebGLUnsignedByteArrayConstructor.h"
+#include "JSWebGLIntArrayConstructor.h"
+#include "JSWebGLUnsignedIntArrayConstructor.h"
+#include "JSWebGLShortArrayConstructor.h"
+#include "JSWebGLUnsignedShortArrayConstructor.h"
+#include "JSWebGLFloatArrayConstructor.h"
 #endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
@@ -297,10 +297,10 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
 
 bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
-    // are not affected by properties changed on the Window or anything in its prototype chain.
-    // This is consistent with the behavior of Firefox.
-    
+    // Never allow cross-domain getOwnPropertyDescriptor
+    if (!allowsAccessFrom(exec))
+        return false;
+
     const HashEntry* entry;
     
     // We don't want any properties other than "close" and "closed" on a closed window.
@@ -323,11 +323,6 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
         return true;
     }
 
-    String errorMessage;
-    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
-    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
-        return true;
-
     // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
     // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
     // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
@@ -335,51 +330,13 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
         if (entry->attributes() & Function) {
-            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
                 if (!DOMWindow::canShowModalDialog(impl()->frame())) {
                     descriptor.setUndefined();
                     return true;
                 }
             }
         }
-    } else {
-        // Allow access to toString() cross-domain, but always Object.prototype.toString.
-        if (propertyName == exec->propertyNames().toString) {
-            if (!allowsAccess) {
-                PropertySlot slot;
-                slot.setCustom(this, objectToStringFunctionGetter);
-                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                return true;
-            }
-        }
     }
     
     entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -406,13 +363,8 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     // precedence over the index and name getters.  
     JSValue proto = prototype();
     if (proto.isObject()) {
-        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
-            if (!allowsAccess) {
-                printErrorMessage(errorMessage);
-                descriptor.setUndefined();
-            }
+        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor))
             return true;
-        }
     }
 
     bool ok;
@@ -482,14 +434,6 @@ void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& proper
     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
-bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    // Only allow getting property attributes properties by frames in the same origin.
-    if (!allowsAccessFrom(exec))
-        return false;
-    return Base::getPropertyAttributes(exec, propertyName, attributes);
-}
-
 void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     // Only allow defining getters by frames in the same origin.
@@ -540,24 +484,24 @@ JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyNam
 JSValue JSDOMWindow::history(ExecState* exec) const
 {
     History* history = impl()->history();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, history))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, window), window, history);
-    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    cacheDOMObjectWrapper(exec, history, jsHistory);
     return jsHistory;
 }
 
 JSValue JSDOMWindow::location(ExecState* exec) const
 {
     Location* location = impl()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), window, location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -645,44 +589,44 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
 }
  
 #if ENABLE(3D_CANVAS)
-JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+JSValue JSDOMWindow::webGLArrayBuffer(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLArrayBufferConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLFloatArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLFloatArrayConstructor>(exec, this);
 }
 #endif
  
@@ -744,6 +688,10 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     ASSERT(lexicalFrame);
     ASSERT(dynamicFrame);
 
+    // Sandboxed iframes cannot open new auxiliary browsing contexts.
+    if (lexicalFrame && lexicalFrame->loader()->isSandboxed(SandboxNavigation))
+        return 0;
+
     ResourceRequest request;
 
     // For whatever reason, Firefox uses the dynamicGlobalObject to determine
diff --git a/WebCore/bindings/js/JSDOMWindowShell.cpp b/WebCore/bindings/js/JSDOMWindowShell.cpp
index 9072f91..09141ee 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -43,9 +43,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
 
-JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window)
+JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window, DOMWrapperWorld* world)
     : Base(JSDOMWindowShell::createStructure(jsNull()))
     , m_window(0)
+    , m_world(world)
 {
     setWindow(window);
 }
@@ -123,11 +124,6 @@ void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& p
     m_window->getOwnPropertyNames(exec, propertyNames);
 }
 
-bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    return m_window->getPropertyAttributes(exec, propertyName, attributes);
-}
-
 void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     m_window->defineGetter(exec, propertyName, getterFunction, attributes);
diff --git a/WebCore/bindings/js/JSDOMWindowShell.h b/WebCore/bindings/js/JSDOMWindowShell.h
index 36cb8d6..27036d4 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/WebCore/bindings/js/JSDOMWindowShell.h
@@ -40,7 +40,7 @@ namespace WebCore {
     class JSDOMWindowShell : public DOMObject {
         typedef DOMObject Base;
     public:
-        JSDOMWindowShell(PassRefPtr<DOMWindow>);
+        JSDOMWindowShell(PassRefPtr<DOMWindow>, DOMWrapperWorld* world);
         virtual ~JSDOMWindowShell();
 
         JSDOMWindow* window() const { return m_window; }
@@ -63,6 +63,8 @@ namespace WebCore {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
+        DOMWrapperWorld* world() { return m_world.get(); }
+
     private:
         static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | DOMObject::StructureFlags;
 
@@ -75,7 +77,6 @@ namespace WebCore {
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
         virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
@@ -85,6 +86,7 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
         JSDOMWindow* m_window;
+        RefPtr<DOMWrapperWorld> m_world;
     };
 
     JSC::JSValue toJS(JSC::ExecState*, Frame*);
diff --git a/WebCore/bindings/js/JSDocumentCustom.cpp b/WebCore/bindings/js/JSDocumentCustom.cpp
index d7f8725..4aa6583 100644
--- a/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -26,7 +26,7 @@
 #include "HTMLDocument.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
@@ -65,11 +65,11 @@ JSValue JSDocument::location(ExecState* exec) const
         return jsNull();
 
     Location* location = frame->domWindow()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, globalObject()), globalObject(), location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -96,7 +96,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* documen
     if (!document)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), document);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, document);
     if (wrapper)
         return wrapper;
 
diff --git a/WebCore/bindings/js/JSElementCustom.cpp b/WebCore/bindings/js/JSElementCustom.cpp
index fb64ff2..c725290 100644
--- a/WebCore/bindings/js/JSElementCustom.cpp
+++ b/WebCore/bindings/js/JSElementCustom.cpp
@@ -145,7 +145,7 @@ JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Eleme
     if (!element)
         return jsNull();
 
-    ASSERT(!getCachedDOMNodeWrapper(element->document(), element));
+    ASSERT(!getCachedDOMNodeWrapper(exec, element->document(), element));
 
     JSNode* wrapper;        
     if (element->isHTMLElement())
diff --git a/WebCore/bindings/js/JSEventCustom.cpp b/WebCore/bindings/js/JSEventCustom.cpp
index 28e38ac..06b2fe5 100644
--- a/WebCore/bindings/js/JSEventCustom.cpp
+++ b/WebCore/bindings/js/JSEventCustom.cpp
@@ -30,9 +30,11 @@
 #include "JSEvent.h"
 
 #include "Clipboard.h"
+#include "CompositionEvent.h"
 #include "Event.h"
 #include "JSBeforeLoadEvent.h"
 #include "JSClipboard.h"
+#include "JSCompositionEvent.h"
 #include "JSErrorEvent.h"
 #include "JSKeyboardEvent.h"
 #include "JSMessageEvent.h"
@@ -40,6 +42,7 @@
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
 #include "JSPageTransitionEvent.h"
+#include "JSPopStateEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -55,6 +58,7 @@
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
 #include "PageTransitionEvent.h"
+#include "PopStateEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -95,7 +99,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     if (!event)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), event);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, event);
     if (wrapper)
         return wrapper;
 
@@ -112,10 +116,15 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         else if (event->isSVGZoomEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, SVGZoomEvent, event);
 #endif
+<<<<<<< HEAD:WebCore/bindings/js/JSEventCustom.cpp
 #if ENABLE(TOUCH_EVENTS) // Android
         else if (event->isTouchEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, TouchEvent, event);
 #endif
+=======
+        else if (event->isCompositionEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, CompositionEvent, event);
+>>>>>>> webkit.org at r51976:WebCore/bindings/js/JSEventCustom.cpp
         else
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, UIEvent, event);
     } else if (event->isMutationEvent())
@@ -145,6 +154,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     else if (event->isErrorEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ErrorEvent, event);
 #endif
+    else if (event->isPopStateEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PopStateEvent, event);
     else
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, Event, event);
 
diff --git a/WebCore/bindings/js/JSEventListener.cpp b/WebCore/bindings/js/JSEventListener.cpp
index 1a999a8..73060f1 100644
--- a/WebCore/bindings/js/JSEventListener.cpp
+++ b/WebCore/bindings/js/JSEventListener.cpp
@@ -86,13 +86,8 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
     }
 
     ExecState* exec = globalObject->globalExec();
+    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
 
-    JSValue handleEventFunction;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
-    }
     CallData callData;
     CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -114,8 +109,8 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
         globalData->timeoutChecker.start();
         JSValue retval = handleEventFunction
-            ? callInWorld(exec, handleEventFunction, callType, callData, jsFunction, args, m_isolatedWorld.get())
-            : callInWorld(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args, m_isolatedWorld.get());
+            ? JSC::call(exec, handleEventFunction, callType, callData, jsFunction, args)
+            : JSC::call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
         globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
@@ -166,7 +161,7 @@ bool JSEventListener::reportError(ScriptExecutionContext* context, const String&
     JSValue thisValue = globalObject->toThisObject(exec);
 
     globalData->timeoutChecker.start();
-    JSValue returnValue = callInWorld(exec, jsFunction, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSValue returnValue = JSC::call(exec, jsFunction, callType, callData, thisValue, args);
     globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
diff --git a/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
index 8ecd287..751e7de 100644
--- a/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -29,7 +29,7 @@
 #include "HTMLCanvasElement.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 #include <wtf/GetPtr.h>
 
diff --git a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index dd4ceaa..ba61922 100644
--- a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -134,7 +134,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, HTMLCollection* c
     if (!collection)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), collection);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, collection);
 
     if (wrapper)
         return wrapper;
diff --git a/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index a65ca7c..7fde002 100644
--- a/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -113,7 +113,7 @@ JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
                 CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
-                return callInWorld(exec, function, callType, callData, wrapper, args, currentWorld(exec));
+                return JSC::call(exec, function, callType, callData, wrapper, args);
             }
         }
         return jsUndefined();
diff --git a/WebCore/bindings/js/JSHistoryCustom.cpp b/WebCore/bindings/js/JSHistoryCustom.cpp
index b24b1ff..3076503 100644
--- a/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -95,15 +95,15 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
 
 bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing History cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, impl()->frame(), message))
-        return false;
-    
+    if (!impl()->frame()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    // Throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return true;
+
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
@@ -133,8 +133,7 @@ bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifi
             return true;
         }
     }
-    
-    printErrorMessageForFrame(impl()->frame(), message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -163,4 +162,52 @@ void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& property
     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
+JSValue JSHistory::pushState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
+JSValue JSHistory::replaceState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSImageDataCustom.cpp b/WebCore/bindings/js/JSImageDataCustom.cpp
index fa3b1d5..61c5112 100644
--- a/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -41,7 +41,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     if (!imageData)
         return jsNull();
     
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), imageData);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, imageData);
     if (wrapper)
         return wrapper;
     
diff --git a/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index 439f532..fcc9e5e 100644
--- a/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -31,7 +31,7 @@
  */
 
 #include "config.h"
-#include "JSInspectorBackend.h"
+#include "JSInjectedScriptHost.h"
 
 #if ENABLE(INSPECTOR)
 
@@ -43,7 +43,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
-#include "InspectorBackend.h"
+#include "InjectedScriptHost.h"
 #include "InspectorController.h"
 #include "InspectorResource.h"
 #include "JSDOMWindow.h"
@@ -73,53 +73,8 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    impl()->highlight(args.at(0).toInt32(exec));
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    Node* node = toNode(args.at(0));
-    if (!node)
-        return jsUndefined();
-
-    String target = args.at(1).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    MarkedArgumentBuffer result;
-    RefPtr<Range> searchRange(rangeOfContents(node));
-
-    ExceptionCode ec = 0;
-    do {
-        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
-        if (resultRange->collapsed(ec))
-            break;
-
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
-        result.append(toJS(exec, resultRange.get()));
-
-        setStart(searchRange.get(), newStart);
-    } while (true);
-
-    return constructArray(exec, result);
-}
-
 #if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::databaseForId(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -137,7 +92,7 @@ JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
 }
 #endif
 
-JSValue JSInspectorBackend::inspectedWindow(ExecState*, const ArgList&)
+JSValue JSInjectedScriptHost::inspectedWindow(ExecState*, const ArgList&)
 {
     InspectorController* ic = impl()->inspectorController();
     if (!ic)
@@ -146,89 +101,7 @@ JSValue JSInspectorBackend::inspectedWindow(ExecState*, const ArgList&)
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
 }
 
-JSValue JSInspectorBackend::setting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    const InspectorController::Setting& setting = ic->setting(key);
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            return jsUndefined();
-        case InspectorController::Setting::StringType:
-            return jsString(exec, setting.string());
-        case InspectorController::Setting::DoubleType:
-            return jsNumber(exec, setting.doubleValue());
-        case InspectorController::Setting::IntegerType:
-            return jsNumber(exec, setting.integerValue());
-        case InspectorController::Setting::BooleanType:
-            return jsBoolean(setting.booleanValue());
-        case InspectorController::Setting::StringVectorType: {
-            MarkedArgumentBuffer stringsArray;
-            const Vector<String>& strings = setting.stringVector();
-            const unsigned length = strings.size();
-            for (unsigned i = 0; i < length; ++i)
-                stringsArray.append(jsString(exec, strings[i]));
-            return constructArray(exec, stringsArray);
-        }
-    }
-}
-
-JSValue JSInspectorBackend::setSetting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController::Setting setting;
-
-    JSValue value = args.at(1);
-    if (value.isUndefined() || value.isNull()) {
-        // Do nothing. The setting is already NoType.
-        ASSERT(setting.type() == InspectorController::Setting::NoType);
-    } else if (value.isString())
-        setting.set(value.toString(exec));
-    else if (value.isNumber())
-        setting.set(value.toNumber(exec));
-    else if (value.isBoolean())
-        setting.set(value.toBoolean(exec));
-    else {
-        JSArray* jsArray = asArray(value);
-        if (!jsArray)
-            return jsUndefined();
-        Vector<String> strings;
-        for (unsigned i = 0; i < jsArray->length(); ++i) {
-            String item = jsArray->get(exec, i).toString(exec);
-            if (exec->hadException())
-                return jsUndefined();
-            strings.append(item);
-        }
-        setting.set(strings);
-    }
-
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (ic)
-        ic->setSetting(key, setting);
-
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::wrapCallback(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::wrapCallback(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -238,7 +111,7 @@ JSValue JSInspectorBackend::wrapCallback(ExecState* exec, const ArgList& args)
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
+JSValue JSInjectedScriptHost::currentCallFrame(ExecState* exec, const ArgList&)
 {
     JavaScriptCallFrame* callFrame = impl()->currentCallFrame();
     if (!callFrame || !callFrame->isValid())
@@ -253,7 +126,7 @@ JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
 
 #endif
 
-JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::nodeForId(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -271,7 +144,7 @@ JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
 }
 
-JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::wrapObject(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return jsUndefined();
@@ -279,7 +152,7 @@ JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
     return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
 }
 
-JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::unwrapObject(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -287,7 +160,7 @@ JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
     return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
 }
 
-JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return jsUndefined();
@@ -305,7 +178,7 @@ JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgLis
 }
 
 #if ENABLE(DATABASE)
-JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
+JSValue JSInjectedScriptHost::selectDatabase(ExecState*, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -322,7 +195,7 @@ JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
 #endif
 
 #if ENABLE(DOM_STORAGE)
-JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
+JSValue JSInjectedScriptHost::selectDOMStorage(ExecState*, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index ed79427..13f59b7 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -68,7 +68,8 @@ JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrapp
 
     if (prototype.isNull())
         return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(jsNull()));
-    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
+    ProtectedJSValue wrappedProto = wrap(unwrappedExec, prototype);
+    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrappedProto)));
 }
 
 JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 9c4330d..ff4fbb9 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -75,7 +75,8 @@ JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwra
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
+    ProtectedJSValue wrappedProto = wrap(unwrappedExec, prototype);
+    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrappedProto.get()));
 }
 
 JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
diff --git a/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp b/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
new file mode 100644
index 0000000..1970bf7
--- /dev/null
+++ b/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectorFrontendHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ContextMenuItem.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "InspectorController.h"
+#include "InspectorFrontendHost.h"
+#include "JSEvent.h"
+#include "JSNode.h"
+#include "JSRange.h"
+#include "MouseEvent.h"
+#include "Node.h"
+#include "Page.h"
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <runtime/JSObject.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSInspectorFrontendHost::search(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Node* node = toNode(args.at(0));
+    if (!node)
+        return jsUndefined();
+
+    String target = args.at(1).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    MarkedArgumentBuffer result;
+    RefPtr<Range> searchRange(rangeOfContents(node));
+
+    ExceptionCode ec = 0;
+    do {
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
+        if (resultRange->collapsed(ec))
+            break;
+
+        // A non-collapsed result range can in some funky whitespace cases still not
+        // advance the range's start position (4509328). Break to avoid infinite loop.
+        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
+        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
+            break;
+
+        result.append(toJS(exec, resultRange.get()));
+
+        setStart(searchRange.get(), newStart);
+    } while (true);
+
+    return constructArray(exec, result);
+}
+
+JSValue JSInspectorFrontendHost::showContextMenu(ExecState* execState, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Event* event = toEvent(args.at(0));
+
+    JSArray* array = asArray(args.at(1));
+    Vector<ContextMenuItem> items;
+
+    for (size_t i = 0; i < array->length(); ++i) {
+        JSObject* item = asObject(array->getIndex(i));
+        JSValue label = item->get(execState, Identifier(execState, "label"));
+        JSValue id = item->get(execState, Identifier(execState, "id"));
+        if (label.isUndefined() || id.isUndefined())
+            items.append(ContextMenuItem(SeparatorType, ContextMenuItemTagNoAction, String()));
+        else {
+            ContextMenuAction typedId = static_cast<ContextMenuAction>(ContextMenuItemBaseCustomTag + id.toInt32(execState));
+            items.append(ContextMenuItem(ActionType, typedId, label.toString(execState)));
+        }
+    }
+
+    impl()->showContextMenu(event, items);
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSLocationCustom.cpp b/WebCore/bindings/js/JSLocationCustom.cpp
index c76a2b1..6c8e032 100644
--- a/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/WebCore/bindings/js/JSLocationCustom.cpp
@@ -102,14 +102,9 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
         return true;
     }
     
-    // When accessing Location cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, frame, message))
-        return false;
+    // throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, frame))
+        return true;
     
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -133,8 +128,7 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
     // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
     // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
     // such cases when normally the string form of Location would be the URL.
-    
-    printErrorMessageForFrame(frame, message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -257,8 +251,9 @@ void JSLocation::setPort(ExecState* exec, JSValue value)
     const UString& portString = value.toString(exec);
     int port = charactersToInt(portString.data(), portString.size());
     if (port < 0 || port > 0xFFFF)
-        port = 0;
-    url.setPort(port);
+        url.removePort();
+    else
+        url.setPort(port);
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
diff --git a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 1974ab0..d1bbeec 100644
--- a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -52,10 +52,8 @@ void JSNamedNodeMap::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->element()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->element())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSNodeCustom.cpp b/WebCore/bindings/js/JSNodeCustom.cpp
index 2a4aa80..f375ae5 100644
--- a/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/WebCore/bindings/js/JSNodeCustom.cpp
@@ -148,31 +148,34 @@ void JSNode::markChildren(MarkStack& markStack)
         return;
     }
 
-    // This is a node outside the document, so find the root of the tree it is in,
-    // and start marking from there.
+    // This is a node outside the document.
+    // Find the the root, and the highest ancestor with a wrapper.
     Node* root = node;
-    for (Node* current = m_impl.get(); current; current = current->parentNode())
+    Node* outermostNodeWithWrapper = node;
+    for (Node* current = m_impl.get(); current; current = current->parentNode()) {
         root = current;
+        if (hasCachedDOMNodeWrapper(current->document(), current))
+            outermostNodeWithWrapper = current;
+    }
 
-    // Nodes in a subtree are marked by the tree's root, so, if the root is already
-    // marking the tree, we don't need to explicitly mark any other nodes.
-    if (root->inSubtreeMark())
+    // Only nodes that have no ancestors with wrappers mark the subtree. In the common
+    // case, the root of the detached subtree has a wrapper, so the tree will only
+    // get marked once. Nodes that aren't outermost need to mark the outermost
+    // in case it is otherwise unreachable.
+    if (node != outermostNodeWithWrapper) {
+        markDOMNodeWrapper(markStack, m_impl->document(), outermostNodeWithWrapper);
         return;
+    }
 
     // Mark the whole tree subtree.
-    root->setInSubtreeMark(true);
-    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
-        JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
-    root->setInSubtreeMark(false);
+    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode())
+        markDOMNodeWrapper(markStack, m_impl->document(), nodeToMark);
 }
 
 static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
     ASSERT(node);
-    ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+    ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
     
     JSNode* wrapper;    
     switch (node->nodeType()) {
@@ -239,7 +242,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
     if (!node)
         return jsNull();
 
-    JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node);
+    JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node);
     if (wrapper)
         return wrapper;
 
diff --git a/WebCore/bindings/js/JSNodeFilterCondition.cpp b/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 54dc020..d34f5c1 100644
--- a/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -66,7 +66,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValue result = callInWorld(exec, m_filter, callType, callData, m_filter, args, currentWorld(exec));
+    JSValue result = JSC::call(exec, m_filter, callType, callData, m_filter, args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/WebCore/bindings/js/JSPopStateEventCustom.cpp b/WebCore/bindings/js/JSPopStateEventCustom.cpp
new file mode 100644
index 0000000..ee86a09
--- /dev/null
+++ b/WebCore/bindings/js/JSPopStateEventCustom.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "JSPopStateEvent.h"
+
+#include "PopStateEvent.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSPopStateEvent::initPopStateEvent(ExecState* exec, const ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    RefPtr<SerializedScriptValue> stateObjectArg = SerializedScriptValue::create(exec, args.at(3));
+    
+    PopStateEvent* event = static_cast<PopStateEvent*>(impl());
+    event->initPopStateEvent(typeArg, canBubbleArg, cancelableArg, stateObjectArg.release());
+    return jsUndefined();
+}
+
+JSC::JSValue JSPopStateEvent::state(JSC::ExecState* exec) const
+{
+    SerializedScriptValue* object = static_cast<PopStateEvent*>(impl())->state();
+    if (!object)
+        return JSC::jsNull();
+    
+    return object->deserialize(exec);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index 2ab2c00..ea2f72f 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -245,9 +245,7 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
     ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
     ASSERT(unwrappedConstructType != ConstructTypeNone);
 
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = constructInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs, debuggerWorld());
-
+    JSValue unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
     JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
     ASSERT(resultValue.isObject());
     JSObject* result = asObject(resultValue);
@@ -296,9 +294,7 @@ JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JS
     CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
     ASSERT(unwrappedCallType != CallTypeNone);
 
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = callInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs, debuggerWorld());
-
+    JSValue unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
     JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
 
     wrapper->transferExceptionToExecState(exec);
diff --git a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index ba1cf22..5f26df3 100644
--- a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -43,9 +43,7 @@ void JSSVGElementInstance::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     // Mark the wrapper for our corresponding element, so it can mark its event handlers.
-    JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
-    if (correspondingWrapper)
-        markStack.append(correspondingWrapper);
+    markDOMNodeWrapper(markStack, impl()->correspondingElement()->document(), impl()->correspondingElement());
 }
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
diff --git a/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/WebCore/bindings/js/JSSVGMatrixCustom.cpp
index 35390b2..a9d0e54 100644
--- a/WebCore/bindings/js/JSSVGMatrixCustom.cpp
+++ b/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2009 Jeff Schiller <codedread@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,11 +25,30 @@
 
 #include "TransformationMatrix.h"
 #include "SVGException.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
+JSValue JSSVGMatrix::multiply(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    if (!args.at(0).inherits(&JSSVGMatrix::s_info))
+        return throwError(exec, TypeError, "secondMatrix argument was not a SVGMatrix");
+
+    JSSVGMatrix* matrixObj = static_cast<JSSVGMatrix*>(asObject(args.at(0)));
+
+    TransformationMatrix m1(*impl());
+    TransformationMatrix m2(*(matrixObj->impl()));
+
+    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(m1.multLeft(m2)).get(), m_context.get());
+
+    return result;
+}
+
 JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 {
     TransformationMatrix imp(*impl());
diff --git a/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index 42fa878..d5be3fd 100644
--- a/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -64,7 +64,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, SVGPathSeg* objec
     if (!object)
         return jsNull();
 
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
         return wrapper;
 
     switch (object->pathSegType()) {
diff --git a/WebCore/bindings/js/JSStyleSheetCustom.cpp b/WebCore/bindings/js/JSStyleSheetCustom.cpp
index d711b6f..ecfc6a6 100644
--- a/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -40,7 +40,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, StyleSheet* style
     if (!styleSheet)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), styleSheet);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, styleSheet);
     if (wrapper)
         return wrapper;
 
@@ -68,10 +68,8 @@ void JSStyleSheet::markChildren(MarkStack& markStack)
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = sheet->ownerNode()) {
-        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
-            markStack.append(ownerNodeWrapper);
-    }
+    if (Node* ownerNode = sheet->ownerNode())
+        markDOMNodeWrapper(markStack, ownerNode->document(), ownerNode);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
index 93d53ca..9742db7 100644
--- a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
@@ -27,28 +27,28 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasArrayBufferConstructor.h"
+#include "JSWebGLArrayBufferConstructor.h"
 
 #include "Document.h"
-#include "CanvasArrayBuffer.h"
-#include "JSCanvasArrayBuffer.h"
+#include "WebGLArrayBuffer.h"
+#include "JSWebGLArrayBuffer.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
+const ClassInfo JSWebGLArrayBufferConstructor::s_info = { "WebGLArrayBufferConstructor", 0, 0, 0 };
 
-JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLArrayBufferConstructor::JSWebGLArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLArrayBufferPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
+    JSWebGLArrayBufferConstructor* jsConstructor = static_cast<JSWebGLArrayBufferConstructor*>(constructor);
 
     unsigned int size = 0;
     if (args.size() == 1) {
@@ -56,10 +56,10 @@ static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* construct
         if (isnan(size))
             size = 0;
     }
-    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
+    return asObject(toJS(exec, jsConstructor->globalObject(), WebGLArrayBuffer::create(size)));
 }
 
-JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasArrayBuffer;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
index 5f1254e..98e364b 100644
--- a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
+++ b/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
@@ -23,26 +23,26 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasArrayBufferConstructor_h
-#define JSCanvasArrayBufferConstructor_h
+#ifndef JSWebGLArrayBufferConstructor_h
+#define JSWebGLArrayBufferConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
-#include "JSCanvasArrayBuffer.h"
+#include "JSWebGLArrayBuffer.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
-    class CanvasArray;
+    class WebGLArray;
 
     // Template function used by CanvasXXXArrayConstructors
     template<class C, typename T>
-    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    PassRefPtr<WebGLArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
     {
         // There are 3 constructors:
         //
         //  1) (in int size)
-        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  2) (in WebGLArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
         //  3) (in sequence<T>) - This ends up being a JS "array-like" object
         //
         RefPtr<C> arrayObject;
@@ -52,7 +52,7 @@ namespace WebCore {
             return C::create(0, 0, 0);
         
         if (args.at(0).isObject()) {
-            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
+            RefPtr<WebGLArrayBuffer> buffer = toWebGLArrayBuffer(args.at(0));
             if (buffer) {
                 int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
                 unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
@@ -82,9 +82,9 @@ namespace WebCore {
         return C::create(size);
     }
 
-    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
+    class JSWebGLArrayBufferConstructor : public DOMConstructorObject {
     public:
-        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -94,4 +94,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasArrayBufferConstructor_h
+#endif // JSWebGLArrayBufferConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLArrayCustom.cpp b/WebCore/bindings/js/JSWebGLArrayCustom.cpp
new file mode 100644
index 0000000..9018544
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLArrayCustom.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLByteArray.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebGLShortArray.h"
+#include "JSWebGLUnsignedShortArray.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLUnsignedIntArray.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    if (object) {
+        if (object->isFloatArray())
+            return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, static_cast<WebGLFloatArray*>(object));
+        if (object->isUnsignedByteArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, static_cast<WebGLUnsignedByteArray*>(object));
+        if (object->isByteArray())
+            return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, static_cast<WebGLByteArray*>(object));
+        if (object->isIntArray())
+            return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, static_cast<WebGLIntArray*>(object));
+        if (object->isUnsignedIntArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, static_cast<WebGLUnsignedIntArray*>(object));
+        if (object->isShortArray())
+            return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, static_cast<WebGLShortArray*>(object));
+        if (object->isUnsignedShortArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, static_cast<WebGLUnsignedShortArray*>(object));
+    }
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSWebGLArrayHelper.h b/WebCore/bindings/js/JSWebGLArrayHelper.h
new file mode 100644
index 0000000..f538cce
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLArrayHelper.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLArrayHelper_h
+#define JSWebGLArrayHelper_h
+
+#include <interpreter/CallFrame.h>
+#include <runtime/ArgList.h>
+#include <runtime/Error.h>
+#include <runtime/JSObject.h>
+#include <runtime/JSValue.h>
+
+namespace WebCore {
+
+template <class T>
+JSC::JSValue setWebGLArrayFromArray(JSC::ExecState* exec, T* webGLArray, JSC::ArgList const& args)
+{
+    if (args.at(0).isObject()) {
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        JSC::JSObject* array = JSC::asObject(args.at(0));
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+        for (int i = 0; i < length; i++) {
+            JSC::JSValue v = array->get(exec, i);
+            if (exec->hadException())
+                return JSC::jsUndefined();
+            webGLArray->set(i + offset, v.toNumber(exec));
+        }
+
+        return JSC::jsUndefined();
+    }
+
+    return JSC::throwError(exec, JSC::SyntaxError);
+}
+
+}
+
+#endif // JSWebGLArrayHelper_h
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
index 6d57912..7db710f 100644
--- a/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
@@ -27,38 +27,38 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasIntArrayConstructor.h"
+#include "JSWebGLByteArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasIntArray.h"
+#include "WebGLByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLByteArrayConstructor::s_info = { "WebGLByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLByteArrayConstructor::JSWebGLByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLByteArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
-    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
+    JSWebGLByteArrayConstructor* jsConstructor = static_cast<JSWebGLByteArrayConstructor*>(constructor);
+    RefPtr<WebGLByteArray> array = static_cast<WebGLByteArray*>(construct<WebGLByteArray, signed char>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasIntArray;
+    constructData.native.function = constructCanvasByteArray;
     return ConstructTypeHost;
 }
 
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
index 5e19652..a201567 100644
--- a/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasIntArrayConstructor_h
-#define JSCanvasIntArrayConstructor_h
+#ifndef JSWebGLByteArrayConstructor_h
+#define JSWebGLByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
+    class JSWebGLByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasIntArrayConstructor_h
+#endif // JSWebGLByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp b/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
new file mode 100644
index 0000000..f7872a8
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLByteArray.h"
+
+#include "WebGLByteArray.h"
+
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLByteArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() < 1 || args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLByteArray* array = toWebGLByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
index ec1d66d..707fe56 100644
--- a/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
@@ -27,38 +27,38 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasByteArrayConstructor.h"
+#include "JSWebGLFloatArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArray.h"
+#include "WebGLFloatArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLFloatArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLFloatArrayConstructor::s_info = { "WebGLFloatArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLFloatArrayConstructor::JSWebGLFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLFloatArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
-    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
+    JSWebGLFloatArrayConstructor* jsConstructor = static_cast<JSWebGLFloatArrayConstructor*>(constructor);
+    RefPtr<WebGLFloatArray> array = static_cast<WebGLFloatArray*>(construct<WebGLFloatArray, float>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasByteArray;
+    constructData.native.function = constructCanvasFloatArray;
     return ConstructTypeHost;
 }
 
diff --git a/WebCore/bindings/js/JSCanvasByteArrayConstructor.h b/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
index 4d5dc11..faf90ff 100644
--- a/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasByteArrayConstructor_h
-#define JSCanvasByteArrayConstructor_h
+#ifndef JSWebGLFloatArrayConstructor_h
+#define JSWebGLFloatArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
+    class JSWebGLFloatArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasByteArrayConstructor_h
+#endif // JSWebGLFloatArrayConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp b/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
new file mode 100644
index 0000000..5f5b24f
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLFloatArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLFloatArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLFloatArray* array = toWebGLFloatArray(args.at(0));
+    if (array) {
+        // void set(in WebGLFloatArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
index 15e39c2..f2a0922 100644
--- a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
@@ -27,38 +27,38 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasFloatArrayConstructor.h"
+#include "JSWebGLIntArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasFloatArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasFloatArray.h"
+#include "WebGLIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLIntArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLIntArrayConstructor::s_info = { "WebGLIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLIntArrayConstructor::JSWebGLIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLIntArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
-    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
+    JSWebGLIntArrayConstructor* jsConstructor = static_cast<JSWebGLIntArrayConstructor*>(constructor);
+    RefPtr<WebGLIntArray> array = static_cast<WebGLIntArray*>(construct<WebGLIntArray, int>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasFloatArray;
+    constructData.native.function = constructCanvasIntArray;
     return ConstructTypeHost;
 }
 
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
index df21825..d42c046 100644
--- a/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasShortArrayConstructor_h
-#define JSCanvasShortArrayConstructor_h
+#ifndef JSWebGLIntArrayConstructor_h
+#define JSWebGLIntArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
+    class JSWebGLIntArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasShortArrayConstructor_h
+#endif // JSWebGLIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp b/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
new file mode 100644
index 0000000..9c384d8
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLIntArray.h"
+
+#include "WebGLIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLIntArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLIntArray* array = toWebGLIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
new file mode 100644
index 0000000..3de9606
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -0,0 +1,708 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLRenderingContext.h"
+
+#include "WebGLRenderingContext.h"
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSWebGLBuffer.h"
+#include "JSWebGLFloatArray.h"
+#include "JSWebGLFramebuffer.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLProgram.h"
+#include "JSWebGLRenderbuffer.h"
+#include "JSWebGLShader.h"
+#include "JSWebGLTexture.h"
+#include "JSWebGLUniformLocation.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebKitCSSMatrix.h"
+#include "NotImplemented.h"
+#include "WebGLBuffer.h"
+#include "WebGLGetInfo.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSWebGLRenderingContext::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+    ExceptionCode ec = 0;
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, count, usage, ec);
+    } else {
+        WebGLArray* array = toWebGLArray(args.at(1));
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, array, usage, ec);
+    }
+
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSWebGLRenderingContext::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    ExceptionCode ec = 0;
+    
+    WebGLArray* array = toWebGLArray(args.at(2));
+    
+    static_cast<WebGLRenderingContext*>(impl())->bufferSubData(target, offset, array, ec);
+
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, const WebGLGetInfo& info)
+{
+    switch (info.getType()) {
+    case WebGLGetInfo::kTypeBool:
+        return jsBoolean(info.getBool());
+    case WebGLGetInfo::kTypeFloat:
+        return jsNumber(exec, info.getFloat());
+    case WebGLGetInfo::kTypeLong:
+        return jsNumber(exec, info.getLong());
+    case WebGLGetInfo::kTypeNull:
+        return jsNull();
+    case WebGLGetInfo::kTypeString:
+        return jsString(exec, info.getString());
+    case WebGLGetInfo::kTypeUnsignedLong:
+        return jsNumber(exec, info.getUnsignedLong());
+    case WebGLGetInfo::kTypeWebGLBuffer:
+        return toJS(exec, globalObject, info.getWebGLBuffer());
+    case WebGLGetInfo::kTypeWebGLFloatArray:
+        return toJS(exec, globalObject, info.getWebGLFloatArray());
+    case WebGLGetInfo::kTypeWebGLFramebuffer:
+        return toJS(exec, globalObject, info.getWebGLFramebuffer());
+    case WebGLGetInfo::kTypeWebGLIntArray:
+        return toJS(exec, globalObject, info.getWebGLIntArray());
+    // FIXME: implement WebGLObjectArray
+    // case WebGLGetInfo::kTypeWebGLObjectArray:
+    case WebGLGetInfo::kTypeWebGLProgram:
+        return toJS(exec, globalObject, info.getWebGLProgram());
+    case WebGLGetInfo::kTypeWebGLRenderbuffer:
+        return toJS(exec, globalObject, info.getWebGLRenderbuffer());
+    case WebGLGetInfo::kTypeWebGLTexture:
+        return toJS(exec, globalObject, info.getWebGLTexture());
+    case WebGLGetInfo::kTypeWebGLUnsignedByteArray:
+        return toJS(exec, globalObject, info.getWebGLUnsignedByteArray());
+    default:
+        notImplemented();
+        return jsUndefined();
+    }
+}
+
+enum ObjectType {
+    kBuffer, kRenderbuffer, kTexture, kVertexAttrib
+};
+
+static JSValue getObjectParameter(JSWebGLRenderingContext* obj, ExecState* exec, const ArgList& args, ObjectType objectType)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(obj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info;
+    switch (objectType) {
+    case kBuffer:
+        info = context->getBufferParameter(target, pname, ec);
+        break;
+    case kRenderbuffer:
+        info = context->getRenderbufferParameter(target, pname, ec);
+        break;
+    case kTexture:
+        info = context->getTexParameter(target, pname, ec);
+        break;
+    case kVertexAttrib:
+        // target => index
+        info = context->getVertexAttrib(target, pname, ec);
+        break;
+    default:
+        notImplemented();
+        break;
+    }
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, obj->globalObject(), info);
+}
+
+enum WhichProgramCall {
+    kProgramParameter, kUniform
+};
+
+JSValue JSWebGLRenderingContext::getBufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kBuffer);
+}
+
+JSValue JSWebGLRenderingContext::getFramebufferAttachmentParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned attachment = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(2).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getFramebufferAttachmentParameter(target, attachment, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 1)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned pname = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getParameter(pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getProgramParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getProgramParameter(program, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getRenderbufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kRenderbuffer);
+}
+
+JSValue JSWebGLRenderingContext::getShaderParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLShader* shader = toWebGLShader(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getShaderParameter(shader, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getTexParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kTexture);
+}
+
+JSValue JSWebGLRenderingContext::getUniform(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    WebGLUniformLocation* loc = toWebGLUniformLocation(args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getUniform(program, loc, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getVertexAttrib(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kVertexAttrib);
+}
+
+// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
+JSValue JSWebGLRenderingContext::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    if (args.size() > 5) {
+        // This must be the bare array case.
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+            
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        WebGLArray* array = toWebGLArray(args.at(8));
+        if (exec->hadException())    
+            return jsUndefined();
+            
+        if (!array)
+            return throwError(exec, TypeError);
+        
+        // FIXME: Need to check to make sure WebGLArray is a WebGLByteArray or WebGLShortArray,
+        // depending on the passed type parameter.
+        
+        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
+        return jsUndefined();
+    }
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(2);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
+JSValue JSWebGLRenderingContext::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 7 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned level = args.at(1).toInt32(exec);
+    unsigned xoff = args.at(2).toInt32(exec);
+    unsigned yoff = args.at(3).toInt32(exec);
+    unsigned width = args.at(4).toInt32(exec);
+    unsigned height = args.at(5).toInt32(exec);
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(6);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    ExceptionCode ec = 0;
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
+    } else
+        ec = TYPE_MISMATCH_ERR;
+    
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();    
+}
+
+template<typename T>
+void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
+{
+    array = 0;
+    
+    if (!value.isObject())
+        return;
+        
+    JSC::JSObject* object = asObject(value);
+    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    void* tempValues;
+    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
+        return;
+    
+    T* values = static_cast<T*>(tempValues);
+    for (int i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        values[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    array = values;
+    size = length;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static bool functionForUniform(DataFunctionToCall f)
+{
+    switch (f) {
+    case f_uniform1v:
+    case f_uniform2v:
+    case f_uniform3v:
+    case f_uniform4v:
+        return true;
+        break;
+    default: break;
+    }
+    return false;
+}
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+    
+    WebGLUniformLocation* location = 0;
+    long index = -1;
+    
+    if (functionForUniform(f))
+        location = toWebGLUniformLocation(args.at(0));
+    else
+        index = args.at(0).toInt32(exec);
+
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1fv(location, webGLArray.get(), ec); break;
+            case f_uniform2v: context->uniform2fv(location, webGLArray.get(), ec); break;
+            case f_uniform3v: context->uniform3fv(location, webGLArray.get(), ec); break;
+            case f_uniform4v: context->uniform4fv(location, webGLArray.get(), ec); break;
+            case f_vertexAttrib1v: context->vertexAttrib1fv(index, webGLArray.get()); break;
+            case f_vertexAttrib2v: context->vertexAttrib2fv(index, webGLArray.get()); break;
+            case f_vertexAttrib3v: context->vertexAttrib3fv(index, webGLArray.get()); break;
+            case f_vertexAttrib4v: context->vertexAttrib4fv(index, webGLArray.get()); break;
+        }
+        if (ec != 0)
+            setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1fv(location, array, size, ec); break;
+        case f_uniform2v: context->uniform2fv(location, array, size, ec); break;
+        case f_uniform3v: context->uniform3fv(location, array, size, ec); break;
+        case f_uniform4v: context->uniform4fv(location, array, size, ec); break;
+        case f_vertexAttrib1v: context->vertexAttrib1fv(index, array, size); break;
+        case f_vertexAttrib2v: context->vertexAttrib2fv(index, array, size); break;
+        case f_vertexAttrib3v: context->vertexAttrib3fv(index, array, size); break;
+        case f_vertexAttrib4v: context->vertexAttrib4fv(index, array, size); break;
+    }
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+  
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLIntArray> webGLArray = toWebGLIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1iv(location, webGLArray.get(), ec); break;
+            case f_uniform2v: context->uniform2iv(location, webGLArray.get(), ec); break;
+            case f_uniform3v: context->uniform3iv(location, webGLArray.get(), ec); break;
+            case f_uniform4v: context->uniform4iv(location, webGLArray.get(), ec); break;
+            default: break;
+        }
+        if (ec != 0)
+            setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    
+    int* array;
+    int size;
+    toArray<int>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1iv(location, array, size, ec); break;
+        case f_uniform2v: context->uniform2iv(location, array, size, ec); break;
+        case f_uniform3v: context->uniform3iv(location, array, size, ec); break;
+        case f_uniform4v: context->uniform4iv(location, array, size, ec); break;
+        default: break;
+    }
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch(f) {
+            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, webGLArray.get(), ec); break;
+            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, webGLArray.get(), ec); break;
+            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, webGLArray.get(), ec); break;
+        }
+        if (ec != 0)
+            setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(2), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size, ec); break;
+        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size, ec); break;
+        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size, ec); break;
+    }
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
index a885b7b..74bfe5c 100644
--- a/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
@@ -27,37 +27,37 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasShortArrayConstructor.h"
+#include "JSWebGLShortArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasShortArray.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasShortArray.h"
+#include "WebGLShortArray.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLShortArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLShortArrayConstructor::s_info = { "WebGLShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLShortArrayConstructor::JSWebGLShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLShortArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
-    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
+    JSWebGLShortArrayConstructor* jsConstructor = static_cast<JSWebGLShortArrayConstructor*>(constructor);
+    RefPtr<WebGLShortArray> array = static_cast<WebGLShortArray*>(construct<WebGLShortArray, short>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasShortArray;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
index efea250..7807a13 100644
--- a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasFloatArrayConstructor_h
-#define JSCanvasFloatArrayConstructor_h
+#ifndef JSWebGLShortArrayConstructor_h
+#define JSWebGLShortArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
+    class JSWebGLShortArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasFloatArrayConstructor_h
+#endif // JSWebGLShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp b/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
new file mode 100644
index 0000000..462b09a
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLShortArray.h"
+
+#include "WebGLShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLShortArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLShortArray* shortArray = toWebGLShortArray(args.at(0));
+    if (shortArray) {
+        // void set(in WebGLShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(shortArray, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
index 5d0800e..d5597ce 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
@@ -27,36 +27,36 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedByteArrayConstructor.h"
+#include "JSWebGLUnsignedByteArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedByteArray.h"
+#include "WebGLUnsignedByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedByteArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedByteArrayConstructor::s_info = { "WebGLUnsignedByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedByteArrayConstructor::JSWebGLUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedByteArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
+    JSWebGLUnsignedByteArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedByteArray> array = static_cast<WebGLUnsignedByteArray*>(construct<WebGLUnsignedByteArray, unsigned char>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedByteArray;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
index 6016159..d90ce96 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasUnsignedIntArrayConstructor_h
-#define JSCanvasUnsignedIntArrayConstructor_h
+#ifndef JSWebGLUnsignedByteArrayConstructor_h
+#define JSWebGLUnsignedByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
+    class JSWebGLUnsignedByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasUnsignedIntArrayConstructor_h
+#endif // JSWebGLUnsignedByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
index f2b0c74..35a545d 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedByteArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedByteArray.h"
 
-#include "CanvasUnsignedByteArray.h"
+#include "WebGLUnsignedByteArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedByteArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedByteArray* array = toWebGLUnsignedByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
index 5f145a7..6fafa81 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
@@ -27,36 +27,36 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedIntArrayConstructor.h"
+#include "JSWebGLUnsignedIntArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedIntArray.h"
+#include "WebGLUnsignedIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedIntArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedIntArrayConstructor::s_info = { "WebGLUnsignedIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedIntArrayConstructor::JSWebGLUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedIntArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
+    JSWebGLUnsignedIntArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedIntArray> array = static_cast<WebGLUnsignedIntArray*>(construct<WebGLUnsignedIntArray, unsigned int>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedIntArray;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h b/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000..7eabbc1
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLUnsignedIntArrayConstructor_h
+#define JSWebGLUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLUnsignedIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
index 95a80a7..ea28111 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedIntArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedIntArray.h"
 
-#include "CanvasUnsignedIntArray.h"
+#include "WebGLUnsignedIntArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedIntArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedIntArray* array = toWebGLUnsignedIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
index 9735693..deaeffd 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
@@ -27,36 +27,36 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedShortArrayConstructor.h"
+#include "JSWebGLUnsignedShortArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedShortArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedShortArray.h"
+#include "WebGLUnsignedShortArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedShortArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedShortArrayConstructor::s_info = { "WebGLUnsignedShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedShortArrayConstructor::JSWebGLUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedShortArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
+    JSWebGLUnsignedShortArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedShortArray> array = static_cast<WebGLUnsignedShortArray*>(construct<WebGLUnsignedShortArray, unsigned short>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedShortArray;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
index 9cfb721..5eba20d 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasUnsignedByteArrayConstructor_h
-#define JSCanvasUnsignedByteArrayConstructor_h
+#ifndef JSWebGLUnsignedShortArrayConstructor_h
+#define JSWebGLUnsignedShortArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
+    class JSWebGLUnsignedShortArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasUnsignedByteArrayConstructor_h
+#endif // JSWebGLUnsignedShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
index 290cd4b..898cc06 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedShortArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedShortArray.h"
 
-#include "CanvasUnsignedShortArray.h"
+#include "WebGLUnsignedShortArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedShortArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedShortArray* array = toWebGLUnsignedShortArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSWebSocketCustom.cpp b/WebCore/bindings/js/JSWebSocketCustom.cpp
index 33c3fcd..238b041 100644
--- a/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -38,7 +38,6 @@
 #include "KURL.h"
 #include "JSEventListener.h"
 #include "WebSocket.h"
-#include "NotImplemented.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
diff --git a/WebCore/bindings/js/JSWorkerContextBase.cpp b/WebCore/bindings/js/JSWorkerContextBase.cpp
index 741a269..f0c4efa 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -45,7 +45,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
-    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
+    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData(normalWorld(*impl->script()->globalData())), this)
     , m_impl(impl)
 {
 }
diff --git a/WebCore/bindings/js/ScheduledAction.cpp b/WebCore/bindings/js/ScheduledAction.cpp
index 9a21b6b..3223e53 100644
--- a/WebCore/bindings/js/ScheduledAction.cpp
+++ b/WebCore/bindings/js/ScheduledAction.cpp
@@ -103,7 +103,7 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
         args.append(m_args[i]);
 
     globalObject->globalData()->timeoutChecker.start();
-    callInWorld(exec, m_function, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSC::call(exec, m_function, callType, callData, thisValue, args);
     globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
@@ -126,7 +126,7 @@ void ScheduledAction::execute(Document* document)
         executeFunctionInContext(window, window->shell());
         Document::updateStyleForAllDocuments();
     } else
-        frame->script()->executeScriptInIsolatedWorld(m_isolatedWorld.get(), m_code);
+        frame->script()->executeScriptInWorld(m_isolatedWorld.get(), m_code);
 
     frame->script()->setProcessingTimerCallback(false);
 }
diff --git a/WebCore/bindings/js/ScriptCachedFrameData.cpp b/WebCore/bindings/js/ScriptCachedFrameData.cpp
index e01324e..f2b64de 100644
--- a/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -44,19 +44,26 @@ using namespace JSC;
 namespace WebCore {
 
 ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
+    : m_domWindow(0)
 {
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        m_window = windowShell->window();
-        scriptController->attachDebugger(0);
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        JSDOMWindow* window = iter->second->window();
+        m_windows.add(iter->first.get(), window);
+        m_domWindow = window->impl();
     }
+
+    scriptController->attachDebugger(0);
 }
 
-DOMWindow* ScriptCachedFrameData::domWindow() const {
-    return m_window ? m_window->impl() : 0;
+DOMWindow* ScriptCachedFrameData::domWindow() const
+{
+    return m_domWindow;
 }
 
 ScriptCachedFrameData::~ScriptCachedFrameData()
@@ -71,26 +78,33 @@ void ScriptCachedFrameData::restore(Frame* frame)
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        if (m_window)
-            windowShell->setWindow(m_window.get());
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        DOMWrapperWorld* world = iter->first.get();
+        JSDOMWindowShell* windowShell = iter->second.get();
+
+        if (JSDOMWindow* window = m_windows.get(world))
+            windowShell->setWindow(window);
         else {
             windowShell->setWindow(frame->domWindow());
-            scriptController->attachDebugger(page->debugger());
-            windowShell->window()->setProfileGroup(page->group().identifier());
+            if (world == debuggerWorld()) {
+                scriptController->attachDebugger(page->debugger());
+                windowShell->window()->setProfileGroup(page->group().identifier());
+            }
         }
     }
 }
 
 void ScriptCachedFrameData::clear()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    if (m_windows.isEmpty())
+        return;
 
-    if (m_window) {
-        m_window = 0;
-        gcController().garbageCollectSoon();
-    }
+    JSLock lock(SilenceAssertionsOnly);
+    m_windows.clear();
+    gcController().garbageCollectSoon();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptCachedFrameData.h b/WebCore/bindings/js/ScriptCachedFrameData.h
index c661f28..5bcaed7 100644
--- a/WebCore/bindings/js/ScriptCachedFrameData.h
+++ b/WebCore/bindings/js/ScriptCachedFrameData.h
@@ -38,8 +38,11 @@ namespace WebCore {
     class Frame;
     class JSDOMWindow;
     class DOMWindow;
+    class DOMWrapperWorld;
 
     class ScriptCachedFrameData  {
+        typedef HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindow> > JSDOMWindowSet;
+
     public:
         ScriptCachedFrameData(Frame*);
         ~ScriptCachedFrameData();
@@ -49,7 +52,8 @@ namespace WebCore {
         DOMWindow* domWindow() const;
 
     private:
-        JSC::ProtectedPtr<JSDOMWindow> m_window;
+        JSDOMWindowSet m_windows;
+        DOMWindow* m_domWindow;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptCallStack.cpp b/WebCore/bindings/js/ScriptCallStack.cpp
index 021ede5..824a07b 100644
--- a/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/WebCore/bindings/js/ScriptCallStack.cpp
@@ -57,7 +57,7 @@ ScriptCallStack::ScriptCallStack(ExecState* exec, const ArgList& args, unsigned
     if (function) {
         m_caller = asInternalFunction(function);
         unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(m_caller->name(m_exec), urlString, lineNumber, args, skipArgumentCount));
     } else {
         // Caller is unknown, but we should still add the frame, because
         // something called us, and gave us arguments.
@@ -94,7 +94,7 @@ void ScriptCallStack::initialize()
     while (!func.isNull()) {
         InternalFunction* internalFunction = asInternalFunction(func);
         ArgList emptyArgList;
-        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, emptyArgList, 0));
+        m_frames.append(ScriptCallFrame(internalFunction->name(m_exec), UString(), 0, emptyArgList, 0));
         func = m_exec->interpreter()->retrieveCaller(m_exec, internalFunction);
     }
     m_initialized = true;
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index b0696ba..3de3b23 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -25,8 +25,10 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "GCController.h"
 #include "HTMLPlugInElement.h"
+#include "InspectorTimelineAgent.h"
 #include "JSDocument.h"
 #include "NP_jsobject.h"
 #include "Page.h"
@@ -43,6 +45,7 @@
 #include <runtime/JSLock.h>
 
 using namespace JSC;
+using namespace std;
 
 namespace WebCore {
 
@@ -79,9 +82,6 @@ ScriptController::ScriptController(Frame* frame)
 ScriptController::~ScriptController()
 {
     if (!m_windowShells.isEmpty()) {
-        for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-            iter->first->forgetScriptController(this);
-
         m_windowShells.clear();
     
         // It's likely that releasing the global object has created a lot of garbage.
@@ -117,10 +117,20 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
 
     RefPtr<Frame> protect = m_frame;
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->willEvaluateScript(sourceURL, sourceCode.startLine());
+#endif
+
     exec->globalData().timeoutChecker.start();
-    Completion comp = WebCore::evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell, world);
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell);
     exec->globalData().timeoutChecker.stop();
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->didEvaluateScript();
+#endif
+
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
     m_frame->keepAlive();
@@ -156,42 +166,14 @@ public:
     static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
 };
 
-static PassRefPtr<IsolatedWorld> findWorld(unsigned worldID)
-{
-    if (!worldID)
-        return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-
-    typedef HashMap<unsigned, RefPtr<IsolatedWorld> > WorldMap;
-    DEFINE_STATIC_LOCAL(WorldMap, isolatedWorlds, ());
-
-    WorldMap::iterator iter = isolatedWorlds.find(worldID);
-    if (iter != isolatedWorlds.end())
-        return iter->second;
-
-    RefPtr<IsolatedWorld> newWorld = IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-    isolatedWorlds.add(worldID, newWorld);
-    return newWorld;
-}
-
-JSDOMWindow* ScriptController::globalObject(unsigned worldID)
+PassRefPtr<DOMWrapperWorld> ScriptController::createWorld()
 {
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return windowShell(world.get())->window();
+    return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
 }
 
-ScriptValue ScriptController::evaluateInIsolatedWorld(unsigned worldID, const ScriptSourceCode& sourceCode) 
+void ScriptController::getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
 {
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return evaluateInWorld(sourceCode, world.get());
-}
-
-void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sourceCode) 
-{
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-
-    unsigned size = sourceCode.size();
-    for (unsigned i = 0; i < size; ++i)
-        evaluateInWorld(sourceCode[i], world.get());
+    static_cast<WebCoreJSClientData*>(JSDOMWindow::commonJSGlobalData()->clientData)->getAllWorlds(worlds);
 }
 
 void ScriptController::clearWindowShell()
@@ -206,7 +188,7 @@ void ScriptController::clearWindowShell()
     attachDebugger(0);
 
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
-        DOMWrapperWorld* world = iter->first;
+        DOMWrapperWorld* world = iter->first.get();
         JSDOMWindowShell* windowShell = iter->second;
         windowShell->window()->willRemoveFromWindowShell();
         windowShell->setWindow(m_frame->domWindow());
@@ -228,10 +210,9 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 
     JSLock lock(SilenceAssertionsOnly);
 
-    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow());
+    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow(), world);
     m_windowShells.add(world, windowShell);
-    world->rememberScriptController(this);
-    windowShell->window()->updateDocument(world);
+    windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
         if (world == debuggerWorld())
@@ -239,10 +220,7 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
         windowShell->window()->setProfileGroup(page->group().identifier());
     }
 
-    {
-        EnterDOMWrapperWorld worldEntry(*JSDOMWindow::commonJSGlobalData(), world);
-        m_frame->loader()->dispatchWindowObjectAvailable();
-    }
+    m_frame->loader()->dispatchDidClearWindowObjectInWorld(world);
 
     return windowShell;
 }
@@ -264,9 +242,10 @@ bool ScriptController::processingUserGestureEvent() const
 
         const AtomicString& type = event->type();
         if ( // mouse events
-            type == eventNames().clickEvent || type == eventNames().mousedownEvent ||
-            type == eventNames().mouseupEvent || type == eventNames().dblclickEvent ||
+            type == eventNames().clickEvent || type == eventNames().mousedownEvent 
+            || type == eventNames().mouseupEvent || type == eventNames().dblclickEvent 
             // keyboard events
+<<<<<<< HEAD:WebCore/bindings/js/ScriptController.cpp
             type == eventNames().keydownEvent || type == eventNames().keypressEvent ||
             type == eventNames().keyupEvent ||
 #if ENABLE(TOUCH_EVENTS) // Android
@@ -274,10 +253,14 @@ bool ScriptController::processingUserGestureEvent() const
             type == eventNames().touchstartEvent || type == eventNames().touchmoveEvent ||
             type == eventNames().touchendEvent || type == eventNames().touchcancelEvent ||
 #endif
+=======
+            || type == eventNames().keydownEvent || type == eventNames().keypressEvent
+            || type == eventNames().keyupEvent
+>>>>>>> webkit.org at r51976:WebCore/bindings/js/ScriptController.cpp
             // other accepted events
-            type == eventNames().selectEvent || type == eventNames().changeEvent ||
-            type == eventNames().focusEvent || type == eventNames().blurEvent ||
-            type == eventNames().submitEvent)
+            || type == eventNames().selectEvent || type == eventNames().changeEvent
+            || type == eventNames().focusEvent || type == eventNames().blurEvent
+            || type == eventNames().submitEvent)
             return true;
     }
     
@@ -316,7 +299,7 @@ bool ScriptController::anyPageIsProcessingUserGesture() const
 bool ScriptController::isEnabled()
 {
     Settings* settings = m_frame->settings();
-    return (settings && settings->isJavaScriptEnabled());
+    return m_frame->loader()->client()->allowJavaScript(settings && settings->isJavaScriptEnabled() && !m_frame->loader()->isSandboxed(SandboxScripts));
 }
 
 void ScriptController::attachDebugger(JSC::Debugger* debugger)
@@ -340,7 +323,7 @@ void ScriptController::updateDocument()
 
     JSLock lock(SilenceAssertionsOnly);
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-        iter->second->window()->updateDocument(iter->first);
+        iter->second->window()->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -473,27 +456,7 @@ void ScriptController::clearScriptObjects()
 #endif
 }
 
-ScriptValue ScriptController::executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture)
-{
-    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
-
-    if (!isEnabled() || isPaused())
-        return ScriptValue();
-
-    bool wasInExecuteScript = m_inExecuteScript;
-    m_inExecuteScript = true;
-
-    ScriptValue result = evaluateInIsolatedWorld(worldID, sourceCode);
-
-    if (!wasInExecuteScript) {
-        m_inExecuteScript = false;
-        Document::updateStyleForAllDocuments();
-    }
-
-    return result;
-}
-
-ScriptValue ScriptController::executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
+ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
 {
     ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
 
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index f2a497d..8801622 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -63,12 +63,15 @@ class XSSAuditor;
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
 class ScriptController {
-    typedef WTF::HashMap<DOMWrapperWorld*, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
+    friend class ScriptCachedFrameData;
+    typedef WTF::HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
 
 public:
     ScriptController(Frame*);
     ~ScriptController();
 
+    static PassRefPtr<DOMWrapperWorld> createWorld();
+
     JSDOMWindowShell* windowShell(DOMWrapperWorld* world)
     {
         ShellMap::iterator iter = m_windowShells.find(world);
@@ -83,17 +86,12 @@ public:
     {
         return windowShell(world)->window();
     }
-    JSDOMWindow* globalObject(unsigned worldID);
 
-    void forgetWorld(DOMWrapperWorld* world)
-    {
-        m_windowShells.remove(world);
-    }
+    static void getAllWorlds(Vector<DOMWrapperWorld*>&);
 
     ScriptValue executeScript(const ScriptSourceCode&);
     ScriptValue executeScript(const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
 
     // Returns true if argument is a JavaScript URL.
     bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
@@ -104,8 +102,6 @@ public:
 
     ScriptValue evaluate(const ScriptSourceCode&);
     ScriptValue evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*);
-    ScriptValue evaluateInIsolatedWorld(unsigned /*worldID*/, const ScriptSourceCode&);
-    void evaluateInIsolatedWorld(unsigned /*worldID*/, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
diff --git a/WebCore/bindings/js/ScriptFunctionCall.cpp b/WebCore/bindings/js/ScriptFunctionCall.cpp
index 91b2a57..e38acb9 100644
--- a/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -72,6 +72,13 @@ void ScriptFunctionCall::appendArgument(const String& argument)
 
 void ScriptFunctionCall::appendArgument(const JSC::UString& argument)
 {
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(const char* argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
     m_arguments.append(jsString(m_exec, argument));
 }
 
@@ -80,6 +87,12 @@ void ScriptFunctionCall::appendArgument(JSC::JSValue argument)
     m_arguments.append(argument);
 }
 
+void ScriptFunctionCall::appendArgument(long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(long long argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -92,6 +105,12 @@ void ScriptFunctionCall::appendArgument(unsigned int argument)
     m_arguments.append(jsNumber(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(unsigned long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(int argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -123,8 +142,7 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
     if (callType == CallTypeNone)
         return ScriptValue();
 
-    // FIXME: Should this function take a worldID? - only used by inspector?
-    JSValue result = callInWorld(m_exec, function, callType, callData, thisObject, m_arguments, debuggerWorld());
+    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
@@ -162,8 +180,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
     if (constructType == ConstructTypeNone)
         return ScriptObject();
 
-    // FIXME: Currently this method constructs objects in debuggerWorld().  We could use the current world, or pass a worldID to this function?
-    JSValue result = constructInWorld(m_exec, constructor, constructType, constructData, m_arguments, debuggerWorld());
+    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
diff --git a/WebCore/bindings/js/ScriptFunctionCall.h b/WebCore/bindings/js/ScriptFunctionCall.h
index 079ac21..7c5074f 100644
--- a/WebCore/bindings/js/ScriptFunctionCall.h
+++ b/WebCore/bindings/js/ScriptFunctionCall.h
@@ -55,10 +55,13 @@ namespace WebCore {
         void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
+        void appendArgument(const char*);
         void appendArgument(const JSC::UString&);
         void appendArgument(JSC::JSValue);
+        void appendArgument(long);
         void appendArgument(long long);
         void appendArgument(unsigned int);
+        void appendArgument(unsigned long);
         void appendArgument(int);
         void appendArgument(bool);
         ScriptValue call(bool& hadException, bool reportExceptions = true);
@@ -70,6 +73,12 @@ namespace WebCore {
         ScriptObject m_thisObject;
         String m_name;
         JSC::MarkedArgumentBuffer m_arguments;
+
+    private:
+        // MarkedArgumentBuffer must be stack allocated, so prevent heap
+        // alloc of ScriptFunctionCall as well.
+        void* operator new(size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
+        void* operator new[](size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptObject.cpp b/WebCore/bindings/js/ScriptObject.cpp
index f14145e..0e62903 100644
--- a/WebCore/bindings/js/ScriptObject.cpp
+++ b/WebCore/bindings/js/ScriptObject.cpp
@@ -36,7 +36,15 @@
 #include <runtime/JSLock.h>
 
 #if ENABLE(INSPECTOR)
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
+=======
+#include "JSInjectedScriptHost.h"
+>>>>>>> webkit.org at r51976:WebCore/bindings/js/ScriptObject.cpp
 #include "JSInspectorBackend.h"
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
+=======
+#include "JSInspectorFrontendHost.h"
+>>>>>>> webkit.org at r51976:WebCore/bindings/js/ScriptObject.cpp
 #endif
 
 using namespace JSC;
@@ -90,6 +98,14 @@ bool ScriptObject::set(const char* name, double value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, long long value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -114,6 +130,14 @@ bool ScriptObject::set(const char* name, unsigned value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -143,6 +167,22 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorFrontendHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InjectedScriptHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
 #endif // ENABLE(INSPECTOR)
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
diff --git a/WebCore/bindings/js/ScriptObject.h b/WebCore/bindings/js/ScriptObject.h
index 31381f3..fed7339 100644
--- a/WebCore/bindings/js/ScriptObject.h
+++ b/WebCore/bindings/js/ScriptObject.h
@@ -38,7 +38,9 @@
 #include <runtime/Protect.h>
 
 namespace WebCore {
+    class InjectedScriptHost;
     class InspectorBackend;
+    class InspectorFrontendHost;
 
     class ScriptObject : public ScriptValue {
     public:
@@ -50,9 +52,11 @@ namespace WebCore {
         bool set(const char* name, const ScriptObject&);
         bool set(const char* name, const String&);
         bool set(const char* name, double);
+        bool set(const char* name, long);
         bool set(const char* name, long long);
         bool set(const char* name, int);
         bool set(const char* name, unsigned);
+        bool set(const char* name, unsigned long);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -66,6 +70,8 @@ namespace WebCore {
         static bool set(ScriptState*, const char* name, const ScriptObject&);
 #if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+        static bool set(ScriptState*, const char* name, InspectorFrontendHost*);
+        static bool set(ScriptState*, const char* name, InjectedScriptHost*);
 #endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
deleted file mode 100644
index 313530f..0000000
--- a/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptObjectQuarantine.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Document.h"
-#include "Frame.h"
-#include "JSDOMBinding.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSNode.h"
-#include "ScriptObject.h"
-#include "ScriptValue.h"
-#include "Storage.h"
-
-#include <runtime/JSLock.h>
-
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "JSDatabase.h"
-#endif
-
-#if ENABLE(DOM_STORAGE)
-#include "JSStorage.h"
-#endif
-
-using namespace JSC;
-
-namespace WebCore {
-
-ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
-}
-
-#if ENABLE(DATABASE)
-bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
-{
-    ASSERT(database);
-
-    Frame* frame = database->document()->frame();
-    if (!frame)
-        return false;
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, database))));
-
-    return true;
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
-{
-    ASSERT(storage);
-    Frame* frame = storage->frame();
-    ASSERT(frame);
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, storage))));
-
-    return true;
-}
-#endif
-
-bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
-{
-    ExecState* exec = scriptStateFromNode(node);
-    if (!exec)
-        return false;
-
-    JSLock lock(SilenceAssertionsOnly);
-    // FIXME: Should use some sort of globalObjectFromNode()
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, deprecatedGlobalObjectForPrototype(exec), node))));
-
-    return true;
-}
-
-bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
-{
-    ASSERT(domWindow);
-
-    JSDOMWindow* window = toJSDOMWindow(domWindow->frame(), debuggerWorld());
-    ExecState* exec = window->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, window)));
-
-    return true;
-}
-
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/ScriptState.cpp b/WebCore/bindings/js/ScriptState.cpp
index 60ba2a0..b9f78ef 100644
--- a/WebCore/bindings/js/ScriptState.cpp
+++ b/WebCore/bindings/js/ScriptState.cpp
@@ -38,7 +38,7 @@
 
 namespace WebCore {
 
-ScriptState* scriptStateFromNode(Node* node)
+ScriptState* scriptStateFromNode(DOMWrapperWorld* world, Node* node)
 {
     if (!node)
         return 0;
@@ -50,12 +50,12 @@ ScriptState* scriptStateFromNode(Node* node)
         return 0;
     if (!frame->script()->isEnabled())
         return 0;
-    return frame->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return frame->script()->globalObject(world)->globalExec();
 }
 
-ScriptState* scriptStateFromPage(Page* page)
+ScriptState* scriptStateFromPage(DOMWrapperWorld* world, Page* page)
 {
-    return page->mainFrame()->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return page->mainFrame()->script()->globalObject(world)->globalExec();
 }
 
 }
diff --git a/WebCore/bindings/js/ScriptState.h b/WebCore/bindings/js/ScriptState.h
index 279234e..6257929 100644
--- a/WebCore/bindings/js/ScriptState.h
+++ b/WebCore/bindings/js/ScriptState.h
@@ -45,8 +45,8 @@ namespace WebCore {
     // For now, the separation is purely by convention.
     typedef JSC::ExecState ScriptState;
 
-    ScriptState* scriptStateFromNode(Node*);
-    ScriptState* scriptStateFromPage(Page*);
+    ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node*);
+    ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/ScriptValue.cpp b/WebCore/bindings/js/ScriptValue.cpp
index 6eac102..5444e0e 100644
--- a/WebCore/bindings/js/ScriptValue.cpp
+++ b/WebCore/bindings/js/ScriptValue.cpp
@@ -32,6 +32,8 @@
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSValueRef.h>
 
+#include "JSInspectedObjectWrapper.h"
+
 #include <runtime/JSLock.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
@@ -40,13 +42,21 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool ScriptValue::getString(String& result) const
+#if ENABLE(INSPECTOR)
+ScriptValue ScriptValue::quarantineValue(ScriptState* scriptState, const ScriptValue& value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
+}
+#endif
+
+bool ScriptValue::getString(ScriptState* scriptState, String& result) const
 {
     if (!m_value)
         return false;
     JSLock lock(SilenceAssertionsOnly);
     UString ustring;
-    if (!m_value.get().getString(ustring))
+    if (!m_value.get().getString(scriptState, ustring))
         return false;
     result = ustring;
     return true;
diff --git a/WebCore/bindings/js/ScriptValue.h b/WebCore/bindings/js/ScriptValue.h
index 19bb693..e11fa55 100644
--- a/WebCore/bindings/js/ScriptValue.h
+++ b/WebCore/bindings/js/ScriptValue.h
@@ -41,11 +41,13 @@ class String;
 
 class ScriptValue {
 public:
+    static ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value);
+
     ScriptValue(JSC::JSValue value = JSC::JSValue()) : m_value(value) {}
     virtual ~ScriptValue() {}
 
     JSC::JSValue jsValue() const { return m_value.get(); }
-    bool getString(String& result) const;
+    bool getString(ScriptState*, String& result) const;
     String toString(ScriptState* scriptState) const { return m_value.get().toString(scriptState); }
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
diff --git a/WebCore/bindings/js/SerializedScriptValue.cpp b/WebCore/bindings/js/SerializedScriptValue.cpp
index 48cd92d..7c4ad62 100644
--- a/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -27,6 +27,11 @@
 #include "config.h"
 #include "SerializedScriptValue.h"
 
+#include "File.h"
+#include "JSDOMGlobalObject.h"
+#include "JSFile.h"
+#include "JSFileList.h"
+#include <JavaScriptCore/APICast.h>
 #include <runtime/DateInstance.h>
 #include <runtime/ExceptionHelpers.h>
 #include <runtime/PropertyNameArray.h>
@@ -148,6 +153,12 @@ SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> dat
 {
 }
 
+SerializedScriptValueData::SerializedScriptValueData(const File* file)
+    : m_type(FileType)
+    , m_string(file->path().crossThreadString())
+{
+}
+
 SerializedArray* SharedSerializedData::asArray()
 {
     return static_cast<SerializedArray*>(this);
@@ -470,7 +481,7 @@ struct SerializingTreeWalker : public BaseWalker {
             return SerializedScriptValueData(value);
 
         if (value.isString())
-            return SerializedScriptValueData(asString(value)->value());
+            return SerializedScriptValueData(asString(value)->value(m_exec));
 
         if (value.isNumber())
             return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
@@ -481,10 +492,15 @@ struct SerializingTreeWalker : public BaseWalker {
         if (isArray(value))
             return SerializedScriptValueData();
 
-        CallData unusedData;
-        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
-            return SerializedScriptValueData();
-
+        if (value.isObject()) {
+            JSObject* obj = asObject(value);
+            if (obj->inherits(&JSFile::s_info))
+                return SerializedScriptValueData(toFile(obj));
+                
+            CallData unusedData;
+            if (value.getCallData(unusedData) == CallTypeNone)
+                return SerializedScriptValueData();
+        }
         // Any other types are expected to serialize as null.
         return SerializedScriptValueData(jsNull());
     }
@@ -640,6 +656,8 @@ struct DeserializingTreeWalker : public BaseWalker {
                 return jsNumber(m_exec, value.asDouble());
             case SerializedScriptValueData::DateType:
                 return new (m_exec) DateInstance(m_exec, value.asDouble());
+            case SerializedScriptValueData::FileType:
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject()), File::create(value.asString().crossThreadString()));
             default:
                 ASSERT_NOT_REACHED();
                 return JSValue();
@@ -836,4 +854,36 @@ void SerializedScriptValueData::tearDownSerializedData()
     walk<TeardownTreeWalker>(context, *this);
 }
 
+SerializedScriptValue::~SerializedScriptValue()
+{
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef originContext, JSValueRef apiValue, JSValueRef* exception)
+{
+    ExecState* exec = toJS(originContext);
+    JSValue value = toJS(exec, apiValue);
+    PassRefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(exec, value);
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    
+    return serializedValue;
+}
+
+JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, JSValueRef* exception)
+{
+    ExecState* exec = toJS(destinationContext);
+    JSValue value = deserialize(exec);
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    return toRef(exec, value);
+}
+
 }
diff --git a/WebCore/bindings/js/SerializedScriptValue.h b/WebCore/bindings/js/SerializedScriptValue.h
index f8a126f..57a4a66 100644
--- a/WebCore/bindings/js/SerializedScriptValue.h
+++ b/WebCore/bindings/js/SerializedScriptValue.h
@@ -29,7 +29,11 @@
 
 #include "ScriptValue.h"
 
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef const struct OpaqueJSValue* JSValueRef;
+
 namespace WebCore {
+    class File;
     class SerializedObject;
     class SerializedArray;
 
@@ -51,7 +55,8 @@ namespace WebCore {
             ImmediateType,
             ObjectType,
             ArrayType,
-            StringType
+            StringType,
+            FileType
         };
 
         SerializedType type() const { return m_type; }
@@ -74,6 +79,8 @@ namespace WebCore {
             , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
         {
         }
+        
+        explicit SerializedScriptValueData(const File*);
 
         explicit SerializedScriptValueData(JSC::JSValue value)
             : m_type(ImmediateType)
@@ -105,7 +112,7 @@ namespace WebCore {
 
         String asString() const
         {
-            ASSERT(m_type == StringType);
+            ASSERT(m_type == StringType || m_type == FileType);
             return m_string;
         }
 
@@ -150,6 +157,8 @@ namespace WebCore {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
         }
 
+        static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef value, JSValueRef* exception);
+
         static PassRefPtr<SerializedScriptValue> create(String string)
         {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
@@ -182,7 +191,8 @@ namespace WebCore {
             return m_value.deserialize(exec, m_mustCopy);
         }
 
-        ~SerializedScriptValue() {}
+        JSValueRef deserialize(JSContextRef, JSValueRef* exception);
+        ~SerializedScriptValue();
 
     private:
         SerializedScriptValue(SerializedScriptValueData value)
diff --git a/WebCore/bindings/js/WorkerScriptController.cpp b/WebCore/bindings/js/WorkerScriptController.cpp
index b66b0e8..5e27ef7 100644
--- a/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/WebCore/bindings/js/WorkerScriptController.cpp
@@ -123,7 +123,7 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
 
     ExecState* exec = m_workerContextWrapper->globalExec();
     m_workerContextWrapper->globalData()->timeoutChecker.start();
-    Completion comp = evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper, currentWorld(exec));
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
     m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
diff --git a/WebCore/bindings/objc/DOMHTML.mm b/WebCore/bindings/objc/DOMHTML.mm
index 1043d8e..3488b35 100644
--- a/WebCore/bindings/objc/DOMHTML.mm
+++ b/WebCore/bindings/objc/DOMHTML.mm
@@ -140,7 +140,12 @@
         return NSMakeRange(start, end - start); 
     }
     return NSMakeRange(NSNotFound, 0);
-}    
+}
+
+- (BOOL)_isAutofilled
+{
+    return core(self)->isAutofilled();
+}
 
 - (void)_setAutofilled:(BOOL)filled
 {
@@ -156,8 +161,9 @@
 
 - (void)_activateItemAtIndex:(int)index
 {
+    // Use the setSelectedIndexByUser function so a change event will be fired. <rdar://problem/6760590>
     if (WebCore::HTMLSelectElement* select = core(self))
-        select->setSelectedIndex(index);
+        select->setSelectedIndexByUser(index, true, true);
 }
 
 @end
@@ -167,7 +173,7 @@
 - (BOOL)_isEdited
 {
     WebCore::RenderObject *renderer = core(self)->renderer();
-    return renderer && [self _isTextField] && static_cast<WebCore::RenderTextControl *>(renderer)->isUserEdited();
+    return renderer && [self _isTextField] && static_cast<WebCore::RenderTextControl *>(renderer)->lastChangeWasUserEdit();
 }
 
 @end
@@ -177,7 +183,7 @@
 - (BOOL)_isEdited
 {
     WebCore::RenderObject* renderer = core(self)->renderer();
-    return renderer && static_cast<WebCore::RenderTextControl*>(renderer)->isUserEdited();
+    return renderer && static_cast<WebCore::RenderTextControl*>(renderer)->lastChangeWasUserEdit();
 }
 
 @end
diff --git a/WebCore/bindings/objc/DOMPrivate.h b/WebCore/bindings/objc/DOMPrivate.h
index 4291cbc..b8e4460 100644
--- a/WebCore/bindings/objc/DOMPrivate.h
+++ b/WebCore/bindings/objc/DOMPrivate.h
@@ -67,10 +67,10 @@
 @end
 
 // All the methods in this category are used by Safari forms autofill and should not be used for any other purpose.
-// They are stopgap measures until we finish transitioning form controls to not use NSView. Each one should become
-// replaceable by public DOM API, and when that happens Safari will switch to implementations using that public API,
-// and these will be deleted.
+// Each one should eventually be replaced by public DOM API, and when that happens Safari will switch to implementations 
+// using that public API, and these will be deleted.
 @interface DOMHTMLInputElement (FormsAutoFillTransition)
+- (BOOL)_isAutofilled;
 - (BOOL)_isTextField;
 - (NSRect)_rectOnScreen; // bounding box of the text field, in screen coordinates
 - (void)_replaceCharactersInRange:(NSRange)targetRange withString:(NSString *)replacementString selectingFromIndex:(int)index;
diff --git a/WebCore/bindings/objc/WebScriptObject.mm b/WebCore/bindings/objc/WebScriptObject.mm
index 6d86001..1622a3c 100644
--- a/WebCore/bindings/objc/WebScriptObject.mm
+++ b/WebCore/bindings/objc/WebScriptObject.mm
@@ -299,7 +299,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
         return nil;
 
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = callInWorld(exec, function, callType, callData, [self _imp], argList, pluginWorld());
+    JSValue result = JSC::call(exec, function, callType, callData, [self _imp], argList);
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.stop();
 
     if (exec->hadException()) {
@@ -328,7 +328,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     JSLock lock(SilenceAssertionsOnly);
     
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.start();
-    Completion completion = evaluateInWorld([self _rootObject]->globalObject()->globalExec(), [self _rootObject]->globalObject()->globalScopeChain(), makeSource(String(script)), JSC::JSValue(), pluginWorld());
+    Completion completion = JSC::evaluate([self _rootObject]->globalObject()->globalExec(), [self _rootObject]->globalObject()->globalScopeChain(), makeSource(String(script)), JSC::JSValue());
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
@@ -529,7 +529,8 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     }
 
     if (value.isString()) {
-        const UString& u = asString(value)->value();
+        ExecState* exec = rootObject->globalObject()->globalExec();
+        const UString& u = asString(value)->value(exec);
         return [NSString stringWithCharacters:u.data() length:u.size()];
     }
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 4ca441b..e98379b 100644
--- a/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -16,7 +16,7 @@
 # Library General Public License for more details.
 #
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
 # Boston, MA 02111-1307, USA.
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index d8367ac..6ccf739 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -316,7 +316,14 @@ sub GenerateGetOwnPropertySlotBody
     if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@getOwnPropertySlotImpl, "    bool ok;\n");
         push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
-        push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+
+        # If the item function returns a string then we let the ConvertNullStringTo handle the cases
+        # where the index is out of range.
+        if (IndexGetterReturnsStrings($implClassName)) {
+            push(@getOwnPropertySlotImpl, "    if (ok) {\n");
+        } else {
+            push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+        }
         if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@getOwnPropertySlotImpl, "        slot.setValue(getByIndex(exec, index));\n");
         } else {
@@ -368,6 +375,14 @@ sub GenerateGetOwnPropertyDescriptorBody
     my $namespaceMaybe = ($inlined ? "JSC::" : "");
     
     my @getOwnPropertyDescriptorImpl = ();
+    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+        if ($interfaceName eq "DOMWindow") {
+            push(@implContent, "    if (!static_cast<$className*>(thisObject)->allowsAccessFrom(exec))\n");
+        } else {
+            push(@implContent, "    if (!allowsAccessFromFrame(exec, static_cast<$className*>(thisObject)->impl()->frame()))\n");
+        }
+        push(@implContent, "        return false;\n");
+    }
     
     if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
         push(@getOwnPropertyDescriptorImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
@@ -643,9 +658,6 @@ sub GenerateHeader
         $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;       
     }
 
-    # Custom getPropertyAttributes function
-    push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
-
     # Custom defineGetter function
     push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorV8.pm b/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 2e0f9ee..77e9512 100644
--- a/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -7,8 +7,6 @@
 # Copyright (C) 2007, 2008, 2009 Google Inc.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
-# This file is part of the KDE project
-#
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
@@ -352,15 +350,16 @@ sub HolderToNative
     my $dataNode = shift;
     my $implClassName = shift;
     my $classIndex = shift;
+    my $holder = shift || "holder";   # optional param
 
     if (IsNodeSubType($dataNode)) {
         push(@implContentDecls, <<END);
-    $implClassName* imp = V8DOMWrapper::convertDOMWrapperToNode<$implClassName>(holder);
+    $implClassName* imp = v8DOMWrapperToNode<$implClassName>($holder);
 END
 
     } else {
         push(@implContentDecls, <<END);
-    $implClassName* imp = V8DOMWrapper::convertToNativeObject<$implClassName>(V8ClassIndex::$classIndex, holder);
+    $implClassName* imp = v8DOMWrapperTo<$implClassName>(V8ClassIndex::$classIndex, $holder);
 END
 
   }
@@ -399,7 +398,7 @@ sub GenerateDomainSafeFunctionGetter
     }
 END
 
-  HolderToNative($dataNode, $implClassName, $classIndex);
+    HolderToNative($dataNode, $implClassName, $classIndex);
 
     push(@implContentDecls, <<END);
     if (!V8Proxy::canAccessFrame(imp->frame(), false)) {
@@ -430,7 +429,7 @@ END
 
     if ($classIndex eq "DOMWINDOW") {
         push(@implContentDecls, <<END);
-    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    DOMWindow* window = v8DOMWrapperTo<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     // Get the proxy corresponding to the DOMWindow if possible to
     // make sure that the constructor function is constructed in the
     // context of the DOMWindow and not in the context of the caller.
@@ -439,11 +438,11 @@ END
     } elsif ($classIndex eq "DEDICATEDWORKERCONTEXT" or $classIndex eq "WORKERCONTEXT" or $classIndex eq "SHAREDWORKERCONTEXT") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         push(@implContentDecls, <<END);
-    WorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
+    WorkerContext* workerContext = v8DOMWrapperTo<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
     return V8DOMWrapper::getConstructor(type, workerContext);
 END
     } else {
-        push(@implContentDecls, "    return v8::Undefined();");
+        push(@implContentDecls, "    return v8::Handle<v8::Value>();");
     }
 
     push(@implContentDecls, <<END);
@@ -469,7 +468,7 @@ sub GenerateNormalAttrGetter
     my $attrType = GetTypeFromSignature($attribute->signature);
     my $attrIsPodType = IsPodType($attrType);
 
-    my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
+    my $nativeType = GetNativeTypeFromSignature($attribute->signature, -1);
     my $isPodType = IsPodType($implClassName);
     my $skipContext = 0;
 
@@ -506,7 +505,7 @@ END
 
     if ($isPodType) {
         push(@implContentDecls, <<END);
-    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
+    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = v8DOMWrapperTo<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
     $implClassName imp_instance = *imp_wrapper;
 END
         if ($getterStringUsesImp) {
@@ -524,22 +523,34 @@ END
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
-    if (holder.IsEmpty()) return v8::Undefined();
+    if (holder.IsEmpty()) return v8::Handle<v8::Value>();
 END
       }
-        HolderToNative($dataNode, $implClassName, $classIndex);
+        HolderToNative($dataNode, $implClassName, $classIndex, "info");
     } else {
+        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+        if ($getterStringUsesImp && $reflect && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
+            # Generate super-compact call for regular attribute getter:
+            my $contentAttributeName = $reflect eq "1" ? $attrName : $reflect;
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    return getElementStringAttr(info, ${namespace}::${contentAttributeName}Attr);\n");
+            push(@implContentDecls, "  }\n\n");
+            return;
+            # Skip the rest of the function!
+        }
+        
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = info.Holder();
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
+        HolderToNative($dataNode, $implClassName, $classIndex, "info");
     }
 
     # Generate security checks if necessary
     if ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->$attrName())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->$attrName())) return v8::Handle<v8::Value>();\n\n");
     } elsif ($attribute->signature->extendedAttributes->{"CheckFrameSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->contentDocument())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->contentDocument())) return v8::Handle<v8::Value>();\n\n");
     }
 
     my $useExceptions = 1 if @{$attribute->getterExceptions} and !($isPodType);
@@ -553,7 +564,12 @@ END
     }
 
     my $getterFunc = $codeGenerator->WK_lcfirst($attrName);
-    $getterFunc .= "Animated" if $codeGenerator->IsSVGAnimatedType($attribute->signature->type);
+
+    if ($codeGenerator->IsSVGAnimatedType($attribute->signature->type)) {
+        # Some SVGFE*Element.idl use 'operator' as attribute name; rewrite as '_operator' to avoid clashes with C/C++
+        $getterFunc = "_" . $getterFunc if ($attrName =~ /operator/);
+        $getterFunc .= "Animated";
+    }
 
     my $returnType = GetTypeFromSignature($attribute->signature);
 
@@ -579,10 +595,6 @@ END
         $getterString = "imp_instance";
     }
 
-    if ($nativeType eq "String") {
-        $getterString = "toString($getterString)";
-    }
-
     my $result;
     my $wrapper;
 
@@ -619,7 +631,7 @@ END
     } else {
         if ($attribute->signature->type eq "EventListener" && $dataNode->name eq "DOMWindow") {
             push(@implContentDecls, "    if (!imp->document())\n");
-            push(@implContentDecls, "      return v8::Undefined();\n");
+            push(@implContentDecls, "      return v8::Handle<v8::Value>();\n");
         }
 
         if ($useExceptions) {
@@ -635,12 +647,12 @@ END
     }
 
     if (IsSVGTypeNeedingContextParameter($attrType) && !$skipContext) {
-        my $resultObject = $result;
         if ($attrIsPodType) {
-            $resultObject = "wrapper";
+            push(@implContentDecls, GenerateSVGContextAssignment($implClassName, "wrapper.get()", "    "));
+        } else {
+            push(@implContentDecls, GenerateSVGContextRetrieval($implClassName, "    "));
+            $result = "V8Proxy::withSVGContext($result, context)";
         }
-        $resultObject = "WTF::getPtr(" . $resultObject . ")";
-        push(@implContentDecls, GenerateSVGContextAssignment($implClassName, $resultObject, "    "));
     }
 
     if ($attrIsPodType) {
@@ -696,7 +708,7 @@ sub GenerateNormalAttrSetter
     if ($isPodType) {
         $implClassName = GetNativeType($implClassName);
         $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = v8DOMWrapperTo<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
         push(@implContentDecls, "    $implClassName imp_instance = *wrapper;\n");
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
@@ -712,12 +724,26 @@ END
     if (holder.IsEmpty()) return;
 END
       }
-        HolderToNative($dataNode, $implClassName, $classIndex);
+        HolderToNative($dataNode, $implClassName, $classIndex, "info");
     } else {
+        my $attrType = GetTypeFromSignature($attribute->signature);
+        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+        my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+        if (($reflect || $reflectURL) && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
+            # Generate super-compact call for regular attribute setter:
+            my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    setElementStringAttr(info, ${namespace}::${contentAttributeName}Attr, value);\n");
+            push(@implContentDecls, "  }\n\n");
+            return;
+            # Skip the rest of the function!
+        }
+
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = info.Holder();
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
+        HolderToNative($dataNode, $implClassName, $classIndex, "info");
     }
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
@@ -726,7 +752,6 @@ END
             push(@implContentDecls, "    if (!imp->document())\n");
             push(@implContentDecls, "      return;\n");
         }
-        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate);\n");
     } else {
         push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
     }
@@ -766,18 +791,10 @@ END
             $implIncludes{"V8AbstractEventListener.h"} = 1;
             $implIncludes{"V8CustomBinding.h"} = 1;
             $cacheIndex = GetHiddenDependencyIndex($dataNode, $attrName);
-            push(@implContentDecls, "    $nativeType old = imp->$attrName();\n");
-            push(@implContentDecls, "    V8AbstractEventListener* oldListener = old ? V8AbstractEventListener::cast(old.get()) : 0;\n");
-            push(@implContentDecls, "    if (oldListener) {\n");
-            push(@implContentDecls, "      v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();\n");
-            push(@implContentDecls, "      if (!oldListenerObject.IsEmpty())\n");
-            push(@implContentDecls, "        removeHiddenDependency(holder, oldListenerObject, $cacheIndex);\n");
-            push(@implContentDecls, "    }\n");
-            push(@implContentDecls, "    imp->set$implSetterFunctionName($result);\n");
-            push(@implContentDecls, "    if ($result)\n");
-            push(@implContentDecls, "      createHiddenDependency(holder, value, $cacheIndex");
+            push(@implContentDecls, "    transferHiddenDependency(holder, imp->$attrName(), value, $cacheIndex);\n");
+            push(@implContentDecls, "    imp->set$implSetterFunctionName(V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate)");
         } else {
-            push(@implContentDecls, "    imp->set$implSetterFunctionName(" . $result);
+            push(@implContentDecls, "    imp->set$implSetterFunctionName($result");
         }
         push(@implContentDecls, ", ec") if $useExceptions;
         push(@implContentDecls, ");\n");
@@ -807,12 +824,11 @@ END
     push(@implContentDecls, "  }\n\n");  # end of setter
 }
 
-sub GenerateNewFunctionTemplate
+sub GetFunctionTemplateCallbackName
 {
     $function = shift;
     $dataNode = shift;
-    $signature = shift;
-
+    
     my $interfaceName = $dataNode->name;
     my $name = $function->signature->name;
 
@@ -827,12 +843,22 @@ sub GenerateNewFunctionTemplate
         if ($customFunc eq 1) {
             $customFunc = $interfaceName . $codeGenerator->WK_ucfirst($name);
         }
-        return "v8::FunctionTemplate::New(V8Custom::v8${customFunc}Callback, v8::Handle<v8::Value>(), $signature)";
+        return "V8Custom::v8${customFunc}Callback";
     } else {
-        return "v8::FunctionTemplate::New(${interfaceName}Internal::${name}Callback, v8::Handle<v8::Value>(), $signature)";
+        return "${interfaceName}Internal::${name}Callback";
     }
 }
 
+sub GenerateNewFunctionTemplate
+{
+    $function = shift;
+    $dataNode = shift;
+    $signature = shift;
+
+    my $callback = GetFunctionTemplateCallbackName($function, $dataNode);
+    return "v8::FunctionTemplate::New($callback, v8::Handle<v8::Value>(), $signature)";
+}
+
 sub GenerateFunctionCallback
 {
     my $function = shift;
@@ -851,12 +877,12 @@ sub GenerateFunctionCallback
 
     if ($function->signature->extendedAttributes->{"RequiresAllArguments"}) {
         push(@implContentDecls,
-            "    if (args.Length() < $numParameters) return v8::Undefined();\n");
+            "    if (args.Length() < $numParameters) return v8::Handle<v8::Value>();\n");
     }
 
     if (IsPodType($implClassName)) {
         my $nativeClassName = GetNativeType($implClassName);
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = v8DOMWrapperTo<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
         push(@implContentDecls, "    $nativeClassName imp_instance = *imp_wrapper;\n");
         push(@implContentDecls, "    $nativeClassName* imp = &imp_instance;\n");
     } else {
@@ -873,24 +899,39 @@ END
     # We have not find real use cases yet.
     push(@implContentDecls,
 "    if (!V8Proxy::canAccessFrame(imp->frame(), true)) {\n".
-"      return v8::Undefined();\n" .
+"      return v8::Handle<v8::Value>();\n" .
 "    }\n");
     }
+    
+    my $raisesExceptions = @{$function->raisesExceptions};
+    if (!$raisesExceptions) {
+        foreach my $parameter (@{$function->parameters}) {
+            if (TypeCanFailConversion($parameter) or $parameter->extendedAttributes->{"IsIndex"}) {
+                $raisesExceptions = 1;
+            }
+        }
+    }
 
-
-    if (@{$function->raisesExceptions}) {
+    if ($raisesExceptions) {
         $implIncludes{"ExceptionCode.h"} = 1;
         push(@implContentDecls, "    ExceptionCode ec = 0;\n");
+        push(@implContentDecls, "    {\n");
+        # The brace here is needed to prevent the ensuing 'goto fail's from jumping past constructors
+        # of objects (like Strings) declared later, causing compile errors. The block scope ends
+        # right before the label 'fail:'.
     }
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push(@implContentDecls, "    ScriptCallStack callStack(args, $numParameters);\n");
+        push(@implContentDecls,
+"    OwnPtr<ScriptCallStack> callStack(ScriptCallStack::create(args, $numParameters));\n".
+"    if (!callStack)\n".
+"        return v8::Undefined();\n");
         $implIncludes{"ScriptCallStack.h"} = 1;
     }
     if ($function->signature->extendedAttributes->{"SVGCheckSecurityDocument"}) {
         push(@implContentDecls,
 "    if (!V8Proxy::checkNodeSecurity(imp->getSVGDocument(ec)))\n" .
-"      return v8::Undefined();\n");
+"      return v8::Handle<v8::Value>();\n");
     }
 
     my $paramIndex = 0;
@@ -911,7 +952,7 @@ END
             push(@implContentDecls, "    bool ${parameterName}Ok;\n");
         }
 
-        push(@implContentDecls, "    " . GetNativeTypeFromSignature($parameter, 1) . " $parameterName = ");
+        push(@implContentDecls, "    " . GetNativeTypeFromSignature($parameter, $paramIndex) . " $parameterName = ");
         push(@implContentDecls, JSValueToNative($parameter, "args[$paramIndex]",
            BasicTypeCanFailConversion($parameter) ?  "${parameterName}Ok" : undef) . ";\n");
 
@@ -919,8 +960,8 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (UNLIKELY(!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ")) {\n" .
-"      V8Proxy::setDOMException(TYPE_MISMATCH_ERR);\n" .
-"      return v8::Handle<v8::Value>();\n" .
+"      ec = TYPE_MISMATCH_ERR;\n" .
+"      goto fail;\n" .
 "    }\n");
         }
 
@@ -928,8 +969,8 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (UNLIKELY($parameterName < 0)) {\n" .
-"      V8Proxy::setDOMException(INDEX_SIZE_ERR);\n" .
-"      return v8::Handle<v8::Value>();\n" .
+"      ec = INDEX_SIZE_ERR;\n" .
+"      goto fail;\n" .
 "    }\n");
         }
 
@@ -939,6 +980,14 @@ END
     # Build the function call string.
     my $callString = GenerateFunctionCallString($function, $paramIndex, "    ", $implClassName);
     push(@implContentDecls, "$callString");
+
+    if ($raisesExceptions) {
+        push(@implContentDecls, "    }\n");
+        push(@implContentDecls, "  fail:\n");
+        push(@implContentDecls, "    V8Proxy::setDOMException(ec);\n");
+        push(@implContentDecls, "    return v8::Handle<v8::Value>();\n");
+    }
+    
     push(@implContentDecls, "  }\n\n");
 }
 
@@ -1217,6 +1266,38 @@ sub GenerateImplementation
         GenerateBatchedAttributeData($dataNode, $attributes);
         push(@implContent, "};\n");
     }
+    
+    # Setup table of standard callback functions
+    $num_callbacks = 0;
+    $has_callbacks = 0;
+    foreach my $function (@{$dataNode->functions}) {
+        my $attrExt = $function->signature->extendedAttributes;
+        # Don't put any nonstandard functions into this table:
+        if ($attrExt->{"V8OnInstance"}) {
+            next;
+        }
+        if ($attrExt->{"EnabledAtRuntime"} || RequiresCustomSignature($function) || $attrExt->{"V8DoNotCheckSignature"}) {
+            next;
+        }
+        if ($attrExt->{"DoNotCheckDomainSecurity"} &&
+            ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
+            next;
+        }
+        if ($attrExt->{"DontEnum"} || $attrExt->{"V8ReadOnly"}) {
+            next;
+        }
+        if (!$has_callbacks) {
+            $has_callbacks = 1;
+            push(@implContent, "static const BatchedCallback ${interfaceName}_callbacks[] = {\n");
+        }
+        my $name = $function->signature->name;
+        my $callback = GetFunctionTemplateCallbackName($function, $dataNode);
+        push(@implContent, <<END);
+  {"$name", $callback},
+END
+        $num_callbacks++;
+    }
+    push(@implContent, "};\n")  if $has_callbacks;
 
     # Setup constants
     my $has_constants = 0;
@@ -1240,7 +1321,7 @@ END
 
     push(@implContentDecls, "} // namespace ${interfaceName}Internal\n\n");
 
-    my $access_check = "/* no access check */";
+    my $access_check = "";
     if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !($interfaceName eq "DOMWindow")) {
         $access_check = "instance->SetAccessCheckCallbacks(V8Custom::v8${interfaceName}NamedSecurityCheck, V8Custom::v8${interfaceName}IndexedSecurityCheck, v8::Integer::New(V8ClassIndex::ToInt(V8ClassIndex::${classIndex})));";
     }
@@ -1259,35 +1340,59 @@ static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Pers
 END
     }
 
+    # find the super descriptor
+    my $parentClassIndex = "INVALID_CLASS_INDEX";
+    foreach (@{$dataNode->parents}) {
+        my $parent = $codeGenerator->StripModule($_);
+        if ($parent eq "EventTarget") { next; }
+        $implIncludes{"V8${parent}.h"} = 1;
+        $parentClassIndex = uc($codeGenerator->StripModule($parent));
+        last;
+    }
+
+    # find the field count
+    my $fieldCount = "V8Custom::kDefaultWrapperInternalFieldCount";
+    if (IsNodeSubType($dataNode)) {
+        $fieldCount = "V8Custom::kNodeMinimumInternalFieldCount";
+    }
+    
     # Generate the template configuration method
     push(@implContent,  <<END);
 static v8::Persistent<v8::FunctionTemplate> Configure${className}Template(v8::Persistent<v8::FunctionTemplate> desc) {
-  v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
+  v8::Local<v8::Signature> default_signature = configureTemplate(desc, \"${interfaceName}\",
+      V8ClassIndex::$parentClassIndex, $fieldCount,
 END
-    if (IsNodeSubType($dataNode)) {
+
+    # Set up our attributes if we have them
+    if ($has_attributes) {
         push(@implContent, <<END);
-  instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+      ${interfaceName}_attrs, sizeof(${interfaceName}_attrs)/sizeof(*${interfaceName}_attrs),
 END
     } else {
         push(@implContent, <<END);
-  instance->SetInternalFieldCount(V8Custom::kDefaultWrapperInternalFieldCount);
+      NULL, 0,
+END
+    }
+    
+    if ($has_callbacks) {
+        push(@implContent, <<END);
+      ${interfaceName}_callbacks, sizeof(${interfaceName}_callbacks)/sizeof(*${interfaceName}_callbacks));
+END
+    } else {
+        push(@implContent, <<END);
+      NULL, 0);
 END
     }
 
+    if ($access_check or @enabledAtRuntime or @{$dataNode->functions} or $has_constants) {
     push(@implContent,  <<END);
-  v8::Local<v8::Signature> default_signature = v8::Signature::New(desc);
+  v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
   v8::Local<v8::ObjectTemplate> proto = desc->PrototypeTemplate();
-  $access_check
-END
-
-
-    # Set up our attributes if we have them
-    if ($has_attributes) {
-        push(@implContent, <<END);
-  batchConfigureAttributes(instance, proto, ${interfaceName}_attrs, sizeof(${interfaceName}_attrs)/sizeof(*${interfaceName}_attrs));
 END
     }
 
+    push(@implContent,  "  $access_check\n");
+    
     # Setup the enable-at-runtime attrs if we have them
     foreach my $runtime_attr (@enabledAtRuntime) {
         $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($runtime_attr->signature->name);
@@ -1304,7 +1409,9 @@ END
     }
 
     # Define our functions with Set() or SetAccessor()
+    $total_functions = 0;
     foreach my $function (@{$dataNode->functions}) {
+        $total_functions++;
         my $attrExt = $function->signature->extendedAttributes;
         my $name = $function->signature->name;
 
@@ -1358,6 +1465,7 @@ END
       v8::ALL_CAN_READ,
       static_cast<v8::PropertyAttribute>($property_attributes));
 END
+          $num_callbacks++;
           next;
       }
 
@@ -1372,31 +1480,26 @@ END
       }
 
       # Normal function call is a template
-      my $templateFunction = GenerateNewFunctionTemplate($function, $dataNode, $signature);
-
-
+      my $callback = GetFunctionTemplateCallbackName($function, $dataNode);
+      
+      if ($property_attributes eq "v8::DontDelete") {
+          $property_attributes = "";
+      } else {
+          $property_attributes = ", static_cast<v8::PropertyAttribute>($property_attributes)";
+      }
+      
+      if ($template eq "proto" && $conditional eq "" && $signature eq "default_signature" && $property_attributes eq "") {
+          # Standard type of callback, already created in the batch, so skip it here.
+          next;
+      }
+      
       push(@implContent, <<END);
-
-  // $commentInfo
-  $conditional ${template}->Set(
-      v8::String::New("$name"),
-      $templateFunction,
-      static_cast<v8::PropertyAttribute>($property_attributes));
+  ${conditional}createCallback($template, "$name", $callback, ${signature}$property_attributes);
 END
+      $num_callbacks++;
     }
-
-    # set the super descriptor
-    foreach (@{$dataNode->parents}) {
-        my $parent = $codeGenerator->StripModule($_);
-        if ($parent eq "EventTarget") { next; }
-        $implIncludes{"V8${parent}.h"} = 1;
-        my $parentClassIndex = uc($codeGenerator->StripModule($parent));
-        push(@implContent, "  desc->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::${parentClassIndex}));\n");
-        last;
-    }
-
-    # Set the class name.  This is used when printing objects.
-    push(@implContent, "  desc->SetClassName(v8::String::New(\"${interfaceName}\"));\n");
+    
+    die "Wrong number of callbacks generated for $interfaceName ($num_callbacks, should be $total_functions)" if $num_callbacks != $total_functions;
 
     if ($has_constants) {
         push(@implContent, <<END);
@@ -1409,19 +1512,12 @@ END
 }
 
 v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate() {
-  static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_;
-  if (${className}_raw_cache_.IsEmpty()) {
-    v8::HandleScope scope;
-    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::checkNewLegal);
-    ${className}_raw_cache_ = v8::Persistent<v8::FunctionTemplate>::New(result);
-  }
+  static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_ = createRawTemplate();
   return ${className}_raw_cache_;
 }
 
 v8::Persistent<v8::FunctionTemplate> ${className}::GetTemplate() {
-  static v8::Persistent<v8::FunctionTemplate> ${className}_cache_;
-  if (${className}_cache_.IsEmpty())
-    ${className}_cache_ = Configure${className}Template(GetRawTemplate());
+  static v8::Persistent<v8::FunctionTemplate> ${className}_cache_ = Configure${className}Template(GetRawTemplate());
   return ${className}_cache_;
 }
 
@@ -1528,7 +1624,7 @@ sub GenerateFunctionCallString()
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
         $functionString .= ", " if not $first;
-        $functionString .= "&callStack";
+        $functionString .= "callStack.get()";
         if ($first) { $first = 0; }
     }
 
@@ -1546,7 +1642,7 @@ sub GenerateFunctionCallString()
         # appendChild functions from Node.
         $result .= $indent . "bool success = $functionString;\n";
         if (@{$function->raisesExceptions}) {
-            $result .= GenerateSetDOMException($indent);
+            $result .= $indent . "if (UNLIKELY(ec)) goto fail;\n";
         }
         $result .= $indent . "if (success)\n";
         $result .= $indent . "    " .
@@ -1570,7 +1666,7 @@ sub GenerateFunctionCallString()
     }
 
     if (@{$function->raisesExceptions}) {
-        $result .= GenerateSetDOMException($indent);
+        $result .= $indent . "if (UNLIKELY(ec)) goto fail;\n";
     }
 
     # If the return type is a POD type, separate out the wrapper generation
@@ -1627,19 +1723,14 @@ sub GetTypeFromSignature
 {
     my $signature = shift;
 
-    my $type = $codeGenerator->StripModule($signature->type);
-    if (($type eq "DOMString") && $signature->extendedAttributes->{"HintAtomic"}) {
-        $type = "AtomicString";
-    }
-
-    return $type;
+    return $codeGenerator->StripModule($signature->type);
 }
 
 
 sub GetNativeTypeFromSignature
 {
     my $signature = shift;
-    my $isParameter = shift;
+    my $parameterIndex = shift;
 
     my $type = GetTypeFromSignature($signature);
 
@@ -1648,32 +1739,28 @@ sub GetNativeTypeFromSignature
         return "int";
     }
 
-    return GetNativeType($type, $isParameter);
+    $type = GetNativeType($type, $parameterIndex >= 0 ? 1 : 0);
+    
+    if ($parameterIndex >= 0 && $type eq "V8Parameter") {
+        my $mode = "";
+        if ($signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"}) {
+            $mode = "WithUndefinedOrNullCheck";
+        } elsif ($signature->extendedAttributes->{"ConvertNullToNullString"}) {
+            $mode = "WithNullCheck";
+        }
+        $type .= "<$mode>";
+    }
+    
+    return $type;
 }
 
 sub IsRefPtrType
 {
     my $type = shift;
     return 1 if $type eq "Attr";
-    return 1 if $type eq "CanvasActiveInfo";
-    return 1 if $type eq "CanvasArray";
-    return 1 if $type eq "CanvasArrayBuffer";
     return 1 if $type eq "CanvasBooleanArray";
-    return 1 if $type eq "CanvasByteArray";
-    return 1 if $type eq "CanvasBuffer";
-    return 1 if $type eq "CanvasFloatArray";
-    return 1 if $type eq "CanvasFramebuffer";
     return 1 if $type eq "CanvasGradient";
-    return 1 if $type eq "CanvasIntArray";
     return 1 if $type eq "CanvasObject";
-    return 1 if $type eq "CanvasProgram";
-    return 1 if $type eq "CanvasRenderbuffer";
-    return 1 if $type eq "CanvasShader";
-    return 1 if $type eq "CanvasShortArray";
-    return 1 if $type eq "CanvasTexture";
-    return 1 if $type eq "CanvasUnsignedByteArray";
-    return 1 if $type eq "CanvasUnsignedIntArray";
-    return 1 if $type eq "CanvasUnsignedShortArray";
     return 1 if $type eq "ClientRect";
     return 1 if $type eq "ClientRectList";
     return 1 if $type eq "CDATASection";
@@ -1721,6 +1808,23 @@ sub IsRefPtrType
     return 1 if $type eq "TextMetrics";
     return 1 if $type eq "TimeRanges";
     return 1 if $type eq "TreeWalker";
+    return 1 if $type eq "WebGLActiveInfo";
+    return 1 if $type eq "WebGLArray";
+    return 1 if $type eq "WebGLArrayBuffer";
+    return 1 if $type eq "WebGLByteArray";
+    return 1 if $type eq "WebGLBuffer";
+    return 1 if $type eq "WebGLFloatArray";
+    return 1 if $type eq "WebGLFramebuffer";
+    return 1 if $type eq "WebGLIntArray";
+    return 1 if $type eq "WebGLProgram";
+    return 1 if $type eq "WebGLRenderbuffer";
+    return 1 if $type eq "WebGLShader";
+    return 1 if $type eq "WebGLShortArray";
+    return 1 if $type eq "WebGLTexture";
+    return 1 if $type eq "WebGLUniformLocation";
+    return 1 if $type eq "WebGLUnsignedByteArray";
+    return 1 if $type eq "WebGLUnsignedIntArray";
+    return 1 if $type eq "WebGLUnsignedShortArray";
     return 1 if $type eq "WebKitCSSMatrix";
     return 1 if $type eq "WebKitPoint";
     return 1 if $type eq "XPathExpression";
@@ -1766,10 +1870,11 @@ sub GetNativeType
     my $type = shift;
     my $isParameter = shift;
 
-    if ($type eq "float" or $type eq "AtomicString" or $type eq "double") {
+    if ($type eq "float" or $type eq "double") {
         return $type;
     }
 
+    return "V8Parameter" if ($type eq "DOMString" or $type eq "DOMUserData") and $isParameter;
     return "int" if $type eq "int";
     return "int" if $type eq "short" or $type eq "unsigned short";
     return "unsigned" if $type eq "unsigned long";
@@ -1805,21 +1910,21 @@ sub GetNativeType
 
 
 my %typeCanFailConversion = (
-    "AtomicString" => 0,
     "Attr" => 1,
-    "CanvasArray" => 0,
-    "CanvasBuffer" => 0,
-    "CanvasByteArray" => 0,
-    "CanvasFloatArray" => 0,
-    "CanvasFramebuffer" => 0,
+    "WebGLArray" => 0,
+    "WebGLBuffer" => 0,
+    "WebGLByteArray" => 0,
+    "WebGLFloatArray" => 0,
+    "WebGLFramebuffer" => 0,
     "CanvasGradient" => 0,
-    "CanvasIntArray" => 0,
+    "WebGLIntArray" => 0,
     "CanvasPixelArray" => 0,
-    "CanvasProgram" => 0,
-    "CanvasRenderbuffer" => 0,
-    "CanvasShader" => 0,
-    "CanvasShortArray" => 0,
-    "CanvasTexture" => 0,
+    "WebGLProgram" => 0,
+    "WebGLRenderbuffer" => 0,
+    "WebGLShader" => 0,
+    "WebGLShortArray" => 0,
+    "WebGLTexture" => 0,
+    "WebGLUniformLocation" => 0,
     "CompareHow" => 0,
     "DataGridColumn" => 0,
     "DOMString" => 0,
@@ -1921,16 +2026,8 @@ sub JSValueToNative
     return "static_cast<Range::CompareHow>($value->Int32Value())" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value->ToInt32()->Int32Value())" if $type eq "SVGPaintType";
 
-    if ($type eq "AtomicString") {
-        return "v8ValueToAtomicWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
-        return "v8ValueToAtomicWebCoreString($value)";
-    }
-
-    return "toWebCoreString($value)" if $type eq "DOMUserData";
-    if ($type eq "DOMString") {
-        return "toWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
-        return "toWebCoreStringWithNullOrUndefinedCheck($value)" if $signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"};
-        return "toWebCoreString($value)";
+    if ($type eq "DOMString" or $type eq "DOMUserData") {
+        return $value;
     }
 
     if ($type eq "SerializedScriptValue") {
@@ -1956,7 +2053,7 @@ sub JSValueToNative
         $implIncludes{"V8Node.h"} = 1;
 
         # EventTarget is not in DOM hierarchy, but all Nodes are EventTarget.
-        return "V8Node::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8Node::HasInstance($value) ? v8DOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 
     if ($type eq "XPathNSResolver") {
@@ -1971,7 +2068,7 @@ sub JSValueToNative
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<${type}>(v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8${type}::HasInstance($value) ? v8DOMWrapperToNode<${type}>(v8::Handle<v8::Object>::Cast($value)) : 0";
     } else {
         # TODO: Temporary to avoid Window name conflict.
         my $classIndex = uc($type);
@@ -1990,7 +2087,7 @@ sub JSValueToNative
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8DOMWrapper::convertToNativeObject<${implClassName}>(V8ClassIndex::${classIndex}, v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8${type}::HasInstance($value) ? v8DOMWrapperTo<${implClassName}>(V8ClassIndex::${classIndex}, v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 }
 
@@ -2054,7 +2151,6 @@ sub RequiresCustomSignature
 
 my %non_wrapper_types = (
     'float' => 1,
-    'AtomicString' => 1,
     'double' => 1,
     'short' => 1,
     'unsigned short' => 1,
@@ -2123,8 +2219,8 @@ sub ReturnNativeToJSValue
     my $className= "V8$type";
 
     return "return v8::Date::New(static_cast<double>($value))" if $type eq "DOMTimeStamp";
-    return "return $value ? v8::True() : v8::False()" if $type eq "boolean";
-    return "return v8::Undefined()" if $type eq "void";
+    return "return v8Boolean($value)" if $type eq "boolean";
+    return "return v8::Handle<v8::Value>()" if $type eq "void";     # equivalent to v8::Undefined()
 
     # For all the types where we use 'int' as the representation type,
     # we use Integer::New which has a fast Smi conversion check.
diff --git a/WebCore/bindings/scripts/IDLParser.pm b/WebCore/bindings/scripts/IDLParser.pm
index 4abdb45..5affe94 100644
--- a/WebCore/bindings/scripts/IDLParser.pm
+++ b/WebCore/bindings/scripts/IDLParser.pm
@@ -3,8 +3,6 @@
 #
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # 
-# This file is part of the KDE project
-# 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
diff --git a/WebCore/bindings/scripts/IDLStructure.pm b/WebCore/bindings/scripts/IDLStructure.pm
index 5a59ff1..f5970b4 100644
--- a/WebCore/bindings/scripts/IDLStructure.pm
+++ b/WebCore/bindings/scripts/IDLStructure.pm
@@ -3,8 +3,6 @@
 #
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # 
-# This file is part of the KDE project
-# 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
diff --git a/WebCore/bindings/v8/DOMData.cpp b/WebCore/bindings/v8/DOMData.cpp
index 07254fe..54bcc55 100644
--- a/WebCore/bindings/v8/DOMData.cpp
+++ b/WebCore/bindings/v8/DOMData.cpp
@@ -33,6 +33,7 @@
 
 #include "ChildThreadDOMData.h"
 #include "MainThreadDOMData.h"
+#include "WebGLUniformLocation.h"
 
 namespace WebCore {
 
@@ -46,19 +47,12 @@ DOMData::DOMData()
 DOMData* DOMData::getCurrent()
 {
     if (WTF::isMainThread())
-        return getCurrentMainThread();
+        return MainThreadDOMData::getCurrent();
 
     DEFINE_STATIC_LOCAL(WTF::ThreadSpecific<ChildThreadDOMData>, childThreadDOMData, ());
     return childThreadDOMData;
 }
 
-DOMData* DOMData::getCurrentMainThread()
-{
-    ASSERT(WTF::isMainThread());
-    DEFINE_STATIC_LOCAL(MainThreadDOMData, mainThreadDOMData, ());
-    return &mainThreadDOMData;
-}
-
 void DOMData::ensureDeref(V8ClassIndex::V8WrapperType type, void* domObject)
 {
     if (m_owningThread == WTF::currentThread()) {
diff --git a/WebCore/bindings/v8/DOMData.h b/WebCore/bindings/v8/DOMData.h
index e67adb4..7bf9f91 100644
--- a/WebCore/bindings/v8/DOMData.h
+++ b/WebCore/bindings/v8/DOMData.h
@@ -50,7 +50,6 @@ namespace WebCore {
 #endif
 
         static DOMData* getCurrent();
-        static DOMData* getCurrentMainThread(); // Caller must be on the main thread.
         virtual DOMDataStore& getStore() = 0;
 
         template<typename T>
@@ -87,20 +86,10 @@ namespace WebCore {
         ThreadIdentifier m_owningThread;
     };
 
-    // Called when the dead object is not in GC thread's map. Go through all
-    // thread maps to find the one containing it.  Then clear the JS reference
-    // and push the DOM object into the delayed queue for it to be deref-ed at
-    // later time from the owning thread.
-    //
-    // * This is called when the GC thread is not the owning thread.
-    // * This can be called on any thread that has GC running.
-    // * Only one V8 instance is running at a time due to V8::Locker. So we don't need to worry about concurrency.
-    //
     template<typename T>
     void DOMData::handleWeakObject(DOMDataStore::DOMWrapperMapType mapType, v8::Handle<v8::Object> v8Object, T* domObject)
     {
-
-        WTF::MutexLocker locker(DOMDataStore::allStoresMutex());
+        ASSERT(WTF::isMainThread());
         DOMDataList& list = DOMDataStore::allStores();
         for (size_t i = 0; i < list.size(); ++i) {
             DOMDataStore* store = list[i];
@@ -111,7 +100,8 @@ namespace WebCore {
             if (*wrapper == *v8Object) {
                 // Clear the JS reference.
                 domMap->forgetOnly(domObject);
-                store->domData()->ensureDeref(V8DOMWrapper::domWrapperType(v8Object), domObject);
+                ASSERT(store->domData()->owningThread() == WTF::currentThread());
+                store->domData()->derefObject(V8DOMWrapper::domWrapperType(v8Object), domObject);
             }
         }
     }
diff --git a/WebCore/bindings/v8/DOMObjectsInclude.h b/WebCore/bindings/v8/DOMObjectsInclude.h
index 213873b..6ed14be 100644
--- a/WebCore/bindings/v8/DOMObjectsInclude.h
+++ b/WebCore/bindings/v8/DOMObjectsInclude.h
@@ -31,36 +31,38 @@
 #ifndef DOMObjectsInclude_h
 #define DOMObjectsInclude_h
 
+#include "Attr.h"
 #include "BarInfo.h"
 #include "BeforeLoadEvent.h"
-#include "CanvasActiveInfo.h"
-#include "CanvasArray.h"
-#include "CanvasArrayBuffer.h"
-#include "CanvasBuffer.h"
-#include "CanvasByteArray.h"
-#include "CanvasFloatArray.h"
-#include "CanvasFramebuffer.h"
+#include "WebGLActiveInfo.h"
+#include "WebGLArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLBuffer.h"
+#include "WebGLByteArray.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
 #include "CanvasGradient.h"
-#include "CanvasIntArray.h"
+#include "WebGLIntArray.h"
 #include "CanvasObject.h"
 #include "CanvasPattern.h"
 #include "CanvasPixelArray.h"
-#include "CanvasProgram.h"
-#include "CanvasRenderbuffer.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
 #include "CanvasRenderingContext.h"
 #include "CanvasRenderingContext2D.h"
-#include "CanvasRenderingContext3D.h"
-#include "CanvasShader.h"
-#include "CanvasShortArray.h"
-#include "CanvasUnsignedByteArray.h"
-#include "CanvasUnsignedIntArray.h"
-#include "CanvasUnsignedShortArray.h"
+#include "WebGLRenderingContext.h"
+#include "WebGLShader.h"
+#include "WebGLShortArray.h"
+#include "WebGLUnsignedByteArray.h"
+#include "WebGLUnsignedIntArray.h"
+#include "WebGLUnsignedShortArray.h"
 #include "CanvasStyle.h"
-#include "CanvasTexture.h"
+#include "WebGLTexture.h"
 #include "CharacterData.h"
 #include "ClientRect.h"
 #include "ClientRectList.h"
 #include "Clipboard.h"
+#include "CompositionEvent.h"
 #include "Console.h"
 #include "Counter.h"
 #include "CSSCharsetRule.h"
@@ -271,7 +273,9 @@
 #endif // XSLT
 
 #if ENABLE(INSPECTOR)
+#include "InjectedScriptHost.h"
 #include "InspectorBackend.h"
+#include "InspectorFrontendHost.h"
 #endif // INSPECTOR
 
 namespace WebCore {
diff --git a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
index 0a88da7..bd2bb7b 100644
--- a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
+++ b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
@@ -31,38 +31,45 @@
 // This source file coalesces the V8 derived sources into a single object file to
 // reduce bloat and allow us to link release builds on 32-bit Windows.
 
+// Require explicit conversion to AtomicString. This helps catch cases where
+// the generated bindings cause an expensive implicit conversion.
+#define NO_IMPLICIT_ATOMICSTRING
+
 #include "bindings/V8Attr.cpp"
 #include "bindings/V8BarInfo.cpp"
 #include "bindings/V8BeforeLoadEvent.cpp"
-#include "bindings/V8CanvasActiveInfo.cpp"
-#include "bindings/V8CanvasArray.cpp"
-#include "bindings/V8CanvasArrayBuffer.cpp"
-#include "bindings/V8CanvasBuffer.cpp"
-#include "bindings/V8CanvasByteArray.cpp"
-#include "bindings/V8CanvasFloatArray.cpp"
-#include "bindings/V8CanvasFramebuffer.cpp"
+#include "bindings/V8WebGLActiveInfo.cpp"
+#include "bindings/V8WebGLArray.cpp"
+#include "bindings/V8WebGLArrayBuffer.cpp"
+#include "bindings/V8WebGLBuffer.cpp"
+#include "bindings/V8WebGLByteArray.cpp"
+#include "bindings/V8WebGLFloatArray.cpp"
+#include "bindings/V8WebGLFramebuffer.cpp"
 #include "bindings/V8CanvasGradient.cpp"
-#include "bindings/V8CanvasIntArray.cpp"
+#include "bindings/V8WebGLIntArray.cpp"
 #include "bindings/V8CanvasPattern.cpp"
 #include "bindings/V8CanvasPixelArray.cpp"
-#include "bindings/V8CanvasProgram.cpp"
-#include "bindings/V8CanvasRenderbuffer.cpp"
+#include "bindings/V8WebGLProgram.cpp"
+#include "bindings/V8WebGLRenderbuffer.cpp"
 #include "bindings/V8CanvasRenderingContext.cpp"
 #include "bindings/V8CanvasRenderingContext2D.cpp"
-#include "bindings/V8CanvasRenderingContext3D.cpp"
-#include "bindings/V8CanvasShader.cpp"
-#include "bindings/V8CanvasShortArray.cpp"
-#include "bindings/V8CanvasTexture.cpp"
-#include "bindings/V8CanvasUnsignedByteArray.cpp"
-#include "bindings/V8CanvasUnsignedIntArray.cpp"
-#include "bindings/V8CanvasUnsignedShortArray.cpp"
+#include "bindings/V8WebGLRenderingContext.cpp"
+#include "bindings/V8WebGLShader.cpp"
+#include "bindings/V8WebGLShortArray.cpp"
+#include "bindings/V8WebGLTexture.cpp"
+#include "bindings/V8WebGLUniformLocation.cpp"
+#include "bindings/V8WebGLUnsignedByteArray.cpp"
+#include "bindings/V8WebGLUnsignedIntArray.cpp"
+#include "bindings/V8WebGLUnsignedShortArray.cpp"
 #include "bindings/V8CDATASection.cpp"
 #include "bindings/V8CharacterData.cpp"
 #include "bindings/V8ClientRect.cpp"
 #include "bindings/V8ClientRectList.cpp"
 #include "bindings/V8Clipboard.cpp"
 #include "bindings/V8Comment.cpp"
+#include "bindings/V8CompositionEvent.cpp"
 #include "bindings/V8Console.cpp"
+#include "bindings/V8Coordinates.cpp"
 #include "bindings/V8Counter.cpp"
 #include "bindings/V8CSSCharsetRule.cpp"
 #include "bindings/V8CSSFontFaceRule.cpp"
@@ -97,6 +104,8 @@
 #include "bindings/V8EventException.cpp"
 #include "bindings/V8File.cpp"
 #include "bindings/V8FileList.cpp"
+#include "bindings/V8Geolocation.cpp"
+#include "bindings/V8Geoposition.cpp"
 #include "bindings/V8History.cpp"
 #include "bindings/V8HTMLAllCollection.cpp"
 #include "bindings/V8HTMLAnchorElement.cpp"
@@ -193,6 +202,7 @@
 #include "bindings/V8PageTransitionEvent.cpp"
 #include "bindings/V8Plugin.cpp"
 #include "bindings/V8PluginArray.cpp"
+#include "bindings/V8PositionError.cpp"
 #include "bindings/V8ProcessingInstruction.cpp"
 #include "bindings/V8ProgressEvent.cpp"
 #include "bindings/V8Range.cpp"
@@ -282,6 +292,7 @@
 #include "bindings/V8SVGCircleElement.cpp"
 #include "bindings/V8SVGClipPathElement.cpp"
 #include "bindings/V8SVGColor.cpp"
+#include "bindings/V8SVGComponentTransferFunctionElement.cpp"
 #include "bindings/V8SVGCursorElement.cpp"
 #include "bindings/V8SVGDefsElement.cpp"
 #include "bindings/V8SVGDescElement.cpp"
@@ -291,6 +302,30 @@
 #include "bindings/V8SVGElementInstanceList.cpp"
 #include "bindings/V8SVGEllipseElement.cpp"
 #include "bindings/V8SVGException.cpp"
+#include "bindings/V8SVGFEBlendElement.cpp"
+#include "bindings/V8SVGFEColorMatrixElement.cpp"
+#include "bindings/V8SVGFEComponentTransferElement.cpp"
+#include "bindings/V8SVGFECompositeElement.cpp"
+#include "bindings/V8SVGFEDiffuseLightingElement.cpp"
+#include "bindings/V8SVGFEDisplacementMapElement.cpp"
+#include "bindings/V8SVGFEDistantLightElement.cpp"
+#include "bindings/V8SVGFEFloodElement.cpp"
+#include "bindings/V8SVGFEFuncAElement.cpp"
+#include "bindings/V8SVGFEFuncBElement.cpp"
+#include "bindings/V8SVGFEFuncGElement.cpp"
+#include "bindings/V8SVGFEFuncRElement.cpp"
+#include "bindings/V8SVGFEGaussianBlurElement.cpp"
+#include "bindings/V8SVGFEImageElement.cpp"
+#include "bindings/V8SVGFEMergeElement.cpp"
+#include "bindings/V8SVGFEMergeNodeElement.cpp"
+#include "bindings/V8SVGFEMorphologyElement.cpp"
+#include "bindings/V8SVGFEOffsetElement.cpp"
+#include "bindings/V8SVGFEPointLightElement.cpp"
+#include "bindings/V8SVGFESpecularLightingElement.cpp"
+#include "bindings/V8SVGFESpotLightElement.cpp"
+#include "bindings/V8SVGFETileElement.cpp"
+#include "bindings/V8SVGFETurbulenceElement.cpp"
+#include "bindings/V8SVGFilterElement.cpp"
 #include "bindings/V8SVGFontElement.cpp"
 #include "bindings/V8SVGFontFaceElement.cpp"
 #include "bindings/V8SVGFontFaceFormatElement.cpp"
@@ -382,5 +417,7 @@
 #endif
 
 #if ENABLE(INSPECTOR)
+#include "bindings/V8InjectedScriptHost.cpp"
 #include "bindings/V8InspectorBackend.cpp"
+#include "bindings/V8InspectorFrontendHost.cpp"
 #endif
diff --git a/WebCore/bindings/v8/MainThreadDOMData.cpp b/WebCore/bindings/v8/MainThreadDOMData.cpp
index ea34444..b1b63bf 100644
--- a/WebCore/bindings/v8/MainThreadDOMData.cpp
+++ b/WebCore/bindings/v8/MainThreadDOMData.cpp
@@ -39,14 +39,30 @@ MainThreadDOMData::MainThreadDOMData()
     : m_defaultStore(this)
 {
 }
+    
+MainThreadDOMData* MainThreadDOMData::getCurrent()
+{
+    ASSERT(WTF::isMainThread());
+    DEFINE_STATIC_LOCAL(MainThreadDOMData, mainThreadDOMData, ());
+    return &mainThreadDOMData;
+}
 
-DOMDataStore& MainThreadDOMData::getStore()
+DOMDataStore& MainThreadDOMData::getMainThreadStore()
 {
+    // This is broken out as a separate non-virtual method from getStore()
+    // so that it can be inlined by getCurrentMainThreadStore, which is
+    // a hot spot in Dromaeo DOM tests.
     ASSERT(WTF::isMainThread());
     V8IsolatedWorld* world = V8IsolatedWorld::getEntered();
-    if (world)
+    if (UNLIKELY(world != 0))
         return *world->getDOMDataStore();
     return m_defaultStore;
 }
 
+DOMDataStore& MainThreadDOMData::getCurrentMainThreadStore()
+{
+    return getCurrent()->getMainThreadStore();
+}
+
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/MainThreadDOMData.h b/WebCore/bindings/v8/MainThreadDOMData.h
index 5c78cec..e8f99c9 100644
--- a/WebCore/bindings/v8/MainThreadDOMData.h
+++ b/WebCore/bindings/v8/MainThreadDOMData.h
@@ -38,10 +38,16 @@ namespace WebCore {
 
     class MainThreadDOMData : public DOMData {
     public:
-        MainThreadDOMData();
-        DOMDataStore& getStore();
+        static MainThreadDOMData* getCurrent(); // Caller must be on the main thread.
+        static DOMDataStore& getCurrentMainThreadStore();
+                
+        virtual DOMDataStore& getStore() { return getMainThreadStore(); }
+        
 
     private:
+        MainThreadDOMData();
+        DOMDataStore& getMainThreadStore();
+
         StaticDOMDataStore m_defaultStore;
         // Note: The DOMDataStores for isolated world are owned by the world object.
     };
diff --git a/WebCore/bindings/v8/NPV8Object.cpp b/WebCore/bindings/v8/NPV8Object.cpp
index 13403ec..69cd303 100644
--- a/WebCore/bindings/v8/NPV8Object.cpp
+++ b/WebCore/bindings/v8/NPV8Object.cpp
@@ -413,7 +413,7 @@ bool _NPN_HasMethod(NPP npp, NPObject* npObject, NPIdentifier methodName)
 
 void _NPN_SetException(NPObject* npObject, const NPUTF8 *message)
 {
-    if (npObject->_class != npScriptObjectClass) {
+    if (!npObject || npObject->_class != npScriptObjectClass) {
         // We won't be able to find a proper scope for this exception, so just throw it.
         // This is consistent with JSC, which throws a global exception all the time.
         V8Proxy::throwError(V8Proxy::GeneralError, message);
diff --git a/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp b/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp
index 21293a5..cf97b5b 100644
--- a/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp
+++ b/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp
@@ -36,5 +36,7 @@ namespace WebCore {
 bool RuntimeEnabledFeatures::isDatabaseEnabled = false;
 bool RuntimeEnabledFeatures::isLocalStorageEnabled = true;
 bool RuntimeEnabledFeatures::isSessionStorageEnabled = true;
+bool RuntimeEnabledFeatures::isNotificationsEnabled = false;
+bool RuntimeEnabledFeatures::isApplicationCacheEnabled = false;
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/RuntimeEnabledFeatures.h b/WebCore/bindings/v8/RuntimeEnabledFeatures.h
index fa42024..d8078c5 100644
--- a/WebCore/bindings/v8/RuntimeEnabledFeatures.h
+++ b/WebCore/bindings/v8/RuntimeEnabledFeatures.h
@@ -45,6 +45,12 @@ public:
     static void setSessionStorageEnabled(bool isEnabled) { isSessionStorageEnabled = isEnabled; }
     static bool sessionStorageEnabled() { return isSessionStorageEnabled; }
 
+    static void setNotificationsEnabled(bool isEnabled) { isNotificationsEnabled = isEnabled; }
+    static bool notificationsEnabled() { return isNotificationsEnabled; }
+
+    static void setApplicationCacheEnabled(bool isEnabled) { isApplicationCacheEnabled = isEnabled; }
+    static bool applicationCacheEnabled() { return isApplicationCacheEnabled; }
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -52,6 +58,8 @@ private:
     static bool isDatabaseEnabled;
     static bool isLocalStorageEnabled;
     static bool isSessionStorageEnabled;
+    static bool isNotificationsEnabled;
+    static bool isApplicationCacheEnabled;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptCallStack.cpp b/WebCore/bindings/v8/ScriptCallStack.cpp
index 8eb9478..d9b2fcf 100644
--- a/WebCore/bindings/v8/ScriptCallStack.cpp
+++ b/WebCore/bindings/v8/ScriptCallStack.cpp
@@ -38,8 +38,21 @@
 
 namespace WebCore {
 
-ScriptCallStack::ScriptCallStack(const v8::Arguments& arguments, unsigned skipArgumentCount)
-    : m_lastCaller(String(), V8Proxy::sourceName(), V8Proxy::sourceLineNumber() + 1, arguments, skipArgumentCount)
+ScriptCallStack* ScriptCallStack::create(const v8::Arguments& arguments, unsigned skipArgumentCount) {
+    String sourceName;
+    int sourceLineNumber;
+    if (!V8Proxy::sourceName(sourceName)) {
+        return 0;
+    }
+    if (!V8Proxy::sourceLineNumber(sourceLineNumber)) {
+        return 0;
+    }
+    sourceLineNumber += 1;
+    return new ScriptCallStack(arguments, skipArgumentCount, sourceName, sourceLineNumber);
+}
+
+ScriptCallStack::ScriptCallStack(const v8::Arguments& arguments, unsigned skipArgumentCount, String sourceName, int sourceLineNumber)
+    : m_lastCaller(String(), sourceName, sourceLineNumber, arguments, skipArgumentCount)
     , m_scriptState(new ScriptState(V8Proxy::retrieveFrameForCurrentContext()))
 {
 }
diff --git a/WebCore/bindings/v8/ScriptCallStack.h b/WebCore/bindings/v8/ScriptCallStack.h
index 3ba01c5..f6a7e39 100644
--- a/WebCore/bindings/v8/ScriptCallStack.h
+++ b/WebCore/bindings/v8/ScriptCallStack.h
@@ -45,7 +45,7 @@ namespace WebCore {
 
     class ScriptCallStack : public Noncopyable {
     public:
-        ScriptCallStack(const v8::Arguments&, unsigned skipArgumentCount = 0);
+        static ScriptCallStack* create(const v8::Arguments&, unsigned skipArgumentCount = 0);
         ~ScriptCallStack();
 
         const ScriptCallFrame& at(unsigned) const;
@@ -55,6 +55,8 @@ namespace WebCore {
         ScriptState* state() const { return m_scriptState.get(); }
 
     private:
+        ScriptCallStack(const v8::Arguments& arguments, unsigned skipArgumentCount, String sourceName, int sourceLineNumber);
+    
         ScriptCallFrame m_lastCaller;
         OwnPtr<ScriptState> m_scriptState;
     };
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
index 35a2d73..5b4dbc2 100644
--- a/WebCore/bindings/v8/ScriptController.cpp
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -45,18 +45,21 @@
 #include "EventListener.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "Node.h"
 #include "NotImplemented.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "NPV8Object.h"
 #include "ScriptSourceCode.h"
-#include "Widget.h"
-#include "XSSAuditor.h"
-
+#include "ScriptState.h"
+#include "Settings.h"
 #include "V8Binding.h"
 #include "V8NPObject.h"
 #include "V8Proxy.h"
+#include "Widget.h"
+#include "XSSAuditor.h"
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -295,7 +298,8 @@ bool ScriptController::haveInterpreter() const
 
 bool ScriptController::isEnabled() const
 {
-    return m_proxy->isEnabled();
+    Settings* settings = m_proxy->frame()->settings();
+    return m_proxy->frame()->loader()->client()->allowJavaScript(settings && settings->isJavaScriptEnabled() && !m_frame->loader()->isSandboxed(SandboxScripts));
 }
 
 PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widget)
@@ -362,6 +366,18 @@ void ScriptController::cleanupScriptObjectsForPlugin(Widget* nativeHandle)
     m_pluginObjects.remove(it);
 }
 
+void ScriptController::getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
+{
+    worlds.append(mainThreadNormalWorld());
+}
+
+ScriptState* ScriptController::mainWorldScriptState()
+{
+    if (!m_mainWorldScriptState)
+        m_mainWorldScriptState.set(new ScriptState(m_frame, V8Proxy::mainWorldContext(m_frame)));
+    return m_mainWorldScriptState.get();
+}
+
 static NPObject* createNoScriptObject()
 {
     notImplemented();
@@ -440,10 +456,4 @@ void ScriptController::updateDocument()
     m_proxy->updateDocument();
 }
 
-// FIXME: Stub method so we compile.  Currently called from FrameLoader.cpp.
-DOMWrapperWorld* mainThreadNormalWorld()
-{
-    return 0;
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptController.h b/WebCore/bindings/v8/ScriptController.h
index a958ead..fb7bbee 100644
--- a/WebCore/bindings/v8/ScriptController.h
+++ b/WebCore/bindings/v8/ScriptController.h
@@ -39,6 +39,7 @@
 #include <v8.h>
 
 #include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -47,6 +48,7 @@ namespace WebCore {
     class Frame;
     class HTMLPlugInElement;
     class ScriptSourceCode;
+    class ScriptState;
     class String;
     class Widget;
     class XSSAuditor;
@@ -165,6 +167,13 @@ namespace WebCore {
         NPObject* windowScriptNPObject();
 #endif
 
+        // Dummy method to avoid a bunch of ifdef's in WebCore.
+        void evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*) { }
+        static void getAllWorlds(Vector<DOMWrapperWorld*>& worlds);
+
+        // Script state for the main world context.
+        ScriptState* mainWorldScriptState();
+
     private:
         Frame* m_frame;
         const String* m_sourceURL;
@@ -187,9 +196,10 @@ namespace WebCore {
 #endif
         // The XSSAuditor associated with this ScriptController.
         OwnPtr<XSSAuditor> m_XSSAuditor;
-    };
 
-    DOMWrapperWorld* mainThreadNormalWorld();
+        // Script state for the main world context.
+        OwnPtr<ScriptState> m_mainWorldScriptState;
+    };
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/v8/ScriptEventListener.cpp b/WebCore/bindings/v8/ScriptEventListener.cpp
index 03713be..51d53ab 100644
--- a/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -68,7 +68,7 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribu
         sourceURL = node->document()->url().string();
     }
 
-    return V8LazyEventListener::create(attr->localName().string(), node->isSVGElement(), attr->value(), sourceURL, lineNumber, columnNumber);
+    return V8LazyEventListener::create(attr->localName().string(), node->isSVGElement(), attr->value(), sourceURL, lineNumber, columnNumber, WorldContextHandle(UseMainWorld));
 }
 
 PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -95,7 +95,7 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
         columnNumber = frame->document()->tokenizer()->columnNumber();
     }
     sourceURL = frame->document()->url().string();
-    return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, lineNumber, columnNumber);
+    return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, lineNumber, columnNumber, WorldContextHandle(UseMainWorld));
 }
 
 String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* listener)
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.cpp b/WebCore/bindings/v8/ScriptFunctionCall.cpp
index 9ff6b8c..a232acd 100644
--- a/WebCore/bindings/v8/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/v8/ScriptFunctionCall.cpp
@@ -74,6 +74,18 @@ void ScriptFunctionCall::appendArgument(const String& argument)
     m_arguments.append(v8String(argument));
 }
 
+void ScriptFunctionCall::appendArgument(const char* argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8String(argument));
+}
+
+void ScriptFunctionCall::appendArgument(long argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8::Number::New(argument));
+}
+
 void ScriptFunctionCall::appendArgument(long long argument)
 {
     ScriptScope scope(m_scriptState);
@@ -86,6 +98,12 @@ void ScriptFunctionCall::appendArgument(unsigned int argument)
     m_arguments.append(v8::Number::New(argument));
 }
 
+void ScriptFunctionCall::appendArgument(unsigned long argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8::Number::New(argument));
+}
+
 void ScriptFunctionCall::appendArgument(int argument)
 {
     ScriptScope scope(m_scriptState);
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.h b/WebCore/bindings/v8/ScriptFunctionCall.h
index 8365a4e..6203402 100644
--- a/WebCore/bindings/v8/ScriptFunctionCall.h
+++ b/WebCore/bindings/v8/ScriptFunctionCall.h
@@ -50,8 +50,11 @@ namespace WebCore {
         void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
+        void appendArgument(const char*);
+        void appendArgument(long);
         void appendArgument(long long);
         void appendArgument(unsigned int);
+        void appendArgument(unsigned long);
         void appendArgument(int);
         void appendArgument(bool);
         ScriptValue call(bool& hadException, bool reportExceptions = true);
diff --git a/WebCore/bindings/v8/ScriptObject.cpp b/WebCore/bindings/v8/ScriptObject.cpp
index ac8051d..5f5609c 100644
--- a/WebCore/bindings/v8/ScriptObject.cpp
+++ b/WebCore/bindings/v8/ScriptObject.cpp
@@ -36,6 +36,8 @@
 
 #include "Document.h"
 #include "Frame.h"
+#include "InspectorBackend.h"
+#include "InspectorFrontendHost.h"
 #include "V8Binding.h"
 #include "V8Proxy.h"
 
@@ -83,6 +85,13 @@ bool ScriptObject::set(const char* name, double value)
     return scope.success();
 }
 
+bool ScriptObject::set(const char* name, long value)
+{
+    ScriptScope scope(m_scriptState);
+    v8Object()->Set(v8::String::New(name), v8::Number::New(value));
+    return scope.success();
+}
+
 bool ScriptObject::set(const char* name, long long value)
 {
     ScriptScope scope(m_scriptState);
@@ -104,6 +113,13 @@ bool ScriptObject::set(const char* name, unsigned value)
     return scope.success();
 }
 
+bool ScriptObject::set(const char* name, unsigned long value)
+{
+    ScriptScope scope(m_scriptState);
+    v8Object()->Set(v8::String::New(name), v8::Number::New(value));
+    return scope.success();
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     ScriptScope scope(m_scriptState);
@@ -124,6 +140,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const S
     return scope.success();
 }
 
+#if ENABLE(INSPECTOR)
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorBackend* value)
 {
     ScriptScope scope(scriptState);
@@ -133,6 +150,21 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     return scope.success();
 }
 
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorFrontendHost* value)
+{
+    ScriptScope scope(scriptState);
+    scope.global()->Set(v8::String::New(name), V8DOMWrapper::convertToV8Object(V8ClassIndex::INSPECTORFRONTENDHOST, value));
+    return scope.success();
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InjectedScriptHost* value)
+{
+    ScriptScope scope(scriptState);
+    scope.global()->Set(v8::String::New(name), V8DOMWrapper::convertToV8Object(V8ClassIndex::INJECTEDSCRIPTHOST, value));
+    return scope.success();
+}
+#endif
+
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
 {
     ScriptScope scope(scriptState);
diff --git a/WebCore/bindings/v8/ScriptObject.h b/WebCore/bindings/v8/ScriptObject.h
index f741f89..630d3b9 100644
--- a/WebCore/bindings/v8/ScriptObject.h
+++ b/WebCore/bindings/v8/ScriptObject.h
@@ -36,7 +36,9 @@
 #include <v8.h>
 
 namespace WebCore {
+    class InjectedScriptHost;
     class InspectorBackend;
+    class InspectorFrontendHost;
     class ScriptState;
 
     class ScriptObject : public ScriptValue {
@@ -51,9 +53,11 @@ namespace WebCore {
         bool set(const char* name, const ScriptObject&);
         bool set(const char* name, const String&);
         bool set(const char* name, double);
+        bool set(const char* name, long);
         bool set(const char* name, long long);
         bool set(const char* name, int);
         bool set(const char* name, unsigned);
+        bool set(const char* name, unsigned long);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -65,6 +69,8 @@ namespace WebCore {
     public:
         static bool set(ScriptState*, const char* name, const ScriptObject&);
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+        static bool set(ScriptState*, const char* name, InspectorFrontendHost*);
+        static bool set(ScriptState*, const char* name, InjectedScriptHost*);
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
     private:
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
deleted file mode 100644
index 6528c9d..0000000
--- a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptObjectQuarantine.h"
-
-#include "Database.h"
-#include "Document.h"
-#include "DOMWindow.h"
-#include "Frame.h"
-#include "InspectorController.h"
-#include "Page.h"
-#include "ScriptObject.h"
-#include "ScriptValue.h"
-#include "Storage.h"
-
-#include "V8Binding.h"
-#include "V8Proxy.h"
-
-#include <v8.h>
-
-namespace WebCore {
-
-ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
-{
-    return value;
-}
-
-bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
-{
-    ASSERT(database);
-
-#if ENABLE(DATABASE)
-    v8::HandleScope handleScope;
-    Frame* frame = database->document()->frame();
-    if (!frame)
-        return false;
-
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
-    if (context.IsEmpty())
-        return false;
-
-    v8::Context::Scope scope(context);
-    v8::Handle<v8::Value> v8Database = V8DOMWrapper::convertToV8Object(V8ClassIndex::DATABASE, database);
-    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
-    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Database)));
-#else
-    ASSERT_NOT_REACHED();
-    quarantinedObject = ScriptObject();
-#endif
-    return true;
-}
-
-bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
-{
-    ASSERT(storage);
-    Frame* frame = storage->frame();
-    ASSERT(frame);
-
-#if ENABLE(DOM_STORAGE)
-    v8::HandleScope handleScope;
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
-    if (context.IsEmpty())
-        return false;
-
-    v8::Context::Scope scope(context);
-
-    v8::Handle<v8::Value> v8Storage = V8DOMWrapper::convertToV8Object(V8ClassIndex::STORAGE, storage);
-    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
-    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Storage)));
-#else
-    ASSERT_NOT_REACHED();
-    quarantinedObject = ScriptObject();
-#endif
-    return true;
-}
-
-bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
-{
-    ASSERT(node);
-
-    v8::HandleScope handleScope;
-    // FIXME: What if document() is null?
-    // FIXME: Why are we grabbing the mainFrame?
-    Frame* frame = node->document()->page()->mainFrame();
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
-    // FIXME: What if context.IsEmpty()?
-    v8::Context::Scope scope(context);
-
-    v8::Handle<v8::Value> v8Node = V8DOMWrapper::convertNodeToV8Object(node);
-    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
-    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Node)));
-
-    return true;
-}
-
-bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
-{
-    ASSERT(domWindow);
-
-    v8::HandleScope handleScope;
-    Frame* frame = domWindow->frame();
-    // FIXME: What if frame is null?
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
-    // FIXME: What if context.IsEmpty()?
-    v8::Context::Scope scope(context);
-
-    v8::Handle<v8::Value> v8DomWindow = V8DOMWrapper::convertToV8Object(V8ClassIndex::DOMWINDOW, domWindow);
-    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
-    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8DomWindow)));
-
-    return true;
-}
-
-
-} // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptState.cpp b/WebCore/bindings/v8/ScriptState.cpp
index 99557b5..68593e7 100644
--- a/WebCore/bindings/v8/ScriptState.cpp
+++ b/WebCore/bindings/v8/ScriptState.cpp
@@ -37,6 +37,7 @@
 #include "ScriptController.h"
 
 #include <wtf/Assertions.h>
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -58,7 +59,7 @@ ScriptState::~ScriptState()
     m_context.Clear();
 }
 
-ScriptState* scriptStateFromNode(Node* node)
+ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node* node)
 {
     // This should be never reached with V8 bindings (WebKit only uses it
     // for non-JS bindings)
@@ -66,11 +67,17 @@ ScriptState* scriptStateFromNode(Node* node)
     return 0;
 }
 
-ScriptState* scriptStateFromPage(Page* page)
+ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page* page)
 {
-    // This should be never reached with V8 bindings.
-    ASSERT_NOT_REACHED();
-    return 0;
+    // This should be only reached with V8 bindings from single process layout tests.
+    return page->mainFrame()->script()->mainWorldScriptState();
+}
+
+// FIXME: Stub method so we compile.  Currently called from FrameLoader.cpp.
+DOMWrapperWorld* mainThreadNormalWorld()
+{
+    DEFINE_STATIC_LOCAL(DOMWrapperWorld, oneWorld, ());
+    return &oneWorld;
 }
 
 }
diff --git a/WebCore/bindings/v8/ScriptState.h b/WebCore/bindings/v8/ScriptState.h
index e44e914..12a1388 100644
--- a/WebCore/bindings/v8/ScriptState.h
+++ b/WebCore/bindings/v8/ScriptState.h
@@ -33,8 +33,10 @@
 
 #include <v8.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
+    class DOMWrapperWorld;
     class Node;
     class Page;
     class Frame;
@@ -65,8 +67,17 @@ namespace WebCore {
         v8::Persistent<v8::Context> m_context;
     };
 
-    ScriptState* scriptStateFromNode(Node*);
-    ScriptState* scriptStateFromPage(Page*);
+    ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node*);
+    ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page*);
+
+    DOMWrapperWorld* mainThreadNormalWorld();
+    inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
+    inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
+
+    // Dummy class to avoid a bunch of ifdef's in WebCore.
+    class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
+    };
+
 }
 
 #endif // ScriptState_h
diff --git a/WebCore/bindings/v8/ScriptValue.h b/WebCore/bindings/v8/ScriptValue.h
index a429593..c0ba8d5 100644
--- a/WebCore/bindings/v8/ScriptValue.h
+++ b/WebCore/bindings/v8/ScriptValue.h
@@ -44,6 +44,11 @@ namespace WebCore {
 
 class ScriptValue {
 public:
+    static ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
+    {
+        return value;
+    }
+
     ScriptValue() {}
 
     ScriptValue(v8::Handle<v8::Value> value) 
@@ -139,6 +144,7 @@ public:
     }
 
     v8::Handle<v8::Value> v8Value() const { return m_value; }
+    bool getString(ScriptState*, String& result) const { return getString(result); }
     bool getString(String& result) const;
     String toString(ScriptState*) const;
 
diff --git a/WebCore/bindings/v8/SharedPersistent.h b/WebCore/bindings/v8/SharedPersistent.h
index c1232ae..8825bd5 100644
--- a/WebCore/bindings/v8/SharedPersistent.h
+++ b/WebCore/bindings/v8/SharedPersistent.h
@@ -32,6 +32,8 @@
 #define SharedPersistent_h
 
 #include <v8.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -40,7 +42,7 @@ namespace WebCore {
     // object and when it should no longer be accessible the object's
     // owner can clear it.
     template <typename T>
-    class SharedPersistent : public WTF::RefCounted<SharedPersistent<T> > {
+    class SharedPersistent : public RefCounted<SharedPersistent<T> > {
     public:
         void set(v8::Persistent<T> value)
         {
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.cpp b/WebCore/bindings/v8/V8AbstractEventListener.cpp
index f27c619..0f5b5c8 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -50,11 +50,11 @@ static void weakEventListenerCallback(v8::Persistent<v8::Value>, void* parameter
     listener->disposeListenerObject();
 }
 
-V8AbstractEventListener::V8AbstractEventListener(PassRefPtr<V8ListenerGuard> guard, bool isAttribute)
+V8AbstractEventListener::V8AbstractEventListener(bool isAttribute, const WorldContextHandle& worldContext)
     : EventListener(JSEventListenerType)
     , m_isWeak(true)
     , m_isAttribute(isAttribute)
-    , m_guard(guard)
+    , m_worldContext(worldContext)
 {
 }
 
@@ -70,17 +70,13 @@ V8AbstractEventListener::~V8AbstractEventListener()
 
 void V8AbstractEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
 {
-    // EventListener could be disconnected from the frame.
-    if (disconnected())
-        return;
-
     // The callback function on XMLHttpRequest can clear the event listener and destroys 'this' object. Keep a local reference to it.
     // See issue 889829.
     RefPtr<V8AbstractEventListener> protect(this);
 
     v8::HandleScope handleScope;
 
-    v8::Local<v8::Context> v8Context = toV8Context(context);
+    v8::Local<v8::Context> v8Context = toV8Context(context, worldContext());
     if (v8Context.IsEmpty())
         return;
 
@@ -120,7 +116,7 @@ void V8AbstractEventListener::setListenerObject(v8::Handle<v8::Object> listener)
 void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context, Event* event, v8::Handle<v8::Value> jsEvent)
 {
 
-    v8::Local<v8::Context> v8Context = toV8Context(context);
+    v8::Local<v8::Context> v8Context = toV8Context(context, worldContext());
     if (v8Context.IsEmpty())
         return;
 
@@ -146,7 +142,6 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
         tryCatch.Reset();
 
         // Call the event handler.
-        tryCatch.SetVerbose(false); // We do not want to report the exception to the inspector console.
         returnValue = callListenerFunction(context, jsEvent, event);
         if (!tryCatch.CanContinue())
             return;
@@ -158,7 +153,6 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
         }
 
         // Restore the old event. This must be done for all exit paths through this method.
-        tryCatch.SetVerbose(true);
         if (savedEvent.IsEmpty())
             v8Context->Global()->SetHiddenValue(eventSymbol, v8::Undefined());
         else
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.h b/WebCore/bindings/v8/V8AbstractEventListener.h
index ceff001..0afbed5 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.h
+++ b/WebCore/bindings/v8/V8AbstractEventListener.h
@@ -32,8 +32,8 @@
 #define V8AbstractEventListener_h
 
 #include "EventListener.h"
-#include "OwnHandle.h"
-#include "SharedPersistent.h"
+#include "WorldContextHandle.h"
+
 #include <v8.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -44,29 +44,6 @@ namespace WebCore {
     class Frame;
     class V8Proxy;
 
-    // Shared by listener objects and V8Proxy so that V8Proxy can
-    // silence listeners when needed.
-    class V8ListenerGuard : public RefCounted<V8ListenerGuard> {
-      public:
-        static PassRefPtr<V8ListenerGuard> create()
-        {
-            return adoptRef(new V8ListenerGuard);
-        }
-
-        bool isDisconnected() const { return m_disconnected; }
-
-        void disconnectListeners()
-        {
-            m_disconnected = true;
-        }
-
-      private:
-        V8ListenerGuard()
-            : m_disconnected(false) { }
-
-        bool m_disconnected;
-    };
-
     // There are two kinds of event listeners: HTML or non-HMTL. onload,
     // onfocus, etc (attributes) are always HTML event handler type; Event
     // listeners added by Window.addEventListener or
@@ -119,10 +96,8 @@ namespace WebCore {
         // Dispose listener object and clear the handle.
         void disposeListenerObject();
 
-        virtual bool disconnected() const { return m_guard && m_guard->isDisconnected(); }
-
     protected:
-        V8AbstractEventListener(PassRefPtr<V8ListenerGuard>, bool isAttribute);
+        V8AbstractEventListener(bool isAttribute, const WorldContextHandle& worldContext);
 
         virtual void prepareListenerObject(ScriptExecutionContext*) { }
 
@@ -132,6 +107,9 @@ namespace WebCore {
 
         // Get the receiver object to use for event listener call.
         v8::Local<v8::Object> getReceiverObject(Event*);
+
+        const WorldContextHandle& worldContext() const { return m_worldContext; }
+
     private:
         // Implementation of EventListener function.
         virtual bool virtualisAttribute() const { return m_isAttribute; }
@@ -146,7 +124,7 @@ namespace WebCore {
         // Indicates if this is an HTML type listener.
         bool m_isAttribute;
 
-        RefPtr<V8ListenerGuard> m_guard;
+        WorldContextHandle m_worldContext;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Binding.cpp b/WebCore/bindings/v8/V8Binding.cpp
index 9ac7eae..00286e5 100644
--- a/WebCore/bindings/v8/V8Binding.cpp
+++ b/WebCore/bindings/v8/V8Binding.cpp
@@ -33,8 +33,10 @@
 
 #include "AtomicString.h"
 #include "CString.h"
+#include "Element.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
+#include "QualifiedName.h"
 #include "StdLibExtras.h"
 #include "StringBuffer.h"
 #include "StringHash.h"
@@ -104,10 +106,6 @@ public:
         return m_atomicString;
     }
 
-    // Returns right string type based on a dummy parameter.
-    String string(String) { return webcoreString(); }
-    AtomicString string(AtomicString) { return atomicString(); }
-
     static WebCoreStringResource* toStringResource(v8::Handle<v8::String> v8String)
     {
         return static_cast<WebCoreStringResource*>(v8String->GetExternalStringResource());
@@ -128,17 +126,177 @@ private:
 #endif
 };
 
-enum ExternalMode {
-    Externalize,
-    DoNotExternalize
+
+void* v8DOMWrapperToNative(v8::Handle<v8::Object> object) {
+    return object->GetPointerFromInternalField(V8Custom::kDOMWrapperObjectIndex);
+}
+    
+void* v8DOMWrapperToNative(const v8::AccessorInfo& info) {
+    return info.Holder()->GetPointerFromInternalField(V8Custom::kDOMWrapperObjectIndex);
+}
+    
+
+String v8ValueToWebCoreString(v8::Handle<v8::Value> value)
+{
+    if (value->IsString())
+        return v8StringToWebCoreString(v8::Handle<v8::String>::Cast(value));
+    return v8NonStringValueToWebCoreString(value);
+}
+
+AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value)
+{
+    if (value->IsString())
+        return v8StringToAtomicWebCoreString(v8::Handle<v8::String>::Cast(value));
+    return v8NonStringValueToAtomicWebCoreString(value);
+}
+
+int toInt32(v8::Handle<v8::Value> value, bool& ok)
+{
+    ok = true;
+    
+    // Fast case.  The value is already a 32-bit integer.
+    if (value->IsInt32())
+        return value->Int32Value();
+    
+    // Can the value be converted to a number?
+    v8::Local<v8::Number> numberObject = value->ToNumber();
+    if (numberObject.IsEmpty()) {
+        ok = false;
+        return 0;
+    }
+    
+    // Does the value convert to nan or to an infinity?
+    double numberValue = numberObject->Value();
+    if (isnan(numberValue) || isinf(numberValue)) {
+        ok = false;
+        return 0;
+    }
+    
+    // Can the value be converted to a 32-bit integer?
+    v8::Local<v8::Int32> intValue = value->ToInt32();
+    if (intValue.IsEmpty()) {
+        ok = false;
+        return 0;
+    }
+    
+    // Return the result of the int32 conversion.
+    return intValue->Value();
+}
+    
+String toWebCoreString(const v8::Arguments& args, int index) {
+    return v8ValueToWebCoreString(args[index]);
+}
+
+    
+String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+{
+    if (value->IsNull()) 
+        return String();
+    return v8ValueToWebCoreString(value);
+}
+
+AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+{
+    if (value->IsNull())
+        return AtomicString();
+    return v8ValueToAtomicWebCoreString(value);
+}
+
+String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
+{
+    if (value->IsNull() || value->IsUndefined())
+        return String();
+    return toWebCoreString(value);
+}
+
+bool isUndefinedOrNull(v8::Handle<v8::Value> value)
+{
+    return value->IsNull() || value->IsUndefined();
+}
+
+v8::Handle<v8::Boolean> v8Boolean(bool value)
+{
+    return value ? v8::True() : v8::False();
+}
+
+v8::Handle<v8::String> v8UndetectableString(const String& str)
+{
+    return v8::String::NewUndetectable(fromWebCoreString(str), str.length());
+}
+
+v8::Handle<v8::Value> v8StringOrNull(const String& str)
+{
+    return str.isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(v8String(str));
+}
+
+v8::Handle<v8::Value> v8StringOrUndefined(const String& str)
+{
+    return str.isNull() ? v8::Handle<v8::Value>(v8::Undefined()) : v8::Handle<v8::Value>(v8String(str));
+}
+
+v8::Handle<v8::Value> v8StringOrFalse(const String& str)
+{
+    return str.isNull() ? v8::Handle<v8::Value>(v8::False()) : v8::Handle<v8::Value>(v8String(str));
+}
+
+
+template <class S> struct StringTraits
+{
+    static S fromStringResource(WebCoreStringResource* resource);
+
+    static S fromV8String(v8::Handle<v8::String> v8String, int length);
+};
+
+template<>
+struct StringTraits<String>
+{
+    static String fromStringResource(WebCoreStringResource* resource)
+    {
+        return resource->webcoreString();
+    }
+
+    static String fromV8String(v8::Handle<v8::String> v8String, int length)
+    {
+        ASSERT(v8String->Length() == length);
+        // NOTE: as of now, String(const UChar*, int) performs String::createUninitialized
+        // anyway, so no need to optimize like we do for AtomicString below.
+        UChar* buffer;
+        String result = String::createUninitialized(length, buffer);
+        v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
+        return result;
+    }
+};
+
+template<>
+struct StringTraits<AtomicString>
+{
+    static AtomicString fromStringResource(WebCoreStringResource* resource)
+    {
+        return resource->atomicString();
+    }
+
+    static AtomicString fromV8String(v8::Handle<v8::String> v8String, int length)
+    {
+        ASSERT(v8String->Length() == length);
+        static const int inlineBufferSize = 16;
+        if (length <= inlineBufferSize) {
+            UChar inlineBuffer[inlineBufferSize];
+            v8String->Write(reinterpret_cast<uint16_t*>(inlineBuffer), 0, length);
+            return AtomicString(inlineBuffer, length);
+        }
+        UChar* buffer;
+        String tmp = String::createUninitialized(length, buffer);
+        v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
+        return AtomicString(tmp);
+    }
 };
 
 template <typename StringType>
-static StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external)
+StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external)
 {
     WebCoreStringResource* stringResource = WebCoreStringResource::toStringResource(v8String);
     if (stringResource)
-        return stringResource->string(StringType());
+        return StringTraits<StringType>::fromStringResource(stringResource);
 
     int length = v8String->Length();
     if (!length) {
@@ -146,18 +304,7 @@ static StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, Exter
         return StringImpl::empty();
     }
 
-    StringType result;
-    static const int inlineBufferSize = 16;
-    if (length <= inlineBufferSize) {
-        UChar inlineBuffer[inlineBufferSize];
-        v8String->Write(reinterpret_cast<uint16_t*>(inlineBuffer), 0, length);
-        result = StringType(inlineBuffer, length);
-    } else {
-        UChar* buffer;
-        String tmp = String::createUninitialized(length, buffer);
-        v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
-        result = StringType(tmp);
-    }
+    StringType result(StringTraits<StringType>::fromV8String(v8String, length));
 
     if (external == Externalize && v8String->CanMakeExternal()) {
         stringResource = new WebCoreStringResource(result);
@@ -168,16 +315,12 @@ static StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, Exter
     }
     return result;
 }
+    
+// Explicitly instantiate the above template with the expected parameterizations,
+// to ensure the compiler generates the code; otherwise link errors can result in GCC 4.4.
+template String v8StringToWebCoreString<String>(v8::Handle<v8::String>, ExternalMode);
+template AtomicString v8StringToWebCoreString<AtomicString>(v8::Handle<v8::String>, ExternalMode);
 
-String v8StringToWebCoreString(v8::Handle<v8::String> v8String)
-{
-    return v8StringToWebCoreString<String>(v8String, Externalize);
-}
-
-AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String> v8String)
-{
-    return v8StringToWebCoreString<AtomicString>(v8String, Externalize);
-}
 
 String v8NonStringValueToWebCoreString(v8::Handle<v8::Value> object)
 {
@@ -254,13 +397,13 @@ static void cachedStringCallback(v8::Persistent<v8::Value> wrapper, void* parame
 
 v8::Local<v8::String> v8ExternalString(const String& string)
 {
-    if (!string.length())
+    StringImpl* stringImpl = string.impl();
+    if (!stringImpl || !stringImpl->length())
         return v8::String::Empty();
 
     if (!stringImplCacheEnabled)
         return makeExternalString(string);
 
-    StringImpl* stringImpl = string.impl();
     StringCache& stringCache = getStringCache();
     v8::String* cachedV8String = stringCache.get(stringImpl);
     if (cachedV8String)
@@ -280,5 +423,65 @@ v8::Local<v8::String> v8ExternalString(const String& string)
 
     return newString;
 }
+    
+v8::Persistent<v8::FunctionTemplate> createRawTemplate()
+{
+    v8::HandleScope scope;
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::checkNewLegal);
+    return v8::Persistent<v8::FunctionTemplate>::New(result);
+}        
+
+v8::Local<v8::Signature> configureTemplate(v8::Persistent<v8::FunctionTemplate>desc,
+                                           const char *interfaceName,
+                                           V8ClassIndex::V8WrapperType parentClassIndex,
+                                           int fieldCount,
+                                           const BatchedAttribute* attributes, 
+                                           size_t attributeCount,
+                                           const BatchedCallback* callbacks,
+                                           size_t callbackCount)
+{
+    desc->SetClassName(v8::String::New(interfaceName));
+    v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
+    instance->SetInternalFieldCount(fieldCount);
+    if (parentClassIndex)
+        desc->Inherit(V8DOMWrapper::getTemplate(parentClassIndex));
+    if (attributeCount)
+        batchConfigureAttributes(instance, desc->PrototypeTemplate(),
+                                 attributes, attributeCount);
+    v8::Local<v8::Signature> defaultSignature = v8::Signature::New(desc);
+    if (callbackCount)
+        batchConfigureCallbacks(desc->PrototypeTemplate(),
+                                defaultSignature,
+                                static_cast<v8::PropertyAttribute>(v8::DontDelete),
+                                callbacks, callbackCount);
+    return defaultSignature;
+}
+
+void createCallback(v8::Local<v8::ObjectTemplate> proto,
+                    const char *name,
+                    v8::InvocationCallback callback,
+                    v8::Handle<v8::Signature> signature,
+                    v8::PropertyAttribute attribute)
+{
+    proto->Set(v8::String::New(name),
+               v8::FunctionTemplate::New(callback, v8::Handle<v8::Value>(), signature),
+               attribute);
+}
+    
+v8::Handle<v8::Value> getElementStringAttr(const v8::AccessorInfo& info,
+                                           const QualifiedName& name) 
+{
+    Element *imp = v8DOMWrapperToNode<Element>(info);
+    return v8ExternalString(imp->getAttribute(name));
+}
+
+void setElementStringAttr(const v8::AccessorInfo& info,
+                          const QualifiedName& name,
+                          v8::Local<v8::Value> value)
+{
+    Element* imp = v8DOMWrapperToNode<Element>(info);
+    AtomicString v = toAtomicWebCoreStringWithNullCheck(value);
+    imp->setAttribute(name, v);
+}
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Binding.h b/WebCore/bindings/v8/V8Binding.h
index 237bc4d..de5bb4c 100644
--- a/WebCore/bindings/v8/V8Binding.h
+++ b/WebCore/bindings/v8/V8Binding.h
@@ -34,37 +34,107 @@
 #include "AtomicString.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
+#include "V8DOMWrapper.h"
+#include "V8Index.h"
 
 #include <v8.h>
 
 namespace WebCore {
+    
+    class EventListener;
+    class EventTarget;
+    
+    // A helper function extract native object pointer from a DOM wrapper
+    // and cast to the specified type.
+    void* v8DOMWrapperToNative(v8::Handle<v8::Object>);
+    
+    template <class C>
+    C* v8DOMWrapperTo(v8::Handle<v8::Object> object)
+    {
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(object));
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(object));
+    }
+    template <class C>
+    C* v8DOMWrapperToNode(v8::Handle<v8::Object> object)
+    {
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(object));
+        ASSERT(V8DOMWrapper::domWrapperType(object) == V8ClassIndex::NODE);
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(object));
+    }
+    
+    void* v8DOMWrapperToNative(const v8::AccessorInfo&);
+    
+    template <class C>
+    C* v8DOMWrapperTo(const v8::AccessorInfo& info) {
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(info.Holder()));
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(info));
+    }
+    template <class C>
+    C* v8DOMWrapperToNode(const v8::AccessorInfo& info) {
+        ASSERT(V8DOMWrapper::domWrapperType(info.Holder()) == V8ClassIndex::NODE);
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(info));
+    }
+    
+    template <class C>
+    C* v8DOMWrapperTo(V8ClassIndex::V8WrapperType type, v8::Handle<v8::Object> object)
+    {
+        // Native event listener is per frame, it cannot be handled by this generic function.
+        ASSERT(type != V8ClassIndex::EVENTLISTENER);
+        ASSERT(type != V8ClassIndex::EVENTTARGET);
+        
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(object));
+        
+#ifndef NDEBUG
+        const bool typeIsValid =
+#define MAKE_CASE(TYPE, NAME) (type != V8ClassIndex::TYPE) &&
+        DOM_NODE_TYPES(MAKE_CASE)
+#if ENABLE(SVG)
+        SVG_NODE_TYPES(MAKE_CASE)
+#endif
+#undef MAKE_CASE
+        true;
+        ASSERT(typeIsValid);
+#endif
+        
+        return v8DOMWrapperTo<C>(object);
+    }
+    
+    template <class C>
+    C* v8DOMWrapperTo(V8ClassIndex::V8WrapperType type, const v8::AccessorInfo& info)
+    {
+#ifndef NDEBUG
+        return v8DOMWrapperTo<C>(type, info.Holder());
+#else
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(info));
+#endif
+    }
+
+    
+    enum ExternalMode {
+        Externalize,
+        DoNotExternalize
+    };
+    
+    template <typename StringType>
+    StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external);
 
     // Convert v8 types to a WebCore::String. If the V8 string is not already
     // an external string then it is transformed into an external string at this
     // point to avoid repeated conversions.
-    String v8StringToWebCoreString(v8::Handle<v8::String>);
-    String v8NonStringValueToWebCoreString(v8::Handle<v8::Value>);
-    inline String v8ValueToWebCoreString(v8::Handle<v8::Value> value)
+    inline String v8StringToWebCoreString(v8::Handle<v8::String> v8String)
     {
-        if (value->IsString())
-            return v8StringToWebCoreString(v8::Handle<v8::String>::Cast(value));
-        return v8NonStringValueToWebCoreString(value);
+        return v8StringToWebCoreString<String>(v8String, Externalize);
     }
+    String v8NonStringValueToWebCoreString(v8::Handle<v8::Value>);
+    String v8ValueToWebCoreString(v8::Handle<v8::Value> value);
 
     // Convert v8 types to a WebCore::AtomicString.
-    AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String>);
-    AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value>);
-    inline AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value)
-    {
-        if (value->IsString())
-            return v8StringToAtomicWebCoreString(v8::Handle<v8::String>::Cast(value));
-        return v8NonStringValueToAtomicWebCoreString(value);
-    }
-
-    inline const String& toString(const String& string)
+    inline AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String> v8String)
     {
-        return string;
+        return v8StringToWebCoreString<AtomicString>(v8String, Externalize);
     }
+    AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value>);
+    AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value);
 
     // Return a V8 external string that shares the underlying buffer with the given
     // WebCore string. The reference counting mechanism is used to keep the
@@ -84,38 +154,7 @@ namespace WebCore {
 
     // Convert a value to a 32-bit integer.  The conversion fails if the
     // value cannot be converted to an integer or converts to nan or to an infinity.
-    inline int toInt32(v8::Handle<v8::Value> value, bool& ok)
-    {
-        ok = true;
-
-        // Fast case.  The value is already a 32-bit integer.
-        if (value->IsInt32())
-            return value->Int32Value();
-
-        // Can the value be converted to a number?
-        v8::Local<v8::Number> numberObject = value->ToNumber();
-        if (numberObject.IsEmpty()) {
-            ok = false;
-            return 0;
-        }
-
-        // Does the value convert to nan or to an infinity?
-        double numberValue = numberObject->Value();
-        if (isnan(numberValue) || isinf(numberValue)) {
-            ok = false;
-            return 0;
-        }
-
-        // Can the value be converted to a 32-bit integer?
-        v8::Local<v8::Int32> intValue = value->ToInt32();
-        if (intValue.IsEmpty()) {
-            ok = false;
-            return 0;
-        }
-
-        // Return the result of the int32 conversion.
-        return intValue->Value();
-    }
+    int toInt32(v8::Handle<v8::Value> value, bool& ok);
 
     // Convert a value to a 32-bit integer assuming the conversion cannot fail.
     inline int toInt32(v8::Handle<v8::Value> value)
@@ -134,6 +173,8 @@ namespace WebCore {
     {
         return v8ValueToWebCoreString(object);
     }
+    
+    String toWebCoreString(const v8::Arguments&, int index);
 
     // The string returned by this function is still owned by the argument
     // and will be deallocated when the argument is deallocated.
@@ -142,56 +183,78 @@ namespace WebCore {
         return reinterpret_cast<const uint16_t*>(str.characters());
     }
 
-    inline bool isUndefinedOrNull(v8::Handle<v8::Value> value)
-    {
-        return value->IsNull() || value->IsUndefined();
-    }
+    bool isUndefinedOrNull(v8::Handle<v8::Value> value);
 
-    inline v8::Handle<v8::Boolean> v8Boolean(bool value)
-    {
-        return value ? v8::True() : v8::False();
-    }
+    v8::Handle<v8::Boolean> v8Boolean(bool value);
 
-    inline String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
-    {
-        if (value->IsNull()) 
-            return String();
-        return v8ValueToWebCoreString(value);
-    }
+    String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value);
 
-    inline AtomicString v8ValueToAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
-    {
-        if (value->IsNull())
-            return AtomicString();
-        return v8ValueToAtomicWebCoreString(value);
-    }
+    AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value);
 
-    inline String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
-    {
-        if (value->IsNull() || value->IsUndefined())
-            return String();
-        return toWebCoreString(value);
-    }
+    String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value);
  
-    inline v8::Handle<v8::String> v8UndetectableString(const String& str)
-    {
-        return v8::String::NewUndetectable(fromWebCoreString(str), str.length());
-    }
+    v8::Handle<v8::String> v8UndetectableString(const String& str);
 
-    inline v8::Handle<v8::Value> v8StringOrNull(const String& str)
-    {
-        return str.isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(v8String(str));
-    }
+    v8::Handle<v8::Value> v8StringOrNull(const String& str);
 
-    inline v8::Handle<v8::Value> v8StringOrUndefined(const String& str)
-    {
-        return str.isNull() ? v8::Handle<v8::Value>(v8::Undefined()) : v8::Handle<v8::Value>(v8String(str));
-    }
+    v8::Handle<v8::Value> v8StringOrUndefined(const String& str);
+
+    v8::Handle<v8::Value> v8StringOrFalse(const String& str);
+    
+    v8::Persistent<v8::FunctionTemplate> createRawTemplate();
+
+    struct BatchedAttribute;
+    struct BatchedCallback;
+    
+    v8::Local<v8::Signature> configureTemplate(v8::Persistent<v8::FunctionTemplate>,
+                                               const char *interfaceName,
+                                               V8ClassIndex::V8WrapperType parentClassIndex,
+                                               int fieldCount,
+                                               const BatchedAttribute*, 
+                                               size_t attributeCount,
+                                               const BatchedCallback*,
+                                               size_t callbackCount);
+    
+    void createCallback(v8::Local<v8::ObjectTemplate> proto,
+                        const char *name,
+                        v8::InvocationCallback,
+                        v8::Handle<v8::Signature>,
+                        v8::PropertyAttribute attributes = v8::DontDelete);
+    
+    v8::Handle<v8::Value> getElementStringAttr(const v8::AccessorInfo&,
+                                               const QualifiedName&);
+    void setElementStringAttr(const v8::AccessorInfo&,
+                              const QualifiedName&,
+                              v8::Local<v8::Value>);
+
+    v8::Handle<v8::Value> getElementEventHandlerAttr(const v8::AccessorInfo&,
+                                                     const AtomicString&);
+    
+    // V8Parameter is an adapter class that converts V8 values to Strings
+    // or AtomicStrings as appropriate, using multiple typecast operators.
+    enum V8ParameterMode {
+        DefaultMode,
+        WithNullCheck,
+        WithUndefinedOrNullCheck
+    };
+    template <V8ParameterMode MODE = DefaultMode>
+    class V8Parameter {
+    public:
+        V8Parameter (v8::Local<v8::Value> object) :m_v8Object(object) { }
+        operator String();
+        operator AtomicString();
+    private:
+        v8::Local<v8::Value> m_v8Object;
+    };
+    
+    template<> inline V8Parameter<DefaultMode>::operator String() { return toWebCoreString(m_v8Object); }
+    template<> inline V8Parameter<WithNullCheck>::operator String() { return toWebCoreStringWithNullCheck(m_v8Object); }
+    template<> inline V8Parameter<WithUndefinedOrNullCheck>::operator String() { return toWebCoreStringWithNullOrUndefinedCheck(m_v8Object); }
+
+    template<> inline V8Parameter<DefaultMode>::operator AtomicString() { return v8ValueToAtomicWebCoreString(m_v8Object); }
+    template<> inline V8Parameter<WithNullCheck>::operator AtomicString() { return toAtomicWebCoreStringWithNullCheck(m_v8Object); }
+    template<> inline V8Parameter<WithUndefinedOrNullCheck>::operator AtomicString() { return toAtomicWebCoreStringWithNullCheck(m_v8Object); }
 
-    inline v8::Handle<v8::Value> v8StringOrFalse(const String& str)
-    {
-        return str.isNull() ? v8::Handle<v8::Value>(v8::False()) : v8::Handle<v8::Value>(v8String(str));
-    }
 } // namespace WebCore
 
 #endif // V8Binding_h
diff --git a/WebCore/bindings/v8/V8Collection.h b/WebCore/bindings/v8/V8Collection.h
index e72dc07..0a4134e 100644
--- a/WebCore/bindings/v8/V8Collection.h
+++ b/WebCore/bindings/v8/V8Collection.h
@@ -177,6 +177,18 @@ namespace WebCore {
     }
 
 
+    // A template for indexed getters on collections of strings.
+    template<class Collection> static v8::Handle<v8::Value> collectionStringIndexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info)
+    {
+        // FIXME: assert that object must be a collection type
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(info.Holder()));
+        V8ClassIndex::V8WrapperType wrapperType = V8DOMWrapper::domWrapperType(info.Holder());
+        Collection* collection = V8DOMWrapper::convertToNativeObject<Collection>(wrapperType, info.Holder());
+        String result = collection->item(index);
+        return v8String(result);
+    }
+
+
     // Add indexed getter to the function template for a collection.
     template<class Collection, class ItemType> static void setCollectionIndexedGetter(v8::Handle<v8::FunctionTemplate> desc, V8ClassIndex::V8WrapperType type)
     {
@@ -208,6 +220,13 @@ namespace WebCore {
         desc->InstanceTemplate()->SetIndexedPropertyHandler(collectionStringOrNullIndexedPropertyGetter<Collection>, 0, 0, 0, collectionIndexedPropertyEnumerator<Collection>);
     }
 
+
+    // Add indexed getter returning a string to a function template for a collection.
+    template<class Collection> static void setCollectionStringIndexedGetter(v8::Handle<v8::FunctionTemplate> desc)
+    {
+        desc->InstanceTemplate()->SetIndexedPropertyHandler(collectionStringIndexedPropertyGetter<Collection>, 0, 0, 0, collectionIndexedPropertyEnumerator<Collection>);
+    }
+
     v8::Handle<v8::Value> toOptionsCollectionSetter(uint32_t index, v8::Handle<v8::Value>, HTMLSelectElement*);
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8DOMMap.cpp b/WebCore/bindings/v8/V8DOMMap.cpp
index 1bd68f7..acd88ec 100644
--- a/WebCore/bindings/v8/V8DOMMap.cpp
+++ b/WebCore/bindings/v8/V8DOMMap.cpp
@@ -34,6 +34,7 @@
 #include "DOMData.h"
 #include "DOMDataStore.h"
 #include "DOMObjectsInclude.h"
+#include "MainThreadDOMData.h"
 #include "ScopedDOMDataStore.h"
 
 namespace WebCore {
@@ -47,33 +48,49 @@ DOMDataStoreHandle::~DOMDataStoreHandle()
 {
 }
 
+static bool fasterDOMStoreAccess = false;
+
+static inline DOMDataStore& getDOMDataStore()
+{
+    if (LIKELY(fasterDOMStoreAccess)) {
+        ASSERT(WTF::isMainThread());
+        return MainThreadDOMData::getCurrentMainThreadStore();
+    }
+
+    return DOMData::getCurrent()->getStore();
+}
+
+void enableFasterDOMStoreAccess()
+{
+    fasterDOMStoreAccess = true;
+}
+
 DOMWrapperMap<Node>& getDOMNodeMap()
 {
-    // Nodes only exist on the main thread.
-    return DOMData::getCurrentMainThread()->getStore().domNodeMap();
+    return getDOMDataStore().domNodeMap();
 }
 
 DOMWrapperMap<void>& getDOMObjectMap()
 {
-    return DOMData::getCurrent()->getStore().domObjectMap();
+    return getDOMDataStore().domObjectMap();
 }
 
 DOMWrapperMap<void>& getActiveDOMObjectMap()
 {
-    return DOMData::getCurrent()->getStore().activeDomObjectMap();
+    return getDOMDataStore().activeDomObjectMap();
 }
 
 #if ENABLE(SVG)
 
 DOMWrapperMap<SVGElementInstance>& getDOMSVGElementInstanceMap()
 {
-    return DOMData::getCurrent()->getStore().domSvgElementInstanceMap();
+    return getDOMDataStore().domSvgElementInstanceMap();
 }
 
 // Map of SVG objects with contexts to V8 objects
 DOMWrapperMap<void>& getDOMSVGObjectWithContextMap()
 {
-    return DOMData::getCurrent()->getStore().domSvgObjectWithContextMap();
+    return getDOMDataStore().domSvgObjectWithContextMap();
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/bindings/v8/V8DOMMap.h b/WebCore/bindings/v8/V8DOMMap.h
index 754ac3a..b6861d4 100644
--- a/WebCore/bindings/v8/V8DOMMap.h
+++ b/WebCore/bindings/v8/V8DOMMap.h
@@ -140,6 +140,8 @@ namespace WebCore {
     DOMWrapperMap<void>& getDOMSVGObjectWithContextMap();
     void visitDOMSVGObjectsInCurrentThread(DOMWrapperMap<void>::Visitor*);
 #endif
+
+    void enableFasterDOMStoreAccess();
 } // namespace WebCore
 
 #endif // V8DOMMap_h
diff --git a/WebCore/bindings/v8/V8DOMWrapper.cpp b/WebCore/bindings/v8/V8DOMWrapper.cpp
index 4e41a8c..7ecc29c 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -57,6 +57,8 @@
 #include "V8Index.h"
 #include "V8IsolatedWorld.h"
 #include "V8Proxy.h"
+#include "WebGLArray.h"
+#include "WebGLUniformLocation.h"
 #include "WorkerContextExecutionProxy.h"
 
 #include <algorithm>
@@ -156,11 +158,64 @@ v8::Handle<v8::Value> V8DOMWrapper::convertSVGObjectWithContextToV8Object(V8Clas
 
 #endif
 
+#if ENABLE(3D_CANVAS)
+void V8DOMWrapper::setIndexedPropertiesToExternalArray(v8::Handle<v8::Object> wrapper,
+                                                       int index,
+                                                       void* address,
+                                                       int length)
+{
+    v8::ExternalArrayType array_type = v8::kExternalByteArray;
+    V8ClassIndex::V8WrapperType classIndex = V8ClassIndex::FromInt(index);
+    switch (classIndex) {
+    case V8ClassIndex::WEBGLBYTEARRAY:
+        array_type = v8::kExternalByteArray;
+        break;
+    case V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY:
+        array_type = v8::kExternalUnsignedByteArray;
+        break;
+    case V8ClassIndex::WEBGLSHORTARRAY:
+        array_type = v8::kExternalShortArray;
+        break;
+    case V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY:
+        array_type = v8::kExternalUnsignedShortArray;
+        break;
+    case V8ClassIndex::WEBGLINTARRAY:
+        array_type = v8::kExternalIntArray;
+        break;
+    case V8ClassIndex::WEBGLUNSIGNEDINTARRAY:
+        array_type = v8::kExternalUnsignedIntArray;
+        break;
+    case V8ClassIndex::WEBGLFLOATARRAY:
+        array_type = v8::kExternalFloatArray;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    wrapper->SetIndexedPropertiesToExternalArrayData(address,
+                                                     array_type,
+                                                     length);
+}
+#endif
+
 bool V8DOMWrapper::domObjectHasJSWrapper(void* object)
 {
     return getDOMObjectMap().contains(object) || getActiveDOMObjectMap().contains(object);
 }
 
+v8::Persistent<v8::Object> V8DOMWrapper::jsWrapperForDOMObject(void* object)
+{
+    v8::Persistent<v8::Object> wrapper = getDOMObjectMap().get(object);
+    ASSERT(!wrapper.IsEmpty());
+    return wrapper;
+}
+
+v8::Persistent<v8::Object> V8DOMWrapper::jsWrapperForActiveDOMObject(void* object)
+{
+    v8::Persistent<v8::Object> wrapper = getActiveDOMObjectMap().get(object);
+    ASSERT(!wrapper.IsEmpty());
+    return wrapper;
+}
+
 // The caller must have increased obj's ref count.
 void V8DOMWrapper::setJSWrapperForDOMObject(void* object, v8::Persistent<v8::Object> wrapper)
 {
@@ -228,7 +283,7 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
         // setter. Therefore, the interceptor has to be on the object
         // itself and not on the prototype object.
         descriptor->InstanceTemplate()->SetNamedPropertyHandler( USE_NAMED_PROPERTY_GETTER(CSSStyleDeclaration), USE_NAMED_PROPERTY_SETTER(CSSStyleDeclaration));
-        setCollectionStringOrNullIndexedGetter<CSSStyleDeclaration>(descriptor);
+        setCollectionStringIndexedGetter<CSSStyleDeclaration>(descriptor);
         break;
     case V8ClassIndex::CSSRULELIST:
         setCollectionIndexedGetter<CSSRuleList, CSSRule>(descriptor,  V8ClassIndex::CSSRULE);
@@ -237,7 +292,7 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
         setCollectionIndexedGetter<CSSValueList, CSSValue>(descriptor, V8ClassIndex::CSSVALUE);
         break;
     case V8ClassIndex::CSSVARIABLESDECLARATION:
-        setCollectionStringOrNullIndexedGetter<CSSVariablesDeclaration>(descriptor);
+        setCollectionStringIndexedGetter<CSSVariablesDeclaration>(descriptor);
         break;
     case V8ClassIndex::WEBKITCSSTRANSFORMVALUE:
         setCollectionIndexedGetter<WebKitCSSTransformValue, CSSValue>(descriptor, V8ClassIndex::CSSVALUE);
@@ -319,10 +374,15 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
     case V8ClassIndex::MIMETYPEARRAY:
         setCollectionIndexedAndNamedGetters<MimeTypeArray, MimeType>(descriptor, V8ClassIndex::MIMETYPE);
         break;
-    case V8ClassIndex::NAMEDNODEMAP:
-        descriptor->InstanceTemplate()->SetNamedPropertyHandler(USE_NAMED_PROPERTY_GETTER(NamedNodeMap));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(NamedNodeMap), 0, 0, 0, collectionIndexedPropertyEnumerator<NamedNodeMap>, v8::Integer::New(V8ClassIndex::NODE));
+    case V8ClassIndex::NAMEDNODEMAP: {
+        // We add an extra internal field to hold a reference to the owner node.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        ASSERT(instanceTemplate->InternalFieldCount() == V8Custom::kDefaultWrapperInternalFieldCount);
+        instanceTemplate->SetInternalFieldCount(V8Custom::kNamedNodeMapInternalFieldCount);
+        instanceTemplate->SetNamedPropertyHandler(USE_NAMED_PROPERTY_GETTER(NamedNodeMap));
+        instanceTemplate->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(NamedNodeMap), 0, 0, 0, collectionIndexedPropertyEnumerator<NamedNodeMap>, v8::Integer::New(V8ClassIndex::NODE));
         break;
+    }
 #if ENABLE(DOM_STORAGE)
     case V8ClassIndex::STORAGE:
         descriptor->InstanceTemplate()->SetNamedPropertyHandler(USE_NAMED_PROPERTY_GETTER(Storage), USE_NAMED_PROPERTY_SETTER(Storage), 0, USE_NAMED_PROPERTY_DELETER(Storage), V8Custom::v8StorageNamedPropertyEnumerator);
@@ -474,36 +534,29 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
 
 #if ENABLE(3D_CANVAS)
     // The following objects are created from JavaScript.
-    case V8ClassIndex::CANVASARRAYBUFFER:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasArrayBufferConstructor));
+    case V8ClassIndex::WEBGLARRAYBUFFER:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLArrayBufferConstructor));
         break;
-    case V8ClassIndex::CANVASBYTEARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasByteArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasByteArray), USE_INDEXED_PROPERTY_SETTER(CanvasByteArray));
+    case V8ClassIndex::WEBGLBYTEARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLByteArrayConstructor));
         break;
-    case V8ClassIndex::CANVASFLOATARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasFloatArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasFloatArray), USE_INDEXED_PROPERTY_SETTER(CanvasFloatArray));
+    case V8ClassIndex::WEBGLFLOATARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLFloatArrayConstructor));
         break;
-    case V8ClassIndex::CANVASINTARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasIntArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasIntArray), USE_INDEXED_PROPERTY_SETTER(CanvasIntArray));
+    case V8ClassIndex::WEBGLINTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLIntArrayConstructor));
         break;
-    case V8ClassIndex::CANVASSHORTARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasShortArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasShortArray), USE_INDEXED_PROPERTY_SETTER(CanvasShortArray));
+    case V8ClassIndex::WEBGLSHORTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLShortArrayConstructor));
         break;
-    case V8ClassIndex::CANVASUNSIGNEDBYTEARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedByteArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray));
+    case V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLUnsignedByteArrayConstructor));
         break;
-    case V8ClassIndex::CANVASUNSIGNEDINTARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedIntArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray));
+    case V8ClassIndex::WEBGLUNSIGNEDINTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLUnsignedIntArrayConstructor));
         break;
-    case V8ClassIndex::CANVASUNSIGNEDSHORTARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedShortArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray));
+    case V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLUnsignedShortArrayConstructor));
         break;
 #endif
     case V8ClassIndex::DOMPARSER:
@@ -670,6 +723,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertToV8Object(V8ClassIndex::V8WrapperTyp
         return convertStyleSheetToV8Object(static_cast<StyleSheet*>(impl));
     case V8ClassIndex::DOMWINDOW:
         return convertWindowToV8Object(static_cast<DOMWindow*>(impl));
+    case V8ClassIndex::NAMEDNODEMAP:
+        return convertNamedNodeMapToV8Object(static_cast<NamedNodeMap*>(impl));
 #if ENABLE(SVG)
         SVG_NONNODE_TYPES(MAKE_CASE)
         if (type == V8ClassIndex::SVGELEMENTINSTANCE)
@@ -692,6 +747,27 @@ v8::Handle<v8::Value> V8DOMWrapper::convertToV8Object(V8ClassIndex::V8WrapperTyp
     // Non DOM node
     v8::Persistent<v8::Object> result = isActiveDomObject ? getActiveDOMObjectMap().get(impl) : getDOMObjectMap().get(impl);
     if (result.IsEmpty()) {
+#if ENABLE(3D_CANVAS)
+        if (type == V8ClassIndex::WEBGLARRAY && impl) {
+            // Determine which subclass we are wrapping.
+            WebGLArray* array = reinterpret_cast<WebGLArray*>(impl);
+            if (array->isByteArray())
+                type = V8ClassIndex::WEBGLBYTEARRAY;
+            else if (array->isFloatArray())
+                type = V8ClassIndex::WEBGLFLOATARRAY;
+            else if (array->isIntArray())
+                type = V8ClassIndex::WEBGLINTARRAY;
+            else if (array->isShortArray())
+                type = V8ClassIndex::WEBGLSHORTARRAY;
+            else if (array->isUnsignedByteArray())
+                type = V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY;
+            else if (array->isUnsignedIntArray())
+                type = V8ClassIndex::WEBGLUNSIGNEDINTARRAY;
+            else if (array->isUnsignedShortArray())
+                type = V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY;
+        }
+#endif
+
         v8::Local<v8::Object> v8Object = instantiateV8Object(type, type, impl);
         if (!v8Object.IsEmpty()) {
             // Go through big switch statement, it has some duplications
@@ -715,6 +791,28 @@ v8::Handle<v8::Value> V8DOMWrapper::convertToV8Object(V8ClassIndex::V8WrapperTyp
                 result->SetIndexedPropertiesToPixelData(pixels->data()->data(), pixels->length());
             }
 
+#if ENABLE(3D_CANVAS)
+            // Set up WebGLArray subclasses' accesses similarly.
+            switch (type) {
+            case V8ClassIndex::WEBGLBYTEARRAY:
+            case V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY:
+            case V8ClassIndex::WEBGLSHORTARRAY:
+            case V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY:
+            case V8ClassIndex::WEBGLINTARRAY:
+            case V8ClassIndex::WEBGLUNSIGNEDINTARRAY:
+            case V8ClassIndex::WEBGLFLOATARRAY: {
+                WebGLArray* array = reinterpret_cast<WebGLArray*>(impl);
+                setIndexedPropertiesToExternalArray(result,
+                                                    V8ClassIndex::ToInt(type),
+                                                    array->baseAddress(),
+                                                    array->length());
+                break;
+            }
+            default:
+                break;
+            }
+#endif
+
             // Special case for non-node objects associated with a
             // DOMWindow. Both Safari and FF let the JS wrappers for these
             // objects survive GC. To mimic their behavior, V8 creates
@@ -849,13 +947,6 @@ v8::Local<v8::Object> V8DOMWrapper::instantiateV8Object(V8Proxy* proxy, V8ClassI
     return instance;
 }
 
-void V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object> object, int type, void* cptr)
-{
-    ASSERT(object->InternalFieldCount() >= 2);
-    object->SetPointerInInternalField(V8Custom::kDOMWrapperObjectIndex, cptr);
-    object->SetInternalField(V8Custom::kDOMWrapperTypeIndex, v8::Integer::New(type));
-}
-
 #ifndef NDEBUG
 bool V8DOMWrapper::maybeDOMWrapper(v8::Handle<v8::Value> value)
 {
@@ -1034,7 +1125,7 @@ V8ClassIndex::V8WrapperType V8DOMWrapper::htmlElementType(HTMLElement* element)
 #define FOR_EACH_ANIMATION_TAG(macro)
 #endif
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #define FOR_EACH_FILTERS_TAG(macro) \
     macro(feBlend, FEBLEND) \
     macro(feColorMatrix, FECOLORMATRIX) \
@@ -1179,6 +1270,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventToV8Object(Event* event)
         else if (event->isSVGZoomEvent())
             type = V8ClassIndex::SVGZOOMEVENT;
 #endif
+        else if (event->isCompositionEvent())
+            type = V8ClassIndex::COMPOSITIONEVENT;
         else
             type = V8ClassIndex::UIEVENT;
     } else if (event->isMutationEvent())
@@ -1260,6 +1353,23 @@ v8::Handle<v8::Value> V8DOMWrapper::convertDocumentToV8Object(Document* document
     return wrapper;
 }
 
+v8::Handle<v8::Value> V8DOMWrapper::convertNodeToV8Object(Node* node)
+{
+    if (!node)
+        return v8::Null();
+    
+    Document* document = node->document();
+    if (node == document)
+        return convertDocumentToV8Object(document);
+    
+    DOMWrapperMap<Node>& domNodeMap = getDOMNodeMap();
+    v8::Handle<v8::Object> wrapper = domNodeMap.get(node);
+    if (wrapper.IsEmpty())
+        return convertNewNodeToV8Object(node, 0, domNodeMap);
+    
+    return wrapper;
+}
+    
 // Caller checks node is not null.
 v8::Handle<v8::Value> V8DOMWrapper::convertNewNodeToV8Object(Node* node, V8Proxy* proxy, DOMWrapperMap<Node>& domNodeMap)
 {
@@ -1358,6 +1468,12 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
         return convertToV8Object(V8ClassIndex::WORKER, worker);
 #endif // WORKERS
 
+#if ENABLE(SHARED_WORKERS)
+    SharedWorker* sharedWorker = target->toSharedWorker();
+    if (sharedWorker)
+        return convertToV8Object(V8ClassIndex::SHAREDWORKER, sharedWorker);
+#endif // SHARED_WORKERS
+
 #if ENABLE(NOTIFICATIONS)
     Notification* notification = target->toNotification();
     if (notification)
@@ -1422,30 +1538,23 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventListenerToV8Object(ScriptExecuti
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
-    ScriptExecutionContext* context = node->scriptExecutionContext();
-    if (!context)
-        return 0;
-
-    V8Proxy* proxy = V8Proxy::retrieve(context);
-    // The document might be created using createDocument, which does
-    // not have a frame, use the active frame.
-    if (!proxy)
-        proxy = V8Proxy::retrieve(V8Proxy::retrieveFrameForEnteredContext());
-
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
-
-    return 0;
+    return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 }
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8DOMWrapper.cpp
 #if PLATFORM(ANDROID)
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8DOMWrapper.cpp
 #if ENABLE(SVG)
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(SVGElementInstance* element, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
     return getEventListener(element->correspondingElement(), value, isAttribute, lookup);
 }
 #endif
+<<<<<<< HEAD:WebCore/bindings/v8/V8DOMWrapper.cpp
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8DOMWrapper.cpp
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(AbstractWorker* worker, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
@@ -1455,11 +1564,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(AbstractWorker* worker,
         return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
     }
 
-    V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
-
-    return 0;
+    return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 }
 
 #if ENABLE(NOTIFICATIONS)
@@ -1471,11 +1576,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Notification* notificat
         return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
     }
 
-    V8Proxy* proxy = V8Proxy::retrieve(notification->scriptExecutionContext());
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
-
-    return 0;
+    return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 }
 #endif
 
@@ -1495,9 +1596,8 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(XMLHttpRequestUpload* u
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(EventTarget* eventTarget, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
-    V8Proxy* proxy = V8Proxy::retrieve(eventTarget->scriptExecutionContext());
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
+    if (V8Proxy::retrieve(eventTarget->scriptExecutionContext()))
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 
 #if ENABLE(WORKERS)
     WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
@@ -1510,10 +1610,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(EventTarget* eventTarge
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(V8Proxy* proxy, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
-
-    return 0;
+    return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 }
 
 v8::Handle<v8::Value> V8DOMWrapper::convertDOMImplementationToV8Object(DOMImplementation* impl)
@@ -1679,4 +1776,30 @@ v8::Handle<v8::Value> V8DOMWrapper::convertWindowToV8Object(DOMWindow* window)
     return global;
 }
 
+v8::Handle<v8::Value> V8DOMWrapper::convertNamedNodeMapToV8Object(NamedNodeMap* map)
+{
+    if (!map)
+        return v8::Null();
+
+    v8::Handle<v8::Object> wrapper = getDOMObjectMap().get(map);
+    if (!wrapper.IsEmpty())
+        return wrapper;
+
+    v8::Handle<v8::Object> result = instantiateV8Object(V8ClassIndex::NAMEDNODEMAP, V8ClassIndex::NAMEDNODEMAP, map);
+    if (result.IsEmpty())
+        return result;
+
+    // Only update the DOM object map if the result is non-empty.
+    map->ref();
+    setJSWrapperForDOMObject(map, v8::Persistent<v8::Object>::New(result));
+
+    // Add a hidden reference from named node map to its owner node.
+    if (Element* element = map->element()) {
+        v8::Handle<v8::Object> owner = v8::Handle<v8::Object>::Cast(convertNodeToV8Object(element));
+        result->SetInternalField(V8Custom::kNamedNodeMapOwnerNodeIndex, owner);
+    }
+
+    return result;
+}
+
 }  // namespace WebCore
diff --git a/WebCore/bindings/v8/V8DOMWrapper.h b/WebCore/bindings/v8/V8DOMWrapper.h
index 3d50af3..660b827 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/WebCore/bindings/v8/V8DOMWrapper.h
@@ -109,7 +109,12 @@ namespace WebCore {
 #endif
 
         // Sets contents of a DOM wrapper.
-        static void setDOMWrapper(v8::Handle<v8::Object>, int type, void* ptr);
+        static void setDOMWrapper(v8::Handle<v8::Object> object, int type, void* cptr)
+        {
+            ASSERT(object->InternalFieldCount() >= 2);
+            object->SetPointerInInternalField(V8Custom::kDOMWrapperObjectIndex, cptr);
+            object->SetInternalField(V8Custom::kDOMWrapperTypeIndex, v8::Integer::New(type));
+        }
 
         static v8::Handle<v8::Object> lookupDOMWrapper(V8ClassIndex::V8WrapperType type, v8::Handle<v8::Object> object)
         {
@@ -147,22 +152,7 @@ namespace WebCore {
             return convertNodeToV8Object(node.get());
         }
 
-        static v8::Handle<v8::Value> convertNodeToV8Object(Node* node)
-        {
-            if (!node)
-                return v8::Null();
-
-            Document* document = node->document();
-            if (node == document)
-                return convertDocumentToV8Object(document);
-
-            DOMWrapperMap<Node>& domNodeMap = getDOMNodeMap();
-            v8::Handle<v8::Object> wrapper = domNodeMap.get(node);
-            if (wrapper.IsEmpty())
-                return convertNewNodeToV8Object(node, 0, domNodeMap);
-
-            return wrapper;
-        }
+        static v8::Handle<v8::Value> convertNodeToV8Object(Node*);
 
         static v8::Handle<v8::Value> convertDocumentToV8Object(Document*);
 
@@ -256,13 +246,13 @@ namespace WebCore {
 // TODO: upstream XPATH guard.
 #if ENABLE(XPATH)
         // XPath-related utilities
-        static RefPtr<XPathNSResolver> getXPathNSResolver(v8::Handle<v8::Value> value)
+        static RefPtr<XPathNSResolver> getXPathNSResolver(v8::Handle<v8::Value> value, V8Proxy* proxy = 0)
         {
             RefPtr<XPathNSResolver> resolver;
             if (V8XPathNSResolver::HasInstance(value))
                 resolver = convertToNativeObject<XPathNSResolver>(V8ClassIndex::XPATHNSRESOLVER, v8::Handle<v8::Object>::Cast(value));
             else if (value->IsObject())
-                resolver = V8CustomXPathNSResolver::create(value->ToObject());
+                resolver = V8CustomXPathNSResolver::create(proxy, value->ToObject());
             return resolver;
         }
 #endif
@@ -284,6 +274,10 @@ namespace WebCore {
 
         // Checks whether a DOM object has a JS wrapper.
         static bool domObjectHasJSWrapper(void*);
+        // Get JS wrapper of an existing DOM object, assuming that the wrapper
+        // exists.
+        static v8::Persistent<v8::Object> jsWrapperForDOMObject(void*);
+        static v8::Persistent<v8::Object> jsWrapperForActiveDOMObject(void*);
         // Set JS wrapper of a DOM object, the caller in charge of increase ref.
         static void setJSWrapperForDOMObject(void*, v8::Persistent<v8::Object>);
         static void setJSWrapperForActiveDOMObject(void*, v8::Persistent<v8::Object>);
@@ -303,12 +297,20 @@ namespace WebCore {
         // Returns the JS wrapper of a window object, initializes the environment
         // of the window frame if needed.
         static v8::Handle<v8::Value> convertWindowToV8Object(DOMWindow*);
+        static v8::Handle<v8::Value> convertNamedNodeMapToV8Object(NamedNodeMap*);
 
 #if ENABLE(SVG)
         static v8::Handle<v8::Value> convertSVGElementInstanceToV8Object(SVGElementInstance*);
         static v8::Handle<v8::Value> convertSVGObjectWithContextToV8Object(V8ClassIndex::V8WrapperType, void*);
 #endif
 
+#if ENABLE(3D_CANVAS)
+        static void setIndexedPropertiesToExternalArray(v8::Handle<v8::Object>,
+                                                        int,
+                                                        void*,
+                                                        int);
+#endif
+
     private:
         // Set hidden references in a DOMWindow object of a frame.
         static void setHiddenWindowReference(Frame*, const int internalIndex, v8::Handle<v8::Object>);
diff --git a/WebCore/bindings/v8/V8EventListenerList.h b/WebCore/bindings/v8/V8EventListenerList.h
index 29b4874..fdf211d 100644
--- a/WebCore/bindings/v8/V8EventListenerList.h
+++ b/WebCore/bindings/v8/V8EventListenerList.h
@@ -31,15 +31,14 @@
 #ifndef V8EventListenerList_h
 #define V8EventListenerList_h
 
-#include <v8.h>
-
-#include "PassRefPtr.h"
 #include "V8CustomEventListener.h"
 #include "V8HiddenPropertyName.h"
 
+#include <v8.h>
+#include <wtf/PassRefPtr.h>
+
 namespace WebCore {
     class Frame;
-    class V8EventListener;
 
     // This is a container for V8EventListener objects that uses hidden properties of v8::Object to speed up lookups.
     class V8EventListenerList {
@@ -55,7 +54,7 @@ namespace WebCore {
         }
 
         template<typename WrapperType>
-        static PassRefPtr<V8EventListener> findOrCreateWrapper(PassRefPtr<V8ListenerGuard>, v8::Local<v8::Value>, bool isAttribute);
+        static PassRefPtr<V8EventListener> findOrCreateWrapper(v8::Local<v8::Value>, bool isAttribute);
 
         static void clearWrapper(v8::Handle<v8::Object> listenerObject, bool isAttribute)
         {
@@ -81,7 +80,7 @@ namespace WebCore {
     };
 
     template<typename WrapperType>
-    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Value> value, bool isAttribute)
+    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(v8::Local<v8::Value> value, bool isAttribute)
     {
         ASSERT(v8::Context::InContext());
         if (!value->IsObject())
@@ -94,7 +93,7 @@ namespace WebCore {
         if (wrapper)
             return wrapper;
 
-        PassRefPtr<V8EventListener> wrapperPtr = WrapperType::create(guard, object, isAttribute);
+        PassRefPtr<V8EventListener> wrapperPtr = WrapperType::create(object, isAttribute, WorldContextHandle(UseCurrentWorld));
         if (wrapperPtr)
             object->SetHiddenValue(wrapperProperty, v8::External::Wrap(wrapperPtr.get()));
 
diff --git a/WebCore/bindings/v8/V8GCController.cpp b/WebCore/bindings/v8/V8GCController.cpp
index 242954c..e08cf66 100644
--- a/WebCore/bindings/v8/V8GCController.cpp
+++ b/WebCore/bindings/v8/V8GCController.cpp
@@ -204,35 +204,11 @@ public:
     // has the drawback that the wrappers are "entangled/unentangled" for each
     // GC even though their entaglement most likely is still the same.
     if (type == V8ClassIndex::MESSAGEPORT) {
-        // Get the port and its entangled port.
+        // Mark each port as in-use if it's entangled. For simplicity's sake, we assume all ports are remotely entangled,
+        // since the Chromium port implementation can't tell the difference.
         MessagePort* port1 = static_cast<MessagePort*>(object);
-        MessagePort* port2 = port1->locallyEntangledPort();
-
-        // If we are remotely entangled, then mark this object as reachable
-        // (we can't determine reachability directly as the remote object is
-        // out-of-proc).
-        if (port1->isEntangled() && !port2)
+        if (port1->isEntangled())
             wrapper.ClearWeak();
-
-        if (port2) {
-            // As ports are always entangled in pairs only perform the entanglement
-            // once for each pair (see ASSERT in MessagePort::unentangle()).
-            if (port1 < port2) {
-                v8::Handle<v8::Value> port1Wrapper = V8DOMWrapper::convertToV8Object(V8ClassIndex::MESSAGEPORT, port1);
-                v8::Handle<v8::Value> port2Wrapper = V8DOMWrapper::convertToV8Object(V8ClassIndex::MESSAGEPORT, port2);
-                ASSERT(port1Wrapper->IsObject());
-                v8::Handle<v8::Object>::Cast(port1Wrapper)->SetInternalField(V8Custom::kMessagePortEntangledPortIndex, port2Wrapper);
-                ASSERT(port2Wrapper->IsObject());
-                v8::Handle<v8::Object>::Cast(port2Wrapper)->SetInternalField(V8Custom::kMessagePortEntangledPortIndex, port1Wrapper);
-            }
-        } else {
-            // Remove the wrapper entanglement when a port is not entangled.
-            if (V8DOMWrapper::domObjectHasJSWrapper(port1)) {
-                v8::Handle<v8::Value> wrapper = V8DOMWrapper::convertToV8Object(V8ClassIndex::MESSAGEPORT, port1);
-                ASSERT(wrapper->IsObject());
-                v8::Handle<v8::Object>::Cast(wrapper)->SetInternalField(V8Custom::kMessagePortEntangledPortIndex, v8::Undefined());
-            }
-        }
     }
 }
 };
@@ -296,14 +272,21 @@ public:
             groupId = reinterpret_cast<uintptr_t>(node->document());
         else {
             Node* root = node;
-            while (root->parent())
-                root = root->parent();
-
-            // If the node is alone in its DOM tree (doesn't have a parent or any
-            // children) then the group will be filtered out later anyway.
-            if (root == node && !node->hasChildNodes())
-                return;
-
+            if (node->isAttributeNode()) {
+                root = static_cast<Attr*>(node)->ownerElement();
+                // If the attribute has no element, no need to put it in the group,
+                // because it'll always be a group of 1.
+                if (!root)
+                    return;
+            } else {
+                while (root->parent())
+                    root = root->parent();
+
+                // If the node is alone in its DOM tree (doesn't have a parent or any
+                // children) then the group will be filtered out later anyway.
+                if (root == node && !node->hasChildNodes() && !node->hasAttributes())
+                    return;
+            }
             groupId = reinterpret_cast<uintptr_t>(root);
         }
         m_grouper.append(GrouperItem(groupId, node, wrapper));
@@ -419,17 +402,30 @@ ACTIVE_DOM_OBJECT_TYPES(MAKE_CASE)
 
         if (type == V8ClassIndex::MESSAGEPORT) {
             MessagePort* port1 = static_cast<MessagePort*>(object);
-            MessagePort* port2 = port1->locallyEntangledPort();
-            if (port1->isEntangled() && !port2) {
-                // We marked this port as reachable in GCPrologueVisitor.  Undo this now since the
-                // port could be not reachable in the future if it gets disentangled (and also
-                // GCPrologueVisitor expects to see all handles marked as weak).
+            // We marked this port as reachable in GCPrologueVisitor.  Undo this now since the
+            // port could be not reachable in the future if it gets disentangled (and also
+            // GCPrologueVisitor expects to see all handles marked as weak).
+            if (!wrapper.IsWeak() && !wrapper.IsNearDeath())
                 wrapper.MakeWeak(port1, &DOMDataStore::weakActiveDOMObjectCallback);
-            }
         }
     }
 };
 
+int V8GCController::workingSetEstimateMB = 0;
+
+namespace {
+
+int getMemoryUsageInMB()
+{
+#if PLATFORM(CHROMIUM)
+    return ChromiumBridge::memoryUsageMB();
+#else
+    return 0;
+#endif
+}
+
+}  // anonymous namespace
+
 void V8GCController::gcEpilogue()
 {
     v8::HandleScope scope;
@@ -439,6 +435,8 @@ void V8GCController::gcEpilogue()
     GCEpilogueVisitor epilogueVisitor;
     visitActiveDOMObjectsInCurrentThread(&epilogueVisitor);
 
+    workingSetEstimateMB = getMemoryUsageInMB();
+
 #ifndef NDEBUG
     // Check all survivals are weak.
     DOMObjectVisitor domObjectVisitor;
@@ -452,4 +450,19 @@ void V8GCController::gcEpilogue()
 #endif
 }
 
+void V8GCController::checkMemoryUsage()
+{
+#if PLATFORM(CHROMIUM)
+    // These values are appropriate for Chromium only.
+    const int lowUsageMB = 256;  // If memory usage is below this threshold, do not bother forcing GC.
+    const int highUsageMB = 1024;  // If memory usage is above this threshold, force GC more aggresively.
+    const int highUsageDeltaMB = 128;  // Delta of memory usage growth (vs. last workingSetEstimateMB) to force GC when memory usage is high.
+
+    int memoryUsageMB = getMemoryUsageInMB();
+    if ((memoryUsageMB > lowUsageMB && memoryUsageMB > 2 * workingSetEstimateMB) || (memoryUsageMB > highUsageMB && memoryUsageMB > workingSetEstimateMB + highUsageDeltaMB))
+        v8::V8::LowMemoryNotification();
+#endif
+}
+
+
 }  // namespace WebCore
diff --git a/WebCore/bindings/v8/V8GCController.h b/WebCore/bindings/v8/V8GCController.h
index 7441bf0..484be24 100644
--- a/WebCore/bindings/v8/V8GCController.h
+++ b/WebCore/bindings/v8/V8GCController.h
@@ -78,6 +78,12 @@ namespace WebCore {
 
         static void gcPrologue();
         static void gcEpilogue();
+
+        static void checkMemoryUsage();
+
+    private:
+        // Estimate of current working set.
+        static int workingSetEstimateMB;
     };
 
 }
diff --git a/WebCore/bindings/v8/V8HiddenPropertyName.h b/WebCore/bindings/v8/V8HiddenPropertyName.h
index 5ef89cb..bb1ca4c 100644
--- a/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -37,7 +37,6 @@ namespace WebCore {
 
 #define V8_HIDDEN_PROPERTIES(V) \
     V(objectPrototype) \
-    V(isolatedWorld) \
     V(listener) \
     V(attributeListener) \
     V(sleepFunction) \
diff --git a/WebCore/bindings/v8/V8Index.cpp b/WebCore/bindings/v8/V8Index.cpp
index c6369dd..7acaf89 100644
--- a/WebCore/bindings/v8/V8Index.cpp
+++ b/WebCore/bindings/v8/V8Index.cpp
@@ -34,7 +34,7 @@
 #include "V8Attr.h"
 #include "V8BarInfo.h"
 #include "V8BeforeLoadEvent.h"
-#include "V8CanvasActiveInfo.h"
+#include "V8WebGLActiveInfo.h"
 #include "V8CanvasRenderingContext.h"
 #include "V8CanvasRenderingContext2D.h"
 #include "V8CanvasGradient.h"
@@ -46,6 +46,7 @@
 #include "V8ClientRectList.h"
 #include "V8Clipboard.h"
 #include "V8Comment.h"
+#include "V8CompositionEvent.h"
 #include "V8Console.h"
 #include "V8Counter.h"
 #include "V8CSSStyleDeclaration.h"
@@ -219,7 +220,7 @@
 #include "V8SVGSetElement.h"
 #endif
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "V8SVGComponentTransferFunctionElement.h"
 #include "V8SVGFEBlendElement.h"
 #include "V8SVGFEColorMatrixElement.h"
@@ -237,6 +238,7 @@
 #include "V8SVGFEImageElement.h"
 #include "V8SVGFEMergeElement.h"
 #include "V8SVGFEMergeNodeElement.h"
+#include "V8SVGFEMorphologyElement.h"
 #include "V8SVGFEOffsetElement.h"
 #include "V8SVGFEPointLightElement.h"
 #include "V8SVGFESpecularLightingElement.h"
@@ -393,22 +395,23 @@
 #endif
 
 #if ENABLE(3D_CANVAS)
-#include "V8CanvasRenderingContext3D.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArray.h"
-#include "V8CanvasByteArray.h"
-#include "V8CanvasBuffer.h"
-#include "V8CanvasFloatArray.h"
-#include "V8CanvasFramebuffer.h"
-#include "V8CanvasIntArray.h"
-#include "V8CanvasProgram.h"
-#include "V8CanvasRenderbuffer.h"
-#include "V8CanvasShader.h"
-#include "V8CanvasShortArray.h"
-#include "V8CanvasTexture.h"
-#include "V8CanvasUnsignedByteArray.h"
-#include "V8CanvasUnsignedIntArray.h"
-#include "V8CanvasUnsignedShortArray.h"
+#include "V8WebGLRenderingContext.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArray.h"
+#include "V8WebGLByteArray.h"
+#include "V8WebGLBuffer.h"
+#include "V8WebGLFloatArray.h"
+#include "V8WebGLFramebuffer.h"
+#include "V8WebGLIntArray.h"
+#include "V8WebGLProgram.h"
+#include "V8WebGLRenderbuffer.h"
+#include "V8WebGLShader.h"
+#include "V8WebGLShortArray.h"
+#include "V8WebGLTexture.h"
+#include "V8WebGLUniformLocation.h"
+#include "V8WebGLUnsignedByteArray.h"
+#include "V8WebGLUnsignedIntArray.h"
+#include "V8WebGLUnsignedShortArray.h"
 #endif
 
 #if ENABLE(DATABASE)
@@ -432,7 +435,9 @@
 #endif
 
 #if ENABLE(INSPECTOR)
+#include "V8InjectedScriptHost.h"
 #include "V8InspectorBackend.h"
+#include "V8InspectorFrontendHost.h"
 #endif
 
 // Geolocation
@@ -441,6 +446,7 @@
 #include "V8Geoposition.h"
 #include "V8PositionError.h"
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.cpp
 #if PLATFORM(ANDROID)
 // TODO: Upstream these guards to webkit.org
 #if ENABLE(TOUCH_EVENTS)
@@ -452,6 +458,8 @@
 #include "V8VoidCallback.h"
 #endif  // PLATFORM(ANDROID)
 
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Index.cpp
 namespace WebCore {
 
 FunctionTemplateFactory V8ClassIndex::GetFactory(V8WrapperType type)
diff --git a/WebCore/bindings/v8/V8Index.h b/WebCore/bindings/v8/V8Index.h
index fb53948..6184f5a 100644
--- a/WebCore/bindings/v8/V8Index.h
+++ b/WebCore/bindings/v8/V8Index.h
@@ -197,7 +197,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #define SVG_ANIMATION_ELEMENT_TYPES(V)
 #endif
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #define SVG_FILTERS_ELEMENT_TYPES(V)                                    \
     V(SVGCOMPONENTTRANSFERFUNCTIONELEMENT, SVGComponentTransferFunctionElement)\
     V(SVGFEBLENDELEMENT, SVGFEBlendElement)                             \
@@ -216,6 +216,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(SVGFEIMAGEELEMENT, SVGFEImageElement)                             \
     V(SVGFEMERGEELEMENT, SVGFEMergeElement)                             \
     V(SVGFEMERGENODEELEMENT, SVGFEMergeNodeElement)                     \
+    V(SVGFEMORPHOLOGYELEMENT, SVGFEMorphologyElement)                   \
     V(SVGFEOFFSETELEMENT, SVGFEOffsetElement)                           \
     V(SVGFEPOINTLIGHTELEMENT, SVGFEPointLightElement)                   \
     V(SVGFESPECULARLIGHTINGELEMENT, SVGFESpecularLightingElement)       \
@@ -332,6 +333,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(CLIENTRECTLIST, ClientRectList)                                   \
     V(CLIPBOARD, Clipboard)                                             \
     V(CONSOLE, Console)                                                 \
+    V(COMPOSITIONEVENT, CompositionEvent)                               \
     V(COUNTER, Counter)                                                 \
     V(CSSCHARSETRULE, CSSCharsetRule)                                   \
     V(CSSFONTFACERULE, CSSFontFaceRule)                                 \
@@ -445,23 +447,24 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if ENABLE(3D_CANVAS)
 #define DOM_OBJECT_3D_CANVAS_TYPES(V)                                   \
-    V(CANVASACTIVEINFO, CanvasActiveInfo)                               \
-    V(CANVASARRAY, CanvasArray)                                         \
-    V(CANVASARRAYBUFFER, CanvasArrayBuffer)                             \
-    V(CANVASBUFFER, CanvasBuffer)                                       \
-    V(CANVASBYTEARRAY, CanvasByteArray)                                 \
-    V(CANVASFLOATARRAY, CanvasFloatArray)                               \
-    V(CANVASFRAMEBUFFER, CanvasFramebuffer)                             \
-    V(CANVASINTARRAY, CanvasIntArray)                                   \
-    V(CANVASPROGRAM, CanvasProgram)                                     \
-    V(CANVASRENDERBUFFER, CanvasRenderbuffer)                           \
-    V(CANVASRENDERINGCONTEXT3D, CanvasRenderingContext3D)               \
-    V(CANVASSHADER, CanvasShader)                                       \
-    V(CANVASSHORTARRAY, CanvasShortArray)                               \
-    V(CANVASTEXTURE, CanvasTexture)                                     \
-    V(CANVASUNSIGNEDBYTEARRAY, CanvasUnsignedByteArray)                 \
-    V(CANVASUNSIGNEDINTARRAY, CanvasUnsignedIntArray)                   \
-    V(CANVASUNSIGNEDSHORTARRAY, CanvasUnsignedShortArray)
+    V(WEBGLACTIVEINFO, WebGLActiveInfo)                                 \
+    V(WEBGLARRAY, WebGLArray)                                           \
+    V(WEBGLARRAYBUFFER, WebGLArrayBuffer)                               \
+    V(WEBGLBUFFER, WebGLBuffer)                                         \
+    V(WEBGLBYTEARRAY, WebGLByteArray)                                   \
+    V(WEBGLFLOATARRAY, WebGLFloatArray)                                 \
+    V(WEBGLFRAMEBUFFER, WebGLFramebuffer)                               \
+    V(WEBGLINTARRAY, WebGLIntArray)                                     \
+    V(WEBGLPROGRAM, WebGLProgram)                                       \
+    V(WEBGLRENDERBUFFER, WebGLRenderbuffer)                             \
+    V(WEBGLRENDERINGCONTEXT, WebGLRenderingContext)                     \
+    V(WEBGLSHADER, WebGLShader)                                         \
+    V(WEBGLSHORTARRAY, WebGLShortArray)                                 \
+    V(WEBGLTEXTURE, WebGLTexture)                                       \
+    V(WEBGLUNIFORMLOCATION, WebGLUniformLocation)                       \
+    V(WEBGLUNSIGNEDBYTEARRAY, WebGLUnsignedByteArray)                   \
+    V(WEBGLUNSIGNEDINTARRAY, WebGLUnsignedIntArray)                     \
+    V(WEBGLUNSIGNEDSHORTARRAY, WebGLUnsignedShortArray)
 #else
 #define DOM_OBJECT_3D_CANVAS_TYPES(V)
 #endif
@@ -486,7 +489,9 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if ENABLE(INSPECTOR)
 #define DOM_OBJECT_INSPECTOR_TYPES(V)                                   \
-    V(INSPECTORBACKEND, InspectorBackend)
+    V(INSPECTORBACKEND, InspectorBackend)                               \
+    V(INSPECTORFRONTENDHOST, InspectorFrontendHost)                     \
+    V(INJECTEDSCRIPTHOST, InjectedScriptHost)
 #else
 #define DOM_OBJECT_INSPECTOR_TYPES(V)
 #endif
@@ -497,6 +502,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(GEOPOSITION, Geoposition)                                         \
     V(POSITIONERROR, PositionError)
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #if PLATFORM(ANDROID)
 // TODO: Upstream this guard.
 #if ENABLE(TOUCH_EVENTS)
@@ -518,6 +524,8 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if PLATFORM(ANDROID)
 // This block is modified, but is not Android-specific.
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Index.h
 #define DOM_OBJECT_TYPES(V)                                             \
     DOM_OBJECT_TYPES_1(V)                                               \
     DOM_OBJECT_TYPES_2(V)                                               \
@@ -528,10 +536,14 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     DOM_OBJECT_XPATH_TYPES(V)                                           \
     DOM_OBJECT_XSLT_TYPES(V)                                            \
     DOM_OBJECT_INSPECTOR_TYPES(V)                                       \
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
     DOM_OBJECT_GEOLOCATION_TYPES(V)                                     \
     DOM_OBJECT_TOUCH_EVENT_TYPES(V)                                     \
     DOM_OBJECT_VOIDCALLBACK_TYPES(V)
 #endif
+=======
+    DOM_OBJECT_GEOLOCATION_TYPES(V)
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Index.h
 
 #if ENABLE(SVG)
 // SVG_OBJECT_TYPES are svg non-node, non-pod types.
diff --git a/WebCore/bindings/v8/V8IsolatedWorld.cpp b/WebCore/bindings/v8/V8IsolatedWorld.cpp
index d4e4f52..cb65097 100644
--- a/WebCore/bindings/v8/V8IsolatedWorld.cpp
+++ b/WebCore/bindings/v8/V8IsolatedWorld.cpp
@@ -58,11 +58,13 @@ V8IsolatedWorld::V8IsolatedWorld(V8Proxy* proxy, int extensionGroup)
 
     v8::HandleScope scope;
     m_context = SharedPersistent<v8::Context>::create(proxy->createNewContext(v8::Handle<v8::Object>(), extensionGroup));
+    if (m_context->get().IsEmpty())
+        return;
 
     // Run code in the new context.
     v8::Context::Scope context_scope(m_context->get());
 
-    m_context->get()->Global()->SetHiddenValue(V8HiddenPropertyName::isolatedWorld(), v8::External::Wrap(this));
+    getGlobalObject(m_context->get())->SetPointerInInternalField(V8Custom::kDOMWindowEnteredIsolatedWorldIndex, this);
 
     V8Proxy::installHiddenObjectPrototype(m_context->get());
     proxy->installDOMWindow(m_context->get(), proxy->frame()->domWindow());
@@ -89,17 +91,4 @@ V8IsolatedWorld::~V8IsolatedWorld()
     m_context->disposeHandle();
 }
 
-V8IsolatedWorld* V8IsolatedWorld::getEnteredImpl()
-{
-    if (!v8::Context::InContext())
-        return 0;
-    v8::HandleScope scope;
-
-    v8::Local<v8::Value> world = v8::Context::GetEntered()->Global()->GetHiddenValue(V8HiddenPropertyName::isolatedWorld());
-    if (world.IsEmpty())
-        return 0;
-
-    return static_cast<V8IsolatedWorld*>(v8::External::Unwrap(world));
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8IsolatedWorld.h b/WebCore/bindings/v8/V8IsolatedWorld.h
index 663f4bd..6313da8 100644
--- a/WebCore/bindings/v8/V8IsolatedWorld.h
+++ b/WebCore/bindings/v8/V8IsolatedWorld.h
@@ -61,6 +61,7 @@ namespace WebCore {
         // Creates an isolated world. To destroy it, call destroy().
         // This will delete the isolated world when the context it owns is GC'd.
         V8IsolatedWorld(V8Proxy* proxy, int extensionGroup);
+        ~V8IsolatedWorld();
 
         // Call this to destroy the isolated world. It will be deleted sometime
         // after this call, once all script references to the world's context
@@ -84,7 +85,9 @@ namespace WebCore {
             // worlds at all.
             if (!isolatedWorldCount)
                 return 0;
-            return getEnteredImpl();
+            if (!v8::Context::InContext())
+                return 0;
+            return reinterpret_cast<V8IsolatedWorld*>(getGlobalObject(v8::Context::GetEntered())->GetPointerFromInternalField(V8Custom::kDOMWindowEnteredIsolatedWorldIndex));
         }
 
         v8::Handle<v8::Context> context() { return m_context->get(); }
@@ -93,9 +96,10 @@ namespace WebCore {
         DOMDataStore* getDOMDataStore() const { return m_domDataStore.getStore(); }
 
     private:
-        ~V8IsolatedWorld();
-
-        static V8IsolatedWorld* getEnteredImpl();
+        static v8::Handle<v8::Object> getGlobalObject(v8::Handle<v8::Context> context)
+        {
+            return v8::Handle<v8::Object>::Cast(context->Global()->GetPrototype());
+        }
 
         // Called by the garbage collector when our JavaScript context is about
         // to be destroyed.
diff --git a/WebCore/bindings/v8/V8LazyEventListener.cpp b/WebCore/bindings/v8/V8LazyEventListener.cpp
index 54740a9..16b21d6 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -35,13 +35,14 @@
 #include "V8Binding.h"
 #include "V8HiddenPropertyName.h"
 #include "V8Proxy.h"
+#include "WorldContextHandle.h"
 
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-V8LazyEventListener::V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber)
-    : V8AbstractEventListener(0, true)
+V8LazyEventListener::V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber, const WorldContextHandle& worldContext)
+    : V8AbstractEventListener(true, worldContext)
     , m_functionName(functionName)
     , m_isSVGEvent(isSVGEvent)
     , m_code(code)
@@ -83,7 +84,7 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
         return;
 
     // Use the outer scope to hold context.
-    v8::Handle<v8::Context> v8Context = proxy->context();
+    v8::Local<v8::Context> v8Context = worldContext().adjustedContext(proxy);
     // Bail out if we cannot get the context.
     if (v8Context.IsEmpty())
         return;
diff --git a/WebCore/bindings/v8/V8LazyEventListener.h b/WebCore/bindings/v8/V8LazyEventListener.h
index 699460b..078dcf1 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.h
+++ b/WebCore/bindings/v8/V8LazyEventListener.h
@@ -45,9 +45,9 @@ namespace WebCore {
     // A V8LazyEventListener is always a HTML event handler.
     class V8LazyEventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8LazyEventListener> create(const String& functionName, bool isSVGEvent, const String& code, const String& sourceURL, int lineNumber, int columnNumber)
+        static PassRefPtr<V8LazyEventListener> create(const String& functionName, bool isSVGEvent, const String& code, const String& sourceURL, int lineNumber, int columnNumber, const WorldContextHandle& worldContext)
         {
-            return adoptRef(new V8LazyEventListener(functionName, isSVGEvent, code, sourceURL, lineNumber, columnNumber));
+            return adoptRef(new V8LazyEventListener(functionName, isSVGEvent, code, sourceURL, lineNumber, columnNumber, worldContext));
         }
 
         virtual bool isLazy() const { return true; }
@@ -56,7 +56,7 @@ namespace WebCore {
         virtual void prepareListenerObject(ScriptExecutionContext*);
 
     private:
-        V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber);
+        V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber, const WorldContextHandle& worldContext);
 
         virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsEvent, Event*);
 
diff --git a/WebCore/bindings/v8/V8NPObject.cpp b/WebCore/bindings/v8/V8NPObject.cpp
index 75163f1..bab3688 100644
--- a/WebCore/bindings/v8/V8NPObject.cpp
+++ b/WebCore/bindings/v8/V8NPObject.cpp
@@ -33,6 +33,7 @@
 #include "V8NPObject.h"
 
 #include "HTMLPlugInElement.h"
+#include "IdentifierRep.h"
 #include "NPV8Object.h"
 #include "V8CustomBinding.h"
 #include "V8DOMMap.h"
@@ -44,7 +45,7 @@
 #include "V8Proxy.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
-#include "wtf/OwnArrayPtr.h"
+#include <wtf/OwnArrayPtr.h>
 
 using namespace WebCore;
 
@@ -117,7 +118,7 @@ static v8::Handle<v8::Value> npObjectInvokeImpl(const v8::Arguments& args, Invok
     if (!retval)
         throwError("Error calling method on NPObject!", V8Proxy::GeneralError);
 
-    for (int i=0; i < numArgs; i++)
+    for (int i = 0; i < numArgs; i++)
         _NPN_ReleaseVariantValue(&npArgs[i]);
 
     // Unwrap return values.
@@ -138,8 +139,8 @@ v8::Handle<v8::Value> npObjectInvokeDefaultHandler(const v8::Arguments& args)
 {
     if (args.IsConstructCall())
         return npObjectInvokeImpl(args, InvokeConstruct);
-    else
-        return npObjectInvokeImpl(args, InvokeDefault);
+
+    return npObjectInvokeImpl(args, InvokeDefault);
 }
 
 
@@ -180,7 +181,9 @@ static v8::Handle<v8::Value> npObjectGetProperty(v8::Local<v8::Object> self, NPI
         _NPN_ReleaseVariantValue(&result);
         return returnValue;
 
-    } else if (key->IsString() && npObject->_class->hasMethod && npObject->_class->hasMethod(npObject, identifier)) {
+    }
+
+    if (key->IsString() && npObject->_class->hasMethod && npObject->_class->hasMethod(npObject, identifier)) {
         PrivateIdentifier* id = static_cast<PrivateIdentifier*>(identifier);
         v8::Persistent<v8::FunctionTemplate> functionTemplate = staticTemplateMap.get(id);
         // Cache templates using identifier as the key.
@@ -275,6 +278,44 @@ v8::Handle<v8::Value> npObjectSetIndexedProperty(v8::Local<v8::Object> self, uin
     return npObjectSetProperty(self, identifier, value);
 }
 
+v8::Handle<v8::Array> npObjectPropertyEnumerator(const v8::AccessorInfo& info, bool namedProperty)
+{
+    NPObject* npObject = V8DOMWrapper::convertToNativeObject<NPObject>(V8ClassIndex::NPOBJECT, info.Holder());
+
+    // Verify that our wrapper wasn't using a NPObject which
+    // has already been deleted.
+    if (!npObject || !_NPN_IsAlive(npObject))
+        throwError("NPObject deleted", V8Proxy::ReferenceError);
+
+    if (NP_CLASS_STRUCT_VERSION_HAS_ENUM(npObject->_class) && npObject->_class->enumerate) {
+        uint32_t count;
+        NPIdentifier* identifiers;
+        if (npObject->_class->enumerate(npObject, &identifiers, &count)) {
+            v8::Handle<v8::Array> properties = v8::Array::New(count);
+            for (uint32_t i = 0; i < count; ++i) {
+                IdentifierRep* identifier = static_cast<IdentifierRep*>(identifiers[i]);
+                if (namedProperty)
+                    properties->Set(v8::Integer::New(i), v8::String::New(identifier->string()));
+                else
+                    properties->Set(v8::Integer::New(i), v8::Integer::New(identifier->number()));
+            }
+
+            return properties;
+        }
+    }
+
+    return v8::Handle<v8::Array>();
+}
+
+v8::Handle<v8::Array> npObjectNamedPropertyEnumerator(const v8::AccessorInfo& info)
+{
+    return npObjectPropertyEnumerator(info, true);
+}
+
+v8::Handle<v8::Array> npObjectIndexedPropertyEnumerator(const v8::AccessorInfo& info)
+{
+    return npObjectPropertyEnumerator(info, false);
+}
 
 static void weakNPObjectCallback(v8::Persistent<v8::Value>, void* parameter);
 
@@ -317,8 +358,8 @@ v8::Local<v8::Object> createV8ObjectForNPObject(NPObject* object, NPObject* root
     if (npObjectDesc.IsEmpty()) {
         npObjectDesc = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New());
         npObjectDesc->InstanceTemplate()->SetInternalFieldCount(V8Custom::kNPObjectInternalFieldCount);
-        npObjectDesc->InstanceTemplate()->SetNamedPropertyHandler(npObjectNamedPropertyGetter, npObjectNamedPropertySetter);
-        npObjectDesc->InstanceTemplate()->SetIndexedPropertyHandler(npObjectIndexedPropertyGetter, npObjectIndexedPropertySetter);
+        npObjectDesc->InstanceTemplate()->SetNamedPropertyHandler(npObjectNamedPropertyGetter, npObjectNamedPropertySetter, 0, 0, npObjectNamedPropertyEnumerator);
+        npObjectDesc->InstanceTemplate()->SetIndexedPropertyHandler(npObjectIndexedPropertyGetter, npObjectIndexedPropertySetter, 0, 0, npObjectIndexedPropertyEnumerator);
         npObjectDesc->InstanceTemplate()->SetCallAsFunctionHandler(npObjectInvokeDefaultHandler);
     }
 
diff --git a/WebCore/bindings/v8/V8Proxy.cpp b/WebCore/bindings/v8/V8Proxy.cpp
index 64424f3..c016d90 100644
--- a/WebCore/bindings/v8/V8Proxy.cpp
+++ b/WebCore/bindings/v8/V8Proxy.cpp
@@ -36,6 +36,7 @@
 #include "DOMObjectsInclude.h"
 #include "DocumentLoader.h"
 #include "FrameLoaderClient.h"
+#include "InspectorTimelineAgent.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "ScriptController.h"
@@ -52,12 +53,14 @@
 #include "WorkerContextExecutionProxy.h"
 
 #include <algorithm>
+#include <stdio.h>
 #include <utility>
 #include <v8.h>
 #include <v8-debug.h>
 #include <wtf/Assertions.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/UnusedParam.h>
 
 #if PLATFORM(CHROMIUM)
@@ -79,16 +82,34 @@ v8::Persistent<v8::Context> V8Proxy::m_utilityContext;
 // Static list of registered extensions
 V8Extensions V8Proxy::m_extensions;
 
-const char* V8Proxy::kContextDebugDataType = "type";
-const char* V8Proxy::kContextDebugDataValue = "value";
-
-void batchConfigureAttributes(v8::Handle<v8::ObjectTemplate> instance, v8::Handle<v8::ObjectTemplate> proto, const BatchedAttribute* attributes, size_t attributeCount)
+void batchConfigureAttributes(v8::Handle<v8::ObjectTemplate> instance, 
+                              v8::Handle<v8::ObjectTemplate> proto, 
+                              const BatchedAttribute* attributes, 
+                              size_t attributeCount)
 {
     for (size_t i = 0; i < attributeCount; ++i)
         configureAttribute(instance, proto, attributes[i]);
 }
 
-void batchConfigureConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor, v8::Handle<v8::ObjectTemplate> proto, const BatchedConstant* constants, size_t constantCount)
+void batchConfigureCallbacks(v8::Handle<v8::ObjectTemplate> proto, 
+                             v8::Handle<v8::Signature> signature, 
+                             v8::PropertyAttribute attributes,
+                             const BatchedCallback* callbacks,
+                             size_t callbackCount)
+{
+    for (size_t i = 0; i < callbackCount; ++i) {
+        proto->Set(v8::String::New(callbacks[i].name),
+                   v8::FunctionTemplate::New(callbacks[i].callback, 
+                                             v8::Handle<v8::Value>(),
+                                             signature),
+                   attributes);
+    }
+}
+
+void batchConfigureConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor,
+                             v8::Handle<v8::ObjectTemplate> proto,
+                             const BatchedConstant* constants,
+                             size_t constantCount)
 {
     for (size_t i = 0; i < constantCount; ++i) {
         const BatchedConstant* constant = &constants[i];
@@ -218,7 +239,6 @@ static void reportFatalErrorInV8(const char* location, const char* message)
 
 V8Proxy::V8Proxy(Frame* frame)
     : m_frame(frame)
-    , m_listenerGuard(V8ListenerGuard::create())
     , m_inlineCode(false)
     , m_timerCallback(false)
     , m_recursion(0)
@@ -306,13 +326,26 @@ void V8Proxy::evaluateInIsolatedWorld(int worldID, const Vector<ScriptSourceCode
             world = iter->second;
         } else {
             world = new V8IsolatedWorld(this, extensionGroup);
+            if (world->context().IsEmpty()) {
+                delete world;
+                return;
+            }
+
             m_isolatedWorlds.set(worldID, world);
 
             // Setup context id for JS debugger.
-            setInjectedScriptContextDebugId(world->context());
+            if (!setInjectedScriptContextDebugId(world->context())) {
+                m_isolatedWorlds.take(worldID);
+                delete world;
+                return;
+            }
         }
     } else {
         world = new V8IsolatedWorld(this, extensionGroup);
+        if (world->context().IsEmpty()) {
+            delete world;
+            return;
+        }
     }
 
     v8::Local<v8::Context> context = v8::Local<v8::Context>::New(world->context());
@@ -338,10 +371,16 @@ void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int
     ASSERT(V8DOMWrapper::convertDOMWrapperToNative<DOMWindow>(windowWrapper) == m_frame->domWindow());
 
     v8::Persistent<v8::Context> context = createNewContext(v8::Handle<v8::Object>(), extensionGroup);
+    if (context.IsEmpty())
+        return;
+
     v8::Context::Scope contextScope(context);
 
     // Setup context id for JS debugger.
-    setInjectedScriptContextDebugId(context);
+    if (!setInjectedScriptContextDebugId(context)) {
+        context.Dispose();
+        return;
+    }
 
     v8::Handle<v8::Object> global = context->Global();
 
@@ -367,25 +406,35 @@ void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int
     context.Dispose();
 }
 
-void V8Proxy::setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext)
+bool V8Proxy::setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext)
 {
     // Setup context id for JS debugger.
     v8::Context::Scope contextScope(targetContext);
-    v8::Handle<v8::Object> contextData = v8::Object::New();
+    if (m_context.IsEmpty())
+        return false;
+    int debugId = contextDebugId(m_context);
 
-    v8::Handle<v8::Value> windowContextData = m_context->GetData();
-    if (windowContextData->IsObject()) {
-        v8::Handle<v8::String> propertyName = v8::String::New(kContextDebugDataValue);
-        contextData->Set(propertyName, v8::Object::Cast(*windowContextData)->Get(propertyName));
-    }
-    contextData->Set(v8::String::New(kContextDebugDataType), v8::String::New("injected"));
-    targetContext->SetData(contextData);
+    char buffer[32];
+    if (debugId == -1)
+        snprintf(buffer, sizeof(buffer), "injected");
+    else
+        snprintf(buffer, sizeof(buffer), "injected,%d", debugId);
+    targetContext->SetData(v8::String::New(buffer));
+
+    return true;
 }
 
 v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* node)
 {
     ASSERT(v8::Context::InContext());
 
+    V8GCController::checkMemoryUsage();
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->willEvaluateScript(source.url().isNull() ? String() : source.url().string(), source.startLine());
+#endif
+
     v8::Local<v8::Value> result;
     {
         // Isolate exceptions that occur when compiling and executing
@@ -419,7 +468,18 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
 #if PLATFORM(CHROMIUM)
     // TODO(andreip): ChromeBridge->BrowserBridge?
     ChromiumBridge::traceEventEnd("v8.run", node, "");
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
+=======
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->didEvaluateScript();
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 #endif
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
+=======
+
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
     return result;
 }
 
@@ -438,6 +498,7 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
     if (script.IsEmpty())
         return notHandledByInterceptor();
 
+    V8GCController::checkMemoryUsage();
     // Compute the source string and prevent against infinite recursion.
     if (m_recursion >= kMaxRecursionDepth) {
         v8::Local<v8::String> code = v8ExternalString("throw RangeError('Recursion too deep')");
@@ -492,9 +553,13 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
 
 v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8::Handle<v8::Object> receiver, int argc, v8::Handle<v8::Value> args[])
 {
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::JavaScriptExecuteTimeCounter);
 #endif
+=======
+    V8GCController::checkMemoryUsage();
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
     v8::Local<v8::Value> result;
     {
         V8ConsoleMessage::Scope scope;
@@ -646,6 +711,7 @@ V8Proxy* V8Proxy::retrieve(ScriptExecutionContext* context)
 
 void V8Proxy::disconnectFrame()
 {
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     disconnectEventListeners();
 }
 
@@ -700,6 +766,8 @@ bool V8Proxy::isEnabled()
     }
 
     return false; // Other protocols fall through to here
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 }
 
 void V8Proxy::updateDocumentWrapper(v8::Handle<v8::Value> wrapper)
@@ -789,12 +857,6 @@ void V8Proxy::releaseStorageMutex()
         page->group().localStorage()->unlock();
 }
 
-void V8Proxy::disconnectEventListeners()
-{
-    m_listenerGuard->disconnectListeners();
-    m_listenerGuard = V8ListenerGuard::create();
-}
-    
 void V8Proxy::resetIsolatedWorlds()
 {
     for (IsolatedWorldMap::iterator iter = m_isolatedWorlds.begin();
@@ -818,7 +880,6 @@ void V8Proxy::clearForClose()
 
 void V8Proxy::clearForNavigation()
 {
-    disconnectEventListeners();
     resetIsolatedWorlds();
 
     if (!m_context.IsEmpty()) {
@@ -942,14 +1003,20 @@ bool V8Proxy::canAccessPrivate(DOMWindow* targetWindow)
 
     String message;
 
-    DOMWindow* originWindow = retrieveWindow(currentContext());
-    if (originWindow == targetWindow)
+    v8::Local<v8::Context> activeContext = v8::Context::GetCalling();
+    if (activeContext.IsEmpty()) {
+        // There is a single activation record on the stack, so that must
+        // be the activeContext.
+        activeContext = v8::Context::GetCurrent();
+    }
+    DOMWindow* activeWindow = retrieveWindow(activeContext);
+    if (activeWindow == targetWindow)
         return true;
 
-    if (!originWindow)
+    if (!activeWindow)
         return false;
 
-    const SecurityOrigin* activeSecurityOrigin = originWindow->securityOrigin();
+    const SecurityOrigin* activeSecurityOrigin = activeWindow->securityOrigin();
     const SecurityOrigin* targetSecurityOrigin = targetWindow->securityOrigin();
 
     // We have seen crashes were the security origin of the target has not been
@@ -962,7 +1029,7 @@ bool V8Proxy::canAccessPrivate(DOMWindow* targetWindow)
 
     // Allow access to a "about:blank" page if the dynamic context is a
     // detached context of the same frame as the blank page.
-    if (targetSecurityOrigin->isEmpty() && originWindow->frame() == targetWindow->frame())
+    if (targetSecurityOrigin->isEmpty() && activeWindow->frame() == targetWindow->frame())
         return true;
 
     return false;
@@ -1171,10 +1238,17 @@ void V8Proxy::initContextIfNeeded()
     setSecurityToken();
 
     m_frame->loader()->client()->didCreateScriptContextForFrame();
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     m_frame->loader()->dispatchWindowObjectAvailable();
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::record(android::TimeCounter::JavaScriptInitTimeCounter, __FUNCTION__);
 #endif
+=======
+
+    // FIXME: This is wrong. We should actually do this for the proper world once
+    // we do isolated worlds the WebCore way.
+    m_frame->loader()->dispatchDidClearWindowObjectInWorld(0);
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 }
 
 void V8Proxy::setDOMException(int exceptionCode)
@@ -1257,8 +1331,13 @@ v8::Local<v8::Context> V8Proxy::context()
             return v8::Local<v8::Context>();
         return v8::Local<v8::Context>::New(context->get());
     }
+    return mainWorldContext();
+}
+
+v8::Local<v8::Context> V8Proxy::mainWorldContext()
+{
     initContextIfNeeded();
-    return v8::Local<v8::Context>::New(m_context);;
+    return v8::Local<v8::Context>::New(m_context);
 }
 
 v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
@@ -1267,8 +1346,7 @@ v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
     if (!proxy)
         return v8::Local<v8::Context>();
 
-    proxy->initContextIfNeeded();
-    return v8::Local<v8::Context>::New(proxy->m_context);
+    return proxy->mainWorldContext();
 }
 
 v8::Local<v8::Context> V8Proxy::currentContext()
@@ -1337,7 +1415,7 @@ void V8Proxy::createUtilityContext()
     v8::Script::Compile(v8::String::New(frameSourceNameSource))->Run();
 }
 
-int V8Proxy::sourceLineNumber()
+bool V8Proxy::sourceLineNumber(int& result)
 {
 #if PLATFORM(ANDROID)
     // TODO(andreip): consider V8's DEBUG flag here, rather than PLATFORM(ANDROID)
@@ -1347,20 +1425,29 @@ int V8Proxy::sourceLineNumber()
     v8::HandleScope scope;
     v8::Handle<v8::Context> v8UtilityContext = V8Proxy::utilityContext();
     if (v8UtilityContext.IsEmpty())
-        return 0;
+        return false;
     v8::Context::Scope contextScope(v8UtilityContext);
     v8::Handle<v8::Function> frameSourceLine;
     frameSourceLine = v8::Local<v8::Function>::Cast(v8UtilityContext->Global()->Get(v8::String::New("frameSourceLine")));
     if (frameSourceLine.IsEmpty())
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
         return 0;
     v8::Handle<v8::Value> result = v8::Debug::Call(frameSourceLine);
     if (result.IsEmpty())
         return 0;
     return result->Int32Value();
 #endif
+=======
+        return false;
+    v8::Handle<v8::Value> value = v8::Debug::Call(frameSourceLine);
+    if (value.IsEmpty())
+        return false;
+    result = value->Int32Value();
+    return true;
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 }
 
-String V8Proxy::sourceName()
+bool V8Proxy::sourceName(String& result)
 {
 #if PLATFORM(ANDROID)
     return String();
@@ -1368,14 +1455,23 @@ String V8Proxy::sourceName()
     v8::HandleScope scope;
     v8::Handle<v8::Context> v8UtilityContext = utilityContext();
     if (v8UtilityContext.IsEmpty())
-        return String();
+        return false;
     v8::Context::Scope contextScope(v8UtilityContext);
     v8::Handle<v8::Function> frameSourceName;
     frameSourceName = v8::Local<v8::Function>::Cast(v8UtilityContext->Global()->Get(v8::String::New("frameSourceName")));
     if (frameSourceName.IsEmpty())
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
         return String();
     return toWebCoreString(v8::Debug::Call(frameSourceName));
 #endif
+=======
+        return false;
+    v8::Handle<v8::Value> value = v8::Debug::Call(frameSourceName);
+    if (value.IsEmpty())
+        return false;
+    result = toWebCoreString(value);
+    return true;
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 }
 
 void V8Proxy::registerExtensionWithV8(v8::Extension* extension)
@@ -1419,20 +1515,24 @@ bool V8Proxy::setContextDebugId(int debugId)
         return false;
 
     v8::Context::Scope contextScope(m_context);
-    v8::Handle<v8::Object> contextData = v8::Object::New();
-    contextData->Set(v8::String::New(kContextDebugDataType), v8::String::New("page"));
-    contextData->Set(v8::String::New(kContextDebugDataValue), v8::Integer::New(debugId));
-    m_context->SetData(contextData);
+
+    char buffer[32];
+    snprintf(buffer, sizeof(buffer), "page,%d", debugId);
+    m_context->SetData(v8::String::New(buffer));
+
     return true;
 }
 
 int V8Proxy::contextDebugId(v8::Handle<v8::Context> context)
 {
     v8::HandleScope scope;
-    if (!context->GetData()->IsObject())
+    if (!context->GetData()->IsString())
         return -1;
-    v8::Handle<v8::Value> data = context->GetData()->ToObject()->Get( v8::String::New(kContextDebugDataValue));
-    return data->IsInt32() ? data->Int32Value() : -1;
+    v8::String::AsciiValue ascii(context->GetData());
+    char* comma = strnstr(*ascii, ",", ascii.length());
+    if (!comma)
+        return -1;
+    return atoi(comma + 1);
 }
 
 v8::Handle<v8::Value> V8Proxy::getHiddenObjectPrototype(v8::Handle<v8::Context> context)
@@ -1455,11 +1555,11 @@ void V8Proxy::installHiddenObjectPrototype(v8::Handle<v8::Context> context)
     context->Global()->SetHiddenValue(hiddenObjectPrototypeString, objectPrototype);
 }
 
-v8::Local<v8::Context> toV8Context(ScriptExecutionContext* context)
+v8::Local<v8::Context> toV8Context(ScriptExecutionContext* context, const WorldContextHandle& worldContext)
 {
     if (context->isDocument()) {
         if (V8Proxy* proxy = V8Proxy::retrieve(context))
-            return proxy->context();
+            return worldContext.adjustedContext(proxy);
     } else if (context->isWorkerContext()) {
         if (WorkerContextExecutionProxy* proxy = static_cast<WorkerContext*>(context)->script()->proxy())
             return proxy->context();
diff --git a/WebCore/bindings/v8/V8Proxy.h b/WebCore/bindings/v8/V8Proxy.h
index 86d3b39..900ee18 100644
--- a/WebCore/bindings/v8/V8Proxy.h
+++ b/WebCore/bindings/v8/V8Proxy.h
@@ -59,6 +59,7 @@ namespace WebCore {
     class String;
     class V8EventListener;
     class V8IsolatedWorld;
+    class WorldContextHandle;
 
     // FIXME: use standard logging facilities in WebCore.
     void logInfo(Frame*, const String& message, const String& url);
@@ -102,6 +103,17 @@ namespace WebCore {
 
     void batchConfigureConstants(v8::Handle<v8::FunctionTemplate>, v8::Handle<v8::ObjectTemplate>, const BatchedConstant*, size_t constantCount);
 
+    struct BatchedCallback {
+        const char* const name;
+        v8::InvocationCallback callback;
+    };
+
+    void batchConfigureCallbacks(v8::Handle<v8::ObjectTemplate>, 
+                                 v8::Handle<v8::Signature>,
+                                 v8::PropertyAttribute,
+                                 const BatchedCallback*, 
+                                 size_t callbackCount);
+
     const int kMaxRecursionDepth = 20;
 
     // Information about an extension that is registered for use with V8. If
@@ -163,11 +175,36 @@ namespace WebCore {
         // and clears all timeouts on the DOM window.
         void disconnectFrame();
 
-        bool isEnabled();
-
 #if ENABLE(SVG)
         static void setSVGContext(void*, SVGElement*);
         static SVGElement* svgContext(void*);
+
+        // These helper functions are required in case we are given a PassRefPtr
+        // to a (possibly) newly created object and must prevent its reference
+        // count from dropping to zero as would happen in code like
+        //
+        //   V8Proxy::setSVGContext(imp->getNewlyCreatedObject().get(), context);
+        //   foo(imp->getNewlyCreatedObject().get());
+        //
+        // In the above two lines each time getNewlyCreatedObject() is called it
+        // creates a new object because we don't ref() it. (So our attemts to
+        // associate a context with it fail.) Such code should be rewritten to
+        //
+        //   foo(V8Proxy::withSVGContext(imp->getNewlyCreatedObject(), context).get());
+        //
+        // where PassRefPtr::~PassRefPtr() is invoked only after foo() is
+        // called.
+        template <typename T>
+        static PassRefPtr<T> withSVGContext(PassRefPtr<T> object, SVGElement* context)
+        {
+            setSVGContext(object.get(), context);
+            return object;
+        }
+        static void* withSVGContext(void* object, SVGElement* context)
+        {
+            setSVGContext(object, context);
+            return object;
+        }
 #endif
 
         void setEventHandlerLineNumber(int lineNumber) { m_handlerLineNumber = lineNumber; }
@@ -302,15 +339,16 @@ namespace WebCore {
 
         // Function for retrieving the line number and source name for the top
         // JavaScript stack frame.
-        static int sourceLineNumber();
-        static String sourceName();
+        //
+        // It will return true if the line number was successfully retrieved and written
+        // into the |result| parameter, otherwise the function will return false. It may
+        // fail due to a stck overflow in the underlying JavaScript implentation, handling
+        // of such exception is up to the caller.
+        static bool sourceLineNumber(int& result);
+        static bool sourceName(String& result);
 
         v8::Local<v8::Context> context();
-
-        PassRefPtr<V8ListenerGuard> listenerGuard()
-        {
-            return m_listenerGuard;
-        }
+        v8::Local<v8::Context> mainWorldContext();
 
         bool setContextDebugId(int id);
         static int contextDebugId(v8::Handle<v8::Context>);
@@ -337,9 +375,6 @@ namespace WebCore {
         void updateDocumentWrapper(v8::Handle<v8::Value> wrapper);
 
     private:
-        static const char* kContextDebugDataType;
-        static const char* kContextDebugDataValue;
-
         void setSecurityToken();
         void clearDocumentWrapper();
 
@@ -357,11 +392,10 @@ namespace WebCore {
         // the storage mutex.
         void releaseStorageMutex();
 
-        void disconnectEventListeners();
-        
         void resetIsolatedWorlds();
 
-        void setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext);
+        // Returns false when we're out of memory in V8.
+        bool setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext);
 
         static bool canAccessPrivate(DOMWindow*);
 
@@ -397,8 +431,6 @@ namespace WebCore {
 
         v8::Persistent<v8::Context> m_context;
 
-        RefPtr<V8ListenerGuard> m_listenerGuard;
-
         // For each possible type of wrapper, we keep a boilerplate object.
         // The boilerplate is used to create additional wrappers of the same
         // type.  We keep a single persistent handle to an array of the
@@ -456,7 +488,7 @@ namespace WebCore {
     }
 
 
-    v8::Local<v8::Context> toV8Context(ScriptExecutionContext*);
+    v8::Local<v8::Context> toV8Context(ScriptExecutionContext*, const WorldContextHandle& worldContext);
 
     // Used by an interceptor callback that it hasn't found anything to
     // intercept.
diff --git a/WebCore/bindings/v8/V8Utilities.cpp b/WebCore/bindings/v8/V8Utilities.cpp
index ecac358..c547cc7 100644
--- a/WebCore/bindings/v8/V8Utilities.cpp
+++ b/WebCore/bindings/v8/V8Utilities.cpp
@@ -76,6 +76,24 @@ void removeHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value>
         }
     }
 }
+    
+void transferHiddenDependency(v8::Handle<v8::Object> object,
+                              EventListener* oldValue, 
+                              v8::Local<v8::Value> newValue, 
+                              int cacheIndex)
+{
+    if (oldValue) {
+        V8AbstractEventListener* oldListener = V8AbstractEventListener::cast(oldValue);
+        if (oldListener) {
+            v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();
+            if (!oldListenerObject.IsEmpty())
+                removeHiddenDependency(object, oldListenerObject, cacheIndex);
+        }
+    }
+    if (!newValue->IsNull() && !newValue->IsUndefined())
+        createHiddenDependency(object, newValue, cacheIndex);
+}
+    
 
 bool processingUserGesture()
 {
@@ -147,7 +165,12 @@ void reportException(ScriptState* scriptState, v8::TryCatch& exceptionCatcher)
         sourceURL = toWebCoreString(message->GetScriptResourceName());
     }
 
-    getScriptExecutionContext(scriptState)->reportException(errorMessage, lineNumber, sourceURL);
+    // Do not report the exception if the current execution context is Document because we do not want to lead to duplicate error messages in the console.
+    // FIXME (31171): need better design to solve the duplicate error message reporting problem.
+    ScriptExecutionContext* context = getScriptExecutionContext(scriptState);
+    // During the frame teardown, there may not be a valid context.
+    if (context && !context->isDocument())
+      context->reportException(errorMessage, lineNumber, sourceURL);
     exceptionCatcher.Reset();
 }
 
diff --git a/WebCore/bindings/v8/V8Utilities.h b/WebCore/bindings/v8/V8Utilities.h
index 36dce24..944823a 100644
--- a/WebCore/bindings/v8/V8Utilities.h
+++ b/WebCore/bindings/v8/V8Utilities.h
@@ -35,6 +35,7 @@
 
 namespace WebCore {
 
+    class EventListener;
     class Frame;
     class KURL;
     class ScriptExecutionContext;
@@ -44,7 +45,10 @@ namespace WebCore {
     // Use an array to hold dependents. It works like a ref-counted scheme. A value can be added more than once to the DOM object.
     void createHiddenDependency(v8::Handle<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
     void removeHiddenDependency(v8::Handle<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
-
+    
+    // Combo create/remove, for generated event-handler-setter bindings:
+    void transferHiddenDependency(v8::Handle<v8::Object>, EventListener* oldValue, v8::Local<v8::Value> newValue, int cacheIndex);
+    
     bool processingUserGesture();
     bool shouldAllowNavigation(Frame*);
     KURL completeURL(const String& relativeURL);
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
index 8dc4b8d..e5356de 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
@@ -48,15 +48,14 @@ static WorkerContextExecutionProxy* workerProxy(ScriptExecutionContext* context)
     return workerContext->script()->proxy();
 }
 
-V8WorkerContextEventListener::V8WorkerContextEventListener(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
-    : V8EventListener(guard, listener, isInline)
+V8WorkerContextEventListener::V8WorkerContextEventListener(v8::Local<v8::Object> listener, bool isInline, const WorldContextHandle& worldContext)
+    : V8EventListener(listener, isInline, worldContext)
 {
 }
 
 void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
 {
-    // Is the EventListener disconnected?
-    if (disconnected())
+    if (!context)
         return;
 
     // The callback function on XMLHttpRequest can clear the event listener and destroys 'this' object. Keep a local reference to it.
@@ -84,8 +83,7 @@ void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext* context,
 
 bool V8WorkerContextEventListener::reportError(ScriptExecutionContext* context, const String& message, const String& url, int lineNumber)
 {
-    // Is the EventListener disconnected?
-    if (disconnected())
+    if (!context)
         return false;
 
     // The callback function can clear the event listener and destroy 'this' object. Keep a local reference to it.
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.h b/WebCore/bindings/v8/V8WorkerContextEventListener.h
index 3f9f862..4487497 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.h
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.h
@@ -44,16 +44,16 @@ namespace WebCore {
 
     class V8WorkerContextEventListener : public V8EventListener {
     public:
-        static PassRefPtr<V8WorkerContextEventListener> create(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
+        static PassRefPtr<V8WorkerContextEventListener> create(v8::Local<v8::Object> listener, bool isInline, const WorldContextHandle& worldContext)
         {
-            return adoptRef(new V8WorkerContextEventListener(guard, listener, isInline));
+            return adoptRef(new V8WorkerContextEventListener(listener, isInline, worldContext));
         }
 
         virtual void handleEvent(ScriptExecutionContext*, Event*);
         virtual bool reportError(ScriptExecutionContext*, const String& message, const String& url, int lineNumber);
 
     private:
-        V8WorkerContextEventListener(PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isInline);
+        V8WorkerContextEventListener(v8::Local<v8::Object> listener, bool isInline, const WorldContextHandle& worldContext);
 
         virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsEvent, Event*);
         v8::Local<v8::Object> getReceiverObject(ScriptExecutionContext*, Event*);
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index 0fd0f8f..8c66d7b 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -72,7 +72,6 @@ static void reportFatalErrorInV8(const char* location, const char* message)
 WorkerContextExecutionProxy::WorkerContextExecutionProxy(WorkerContext* workerContext)
     : m_workerContext(workerContext)
     , m_recursion(0)
-    , m_listenerGuard(V8ListenerGuard::create())
 {
     initV8IfNeeded();
 }
@@ -84,8 +83,6 @@ WorkerContextExecutionProxy::~WorkerContextExecutionProxy()
 
 void WorkerContextExecutionProxy::dispose()
 {
-    m_listenerGuard->disconnectListeners();
-
     // Detach all events from their JS wrappers.
     for (size_t eventIndex = 0; eventIndex < m_events.size(); ++eventIndex) {
         Event* event = m_events[eventIndex];
@@ -158,7 +155,12 @@ void WorkerContextExecutionProxy::initContextIfNeeded()
     v8::Handle<v8::String> implicitProtoString = v8::String::New("__proto__");
 
     // Create a new JS object and use it as the prototype for the shadow global object.
-    v8::Handle<v8::Function> workerContextConstructor = V8DOMWrapper::getConstructorForContext(V8ClassIndex::DEDICATEDWORKERCONTEXT, context);
+    V8ClassIndex::V8WrapperType contextType = V8ClassIndex::DEDICATEDWORKERCONTEXT;
+#if ENABLE(SHARED_WORKERS)
+    if (!m_workerContext->isDedicatedWorkerContext())
+        contextType = V8ClassIndex::SHAREDWORKERCONTEXT;
+#endif
+    v8::Handle<v8::Function> workerContextConstructor = V8DOMWrapper::getConstructorForContext(contextType, context);
     v8::Local<v8::Object> jsWorkerContext = SafeAllocation::newInstance(workerContextConstructor);
     // Bail out if allocation failed.
     if (jsWorkerContext.IsEmpty()) {
@@ -167,7 +169,7 @@ void WorkerContextExecutionProxy::initContextIfNeeded()
     }
 
     // Wrap the object.
-    V8DOMWrapper::setDOMWrapper(jsWorkerContext, V8ClassIndex::ToInt(V8ClassIndex::DEDICATEDWORKERCONTEXT), m_workerContext);
+    V8DOMWrapper::setDOMWrapper(jsWorkerContext, V8ClassIndex::ToInt(contextType), m_workerContext);
 
     V8DOMWrapper::setJSWrapperForDOMObject(m_workerContext, v8::Persistent<v8::Object>::New(jsWorkerContext));
     m_workerContext->ref();
@@ -182,7 +184,11 @@ v8::Handle<v8::Value> WorkerContextExecutionProxy::convertToV8Object(V8ClassInde
     if (!impl)
         return v8::Null();
 
-    if (type == V8ClassIndex::DEDICATEDWORKERCONTEXT)
+    if (type == V8ClassIndex::DEDICATEDWORKERCONTEXT
+#if ENABLE(SHARED_WORKERS)
+        || type == V8ClassIndex::SHAREDWORKERCONTEXT
+#endif
+        )
         return convertWorkerContextToV8Object(static_cast<WorkerContext*>(impl));
 
     bool isActiveDomObject = false;
@@ -294,10 +300,22 @@ v8::Handle<v8::Value> WorkerContextExecutionProxy::convertEventTargetToV8Object(
     if (workerContext)
         return convertWorkerContextToV8Object(workerContext);
 
+#if ENABLE(SHARED_WORKERS)
+    SharedWorkerContext* sharedWorkerContext = target->toSharedWorkerContext();
+    if (sharedWorkerContext)
+        return convertWorkerContextToV8Object(sharedWorkerContext);
+#endif
+
     Worker* worker = target->toWorker();
     if (worker)
         return convertToV8Object(V8ClassIndex::WORKER, worker);
 
+#if ENABLE(SHARED_WORKERS)
+    SharedWorker* sharedWorker = target->toSharedWorker();
+    if (sharedWorker)
+        return convertToV8Object(V8ClassIndex::SHAREDWORKER, sharedWorker);
+#endif
+
     XMLHttpRequest* xhr = target->toXMLHttpRequest();
     if (xhr)
         return convertToV8Object(V8ClassIndex::XMLHTTPREQUEST, xhr);
@@ -411,7 +429,7 @@ v8::Local<v8::Value> WorkerContextExecutionProxy::runScript(v8::Handle<v8::Scrip
 
 PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
 {
-    return findOnly ? V8EventListenerList::findWrapper(object, isInline) : V8EventListenerList::findOrCreateWrapper<V8WorkerContextEventListener>(m_listenerGuard, object, isInline);
+    return findOnly ? V8EventListenerList::findWrapper(object, isInline) : V8EventListenerList::findOrCreateWrapper<V8WorkerContextEventListener>(object, isInline);
 }
 
 void WorkerContextExecutionProxy::trackEvent(Event* event)
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index e723bc6..3b8ab9e 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -112,7 +112,6 @@ namespace WebCore {
         WorkerContext* m_workerContext;
         v8::Persistent<v8::Context> m_context;
         int m_recursion;
-        RefPtr<V8ListenerGuard> m_listenerGuard;
 
         Vector<Event*> m_events;
     };
diff --git a/WebCore/bindings/v8/WorldContextHandle.cpp b/WebCore/bindings/v8/WorldContextHandle.cpp
new file mode 100644
index 0000000..eb83586
--- /dev/null
+++ b/WebCore/bindings/v8/WorldContextHandle.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorldContextHandle.h"
+
+#include "V8IsolatedWorld.h"
+
+namespace WebCore {
+
+WorldContextHandle::WorldContextHandle(WorldToUse worldToUse)
+    : m_worldToUse(worldToUse)
+{
+    if (worldToUse == UseMainWorld)
+        return;
+
+    if (V8IsolatedWorld* world = V8IsolatedWorld::getEntered())
+        m_context = world->sharedContext();
+}
+
+v8::Local<v8::Context> WorldContextHandle::adjustedContext(V8Proxy* proxy) const
+{
+    if (m_worldToUse == UseMainWorld)
+        return proxy->mainWorldContext();
+    if (!m_context || m_context->get().IsEmpty())
+        return proxy->context();
+    return v8::Local<v8::Context>::New(m_context->get());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/WorldContextHandle.h b/WebCore/bindings/v8/WorldContextHandle.h
new file mode 100644
index 0000000..ad0983e
--- /dev/null
+++ b/WebCore/bindings/v8/WorldContextHandle.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorldContextHandle_h
+#define WorldContextHandle_h
+
+#include "SharedPersistent.h"
+
+#include <v8.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class V8Proxy;
+
+enum WorldToUse { UseMainWorld, UseCurrentWorld };
+
+class WorldContextHandle {
+public:
+    WorldContextHandle(WorldToUse);
+    v8::Local<v8::Context> adjustedContext(V8Proxy*) const;
+
+private:
+    WorldToUse m_worldToUse;
+    RefPtr<SharedPersistent<v8::Context> > m_context;
+};
+
+} // namespace WebCore
+
+#endif // WorldContextHandle_h
diff --git a/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h b/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h
deleted file mode 100644
index 311b838..0000000
--- a/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-
-#include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CustomBinding.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-    // Template function used by the CanvasArray*Constructor callbacks.
-    template<class ArrayClass>
-    v8::Handle<v8::Value> constructCanvasArray(const v8::Arguments& args,
-                                               int classIndex)
-    {
-        if (!args.IsConstructCall())
-            return throwError("DOM object constructor cannot be called as a function.");
-
-        int argLen = args.Length();
-        // Supported constructors:
-        // Canvas<T>Array(n) where n is an integer:
-        //   -- create an empty array of n elements
-        // Canvas<T>Array(arr) where arr is an array:
-        //   -- create a Canvas<T>Array containing the contents of "arr"
-        // Canvas<T>Array(buf, offset, length)
-        //   -- create a Canvas<T>Array pointing to the CanvasArrayBuffer
-        //      "buf", starting at the specified offset, for the given
-        //      length
-
-        if (argLen == 0)
-            return throwError("No arguments specified to constructor");
-
-        // See whether the first argument is a CanvasArrayBuffer.
-        if (V8CanvasArrayBuffer::HasInstance(args[0])) {
-            if (argLen > 3)
-                return throwError("Wrong number of arguments to new Canvas<T>Array(CanvasArrayBuffer, int, int)");
-
-            CanvasArrayBuffer* buf =
-                V8DOMWrapper::convertToNativeObject<CanvasArrayBuffer>(V8ClassIndex::CANVASARRAYBUFFER,
-                                                                       args[0]->ToObject());
-            if (buf == NULL)
-                return throwError("Could not convert argument 0 to a CanvasArrayBuffer");
-            bool ok;
-            int offset = 0;
-            if (argLen > 1) {
-                offset = toInt32(args[1], ok);
-                if (!ok)
-                    return throwError("Could not convert argument 1 to an integer");
-            }
-            int length = buf->byteLength() - offset;
-            if (argLen > 2) {
-                length = toInt32(args[2], ok);
-                if (!ok)
-                    return throwError("Could not convert argument 2 to an integer");
-            }
-            if (length < 0)
-                return throwError("Length / offset out of range");
-
-            RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
-            if (array == NULL)
-                return throwError("Invalid arguments to new Canvas<T>Array(CanvasArrayBuffer, int, int)");
-            // Transform the holder into a wrapper object for the array.
-            V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
-            return toV8(array.release(), args.Holder());
-        }
-
-        int len = 0;
-        v8::Handle<v8::Array> srcArray;
-        if (argLen != 1)
-            return throwError("Wrong number of arguments to new Canvas<T>Array(int / array)");
-
-        if (args[0]->IsInt32()) {
-            len = toInt32(args[0]);
-        } else if (args[0]->IsArray()) {
-            srcArray = v8::Local<v8::Array>::Cast(args[0]);
-            if (srcArray.IsEmpty())
-                return throwError("Could not convert argument 0 to an array");
-            len = srcArray->Length();
-        } else
-            return throwError("Could not convert argument 0 to either an int32 or an array");
-
-        RefPtr<ArrayClass> array = ArrayClass::create(len);
-        if (!srcArray.IsEmpty()) {
-            // Need to copy the incoming array into the newly created CanvasArray.
-            for (int i = 0; i < len; i++) {
-                v8::Local<v8::Value> val = srcArray->Get(v8::Integer::New(i));
-                if (!val->IsNumber()) {
-                    char buf[256];
-                    sprintf(buf, "Could not convert array element %d to a number", i);
-                    return throwError(buf);
-                }
-                array->set(i, val->NumberValue());
-            }
-        }
-
-        // Transform the holder into a wrapper object for the array.
-        V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
-        return toV8(array.release(), args.Holder());
-    }
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp
deleted file mode 100644
index c109bb8..0000000
--- a/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp
+++ /dev/null
@@ -1,597 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasRenderingContext3D.h"
-
-#include "ExceptionCode.h"
-
-#include "NotImplemented.h"
-
-#include <wtf/FastMalloc.h>
-
-#include "V8Binding.h"
-#include "V8CanvasArray.h"
-#include "V8CanvasByteArray.h"
-#include "V8CanvasFloatArray.h"
-#include "V8CanvasIntArray.h"
-#include "V8CanvasShortArray.h"
-#include "V8CanvasUnsignedByteArray.h"
-#include "V8CanvasUnsignedIntArray.h"
-#include "V8CanvasUnsignedShortArray.h"
-#include "V8HTMLImageElement.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-// Allocates new storage via tryFastMalloc.
-// Returns NULL if array failed to convert for any reason.
-static float* jsArrayToFloatArray(v8::Handle<v8::Array> array, uint32_t len)
-{
-    // Convert the data element-by-element.
-    float* data;
-    if (!tryFastMalloc(len * sizeof(float)).getValue(data))
-        return 0;
-    for (uint32_t i = 0; i < len; i++) {
-        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
-        if (!val->IsNumber()) {
-            fastFree(data);
-            return 0;
-        }
-        data[i] = toFloat(val);
-    }
-    return data;
-}
-
-// Allocates new storage via tryFastMalloc.
-// Returns NULL if array failed to convert for any reason.
-static int* jsArrayToIntArray(v8::Handle<v8::Array> array, uint32_t len)
-{
-    // Convert the data element-by-element.
-    int* data;
-    if (!tryFastMalloc(len * sizeof(int)).getValue(data))
-        return 0;
-    for (uint32_t i = 0; i < len; i++) {
-        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
-        bool ok;
-        int ival = toInt32(val, ok);
-        if (!ok) {
-            fastFree(data);
-            return 0;
-        }
-        data[i] = ival;
-    }
-    return data;
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DBufferData)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.bufferData()");
-
-    // Forms:
-    // * bufferData(GLenum target, CanvasArray data, GLenum usage);
-    //   - Sets the buffer's data from the given CanvasArray
-    // * bufferData(GLenum target, GLsizeiptr size, GLenum usage);
-    //   - Sets the size of the buffer to the given size in bytes
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int target = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    int usage = toInt32(args[2], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (args[1]->IsInt32()) {
-        int size = toInt32(args[1]);
-        context->bufferData(target, size, usage);
-    } else if (V8CanvasArray::HasInstance(args[1])) {
-        CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, args[1]->ToObject());
-        context->bufferData(target, array, usage);
-    } else {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DBufferSubData)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.bufferSubData()");
-
-    // Forms:
-    // * bufferSubData(GLenum target, GLintptr offset, CanvasArray data);
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int target = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    int offset = toInt32(args[1], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (!V8CanvasArray::HasInstance(args[2])) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, args[2]->ToObject());
-    context->bufferSubData(target, offset, array);
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DTexImage2D)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.texImage2D()");
-
-    // Currently supported forms:
-    // * void texImage2D(in GLenum target, in GLint level,
-    //                   in GLint internalformat,
-    //                   in GLsizei width, in GLsizei height, in GLint border,
-    //                   in GLenum format, in GLenum type, in CanvasArray pixels);
-    // * void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
-    //                   [Optional] in GLboolean flipY, [Optional] in GLboolean premultiplyAlpha);
-    if (args.Length() != 3 &&
-        args.Length() != 4 &&
-        args.Length() != 5 &&
-        args.Length() != 9) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int target = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    int level = toInt32(args[1], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    ExceptionCode ec = 0;
-    if (args.Length() == 3 ||
-        args.Length() == 4 ||
-        args.Length() == 5) {
-        v8::Handle<v8::Value> arg = args[2];
-        if (V8HTMLImageElement::HasInstance(arg)) {
-            HTMLImageElement* image_element = V8DOMWrapper::convertDOMWrapperToNode<HTMLImageElement>(v8::Handle<v8::Object>::Cast(arg));
-            bool flipY = false;
-            bool premultiplyAlpha = false;
-            if (args.Length() >= 4)
-                flipY = args[3]->BooleanValue();
-            if (args.Length() >= 5)
-                premultiplyAlpha = args[4]->BooleanValue();
-            context->texImage2D(target, level, image_element, flipY, premultiplyAlpha, ec);
-        } else {
-            // FIXME: consider different / better exception type.
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        // Fall through
-    } else if (args.Length() == 9) {
-        int internalformat = toInt32(args[2], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int width = toInt32(args[3], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int height = toInt32(args[4], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int border = toInt32(args[5], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int format = toInt32(args[6], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int type = toInt32(args[7], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        v8::Handle<v8::Value> arg = args[8];
-        if (V8CanvasArray::HasInstance(arg)) {
-            CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, arg->ToObject());
-            // FIXME: must do validation similar to JOGL's to ensure that
-            // the incoming array is of the appropriate length and type
-            context->texImage2D(target,
-                                level,
-                                internalformat,
-                                width,
-                                height,
-                                border,
-                                format,
-                                type,
-                                array,
-                                ec);
-            // Fall through
-        } else {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-    } else {
-        ASSERT_NOT_REACHED();
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (ec) {
-        V8Proxy::setDOMException(ec);
-        return v8::Handle<v8::Value>();
-    }
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DTexSubImage2D)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.texSubImage2D()");
-
-    // FIXME: implement
-    notImplemented();
-
-    return v8::Undefined();
-}
-
-enum FunctionToCall {
-    kUniform1v, kUniform2v, kUniform3v, kUniform4v,
-    kVertexAttrib1v, kVertexAttrib2v, kVertexAttrib3v, kVertexAttrib4v
-};
-
-static v8::Handle<v8::Value> vertexAttribAndUniformHelperf(const v8::Arguments& args,
-                                                           FunctionToCall functionToCall) {
-    // Forms:
-    // * glUniform1fv(GLint location, Array data);
-    // * glUniform1fv(GLint location, CanvasFloatArray data);
-    // * glUniform2fv(GLint location, Array data);
-    // * glUniform2fv(GLint location, CanvasFloatArray data);
-    // * glUniform3fv(GLint location, Array data);
-    // * glUniform3fv(GLint location, CanvasFloatArray data);
-    // * glUniform4fv(GLint location, Array data);
-    // * glUniform4fv(GLint location, CanvasFloatArray data);
-    // * glVertexAttrib1fv(GLint location, Array data);
-    // * glVertexAttrib1fv(GLint location, CanvasFloatArray data);
-    // * glVertexAttrib2fv(GLint location, Array data);
-    // * glVertexAttrib2fv(GLint location, CanvasFloatArray data);
-    // * glVertexAttrib3fv(GLint location, Array data);
-    // * glVertexAttrib3fv(GLint location, CanvasFloatArray data);
-    // * glVertexAttrib4fv(GLint location, Array data);
-    // * glVertexAttrib4fv(GLint location, CanvasFloatArray data);
-
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int location = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (V8CanvasFloatArray::HasInstance(args[1])) {
-        CanvasFloatArray* array = 
-            V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, args[1]->ToObject());
-        ASSERT(array != NULL);
-        switch (functionToCall) {
-            case kUniform1v: context->uniform1fv(location, array); break;
-            case kUniform2v: context->uniform2fv(location, array); break;
-            case kUniform3v: context->uniform3fv(location, array); break;
-            case kUniform4v: context->uniform4fv(location, array); break;
-            case kVertexAttrib1v: context->vertexAttrib1fv(location, array); break;
-            case kVertexAttrib2v: context->vertexAttrib2fv(location, array); break;
-            case kVertexAttrib3v: context->vertexAttrib3fv(location, array); break;
-            case kVertexAttrib4v: context->vertexAttrib4fv(location, array); break;
-            default: ASSERT_NOT_REACHED(); break;
-        }
-        return v8::Undefined();
-    }
-
-    v8::Handle<v8::Array> array =
-      v8::Local<v8::Array>::Cast(args[1]);
-    if (array.IsEmpty()) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    uint32_t len = array->Length();
-    float* data = jsArrayToFloatArray(array, len);
-    if (!data) {
-        // FIXME: consider different / better exception type.
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    switch (functionToCall) {
-        case kUniform1v: context->uniform1fv(location, data, len); break;
-        case kUniform2v: context->uniform2fv(location, data, len); break;
-        case kUniform3v: context->uniform3fv(location, data, len); break;
-        case kUniform4v: context->uniform4fv(location, data, len); break;
-        case kVertexAttrib1v: context->vertexAttrib1fv(location, data, len); break;
-        case kVertexAttrib2v: context->vertexAttrib2fv(location, data, len); break;
-        case kVertexAttrib3v: context->vertexAttrib3fv(location, data, len); break;
-        case kVertexAttrib4v: context->vertexAttrib4fv(location, data, len); break;
-        default: ASSERT_NOT_REACHED(); break;
-    }
-    fastFree(data);
-    return v8::Undefined();
-}
-
-static v8::Handle<v8::Value> uniformHelperi(const v8::Arguments& args,
-                                            FunctionToCall functionToCall) {
-    // Forms:
-    // * glUniform1iv(GLint location, Array data);
-    // * glUniform1iv(GLint location, CanvasIntArray data);
-    // * glUniform2iv(GLint location, Array data);
-    // * glUniform2iv(GLint location, CanvasIntArray data);
-    // * glUniform3iv(GLint location, Array data);
-    // * glUniform3iv(GLint location, CanvasIntArray data);
-    // * glUniform4iv(GLint location, Array data);
-    // * glUniform4iv(GLint location, CanvasIntArray data);
-
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int location = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (V8CanvasIntArray::HasInstance(args[1])) {
-        CanvasIntArray* array = 
-            V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, args[1]->ToObject());
-        ASSERT(array != NULL);
-        switch (functionToCall) {
-            case kUniform1v: context->uniform1iv(location, array); break;
-            case kUniform2v: context->uniform2iv(location, array); break;
-            case kUniform3v: context->uniform3iv(location, array); break;
-            case kUniform4v: context->uniform4iv(location, array); break;
-            default: ASSERT_NOT_REACHED(); break;
-        }
-        return v8::Undefined();
-    }
-
-    v8::Handle<v8::Array> array =
-      v8::Local<v8::Array>::Cast(args[1]);
-    if (array.IsEmpty()) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    uint32_t len = array->Length();
-    int* data = jsArrayToIntArray(array, len);
-    if (!data) {
-        // FIXME: consider different / better exception type.
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    switch (functionToCall) {
-        case kUniform1v: context->uniform1iv(location, data, len); break;
-        case kUniform2v: context->uniform2iv(location, data, len); break;
-        case kUniform3v: context->uniform3iv(location, data, len); break;
-        case kUniform4v: context->uniform4iv(location, data, len); break;
-        default: ASSERT_NOT_REACHED(); break;
-    }
-    fastFree(data);
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform1fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform1fv()");
-    return vertexAttribAndUniformHelperf(args, kUniform1v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform1iv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform1iv()");
-    return uniformHelperi(args, kUniform1v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform2fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform2fv()");
-    return vertexAttribAndUniformHelperf(args, kUniform2v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform2iv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform2iv()");
-    return uniformHelperi(args, kUniform2v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform3fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform3fv()");
-    return vertexAttribAndUniformHelperf(args, kUniform3v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform3iv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform3iv()");
-    return uniformHelperi(args, kUniform3v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform4fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform4fv()");
-    return vertexAttribAndUniformHelperf(args, kUniform4v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform4iv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform4iv()");
-    return uniformHelperi(args, kUniform4v);
-}
-
-static v8::Handle<v8::Value> uniformMatrixHelper(const v8::Arguments& args,
-                                                 int matrixSize)
-{
-    // Forms:
-    // * glUniformMatrix2fv(GLint location, GLboolean transpose, Array data);
-    // * glUniformMatrix2fv(GLint location, GLboolean transpose, CanvasFloatArray data);
-    // * glUniformMatrix3fv(GLint location, GLboolean transpose, Array data);
-    // * glUniformMatrix3fv(GLint location, GLboolean transpose, CanvasFloatArray data);
-    // * glUniformMatrix4fv(GLint location, GLboolean transpose, Array data);
-    // * glUniformMatrix4fv(GLint location, GLboolean transpose, CanvasFloatArray data);
-    //
-    // FIXME: need to change to accept CanvasFloatArray as well.
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int location = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    bool transpose = args[1]->BooleanValue();
-    if (V8CanvasFloatArray::HasInstance(args[2])) {
-        CanvasFloatArray* array = 
-            V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, args[2]->ToObject());
-        ASSERT(array != NULL);
-        switch (matrixSize) {
-            case 2: context->uniformMatrix2fv(location, transpose, array); break;
-            case 3: context->uniformMatrix3fv(location, transpose, array); break;
-            case 4: context->uniformMatrix4fv(location, transpose, array); break;
-            default: ASSERT_NOT_REACHED(); break;
-        }
-        return v8::Undefined();
-    }
-
-    v8::Handle<v8::Array> array =
-      v8::Local<v8::Array>::Cast(args[2]);
-    if (array.IsEmpty()) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    uint32_t len = array->Length();
-    float* data = jsArrayToFloatArray(array, len);
-    if (!data) {
-        // FIXME: consider different / better exception type.
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    switch (matrixSize) {
-        case 2: context->uniformMatrix2fv(location, transpose, data, len); break;
-        case 3: context->uniformMatrix3fv(location, transpose, data, len); break;
-        case 4: context->uniformMatrix4fv(location, transpose, data, len); break;
-        default: ASSERT_NOT_REACHED(); break;
-    }
-    fastFree(data);
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix2fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix2fv()");
-    return uniformMatrixHelper(args, 2);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix3fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix3fv()");
-    return uniformMatrixHelper(args, 3);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix4fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix4fv()");
-    return uniformMatrixHelper(args, 4);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib1fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib1fv()");
-    return vertexAttribAndUniformHelperf(args, kVertexAttrib1v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib2fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib2fv()");
-    return vertexAttribAndUniformHelperf(args, kVertexAttrib2v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib3fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib3fv()");
-    return vertexAttribAndUniformHelperf(args, kVertexAttrib3v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib4fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib4fv()");
-    return vertexAttribAndUniformHelperf(args, kVertexAttrib4v);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasPixelArrayCustom.cpp b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
index 5fe2710..b44e074 100644
--- a/WebCore/bindings/v8/custom/V8CanvasPixelArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
@@ -29,37 +29,28 @@
  */
 
 #include "config.h"
-#include "CanvasPixelArray.h"
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
+#include <v8.h>
 
 namespace WebCore {
 
-// Get the specified value from the pixel buffer and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasPixelArray)
+CALLBACK_FUNC_DECL(ConsoleProfile)
 {
-    INC_STATS("DOM.CanvasPixelArray.IndexedPropertyGetter");
-    CanvasPixelArray* pixelBuffer = V8DOMWrapper::convertToNativeObject<CanvasPixelArray>(V8ClassIndex::CANVASPIXELARRAY, info.Holder());
-
-    if ((index < 0) || (index >= pixelBuffer->length()))
-        return v8::Undefined();
-    unsigned char result;
-    if (!pixelBuffer->get(index, result))
-        return v8::Undefined();
-    return v8::Number::New(result);
+    INC_STATS("console.profile()");
+    v8::HandleScope scope;
+    v8::Context::Scope context_scope(v8::Context::GetCurrent());
+    v8::V8::ResumeProfiler();
+    return v8::Undefined();
 }
 
-// Set the specified value in the pixel buffer. Accesses outside the valid pixel buffer range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasPixelArray)
+CALLBACK_FUNC_DECL(ConsoleProfileEnd)
 {
-    INC_STATS("DOM.CanvasPixelArray.IndexedPropertySetter");
-    CanvasPixelArray* pixelBuffer = V8DOMWrapper::convertToNativeObject<CanvasPixelArray>(V8ClassIndex::CANVASPIXELARRAY, info.Holder());
-
-    if ((index >= 0) && (index < pixelBuffer->length()))
-        pixelBuffer->set(index, value->NumberValue());
-    return value;
+    INC_STATS("console.profileEnd()");
+    v8::V8::PauseProfiler();
+    return v8::Undefined();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomBinding.h b/WebCore/bindings/v8/custom/V8CustomBinding.h
index 06182c9..e7670b7 100644
--- a/WebCore/bindings/v8/custom/V8CustomBinding.h
+++ b/WebCore/bindings/v8/custom/V8CustomBinding.h
@@ -120,8 +120,7 @@ namespace WebCore {
         static const int kMessageChannelInternalFieldCount = kDefaultWrapperInternalFieldCount + 2;
 
         static const int kMessagePortRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
-        static const int kMessagePortEntangledPortIndex = kDefaultWrapperInternalFieldCount + 1;
-        static const int kMessagePortInternalFieldCount = kDefaultWrapperInternalFieldCount + 2;
+        static const int kMessagePortInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
 
 #if ENABLE(WORKERS)
         static const int kAbstractWorkerRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
@@ -169,10 +168,13 @@ namespace WebCore {
         static const int kDOMWindowLocationIndex = kDefaultWrapperInternalFieldCount + 11;
         static const int kDOMWindowDOMSelectionIndex = kDefaultWrapperInternalFieldCount + 12;
         static const int kDOMWindowEventListenerCacheIndex = kDefaultWrapperInternalFieldCount + 13;
-        static const int kDOMWindowInternalFieldCount = kDefaultWrapperInternalFieldCount + 14;
+        static const int kDOMWindowEnteredIsolatedWorldIndex = kDefaultWrapperInternalFieldCount + 14;
+        static const int kDOMWindowInternalFieldCount = kDefaultWrapperInternalFieldCount + 15;
 
         static const int kStyleSheetOwnerNodeIndex = kDefaultWrapperInternalFieldCount + 0;
         static const int kStyleSheetInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+        static const int kNamedNodeMapOwnerNodeIndex = kDefaultWrapperInternalFieldCount + 0;
+        static const int kNamedNodeMapInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         static const int kDOMApplicationCacheCacheIndex = kDefaultWrapperInternalFieldCount + 0;
@@ -363,35 +365,43 @@ namespace WebCore {
         DECLARE_CALLBACK(CanvasRenderingContext2DPutImageData);
 
 #if ENABLE(3D_CANVAS)
-        DECLARE_CALLBACK(CanvasRenderingContext3DBufferData);
-        DECLARE_CALLBACK(CanvasRenderingContext3DBufferSubData);
-        DECLARE_CALLBACK(CanvasRenderingContext3DSizeof);
-        DECLARE_CALLBACK(CanvasRenderingContext3DTexImage2D);
-        DECLARE_CALLBACK(CanvasRenderingContext3DTexSubImage2D);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform1fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform1iv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform2fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform2iv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform3fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform3iv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform4fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform4iv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix2fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix3fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix4fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib1fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib2fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib3fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib4fv);
-
-        DECLARE_CALLBACK(CanvasArrayBufferConstructor);
-        DECLARE_CALLBACK(CanvasByteArrayConstructor);
-        DECLARE_CALLBACK(CanvasFloatArrayConstructor);
-        DECLARE_CALLBACK(CanvasIntArrayConstructor);
-        DECLARE_CALLBACK(CanvasShortArrayConstructor);
-        DECLARE_CALLBACK(CanvasUnsignedByteArrayConstructor);
-        DECLARE_CALLBACK(CanvasUnsignedIntArrayConstructor);
-        DECLARE_CALLBACK(CanvasUnsignedShortArrayConstructor);
+        DECLARE_CALLBACK(WebGLRenderingContextBufferData);
+        DECLARE_CALLBACK(WebGLRenderingContextBufferSubData);
+        DECLARE_CALLBACK(WebGLRenderingContextGetBufferParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetFramebufferAttachmentParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetProgramParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetRenderbufferParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetShaderParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetTexParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetUniform);
+        DECLARE_CALLBACK(WebGLRenderingContextGetVertexAttrib);
+        DECLARE_CALLBACK(WebGLRenderingContextTexImage2D);
+        DECLARE_CALLBACK(WebGLRenderingContextTexSubImage2D);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform1fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform1iv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform2fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform2iv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform3fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform3iv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform4fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform4iv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniformMatrix2fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniformMatrix3fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniformMatrix4fv);
+        DECLARE_CALLBACK(WebGLRenderingContextVertexAttrib1fv);
+        DECLARE_CALLBACK(WebGLRenderingContextVertexAttrib2fv);
+        DECLARE_CALLBACK(WebGLRenderingContextVertexAttrib3fv);
+        DECLARE_CALLBACK(WebGLRenderingContextVertexAttrib4fv);
+
+        DECLARE_CALLBACK(WebGLArrayBufferConstructor);
+        DECLARE_CALLBACK(WebGLByteArrayConstructor);
+        DECLARE_CALLBACK(WebGLFloatArrayConstructor);
+        DECLARE_CALLBACK(WebGLIntArrayConstructor);
+        DECLARE_CALLBACK(WebGLShortArrayConstructor);
+        DECLARE_CALLBACK(WebGLUnsignedByteArrayConstructor);
+        DECLARE_CALLBACK(WebGLUnsignedIntArrayConstructor);
+        DECLARE_CALLBACK(WebGLUnsignedShortArrayConstructor);
 #endif
 
         DECLARE_PROPERTY_ACCESSOR_GETTER(ClipboardTypes);
@@ -407,6 +417,9 @@ namespace WebCore {
         DECLARE_CALLBACK(ElementSetAttributeNS);
         DECLARE_CALLBACK(ElementSetAttributeNodeNS);
 
+        DECLARE_CALLBACK(HistoryPushState);
+        DECLARE_CALLBACK(HistoryReplaceState);
+
         DECLARE_PROPERTY_ACCESSOR_SETTER(LocationProtocol);
         DECLARE_PROPERTY_ACCESSOR_SETTER(LocationHost);
         DECLARE_PROPERTY_ACCESSOR_SETTER(LocationHostname);
@@ -423,7 +436,6 @@ namespace WebCore {
         DECLARE_CALLBACK(LocationReload);
         DECLARE_CALLBACK(LocationToString);
         DECLARE_CALLBACK(LocationValueOf);
-
         DECLARE_CALLBACK(NodeAddEventListener);
         DECLARE_CALLBACK(NodeRemoveEventListener);
         DECLARE_CALLBACK(NodeInsertBefore);
@@ -469,29 +481,25 @@ namespace WebCore {
         DECLARE_CALLBACK(TreeWalkerNextSibling);
         DECLARE_CALLBACK(TreeWalkerPreviousSibling);
 
-        DECLARE_CALLBACK(InspectorBackendHighlightDOMNode);
-        DECLARE_CALLBACK(InspectorBackendAddResourceSourceToFrame);
-        DECLARE_CALLBACK(InspectorBackendAddSourceToFrame);
-        DECLARE_CALLBACK(InspectorBackendSearch);
-        DECLARE_CALLBACK(InspectorBackendSetting);
-        DECLARE_CALLBACK(InspectorBackendDatabaseForId);
-        DECLARE_CALLBACK(InspectorBackendInspectedWindow);
-        DECLARE_CALLBACK(InspectorBackendSetSetting);
-        DECLARE_CALLBACK(InspectorBackendCurrentCallFrame);
-        DECLARE_CALLBACK(InspectorBackendDebuggerEnabled);
-        DECLARE_CALLBACK(InspectorBackendPauseOnExceptions);
-        DECLARE_CALLBACK(InspectorBackendProfilerEnabled);
-        DECLARE_CALLBACK(InspectorBackendNodeForId);
-        DECLARE_CALLBACK(InspectorBackendWrapObject);
-        DECLARE_CALLBACK(InspectorBackendUnwrapObject);
-        DECLARE_CALLBACK(InspectorBackendPushNodePathToFrontend);
+        DECLARE_CALLBACK(InjectedScriptHostInspectedWindow);
+        DECLARE_CALLBACK(InjectedScriptHostNodeForId);
+        DECLARE_CALLBACK(InjectedScriptHostWrapObject);
+        DECLARE_CALLBACK(InjectedScriptHostUnwrapObject);
+        DECLARE_CALLBACK(InjectedScriptHostPushNodePathToFrontend);
+        DECLARE_CALLBACK(InjectedScriptHostWrapCallback);
 #if ENABLE(DATABASE)
-        DECLARE_CALLBACK(InspectorBackendSelectDatabase);
+        DECLARE_CALLBACK(InjectedScriptHostSelectDatabase);
+        DECLARE_CALLBACK(InjectedScriptHostDatabaseForId);
 #endif
 #if ENABLE(DOM_STORAGE)
-        DECLARE_CALLBACK(InspectorBackendSelectDOMStorage);
+        DECLARE_CALLBACK(InjectedScriptHostSelectDOMStorage);
 #endif
-        DECLARE_CALLBACK(InspectorBackendWrapCallback);
+
+        DECLARE_CALLBACK(InspectorFrontendHostSearch);
+        DECLARE_CALLBACK(InspectorFrontendHostShowContextMenu);
+
+        DECLARE_CALLBACK(ConsoleProfile);
+        DECLARE_CALLBACK(ConsoleProfileEnd);
 
         DECLARE_CALLBACK(NodeIteratorNextNode);
         DECLARE_CALLBACK(NodeIteratorPreviousNode);
@@ -529,31 +537,40 @@ namespace WebCore {
         DECLARE_NAMED_PROPERTY_GETTER(HTMLCollection);
 
 #if ENABLE(3D_CANVAS)
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasByteArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasByteArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasFloatArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasFloatArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasIntArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasIntArray);
-#endif
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasPixelArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasPixelArray);
-
-#if ENABLE(3D_CANVAS)
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasShortArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasShortArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray);
+        DECLARE_CALLBACK(WebGLByteArrayGet);
+        DECLARE_CALLBACK(WebGLByteArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLByteArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLByteArray);
+
+        DECLARE_CALLBACK(WebGLFloatArrayGet);
+        DECLARE_CALLBACK(WebGLFloatArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLFloatArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLFloatArray);
+
+        DECLARE_CALLBACK(WebGLIntArrayGet);
+        DECLARE_CALLBACK(WebGLIntArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLIntArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLIntArray);
+
+        DECLARE_CALLBACK(WebGLShortArrayGet);
+        DECLARE_CALLBACK(WebGLShortArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLShortArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLShortArray);
+
+        DECLARE_CALLBACK(WebGLUnsignedByteArrayGet);
+        DECLARE_CALLBACK(WebGLUnsignedByteArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLUnsignedByteArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLUnsignedByteArray);
+
+        DECLARE_CALLBACK(WebGLUnsignedIntArrayGet);
+        DECLARE_CALLBACK(WebGLUnsignedIntArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLUnsignedIntArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLUnsignedIntArray);
+
+        DECLARE_CALLBACK(WebGLUnsignedShortArrayGet);
+        DECLARE_CALLBACK(WebGLUnsignedShortArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLUnsignedShortArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLUnsignedShortArray);
 #endif
 
         DECLARE_PROPERTY_ACCESSOR_GETTER(MessageEventPorts);
@@ -600,6 +617,7 @@ namespace WebCore {
 #if ENABLE(SVG)
         DECLARE_PROPERTY_ACCESSOR_GETTER(SVGLengthValue);
         DECLARE_CALLBACK(SVGLengthConvertToSpecifiedUnits);
+        DECLARE_CALLBACK(SVGMatrixMultiply);
         DECLARE_CALLBACK(SVGMatrixInverse);
         DECLARE_CALLBACK(SVGMatrixRotateFromVector);
         DECLARE_CALLBACK(SVGElementInstanceAddEventListener);
@@ -648,6 +666,7 @@ namespace WebCore {
 #endif // ENABLE(NOTIFICATIONS)
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowApplicationCache);
         DECLARE_PROPERTY_ACCESSOR(DOMApplicationCacheEventHandler);
         DECLARE_CALLBACK(DOMApplicationCacheAddEventListener);
         DECLARE_CALLBACK(DOMApplicationCacheRemoveEventListener);
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
index 17c86a3..24d752f 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-V8EventListener::V8EventListener(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
-    : V8AbstractEventListener(guard, isAttribute)
+V8EventListener::V8EventListener(v8::Local<v8::Object> listener, bool isAttribute, const WorldContextHandle& worldContext)
+    : V8AbstractEventListener(isAttribute, worldContext)
 {
     setListenerObject(listener);
 }
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.h b/WebCore/bindings/v8/custom/V8CustomEventListener.h
index dc9d33b..f9d5385 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.h
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.h
@@ -44,13 +44,13 @@ namespace WebCore {
     // that can handle the event.
     class V8EventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8EventListener> create(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
+        static PassRefPtr<V8EventListener> create(v8::Local<v8::Object> listener, bool isAttribute, const WorldContextHandle& worldContext)
         {
-            return adoptRef(new V8EventListener(guard, listener, isAttribute));
+            return adoptRef(new V8EventListener(listener, isAttribute, worldContext));
         }
 
     protected:
-        V8EventListener(PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isAttribute);
+        V8EventListener(v8::Local<v8::Object> listener, bool isAttribute, const WorldContextHandle& worldContext);
 
         v8::Local<v8::Function> getListenerFunction(ScriptExecutionContext*);
 
diff --git a/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.cpp b/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.cpp
index 3341924..e45cba0 100644
--- a/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.cpp
@@ -38,13 +38,14 @@
 
 namespace WebCore {
 
-PassRefPtr<V8CustomXPathNSResolver> V8CustomXPathNSResolver::create(v8::Handle<v8::Object> resolver)
+PassRefPtr<V8CustomXPathNSResolver> V8CustomXPathNSResolver::create(V8Proxy* proxy, v8::Handle<v8::Object> resolver)
 {
-    return adoptRef(new V8CustomXPathNSResolver(resolver));
+    return adoptRef(new V8CustomXPathNSResolver(proxy, resolver));
 }
 
-V8CustomXPathNSResolver::V8CustomXPathNSResolver(v8::Handle<v8::Object> resolver)
-    : m_resolver(resolver)
+V8CustomXPathNSResolver::V8CustomXPathNSResolver(V8Proxy* proxy, v8::Handle<v8::Object> resolver)
+        : m_proxy(proxy)
+        , m_resolver(resolver)
 {
 }
 
@@ -54,6 +55,14 @@ V8CustomXPathNSResolver::~V8CustomXPathNSResolver()
 
 String V8CustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 {
+    V8Proxy* proxy = m_proxy;
+
+    if (!proxy) {
+        proxy = V8Proxy::retrieve();
+        if (!proxy)
+            return String();
+    }
+
     v8::Handle<v8::Function> lookupNamespaceURIFunc;
     v8::Handle<v8::String> lookupNamespaceURIName = v8::String::New("lookupNamespaceURI");
 
@@ -65,7 +74,7 @@ String V8CustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     }
 
     if (lookupNamespaceURIFunc.IsEmpty() && !m_resolver->IsFunction()) {
-        Frame* frame = V8Proxy::retrieveFrameForEnteredContext();
+        Frame* frame = proxy->frame();
         logInfo(frame, "XPathNSResolver does not have a lookupNamespaceURI method.", String());
         return String();
     }
@@ -78,7 +87,6 @@ String V8CustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     v8::Handle<v8::Value> argv[argc] = { v8String(prefix) };
     v8::Handle<v8::Function> function = lookupNamespaceURIFunc.IsEmpty() ? v8::Handle<v8::Function>::Cast(m_resolver) : lookupNamespaceURIFunc;
 
-    V8Proxy* proxy = V8Proxy::retrieve();
     v8::Handle<v8::Value> retval = proxy->callFunction(function, m_resolver, argc, argv);
 
     // Eat exceptions from namespace resolver and return an empty string. This will most likely cause NAMESPACE_ERR.
diff --git a/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.h b/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.h
index f1dc65c..15ac27d 100644
--- a/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.h
+++ b/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.h
@@ -42,17 +42,22 @@
 namespace WebCore {
 
 class String;
+class V8Proxy;
 
+// V8CustomXPathNSResolver does not create a persistent handle to the
+// given resolver object.  So the lifetime of V8CustomXPathNSResolver
+// must not exceed the lifetime of the passed handle.
 class V8CustomXPathNSResolver : public XPathNSResolver {
 public:
-    static PassRefPtr<V8CustomXPathNSResolver> create(v8::Handle<v8::Object> resolver);
+    static PassRefPtr<V8CustomXPathNSResolver> create(V8Proxy* proxy, v8::Handle<v8::Object> resolver);
 
     virtual ~V8CustomXPathNSResolver();
     virtual String lookupNamespaceURI(const String& prefix);
 
 private:
-    V8CustomXPathNSResolver(v8::Handle<v8::Object> resolver);
+    V8CustomXPathNSResolver(V8Proxy* proxy, v8::Handle<v8::Object> resolver);
 
+    V8Proxy* m_proxy;
     v8::Handle<v8::Object> m_resolver;  // Handle to resolver object.
 };
 
diff --git a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 25d5ccd..46c33b9 100644
--- a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -46,7 +46,6 @@
 #include "FrameView.h"
 #include "HTMLCollection.h"
 #include "MediaPlayer.h"
-#include "NotificationCenter.h"
 #include "Page.h"
 #include "PlatformScreen.h"
 #include "RuntimeEnabledFeatures.h"
@@ -176,6 +175,9 @@ ACCESSOR_GETTER(DOMWindowEvent)
         return v8::Undefined();
 
     v8::Local<v8::Context> context = V8Proxy::context(frame);
+    if (context.IsEmpty())
+        return v8::Undefined();
+
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
     v8::Handle<v8::Value> jsEvent = context->Global()->GetHiddenValue(eventSymbol);
     if (jsEvent.IsEmpty())
@@ -194,6 +196,9 @@ ACCESSOR_SETTER(DOMWindowEvent)
         return;
 
     v8::Local<v8::Context> context = V8Proxy::context(frame);
+    if (context.IsEmpty())
+        return;
+
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
     context->Global()->SetHiddenValue(eventSymbol, value);
 }
@@ -306,7 +311,14 @@ ACCESSOR_RUNTIME_ENABLER(DOMWindowSessionStorage)
 #if ENABLE(NOTIFICATIONS)
 ACCESSOR_RUNTIME_ENABLER(DOMWindowWebkitNotifications)
 {
-    return NotificationCenter::isAvailable();
+    return RuntimeEnabledFeatures::notificationsEnabled();
+}
+#endif
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+ACCESSOR_RUNTIME_ENABLER(DOMWindowApplicationCache)
+{
+    return RuntimeEnabledFeatures::applicationCacheEnabled();
 }
 #endif
 
@@ -538,6 +550,10 @@ static Frame* createWindow(Frame* callingFrame,
     ASSERT(callingFrame);
     ASSERT(enteredFrame);
 
+    // Sandboxed iframes cannot open new auxiliary browsing contexts.
+    if (callingFrame && callingFrame->loader()->isSandboxed(SandboxNavigation))
+        return 0;
+
     ResourceRequest request;
 
     // For whatever reason, Firefox uses the entered frame to determine
@@ -696,14 +712,15 @@ CALLBACK_FUNC_DECL(DOMWindowOpen)
     if (!V8Proxy::canAccessFrame(frame, true))
         return v8::Undefined();
 
-    Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
-    if (!callingFrame)
-        return v8::Undefined();
-
     Frame* enteredFrame = V8Proxy::retrieveFrameForEnteredContext();
     if (!enteredFrame)
         return v8::Undefined();
 
+    Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
+    // We may not have a calling context if we are invoked by a plugin via NPAPI.
+    if (!callingFrame)
+        callingFrame = enteredFrame;
+
     Page* page = frame->page();
     if (!page)
         return v8::Undefined();
diff --git a/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index 8b77a3a..ee68293 100644
--- a/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -64,7 +64,7 @@ CALLBACK_FUNC_DECL(DocumentEvaluate)
     if (V8Node::HasInstance(args[1]))
         contextNode = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[1]));
 
-    RefPtr<XPathNSResolver> resolver = V8DOMWrapper::getXPathNSResolver(args[2]);
+    RefPtr<XPathNSResolver> resolver = V8DOMWrapper::getXPathNSResolver(args[2], V8Proxy::retrieve(V8Proxy::retrieveFrameForCallingContext()));
     if (!resolver && !args[2]->IsNull() && !args[2]->IsUndefined())
         return throwError(TYPE_MISMATCH_ERR);
 
@@ -104,7 +104,7 @@ CALLBACK_FUNC_DECL(DocumentGetCSSCanvasContext)
         return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
 #if ENABLE(3D_CANVAS)
     else if (result->is3d())
-        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT3D, result);
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLRENDERINGCONTEXT, result);
 #endif // ENABLE(3D_CANVAS)
     ASSERT_NOT_REACHED();
     return v8::Undefined();
diff --git a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index 4116673..e51437e 100644
--- a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -53,7 +53,7 @@ CALLBACK_FUNC_DECL(HTMLCanvasElementGetContext)
         return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
 #if ENABLE(3D_CANVAS)
     else if (result->is3d())
-        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT3D, result);
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLRENDERINGCONTEXT, result);
 #endif
     ASSERT_NOT_REACHED();
     return v8::Undefined();
diff --git a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index afc9ed1..9cf2f3d 100644
--- a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -120,8 +120,7 @@ CALLBACK_FUNC_DECL(HTMLDocumentWrite)
     INC_STATS("DOM.HTMLDocument.write()");
     HTMLDocument* htmlDocument = V8DOMWrapper::convertDOMWrapperToNode<HTMLDocument>(args.Holder());
     Frame* frame = V8Proxy::retrieveFrameForCallingContext();
-    ASSERT(frame);
-    htmlDocument->write(writeHelperGetString(args), frame->document());
+    htmlDocument->write(writeHelperGetString(args), frame ? frame->document() : NULL);
     return v8::Undefined();
 }
 
@@ -130,8 +129,7 @@ CALLBACK_FUNC_DECL(HTMLDocumentWriteln)
     INC_STATS("DOM.HTMLDocument.writeln()");
     HTMLDocument* htmlDocument = V8DOMWrapper::convertDOMWrapperToNode<HTMLDocument>(args.Holder());
     Frame* frame = V8Proxy::retrieveFrameForCallingContext();
-    ASSERT(frame);
-    htmlDocument->writeln(writeHelperGetString(args), frame->document());
+    htmlDocument->writeln(writeHelperGetString(args), frame ? frame->document() : NULL);
     return v8::Undefined();
 }
 
@@ -170,7 +168,7 @@ CALLBACK_FUNC_DECL(HTMLDocumentOpen)
     }
 
     Frame* frame = V8Proxy::retrieveFrameForCallingContext();
-    htmlDocument->open(frame->document());
+    htmlDocument->open(frame ? frame->document() : NULL);
     // Return the document.
     return args.Holder();
 }
diff --git a/WebCore/bindings/v8/custom/V8HistoryCustom.cpp b/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
new file mode 100644
index 0000000..c884d15
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "History.h"
+
+#include "ExceptionCode.h"
+#include "SerializedScriptValue.h"
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+CALLBACK_FUNC_DECL(HistoryPushState)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(toWebCoreString(args[0]));
+
+    v8::TryCatch tryCatch;
+    String title = toWebCoreStringWithNullOrUndefinedCheck(args[1]);
+    if (tryCatch.HasCaught())
+        return v8::Undefined();
+    String url;
+    if (args.Length() > 2) {
+        url = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
+        if (tryCatch.HasCaught())
+            return v8::Undefined();
+    }
+
+    ExceptionCode ec = 0;
+    History* history = V8DOMWrapper::convertToNativeObject<History>(V8ClassIndex::HISTORY, args.Holder());
+    history->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
+    return throwError(ec);
+}
+
+CALLBACK_FUNC_DECL(HistoryReplaceState)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(toWebCoreString(args[0]));
+
+    v8::TryCatch tryCatch;
+    String title = toWebCoreStringWithNullOrUndefinedCheck(args[1]);
+    if (tryCatch.HasCaught())
+        return v8::Undefined();
+    String url;
+    if (args.Length() > 2) {
+        url = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
+        if (tryCatch.HasCaught())
+            return v8::Undefined();
+    }
+
+    ExceptionCode ec = 0;
+    History* history = V8DOMWrapper::convertToNativeObject<History>(V8ClassIndex::HISTORY, args.Holder());
+    history->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
+    return throwError(ec);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
new file mode 100644
index 0000000..fac6733
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2007-2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptHost.h"
+
+#include "Database.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "InspectorController.h"
+#include "Node.h"
+#include "Page.h"
+
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(InjectedScriptHostInspectedWindow)
+{
+    INC_STATS("InjectedScriptHost.inspectedWindow()");
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    InspectorController* ic = host->inspectorController();
+    if (!ic)
+        return v8::Undefined();
+    return V8DOMWrapper::convertToV8Object<DOMWindow>(V8ClassIndex::DOMWINDOW, ic->inspectedPage()->mainFrame()->domWindow());
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostWrapCallback)
+{
+    INC_STATS("InjectedScriptHost.wrapCallback()");
+    return args[0];
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostNodeForId)
+{
+    INC_STATS("InjectedScriptHost.nodeForId()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    
+    Node* node = host->nodeForId(args[0]->ToInt32()->Value());
+    if (!node)
+        return v8::Undefined();
+
+    InspectorController* ic = host->inspectorController();
+    if (!ic)
+        return v8::Undefined();
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NODE, node);
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostWrapObject)
+{
+    INC_STATS("InjectedScriptHost.wrapObject()");
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    return host->wrapObject(ScriptValue(args[0]), toWebCoreStringWithNullCheck(args[1])).v8Value();
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostUnwrapObject)
+{
+    INC_STATS("InjectedScriptHost.unwrapObject()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    return host->unwrapObject(toWebCoreStringWithNullCheck(args[0])).v8Value();
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostPushNodePathToFrontend)
+{
+    INC_STATS("InjectedScriptHost.pushNodePathToFrontend()");
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
+    bool selectInUI = args[1]->ToBoolean()->Value();
+    if (node)
+        return v8::Number::New(host->pushNodePathToFrontend(node, selectInUI));
+
+    return v8::Undefined();
+}
+
+#if ENABLE(DATABASE)
+CALLBACK_FUNC_DECL(InjectedScriptHostDatabaseForId)
+{
+    INC_STATS("InjectedScriptHost.databaseForId()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    Database* database = host->databaseForId(args[0]->ToInt32()->Value());
+    if (!database)
+        return v8::Undefined();
+    return V8DOMWrapper::convertToV8Object<Database>(V8ClassIndex::DATABASE, database);
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostSelectDatabase)
+{
+    INC_STATS("InjectedScriptHost.selectDatabase()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    Database* database = V8DOMWrapper::convertToNativeObject<Database>(V8ClassIndex::DATABASE, v8::Handle<v8::Object>::Cast(args[0]));
+    if (database)
+        host->selectDatabase(database);
+
+    return v8::Undefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+CALLBACK_FUNC_DECL(InjectedScriptHostSelectDOMStorage)
+{
+    INC_STATS("InjectedScriptHost.selectDOMStorage()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    Storage* storage = V8DOMWrapper::convertToNativeObject<Storage>(V8ClassIndex::STORAGE, v8::Handle<v8::Object>::Cast(args[0]));
+    if (storage)
+        host->selectDOMStorage(storage);
+
+    return v8::Undefined();
+}
+#endif
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp b/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
deleted file mode 100644
index ec9b034..0000000
--- a/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
+++ /dev/null
@@ -1,306 +0,0 @@
-/*
- * Copyright (C) 2007-2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "InspectorBackend.h"
-
-#include "Database.h"
-#include "DOMWindow.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "ExceptionCode.h"
-#include "InspectorController.h"
-#include "InspectorResource.h"
-#include "NotImplemented.h"
-#include "Node.h"
-#include "Range.h"
-#include "Page.h"
-#include "TextIterator.h"
-#include "VisiblePosition.h"
-
-#include "V8Binding.h"
-#include "V8CustomBinding.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-CALLBACK_FUNC_DECL(InspectorBackendHighlightDOMNode)
-{
-    INC_STATS("InspectorBackend.highlightDOMNode()");
-
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    inspectorBackend->highlight(args[0]->ToInt32()->Value());
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendSearch)
-{
-    INC_STATS("InspectorBackend.search()");
-
-    if (args.Length() < 2)
-        return v8::Undefined();
-
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
-    if (!node)
-        return v8::Undefined();
-
-    String target = toWebCoreStringWithNullCheck(args[1]);
-    if (target.isEmpty())
-        return v8::Undefined();
-
-    v8::Local<v8::Array> result = v8::Array::New();
-    RefPtr<Range> searchRange(rangeOfContents(node));
-
-    ExceptionCode ec = 0;
-    int index = 0;
-    do {
-        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
-        if (resultRange->collapsed(ec))
-            break;
-
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
-        result->Set(v8::Number::New(index++), V8DOMWrapper::convertToV8Object(V8ClassIndex::RANGE, resultRange.release()));
-
-        setStart(searchRange.get(), newStart);
-    } while (true);
-
-    return result;
-}
-
-#if ENABLE(DATABASE)
-CALLBACK_FUNC_DECL(InspectorBackendDatabaseForId)
-{
-    INC_STATS("InspectorBackend.databaseForId()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    Database* database = inspectorBackend->databaseForId(args[0]->ToInt32()->Value());
-    if (!database)
-        return v8::Undefined();
-    return V8DOMWrapper::convertToV8Object<Database>(V8ClassIndex::DATABASE, database);
-}
-#endif
-
-CALLBACK_FUNC_DECL(InspectorBackendInspectedWindow)
-{
-    INC_STATS("InspectorBackend.inspectedWindow()");
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    InspectorController* ic = inspectorBackend->inspectorController();
-    if (!ic)
-        return v8::Undefined();
-    return V8DOMWrapper::convertToV8Object<DOMWindow>(V8ClassIndex::DOMWINDOW, ic->inspectedPage()->mainFrame()->domWindow());
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendSetting)
-{
-    INC_STATS("InspectorBackend.setting()");
-
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    String key = toWebCoreStringWithNullCheck(args[0]);
-    if (key.isEmpty())
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    InspectorController* ic = inspectorBackend->inspectorController();
-    if (!ic)
-        return v8::Undefined();
-    const InspectorController::Setting& setting = ic->setting(key);
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            return v8::Undefined();
-        case InspectorController::Setting::StringType:
-            return v8String(setting.string());
-        case InspectorController::Setting::DoubleType:
-            return v8::Number::New(setting.doubleValue());
-        case InspectorController::Setting::IntegerType:
-            return v8::Number::New(setting.integerValue());
-        case InspectorController::Setting::BooleanType:
-            return v8Boolean(setting.booleanValue());
-        case InspectorController::Setting::StringVectorType: {
-            const Vector<String>& strings = setting.stringVector();
-            v8::Local<v8::Array> stringsArray = v8::Array::New(strings.size());
-            const unsigned length = strings.size();
-            for (unsigned i = 0; i < length; ++i)
-                stringsArray->Set(v8::Number::New(i), v8String(strings[i]));
-            return stringsArray;
-        }
-    }
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendSetSetting)
-{
-    INC_STATS("InspectorBackend.setSetting()");
-    if (args.Length() < 2)
-        return v8::Undefined();
-
-    String key = toWebCoreStringWithNullCheck(args[0]);
-    if (key.isEmpty())
-        return v8::Undefined();
-
-    InspectorController::Setting setting;
-
-    v8::Local<v8::Value> value = args[1];
-    if (value->IsUndefined() || value->IsNull()) {
-        // Do nothing. The setting is already NoType.
-        ASSERT(setting.type() == InspectorController::Setting::NoType);
-    } else if (value->IsString())
-        setting.set(toWebCoreStringWithNullCheck(value));
-    else if (value->IsNumber())
-        setting.set(value->NumberValue());
-    else if (value->IsBoolean())
-        setting.set(value->BooleanValue());
-    else if (value->IsArray()) {
-        v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(value);
-        Vector<String> strings;
-        for (unsigned i = 0; i < v8Array->Length(); ++i) {
-            String item = toWebCoreString(v8Array->Get(v8::Integer::New(i)));
-            if (item.isEmpty())
-                return v8::Undefined();
-            strings.append(item);
-        }
-        setting.set(strings);
-    } else
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    InspectorController* ic = inspectorBackend->inspectorController();
-    if (ic)
-        inspectorBackend->inspectorController()->setSetting(key, setting);
-
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendWrapCallback)
-{
-    INC_STATS("InspectorBackend.wrapCallback()");
-    return args[0];
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendNodeForId)
-{
-    INC_STATS("InspectorBackend.nodeForId()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    
-    Node* node = inspectorBackend->nodeForId(args[0]->ToInt32()->Value());
-    if (!node)
-        return v8::Undefined();
-
-    InspectorController* ic = inspectorBackend->inspectorController();
-    if (!ic)
-        return v8::Undefined();
-
-    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NODE, node);
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendWrapObject)
-{
-    INC_STATS("InspectorBackend.wrapObject()");
-    if (args.Length() < 2)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    return inspectorBackend->wrapObject(ScriptValue(args[0]), toWebCoreStringWithNullCheck(args[1])).v8Value();
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendUnwrapObject)
-{
-    INC_STATS("InspectorBackend.unwrapObject()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    return inspectorBackend->unwrapObject(toWebCoreStringWithNullCheck(args[0])).v8Value();
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendPushNodePathToFrontend)
-{
-    INC_STATS("InspectorBackend.pushNodePathToFrontend()");
-    if (args.Length() < 2)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
-    bool selectInUI = args[1]->ToBoolean()->Value();
-    if (node)
-        return v8::Number::New(inspectorBackend->pushNodePathToFrontend(node, selectInUI));
-
-    return v8::Undefined();
-}
-
-#if ENABLE(DATABASE)
-CALLBACK_FUNC_DECL(InspectorBackendSelectDatabase)
-{
-    INC_STATS("InspectorBackend.selectDatabase()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    Database* database = V8DOMWrapper::convertToNativeObject<Database>(V8ClassIndex::DATABASE, v8::Handle<v8::Object>::Cast(args[0]));
-    if (database)
-        inspectorBackend->selectDatabase(database);
-
-    return v8::Undefined();
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-CALLBACK_FUNC_DECL(InspectorBackendSelectDOMStorage)
-{
-    INC_STATS("InspectorBackend.selectDOMStorage()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    Storage* storage = V8DOMWrapper::convertToNativeObject<Storage>(V8ClassIndex::STORAGE, v8::Handle<v8::Object>::Cast(args[0]));
-    if (storage)
-        inspectorBackend->selectDOMStorage(storage);
-
-    return v8::Undefined();
-}
-#endif
-
-} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp b/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
new file mode 100644
index 0000000..15b45e9
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2007-2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontendHost.h"
+
+#include "ExceptionCode.h"
+#include "InspectorController.h"
+#include "Node.h"
+#include "Range.h"
+#include "Page.h"
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(InspectorFrontendHostSearch)
+{
+    INC_STATS("InspectorFrontendHost.search()");
+
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
+    if (!node)
+        return v8::Undefined();
+
+    String target = toWebCoreStringWithNullCheck(args[1]);
+    if (target.isEmpty())
+        return v8::Undefined();
+
+    v8::Local<v8::Array> result = v8::Array::New();
+    RefPtr<Range> searchRange(rangeOfContents(node));
+
+    ExceptionCode ec = 0;
+    int index = 0;
+    do {
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
+        if (resultRange->collapsed(ec))
+            break;
+
+        // A non-collapsed result range can in some funky whitespace cases still not
+        // advance the range's start position (4509328). Break to avoid infinite loop.
+        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
+        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
+            break;
+
+        result->Set(v8::Number::New(index++), V8DOMWrapper::convertToV8Object(V8ClassIndex::RANGE, resultRange.release()));
+
+        setStart(searchRange.get(), newStart);
+    } while (true);
+
+    return result;
+}
+
+CALLBACK_FUNC_DECL(InspectorFrontendHostShowContextMenu)
+{
+    return v8::Undefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp b/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
index bd5fb4a..a1f20cc 100644
--- a/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -82,15 +82,15 @@ CALLBACK_FUNC_DECL(NotificationCenterCreateHTMLNotification)
 {
     INC_STATS(L"DOM.NotificationCenter.CreateHTMLNotification()");
     NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
-    ScriptExecutionContext* context = notificationCenter->context();
+
     ExceptionCode ec = 0;
     String url = toWebCoreString(args[0]);
-    RefPtr<Notification> notification = Notification::create(url, context, ec, notificationCenter->presenter());
+    RefPtr<Notification> notification = notificationCenter->createHTMLNotification(url, ec);
 
     if (ec)
         return throwError(ec);
 
-    if (context->isWorkerContext())
+    if (notificationCenter->context()->isWorkerContext())
         return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
 
     return V8DOMWrapper::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
@@ -100,16 +100,14 @@ CALLBACK_FUNC_DECL(NotificationCenterCreateNotification)
 {
     INC_STATS(L"DOM.NotificationCenter.CreateNotification()");
     NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
-    NotificationContents contents(toWebCoreString(args[0]), toWebCoreString(args[1]), toWebCoreString(args[2]));
 
-    ScriptExecutionContext* context = notificationCenter->context();
     ExceptionCode ec = 0;
-    RefPtr<Notification> notification = Notification::create(contents, context, ec, notificationCenter->presenter());
+    RefPtr<Notification> notification = notificationCenter->createNotification(toWebCoreString(args[0]), toWebCoreString(args[1]), toWebCoreString(args[2]), ec);
 
     if (ec)
         return throwError(ec);
 
-    if (context->isWorkerContext())
+    if (notificationCenter->context()->isWorkerContext())
         return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
 
     return V8DOMWrapper::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
diff --git a/WebCore/bindings/v8/custom/V8SVGMatrixCustom.cpp b/WebCore/bindings/v8/custom/V8SVGMatrixCustom.cpp
index 3766397..690eac1 100644
--- a/WebCore/bindings/v8/custom/V8SVGMatrixCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SVGMatrixCustom.cpp
@@ -38,11 +38,27 @@
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
+#include "V8SVGMatrix.h"
 #include "V8SVGPODTypeWrapper.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
+CALLBACK_FUNC_DECL(SVGMatrixMultiply)
+{
+    INC_STATS("DOM.SVGMatrix.multiply()");
+    if (args.Length() < 1)
+        return throwError("Not enough arguments");
+
+    if (!V8SVGMatrix::HasInstance(args[0]))
+        return throwError("secondMatrix argument was not a SVGMatrix");
+
+    TransformationMatrix m1 = *V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<TransformationMatrix> >(V8ClassIndex::SVGMATRIX, args.Holder());
+    TransformationMatrix m2 = *V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<TransformationMatrix> >(V8ClassIndex::SVGMATRIX, v8::Handle<v8::Object>::Cast(args[0]));
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::SVGMATRIX, V8SVGStaticPODTypeWrapper<TransformationMatrix>::create(m1.multLeft(m2)));
+}
+
 CALLBACK_FUNC_DECL(SVGMatrixInverse)
 {
     INC_STATS("DOM.SVGMatrix.inverse()");
diff --git a/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp b/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
index ecd0153..32a48eb 100644
--- a/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
@@ -29,6 +29,7 @@
  */
 
 #include "config.h"
+#include "HTMLStyleElement.h"
 #include "StyleSheetList.h"
 
 #include "V8Binding.h"
@@ -50,7 +51,7 @@ NAMED_PROPERTY_GETTER(StyleSheetList)
     if (!item)
         return notHandledByInterceptor();
 
-    return V8DOMWrapper::convertToV8Object(V8ClassIndex::HTMLSTYLEELEMENT, item);
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::STYLESHEET, item->sheet());
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLArrayBufferCustom.cpp
index 4a85e82..16a1f51 100644
--- a/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLArrayBufferCustom.cpp
@@ -32,37 +32,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
+#include "WebGLArrayBuffer.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
+#include "V8WebGLArrayBuffer.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasArrayBufferConstructor)
+CALLBACK_FUNC_DECL(WebGLArrayBufferConstructor)
 {
-    INC_STATS("DOM.CanvasArrayBuffer.Contructor");
+    INC_STATS("DOM.WebGLArrayBuffer.Constructor");
 
     if (!args.IsConstructCall())
         return throwError("DOM object constructor cannot be called as a function.");
 
-    int argLen = args.Length();
+    // If we return a previously constructed WebGLArrayBuffer,
+    // e.g. from the call to WebGLArray.buffer, this code is called
+    // with a zero-length argument list. The V8DOMWrapper will then
+    // set the internal pointer in the newly-created object.
+    // Unfortunately it doesn't look like it's possible to distinguish
+    // between this case and that where the user calls "new
+    // WebGLArrayBuffer()" from JavaScript. To guard against problems,
+    // we always create at least a zero-length WebGLArrayBuffer, even
+    // if it is immediately overwritten by the V8DOMWrapper.
+
     // Supported constructors:
-    // CanvasArrayBuffer(n) where n is an integer:
+    // WebGLArrayBuffer(n) where n is an integer:
     //   -- create an empty buffer of n bytes
 
-    if (argLen != 1)
+    int argLen = args.Length();
+    if (argLen > 1)
         return throwError("Wrong number of arguments specified to constructor (requires 1)");
 
     int len = 0;
-    if (!args[0]->IsInt32())
-        return throwError("Argument to CanvasArrayBuffer constructor was not an integer");
-    len = toInt32(args[0]);
-    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(len);
+    if (argLen > 0) {
+        if (!args[0]->IsInt32())
+            return throwError("Argument to WebGLArrayBuffer constructor was not an integer");
+        len = toInt32(args[0]);
+    }
+
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(len);
     // Transform the holder into a wrapper object for the array.
-    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::CANVASARRAYBUFFER), buffer.get());
+    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::WEBGLARRAYBUFFER), buffer.get());
     return toV8(buffer.release(), args.Holder());
 }
 
diff --git a/WebCore/bindings/v8/custom/V8WebGLArrayCustom.h b/WebCore/bindings/v8/custom/V8WebGLArrayCustom.h
new file mode 100644
index 0000000..1a4b6a4
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8WebGLArrayCustom.h
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+
+#include "V8Binding.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+// Template function used by the WebGLArray*Constructor callbacks.
+template<class ArrayClass>
+v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args,
+                                          int classIndex)
+{
+    if (!args.IsConstructCall())
+        return throwError("DOM object constructor cannot be called as a function.");
+
+    int argLen = args.Length();
+    if (argLen == 0) {
+        // This happens when we return a previously constructed
+        // WebGLArray, e.g. from the call to WebGL<T>Array.slice().
+        // The V8DOMWrapper will set the internal pointer in the
+        // created object. Unfortunately it doesn't look like it's
+        // possible to distinguish between this case and that where
+        // the user calls "new WebGL<T>Array()" from JavaScript.
+        return args.Holder();
+    }
+
+    // Supported constructors:
+    // WebGL<T>Array(n) where n is an integer:
+    //   -- create an empty array of n elements
+    // WebGL<T>Array(arr) where arr is an array:
+    //   -- create a WebGL<T>Array containing the contents of "arr"
+    // WebGL<T>Array(buf, offset, length)
+    //   -- create a WebGL<T>Array pointing to the WebGLArrayBuffer
+    //      "buf", starting at the specified offset, for the given
+    //      length
+
+    // See whether the first argument is a WebGLArrayBuffer.
+    if (V8WebGLArrayBuffer::HasInstance(args[0])) {
+        if (argLen > 3)
+            return throwError("Wrong number of arguments to new WebGL<T>Array(WebGLArrayBuffer, int, int)");
+
+        WebGLArrayBuffer* buf =
+                V8DOMWrapper::convertToNativeObject<WebGLArrayBuffer>(V8ClassIndex::WEBGLARRAYBUFFER,
+                                                                      args[0]->ToObject());
+        if (buf == NULL)
+            return throwError("Could not convert argument 0 to a WebGLArrayBuffer");
+        bool ok;
+        int offset = 0;
+        if (argLen > 1) {
+            offset = toInt32(args[1], ok);
+            if (!ok)
+                return throwError("Could not convert argument 1 to an integer");
+        }
+        int length = buf->byteLength() - offset;
+        if (argLen > 2) {
+            length = toInt32(args[2], ok);
+            if (!ok)
+                return throwError("Could not convert argument 2 to an integer");
+        }
+        if (length < 0)
+            return throwError("Length / offset out of range");
+
+        RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
+        if (array == NULL)
+            return throwError("Invalid arguments to new WebGL<T>Array(WebGLArrayBuffer, int, int)");
+        // Transform the holder into a wrapper object for the array.
+        V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
+        V8DOMWrapper::setIndexedPropertiesToExternalArray(args.Holder(),
+                                                          classIndex,
+                                                          array.get()->baseAddress(),
+                                                          array.get()->length());
+        return toV8(array.release(), args.Holder());
+    }
+
+    int len = 0;
+    v8::Handle<v8::Object> srcArray;
+    if (argLen != 1)
+        return throwError("Wrong number of arguments to new WebGL<T>Array(int / array)");
+
+    if (args[0]->IsInt32()) {
+        len = toInt32(args[0]);
+    } else if (args[0]->IsObject()) {
+        srcArray = args[0]->ToObject();
+        if (srcArray.IsEmpty())
+            return throwError("Could not convert argument 0 to an object");
+        len = toInt32(srcArray->Get(v8::String::New("length")));
+    } else
+        return throwError("Could not convert argument 0 to either an int32 or an object");
+
+    RefPtr<ArrayClass> array = ArrayClass::create(len);
+    if (!srcArray.IsEmpty()) {
+        // Need to copy the incoming array into the newly created WebGLArray.
+        for (int i = 0; i < len; i++) {
+            v8::Local<v8::Value> val = srcArray->Get(v8::Integer::New(i));
+            array->set(i, val->NumberValue());
+        }
+    }
+
+    // Transform the holder into a wrapper object for the array.
+    V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
+    V8DOMWrapper::setIndexedPropertiesToExternalArray(args.Holder(),
+                                                      classIndex,
+                                                      array.get()->baseAddress(),
+                                                      array.get()->length());
+    return toV8(array.release(), args.Holder());
+}
+
+template <class T, typename ElementType>
+v8::Handle<v8::Value> getWebGLArrayElement(const v8::Arguments& args,
+                                           V8ClassIndex::V8WrapperType wrapperType)
+{
+    if (args.Length() != 1) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    bool ok;
+    uint32_t index = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    T* array = V8DOMWrapper::convertToNativeObject<T>(wrapperType, args.Holder());
+    if (index >= array->length())
+        return v8::Undefined();
+    ElementType result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+template <class T>
+v8::Handle<v8::Value> setWebGLArrayFromArray(T* webGLArray, const v8::Arguments& args)
+{
+    if (args[0]->IsObject()) {
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        v8::Local<v8::Object> array = args[0]->ToObject();
+        uint32_t offset = 0;
+        if (args.Length() == 2)
+            offset = toInt32(args[1]);
+        uint32_t length = toInt32(array->Get(v8::String::New("length")));
+        for (uint32_t i = 0; i < length; i++) {
+            webGLArray->set(offset + i, array->Get(v8::Integer::New(i))->NumberValue());
+        }
+    }
+
+    return v8::Undefined();
+}
+
+template <class CPlusPlusArrayType, class JavaScriptWrapperArrayType>
+v8::Handle<v8::Value> setWebGLArray(const v8::Arguments& args,
+                                    V8ClassIndex::V8WrapperType wrapperType)
+{
+    if (args.Length() < 1 || args.Length() > 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CPlusPlusArrayType* array = V8DOMWrapper::convertToNativeObject<CPlusPlusArrayType>(wrapperType, args.Holder());
+
+    if (args.Length() == 2 && args[0]->IsInt32()) {
+        // void set(in unsigned long index, in long value);
+        uint32_t index = toInt32(args[0]);
+        array->set(index, args[1]->NumberValue());
+        return v8::Undefined();
+    }
+
+    if (JavaScriptWrapperArrayType::HasInstance(args[0])) {
+        // void set(in WebGL<T>Array array, [Optional] in unsigned long offset);
+        CPlusPlusArrayType* src = V8DOMWrapper::convertToNativeObject<CPlusPlusArrayType>(wrapperType, args[0]->ToObject());
+        uint32_t offset = 0;
+        if (args.Length() == 2)
+            offset = toInt32(args[1]);
+        ExceptionCode ec = 0;
+        array->set(src, offset, ec);
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+
+    return setWebGLArrayFromArray(array, args);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLByteArrayCustom.cpp
index 503e5e8..5719c8a 100644
--- a/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLByteArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasByteArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLByteArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLByteArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasByteArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLByteArrayConstructor)
 {
-    INC_STATS("DOM.CanvasByteArray.Contructor");
+    INC_STATS("DOM.WebGLByteArray.Contructor");
 
-    return constructCanvasArray<CanvasByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASBYTEARRAY));
+    return constructWebGLArray<WebGLByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLBYTEARRAY));
 }
 
 // Get the specified value from the byte buffer and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid byte buffer range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasByteArray)
+INDEXED_PROPERTY_GETTER(WebGLByteArray)
 {
-    INC_STATS("DOM.CanvasByteArray.IndexedPropertyGetter");
-    CanvasByteArray* byteBuffer = V8DOMWrapper::convertToNativeObject<CanvasByteArray>(V8ClassIndex::CANVASBYTEARRAY, info.Holder());
+    INC_STATS("DOM.WebGLByteArray.IndexedPropertyGetter");
+    WebGLByteArray* byteBuffer = V8DOMWrapper::convertToNativeObject<WebGLByteArray>(V8ClassIndex::WEBGLBYTEARRAY, info.Holder());
 
     if ((index < 0) || (index >= byteBuffer->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasByteArray)
 }
 
 // Set the specified value in the byte buffer. Accesses outside the valid byte buffer range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasByteArray)
+INDEXED_PROPERTY_SETTER(WebGLByteArray)
 {
-    INC_STATS("DOM.CanvasByteArray.IndexedPropertySetter");
-    CanvasByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasByteArray>(V8ClassIndex::CANVASBYTEARRAY, info.Holder());
+    INC_STATS("DOM.WebGLByteArray.IndexedPropertySetter");
+    WebGLByteArray* array = V8DOMWrapper::convertToNativeObject<WebGLByteArray>(V8ClassIndex::WEBGLBYTEARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasByteArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLByteArrayGet)
+{
+    INC_STATS("DOM.WebGLByteArray.get()");
+    return getWebGLArrayElement<WebGLByteArray, signed char>(args, V8ClassIndex::WEBGLBYTEARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLByteArraySet)
+{
+    INC_STATS("DOM.WebGLByteArray.set()");
+    return setWebGLArray<WebGLByteArray, V8WebGLByteArray>(args, V8ClassIndex::WEBGLBYTEARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLFloatArrayCustom.cpp
index b3c1d62..6e56760 100644
--- a/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLFloatArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasFloatArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLFloatArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLFloatArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasFloatArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLFloatArrayConstructor)
 {
-    INC_STATS("DOM.CanvasFloatArray.Contructor");
+    INC_STATS("DOM.WebGLFloatArray.Contructor");
 
-    return constructCanvasArray<CanvasFloatArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASFLOATARRAY));
+    return constructWebGLArray<WebGLFloatArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLFLOATARRAY));
 }
 
 // Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasFloatArray)
+INDEXED_PROPERTY_GETTER(WebGLFloatArray)
 {
-    INC_STATS("DOM.CanvasFloatArray.IndexedPropertyGetter");
-    CanvasFloatArray* array = V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, info.Holder());
+    INC_STATS("DOM.WebGLFloatArray.IndexedPropertyGetter");
+    WebGLFloatArray* array = V8DOMWrapper::convertToNativeObject<WebGLFloatArray>(V8ClassIndex::WEBGLFLOATARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,16 +66,28 @@ INDEXED_PROPERTY_GETTER(CanvasFloatArray)
 }
 
 // Set the specified value in the array. Accesses outside the valid array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasFloatArray)
+INDEXED_PROPERTY_SETTER(WebGLFloatArray)
 {
-    INC_STATS("DOM.CanvasFloatArray.IndexedPropertySetter");
-    CanvasFloatArray* array = V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, info.Holder());
+    INC_STATS("DOM.WebGLFloatArray.IndexedPropertySetter");
+    WebGLFloatArray* array = V8DOMWrapper::convertToNativeObject<WebGLFloatArray>(V8ClassIndex::WEBGLFLOATARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length()))
         array->set(index, value->NumberValue());
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLFloatArrayGet)
+{
+    INC_STATS("DOM.WebGLFloatArray.get()");
+    return getWebGLArrayElement<WebGLFloatArray, float>(args, V8ClassIndex::WEBGLFLOATARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLFloatArraySet)
+{
+    INC_STATS("DOM.WebGLFloatArray.set()");
+    return setWebGLArray<WebGLFloatArray, V8WebGLFloatArray>(args, V8ClassIndex::WEBGLFLOATARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLIntArrayCustom.cpp
index 6f35db8..1bd30b2 100644
--- a/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLIntArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasIntArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLIntArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLIntArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasIntArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLIntArrayConstructor)
 {
-    INC_STATS("DOM.CanvasIntArray.Contructor");
+    INC_STATS("DOM.WebGLIntArray.Contructor");
 
-    return constructCanvasArray<CanvasIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASINTARRAY));
+    return constructWebGLArray<WebGLIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLINTARRAY));
 }
 
 // Get the specified value from the integer array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasIntArray)
+INDEXED_PROPERTY_GETTER(WebGLIntArray)
 {
-    INC_STATS("DOM.CanvasIntArray.IndexedPropertyGetter");
-    CanvasIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLIntArray.IndexedPropertyGetter");
+    WebGLIntArray* array = V8DOMWrapper::convertToNativeObject<WebGLIntArray>(V8ClassIndex::WEBGLINTARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasIntArray)
 }
 
 // Set the specified value in the integer array. Accesses outside the valid integer array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasIntArray)
+INDEXED_PROPERTY_SETTER(WebGLIntArray)
 {
-    INC_STATS("DOM.CanvasIntArray.IndexedPropertySetter");
-    CanvasIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLIntArray.IndexedPropertySetter");
+    WebGLIntArray* array = V8DOMWrapper::convertToNativeObject<WebGLIntArray>(V8ClassIndex::WEBGLINTARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasIntArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLIntArrayGet)
+{
+    INC_STATS("DOM.WebGLIntArray.get()");
+    return getWebGLArrayElement<WebGLIntArray, int>(args, V8ClassIndex::WEBGLINTARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLIntArraySet)
+{
+    INC_STATS("DOM.WebGLIntArray.set()");
+    return setWebGLArray<WebGLIntArray, V8WebGLIntArray>(args, V8ClassIndex::WEBGLINTARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
new file mode 100644
index 0000000..fd73a5b
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -0,0 +1,928 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions areV8ClassIndex::WEBGL
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLRenderingContext.h"
+
+#include "ExceptionCode.h"
+
+#include "NotImplemented.h"
+
+#include <wtf/FastMalloc.h>
+
+#include "V8Binding.h"
+#include "V8WebGLArray.h"
+#include "V8WebGLByteArray.h"
+#include "V8WebGLFloatArray.h"
+#include "V8WebGLIntArray.h"
+#include "V8WebGLProgram.h"
+#include "V8WebGLShader.h"
+#include "V8WebGLShortArray.h"
+#include "V8WebGLUniformLocation.h"
+#include "V8WebGLUnsignedByteArray.h"
+#include "V8WebGLUnsignedIntArray.h"
+#include "V8WebGLUnsignedShortArray.h"
+#include "V8HTMLCanvasElement.h"
+#include "V8HTMLImageElement.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+// Allocates new storage via tryFastMalloc.
+// Returns NULL if array failed to convert for any reason.
+static float* jsArrayToFloatArray(v8::Handle<v8::Array> array, uint32_t len)
+{
+    // Convert the data element-by-element.
+    float* data;
+    if (!tryFastMalloc(len * sizeof(float)).getValue(data))
+        return 0;
+    for (uint32_t i = 0; i < len; i++) {
+        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
+        if (!val->IsNumber()) {
+            fastFree(data);
+            return 0;
+        }
+        data[i] = toFloat(val);
+    }
+    return data;
+}
+
+// Allocates new storage via tryFastMalloc.
+// Returns NULL if array failed to convert for any reason.
+static int* jsArrayToIntArray(v8::Handle<v8::Array> array, uint32_t len)
+{
+    // Convert the data element-by-element.
+    int* data;
+    if (!tryFastMalloc(len * sizeof(int)).getValue(data))
+        return 0;
+    for (uint32_t i = 0; i < len; i++) {
+        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
+        bool ok;
+        int ival = toInt32(val, ok);
+        if (!ok) {
+            fastFree(data);
+            return 0;
+        }
+        data[i] = ival;
+    }
+    return data;
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextBufferData)
+{
+    INC_STATS("DOM.WebGLRenderingContext.bufferData()");
+
+    // Forms:
+    // * bufferData(GLenum target, WebGLArray data, GLenum usage);
+    //   - Sets the buffer's data from the given WebGLArray
+    // * bufferData(GLenum target, GLsizeiptr size, GLenum usage);
+    //   - Sets the size of the buffer to the given size in bytes
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int usage = toInt32(args[2], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (args[1]->IsInt32()) {
+        int size = toInt32(args[1]);
+        ExceptionCode exceptionCode;
+        context->bufferData(target, size, usage, exceptionCode);
+    } else if (V8WebGLArray::HasInstance(args[1])) {
+        WebGLArray* array = V8DOMWrapper::convertToNativeObject<WebGLArray>(V8ClassIndex::WEBGLARRAY, args[1]->ToObject());
+        ExceptionCode exceptionCode;
+        context->bufferData(target, array, usage, exceptionCode);
+    } else {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextBufferSubData)
+{
+    INC_STATS("DOM.WebGLRenderingContext.bufferSubData()");
+
+    // Forms:
+    // * bufferSubData(GLenum target, GLintptr offset, WebGLArray data);
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int offset = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (!V8WebGLArray::HasInstance(args[2])) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLArray* array = V8DOMWrapper::convertToNativeObject<WebGLArray>(V8ClassIndex::WEBGLARRAY, args[2]->ToObject());
+    ExceptionCode exceptionCode;
+    context->bufferSubData(target, offset, array, exceptionCode);
+    return v8::Undefined();
+}
+
+static v8::Handle<v8::Value> toV8(const WebGLGetInfo& info)
+{
+    switch (info.getType()) {
+    case WebGLGetInfo::kTypeBool:
+        return v8::Boolean::New(info.getBool());
+    case WebGLGetInfo::kTypeFloat:
+        return v8::Number::New(info.getFloat());
+    case WebGLGetInfo::kTypeLong:
+        return v8::Integer::New(info.getLong());
+    case WebGLGetInfo::kTypeNull:
+        return v8::Null();
+    case WebGLGetInfo::kTypeString:
+        return v8::String::New(fromWebCoreString(info.getString()), info.getString().length());
+    case WebGLGetInfo::kTypeUnsignedLong:
+        return v8::Integer::NewFromUnsigned(info.getUnsignedLong());
+    case WebGLGetInfo::kTypeWebGLBuffer:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLBUFFER, info.getWebGLBuffer());
+    case WebGLGetInfo::kTypeWebGLFloatArray:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLFLOATARRAY, info.getWebGLFloatArray());
+    case WebGLGetInfo::kTypeWebGLFramebuffer:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLFRAMEBUFFER, info.getWebGLFramebuffer());
+    case WebGLGetInfo::kTypeWebGLIntArray:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLINTARRAY, info.getWebGLIntArray());
+    // FIXME: implement WebGLObjectArray
+    // case WebGLGetInfo::kTypeWebGLObjectArray:
+    case WebGLGetInfo::kTypeWebGLProgram:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLPROGRAM, info.getWebGLProgram());
+    case WebGLGetInfo::kTypeWebGLRenderbuffer:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLRENDERBUFFER, info.getWebGLRenderbuffer());
+    case WebGLGetInfo::kTypeWebGLTexture:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLTEXTURE, info.getWebGLTexture());
+    case WebGLGetInfo::kTypeWebGLUnsignedByteArray:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY, info.getWebGLUnsignedByteArray());
+    default:
+        notImplemented();
+        return v8::Undefined();
+    }
+}
+
+enum ObjectType {
+    kBuffer, kRenderbuffer, kTexture, kVertexAttrib
+};
+
+static v8::Handle<v8::Value> getObjectParameter(const v8::Arguments& args, ObjectType objectType)
+{
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    unsigned target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    unsigned pname = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info;
+    switch (objectType) {
+    case kBuffer:
+        info = context->getBufferParameter(target, pname, ec);
+        break;
+    case kRenderbuffer:
+        info = context->getRenderbufferParameter(target, pname, ec);
+        break;
+    case kTexture:
+        info = context->getTexParameter(target, pname, ec);
+        break;
+    case kVertexAttrib:
+        // target => index
+        info = context->getVertexAttrib(target, pname, ec);
+        break;
+    default:
+        notImplemented();
+        break;
+    }
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+static WebGLUniformLocation* toWebGLUniformLocation(v8::Handle<v8::Value> value, bool& ok)
+{
+    ok = false;
+    WebGLUniformLocation* location = 0;
+    if (V8WebGLUniformLocation::HasInstance(value)) {
+        location = V8DOMWrapper::convertToNativeObject<WebGLUniformLocation>(
+            V8ClassIndex::WEBGLUNIFORMLOCATION, value->ToObject());
+        ok = true;
+    }
+    return location;
+}
+
+enum WhichProgramCall {
+    kProgramParameter, kUniform
+};
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetBufferParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getBufferParameter()");
+    return getObjectParameter(args, kBuffer);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetFramebufferAttachmentParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getFramebufferAttachmentParameter()");
+
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    unsigned target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    unsigned attachment = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    unsigned pname = toInt32(args[2], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getFramebufferAttachmentParameter(target, attachment, pname, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getParameter()");
+
+    if (args.Length() != 1) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    unsigned pname = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getParameter(pname, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetProgramParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getProgramParameter()");
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    WebGLProgram* program = V8WebGLProgram::HasInstance(args[0]) ? v8DOMWrapperTo<WebGLProgram>(V8ClassIndex::WEBGLPROGRAM, v8::Handle<v8::Object>::Cast(args[0])) : 0;
+    bool ok;
+    unsigned pname = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getProgramParameter(program, pname, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetRenderbufferParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getRenderbufferParameter()");
+    return getObjectParameter(args, kRenderbuffer);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetShaderParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getShaderParameter()");
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    WebGLShader* shader = V8WebGLShader::HasInstance(args[0]) ? v8DOMWrapperTo<WebGLShader>(V8ClassIndex::WEBGLSHADER, v8::Handle<v8::Object>::Cast(args[0])) : 0;
+    bool ok;
+    unsigned pname = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getShaderParameter(shader, pname, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetTexParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getTexParameter()");
+    return getObjectParameter(args, kTexture);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetUniform)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getUniform()");
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    WebGLProgram* program = V8WebGLProgram::HasInstance(args[0]) ? v8DOMWrapperTo<WebGLProgram>(V8ClassIndex::WEBGLPROGRAM, v8::Handle<v8::Object>::Cast(args[0])) : 0;
+
+    bool ok = false;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args[1], ok);
+
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getUniform(program, location, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetVertexAttrib)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getVertexAttrib()");
+    return getObjectParameter(args, kVertexAttrib);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextTexImage2D)
+{
+    INC_STATS("DOM.WebGLRenderingContext.texImage2D()");
+
+    // Currently supported forms:
+    // * void texImage2D(in GLenum target, in GLint level,
+    //                   in GLint internalformat,
+    //                   in GLsizei width, in GLsizei height, in GLint border,
+    //                   in GLenum format, in GLenum type, in WebGLArray pixels);
+    // * void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
+    //                   [Optional] in GLboolean flipY, [Optional] in GLboolean premultiplyAlpha);
+    // * void texImage2D(in GLenum target, in GLint level, in HTMLCanvasElement image,
+    //                   [Optional] in GLboolean flipY, [Optional] in GLboolean premultiplyAlpha);
+    if (args.Length() != 3 &&
+        args.Length() != 4 &&
+        args.Length() != 5 &&
+        args.Length() != 9) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int level = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    if (args.Length() == 3 ||
+        args.Length() == 4 ||
+        args.Length() == 5) {
+        v8::Handle<v8::Value> arg = args[2];
+        bool flipY = false;
+        bool premultiplyAlpha = false;
+        if (args.Length() >= 4)
+            flipY = args[3]->BooleanValue();
+        if (args.Length() >= 5)
+            premultiplyAlpha = args[4]->BooleanValue();
+        if (V8HTMLImageElement::HasInstance(arg)) {
+            HTMLImageElement* element = V8DOMWrapper::convertDOMWrapperToNode<HTMLImageElement>(v8::Handle<v8::Object>::Cast(arg));
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else if (V8HTMLCanvasElement::HasInstance(arg)) {
+            HTMLCanvasElement* element = V8DOMWrapper::convertDOMWrapperToNode<HTMLCanvasElement>(v8::Handle<v8::Object>::Cast(arg));
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else {
+            // FIXME: support HTMLVideoElement and ImageData.
+            // FIXME: consider different / better exception type.
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        // Fall through
+    } else if (args.Length() == 9) {
+        int internalformat = toInt32(args[2], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int width = toInt32(args[3], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int height = toInt32(args[4], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int border = toInt32(args[5], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int format = toInt32(args[6], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int type = toInt32(args[7], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        v8::Handle<v8::Value> arg = args[8];
+        if (V8WebGLArray::HasInstance(arg)) {
+            WebGLArray* array = V8DOMWrapper::convertToNativeObject<WebGLArray>(V8ClassIndex::WEBGLARRAY, arg->ToObject());
+            // FIXME: must do validation similar to JOGL's to ensure that
+            // the incoming array is of the appropriate length and type
+            context->texImage2D(target,
+                                level,
+                                internalformat,
+                                width,
+                                height,
+                                border,
+                                format,
+                                type,
+                                array,
+                                ec);
+            // Fall through
+        } else {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+    } else {
+        ASSERT_NOT_REACHED();
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextTexSubImage2D)
+{
+    INC_STATS("DOM.WebGLRenderingContext.texSubImage2D()");
+
+    // FIXME: implement
+    notImplemented();
+
+    return v8::Undefined();
+}
+
+enum FunctionToCall {
+    kUniform1v, kUniform2v, kUniform3v, kUniform4v,
+    kVertexAttrib1v, kVertexAttrib2v, kVertexAttrib3v, kVertexAttrib4v
+};
+
+bool isFunctionToCallForAttribute(FunctionToCall functionToCall)
+{
+    switch (functionToCall) {
+    case kVertexAttrib1v:
+    case kVertexAttrib2v:
+    case kVertexAttrib3v:
+    case kVertexAttrib4v:
+        return true;
+    default:
+        break;
+    }
+    return false;
+}
+
+static v8::Handle<v8::Value> vertexAttribAndUniformHelperf(const v8::Arguments& args,
+                                                           FunctionToCall functionToCall) {
+    // Forms:
+    // * glUniform1fv(WebGLUniformLocation location, Array data);
+    // * glUniform1fv(WebGLUniformLocation location, WebGLFloatArray data);
+    // * glUniform2fv(WebGLUniformLocation location, Array data);
+    // * glUniform2fv(WebGLUniformLocation location, WebGLFloatArray data);
+    // * glUniform3fv(WebGLUniformLocation location, Array data);
+    // * glUniform3fv(WebGLUniformLocation location, WebGLFloatArray data);
+    // * glUniform4fv(WebGLUniformLocation location, Array data);
+    // * glUniform4fv(WebGLUniformLocation location, WebGLFloatArray data);
+    // * glVertexAttrib1fv(GLint index, Array data);
+    // * glVertexAttrib1fv(GLint index, WebGLFloatArray data);
+    // * glVertexAttrib2fv(GLint index, Array data);
+    // * glVertexAttrib2fv(GLint index, WebGLFloatArray data);
+    // * glVertexAttrib3fv(GLint index, Array data);
+    // * glVertexAttrib3fv(GLint index, WebGLFloatArray data);
+    // * glVertexAttrib4fv(GLint index, Array data);
+    // * glVertexAttrib4fv(GLint index, WebGLFloatArray data);
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    bool ok = false;
+    int index = -1;
+    WebGLUniformLocation* location = 0;
+
+    if (isFunctionToCallForAttribute(functionToCall))
+        index = toInt32(args[0], ok);
+    else
+        location = toWebGLUniformLocation(args[0], ok);
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (V8WebGLFloatArray::HasInstance(args[1])) {
+        WebGLFloatArray* array = 
+            V8DOMWrapper::convertToNativeObject<WebGLFloatArray>(V8ClassIndex::WEBGLFLOATARRAY, args[1]->ToObject());
+        ASSERT(array != NULL);
+        ExceptionCode ec = 0;
+        switch (functionToCall) {
+            case kUniform1v: context->uniform1fv(location, array, ec); break;
+            case kUniform2v: context->uniform2fv(location, array, ec); break;
+            case kUniform3v: context->uniform3fv(location, array, ec); break;
+            case kUniform4v: context->uniform4fv(location, array, ec); break;
+            case kVertexAttrib1v: context->vertexAttrib1fv(index, array); break;
+            case kVertexAttrib2v: context->vertexAttrib2fv(index, array); break;
+            case kVertexAttrib3v: context->vertexAttrib3fv(index, array); break;
+            case kVertexAttrib4v: context->vertexAttrib4fv(index, array); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        if (ec)
+            V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[1]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    float* data = jsArrayToFloatArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    ExceptionCode ec = 0;
+    switch (functionToCall) {
+        case kUniform1v: context->uniform1fv(location, data, len, ec); break;
+        case kUniform2v: context->uniform2fv(location, data, len, ec); break;
+        case kUniform3v: context->uniform3fv(location, data, len, ec); break;
+        case kUniform4v: context->uniform4fv(location, data, len, ec); break;
+        case kVertexAttrib1v: context->vertexAttrib1fv(index, data, len); break;
+        case kVertexAttrib2v: context->vertexAttrib2fv(index, data, len); break;
+        case kVertexAttrib3v: context->vertexAttrib3fv(index, data, len); break;
+        case kVertexAttrib4v: context->vertexAttrib4fv(index, data, len); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    if (ec)
+        V8Proxy::setDOMException(ec);
+    return v8::Undefined();
+}
+
+static v8::Handle<v8::Value> uniformHelperi(const v8::Arguments& args,
+                                            FunctionToCall functionToCall) {
+    // Forms:
+    // * glUniform1iv(GLUniformLocation location, Array data);
+    // * glUniform1iv(GLUniformLocation location, WebGLIntArray data);
+    // * glUniform2iv(GLUniformLocation location, Array data);
+    // * glUniform2iv(GLUniformLocation location, WebGLIntArray data);
+    // * glUniform3iv(GLUniformLocation location, Array data);
+    // * glUniform3iv(GLUniformLocation location, WebGLIntArray data);
+    // * glUniform4iv(GLUniformLocation location, Array data);
+    // * glUniform4iv(GLUniformLocation location, WebGLIntArray data);
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok = false;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args[0], ok);
+
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (V8WebGLIntArray::HasInstance(args[1])) {
+        WebGLIntArray* array = 
+            V8DOMWrapper::convertToNativeObject<WebGLIntArray>(V8ClassIndex::WEBGLINTARRAY, args[1]->ToObject());
+        ASSERT(array != NULL);
+        ExceptionCode ec = 0;
+        switch (functionToCall) {
+            case kUniform1v: context->uniform1iv(location, array, ec); break;
+            case kUniform2v: context->uniform2iv(location, array, ec); break;
+            case kUniform3v: context->uniform3iv(location, array, ec); break;
+            case kUniform4v: context->uniform4iv(location, array, ec); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        if (ec)
+            V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[1]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    int* data = jsArrayToIntArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    ExceptionCode ec = 0;
+    switch (functionToCall) {
+        case kUniform1v: context->uniform1iv(location, data, len, ec); break;
+        case kUniform2v: context->uniform2iv(location, data, len, ec); break;
+        case kUniform3v: context->uniform3iv(location, data, len, ec); break;
+        case kUniform4v: context->uniform4iv(location, data, len, ec); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    if (ec)
+        V8Proxy::setDOMException(ec);
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform1fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform1fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform1v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform1iv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform1iv()");
+    return uniformHelperi(args, kUniform1v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform2fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform2fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform2v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform2iv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform2iv()");
+    return uniformHelperi(args, kUniform2v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform3fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform3fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform3v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform3iv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform3iv()");
+    return uniformHelperi(args, kUniform3v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform4fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform4fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform4v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform4iv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform4iv()");
+    return uniformHelperi(args, kUniform4v);
+}
+
+static v8::Handle<v8::Value> uniformMatrixHelper(const v8::Arguments& args,
+                                                 int matrixSize)
+{
+    // Forms:
+    // * glUniformMatrix2fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix2fv(GLint location, GLboolean transpose, WebGLFloatArray data);
+    // * glUniformMatrix3fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix3fv(GLint location, GLboolean transpose, WebGLFloatArray data);
+    // * glUniformMatrix4fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix4fv(GLint location, GLboolean transpose, WebGLFloatArray data);
+    //
+    // FIXME: need to change to accept WebGLFloatArray as well.
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+
+    bool ok = false;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args[0], ok);
+    
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    bool transpose = args[1]->BooleanValue();
+    if (V8WebGLFloatArray::HasInstance(args[2])) {
+        WebGLFloatArray* array = 
+            V8DOMWrapper::convertToNativeObject<WebGLFloatArray>(V8ClassIndex::WEBGLFLOATARRAY, args[2]->ToObject());
+        ASSERT(array != NULL);
+        ExceptionCode ec = 0;
+        switch (matrixSize) {
+            case 2: context->uniformMatrix2fv(location, transpose, array, ec); break;
+            case 3: context->uniformMatrix3fv(location, transpose, array, ec); break;
+            case 4: context->uniformMatrix4fv(location, transpose, array, ec); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        if (ec)
+            V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[2]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    float* data = jsArrayToFloatArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    ExceptionCode ec = 0;
+    switch (matrixSize) {
+        case 2: context->uniformMatrix2fv(location, transpose, data, len, ec); break;
+        case 3: context->uniformMatrix3fv(location, transpose, data, len, ec); break;
+        case 4: context->uniformMatrix4fv(location, transpose, data, len, ec); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    if (ec)
+        V8Proxy::setDOMException(ec); 
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniformMatrix2fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniformMatrix2fv()");
+    return uniformMatrixHelper(args, 2);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniformMatrix3fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniformMatrix3fv()");
+    return uniformMatrixHelper(args, 3);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniformMatrix4fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniformMatrix4fv()");
+    return uniformMatrixHelper(args, 4);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextVertexAttrib1fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.vertexAttrib1fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib1v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextVertexAttrib2fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.vertexAttrib2fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib2v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextVertexAttrib3fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.vertexAttrib3fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib3v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextVertexAttrib4fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.vertexAttrib4fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib4v);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLShortArrayCustom.cpp
index 8b83022..f8a26c3 100644
--- a/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLShortArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasShortArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLShortArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLShortArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasShortArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLShortArrayConstructor)
 {
-    INC_STATS("DOM.CanvasShortArray.Contructor");
+    INC_STATS("DOM.WebGLShortArray.Contructor");
 
-    return constructCanvasArray<CanvasShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASSHORTARRAY));
+    return constructWebGLArray<WebGLShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLSHORTARRAY));
 }
 
 // Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasShortArray)
+INDEXED_PROPERTY_GETTER(WebGLShortArray)
 {
-    INC_STATS("DOM.CanvasShortArray.IndexedPropertyGetter");
-    CanvasShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasShortArray>(V8ClassIndex::CANVASSHORTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLShortArray.IndexedPropertyGetter");
+    WebGLShortArray* array = V8DOMWrapper::convertToNativeObject<WebGLShortArray>(V8ClassIndex::WEBGLSHORTARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasShortArray)
 }
 
 // Set the specified value in the array. Accesses outside the valid array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasShortArray)
+INDEXED_PROPERTY_SETTER(WebGLShortArray)
 {
-    INC_STATS("DOM.CanvasShortArray.IndexedPropertySetter");
-    CanvasShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasShortArray>(V8ClassIndex::CANVASSHORTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLShortArray.IndexedPropertySetter");
+    WebGLShortArray* array = V8DOMWrapper::convertToNativeObject<WebGLShortArray>(V8ClassIndex::WEBGLSHORTARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasShortArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLShortArrayGet)
+{
+    INC_STATS("DOM.WebGLShortArray.get()");
+    return getWebGLArrayElement<WebGLShortArray, short>(args, V8ClassIndex::WEBGLSHORTARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLShortArraySet)
+{
+    INC_STATS("DOM.WebGLShortArray.set()");
+    return setWebGLArray<WebGLShortArray, V8WebGLShortArray>(args, V8ClassIndex::WEBGLSHORTARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp
index 62ab880..391f213 100644
--- a/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedByteArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedByteArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLUnsignedByteArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasUnsignedByteArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLUnsignedByteArrayConstructor)
 {
-    INC_STATS("DOM.CanvasUnsignedByteArray.Contructor");
+    INC_STATS("DOM.WebGLUnsignedByteArray.Contructor");
 
-    return constructCanvasArray<CanvasUnsignedByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY));
+    return constructWebGLArray<WebGLUnsignedByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY));
 }
 
 // Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray)
+INDEXED_PROPERTY_GETTER(WebGLUnsignedByteArray)
 {
-    INC_STATS("DOM.CanvasUnsignedByteArray.IndexedPropertyGetter");
-    CanvasUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedByteArray>(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedByteArray.IndexedPropertyGetter");
+    WebGLUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedByteArray>(V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray)
 }
 
 // Set the specified value in the array. Accesses outside the valid array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray)
+INDEXED_PROPERTY_SETTER(WebGLUnsignedByteArray)
 {
-    INC_STATS("DOM.CanvasUnsignedByteArray.IndexedPropertySetter");
-    CanvasUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedByteArray>(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedByteArray.IndexedPropertySetter");
+    WebGLUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedByteArray>(V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLUnsignedByteArrayGet)
+{
+    INC_STATS("DOM.WebGLUnsignedByteArray.get()");
+    return getWebGLArrayElement<WebGLUnsignedByteArray, unsigned char>(args, V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLUnsignedByteArraySet)
+{
+    INC_STATS("DOM.WebGLUnsignedByteArray.set()");
+    return setWebGLArray<WebGLUnsignedByteArray, V8WebGLUnsignedByteArray>(args, V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp
index 94ec7d0..92b9fe0 100644
--- a/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedIntArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedIntArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLUnsignedIntArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasUnsignedIntArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLUnsignedIntArrayConstructor)
 {
-    INC_STATS("DOM.CanvasUnsignedIntArray.Contructor");
+    INC_STATS("DOM.WebGLUnsignedIntArray.Contructor");
 
-    return constructCanvasArray<CanvasUnsignedIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDINTARRAY));
+    return constructWebGLArray<WebGLUnsignedIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLUNSIGNEDINTARRAY));
 }
 
 // Get the specified value from the integer array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray)
+INDEXED_PROPERTY_GETTER(WebGLUnsignedIntArray)
 {
-    INC_STATS("DOM.CanvasUnsignedIntArray.IndexedPropertyGetter");
-    CanvasUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedIntArray>(V8ClassIndex::CANVASUNSIGNEDINTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedIntArray.IndexedPropertyGetter");
+    WebGLUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedIntArray>(V8ClassIndex::WEBGLUNSIGNEDINTARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray)
 }
 
 // Set the specified value in the integer array. Accesses outside the valid integer array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray)
+INDEXED_PROPERTY_SETTER(WebGLUnsignedIntArray)
 {
-    INC_STATS("DOM.CanvasUnsignedIntArray.IndexedPropertySetter");
-    CanvasUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedIntArray>(V8ClassIndex::CANVASUNSIGNEDINTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedIntArray.IndexedPropertySetter");
+    WebGLUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedIntArray>(V8ClassIndex::WEBGLUNSIGNEDINTARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLUnsignedIntArrayGet)
+{
+    INC_STATS("DOM.WebGLUnsignedIntArray.get()");
+    return getWebGLArrayElement<WebGLUnsignedIntArray, unsigned int>(args, V8ClassIndex::WEBGLUNSIGNEDINTARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLUnsignedIntArraySet)
+{
+    INC_STATS("DOM.WebGLUnsignedIntArray.set()");
+    return setWebGLArray<WebGLUnsignedIntArray, V8WebGLUnsignedIntArray>(args, V8ClassIndex::WEBGLUNSIGNEDINTARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp
index eeef82c..ce261e9 100644
--- a/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedShortArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedShortArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLUnsignedShortArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasUnsignedShortArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLUnsignedShortArrayConstructor)
 {
-    INC_STATS("DOM.CanvasUnsignedShortArray.Contructor");
+    INC_STATS("DOM.WebGLUnsignedShortArray.Contructor");
 
-    return constructCanvasArray<CanvasUnsignedShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY));
+    return constructWebGLArray<WebGLUnsignedShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY));
 }
 
 // Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray)
+INDEXED_PROPERTY_GETTER(WebGLUnsignedShortArray)
 {
-    INC_STATS("DOM.CanvasUnsignedShortArray.IndexedPropertyGetter");
-    CanvasUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedShortArray>(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedShortArray.IndexedPropertyGetter");
+    WebGLUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedShortArray>(V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray)
 }
 
 // Set the specified value in the array. Accesses outside the valid array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray)
+INDEXED_PROPERTY_SETTER(WebGLUnsignedShortArray)
 {
-    INC_STATS("DOM.CanvasUnsignedShortArray.IndexedPropertySetter");
-    CanvasUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedShortArray>(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedShortArray.IndexedPropertySetter");
+    WebGLUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedShortArray>(V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLUnsignedShortArrayGet)
+{
+    INC_STATS("DOM.WebGLUnsignedShortArray.get()");
+    return getWebGLArrayElement<WebGLUnsignedShortArray, unsigned short>(args, V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLUnsignedShortArraySet)
+{
+    INC_STATS("DOM.WebGLUnsignedShortArray.set()");
+    return setWebGLArray<WebGLUnsignedShortArray, V8WebGLUnsignedShortArray>(args, V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index 36c7001..9b68ac0 100755
--- a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -34,7 +34,7 @@
 
 #include "DOMTimer.h"
 #include "ExceptionCode.h"
-#include "NotificationCenter.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ScheduledAction.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -49,7 +49,7 @@ namespace WebCore {
 #if ENABLE(NOTIFICATIONS)
 ACCESSOR_RUNTIME_ENABLER(WorkerContextWebkitNotifications)
 {
-    return NotificationCenter::isAvailable();
+    return RuntimeEnabledFeatures::notificationsEnabled();
 }
 #endif
 
@@ -100,8 +100,13 @@ CALLBACK_FUNC_DECL(WorkerContextImportScripts)
     if (!args.Length())
         return v8::Undefined();
 
-    String callerURL = V8Proxy::sourceName();
-    int callerLine = V8Proxy::sourceLineNumber() + 1;
+    String callerURL;
+    if (!V8Proxy::sourceName(callerURL))
+        return v8::Undefined();
+    int callerLine;
+    if (!V8Proxy::sourceLineNumber(callerLine))
+        return v8::Undefined();
+    callerLine += 1;
 
     Vector<String> urls;
     for (int i = 0; i < args.Length(); i++) {
diff --git a/WebCore/bridge/NP_jsobject.cpp b/WebCore/bridge/NP_jsobject.cpp
index 6a89652..59900c5 100644
--- a/WebCore/bridge/NP_jsobject.cpp
+++ b/WebCore/bridge/NP_jsobject.cpp
@@ -124,7 +124,7 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = callInWorld(exec, function, callType, callData, function, argList, pluginWorld());
+        JSValue resultV = JSC::call(exec, function, callType, callData, function, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -174,7 +174,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = callInWorld(exec, function, callType, callData, obj->imp, argList, pluginWorld());
+        JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -204,7 +204,7 @@ bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
         String scriptString = convertNPStringToUTF16(s);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        Completion completion = evaluateInWorld(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue(), pluginWorld());
+        Completion completion = JSC::evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue());
         globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
@@ -444,7 +444,7 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = constructInWorld(exec, constructor, constructType, constructData, argList, pluginWorld());
+        JSValue resultV = JSC::construct(exec, constructor, constructType, constructData, argList);
         globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
diff --git a/WebCore/bridge/jni/jni_jsobject.mm b/WebCore/bridge/jni/jni_jsobject.mm
index cc28a75..6683af6 100644
--- a/WebCore/bridge/jni/jni_jsobject.mm
+++ b/WebCore/bridge/jni/jni_jsobject.mm
@@ -35,6 +35,7 @@
 #include "WebCoreFrameView.h"
 #include "jni_runtime.h"
 #include "jni_utility.h"
+#include "jni_utility_private.h"
 #include "runtime_object.h"
 #include "runtime_root.h"
 #include <interpreter/CallFrame.h>
@@ -303,7 +304,7 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = WebCore::callInWorld(exec, function, callType, callData, _imp, argList, WebCore::pluginWorld());
+    JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
@@ -322,7 +323,7 @@ jobject JavaJSObject::eval(jstring script) const
         return 0;
 
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    Completion completion = WebCore::evaluateInWorld(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue(), WebCore::pluginWorld());
+    Completion completion = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue());
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
diff --git a/WebCore/bridge/jni/jni_objc.mm b/WebCore/bridge/jni/jni_objc.mm
index 0306bfd..fb2d694 100644
--- a/WebCore/bridge/jni/jni_objc.mm
+++ b/WebCore/bridge/jni/jni_objc.mm
@@ -29,6 +29,7 @@
 
 #import <Foundation/Foundation.h>
 #import "jni_utility.h"
+#import "jni_utility_private.h"
 #import "objc_utility.h"
 #include <runtime/JSLock.h>
 
diff --git a/WebCore/bridge/qt/qt_instance.cpp b/WebCore/bridge/qt/qt_instance.cpp
index 0546014..c6185e9 100644
--- a/WebCore/bridge/qt/qt_instance.cpp
+++ b/WebCore/bridge/qt/qt_instance.cpp
@@ -58,6 +58,14 @@ public:
             instance->markAggregate(markStack);
     }
 
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    {
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = RuntimeObjectImp::StructureFlags | OverridesMarkChildren;
+
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
 };
@@ -111,10 +119,17 @@ PassRefPtr<QtInstance> QtInstance::getQtInstance(QObject* o, PassRefPtr<RootObje
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    foreach(QtInstance* instance, cachedInstances.values(o)) {
-        if (instance->rootObject() == rootObject)
-            return instance;
-    }
+    foreach(QtInstance* instance, cachedInstances.values(o))
+        if (instance->rootObject() == rootObject) {
+            // The garbage collector removes instances, but it may happen that the wrapped
+            // QObject dies before the gc kicks in. To handle that case we have to do an additional
+            // check if to see if the instance's wrapped object is still alive. If it isn't, then
+            // we have to create a new wrapper.
+            if (!instance->getObject())
+                cachedInstances.remove(instance->hashKey());
+            else
+                return instance;
+        }
 
     RefPtr<QtInstance> ret = QtInstance::create(o, rootObject, ownership);
     cachedInstances.insert(o, ret.get());
diff --git a/WebCore/bridge/qt/qt_instance.h b/WebCore/bridge/qt/qt_instance.h
index 00aaa5b..0afc6c7 100644
--- a/WebCore/bridge/qt/qt_instance.h
+++ b/WebCore/bridge/qt/qt_instance.h
@@ -59,6 +59,7 @@ public:
     JSValue booleanValue() const;
 
     QObject* getObject() const { return m_object; }
+    QObject* hashKey() const { return m_hashkey; }
 
     static PassRefPtr<QtInstance> getQtInstance(QObject*, PassRefPtr<RootObject>, QScriptEngine::ValueOwnership ownership);
 
diff --git a/WebCore/bridge/qt/qt_runtime.cpp b/WebCore/bridge/qt/qt_runtime.cpp
index 6887325..94749b4 100644
--- a/WebCore/bridge/qt/qt_runtime.cpp
+++ b/WebCore/bridge/qt/qt_runtime.cpp
@@ -457,8 +457,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
         case QMetaType::QTime:
             if (type == Date) {
                 DateInstance* date = static_cast<DateInstance*>(object);
-                WTF::GregorianDateTime gdt;
-                WTF::msToGregorianDateTime(date->internalNumber(), true, gdt);
+                GregorianDateTime gdt;
+                msToGregorianDateTime(exec, date->internalNumber(), true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 0;
@@ -471,8 +471,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 }
             } else if (type == Number) {
                 double b = value.toNumber(exec);
-                WTF::GregorianDateTime gdt;
-                msToGregorianDateTime(b, true, gdt);
+                GregorianDateTime gdt;
+                msToGregorianDateTime(exec, b, true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 6;
@@ -824,7 +824,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         }
 
         // Dates specified this way are in local time (we convert DateTimes above)
-        WTF::GregorianDateTime dt;
+        GregorianDateTime dt;
         dt.year = date.year() - 1900;
         dt.month = date.month() - 1;
         dt.monthDay = date.day();
@@ -832,7 +832,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         dt.minute = time.minute();
         dt.second = time.second();
         dt.isDST = -1;
-        double ms = WTF::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
+        double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
 
         return new (exec) DateInstance(exec, trunc(ms));
     }
diff --git a/WebCore/bridge/qt/qt_runtime.h b/WebCore/bridge/qt/qt_runtime.h
index f2ce954..dc55f61 100644
--- a/WebCore/bridge/qt/qt_runtime.h
+++ b/WebCore/bridge/qt/qt_runtime.h
@@ -151,10 +151,12 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  OverridesGetOwnPropertySlot | OverridesMarkChildren));
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags));
     }
 
 protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | InternalFunction::StructureFlags | OverridesMarkChildren;
+
     QtRuntimeMethodData *d_func() const {return d_ptr;}
     QtRuntimeMethod(QtRuntimeMethodData *dd, ExecState *exec, const Identifier &n, PassRefPtr<QtInstance> inst);
     QtRuntimeMethodData *d_ptr;
diff --git a/WebCore/config.h b/WebCore/config.h
index 19b60c8..31b4c17 100644
--- a/WebCore/config.h
+++ b/WebCore/config.h
@@ -75,12 +75,18 @@
 
 #endif /* PLATFORM(WIN_OS) */
 
+<<<<<<< HEAD:WebCore/config.h
 // ANDROID def should be after all PLATFORM to avoid override.
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #if PLATFORM(ANDROID)
 #define WEBCORE_NAVIGATOR_VENDOR "Google Inc."
 // This must be defined before we include FastMalloc.h, below.
 #define USE_SYSTEM_MALLOC 1
+<<<<<<< HEAD:WebCore/config.h
 #define ANDROID_MOBILE      // change can be merged back to WebKit.org for MOBILE
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #define LOG_DISABLED 1
 #include <wtf/Assertions.h>
 // Central place to set which optional features Android uses.
@@ -93,6 +99,7 @@
 #endif
 #define ENABLE_VIDEO 1
 #define ENABLE_WORKERS 1
+<<<<<<< HEAD:WebCore/config.h
 #if ENABLE_SVG
 #if !defined(ENABLE_SVG_ANIMATION)
 #define ENABLE_SVG_ANIMATION 0 // to enable:
@@ -106,19 +113,28 @@
 #define ENABLE_SVG_FOREIGN_OBJECT 1
 #define ENABLE_SVG_USE 1
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #define ENABLE_XBL 0
 #define ENABLE_XPATH 0
 #define ENABLE_XSLT 0
+<<<<<<< HEAD:WebCore/config.h
 
 #undef ENABLE_ARCHIVE  // Enabled by default in Platform.h
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #define ENABLE_ARCHIVE 0
 #define ENABLE_OFFLINE_WEB_APPLICATIONS 1
+<<<<<<< HEAD:WebCore/config.h
 #define ENABLE_TOUCH_EVENTS 1
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #undef ENABLE_GEOLOCATION  // Disabled by default in Platform.h
 #define ENABLE_GEOLOCATION 1
 #undef ENABLE_INSPECTOR  // Enabled by default in Platform.h
 #define ENABLE_INSPECTOR 0
 #define ENABLE_EVENT_SOURCE 0
+<<<<<<< HEAD:WebCore/config.h
 
 #define FLATTEN_FRAMESET
 #define FLATTEN_IFRAME
@@ -195,6 +211,8 @@
 // a page is cached. Invoke loadEvent when a page is restored.
 #define ANDROID_PAGE_CACHE_UNLOAD
 
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #endif /* PLATFORM(ANDROID) */
 
 #ifdef __cplusplus
diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index 65a6ecf..ce43cd6 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -33,10 +33,8 @@
 #include "CSSReflectValue.h"
 #include "CSSTimingFunctionValue.h"
 #include "CSSValueList.h"
-#include "CachedImage.h"
 #include "Document.h"
 #include "ExceptionCode.h"
-#include "Pair.h"
 #include "Rect.h"
 #include "RenderBox.h"
 #include "RenderLayer.h"
@@ -177,6 +175,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBoxReflect,
     CSSPropertyWebkitBoxShadow,
     CSSPropertyWebkitBoxSizing,
+    CSSPropertyWebkitColorCorrection,
     CSSPropertyWebkitColumnBreakAfter,
     CSSPropertyWebkitColumnBreakBefore,
     CSSPropertyWebkitColumnBreakInside,
@@ -915,9 +914,9 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueNormal);
             return CSSPrimitiveValue::create(style->letterSpacing(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyWebkitLineClamp:
-            if (style->lineClamp() == -1)
+            if (style->lineClamp().isNone())
                 return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-            return CSSPrimitiveValue::create(style->lineClamp(), CSSPrimitiveValue::CSS_PERCENTAGE);
+            return CSSPrimitiveValue::create(style->lineClamp().value(), style->lineClamp().isPercentage() ? CSSPrimitiveValue::CSS_PERCENTAGE : CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyLineHeight: {
             Length length = style->lineHeight();
             if (length.isNegative())
@@ -1391,6 +1390,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return getTimingFunctionValue(style->transitions());
         case CSSPropertyPointerEvents:
             return CSSPrimitiveValue::create(style->pointerEvents());
+        case CSSPropertyWebkitColorCorrection:
+            return CSSPrimitiveValue::create(style->colorSpace());
 
         /* Shorthand properties, currently not supported see bug 13658*/
         case CSSPropertyBackground:
@@ -1522,7 +1523,7 @@ unsigned CSSComputedStyleDeclaration::length() const
 String CSSComputedStyleDeclaration::item(unsigned i) const
 {
     if (i >= length())
-        return String();
+        return "";
 
     return getPropertyName(static_cast<CSSPropertyID>(computedProperties[i]));
 }
diff --git a/WebCore/css/CSSCursorImageValue.cpp b/WebCore/css/CSSCursorImageValue.cpp
index c1a517c..fe10cf3 100644
--- a/WebCore/css/CSSCursorImageValue.cpp
+++ b/WebCore/css/CSSCursorImageValue.cpp
@@ -25,7 +25,6 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "PlatformString.h"
-#include "RenderStyle.h"
 #include <wtf/MathExtras.h>
 #include <wtf/UnusedParam.h>
 
diff --git a/WebCore/css/CSSFontSelector.cpp b/WebCore/css/CSSFontSelector.cpp
index 35bc876..ce3253c 100644
--- a/WebCore/css/CSSFontSelector.cpp
+++ b/WebCore/css/CSSFontSelector.cpp
@@ -45,7 +45,6 @@
 #include "FontCache.h"
 #include "FontFamilyValue.h"
 #include "Frame.h"
-#include "NodeList.h"
 #include "RenderObject.h"
 #include "Settings.h"
 #include "SimpleFontData.h"
diff --git a/WebCore/css/CSSGradientValue.cpp b/WebCore/css/CSSGradientValue.cpp
index 3f45e47..5946d7a 100644
--- a/WebCore/css/CSSGradientValue.cpp
+++ b/WebCore/css/CSSGradientValue.cpp
@@ -29,9 +29,7 @@
 #include "CSSStyleSelector.h"
 #include "GeneratedImage.h"
 #include "Gradient.h"
-#include "GraphicsContext.h"
 #include "Image.h"
-#include "ImageBuffer.h"
 #include "IntSize.h"
 #include "IntSizeHash.h"
 #include "PlatformString.h"
diff --git a/WebCore/css/CSSGrammar.y b/WebCore/css/CSSGrammar.y
index 0530e91..22e3aaf 100644
--- a/WebCore/css/CSSGrammar.y
+++ b/WebCore/css/CSSGrammar.y
@@ -97,7 +97,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 51
+%expect 48
 
 %nonassoc LOWEST_PREC
 
@@ -184,18 +184,15 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %type <rule> charset
 %type <rule> ruleset
-%type <rule> valid_rule_or_import
 %type <rule> media
 %type <rule> import
+%type <rule> namespace
 %type <rule> page
 %type <rule> font_face
 %type <rule> keyframes
 %type <rule> invalid_rule
 %type <rule> save_block
 %type <rule> invalid_at
-%type <rule> invalid_at_list
-%type <rule> invalid_import
-%type <rule> invalid_media
 %type <rule> rule
 %type <rule> valid_rule
 %type <ruleList> block_rule_list 
@@ -268,7 +265,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %%
 
 stylesheet:
-    maybe_space maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
+    maybe_space maybe_charset maybe_sgml rule_list
   | webkit_rule maybe_space
   | webkit_decls maybe_space
   | webkit_value maybe_space
@@ -278,13 +275,8 @@ stylesheet:
   | webkit_keyframe_rule maybe_space
   ;
 
-valid_rule_or_import:
-    valid_rule
-  | import
-  ;
-
 webkit_rule:
-    WEBKIT_RULE_SYM '{' maybe_space valid_rule_or_import maybe_space '}' {
+    WEBKIT_RULE_SYM '{' maybe_space valid_rule maybe_space '}' {
         static_cast<CSSParser*>(parser)->m_rule = $4;
     }
 ;
@@ -373,31 +365,6 @@ charset:
   }
 ;
 
-import_list:
- /* empty */
- | import_list import maybe_sgml {
-     CSSParser* p = static_cast<CSSParser*>(parser);
-     if ($2 && p->m_styleSheet)
-         p->m_styleSheet->append($2);
- }
- | invalid_at_list {
- }
- ;
-
-variables_list:
-/* empty */
-| variables_list variables_rule maybe_sgml {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-     if ($2 && p->m_styleSheet)
-         p->m_styleSheet->append($2);
-}
-;
-
-namespace_list:
-/* empty */
-| namespace_list namespace maybe_sgml
-;
-
 rule_list:
    /* empty */
  | rule_list rule maybe_sgml {
@@ -413,13 +380,15 @@ valid_rule:
   | page
   | font_face
   | keyframes
+  | namespace
+  | import
+  | variables_rule
   ;
 
 rule:
     valid_rule
   | invalid_rule
   | invalid_at
-  | invalid_import
   ;
 
 block_rule_list: 
@@ -445,8 +414,10 @@ block_rule:
     block_valid_rule
   | invalid_rule
   | invalid_at
-  | invalid_import
-  | invalid_media
+  | namespace
+  | import
+  | variables_rule
+  | media
   ;
 
 
@@ -570,17 +541,23 @@ variable_name:
 
 namespace:
 NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space ';' {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-    if (p->m_styleSheet)
-        p->m_styleSheet->addNamespace(p, $3, $4);
+    static_cast<CSSParser*>(parser)->addNamespace($3, $4);
+    $$ = 0;
+}
+| NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space invalid_block {
+    $$ = 0;
+}
+| NAMESPACE_SYM error invalid_block {
+    $$ = 0;
+}
+| NAMESPACE_SYM error ';' {
+    $$ = 0;
 }
-| NAMESPACE_SYM error invalid_block
-| NAMESPACE_SYM error ';'
 ;
 
 maybe_ns_prefix:
 /* empty */ { $$.characters = 0; }
-| IDENT WHITESPACE { $$ = $1; }
+| IDENT maybe_space { $$ = $1; }
 ;
 
 string_or_uri:
@@ -1481,23 +1458,6 @@ invalid_at:
     }
     ;
 
-invalid_at_list:
-    invalid_at maybe_sgml
-  | invalid_at_list invalid_at maybe_sgml
-  ;
-
-invalid_import:
-    import {
-        $$ = 0;
-    }
-    ;
-
-invalid_media:
-    media {
-        $$ = 0;
-    }
-    ;
-
 invalid_rule:
     error invalid_block {
         $$ = 0;
diff --git a/WebCore/css/CSSImageValue.cpp b/WebCore/css/CSSImageValue.cpp
index 3432a4e..96a8dec 100644
--- a/WebCore/css/CSSImageValue.cpp
+++ b/WebCore/css/CSSImageValue.cpp
@@ -25,7 +25,6 @@
 #include "Cache.h"
 #include "CachedImage.h"
 #include "DocLoader.h"
-#include "RenderStyle.h"
 #include "StyleCachedImage.h"
 
 namespace WebCore {
diff --git a/WebCore/css/CSSImportRule.cpp b/WebCore/css/CSSImportRule.cpp
index 2fe7abf..8534adf 100644
--- a/WebCore/css/CSSImportRule.cpp
+++ b/WebCore/css/CSSImportRule.cpp
@@ -25,7 +25,6 @@
 #include "CachedCSSStyleSheet.h"
 #include "DocLoader.h"
 #include "Document.h"
-#include "MediaList.h"
 #include "Settings.h"
 #include <wtf/StdLibExtras.h>
 
diff --git a/WebCore/css/CSSInheritedValue.cpp b/WebCore/css/CSSInheritedValue.cpp
index 08d3db3..20b73e2 100644
--- a/WebCore/css/CSSInheritedValue.cpp
+++ b/WebCore/css/CSSInheritedValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/CSSInitialValue.cpp b/WebCore/css/CSSInitialValue.cpp
index 9c2bb23..cbe776b 100644
--- a/WebCore/css/CSSInitialValue.cpp
+++ b/WebCore/css/CSSInitialValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/CSSMediaRule.cpp b/WebCore/css/CSSMediaRule.cpp
index 610e988..d1c220b 100644
--- a/WebCore/css/CSSMediaRule.cpp
+++ b/WebCore/css/CSSMediaRule.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2005, 2006 Apple Computer, Inc.
diff --git a/WebCore/css/CSSMutableStyleDeclaration.cpp b/WebCore/css/CSSMutableStyleDeclaration.cpp
index 2dd2f5d..b86be05 100644
--- a/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -23,7 +23,6 @@
 
 #include "CSSImageValue.h"
 #include "CSSParser.h"
-#include "CSSProperty.h"
 #include "CSSPropertyLonghand.h"
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
@@ -259,20 +258,28 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
 
 String CSSMutableStyleDeclaration::get4Values(const int* properties) const
 {
-    String res;
-    for (int i = 0; i < 4; ++i) {
-        if (!isPropertyImplicit(properties[i])) {
-            RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
+    // Assume the properties are in the usual order top, right, bottom, left.
+    RefPtr<CSSValue> topValue = getPropertyCSSValue(properties[0]);
+    RefPtr<CSSValue> rightValue = getPropertyCSSValue(properties[1]);
+    RefPtr<CSSValue> bottomValue = getPropertyCSSValue(properties[2]);
+    RefPtr<CSSValue> leftValue = getPropertyCSSValue(properties[3]);
 
-            // apparently all 4 properties must be specified.
-            if (!value)
-                return String();
+    // All 4 properties must be specified.
+    if (!topValue || !rightValue || !bottomValue || !leftValue)
+        return String();
+
+    bool showLeft = rightValue->cssText() != leftValue->cssText();
+    bool showBottom = (topValue->cssText() != bottomValue->cssText()) || showLeft;
+    bool showRight = (topValue->cssText() != rightValue->cssText()) || showBottom;
+
+    String res = topValue->cssText();
+    if (showRight)
+        res += " " + rightValue->cssText();
+    if (showBottom)
+        res += " " + bottomValue->cssText();
+    if (showLeft)
+        res += " " + leftValue->cssText();
 
-            if (!res.isNull())
-                res += " ";
-            res += value->cssText();
-        }
-    }
     return res;
 }
 
@@ -628,7 +635,7 @@ unsigned CSSMutableStyleDeclaration::length() const
 String CSSMutableStyleDeclaration::item(unsigned i) const
 {
     if (i >= m_properties.size())
-       return String();
+       return "";
     return getPropertyName(static_cast<CSSPropertyID>(m_properties[i].id()));
 }
 
diff --git a/WebCore/css/CSSNamespace.h b/WebCore/css/CSSNamespace.h
index 9194be8..0a1119d 100644
--- a/WebCore/css/CSSNamespace.h
+++ b/WebCore/css/CSSNamespace.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  * Copyright (C) 2004, 2006 Apple Computer, Inc.
@@ -28,7 +26,7 @@
 
 namespace WebCore {
 
-    struct CSSNamespace {
+    struct CSSNamespace : Noncopyable {
         AtomicString m_prefix;
         AtomicString m_uri;
         CSSNamespace* m_parent;
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index 0da1b85..19d82ee 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -146,6 +146,9 @@ CSSParser::CSSParser(bool strictParsing)
     , m_defaultNamespace(starAtom)
     , m_data(0)
     , yy_start(1)
+    , m_allowImportRules(true)
+    , m_allowVariablesRules(true)
+    , m_allowNamespaceDeclarations(true)
     , m_floatingMediaQuery(0)
     , m_floatingMediaQueryExp(0)
     , m_floatingMediaQueryExpList(0)
@@ -242,6 +245,7 @@ PassRefPtr<CSSRule> CSSParser::parseRule(CSSStyleSheet* sheet, const String& str
     android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
 #endif
     m_styleSheet = sheet;
+    m_allowNamespaceDeclarations = false;
     setupParser("@-webkit-rule{", string, "} ");
     cssyyparse(this);
 #ifdef ANDROID_INSTRUMENT
@@ -1297,6 +1301,9 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitBoxSizing:
         valid_primitive = id == CSSValueBorderBox || id == CSSValueContentBox;
         break;
+    case CSSPropertyWebkitColorCorrection:
+        valid_primitive = id == CSSValueSrgb || id == CSSValueDefault;
+        break;
     case CSSPropertyWebkitMarquee: {
         const int properties[5] = { CSSPropertyWebkitMarqueeDirection, CSSPropertyWebkitMarqueeIncrement,
                                     CSSPropertyWebkitMarqueeRepetition,
@@ -1541,7 +1548,9 @@ bool CSSParser::parseValue(int propId, bool important)
     // Apple specific properties.  These will never be standardized and are purely to
     // support custom WebKit-based Apple applications.
     case CSSPropertyWebkitLineClamp:
-        valid_primitive = (!id && validUnit(value, FPercent, false));
+        // When specifying number of lines, don't allow 0 as a valid value
+        // When specifying either type of unit, require non-negative integers
+        valid_primitive = (!id && (value->unit == CSSPrimitiveValue::CSS_PERCENTAGE || value->fValue) && validUnit(value, FInteger | FPercent | FNonNeg, false));
         break;
     case CSSPropertyWebkitTextSizeAdjust:
         if (id == CSSValueAuto || id == CSSValueNone)
@@ -3388,6 +3397,12 @@ bool CSSParser::parseFontWeight(bool important)
     return false;
 }
 
+static bool isValidFormatFunction(CSSParserValue* val)
+{
+    CSSParserValueList* args = val->function->args;
+    return equalIgnoringCase(val->function->name, "format(") && (args->current()->unit == CSSPrimitiveValue::CSS_STRING || args->current()->unit == CSSPrimitiveValue::CSS_IDENT);
+}
+
 bool CSSParser::parseFontFaceSrc()
 {
     RefPtr<CSSValueList> values(CSSValueList::createCommaSeparated());
@@ -3415,7 +3430,7 @@ bool CSSParser::parseFontFaceSrc()
                     CSSParserValue* a = args->current();
                     uriValue.clear();
                     parsedValue = CSSFontFaceSrcValue::createLocal(a->string);
-                } else if (equalIgnoringCase(val->function->name, "format(") && allowFormat && uriValue) {
+                } else if (allowFormat && uriValue && isValidFormatFunction(val)) {
                     expectComma = true;
                     allowFormat = false;
                     uriValue->setFormat(args->current()->string);
@@ -4673,11 +4688,13 @@ static inline int yyerror(const char*) { return 1; }
 int CSSParser::lex(void* yylvalWithoutType)
 {
     YYSTYPE* yylval = static_cast<YYSTYPE*>(yylvalWithoutType);
-    int token = lex();
     int length;
+    
+    lex();
+
     UChar* t = text(&length);
 
-    switch (token) {
+    switch (token()) {
     case WHITESPACE:
     case SGML_CD:
     case INCLUDES:
@@ -4743,7 +4760,7 @@ int CSSParser::lex(void* yylvalWithoutType)
         break;
     }
 
-    return token;
+    return token();
 }
 
 static inline bool isCSSWhitespace(UChar c)
@@ -4751,6 +4768,28 @@ static inline bool isCSSWhitespace(UChar c)
     return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '\f';
 }
 
+void CSSParser::recheckAtKeyword(const UChar* str, int len)
+{
+    String ruleName(str, len);
+    if (equalIgnoringCase(ruleName, "@import"))
+        yyTok = IMPORT_SYM;
+    else if (equalIgnoringCase(ruleName, "@page"))
+        yyTok = PAGE_SYM;
+    else if (equalIgnoringCase(ruleName, "@media"))
+        yyTok = MEDIA_SYM;
+    else if (equalIgnoringCase(ruleName, "@font-face"))
+        yyTok = FONT_FACE_SYM;
+    else if (equalIgnoringCase(ruleName, "@charset"))
+        yyTok = CHARSET_SYM;
+    else if (equalIgnoringCase(ruleName, "@namespace"))
+        yyTok = NAMESPACE_SYM;
+    else if (equalIgnoringCase(ruleName, "@-webkit-keyframes"))
+        yyTok = WEBKIT_KEYFRAMES_SYM;
+    else if (equalIgnoringCase(ruleName, "@-webkit-mediaquery"))
+        yyTok = WEBKIT_MEDIAQUERY_SYM;
+    // FIXME: Add CSS Variables if we ever decide to turn it back on.
+}
+
 UChar* CSSParser::text(int *length)
 {
     UChar* start = yytext;
@@ -4804,6 +4843,8 @@ UChar* CSSParser::text(int *length)
     UChar* out = start;
     UChar* escape = 0;
 
+    bool sawEscape = false;
+
     for (int i = 0; i < l; i++) {
         UChar* current = start + i;
         if (escape == current - 1) {
@@ -4848,6 +4889,7 @@ UChar* CSSParser::text(int *length)
         }
         if (!escape && *current == '\\') {
             escape = current;
+            sawEscape = true;
             continue;
         }
         *out++ = *current;
@@ -4868,6 +4910,12 @@ UChar* CSSParser::text(int *length)
     }
     
     *length = out - start;
+    
+    // If we have an unrecognized @-keyword, and if we handled any escapes at all, then
+    // we should attempt to adjust yyTok to the correct type.
+    if (yyTok == ATKEYWORD && sawEscape)
+        recheckAtKeyword(start, *length);
+
     return start;
 }
 
@@ -4998,7 +5046,7 @@ CSSRule* CSSParser::createCharsetRule(const CSSParserString& charset)
 
 CSSRule* CSSParser::createImportRule(const CSSParserString& url, MediaList* media)
 {
-    if (!media || !m_styleSheet)
+    if (!media || !m_styleSheet || !m_allowImportRules)
         return 0;
     RefPtr<CSSImportRule> rule = CSSImportRule::create(m_styleSheet, url, media);
     CSSImportRule* result = rule.get();
@@ -5010,6 +5058,7 @@ CSSRule* CSSParser::createMediaRule(MediaList* media, CSSRuleList* rules)
 {
     if (!media || !rules || !m_styleSheet)
         return 0;
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<CSSMediaRule> rule = CSSMediaRule::create(m_styleSheet, media, rules);
     CSSMediaRule* result = rule.get();
     m_parsedStyleObjects.append(rule.release());
@@ -5027,6 +5076,7 @@ CSSRuleList* CSSParser::createRuleList()
 
 WebKitCSSKeyframesRule* CSSParser::createKeyframesRule()
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<WebKitCSSKeyframesRule> rule = WebKitCSSKeyframesRule::create(m_styleSheet);
     WebKitCSSKeyframesRule* rulePtr = rule.get();
     m_parsedStyleObjects.append(rule.release());
@@ -5035,6 +5085,7 @@ WebKitCSSKeyframesRule* CSSParser::createKeyframesRule()
 
 CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     CSSStyleRule* result = 0;
     if (selectors) {
         RefPtr<CSSStyleRule> rule = CSSStyleRule::create(m_styleSheet);
@@ -5051,6 +5102,7 @@ CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 
 CSSRule* CSSParser::createFontFaceRule()
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
     for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
@@ -5068,6 +5120,15 @@ CSSRule* CSSParser::createFontFaceRule()
     return result;
 }
 
+void CSSParser::addNamespace(const AtomicString& prefix, const AtomicString& uri)
+{
+    if (!m_styleSheet || !m_allowNamespaceDeclarations)
+        return;
+    m_allowImportRules = false;
+    m_allowVariablesRules = false;
+    m_styleSheet->addNamespace(this, prefix, uri);
+}
+
 #if !ENABLE(CSS_VARIABLES)
 
 CSSRule* CSSParser::createVariablesRule(MediaList*, bool)
@@ -5089,6 +5150,9 @@ bool CSSParser::addVariableDeclarationBlock(const CSSParserString&)
 
 CSSRule* CSSParser::createVariablesRule(MediaList* mediaList, bool variablesKeyword)
 {
+    if (!m_allowVariablesRules)
+        return 0;
+    m_allowImportRules = false;
     RefPtr<CSSVariablesRule> rule = CSSVariablesRule::create(m_styleSheet, mediaList, variablesKeyword);
     rule->setDeclaration(CSSVariablesDeclaration::create(rule.get(), m_variableNames, m_variableValues));
     clearVariables();    
diff --git a/WebCore/css/CSSParser.h b/WebCore/css/CSSParser.h
index 6d1bb32..d032886 100644
--- a/WebCore/css/CSSParser.h
+++ b/WebCore/css/CSSParser.h
@@ -187,13 +187,15 @@ namespace WebCore {
         MediaQuery* createFloatingMediaQuery(Vector<MediaQueryExp*>*);
         MediaQuery* sinkFloatingMediaQuery(MediaQuery*);
 
+        void addNamespace(const AtomicString& prefix, const AtomicString& uri);
+
         bool addVariable(const CSSParserString&, CSSParserValueList*);
         bool addVariableDeclarationBlock(const CSSParserString&);
         bool checkForVariables(CSSParserValueList*);
         void addUnresolvedProperty(int propId, bool important);
         
         Vector<CSSSelector*>* reusableSelectorVector() { return &m_reusableSelectorVector; }
-        
+
         bool m_strict;
         bool m_important;
         int m_id;
@@ -225,6 +227,8 @@ namespace WebCore {
         int lex();
         
     private:
+        void recheckAtKeyword(const UChar* str, int len);
+    
         void clearProperties();
 
         void setupParser(const char* prefix, const String&, const char* suffix);
@@ -247,6 +251,10 @@ namespace WebCore {
         int yyTok;
         int yy_start;
 
+        bool m_allowImportRules;
+        bool m_allowVariablesRules;
+        bool m_allowNamespaceDeclarations;
+
         Vector<RefPtr<StyleBase> > m_parsedStyleObjects;
         Vector<RefPtr<CSSRuleList> > m_parsedRuleLists;
         HashSet<CSSSelector*> m_floatingSelectors;
@@ -287,7 +295,7 @@ namespace WebCore {
     int cssPropertyID(const String&);
     int cssValueKeywordID(const CSSParserString&);
 
-    class ShorthandScope {
+    class ShorthandScope : public FastAllocBase {
     public:
         ShorthandScope(CSSParser* parser, int propId) : m_parser(parser)
         {
diff --git a/WebCore/css/CSSPrimitiveValueMappings.h b/WebCore/css/CSSPrimitiveValueMappings.h
index 6f89df9..3c6097b 100644
--- a/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2007 Alexey Proskuryakov <ap@nypop.com>.
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,6 +28,7 @@
 #ifndef CSSPrimitiveValueMappings_h
 #define CSSPrimitiveValueMappings_h
 
+#include "ColorSpace.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
 #include "FontSmoothingMode.h"
@@ -229,6 +230,9 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaReturnToRealtimeButtonPart:
             m_value.ident = CSSValueMediaReturnToRealtimeButton;
             break;
+        case MediaToggleClosedCaptionsButtonPart:
+            m_value.ident = CSSValueMediaToggleClosedCaptionsButton;
+            break;
         case MediaSliderPart:
             m_value.ident = CSSValueMediaSlider;
             break;
@@ -1881,6 +1885,32 @@ template<> inline CSSPrimitiveValue::operator TextRenderingMode() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ColorSpace space)
+    : m_type(CSS_IDENT)
+{
+    switch (space) {
+        case DeviceColorSpace:
+            m_value.ident = CSSValueDefault;
+            break;
+        case sRGBColorSpace:
+            m_value.ident = CSSValueSrgb;
+            break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator ColorSpace() const
+{
+    switch (m_value.ident) {
+        case CSSValueDefault:
+            return DeviceColorSpace;
+        case CSSValueSrgb:
+            return sRGBColorSpace;
+        default:
+            ASSERT_NOT_REACHED();
+            return DeviceColorSpace;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
diff --git a/WebCore/css/CSSProperty.cpp b/WebCore/css/CSSProperty.cpp
index 9b21a3f..d7f2175 100644
--- a/WebCore/css/CSSProperty.cpp
+++ b/WebCore/css/CSSProperty.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/CSSProperty.h b/WebCore/css/CSSProperty.h
index b5635d0..4505f33 100644
--- a/WebCore/css/CSSProperty.h
+++ b/WebCore/css/CSSProperty.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/CSSPropertyNames.in b/WebCore/css/CSSPropertyNames.in
index dff3a2b..fe610de 100644
--- a/WebCore/css/CSSPropertyNames.in
+++ b/WebCore/css/CSSPropertyNames.in
@@ -185,6 +185,7 @@ zoom
 -webkit-box-reflect
 -webkit-box-shadow
 -webkit-box-sizing
+-webkit-color-correction
 -webkit-column-break-after
 -webkit-column-break-before
 -webkit-column-break-inside
diff --git a/WebCore/css/CSSRule.cpp b/WebCore/css/CSSRule.cpp
index 8fe4caf..43d8eac 100644
--- a/WebCore/css/CSSRule.cpp
+++ b/WebCore/css/CSSRule.cpp
@@ -22,7 +22,6 @@
 #include "config.h"
 #include "CSSRule.h"
 
-#include "CSSStyleSheet.h"
 #include "NotImplemented.h"
 
 namespace WebCore {
diff --git a/WebCore/css/CSSRuleList.cpp b/WebCore/css/CSSRuleList.cpp
index 4528d40..7367ab2 100644
--- a/WebCore/css/CSSRuleList.cpp
+++ b/WebCore/css/CSSRuleList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2005, 2006 Apple Computer, Inc.
diff --git a/WebCore/css/CSSRuleList.h b/WebCore/css/CSSRuleList.h
index 26186b3..a355c4a 100644
--- a/WebCore/css/CSSRuleList.h
+++ b/WebCore/css/CSSRuleList.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2006 Apple Computer, Inc.
diff --git a/WebCore/css/CSSSelector.cpp b/WebCore/css/CSSSelector.cpp
index 313528f..ab2d22b 100644
--- a/WebCore/css/CSSSelector.cpp
+++ b/WebCore/css/CSSSelector.cpp
@@ -116,6 +116,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsRewindButton, ("-webkit-media-controls-rewind-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsReturnToRealtimeButton, ("-webkit-media-controls-return-to-realtime-button"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsToggleClosedCaptionsButton, ("-webkit-media-controls-toggle-closed-captions-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsStatusDisplay, ("-webkit-media-controls-status-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
@@ -271,6 +272,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsReturnToRealtimeButton) {
         m_pseudoType = PseudoMediaControlsReturnToRealtimeButton;
         element = true;
+    } else if (m_value == mediaControlsToggleClosedCaptionsButton) {
+        m_pseudoType = PseudoMediaControlsToggleClosedCaptions;
+        element = true;
     } else if (m_value == mediaControlsStatusDisplay) {
         m_pseudoType = PseudoMediaControlsStatusDisplay;
         element = true;
diff --git a/WebCore/css/CSSSelector.h b/WebCore/css/CSSSelector.h
index 0c3b677..95a72e4 100644
--- a/WebCore/css/CSSSelector.h
+++ b/WebCore/css/CSSSelector.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
@@ -176,6 +174,7 @@ namespace WebCore {
             PseudoMediaControlsVolumeSliderContainer,
             PseudoMediaControlsCurrentTimeDisplay,
             PseudoMediaControlsTimeRemainingDisplay,
+            PseudoMediaControlsToggleClosedCaptions,
             PseudoMediaControlsTimeline,
             PseudoMediaControlsVolumeSlider,
             PseudoMediaControlsSeekBackButton,
@@ -230,7 +229,7 @@ namespace WebCore {
 
         void extractPseudoType() const;
 
-        struct RareData {
+        struct RareData : Noncopyable {
             RareData(CSSSelector* tagHistory)
                 : m_tagHistory(tagHistory)
                 , m_simpleSelector(0)
diff --git a/WebCore/css/CSSStyleDeclaration.idl b/WebCore/css/CSSStyleDeclaration.idl
index 3e37418..42682ef 100644
--- a/WebCore/css/CSSStyleDeclaration.idl
+++ b/WebCore/css/CSSStyleDeclaration.idl
@@ -44,7 +44,7 @@ module css {
             raises(DOMException);
 
         readonly attribute unsigned long    length;
-        [ConvertNullStringTo=Null] DOMString          item(in unsigned long index);
+        DOMString          item(in unsigned long index);
         readonly attribute CSSRule          parentRule;
 
         // Extensions
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index 3276964..b3f5d72 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -28,14 +28,11 @@
 
 #include "CSSBorderImageValue.h"
 #include "CSSCursorImageValue.h"
-#include "CSSFontFace.h"
 #include "CSSFontFaceRule.h"
-#include "CSSFontFaceSource.h"
 #include "CSSImportRule.h"
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
 #include "CSSPrimitiveValueMappings.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSReflectValue.h"
 #include "CSSRuleList.h"
@@ -61,6 +58,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
+#include "KeyframeList.h"
 #include "LinkHash.h"
 #include "MappedAttribute.h"
 #include "MatrixTransformOperation.h"
@@ -350,7 +348,7 @@ if (id == propID) { \
     return; \
 }
 
-class CSSRuleSet {
+class CSSRuleSet : public Noncopyable {
 public:
     CSSRuleSet();
     ~CSSRuleSet();
@@ -662,7 +660,7 @@ void CSSStyleSelector::matchRules(CSSRuleSet* rules, int& firstRuleIndex, int& l
         matchRulesForList(rules->getIDRules(m_element->getIDAttribute().impl()), firstRuleIndex, lastRuleIndex);
     if (m_element->hasClass()) {
         ASSERT(m_styledElement);
-        const ClassNames& classNames = m_styledElement->classNames();
+        const SpaceSplitString& classNames = m_styledElement->classNames();
         size_t size = classNames.size();
         for (size_t i = 0; i < size; ++i)
             matchRulesForList(rules->getClassRules(classNames[i].impl()), firstRuleIndex, lastRuleIndex);
@@ -2556,6 +2554,9 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoMediaControlsReturnToRealtimeButton:
                 dynamicPseudo = MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON;
                 return true;
+            case CSSSelector::PseudoMediaControlsToggleClosedCaptions:
+                dynamicPseudo = MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON;
+                return true;
             case CSSSelector::PseudoMediaControlsStatusDisplay:
                 dynamicPseudo = MEDIA_CONTROLS_STATUS_DISPLAY;
                 return true;
@@ -5000,13 +5001,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitMarginBottomCollapse:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginBottomCollapse, MarginBottomCollapse)
         return;
-
-    // Apple-specific changes.  Do not merge these properties into KHTML.
     case CSSPropertyWebkitLineClamp: {
         HANDLE_INHERIT_AND_INITIAL(lineClamp, LineClamp)
         if (!primitiveValue)
             return;
-        m_style->setLineClamp(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE));
+        int type = primitiveValue->primitiveType();
+        if (type == CSSPrimitiveValue::CSS_NUMBER)
+            m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_NUMBER), LineClampLineCount));
+        else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
+            m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE), LineClampPercentage));
         return;
     }
     case CSSPropertyWebkitHighlight: {
@@ -5267,6 +5270,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setPointerEvents(*primitiveValue);
         return;
     }
+    case CSSPropertyWebkitColorCorrection:
+        if (isInherit) 
+            m_style->setColorSpace(m_parentStyle->colorSpace());
+        else if (isInitial)
+            m_style->setColorSpace(DeviceColorSpace);
+        else {
+            if (!primitiveValue)
+                return;
+            m_style->setColorSpace(*primitiveValue);
+        }
+        return;
     case CSSPropertyInvalid:
         return;
     case CSSPropertyFontStretch:
diff --git a/WebCore/css/CSSStyleSelector.h b/WebCore/css/CSSStyleSelector.h
index 6e0663f..fab5006 100644
--- a/WebCore/css/CSSStyleSelector.h
+++ b/WebCore/css/CSSStyleSelector.h
@@ -23,7 +23,6 @@
 #define CSSStyleSelector_h
 
 #include "CSSFontSelector.h"
-#include "KeyframeList.h"
 #include "LinkHash.h"
 #include "MediaQueryExp.h"
 #include "RenderStyle.h"
@@ -56,6 +55,7 @@ class Element;
 class Frame;
 class FrameView;
 class KURL;
+class KeyframeList;
 class MediaQueryEvaluator;
 class Node;
 class Settings;
@@ -65,7 +65,7 @@ class StyleSheetList;
 class StyledElement;
 class WebKitCSSKeyframesRule;
 
-class MediaQueryResult {
+class MediaQueryResult : public Noncopyable {
 public:
     MediaQueryResult(const MediaQueryExp& expr, bool result)
         : m_expression(expr)
@@ -286,7 +286,7 @@ public:
         HashMap<CSSMutableStyleDeclaration*, RefPtr<CSSMutableStyleDeclaration> > m_resolvedVariablesDeclarations;
     };
 
-    class CSSRuleData {
+    class CSSRuleData : public Noncopyable {
     public:
         CSSRuleData(unsigned pos, CSSStyleRule* r, CSSSelector* sel, CSSRuleData* prev = 0)
             : m_position(pos)
@@ -314,7 +314,7 @@ public:
         CSSRuleData* m_next;
     };
 
-    class CSSRuleDataList {
+    class CSSRuleDataList : public Noncopyable {
     public:
         CSSRuleDataList(unsigned pos, CSSStyleRule* rule, CSSSelector* sel)
             : m_first(new CSSRuleData(pos, rule, sel))
diff --git a/WebCore/css/CSSStyleSheet.cpp b/WebCore/css/CSSStyleSheet.cpp
index 1579999..f6cd6f2 100644
--- a/WebCore/css/CSSStyleSheet.cpp
+++ b/WebCore/css/CSSStyleSheet.cpp
@@ -28,6 +28,7 @@
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Node.h"
+#include "SecurityOrigin.h"
 #include "TextEncoding.h"
 #include <wtf/Deque.h>
 
@@ -118,6 +119,8 @@ int CSSStyleSheet::addRule(const String& selector, const String& style, Exceptio
 
 PassRefPtr<CSSRuleList> CSSStyleSheet::cssRules(bool omitCharsetRules)
 {
+    if (doc() && !doc()->securityOrigin()->canRequest(baseURL()))
+        return 0;
     return CSSRuleList::create(this, omitCharsetRules);
 }
 
@@ -135,7 +138,7 @@ void CSSStyleSheet::deleteRule(unsigned index, ExceptionCode& ec)
 
 void CSSStyleSheet::addNamespace(CSSParser* p, const AtomicString& prefix, const AtomicString& uri)
 {
-    if (uri.isEmpty())
+    if (uri.isNull())
         return;
 
     m_namespaces = new CSSNamespace(prefix, uri, m_namespaces);
@@ -148,11 +151,11 @@ void CSSStyleSheet::addNamespace(CSSParser* p, const AtomicString& prefix, const
 
 const AtomicString& CSSStyleSheet::determineNamespace(const AtomicString& prefix)
 {
-    if (prefix.isEmpty())
+    if (prefix.isNull())
         return nullAtom; // No namespace. If an element/attribute has a namespace, we won't match it.
-    else if (prefix == starAtom)
+    if (prefix == starAtom)
         return starAtom; // We'll match any namespace.
-    else if (m_namespaces) {
+    if (m_namespaces) {
         CSSNamespace* ns = m_namespaces->namespaceForPrefix(prefix);
         if (ns)
             return ns->uri();
@@ -227,10 +230,12 @@ void CSSStyleSheet::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
         CSSStyleSheet* styleSheet = styleSheetQueue.first();
         styleSheetQueue.removeFirst();
 
-        RefPtr<CSSRuleList> ruleList = styleSheet->cssRules();
-
-        for (unsigned i = 0; i < ruleList->length(); ++i) {
-            CSSRule* rule = ruleList->item(i);
+        for (unsigned i = 0; i < styleSheet->length(); ++i) {
+            StyleBase* styleBase = styleSheet->item(i);
+            if (!styleBase->isRule())
+                continue;
+            
+            CSSRule* rule = static_cast<CSSRule*>(styleBase);
             if (rule->isImportRule()) {
                 if (CSSStyleSheet* ruleStyleSheet = static_cast<CSSImportRule*>(rule)->styleSheet())
                     styleSheetQueue.append(ruleStyleSheet);
diff --git a/WebCore/css/CSSValueKeywords.in b/WebCore/css/CSSValueKeywords.in
index 1b7b1d8..1c35b23 100644
--- a/WebCore/css/CSSValueKeywords.in
+++ b/WebCore/css/CSSValueKeywords.in
@@ -511,6 +511,7 @@ media-seek-back-button
 media-seek-forward-button
 media-rewind-button
 media-return-to-realtime-button
+media-toggle-closed-captions-button
 media-slider
 media-sliderthumb
 media-volume-slider-container
@@ -638,3 +639,7 @@ subpixel-antialiased
 optimizeSpeed
 optimizeLegibility
 geometricPrecision
+
+# -webkit-color-correction
+#default
+sRGB
diff --git a/WebCore/css/CSSValueList.cpp b/WebCore/css/CSSValueList.cpp
index 9633f7c..8f1f88d 100644
--- a/WebCore/css/CSSValueList.cpp
+++ b/WebCore/css/CSSValueList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *
diff --git a/WebCore/css/FontValue.cpp b/WebCore/css/FontValue.cpp
index 231ac64..991fc6e 100644
--- a/WebCore/css/FontValue.cpp
+++ b/WebCore/css/FontValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/MediaFeatureNames.cpp b/WebCore/css/MediaFeatureNames.cpp
index fcee5de..a7799c1 100644
--- a/WebCore/css/MediaFeatureNames.cpp
+++ b/WebCore/css/MediaFeatureNames.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/css/MediaFeatureNames.h b/WebCore/css/MediaFeatureNames.h
index 5196586..2799004 100644
--- a/WebCore/css/MediaFeatureNames.h
+++ b/WebCore/css/MediaFeatureNames.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/css/MediaQuery.h b/WebCore/css/MediaQuery.h
index ff22d9a..7cbd3bf 100644
--- a/WebCore/css/MediaQuery.h
+++ b/WebCore/css/MediaQuery.h
@@ -34,7 +34,7 @@
 namespace WebCore {
 class MediaQueryExp;
 
-class MediaQuery {
+class MediaQuery : public Noncopyable {
 public:
     enum Restrictor {
         Only, Not, None
diff --git a/WebCore/css/MediaQueryEvaluator.h b/WebCore/css/MediaQueryEvaluator.h
index 404504b..00ac394 100644
--- a/WebCore/css/MediaQueryEvaluator.h
+++ b/WebCore/css/MediaQueryEvaluator.h
@@ -49,7 +49,7 @@ class MediaQueryExp;
  * the device characteristics are not known. This can be used to prune the loading
  * of stylesheets to only those which are probable to match.
  */
-class MediaQueryEvaluator {
+class MediaQueryEvaluator : public Noncopyable {
 public:
     /** Creates evaluator which evaluates only simple media queries
      *  Evaluator returns true for "all", and returns value of \mediaFeatureResult
diff --git a/WebCore/css/MediaQueryExp.h b/WebCore/css/MediaQueryExp.h
index 5ff4af3..fd55cf6 100644
--- a/WebCore/css/MediaQueryExp.h
+++ b/WebCore/css/MediaQueryExp.h
@@ -36,7 +36,7 @@
 namespace WebCore {
 class CSSParserValueList;
 
-class MediaQueryExp {
+class MediaQueryExp : public FastAllocBase {
 public:
     MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* values);
     ~MediaQueryExp();
diff --git a/WebCore/css/Pair.h b/WebCore/css/Pair.h
index a2b127e..c76bd82 100644
--- a/WebCore/css/Pair.h
+++ b/WebCore/css/Pair.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/SVGCSSStyleSelector.cpp b/WebCore/css/SVGCSSStyleSelector.cpp
index 7e4483f..6d131df 100644
--- a/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/WebCore/css/SVGCSSStyleSelector.cpp
@@ -10,8 +10,6 @@
              (C) 2004 Allan Sandfeld Jensen(kde@carewolf.com)
              (C) 2004 Germain Garand(germain@ebooksfrance.org)
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/css/SVGCSSValueKeywords.in b/WebCore/css/SVGCSSValueKeywords.in
index 152a68f..91fb57e 100644
--- a/WebCore/css/SVGCSSValueKeywords.in
+++ b/WebCore/css/SVGCSSValueKeywords.in
@@ -183,7 +183,7 @@ new
 # CSS_PROP_STOP_OPACITY
 # CSS_PROP_COLOR_INTERPOLATION
 #auto
-sRGB
+#sRGB
 linearRGB
 
 # CSS_PROP_COLOR_INTERPOLATION_FILTERS
diff --git a/WebCore/css/ShadowValue.cpp b/WebCore/css/ShadowValue.cpp
index 27be86c..060a322 100644
--- a/WebCore/css/ShadowValue.cpp
+++ b/WebCore/css/ShadowValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2009 Apple Computer, Inc.
  *
diff --git a/WebCore/css/StyleSheet.cpp b/WebCore/css/StyleSheet.cpp
index 16e6278..b4fb3b2 100644
--- a/WebCore/css/StyleSheet.cpp
+++ b/WebCore/css/StyleSheet.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/StyleSheetList.cpp b/WebCore/css/StyleSheetList.cpp
index b9df810..2c90258 100644
--- a/WebCore/css/StyleSheetList.cpp
+++ b/WebCore/css/StyleSheetList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  *
diff --git a/WebCore/css/WebKitCSSKeyframesRule.cpp b/WebCore/css/WebKitCSSKeyframesRule.cpp
index 440d7a2..23f9f34 100644
--- a/WebCore/css/WebKitCSSKeyframesRule.cpp
+++ b/WebCore/css/WebKitCSSKeyframesRule.cpp
@@ -108,8 +108,16 @@ WebKitCSSKeyframeRule* WebKitCSSKeyframesRule::findRule(const String& s)
 
 int WebKitCSSKeyframesRule::findRuleIndex(const String& key) const
 {
+    String percentageString;
+    if (equalIgnoringCase(key, "from"))
+        percentageString = "0%";
+    else if (equalIgnoringCase(key, "to"))
+        percentageString = "100%";
+    else
+        percentageString = key;
+
     for (unsigned i = 0; i < length(); ++i) {
-        if (item(i)->keyText() == key)
+        if (item(i)->keyText() == percentageString)
             return i;
     }
 
diff --git a/WebCore/css/WebKitCSSKeyframesRule.h b/WebCore/css/WebKitCSSKeyframesRule.h
index 8c76b61..f58406f 100644
--- a/WebCore/css/WebKitCSSKeyframesRule.h
+++ b/WebCore/css/WebKitCSSKeyframesRule.h
@@ -64,7 +64,7 @@ public:
     // themselves, or know that it will get called later.
     void setNameInternal(const String& name)
     {   
-        m_name = name;
+        m_name = AtomicString(name);
     }
 
     CSSRuleList* cssRules() { return m_lstCSSRules.get(); }
diff --git a/WebCore/css/html.css b/WebCore/css/html.css
index 095fab3..1132d24 100644
--- a/WebCore/css/html.css
+++ b/WebCore/css/html.css
@@ -607,6 +607,22 @@ a:-webkit-any-link:active {
     color: -webkit-activelink
 }
 
+/* HTML5 ruby elements */
+
+ruby, rt {
+    text-indent: 0; /* blocks used for ruby rendering should not trigger this */ 
+}
+
+ruby > rt {
+    display: block;
+    font-size: 60%; /* make slightly larger than 50% for better readability */
+    text-align: center;
+}
+
+ruby > rp {
+    display: none;
+}
+
 /* other elements */
 
 noframes {
diff --git a/WebCore/css/maketokenizer b/WebCore/css/maketokenizer
index d14b37a..90d5fcb 100644
--- a/WebCore/css/maketokenizer
+++ b/WebCore/css/maketokenizer
@@ -1,7 +1,5 @@
 print <<END;
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2003 Lars Knoll (knoll\@kde.org)
  *
  *
@@ -73,30 +71,36 @@ typedef unsigned int flex_uint32_t;
 END
 }
 
-
+# Skip over the flex output prologue: the above typedefs, forward declarations, etc.
+# Stop when we get to the declarations of tables.
 while (<>) {
     last if /YY_NUM_RULES/;
 }
 
+# Dump the generated tables.  /yy_last_accepting/ matches the first declaration after the tables.
 print;
 while (<>) {
     last if /yy_last_accepting/;
     print;
 }
 
-# media query, tokenizer state support
+# Skip down the the declaration of yytext; the body of the flex output begins after it.
 while (<>) {
   last if /yytext/;
 }
+# Dump the definitions of states (INITIAL, media query, tokenizer state support).
 while (<>) {
   last if not (/define/ || /line/) ;
   print;
 }
 
+# Skip to main scanner function.
 while (<>) {
     last if /^YY_DECL/;
 }
 
+# Dump main scanner declarations, substituting in our 16-bit character type.
+# Declarations end with the declaration matching /yy_act/.
 print;
 while (<>) {
     s/char/UChar/;
@@ -104,23 +108,34 @@ while (<>) {
     last if /yy_act/;
 }
 
+# Skip past initialization code, down to main loop.
 while (<>) {
     last if /while \( 1 \)/;
 }
 
+# Dump the main loop, skipping over labels we don't use.
+# Stop before dumping the end-of-buffer handling, because we output our own custom end-of-buffer handling.
 print;
 while (<>) {
     next if /^yy_match:/;
     next if /^do_action:/;
     last if /YY_END_OF_BUFFER/;
+    if (/^case YY_STATE_EOF\(INITIAL\):/) {
+        print "case YY_END_OF_BUFFER:\n";
+        # flex outputs a ton of logic related to end-of-buffer handling; we just want to fall through to
+        # the yyterminate() found in other EOF states.  But we need to be careful to back up to behind
+        # the terminating double-NUL so that subsequent calls to flex will have the pointers in order,
+        # so this logic is a reduction of the normal flex-generated YY_END_OF_BUFFER code.
+        print "\tyy_c_buf_p = yy_cp - 1;\n";
+        print "\tyy_cp = yy_c_buf_p;\n";
+    }
     print;
-    print "case YY_END_OF_BUFFER:\n" if /^case YY_STATE_EOF\(INITIAL\):/;
 }
 
+# Skip over the end-of-buffer handling; dump the rest of the function.
 while (<>) {
     last if /default:/;
 }
-
 print;
 while (<>) {
     print;
diff --git a/WebCore/css/mediaControls.css b/WebCore/css/mediaControls.css
index d0ec90d..de2c2fe 100644
--- a/WebCore/css/mediaControls.css
+++ b/WebCore/css/mediaControls.css
@@ -124,3 +124,10 @@ audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewin
 audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
     display: none;
 }
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 16px;
+    height: 16px;
+}
diff --git a/WebCore/css/mediaControlsQuickTime.css b/WebCore/css/mediaControlsQuickTime.css
index 5cf48ae..965685d 100644
--- a/WebCore/css/mediaControlsQuickTime.css
+++ b/WebCore/css/mediaControlsQuickTime.css
@@ -132,7 +132,7 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     height: 16px;
     margin-left: 7px;
     margin-right: 7px;
-    -webkit-box-ordinal-group: 3; /* At the very end */
+    -webkit-box-ordinal-group: 4; /* At the very end */
 }
 
 audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
@@ -175,3 +175,13 @@ audio::-webkit-media-controls-status-display, video::-webkit-media-controls-stat
     text-indent: 0;
     text-decoration: none;
 }
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 16px;
+    height: 16px;
+    margin-left: 7px;
+    margin-right: 7px;
+    -webkit-box-ordinal-group: 3; /* between mute and fullscreen */
+}
diff --git a/WebCore/dom/BeforeUnloadEvent.cpp b/WebCore/dom/BeforeUnloadEvent.cpp
index 2521aa1..97d7f97 100644
--- a/WebCore/dom/BeforeUnloadEvent.cpp
+++ b/WebCore/dom/BeforeUnloadEvent.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/WebCore/dom/BeforeUnloadEvent.h b/WebCore/dom/BeforeUnloadEvent.h
index 39c96fd..2644693 100644
--- a/WebCore/dom/BeforeUnloadEvent.h
+++ b/WebCore/dom/BeforeUnloadEvent.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/WebCore/dom/CSSMappedAttributeDeclaration.cpp b/WebCore/dom/CSSMappedAttributeDeclaration.cpp
index 7fe0915..9ee6474 100644
--- a/WebCore/dom/CSSMappedAttributeDeclaration.cpp
+++ b/WebCore/dom/CSSMappedAttributeDeclaration.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
diff --git a/WebCore/dom/ClassNodeList.h b/WebCore/dom/ClassNodeList.h
index d40ee19..c519b3e 100644
--- a/WebCore/dom/ClassNodeList.h
+++ b/WebCore/dom/ClassNodeList.h
@@ -30,8 +30,8 @@
 #ifndef ClassNodeList_h
 #define ClassNodeList_h
 
-#include "ClassNames.h"
 #include "DynamicNodeList.h"
+#include "SpaceSplitString.h"
 
 namespace WebCore {
 
@@ -47,7 +47,7 @@ namespace WebCore {
 
         virtual bool nodeMatches(Element*) const;
 
-        ClassNames m_classNames;
+        SpaceSplitString m_classNames;
     };
 
 } // namespace WebCore
diff --git a/WebCore/dom/Clipboard.cpp b/WebCore/dom/Clipboard.cpp
index 6d1bc15..2aea90a 100644
--- a/WebCore/dom/Clipboard.cpp
+++ b/WebCore/dom/Clipboard.cpp
@@ -55,6 +55,8 @@ void Clipboard::setAccessPolicy(ClipboardAccessPolicy policy)
 static DragOperation dragOpFromIEOp(const String& op)
 {
     // yep, it's really just this fixed set
+    if (op == "uninitialized")
+        return DragOperationEvery;
     if (op == "none")
         return DragOperationNone;
     if (op == "copy")
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/WebCore/dom/CompositionEvent.cpp
index 20cd805..508d5e6 100644
--- a/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
+++ b/WebCore/dom/CompositionEvent.cpp
@@ -9,7 +9,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
@@ -21,30 +21,43 @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
  */
 
 #include "config.h"
+#include "CompositionEvent.h"
 
-#if ENABLE(3D_CANVAS)
+#include "EventNames.h"
 
-#include "JSCanvasFloatArray.h"
+namespace WebCore {
 
-#include "CanvasFloatArray.h"
+CompositionEvent::CompositionEvent()
+{
+}
 
-using namespace JSC;
+CompositionEvent::CompositionEvent(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data)
+    : UIEvent(type, true, true, view, 0)
+    , m_data(data)
+{
+}
 
-namespace WebCore {
+CompositionEvent::~CompositionEvent()
+{
+}
 
-void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void CompositionEvent::initCompositionEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view, const String& data)
 {
-    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+    if (dispatched())
+        return;
+
+    initUIEvent(type, canBubble, cancelable, view, 0);
+
+    m_data = data;
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
+bool CompositionEvent::isCompositionEvent() const
 {
-    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
+    return true;
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/dom/CompositionEvent.h b/WebCore/dom/CompositionEvent.h
new file mode 100644
index 0000000..4ff01ae
--- /dev/null
+++ b/WebCore/dom/CompositionEvent.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef CompositionEvent_h
+#define CompositionEvent_h
+
+#include "UIEvent.h"
+
+namespace WebCore {
+
+    class CompositionEvent : public UIEvent {
+    public:
+        static PassRefPtr<CompositionEvent> create()
+        {
+            return adoptRef(new CompositionEvent);
+        }
+        static PassRefPtr<CompositionEvent> create(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data)
+        {
+          return adoptRef(new CompositionEvent(type, view, data));
+        }
+        virtual ~CompositionEvent();
+    
+        void initCompositionEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>, const String& data);
+    
+        String data() const { return m_data; }
+
+        virtual bool isCompositionEvent() const;
+
+    private:
+        CompositionEvent();
+        CompositionEvent(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data);
+
+        String m_data;
+    };
+
+} // namespace WebCore
+
+#endif // CompositionEvent_h
diff --git a/WebCore/dom/CompositionEvent.idl b/WebCore/dom/CompositionEvent.idl
new file mode 100644
index 0000000..3752091
--- /dev/null
+++ b/WebCore/dom/CompositionEvent.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module events {
+
+    // Introduced in DOM Level 3:
+    interface [
+        GenerateConstructor
+    ] CompositionEvent : UIEvent {
+
+        readonly attribute DOMString data;
+
+        void initCompositionEvent(in DOMString typeArg, 
+                                  in boolean canBubbleArg, 
+                                  in boolean cancelableArg, 
+                                  in DOMWindow viewArg, 
+                                  in DOMString dataArg);
+
+    };
+
+}
diff --git a/WebCore/dom/DOMImplementation.cpp b/WebCore/dom/DOMImplementation.cpp
index 59b9703..f7c8242 100644
--- a/WebCore/dom/DOMImplementation.cpp
+++ b/WebCore/dom/DOMImplementation.cpp
@@ -305,7 +305,8 @@ PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(const String& tit
 {
     RefPtr<HTMLDocument> d = HTMLDocument::create(0);
     d->open();
-    d->write("<!doctype html><html><head><title>" + title + "</title></head><body></body></html>");
+    d->write("<!doctype html><html><body></body></html>");
+    d->setTitle(title);
     return d.release();
 }
 
diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index 174e58d..ba6dc97 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -98,6 +98,7 @@
 #include "PageGroup.h"
 #include "PageTransitionEvent.h"
 #include "PlatformKeyboardEvent.h"
+#include "PopStateEvent.h"
 #include "ProcessingInstruction.h"
 #include "ProgressEvent.h"
 #include "RegisteredEventListener.h"
@@ -386,15 +387,18 @@ Document::Document(Frame* frame, bool isXHTML)
     m_ignoreAutofocus = false;
 
     m_frame = frame;
+<<<<<<< HEAD:WebCore/dom/Document.cpp
     m_renderArena = 0;
 #if !PLATFORM(ANDROID)
+=======
+
+>>>>>>> webkit.org at r51976:WebCore/dom/Document.cpp
     m_axObjectCache = 0;
 #endif    
     m_docLoader = new DocLoader(this);
 
     visuallyOrdered = false;
     m_bParsing = false;
-    m_tokenizer = 0;
     m_wellFormed = false;
 
     setParseMode(Strict);
@@ -465,8 +469,7 @@ void Document::removedLastRef()
         deleteAllValues(m_markers);
         m_markers.clear();
 
-        delete m_tokenizer;
-        m_tokenizer = 0;
+        m_tokenizer.clear();
 
         m_cssCanvasElements.clear();
 
@@ -500,18 +503,15 @@ Document::~Document()
     forgetAllDOMNodesForDocument(this);
 #endif
 
-    delete m_tokenizer;
+    m_tokenizer.clear();
     m_document = 0;
     delete m_styleSelector;
-    delete m_docLoader;
-    
-    if (m_renderArena) {
-        delete m_renderArena;
-        m_renderArena = 0;
-    }
+    m_docLoader.clear();
+
+    m_renderArena.clear();
 
 #if ENABLE(XBL)
-    delete m_bindingManager;
+    m_bindingManager.clear();
 #endif
 
     deleteAllValues(m_markers);
@@ -1264,13 +1264,13 @@ void Document::recalcStyle(StyleChange change)
         return; // Guard against re-entrancy. -dwh
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->willRecalculateStyle();
 #endif
 
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
+    RenderWidget::suspendWidgetHierarchyUpdates();
     if (view())
         view()->pauseScheduledEvents();
     
@@ -1341,6 +1341,7 @@ bail_out:
 
     if (view())
         view()->resumeScheduledEvents();
+    RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
     m_inStyleRecalc = false;
 
@@ -1351,7 +1352,7 @@ bail_out:
     }
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didRecalculateStyle();
 #endif
 }
@@ -1442,7 +1443,7 @@ void Document::attach()
         m_renderArena = new RenderArena();
     
     // Create the rendering tree
-    setRenderer(new (m_renderArena) RenderView(this, view()));
+    setRenderer(new (m_renderArena.get()) RenderView(this, view()));
 #if USE(ACCELERATED_COMPOSITING)
     renderView()->didMoveOnscreen();
 #endif
@@ -1514,17 +1515,19 @@ void Document::detach()
     if (render)
         render->destroy();
     
+    HashSet<RefPtr<HistoryItem> > associatedHistoryItems;
+    associatedHistoryItems.swap(m_associatedHistoryItems);
+    HashSet<RefPtr<HistoryItem> >::iterator end = associatedHistoryItems.end();
+    for (HashSet<RefPtr<HistoryItem> >::iterator i = associatedHistoryItems.begin(); i != end; ++i)
+        (*i)->documentDetached(this);
+    
     // This is required, as our Frame might delete itself as soon as it detaches
     // us. However, this violates Node::detach() symantics, as it's never
     // possible to re-attach. Eventually Document::detach() should be renamed,
     // or this setting of the frame to 0 could be made explicit in each of the
     // callers of Document::detach().
     m_frame = 0;
-    
-    if (m_renderArena) {
-        delete m_renderArena;
-        m_renderArena = 0;
-    }
+    m_renderArena.clear();
 }
 
 void Document::removeAllEventListeners()
@@ -1647,8 +1650,7 @@ void Document::cancelParsing()
         // the onload handler when closing as a side effect of a cancel-style
         // change, such as opening a new document or closing the window while
         // still parsing
-        delete m_tokenizer;
-        m_tokenizer = 0;
+        m_tokenizer.clear();
         close();
     }
 }
@@ -1657,8 +1659,7 @@ void Document::implicitOpen()
 {
     cancelParsing();
 
-    delete m_tokenizer;
-    m_tokenizer = 0;
+    m_tokenizer.clear();
 
     removeChildren();
 
@@ -1755,8 +1756,7 @@ void Document::implicitClose()
 
     // We have to clear the tokenizer, in case someone document.write()s from the
     // onLoad event handler, as in Radar 3206524.
-    delete m_tokenizer;
-    m_tokenizer = 0;
+    m_tokenizer.clear();
 
     // Parser should have picked up all preloads by now
     m_docLoader->clearPreloads();
@@ -1793,6 +1793,9 @@ void Document::implicitClose()
     ImageLoader::dispatchPendingEvents();
     dispatchWindowLoadEvent();
     dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
+    if (m_pendingStateObject)
+        dispatchWindowEvent(PopStateEvent::create(m_pendingStateObject.release()));
+    
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -2291,8 +2294,10 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         }
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
-        if (isHTMLDocument())
-            static_cast<HTMLDocument*>(this)->setCookie(content);
+        if (isHTMLDocument()) {
+            ExceptionCode ec; // Exception (for sandboxed documents) ignored.
+            static_cast<HTMLDocument*>(this)->setCookie(content, ec);
+        }
     } else if (equalIgnoringCase(equiv, "content-language"))
         setContentLanguage(content);
     else if (equalIgnoringCase(equiv, "x-dns-prefetch-control"))
@@ -2608,7 +2613,7 @@ void Document::recalcStyleSelector()
                     sheet = cssSheet.get();
                 }
             }
-        } else if (n->isHTMLElement() && (n->hasTagName(linkTag) || n->hasTagName(styleTag))
+        } else if ((n->isHTMLElement() && (n->hasTagName(linkTag) || n->hasTagName(styleTag)))
 #if ENABLE(SVG)
             ||  (n->isSVGElement() && n->hasTagName(SVGNames::styleTag))
 #endif
@@ -2770,14 +2775,14 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             oldFocusedNode->setActive(false);
 
         oldFocusedNode->setFocus(false);
-                
+
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = oldFocusedNode->renderer();
-        if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
-            oldFocusedNode->dispatchEvent(Event::create(eventNames().changeEvent, true, false));
+        if (r && r->isTextControl() && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
+            static_cast<Element*>(oldFocusedNode.get())->dispatchFormControlChangeEvent();
             r = oldFocusedNode->renderer();
             if (r && r->isTextControl())
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         // Dispatch the blur event and let the node do any other blur related activities (important for text fields)
@@ -2861,6 +2866,8 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         axObjectCache()->handleFocusedUIElementChanged(oldFocusedRenderer, newFocusedRenderer);
     }
 #endif
+    if (!focusChangeBlocked)
+        page()->chrome()->focusedNodeChanged(m_focusedNode.get());
 
 SetFocusedNodeDone:
     updateStyleIfNeeded();
@@ -3112,11 +3119,20 @@ Element* Document::ownerElement() const
     return frame()->ownerElement();
 }
 
-String Document::cookie() const
+String Document::cookie(ExceptionCode& ec) const
 {
     if (page() && !page()->cookieEnabled())
         return String();
 
+    // FIXME: The HTML5 DOM spec states that this attribute can raise an
+    // INVALID_STATE_ERR exception on getting if the Document has no
+    // browsing context.
+
+    if (securityOrigin()->isSandboxed(SandboxOrigin)) {
+        ec = SECURITY_ERR;
+        return String();
+    }
+
     KURL cookieURL = this->cookieURL();
     if (cookieURL.isEmpty())
         return String();
@@ -3124,11 +3140,20 @@ String Document::cookie() const
     return cookies(this, cookieURL);
 }
 
-void Document::setCookie(const String& value)
+void Document::setCookie(const String& value, ExceptionCode& ec)
 {
     if (page() && !page()->cookieEnabled())
         return;
 
+    // FIXME: The HTML5 DOM spec states that this attribute can raise an
+    // INVALID_STATE_ERR exception on setting if the Document has no
+    // browsing context.
+
+    if (securityOrigin()->isSandboxed(SandboxOrigin)) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
     KURL cookieURL = this->cookieURL();
     if (cookieURL.isEmpty())
         return;
@@ -3855,7 +3880,7 @@ void Document::repaintMarkers(DocumentMarker::MarkerType markerType)
     }
 }
 
-void Document::setRenderedRectForMarker(Node* node, DocumentMarker marker, const IntRect& r)
+void Document::setRenderedRectForMarker(Node* node, const DocumentMarker& marker, const IntRect& r)
 {
     MarkerMapVectorPair* vectorPair = m_markers.get(node);
     if (!vectorPair) {
@@ -4377,6 +4402,8 @@ void Document::initSecurityContext()
     m_cookieURL = url;
     ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url));
 
+    updateSandboxFlags();
+ 
     if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
         // load local resources.  See https://bugs.webkit.org/show_bug.cgi?id=16756
@@ -4427,6 +4454,46 @@ void Document::setSecurityOrigin(SecurityOrigin* securityOrigin)
     initDNSPrefetch();
 }
 
+void Document::updateURLForPushOrReplaceState(const KURL& url)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+
+    setURL(url);
+    f->loader()->documentLoader()->replaceRequestURLForSameDocumentNavigation(url);
+}
+
+void Document::statePopped(SerializedScriptValue* stateObject)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+    
+    if (f->loader()->isComplete())
+        dispatchWindowEvent(PopStateEvent::create(stateObject));
+    else
+        m_pendingStateObject = stateObject;
+}
+
+void Document::registerHistoryItem(HistoryItem* item)
+{
+    ASSERT(!m_associatedHistoryItems.contains(item));
+    m_associatedHistoryItems.add(item);
+}
+
+void Document::unregisterHistoryItem(HistoryItem* item)
+{
+    ASSERT(m_associatedHistoryItems.contains(item) || m_associatedHistoryItems.isEmpty());
+    m_associatedHistoryItems.remove(item);
+}
+
+void Document::updateSandboxFlags()
+{
+    if (m_frame && securityOrigin())
+        securityOrigin()->setSandboxFlags(m_frame->loader()->sandboxFlags());
+}
+
 void Document::updateFocusAppearanceSoon()
 {
     if (!m_updateFocusAppearanceTimer.isActive())
@@ -4690,7 +4757,7 @@ void Document::scriptImported(unsigned long identifier, const String& sourceStri
 
 class ScriptExecutionContextTaskTimer : public TimerBase {
 public:
-    ScriptExecutionContextTaskTimer(PassRefPtr<Document> context, PassRefPtr<ScriptExecutionContext::Task> task)
+    ScriptExecutionContextTaskTimer(PassRefPtr<Document> context, PassOwnPtr<ScriptExecutionContext::Task> task)
         : m_context(context)
         , m_task(task)
     {
@@ -4704,18 +4771,18 @@ private:
     }
 
     RefPtr<Document> m_context;
-    RefPtr<ScriptExecutionContext::Task> m_task;
+    OwnPtr<ScriptExecutionContext::Task> m_task;
 };
 
-struct PerformTaskContext {
-    PerformTaskContext(ScriptExecutionContext* scriptExecutionContext, PassRefPtr<ScriptExecutionContext::Task> task)
+struct PerformTaskContext : Noncopyable {
+    PerformTaskContext(ScriptExecutionContext* scriptExecutionContext, PassOwnPtr<ScriptExecutionContext::Task> task)
         : scriptExecutionContext(scriptExecutionContext)
         , task(task)
     {
     }
 
     ScriptExecutionContext* scriptExecutionContext; // The context should exist until task execution.
-    RefPtr<ScriptExecutionContext::Task> task;
+    OwnPtr<ScriptExecutionContext::Task> task;
 };
 
 static void performTask(void* ctx)
@@ -4725,7 +4792,7 @@ static void performTask(void* ctx)
     delete ptctx;
 }
 
-void Document::postTask(PassRefPtr<Task> task)
+void Document::postTask(PassOwnPtr<Task> task)
 {
     if (isMainThread()) {
         ScriptExecutionContextTaskTimer* timer = new ScriptExecutionContextTaskTimer(static_cast<Document*>(this), task);
@@ -4790,4 +4857,11 @@ bool Document::isXHTMLMPDocument() const
 }
 #endif
 
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* Document::inspectorTimelineAgent() const 
+{
+    return page() ? page()->inspectorTimelineAgent() : 0;
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index 9f5785e..3d0582c 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -33,7 +33,6 @@
 #include "CollectionType.h"
 #include "Color.h"
 #include "DocumentMarker.h"
-#include "Page.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
@@ -68,7 +67,6 @@ namespace WebCore {
     class EventListener;
     class Frame;
     class FrameView;
-    class HitTestRequest;
     class HTMLCanvasElement;
     class HTMLCollection;
     class HTMLAllCollection;
@@ -78,6 +76,8 @@ namespace WebCore {
     class HTMLHeadElement;
     class HTMLInputElement;
     class HTMLMapElement;
+    class HistoryItem;
+    class HitTestRequest;
     class InspectorTimelineAgent;
     class IntPoint;
     class DOMWrapperWorld;
@@ -85,6 +85,7 @@ namespace WebCore {
     class MouseEventWithHitTestResults;
     class NodeFilter;
     class NodeIterator;
+    class Page;
     class PlatformMouseEvent;
     class ProcessingInstruction;
     class Range;
@@ -93,6 +94,7 @@ namespace WebCore {
     class RenderView;
     class ScriptElementData;
     class SecurityOrigin;
+    class SerializedScriptValue;
     class SegmentedString;
     class Settings;
     class StyleSheet;
@@ -451,12 +453,12 @@ public:
     void updateLayout();
     void updateLayoutIgnorePendingStylesheets();
     static void updateStyleForAllDocuments(); // FIXME: Try to reduce the # of calls to this function.
-    DocLoader* docLoader() { return m_docLoader; }
+    DocLoader* docLoader() { return m_docLoader.get(); }
 
     virtual void attach();
     virtual void detach();
 
-    RenderArena* renderArena() { return m_renderArena; }
+    RenderArena* renderArena() { return m_renderArena.get(); }
 
     RenderView* renderView() const;
 
@@ -504,7 +506,7 @@ public:
     CSSStyleSheet* mappedElementSheet();
     
     virtual Tokenizer* createTokenizer();
-    Tokenizer* tokenizer() { return m_tokenizer; }
+    Tokenizer* tokenizer() { return m_tokenizer.get(); }
     
     bool printing() const { return m_printing; }
     void setPrinting(bool p) { m_printing = p; }
@@ -683,8 +685,8 @@ public:
     void setTitle(const String&, Element* titleElement = 0);
     void removeTitle(Element* titleElement);
 
-    String cookie() const;
-    void setCookie(const String&);
+    String cookie(ExceptionCode&) const;
+    void setCookie(const String&, ExceptionCode&);
 
     String referrer() const;
 
@@ -738,7 +740,7 @@ public:
     void removeMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void removeMarkers(Node*);
     void repaintMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
-    void setRenderedRectForMarker(Node*, DocumentMarker, const IntRect&);
+    void setRenderedRectForMarker(Node*, const DocumentMarker&, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
     void shiftMarkers(Node*, unsigned startOffset, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void setMarkersActive(Range*, bool);
@@ -772,7 +774,7 @@ public:
 
 #if ENABLE(XBL)
     // XBL methods
-    XBLBindingManager* bindingManager() const { return m_bindingManager; }
+    XBLBindingManager* bindingManager() const { return m_bindingManager.get(); }
 #endif
 
     void incDOMTreeVersion() { ++m_domtree_version; }
@@ -832,7 +834,7 @@ public:
     virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
     virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     virtual void scriptImported(unsigned long, const String&);
-    virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
+    virtual void postTask(PassOwnPtr<Task>); // Executes the task on context's thread asynchronously.
 
     typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
     typedef HashMap<DOMWrapperWorld*, JSWrapperCache*> JSWrapperCacheMap;
@@ -900,6 +902,13 @@ public:
     //       that already contains content.
     void setSecurityOrigin(SecurityOrigin*);
 
+    void updateURLForPushOrReplaceState(const KURL&);
+    void statePopped(SerializedScriptValue*);
+    void registerHistoryItem(HistoryItem* item);
+    void unregisterHistoryItem(HistoryItem* item);
+
+    void updateSandboxFlags(); // Set sandbox flags as determined by the frame.
+
     bool processingLoadEvent() const { return m_processingLoadEvent; }
 
 #if ENABLE(DATABASE)
@@ -976,8 +985,8 @@ private:
     bool m_didCalculateStyleSelector;
 
     Frame* m_frame;
-    DocLoader* m_docLoader;
-    Tokenizer* m_tokenizer;
+    OwnPtr<DocLoader> m_docLoader;
+    OwnPtr<Tokenizer> m_tokenizer;
     bool m_wellFormed;
 
     // Document URLs.
@@ -1076,8 +1085,8 @@ private:
     String m_title;
     bool m_titleSetExplicitly;
     RefPtr<Element> m_titleElement;
-    
-    RenderArena* m_renderArena;
+
+    OwnPtr<RenderArena> m_renderArena;
 
     typedef std::pair<Vector<DocumentMarker>, Vector<IntRect> > MarkerMapVectorPair;
     typedef HashMap<RefPtr<Node>, MarkerMapVectorPair*> MarkerMap;
@@ -1090,6 +1099,8 @@ private:
     Element* m_cssTarget;
     
     bool m_processingLoadEvent;
+    RefPtr<SerializedScriptValue> m_pendingStateObject;
+    HashSet<RefPtr<HistoryItem> > m_associatedHistoryItems;
     double m_startTime;
     bool m_overMinimumLayoutThreshold;
 
@@ -1102,7 +1113,7 @@ private:
 #endif
 
 #if ENABLE(XBL)
-    XBLBindingManager* m_bindingManager; // The access point through which documents and elements communicate with XBL.
+    OwnPtr<XBLBindingManager> m_bindingManager; // The access point through which documents and elements communicate with XBL.
 #endif
     
     typedef HashMap<AtomicStringImpl*, HTMLMapElement*> ImageMapsByName;
@@ -1204,12 +1215,6 @@ inline bool Node::isDocumentNode() const
     return this == m_document;
 }
 
-#if ENABLE(INSPECTOR)
-inline InspectorTimelineAgent* Document::inspectorTimelineAgent() const {
-    return page() ? page()->inspectorTimelineAgent() : 0;
-}
-#endif
-
 } // namespace WebCore
 
 #endif // Document_h
diff --git a/WebCore/dom/Document.idl b/WebCore/dom/Document.idl
index ce7010a..e54add0 100644
--- a/WebCore/dom/Document.idl
+++ b/WebCore/dom/Document.idl
@@ -35,7 +35,7 @@ module core {
         readonly attribute [V8Custom] DOMImplementation implementation;
         readonly attribute Element documentElement;
 
-        [ReturnsNew] Element createElement(in [ConvertNullToNullString, HintAtomic] DOMString tagName)
+        [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
             raises (DOMException);
         DocumentFragment   createDocumentFragment();
         [ReturnsNew] Text createTextNode(in DOMString data);
@@ -64,7 +64,7 @@ module core {
             raises (DOMException);
         [OldStyleObjC] NodeList getElementsByTagNameNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                                        in DOMString localName);
-        Element            getElementById(in [HintAtomic] DOMString elementId);
+        Element            getElementById(in DOMString elementId);
 
         // DOM Level 3 Core
 
@@ -162,10 +162,9 @@ module core {
 #endif
         readonly attribute DOMString URL;
 
-        // FIXME: the DOM spec states that this attribute can 
-        // raise an exception on setting.
                  attribute [ConvertNullToNullString] DOMString cookie
-                     /*setter raises (DOMException)*/;
+                     setter raises (DOMException),
+                     getter raises (DOMException);
 
         // FIXME: the DOM spec does NOT have this attribute
         // raising an exception.
diff --git a/WebCore/dom/DynamicNodeList.cpp b/WebCore/dom/DynamicNodeList.cpp
index 892a5e7..3f0744b 100644
--- a/WebCore/dom/DynamicNodeList.cpp
+++ b/WebCore/dom/DynamicNodeList.cpp
@@ -129,7 +129,9 @@ Node* DynamicNodeList::itemWithName(const AtomicString& elementId) const
                     return node;
             }
         }
-        return 0;
+        if (!node)
+            return 0;
+        // In the case of multiple nodes with the same name, just fall through.
     }
 
     unsigned length = this->length();
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 9edde25..d7f1b11 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -47,6 +47,7 @@
 #include "NodeRenderStyle.h"
 #include "Page.h"
 #include "RenderView.h"
+#include "RenderWidget.h"
 #include "TextIterator.h"
 #include "XMLNames.h"
 
@@ -135,6 +136,12 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value)
     ExceptionCode ec;
     setAttribute(name, value, ec);
 }
+    
+void Element::setCStringAttribute(const QualifiedName& name, const char* cStringValue)
+{
+    ExceptionCode ec;
+    setAttribute(name, AtomicString(cStringValue), ec);
+}
 
 void Element::setBooleanAttribute(const QualifiedName& name, bool b)
 {
@@ -488,8 +495,10 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
 
 const AtomicString& Element::getAttribute(const String& name) const
 {
-    String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    if (localName == styleAttr.localName() && !m_isStyleAttributeValid)
+    bool ignoreCase = shouldIgnoreAttributeCase(this);
+    
+    // Update the 'style' attribute if it's invalid and being requested:
+    if (!m_isStyleAttributeValid && equalPossiblyIgnoringCase(name, styleAttr.localName(), ignoreCase))
         updateStyleAttribute();
 
 #if ENABLE(SVG)
@@ -498,8 +507,8 @@ const AtomicString& Element::getAttribute(const String& name) const
 #endif
 
     if (namedAttrMap)
-        if (Attribute* a = namedAttrMap->getAttributeItem(name, shouldIgnoreAttributeCase(this)))
-            return a->value();
+        if (Attribute* attribute = namedAttrMap->getAttributeItem(name, ignoreCase))
+            return attribute->value();
     
     return nullAtom;
 }
@@ -727,6 +736,7 @@ void Element::removedFromDocument()
 void Element::attach()
 {
     suspendPostAttachCallbacks();
+    RenderWidget::suspendWidgetHierarchyUpdates();
 
     createRendererIfNeeded();
     ContainerNode::attach();
@@ -739,20 +749,25 @@ void Element::attach()
         }
     }
 
+    RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
 }
 
 void Element::detach()
 {
+    RenderWidget::suspendWidgetHierarchyUpdates();
+
     cancelFocusAppearanceUpdate();
     if (hasRareData())
         rareData()->resetComputedStyle();
     ContainerNode::detach();
+
+    RenderWidget::resumeWidgetHierarchyUpdates();
 }
 
 bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle)
 {
-    ASSERT(currentStyle = renderStyle());
+    ASSERT(currentStyle == renderStyle());
 
     if (!renderer() || !currentStyle)
         return false;
diff --git a/WebCore/dom/Element.h b/WebCore/dom/Element.h
index d27976a..97d3eb4 100644
--- a/WebCore/dom/Element.h
+++ b/WebCore/dom/Element.h
@@ -167,6 +167,9 @@ public:
     // convenience methods which ignore exceptions
     void setAttribute(const QualifiedName&, const AtomicString& value);
     void setBooleanAttribute(const QualifiedName& name, bool);
+    // Please don't use setCStringAttribute in performance-sensitive code;
+    // use a static AtomicString value instead to avoid the conversion overhead.
+    void setCStringAttribute(const QualifiedName&, const char* cStringValue);
 
     virtual NamedNodeMap* attributes() const;
     NamedNodeMap* attributes(bool readonly) const;
diff --git a/WebCore/dom/Event.cpp b/WebCore/dom/Event.cpp
index 5d8eaaa..eda44b0 100644
--- a/WebCore/dom/Event.cpp
+++ b/WebCore/dom/Event.cpp
@@ -96,6 +96,11 @@ bool Event::isTextEvent() const
     return false;
 }
 
+bool Event::isCompositionEvent() const
+{
+    return false;
+}
+
 bool Event::isDragEvent() const
 {
     return false;
@@ -131,6 +136,11 @@ bool Event::isPageTransitionEvent() const
     return false;
 }
 
+bool Event::isPopStateEvent() const
+{
+    return false;
+}
+
 bool Event::isProgressEvent() const
 {
     return false;
diff --git a/WebCore/dom/Event.h b/WebCore/dom/Event.h
index b391985..7ec85a7 100644
--- a/WebCore/dom/Event.h
+++ b/WebCore/dom/Event.h
@@ -103,6 +103,7 @@ namespace WebCore {
         virtual bool isMutationEvent() const;
         virtual bool isKeyboardEvent() const;
         virtual bool isTextEvent() const;
+        virtual bool isCompositionEvent() const;
         virtual bool isDragEvent() const; // a subset of mouse events
         virtual bool isClipboardEvent() const;
         virtual bool isMessageEvent() const;
@@ -110,6 +111,7 @@ namespace WebCore {
         virtual bool isBeforeTextInsertedEvent() const;
         virtual bool isOverflowEvent() const;
         virtual bool isPageTransitionEvent() const;
+        virtual bool isPopStateEvent() const;
         virtual bool isProgressEvent() const;
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
diff --git a/WebCore/dom/EventNames.cpp b/WebCore/dom/EventNames.cpp
index 00191ab..900b8ef 100644
--- a/WebCore/dom/EventNames.cpp
+++ b/WebCore/dom/EventNames.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/dom/EventNames.h b/WebCore/dom/EventNames.h
index b2db177..63460a5 100644
--- a/WebCore/dom/EventNames.h
+++ b/WebCore/dom/EventNames.h
@@ -41,6 +41,9 @@ namespace WebCore {
     macro(checking) \
     macro(click) \
     macro(close) \
+    macro(compositionend) \
+    macro(compositionstart) \
+    macro(compositionupdate) \
     macro(connect) \
     macro(contextmenu) \
     macro(copy) \
@@ -81,6 +84,7 @@ namespace WebCore {
     macro(pagehide) \
     macro(pageshow) \
     macro(paste) \
+    macro(popstate) \
     macro(readystatechange) \
     macro(reset) \
     macro(resize) \
@@ -135,6 +139,9 @@ namespace WebCore {
     macro(volumechange) \
     macro(waiting) \
     \
+    macro(webkitbeginfullscreen) \
+    macro(webkitendfullscreen) \
+    \
     macro(progress) \
     macro(stalled) \
     macro(suspend) \
@@ -149,7 +156,7 @@ namespace WebCore {
     \
 // end of DOM_EVENT_NAMES_FOR_EACH
 
-    class EventNames {
+    class EventNames : public Noncopyable {
         int dummy; // Needed to make initialization macro work.
         // Private to prevent accidental call to EventNames() instead of eventNames()
         EventNames();
diff --git a/WebCore/dom/EventTarget.cpp b/WebCore/dom/EventTarget.cpp
index 694e78a..65d751a 100644
--- a/WebCore/dom/EventTarget.cpp
+++ b/WebCore/dom/EventTarget.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
@@ -68,6 +66,11 @@ bool eventDispatchForbidden()
 }
 #endif // NDEBUG
 
+EventTargetData::~EventTargetData()
+{
+    deleteAllValues(eventListenerMap);
+}
+
 EventTarget::~EventTarget()
 {
 }
@@ -157,16 +160,19 @@ bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<Eve
 {
     EventTargetData* d = ensureEventTargetData();
 
-    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, EventListenerVector());
-    EventListenerVector& entry = result.first->second;
+    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, 0);
+    EventListenerVector*& entry = result.first->second;
+    const bool isNewEntry = result.second;
+    if (isNewEntry)
+        entry = new EventListenerVector();
 
     RegisteredEventListener registeredListener(listener, useCapture);
-    if (!result.second) { // pre-existing entry
-        if (entry.find(registeredListener) != notFound) // duplicate listener
+    if (!isNewEntry) {
+        if (entry->find(registeredListener) != notFound) // duplicate listener
             return false;
     }
 
-    entry.append(registeredListener);
+    entry->append(registeredListener);
     return true;
 }
 
@@ -179,16 +185,18 @@ bool EventTarget::removeEventListener(const AtomicString& eventType, EventListen
     EventListenerMap::iterator result = d->eventListenerMap.find(eventType);
     if (result == d->eventListenerMap.end())
         return false;
-    EventListenerVector& entry = result->second;
+    EventListenerVector* entry = result->second;
 
     RegisteredEventListener registeredListener(listener, useCapture);
-    size_t index = entry.find(registeredListener);
+    size_t index = entry->find(registeredListener);
     if (index == notFound)
         return false;
 
-    entry.remove(index);
-    if (!entry.size())
+    entry->remove(index);
+    if (entry->isEmpty()) {
+        delete entry;
         d->eventListenerMap.remove(result);
+    }
 
     // Notify firing events planning to invoke the listener at 'index' that
     // they have one less listener to invoke.
@@ -266,7 +274,7 @@ bool EventTarget::fireEventListeners(Event* event)
     EventListenerMap::iterator result = d->eventListenerMap.find(event->type());
     if (result == d->eventListenerMap.end())
         return false;
-    EventListenerVector& entry = result->second;
+    EventListenerVector& entry = *result->second;
 
     RefPtr<EventTarget> protect = this;
 
@@ -303,7 +311,7 @@ const EventListenerVector& EventTarget::getEventListeners(const AtomicString& ev
     EventListenerMap::iterator it = d->eventListenerMap.find(eventType);
     if (it == d->eventListenerMap.end())
         return emptyVector;
-    return it->second;
+    return *it->second;
 }
 
 void EventTarget::removeAllEventListeners()
@@ -311,6 +319,7 @@ void EventTarget::removeAllEventListeners()
     EventTargetData* d = eventTargetData();
     if (!d)
         return;
+    deleteAllValues(d->eventListenerMap);
     d->eventListenerMap.clear();
 
     // Notify firing events planning to invoke the listener at 'index' that
diff --git a/WebCore/dom/EventTarget.h b/WebCore/dom/EventTarget.h
index 9a1975c..2d77c87 100644
--- a/WebCore/dom/EventTarget.h
+++ b/WebCore/dom/EventTarget.h
@@ -76,9 +76,11 @@ namespace WebCore {
     typedef Vector<FiringEventIterator, 1> FiringEventIteratorVector;
 
     typedef Vector<RegisteredEventListener, 1> EventListenerVector;
-    typedef HashMap<AtomicString, EventListenerVector> EventListenerMap;
+    typedef HashMap<AtomicString, EventListenerVector*> EventListenerMap;
+
+    struct EventTargetData : Noncopyable {
+        ~EventTargetData();
 
-    struct EventTargetData {
         EventListenerMap eventListenerMap;
         FiringEventIteratorVector firingEventIterators;
     };
@@ -190,7 +192,7 @@ namespace WebCore {
 
         EventListenerMap::iterator end = d->eventListenerMap.end();
         for (EventListenerMap::iterator it = d->eventListenerMap.begin(); it != end; ++it) {
-            EventListenerVector& entry = it->second;
+            EventListenerVector& entry = *it->second;
             for (size_t i = 0; i < entry.size(); ++i)
                 entry[i].listener->markJSFunction(markStack);
         }
@@ -202,6 +204,7 @@ namespace WebCore {
         if (!d)
             return;
 
+        deleteAllValues(d->eventListenerMap);
         d->eventListenerMap.clear();
     }
 #endif
diff --git a/WebCore/dom/InputElement.h b/WebCore/dom/InputElement.h
index e0e7110..2ae0312 100644
--- a/WebCore/dom/InputElement.h
+++ b/WebCore/dom/InputElement.h
@@ -48,7 +48,8 @@ public:
 
     virtual int size() const = 0;
     virtual String value() const = 0;
-    virtual void setValue(const String&) = 0;
+    virtual void setValue(const String&, bool sendChangeEvent = false) = 0;
+    virtual void setValueForUser(const String&) = 0;
 
     virtual String sanitizeValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
diff --git a/WebCore/dom/KeyboardEvent.cpp b/WebCore/dom/KeyboardEvent.cpp
index 6bc825f..99c9220 100644
--- a/WebCore/dom/KeyboardEvent.cpp
+++ b/WebCore/dom/KeyboardEvent.cpp
@@ -80,7 +80,6 @@ KeyboardEvent::KeyboardEvent(const AtomicString& eventType, bool canBubble, bool
 
 KeyboardEvent::~KeyboardEvent()
 {
-    delete m_keyEvent;
 }
 
 void KeyboardEvent::initKeyboardEvent(const AtomicString& type, bool canBubble, bool cancelable, AbstractView* view,
diff --git a/WebCore/dom/KeyboardEvent.h b/WebCore/dom/KeyboardEvent.h
index 2b0a131..793ac41 100644
--- a/WebCore/dom/KeyboardEvent.h
+++ b/WebCore/dom/KeyboardEvent.h
@@ -79,7 +79,7 @@ namespace WebCore {
 
         bool altGraphKey() const { return m_altGraphKey; }
     
-        const PlatformKeyboardEvent* keyEvent() const { return m_keyEvent; }
+        const PlatformKeyboardEvent* keyEvent() const { return m_keyEvent.get(); }
 
         int keyCode() const; // key code for keydown and keyup, character for keypress
         int charCode() const; // character code for keypress, 0 for keydown and keyup
@@ -99,7 +99,7 @@ namespace WebCore {
                       const String& keyIdentifier, unsigned keyLocation,
                       bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, bool altGraphKey);
 
-        PlatformKeyboardEvent* m_keyEvent;
+        OwnPtr<PlatformKeyboardEvent> m_keyEvent;
         String m_keyIdentifier;
         unsigned m_keyLocation;
         bool m_altGraphKey : 1;
diff --git a/WebCore/dom/MappedAttributeEntry.h b/WebCore/dom/MappedAttributeEntry.h
index 745ad23..842e7a8 100644
--- a/WebCore/dom/MappedAttributeEntry.h
+++ b/WebCore/dom/MappedAttributeEntry.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
diff --git a/WebCore/dom/MessagePort.cpp b/WebCore/dom/MessagePort.cpp
index 9f6e649..1051920 100644
--- a/WebCore/dom/MessagePort.cpp
+++ b/WebCore/dom/MessagePort.cpp
@@ -41,6 +41,7 @@ namespace WebCore {
 MessagePort::MessagePort(ScriptExecutionContext& scriptExecutionContext)
     : m_entangledChannel(0)
     , m_started(false)
+    , m_closed(false)
     , m_scriptExecutionContext(&scriptExecutionContext)
 {
     m_scriptExecutionContext->createdMessagePort(this);
@@ -131,6 +132,7 @@ void MessagePort::start()
 
 void MessagePort::close()
 {
+    m_closed = true;
     if (!m_entangledChannel)
         return;
     m_entangledChannel->close();
@@ -200,7 +202,7 @@ PassOwnPtr<MessagePortChannelArray> MessagePort::disentanglePorts(const MessageP
     // Walk the incoming array - if there are any duplicate ports, or null ports or cloned ports, throw an error (per section 8.3.3 of the HTML5 spec).
     for (unsigned int i = 0; i < ports->size(); ++i) {
         MessagePort* port = (*ports)[i].get();
-        if (!port || !port->isEntangled() || portSet.contains(port)) {
+        if (!port || port->isCloned() || portSet.contains(port)) {
             ec = INVALID_STATE_ERR;
             return 0;
         }
diff --git a/WebCore/dom/MessagePort.h b/WebCore/dom/MessagePort.h
index 0ab0f50..ae1eb22 100644
--- a/WebCore/dom/MessagePort.h
+++ b/WebCore/dom/MessagePort.h
@@ -103,7 +103,10 @@ namespace WebCore {
         // Returns null otherwise.
         // NOTE: This is used solely to enable a GC optimization. Some platforms may not be able to determine ownership of the remote port (since it may live cross-process) - those platforms may always return null.
         MessagePort* locallyEntangledPort();
-        bool isEntangled() { return m_entangledChannel; }
+        // A port starts out its life entangled, and remains entangled until it is closed or is cloned.
+        bool isEntangled() { return !m_closed && !isCloned(); }
+        // A port is cloned if its entangled channel has been removed and sent to a new owner via postMessage().
+        bool isCloned() { return !m_entangledChannel; }
 
     private:
         MessagePort(ScriptExecutionContext&);
@@ -116,6 +119,7 @@ namespace WebCore {
         OwnPtr<MessagePortChannel> m_entangledChannel;
 
         bool m_started;
+        bool m_closed;
 
         ScriptExecutionContext* m_scriptExecutionContext;
         EventTargetData m_eventTargetData;
diff --git a/WebCore/dom/MessagePortChannel.h b/WebCore/dom/MessagePortChannel.h
index 2321b1f..90cb0d9 100644
--- a/WebCore/dom/MessagePortChannel.h
+++ b/WebCore/dom/MessagePortChannel.h
@@ -78,7 +78,7 @@ namespace WebCore {
         // Returns true if the proxy currently contains messages for this port.
         bool hasPendingActivity();
 
-        class EventData {
+        class EventData : public Noncopyable {
         public:
             static PassOwnPtr<EventData> create(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
 
diff --git a/WebCore/dom/MouseRelatedEvent.h b/WebCore/dom/MouseRelatedEvent.h
index 7649aa9..fc494d1 100644
--- a/WebCore/dom/MouseRelatedEvent.h
+++ b/WebCore/dom/MouseRelatedEvent.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/WebCore/dom/NamedAttrMap.cpp b/WebCore/dom/NamedAttrMap.cpp
index d4ec598..56b40b9 100644
--- a/WebCore/dom/NamedAttrMap.cpp
+++ b/WebCore/dom/NamedAttrMap.cpp
@@ -177,11 +177,33 @@ PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
 Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
+    bool doSlowCheck = shouldIgnoreAttributeCase;
+    
+    // Optimize for the case where the attribute exists and its name exactly matches.
     for (unsigned i = 0; i < len; ++i) {
-        if (!m_attributes[i]->name().hasPrefix() && m_attributes[i]->name().localName() == name)
-            return m_attributes[i].get();
-        if (shouldIgnoreAttributeCase ? equalIgnoringCase(m_attributes[i]->name().toString(), name) : name == m_attributes[i]->name().toString())
-            return m_attributes[i].get();
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (name == attrName.localName())
+                return m_attributes[i].get();
+        } else
+            doSlowCheck = true;
+    }
+    
+    // Continue to checking case-insensitively and/or full namespaced names if necessary:
+    if (doSlowCheck) {
+        for (unsigned i = 0; i < len; ++i) {
+            const QualifiedName& attrName = m_attributes[i]->name();
+            if (!attrName.hasPrefix()) {
+                if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attrName.localName()))
+                    return m_attributes[i].get();
+            } else {
+                // FIXME: Would be faster to do this comparison without calling toString, which
+                // generates a temporary string by concatenation. But this branch is only reached
+                // if the attribute name has a prefix, which is rare in HTML.
+                if (equalPossiblyIgnoringCase(name, attrName.toString(), shouldIgnoreAttributeCase))
+                    return m_attributes[i].get();
+            }
+        }
     }
     return 0;
 }
diff --git a/WebCore/dom/NamedMappedAttrMap.h b/WebCore/dom/NamedMappedAttrMap.h
index 0afa278..a288685 100644
--- a/WebCore/dom/NamedMappedAttrMap.h
+++ b/WebCore/dom/NamedMappedAttrMap.h
@@ -26,8 +26,8 @@
 #ifndef NamedMappedAttrMap_h
 #define NamedMappedAttrMap_h
 
-#include "ClassNames.h"
 #include "NamedNodeMap.h"
+#include "SpaceSplitString.h"
 
 namespace WebCore {
 
@@ -37,7 +37,7 @@ public:
 
     void clearClass() { m_classNames.clear(); }
     void setClass(const String&);
-    const ClassNames& classNames() const { return m_classNames; }
+    const SpaceSplitString& classNames() const { return m_classNames; }
 
     bool hasMappedAttributes() const { return m_mappedAttributeCount > 0; }
     void declRemoved() { m_mappedAttributeCount--; }
@@ -53,7 +53,7 @@ private:
 
     int declCount() const;
 
-    ClassNames m_classNames;
+    SpaceSplitString m_classNames;
     int m_mappedAttributeCount;
 };
 
diff --git a/WebCore/dom/Node.cpp b/WebCore/dom/Node.cpp
index 446efda..4ae83de 100644
--- a/WebCore/dom/Node.cpp
+++ b/WebCore/dom/Node.cpp
@@ -415,7 +415,6 @@ Node::Node(Document* document, ConstructionType type)
     , m_hovered(false)
     , m_inActiveChain(false)
     , m_inDetach(false)
-    , m_inSubtreeMark(false)
     , m_hasRareData(false)
     , m_isElement(isElement(type))
     , m_isContainer(isContainer(type))
@@ -1768,23 +1767,22 @@ bool Node::isEqualNode(Node *other) const
     return true;
 }
 
-bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
+bool Node::isDefaultNamespace(const AtomicString& namespaceURIMaybeEmpty) const
 {
-    // Implemented according to
-    // http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/namespaces-algorithms.html#isDefaultNamespaceAlgo
-    
+    const AtomicString& namespaceURI = namespaceURIMaybeEmpty.isEmpty() ? nullAtom : namespaceURIMaybeEmpty;
+
     switch (nodeType()) {
         case ELEMENT_NODE: {
-            const Element *elem = static_cast<const Element *>(this);
+            const Element* elem = static_cast<const Element*>(this);
             
             if (elem->prefix().isNull())
                 return elem->namespaceURI() == namespaceURI;
 
             if (elem->hasAttributes()) {
-                NamedNodeMap *attrs = elem->attributes();
+                NamedNodeMap* attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
-                    Attribute *attr = attrs->attributeItem(i);
+                    Attribute* attr = attrs->attributeItem(i);
                     
                     if (attr->localName() == "xmlns")
                         return attr->value() == namespaceURI;
@@ -1806,7 +1804,7 @@ bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
         case DOCUMENT_FRAGMENT_NODE:
             return false;
         case ATTRIBUTE_NODE: {
-            const Attr *attr = static_cast<const Attr *>(this);
+            const Attr* attr = static_cast<const Attr*>(this);
             if (attr->ownerElement())
                 return attr->ownerElement()->isDefaultNamespace(namespaceURI);
             return false;
@@ -2539,6 +2537,23 @@ bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
     return dispatchGenericEvent(event.release());
 }
 
+static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window, Node* node, Vector<RefPtr<ContainerNode> >& ancestors)
+{
+    if (window && window->hasEventListeners(eventType))
+        return true;
+
+    if (node->hasEventListeners(eventType))
+        return true;
+
+    for (size_t i = 0; i < ancestors.size(); i++) {
+        ContainerNode* ancestor = ancestors[i].get();
+        if (ancestor->hasEventListeners(eventType))
+            return true;
+    }
+
+   return false;    
+}
+
 bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
 {
     RefPtr<Event> event(prpEvent);
@@ -2547,12 +2562,6 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
     ASSERT(event->target());
     ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
 
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willDispatchDOMEvent(*event);
-#endif
-
     // Make a vector of ancestors to send the event to.
     // If the node is not in a document just send the event to it.
     // Be sure to ref all of nodes since event handlers could result in the last reference going away.
@@ -2570,6 +2579,13 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
             targetForWindowEvents = static_cast<Document*>(topLevelContainer)->domWindow();
     }
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
+    bool timelineAgentIsActive = timelineAgent && eventHasListeners(event->type(), targetForWindowEvents, this, ancestors);
+    if (timelineAgentIsActive)
+        timelineAgent->willDispatchEvent(*event);
+#endif
+
     // Give the target node a chance to do some work before DOM event handlers get a crack.
     void* data = preDispatchEventHandler(event.get());
     if (event->propagationStopped())
@@ -2651,8 +2667,8 @@ doneDispatching:
 
 doneWithDefault:
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
-        timelineAgent->didDispatchDOMEvent();
+    if (timelineAgentIsActive && (timelineAgent = document()->inspectorTimelineAgent()))
+        timelineAgent->didDispatchEvent();
 #endif
 
     Document::updateStyleForAllDocuments();
diff --git a/WebCore/dom/Node.h b/WebCore/dom/Node.h
index 082ab16..7da8634 100644
--- a/WebCore/dom/Node.h
+++ b/WebCore/dom/Node.h
@@ -289,9 +289,6 @@ public:
     void setNeedsStyleRecalc(StyleChangeType changeType = FullStyleChange);
     void setIsLink(bool b = true) { m_isLink = b; }
 
-    bool inSubtreeMark() const { return m_inSubtreeMark; }
-    void setInSubtreeMark(bool b = true) { m_inSubtreeMark = b; }
-
     void lazyAttach();
     virtual bool canLazyAttach();
 
@@ -642,7 +639,6 @@ private:
     bool m_hovered : 1;
     bool m_inActiveChain : 1;
     bool m_inDetach : 1;
-    bool m_inSubtreeMark : 1;
     bool m_hasRareData : 1;
     const bool m_isElement : 1;
     const bool m_isContainer : 1;
diff --git a/WebCore/dom/NodeFilter.h b/WebCore/dom/NodeFilter.h
index 5a542ad..53b32e1 100644
--- a/WebCore/dom/NodeFilter.h
+++ b/WebCore/dom/NodeFilter.h
@@ -73,8 +73,9 @@ namespace WebCore {
         short acceptNode(ScriptState*, Node*) const;
         void markAggregate(JSC::MarkStack& markStack) { m_condition->markAggregate(markStack); };
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(node), node); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(mainThreadNormalWorld(), node), node); }
 
     private:
         NodeFilter(PassRefPtr<NodeFilterCondition> condition) : m_condition(condition) { }
diff --git a/WebCore/dom/NodeIterator.h b/WebCore/dom/NodeIterator.h
index 2a992d3..3eec49a 100644
--- a/WebCore/dom/NodeIterator.h
+++ b/WebCore/dom/NodeIterator.h
@@ -52,9 +52,10 @@ namespace WebCore {
         // This function is called before any node is removed from the document tree.
         void nodeWillBeRemoved(Node*);
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        PassRefPtr<Node> nextNode(ExceptionCode& ec) { return nextNode(scriptStateFromNode(referenceNode()), ec); }
-        PassRefPtr<Node> previousNode(ExceptionCode& ec) { return previousNode(scriptStateFromNode(referenceNode()), ec); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        PassRefPtr<Node> nextNode(ExceptionCode& ec) { return nextNode(scriptStateFromNode(mainThreadNormalWorld(), referenceNode()), ec); }
+        PassRefPtr<Node> previousNode(ExceptionCode& ec) { return previousNode(scriptStateFromNode(mainThreadNormalWorld(), referenceNode()), ec); }
 
     private:
         NodeIterator(PassRefPtr<Node>, unsigned whatToShow, PassRefPtr<NodeFilter>, bool expandEntityReferences);
diff --git a/WebCore/dom/NodeRareData.h b/WebCore/dom/NodeRareData.h
index 8b9e1bf..6e9d0e4 100644
--- a/WebCore/dom/NodeRareData.h
+++ b/WebCore/dom/NodeRareData.h
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-struct NodeListsNodeData {
+struct NodeListsNodeData : Noncopyable {
     typedef HashSet<DynamicNodeList*> NodeListSet;
     NodeListSet m_listsWithCaches;
     
@@ -62,7 +62,7 @@ private:
     }
 };
     
-class NodeRareData {
+class NodeRareData : public Noncopyable {
 public:    
     NodeRareData()
         : m_tabIndex(0)
diff --git a/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/WebCore/dom/PopStateEvent.cpp
index 04697ce..b9ad862 100644
--- a/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
+++ b/WebCore/dom/PopStateEvent.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
@@ -21,30 +21,30 @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
  */
 
 #include "config.h"
+#include "PopStateEvent.h"
 
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasByteArray.h"
-
-#include "CanvasByteArray.h"
-
-using namespace JSC;
+#include "EventNames.h"
 
 namespace WebCore {
 
-void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+PopStateEvent::PopStateEvent(PassRefPtr<SerializedScriptValue> stateObject)
+    : Event(eventNames().popstateEvent, false, true)
+    , m_stateObject(stateObject)
 {
-    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
 }
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
+    
+void PopStateEvent::initPopStateEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> stateObject)
 {
-    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
+    if (dispatched())
+        return;
+    
+    initEvent(type, canBubble, cancelable);
+
+    m_stateObject = stateObject;
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/dom/PopStateEvent.h b/WebCore/dom/PopStateEvent.h
new file mode 100644
index 0000000..2fb8d06
--- /dev/null
+++ b/WebCore/dom/PopStateEvent.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef PopStateEvent_h
+#define PopStateEvent_h
+
+#include "Event.h"
+#include "SerializedScriptValue.h"
+
+namespace WebCore {
+
+class SerializedScriptValue;
+
+class PopStateEvent : public Event {
+public:
+    static PassRefPtr<PopStateEvent> create(PassRefPtr<SerializedScriptValue> stateObject)
+    {
+        return adoptRef(new PopStateEvent(stateObject));
+    }
+
+    void initPopStateEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue>);
+    bool isPopStateEvent() const { return true; }
+
+    SerializedScriptValue* state() const { return m_stateObject.get(); }    
+
+private:
+    PopStateEvent(PassRefPtr<SerializedScriptValue>);
+
+    RefPtr<SerializedScriptValue> m_stateObject;
+};
+
+} // namespace WebCore
+
+#endif // PopStateEvent_h
diff --git a/WebCore/dom/PopStateEvent.idl b/WebCore/dom/PopStateEvent.idl
new file mode 100644
index 0000000..c6775ec
--- /dev/null
+++ b/WebCore/dom/PopStateEvent.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface [
+        GenerateConstructor
+    ] PopStateEvent : Event {
+        [Custom] void initPopStateEvent(in DOMString typeArg, 
+                               in boolean canBubbleArg, 
+                               in boolean cancelableArg, 
+                               in any stateArg);
+                               
+        readonly attribute [CustomGetter] any state;
+    };
+
+}
diff --git a/WebCore/dom/Position.cpp b/WebCore/dom/Position.cpp
index 060b28c..0ff8262 100644
--- a/WebCore/dom/Position.cpp
+++ b/WebCore/dom/Position.cpp
@@ -307,6 +307,27 @@ bool Position::atLastEditingPositionForNode() const
     return m_offset >= lastOffsetForEditing(node());
 }
 
+// A position is considered at editing boundary if one of the following is true:
+// 1. It is the first position in the node and the next visually equivalent position
+//    is non editable.
+// 2. It is the last position in the node and the previous visually equivalent position
+//    is non editable.
+// 3. It is an editable position and both the next and previous visually equivalent
+//    positions are both non editable.
+bool Position::atEditingBoundary() const
+{
+    Position nextPosition = downstream(CanCrossEditingBoundary);
+    if (atFirstEditingPositionForNode() && nextPosition.isNotNull() && !nextPosition.node()->isContentEditable())
+        return true;
+        
+    Position prevPosition = upstream(CanCrossEditingBoundary);
+    if (atLastEditingPositionForNode() && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable())
+        return true;
+        
+    return nextPosition.isNotNull() && !nextPosition.node()->isContentEditable()
+        && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable();
+}
+
 bool Position::atStartOfTree() const
 {
     if (isNull())
@@ -448,7 +469,7 @@ static bool isStreamer(const PositionIterator& pos)
 // and downstream() will return the right one.
 // Also, upstream() will return [boundary, 0] for any of the positions from [boundary, 0] to the first candidate
 // in boundary, where endsOfNodeAreVisuallyDistinctPositions(boundary) is true.
-Position Position::upstream() const
+Position Position::upstream(EditingBoundaryCrossingRule rule) const
 {
     Node* startNode = node();
     if (!startNode)
@@ -460,6 +481,7 @@ Position Position::upstream() const
     PositionIterator currentPos = lastVisible;
     bool startEditable = startNode->isContentEditable();
     Node* lastNode = startNode;
+    bool boundaryCrossed = false;
     for (; !currentPos.atStart(); currentPos.decrement()) {
         Node* currentNode = currentPos.node();
         
@@ -468,8 +490,11 @@ Position Position::upstream() const
         if (currentNode != lastNode) {
             // Don't change editability.
             bool currentEditable = currentNode->isContentEditable();
-            if (startEditable != currentEditable)
-                break;
+            if (startEditable != currentEditable) {
+                if (rule == CannotCrossEditingBoundary)
+                    break;
+                boundaryCrossed = true;
+            }
             lastNode = currentNode;
         }
 
@@ -483,6 +508,11 @@ Position Position::upstream() const
         if (!renderer || renderer->style()->visibility() != VISIBLE)
             continue;
                  
+        if (rule == CanCrossEditingBoundary && boundaryCrossed) {
+            lastVisible = currentPos;
+            break;
+        }
+        
         // track last visible streamer position
         if (isStreamer(currentPos))
             lastVisible = currentPos;
@@ -560,7 +590,7 @@ Position Position::upstream() const
 // and upstream() will return the left one.
 // Also, downstream() will return the last position in the last atomic node in boundary for all of the positions
 // in boundary after the last candidate, where endsOfNodeAreVisuallyDistinctPositions(boundary).
-Position Position::downstream() const
+Position Position::downstream(EditingBoundaryCrossingRule rule) const
 {
     Node* startNode = node();
     if (!startNode)
@@ -572,6 +602,7 @@ Position Position::downstream() const
     PositionIterator currentPos = lastVisible;
     bool startEditable = startNode->isContentEditable();
     Node* lastNode = startNode;
+    bool boundaryCrossed = false;
     for (; !currentPos.atEnd(); currentPos.increment()) {   
         Node* currentNode = currentPos.node();
         
@@ -580,8 +611,12 @@ Position Position::downstream() const
         if (currentNode != lastNode) {
             // Don't change editability.
             bool currentEditable = currentNode->isContentEditable();
-            if (startEditable != currentEditable)
-                break;
+            if (startEditable != currentEditable) {
+                if (rule == CannotCrossEditingBoundary)
+                    break;
+                boundaryCrossed = true;
+            }
+                
             lastNode = currentNode;
         }
 
@@ -604,6 +639,11 @@ Position Position::downstream() const
         if (!renderer || renderer->style()->visibility() != VISIBLE)
             continue;
             
+        if (rule == CanCrossEditingBoundary && boundaryCrossed) {
+            lastVisible = currentPos;
+            break;
+        }
+        
         // track last visible streamer position
         if (isStreamer(currentPos))
             lastVisible = currentPos;
@@ -704,10 +744,14 @@ bool Position::isCandidate() const
     if (isTableElement(node()) || editingIgnoresContent(node()))
         return (atFirstEditingPositionForNode() || atLastEditingPositionForNode()) && !nodeIsUserSelectNone(node()->parent());
 
-    if (!node()->hasTagName(htmlTag) && renderer->isBlockFlow() && !hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (toRenderBox(renderer)->height() || node()->hasTagName(bodyTag)))
-        return atFirstEditingPositionForNode() && !nodeIsUserSelectNone(node());
-    
+    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow()) {
+        if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
+                return atFirstEditingPositionForNode() && !Position::nodeIsUserSelectNone(node());
+            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(node()) && atEditingBoundary();
+        }
+    }
+
     return false;
 }
 
@@ -949,7 +993,22 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
 {
     caretOffset = m_offset;
     RenderObject* renderer = node()->renderer();
+          
     if (!renderer->isText()) {
+        if (renderer->isBlockFlow() && hasRenderedNonAnonymousDescendantsWithHeight(renderer)) {
+            bool lastPosition = caretOffset == lastOffsetInNode(node());
+            Node* startNode = lastPosition ? node()->childNode(caretOffset - 1) : node()->childNode(caretOffset);
+            while (startNode && (!startNode->renderer() || (startNode->isTextNode() && toRenderText(startNode->renderer())->isAllCollapsibleWhitespace())))
+                startNode = (lastPosition)? startNode->previousSibling(): startNode->nextSibling();
+            if (startNode) {
+                Position pos(startNode, 0);
+                pos = pos.downstream(CanCrossEditingBoundary);
+                pos.getInlineBoxAndOffset(UPSTREAM, primaryDirection, inlineBox, caretOffset);
+                if (lastPosition && inlineBox)
+                    caretOffset = inlineBox->caretMaxOffset();
+                return;
+            }
+        }
         inlineBox = renderer->isBox() ? toRenderBox(renderer)->inlineBoxWrapper() : 0;
         if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
             return;
diff --git a/WebCore/dom/Position.h b/WebCore/dom/Position.h
index c08872d..1e0304e 100644
--- a/WebCore/dom/Position.h
+++ b/WebCore/dom/Position.h
@@ -56,6 +56,11 @@ public:
         PositionIsBeforeAnchor
     };
 
+    enum EditingBoundaryCrossingRule {
+        CanCrossEditingBoundary,
+        CannotCrossEditingBoundary
+    };
+    
     Position()
         : m_offset(0)
         , m_anchorType(PositionIsOffsetInAnchor)
@@ -130,6 +135,9 @@ public:
     bool atFirstEditingPositionForNode() const;
     bool atLastEditingPositionForNode() const;
 
+    // Retuns true if the visually equivalent positions around have different editability
+    bool atEditingBoundary() const;
+    
     bool atStartOfTree() const;
     bool atEndOfTree() const;
 
@@ -139,8 +147,8 @@ public:
     Position trailingWhitespacePosition(EAffinity, bool considerNonCollapsibleWhitespace = false) const;
     
     // These return useful visually equivalent positions.
-    Position upstream() const;
-    Position downstream() const;
+    Position upstream(EditingBoundaryCrossingRule = CannotCrossEditingBoundary) const;
+    Position downstream(EditingBoundaryCrossingRule = CannotCrossEditingBoundary) const;
     
     bool isCandidate() const;
     bool inRenderedText() const;
diff --git a/WebCore/dom/PositionIterator.cpp b/WebCore/dom/PositionIterator.cpp
index 8d881ba..f5b65f5 100644
--- a/WebCore/dom/PositionIterator.cpp
+++ b/WebCore/dom/PositionIterator.cpp
@@ -156,10 +156,14 @@ bool PositionIterator::isCandidate() const
     if (isTableElement(m_anchorNode) || editingIgnoresContent(m_anchorNode))
         return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
-    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)))
-        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
-    
+    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow()) {
+        if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
+                return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
+            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(m_anchorNode) && Position(*this).atEditingBoundary();
+        }
+    }
+
     return false;
 }
 
diff --git a/WebCore/dom/ProcessingInstruction.cpp b/WebCore/dom/ProcessingInstruction.cpp
index 8a94864..8adf9aa 100644
--- a/WebCore/dom/ProcessingInstruction.cpp
+++ b/WebCore/dom/ProcessingInstruction.cpp
@@ -42,6 +42,7 @@ inline ProcessingInstruction::ProcessingInstruction(Document* document, const St
     , m_cachedSheet(0)
     , m_loading(false)
     , m_alternate(false)
+    , m_createdByParser(false)
 #if ENABLE(XSLT)
     , m_isXSL(false)
 #endif
diff --git a/WebCore/dom/QualifiedName.cpp b/WebCore/dom/QualifiedName.cpp
index 2c5f39a..795bdb6 100644
--- a/WebCore/dom/QualifiedName.cpp
+++ b/WebCore/dom/QualifiedName.cpp
@@ -51,7 +51,7 @@ struct QNameComponentsTranslator {
 
 static QNameSet* gNameCache;
 
-QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+void QualifiedName::init(const AtomicString& p, const AtomicString& l, const AtomicString& n)
 {
     if (!gNameCache)
         gNameCache = new QNameSet;
@@ -62,6 +62,16 @@ QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const
         m_impl->ref();
 }
 
+QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+{
+    init(p, l, n);
+}
+
+QualifiedName::QualifiedName(const AtomicString& p, const char* l, const AtomicString& n)
+{
+    init(p, AtomicString(l), n);
+}
+
 void QualifiedName::deref()
 {
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
diff --git a/WebCore/dom/QualifiedName.h b/WebCore/dom/QualifiedName.h
index 3b9f5c4..a7e1fcb 100644
--- a/WebCore/dom/QualifiedName.h
+++ b/WebCore/dom/QualifiedName.h
@@ -32,7 +32,7 @@ struct QualifiedNameComponents {
     StringImpl* m_namespace;
 };
 
-class QualifiedName {
+class QualifiedName : public FastAllocBase {
 public:
     class QualifiedNameImpl : public RefCounted<QualifiedNameImpl> {
     public:
@@ -57,6 +57,7 @@ public:
     };
 
     QualifiedName(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
+    QualifiedName(const AtomicString& prefix, const char* localName, const AtomicString& namespaceURI);
     ~QualifiedName() { deref(); }
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
     QualifiedName() : m_impl(0) { }
@@ -88,6 +89,7 @@ public:
     static void init();
     
 private:
+    void init(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
     void ref() const { m_impl->ref(); }
     void deref();
     
diff --git a/WebCore/dom/Range.cpp b/WebCore/dom/Range.cpp
index 122130d..84a46c2 100644
--- a/WebCore/dom/Range.cpp
+++ b/WebCore/dom/Range.cpp
@@ -1595,12 +1595,32 @@ IntRect Range::boundingBox()
 
 void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
 {
-    if (!m_start.container() || !m_end.container())
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
+
+    if (!startContainer || !endContainer)
         return;
 
+    Node* stopNode = pastLastNode();
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        RenderObject* r = node->renderer();
+        if (!r || !r->isText())
+            continue;
+        RenderText* renderText = toRenderText(r);
+        int startOffset = node == startContainer ? m_start.offset() : 0;
+        int endOffset = node == endContainer ? m_end.offset() : numeric_limits<int>::max();
+        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
+    }
+}
+
+void Range::textQuads(Vector<FloatQuad>& quads, bool useSelectionHeight)
+{
     Node* startContainer = m_start.container();
     Node* endContainer = m_end.container();
 
+    if (!startContainer || !endContainer)
+        return;
+
     Node* stopNode = pastLastNode();
     for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
         RenderObject* r = node->renderer();
@@ -1608,8 +1628,8 @@ void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
             continue;
         RenderText* renderText = toRenderText(r);
         int startOffset = node == startContainer ? m_start.offset() : 0;
-        int endOffset = node == endContainer ? m_end.offset() : INT_MAX;
-        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
+        int endOffset = node == endContainer ? m_end.offset() : numeric_limits<int>::max();
+        renderText->absoluteQuadsForRange(quads, startOffset, endOffset, useSelectionHeight);
     }
 }
 
diff --git a/WebCore/dom/Range.h b/WebCore/dom/Range.h
index e2e282b..583f9f0 100644
--- a/WebCore/dom/Range.h
+++ b/WebCore/dom/Range.h
@@ -105,7 +105,10 @@ public:
     Node* shadowTreeRootNode() const;
 
     IntRect boundingBox();
+    // Not transform-friendly
     void textRects(Vector<IntRect>&, bool useSelectionHeight = false);
+    // Transform-friendly
+    void textQuads(Vector<FloatQuad>&, bool useSelectionHeight = false);
 
     void nodeChildrenChanged(ContainerNode*);
     void nodeWillBeRemoved(Node*);
diff --git a/WebCore/dom/RangeException.h b/WebCore/dom/RangeException.h
index 2eee3b0..c9f4f5c 100644
--- a/WebCore/dom/RangeException.h
+++ b/WebCore/dom/RangeException.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
diff --git a/WebCore/dom/ScriptElement.cpp b/WebCore/dom/ScriptElement.cpp
index 827aff3..83ed2bb 100644
--- a/WebCore/dom/ScriptElement.cpp
+++ b/WebCore/dom/ScriptElement.cpp
@@ -229,12 +229,14 @@ bool ScriptElementData::shouldExecuteAsJavaScript() const
          We want to accept all the values that either of these browsers accept, but not other values.
      */
     String type = m_scriptElement->typeAttributeValue();
-    if (!type.isEmpty())
-        return MIMETypeRegistry::isSupportedJavaScriptMIMEType(type.stripWhiteSpace().lower());
-
-    String language = m_scriptElement->languageAttributeValue();
-    if (!language.isEmpty())
-        return isSupportedJavaScriptLanguage(language);
+    if (!type.isEmpty()) {
+        if (!MIMETypeRegistry::isSupportedJavaScriptMIMEType(type.stripWhiteSpace().lower()))
+            return false;
+    } else {
+        String language = m_scriptElement->languageAttributeValue();
+        if (!language.isEmpty() && !isSupportedJavaScriptLanguage(language))
+            return false;
+    }    
 
     // No type or language is specified, so we assume the script to be JavaScript.
     // We don't yet support setting event listeners via the 'for' attribute for scripts.
diff --git a/WebCore/dom/ScriptExecutionContext.cpp b/WebCore/dom/ScriptExecutionContext.cpp
index f7046e3..bc71084 100644
--- a/WebCore/dom/ScriptExecutionContext.cpp
+++ b/WebCore/dom/ScriptExecutionContext.cpp
@@ -44,9 +44,9 @@ namespace WebCore {
 
 class ProcessMessagesSoonTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<ProcessMessagesSoonTask> create()
+    static PassOwnPtr<ProcessMessagesSoonTask> create()
     {
-        return adoptRef(new ProcessMessagesSoonTask);
+        return new ProcessMessagesSoonTask;
     }
 
     virtual void performTask(ScriptExecutionContext* context)
diff --git a/WebCore/dom/ScriptExecutionContext.h b/WebCore/dom/ScriptExecutionContext.h
index 398afec..cf332c3 100644
--- a/WebCore/dom/ScriptExecutionContext.h
+++ b/WebCore/dom/ScriptExecutionContext.h
@@ -31,6 +31,7 @@
 #include "KURL.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
@@ -92,13 +93,13 @@ namespace WebCore {
         void ref() { refScriptExecutionContext(); }
         void deref() { derefScriptExecutionContext(); }
 
-        class Task : public ThreadSafeShared<Task> {
+        class Task : public Noncopyable {
         public:
             virtual ~Task();
             virtual void performTask(ScriptExecutionContext*) = 0;
         };
 
-        virtual void postTask(PassRefPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
+        virtual void postTask(PassOwnPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
 
         void addTimeout(int timeoutId, DOMTimer*);
         void removeTimeout(int timeoutId);
diff --git a/WebCore/dom/ClassNames.cpp b/WebCore/dom/SpaceSplitString.cpp
index 1c5ff47..b062dbf 100644
--- a/WebCore/dom/ClassNames.cpp
+++ b/WebCore/dom/SpaceSplitString.cpp
@@ -19,7 +19,7 @@
  */
 
 #include "config.h"
-#include "ClassNames.h"
+#include "SpaceSplitString.h"
 
 #include <wtf/ASCIICType.h>
 
@@ -41,7 +41,7 @@ static bool hasNonASCIIOrUpper(const String& string)
     return hasUpper || (ored & ~0x7F);
 }
 
-void ClassNamesData::createVector()
+void SpaceSplitStringData::createVector()
 {
     ASSERT(!m_createdVector);
     ASSERT(m_vector.isEmpty());
@@ -70,7 +70,7 @@ void ClassNamesData::createVector()
     m_createdVector = true;
 }
 
-bool ClassNamesData::containsAll(ClassNamesData& other)
+bool SpaceSplitStringData::containsAll(SpaceSplitStringData& other)
 {
     ensureVector();
     other.ensureVector();
diff --git a/WebCore/dom/ClassNames.h b/WebCore/dom/SpaceSplitString.h
index a836606..2ef3fc4 100644
--- a/WebCore/dom/ClassNames.h
+++ b/WebCore/dom/SpaceSplitString.h
@@ -18,8 +18,8 @@
  *
  */
 
-#ifndef ClassNames_h
-#define ClassNames_h
+#ifndef SpaceSplitString_h
+#define SpaceSplitString_h
 
 #include "AtomicString.h"
 #include <wtf/OwnPtr.h>
@@ -27,9 +27,9 @@
 
 namespace WebCore {
 
-    class ClassNamesData : public Noncopyable {
+    class SpaceSplitStringData : public Noncopyable {
     public:
-        ClassNamesData(const String& string, bool shouldFoldCase)
+        SpaceSplitStringData(const String& string, bool shouldFoldCase)
             : m_string(string), m_shouldFoldCase(shouldFoldCase), m_createdVector(false)
         {
         }
@@ -45,7 +45,7 @@ namespace WebCore {
             return false;
         }
 
-        bool containsAll(ClassNamesData&);
+        bool containsAll(SpaceSplitStringData&);
 
         size_t size() { ensureVector(); return m_vector.size(); }
         const AtomicString& operator[](size_t i) { ensureVector(); ASSERT(i < size()); return m_vector[i]; }
@@ -54,29 +54,29 @@ namespace WebCore {
         void ensureVector() { if (!m_createdVector) createVector(); }
         void createVector();
 
-        typedef Vector<AtomicString, 8> ClassNameVector;
+        typedef Vector<AtomicString, 8> StringVector;
         String m_string;
-        ClassNameVector m_vector;
+        StringVector m_vector;
         bool m_shouldFoldCase;
         bool m_createdVector;
     };
 
-    class ClassNames {
+    class SpaceSplitString {
     public:
-        ClassNames() { }
-        ClassNames(const String& string, bool shouldFoldCase) : m_data(new ClassNamesData(string, shouldFoldCase)) { }
+        SpaceSplitString() { }
+        SpaceSplitString(const String& string, bool shouldFoldCase) : m_data(new SpaceSplitStringData(string, shouldFoldCase)) { }
 
-        void set(const String& string, bool shouldFoldCase) { m_data.set(new ClassNamesData(string, shouldFoldCase)); }
+        void set(const String& string, bool shouldFoldCase) { m_data.set(new SpaceSplitStringData(string, shouldFoldCase)); }
         void clear() { m_data.clear(); }
 
         bool contains(const AtomicString& string) const { return m_data && m_data->contains(string); }
-        bool containsAll(const ClassNames& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
+        bool containsAll(const SpaceSplitString& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
 
         size_t size() const { return m_data ? m_data->size() : 0; }
         const AtomicString& operator[](size_t i) const { ASSERT(i < size()); return (*m_data)[i]; }
 
     private:
-        OwnPtr<ClassNamesData> m_data;
+        OwnPtr<SpaceSplitStringData> m_data;
     };
 
     inline bool isClassWhitespace(UChar c)
@@ -86,4 +86,4 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ClassNames_h
+#endif // SpaceSplitString_h
diff --git a/WebCore/dom/StyleElement.h b/WebCore/dom/StyleElement.h
index 7f83909..9d3ac84 100644
--- a/WebCore/dom/StyleElement.h
+++ b/WebCore/dom/StyleElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006, 2007 Rob Buis
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/dom/StyledElement.h b/WebCore/dom/StyledElement.h
index 85fa7a7..52bffd3 100644
--- a/WebCore/dom/StyledElement.h
+++ b/WebCore/dom/StyledElement.h
@@ -66,7 +66,7 @@ public:
     CSSStyleDeclaration* style();
     void invalidateStyleAttribute();
 
-    const ClassNames& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
+    const SpaceSplitString& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
 
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
 
diff --git a/WebCore/dom/Tokenizer.h b/WebCore/dom/Tokenizer.h
index ea303f9..9a9b7b3 100644
--- a/WebCore/dom/Tokenizer.h
+++ b/WebCore/dom/Tokenizer.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2005, 2006 Apple Computer, Inc.
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
@@ -30,7 +28,7 @@ namespace WebCore {
     class SegmentedString;
     class XSSAuditor;
 
-    class Tokenizer {
+    class Tokenizer : public Noncopyable {
     public:
         virtual ~Tokenizer() { }
 
diff --git a/WebCore/dom/TreeWalker.h b/WebCore/dom/TreeWalker.h
index 4cc8e9a..88e59da 100644
--- a/WebCore/dom/TreeWalker.h
+++ b/WebCore/dom/TreeWalker.h
@@ -52,14 +52,15 @@ namespace WebCore {
         Node* previousNode(ScriptState*);
         Node* nextNode(ScriptState*);
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        Node* parentNode() { return parentNode(scriptStateFromNode(m_current.get())); }
-        Node* firstChild() { return firstChild(scriptStateFromNode(m_current.get())); }
-        Node* lastChild() { return lastChild(scriptStateFromNode(m_current.get())); }
-        Node* previousSibling() { return previousSibling(scriptStateFromNode(m_current.get())); }
-        Node* nextSibling() { return nextSibling(scriptStateFromNode(m_current.get())); }
-        Node* previousNode() { return previousNode(scriptStateFromNode(m_current.get())); }
-        Node* nextNode() { return nextNode(scriptStateFromNode(m_current.get())); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        Node* parentNode() { return parentNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* firstChild() { return firstChild(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* lastChild() { return lastChild(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* previousSibling() { return previousSibling(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* nextSibling() { return nextSibling(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* previousNode() { return previousNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* nextNode() { return nextNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
 
     private:
         TreeWalker(PassRefPtr<Node>, unsigned whatToShow, PassRefPtr<NodeFilter>, bool expandEntityReferences);
diff --git a/WebCore/dom/XMLTokenizer.cpp b/WebCore/dom/XMLTokenizer.cpp
index 30d39e0..56f8ff4 100644
--- a/WebCore/dom/XMLTokenizer.cpp
+++ b/WebCore/dom/XMLTokenizer.cpp
@@ -91,7 +91,8 @@ void XMLTokenizer::pushCurrentNode(Node* n)
 
 void XMLTokenizer::popCurrentNode()
 {
-    ASSERT(m_currentNode);
+    if (!m_currentNode)
+        return;
     ASSERT(m_currentNodeStack.size());
 
     if (m_currentNode != m_doc)
diff --git a/WebCore/dom/XMLTokenizer.h b/WebCore/dom/XMLTokenizer.h
index 095e8db..2f9c113 100644
--- a/WebCore/dom/XMLTokenizer.h
+++ b/WebCore/dom/XMLTokenizer.h
@@ -161,6 +161,23 @@ namespace WebCore {
     class PendingCallbacks;
     class ScriptElement;
 
+#if !USE(QXMLSTREAM)
+    class XMLParserContext : public RefCounted<XMLParserContext> {
+    public:
+        static PassRefPtr<XMLParserContext> createMemoryParser(xmlSAXHandlerPtr, void*, const char*);
+        static PassRefPtr<XMLParserContext> createStringParser(xmlSAXHandlerPtr, void*);
+        ~XMLParserContext();
+        xmlParserCtxtPtr context() const { return m_context; }
+
+    private:
+        XMLParserContext(xmlParserCtxtPtr context)
+            : m_context(context)
+        {
+        }
+        xmlParserCtxtPtr m_context;
+    };
+#endif
+
     class XMLTokenizer : public Tokenizer, public CachedResourceClient {
     public:
         XMLTokenizer(Document*, FrameView* = 0);
@@ -255,7 +272,8 @@ public:
         QXmlStreamReader m_stream;
         bool m_wroteText;
 #else
-        xmlParserCtxtPtr m_context;
+        xmlParserCtxtPtr context() const { return m_context ? m_context->context() : 0; };
+        RefPtr<XMLParserContext> m_context;
         OwnPtr<PendingCallbacks> m_pendingCallbacks;
         Vector<xmlChar> m_bufferedText;
 #endif
diff --git a/WebCore/dom/XMLTokenizerLibxml2.cpp b/WebCore/dom/XMLTokenizerLibxml2.cpp
index 9aa0961..42c8b9b 100644
--- a/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -465,7 +465,7 @@ static void errorFunc(void*, const char*, ...)
 
 static bool didInit = false;
 
-static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* userData)
+PassRefPtr<XMLParserContext> XMLParserContext::createStringParser(xmlSAXHandlerPtr handlers, void* userData)
 {
     if (!didInit) {
         xmlInitParser();
@@ -482,12 +482,12 @@ static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* user
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
     xmlSwitchEncoding(parser, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
-    return parser;
+    return adoptRef(new XMLParserContext(parser));
 }
 
 
 // Chunk should be encoded in UTF-8
-static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
+PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
 {
     if (!didInit) {
         xmlInitParser();
@@ -518,8 +518,8 @@ static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* user
     parser->str_xmlns = xmlDictLookup(parser->dict, BAD_CAST "xmlns", 5);
     parser->str_xml_ns = xmlDictLookup(parser->dict, XML_XML_NAMESPACE, 36);
     parser->_private = userData;
-
-    return parser;
+    
+    return adoptRef(new XMLParserContext(parser));
 }
 
 // --------------------------------
@@ -609,6 +609,13 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
         m_defaultNamespaceURI = parentElement->namespaceURI();
 }
 
+XMLParserContext::~XMLParserContext()
+{
+    if (m_context->myDoc)
+        xmlFreeDoc(m_context->myDoc);
+    xmlFreeParserCtxt(m_context);
+}
+
 XMLTokenizer::~XMLTokenizer()
 {
     clearCurrentNodeStack();
@@ -616,15 +623,16 @@ XMLTokenizer::~XMLTokenizer()
         m_doc->deref();
     if (m_pendingScript)
         m_pendingScript->removeClient(this);
-    if (m_context)
-        xmlFreeParserCtxt(m_context);
 }
 
 void XMLTokenizer::doWrite(const String& parseString)
 {
     if (!m_context)
         initializeParserContext();
-    
+
+    // Protect the libxml context from deletion during a callback
+    RefPtr<XMLParserContext> context = m_context;
+
     // libXML throws an error if you try to switch the encoding for an empty string.
     if (parseString.length()) {
         // Hack around libxml2's lack of encoding overide support by manually
@@ -633,15 +641,15 @@ void XMLTokenizer::doWrite(const String& parseString)
         // and switch encodings, causing the parse to fail.
         const UChar BOM = 0xFEFF;
         const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
-        xmlSwitchEncoding(m_context, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
+        xmlSwitchEncoding(context->context(), BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
         XMLTokenizerScope scope(m_doc->docLoader());
-        xmlParseChunk(m_context, reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
+        xmlParseChunk(context->context(), reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
     }
     
     if (m_doc->decoder() && m_doc->decoder()->sawError()) {
         // If the decoder saw an error, report it as fatal (stops parsing)
-        handleError(fatal, "Encoding error", lineNumber(), columnNumber());
+        handleError(fatal, "Encoding error", context->context()->input->line, context->context()->input->col);
     }
 
     return;
@@ -1277,9 +1285,9 @@ void XMLTokenizer::initializeParserContext(const char* chunk)
 
     XMLTokenizerScope scope(m_doc->docLoader());
     if (m_parsingFragment)
-        m_context = createMemoryParser(&sax, this, chunk);
+        m_context = XMLParserContext::createMemoryParser(&sax, this, chunk);
     else
-        m_context = createStringParser(&sax, this);
+        m_context = XMLParserContext::createStringParser(&sax, this);
 }
 
 void XMLTokenizer::doEnd()
@@ -1300,12 +1308,9 @@ void XMLTokenizer::doEnd()
         // Tell libxml we're done.
         {
             XMLTokenizerScope scope(m_doc->docLoader());
-            xmlParseChunk(m_context, 0, 0, 1);
+            xmlParseChunk(context(), 0, 0, 1);
         }
 
-        if (m_context->myDoc)
-            xmlFreeDoc(m_context->myDoc);
-        xmlFreeParserCtxt(m_context);
         m_context = 0;
     }
 }
@@ -1334,18 +1339,19 @@ void* xmlDocPtrForString(DocLoader* docLoader, const String& source, const Strin
 
 int XMLTokenizer::lineNumber() const
 {
-    return m_context ? m_context->input->line : 1;
+    return context() ? context()->input->line : 1;
 }
 
 int XMLTokenizer::columnNumber() const
 {
-    return m_context ? m_context->input->col : 1;
+    return context() ? context()->input->col : 1;
 }
 
 void XMLTokenizer::stopParsing()
 {
     Tokenizer::stopParsing();
-    xmlStopParser(m_context);
+    if (context())
+        xmlStopParser(context());
 }
 
 void XMLTokenizer::resumeParsing()
@@ -1384,17 +1390,17 @@ bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, E
     CString chunkAsUtf8 = chunk.utf8();
     tokenizer.initializeParserContext(chunkAsUtf8.data());
 
-    xmlParseContent(tokenizer.m_context);
+    xmlParseContent(tokenizer.context());
 
     tokenizer.endDocument();
 
     // Check if all the chunk has been processed.
-    long bytesProcessed = xmlByteConsumed(tokenizer.m_context);
+    long bytesProcessed = xmlByteConsumed(tokenizer.context());
     if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) != chunkAsUtf8.length())
         return false;
 
     // No error if the chunk is well formed or it is not but we have no error.
-    return tokenizer.m_context->wellFormed || xmlCtxtGetLastError(tokenizer.m_context) == 0;
+    return tokenizer.context()->wellFormed || xmlCtxtGetLastError(tokenizer.context()) == 0;
 }
 
 // --------------------------------
@@ -1437,12 +1443,9 @@ HashMap<String, String> parseAttributes(const String& string, bool& attrsOK)
     memset(&sax, 0, sizeof(sax));
     sax.startElementNs = attributesStartElementNsHandler;
     sax.initialized = XML_SAX2_MAGIC;
-    xmlParserCtxtPtr parser = createStringParser(&sax, &state);
+    RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
-    xmlParseChunk(parser, reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
-    if (parser->myDoc)
-        xmlFreeDoc(parser->myDoc);
-    xmlFreeParserCtxt(parser);
+    xmlParseChunk(parser->context(), reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
diff --git a/WebCore/dom/XMLTokenizerQt.cpp b/WebCore/dom/XMLTokenizerQt.cpp
index c6e73ba..4e61715 100644
--- a/WebCore/dom/XMLTokenizerQt.cpp
+++ b/WebCore/dom/XMLTokenizerQt.cpp
@@ -66,7 +66,6 @@ using namespace std;
 
 namespace WebCore {
 
-#if QT_VERSION >= 0x040400
 class EntityResolver : public QXmlStreamEntityResolver {
     virtual QString resolveUndeclaredEntity(const QString &name);
 };
@@ -76,7 +75,6 @@ QString EntityResolver::resolveUndeclaredEntity(const QString &name)
     UChar c = decodeNamedEntity(name.toUtf8().constData());
     return QString(c);
 }
-#endif
 
 // --------------------------------
 
@@ -103,9 +101,7 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_scriptStartLine(0)
     , m_parsingFragment(false)
 {
-#if QT_VERSION >= 0x040400
     m_stream.setEntityResolver(new EntityResolver);
-#endif
 }
 
 XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
@@ -149,19 +145,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     if (elemStack.isEmpty())
         return;
     
-#if QT_VERSION < 0x040400
-    for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedNodeMap* attrs = element->attributes()) {
-            for (unsigned i = 0; i < attrs->length(); i++) {
-                Attribute* attr = attrs->attributeItem(i);
-                if (attr->localName() == "xmlns")
-                    m_defaultNamespaceURI = attr->value();
-                else if (attr->prefix() == "xmlns")
-                    m_prefixToNamespaceMap.set(attr->localName(), attr->value());
-            }
-        }
-    }
-#else
     QXmlStreamNamespaceDeclarations namespaces;
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
         if (NamedNodeMap* attrs = element->attributes()) {
@@ -176,7 +159,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     }
     m_stream.addExtraNamespaceDeclarations(namespaces);
     m_stream.setEntityResolver(new EntityResolver);
-#endif
 
     // If the parent element is not in document tree, there may be no xmlns attribute; just default to the parent's namespace.
     if (m_defaultNamespaceURI.isNull() && !parentElement->inDocument())
@@ -190,9 +172,7 @@ XMLTokenizer::~XMLTokenizer()
         m_doc->deref();
     if (m_pendingScript)
         m_pendingScript->removeClient(this);
-#if QT_VERSION >= 0x040400
     delete m_stream.entityResolver();
-#endif
 }
 
 void XMLTokenizer::doWrite(const String& parseString)
@@ -207,27 +187,6 @@ void XMLTokenizer::doWrite(const String& parseString)
 
     QString data(parseString);
     if (!data.isEmpty()) {
-#if QT_VERSION < 0x040400
-        if (!m_sawFirstElement) {
-            int idx = data.indexOf(QLatin1String("<?xml"));
-            if (idx != -1) {
-                int start = idx + 5;
-                int end = data.indexOf(QLatin1String("?>"), start);
-                QString content = data.mid(start, end-start);
-                bool ok = true;
-                HashMap<String, String> attrs = parseAttributes(content, ok);
-                String version = attrs.get("version");
-                String encoding = attrs.get("encoding");
-                ExceptionCode ec = 0;
-                if (!m_parsingFragment) {
-                    if (!version.isEmpty())
-                        m_doc->setXMLVersion(version, ec);
-                    if (!encoding.isEmpty())
-                        m_doc->setXMLEncoding(encoding);
-                }
-            }
-        }
-#endif
         m_stream.addData(data);
         parse();
     }
@@ -256,7 +215,7 @@ void XMLTokenizer::doEnd()
 #endif
     
     if (m_stream.error() == QXmlStreamReader::PrematureEndOfDocumentError
-        || (m_wroteText && !m_sawFirstElement && !m_sawXSLTransform))
+        || (m_wroteText && !m_sawFirstElement && !m_sawXSLTransform && !m_sawError))
         handleError(fatal, qPrintable(m_stream.errorString()), lineNumber(), columnNumber());
 }
 
@@ -485,14 +444,12 @@ void XMLTokenizer::startDocument()
     if (!m_parsingFragment) {
         m_doc->setXMLStandalone(m_stream.isStandaloneDocument(), ec);
 
-#if QT_VERSION >= 0x040400
         QStringRef version = m_stream.documentVersion();
         if (!version.isEmpty())
             m_doc->setXMLVersion(version, ec);
         QStringRef encoding = m_stream.documentEncoding();
         if (!encoding.isEmpty())
             m_doc->setXMLEncoding(encoding);
-#endif
     }
 }
 
@@ -702,83 +659,11 @@ bool XMLTokenizer::hasError() const
     return m_stream.hasError();
 }
 
-#if QT_VERSION < 0x040400
-static QString parseId(const QString &dtd, int *pos, bool *ok)
-{
-    *ok = true;
-    int start = *pos + 1;
-    int end = start;
-    if (dtd.at(*pos) == QLatin1Char('\''))
-        while (start < dtd.length() && dtd.at(end) != QLatin1Char('\''))
-            ++end;
-    else if (dtd.at(*pos) == QLatin1Char('\"'))
-        while (start < dtd.length() && dtd.at(end) != QLatin1Char('\"'))
-            ++end;
-    else {
-        *ok = false;
-        return QString();
-    }
-    *pos = end + 1;
-    return dtd.mid(start, end - start);
-}
-#endif
-
 void XMLTokenizer::parseDtd()
 {
-#if QT_VERSION >= 0x040400
     QStringRef name = m_stream.dtdName();
     QStringRef publicId = m_stream.dtdPublicId();
     QStringRef systemId = m_stream.dtdSystemId();
-#else
-    QString dtd = m_stream.text().toString();
-
-    int start = dtd.indexOf("<!DOCTYPE ") + 10;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    int end = start;
-    while (start < dtd.length() && !dtd.at(end).isSpace())
-        ++end;
-    QString name = dtd.mid(start, end - start);
-
-    start = end;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    end = start;
-    while (start < dtd.length() && !dtd.at(end).isSpace())
-        ++end;
-    QString id = dtd.mid(start, end - start);
-    start = end;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    QString publicId;
-    QString systemId;
-    if (id == QLatin1String("PUBLIC")) {
-        bool ok;
-        publicId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-        while (start < dtd.length() && dtd.at(start).isSpace())
-            ++start;
-        systemId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-    } else if (id == QLatin1String("SYSTEM")) {
-        bool ok;
-        systemId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-    } else if (id == QLatin1String("[") || id == QLatin1String(">")) {
-    } else {
-        handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-        return;
-    }
-#endif    
 
     //qDebug() << dtd << name << publicId << systemId;
     if ((publicId == QLatin1String("-//W3C//DTD XHTML 1.0 Transitional//EN"))
diff --git a/WebCore/dom/default/PlatformMessagePortChannel.cpp b/WebCore/dom/default/PlatformMessagePortChannel.cpp
index d668703..9e0e7dc 100644
--- a/WebCore/dom/default/PlatformMessagePortChannel.cpp
+++ b/WebCore/dom/default/PlatformMessagePortChannel.cpp
@@ -193,7 +193,8 @@ void PlatformMessagePortChannel::postMessageToRemote(PassOwnPtr<MessagePortChann
 bool PlatformMessagePortChannel::tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>& result)
 {
     MutexLocker lock(m_mutex);
-    return m_incomingQueue->tryGetMessage(result);
+    result = m_incomingQueue->tryGetMessage();
+    return result;
 }
 
 bool PlatformMessagePortChannel::isConnectedTo(MessagePort* port)
diff --git a/WebCore/dom/default/PlatformMessagePortChannel.h b/WebCore/dom/default/PlatformMessagePortChannel.h
index 0ce2d13..2aad952 100644
--- a/WebCore/dom/default/PlatformMessagePortChannel.h
+++ b/WebCore/dom/default/PlatformMessagePortChannel.h
@@ -63,18 +63,14 @@ namespace WebCore {
         public:
             static PassRefPtr<MessagePortQueue> create() { return adoptRef(new MessagePortQueue()); }
 
-            bool tryGetMessage(OwnPtr<MessagePortChannel::EventData>& message)
+            PassOwnPtr<MessagePortChannel::EventData> tryGetMessage()
             {
-                MessagePortChannel::EventData* holder = 0;
-                bool messageAvailable = m_queue.tryGetMessage(holder);
-                if (messageAvailable)
-                    message.set(holder);
-                return messageAvailable;
+                return m_queue.tryGetMessage();
             }
 
             bool appendAndCheckEmpty(PassOwnPtr<MessagePortChannel::EventData> message)
             {
-                return m_queue.appendAndCheckEmpty(message.release());
+                return m_queue.appendAndCheckEmpty(message);
             }
 
             bool isEmpty()
@@ -82,19 +78,10 @@ namespace WebCore {
                 return m_queue.isEmpty();
             }
 
-            ~MessagePortQueue()
-            {
-                // Manually free any items left in the queue, since we can't use OwnPtr internally.
-                MessagePortChannel::EventData* data = 0;
-                while (m_queue.tryGetMessage(data))
-                    delete data;
-            }
         private:
             MessagePortQueue() { }
 
-            // OwnPtr is Noncopyable, so we can't use it as the template type in a MessageQueue. So we just store a pointer to EventData and manually free it in the destructor.
-            // FIXME: Use a lock-free queue implementation to completely eliminate contention when sending/receiving messages.
-            MessageQueue<MessagePortChannel::EventData*> m_queue;
+            MessageQueue<MessagePortChannel::EventData> m_queue;
         };
 
         ~PlatformMessagePortChannel();
diff --git a/WebCore/editing/AppendNodeCommand.cpp b/WebCore/editing/AppendNodeCommand.cpp
index ef79e9c..6178641 100644
--- a/WebCore/editing/AppendNodeCommand.cpp
+++ b/WebCore/editing/AppendNodeCommand.cpp
@@ -44,12 +44,18 @@ AppendNodeCommand::AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node
 
 void AppendNodeCommand::doApply()
 {
+    if (!m_parent->isContentEditable() && m_parent->attached())
+        return;
+        
     ExceptionCode ec;
     m_parent->appendChild(m_node.get(), ec);
 }
 
 void AppendNodeCommand::doUnapply()
 {
+    if (!m_parent->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->remove(ec);
 }
diff --git a/WebCore/editing/CompositeEditCommand.cpp b/WebCore/editing/CompositeEditCommand.cpp
index 1617be8..2796690 100644
--- a/WebCore/editing/CompositeEditCommand.cpp
+++ b/WebCore/editing/CompositeEditCommand.cpp
@@ -746,8 +746,9 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
 {
     // First we clone the outerNode
     
-    RefPtr<Node> lastNode = outerNode->cloneNode(isTableElement(outerNode));
-    appendNode(lastNode, blockElement);
+    RefPtr<Node> topNode = outerNode->cloneNode(isTableElement(outerNode));
+    appendNode(topNode, blockElement);
+    RefPtr<Node> lastNode = topNode;
 
     if (start.node() != outerNode) {
         Vector<RefPtr<Node> > ancestors;
@@ -769,12 +770,15 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
     // Handle the case of paragraphs with more than one node,
     // cloning all the siblings until end.node() is reached.
     
-    if (start.node() != end.node()) {
-        for (Node* n = start.node()->nextSibling(); n != NULL; n = n->nextSibling()) {
+    if (start.node() != end.node() && !start.node()->isDescendantOf(end.node())) {
+        for (Node* n = start.node()->traverseNextSibling(outerNode); n; n = n->nextSibling()) {
+            if (n->parentNode() != start.node()->parentNode())
+                lastNode = topNode->firstChild();
+
             RefPtr<Node> clonedNode = n->cloneNode(true);
             insertNodeAfter(clonedNode, lastNode);
             lastNode = clonedNode.release();
-            if (n == end.node())
+            if (n == end.node() || end.node()->isDescendantOf(n))
                 break;
         }
     }
diff --git a/WebCore/editing/DeleteButtonController.h b/WebCore/editing/DeleteButtonController.h
index 713ae8b..1286c07 100644
--- a/WebCore/editing/DeleteButtonController.h
+++ b/WebCore/editing/DeleteButtonController.h
@@ -36,7 +36,7 @@ class HTMLElement;
 class RenderObject;
 class VisibleSelection;
 
-class DeleteButtonController {
+class DeleteButtonController : public Noncopyable {
 public:
     DeleteButtonController(Frame*);
 
diff --git a/WebCore/editing/DeleteFromTextNodeCommand.cpp b/WebCore/editing/DeleteFromTextNodeCommand.cpp
index e942fef..f1d79af 100644
--- a/WebCore/editing/DeleteFromTextNodeCommand.cpp
+++ b/WebCore/editing/DeleteFromTextNodeCommand.cpp
@@ -45,6 +45,9 @@ void DeleteFromTextNodeCommand::doApply()
 {
     ASSERT(m_node);
 
+    if (!m_node->isContentEditable())
+        return;
+
     ExceptionCode ec = 0;
     m_text = m_node->substringData(m_offset, m_count, ec);
     if (ec)
@@ -57,6 +60,9 @@ void DeleteFromTextNodeCommand::doUnapply()
 {
     ASSERT(m_node);
 
+    if (!m_node->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->insertData(m_offset, m_text, ec);
 }
diff --git a/WebCore/editing/DeleteSelectionCommand.cpp b/WebCore/editing/DeleteSelectionCommand.cpp
index fbb5aea..9e4ba29 100644
--- a/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/WebCore/editing/DeleteSelectionCommand.cpp
@@ -595,6 +595,14 @@ void DeleteSelectionCommand::mergeParagraphs()
         return;
     }
     
+    // Block images, tables and horizontal rules cannot be made inline with content at mergeDestination.  If there is 
+    // any (!isStartOfParagraph(mergeDestination)), don't merge, just move the caret to just before the selection we deleted.
+    // See https://bugs.webkit.org/show_bug.cgi?id=25439
+    if (isRenderedAsNonInlineTableImageOrHR(startOfParagraphToMove.deepEquivalent().node()) && !isStartOfParagraph(mergeDestination)) {
+        m_endingPosition = m_upstreamStart;
+        return;
+    }
+    
     RefPtr<Range> range = Range::create(document(), rangeCompliantEquivalent(startOfParagraphToMove.deepEquivalent()), rangeCompliantEquivalent(endOfParagraphToMove.deepEquivalent()));
     RefPtr<Range> rangeToBeReplaced = Range::create(document(), rangeCompliantEquivalent(mergeDestination.deepEquivalent()), rangeCompliantEquivalent(mergeDestination.deepEquivalent()));
     if (!document()->frame()->editor()->client()->shouldMoveRangeAfterDelete(range.get(), rangeToBeReplaced.get()))
diff --git a/WebCore/editing/Editor.cpp b/WebCore/editing/Editor.cpp
index 3f3f736..0744fd6 100644
--- a/WebCore/editing/Editor.cpp
+++ b/WebCore/editing/Editor.cpp
@@ -30,6 +30,7 @@
 #include "AXObjectCache.h"
 #include "ApplyStyleCommand.h"
 #include "CharacterNames.h"
+#include "CompositionEvent.h"
 #include "CreateLinkCommand.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSMutableStyleDeclaration.h"
@@ -831,7 +832,7 @@ TriState Editor::selectionHasStyle(CSSStyleDeclaration* style) const
                 TriState nodeState = triStateOfStyleInComputedStyle(style, nodeStyle.get(), !node->isTextNode());
                 if (node == m_frame->selection()->start().node())
                     state = nodeState;
-                else if (state != nodeState) {
+                else if (state != nodeState && node->isTextNode()) {
                     state = MixedTriState;
                     break;
                 }
@@ -1003,6 +1004,16 @@ bool Editor::insertParagraphSeparator()
     return true;
 }
 
+static bool nodeIsInTextFormControl(Node* node)
+{
+    if (!node)
+        return false;
+    Node* ancestor = node->shadowAncestorNode();
+    if (ancestor == node)
+        return false;
+    return ancestor->isElementNode() && static_cast<Element*>(ancestor)->isTextFormControl();
+}
+
 void Editor::cut()
 {
     if (tryDHTMLCut())
@@ -1013,7 +1024,10 @@ void Editor::cut()
     }
     RefPtr<Range> selection = selectedRange();
     if (shouldDeleteRange(selection.get())) {
-        Pasteboard::generalPasteboard()->writeSelection(selection.get(), canSmartCopyOrDelete(), m_frame);
+        if (nodeIsInTextFormControl(m_frame->selection()->start().node()))
+            Pasteboard::generalPasteboard()->writePlainText(m_frame->selectedText());
+        else
+            Pasteboard::generalPasteboard()->writeSelection(selection.get(), canSmartCopyOrDelete(), m_frame);
         didWriteSelectionToPasteboard();
         deleteSelectionWithSmartDelete(canSmartCopyOrDelete());
     }
@@ -1027,13 +1041,17 @@ void Editor::copy()
         systemBeep();
         return;
     }
-    
-    Document* document = m_frame->document();
-    if (HTMLImageElement* imageElement = imageElementFromImageDocument(document))
-        Pasteboard::generalPasteboard()->writeImage(imageElement, document->url(), document->title());
-    else
-        Pasteboard::generalPasteboard()->writeSelection(selectedRange().get(), canSmartCopyOrDelete(), m_frame);
-    
+
+    if (nodeIsInTextFormControl(m_frame->selection()->start().node()))
+        Pasteboard::generalPasteboard()->writePlainText(m_frame->selectedText());
+    else {
+        Document* document = m_frame->document();
+        if (HTMLImageElement* imageElement = imageElementFromImageDocument(document))
+            Pasteboard::generalPasteboard()->writeImage(imageElement, document->url(), document->title());
+        else
+            Pasteboard::generalPasteboard()->writeSelection(selectedRange().get(), canSmartCopyOrDelete(), m_frame);
+    }
+
     didWriteSelectionToPasteboard();
 }
 
@@ -1353,6 +1371,16 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
         return;
     }
     
+    // Dispatch a compositionend event to the focused node.
+    // We should send this event before sending a TextEvent as written in Section 6.2.2 and 6.2.3 of
+    // the DOM Event specification.
+    Node* target = m_frame->document()->focusedNode();
+    if (target) {
+        RefPtr<CompositionEvent> event = CompositionEvent::create(eventNames().compositionendEvent, m_frame->domWindow(), text);
+        ExceptionCode ec = 0;
+        target->dispatchEvent(event, ec);
+    }
+
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
@@ -1379,7 +1407,38 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
         setIgnoreCompositionSelectionChange(false);
         return;
     }
-    
+
+    Node* target = m_frame->document()->focusedNode();
+    if (target) {
+        // Dispatch an appropriate composition event to the focused node.
+        // We check the composition status and choose an appropriate composition event since this
+        // function is used for three purposes:
+        // 1. Starting a new composition.
+        //    Send a compositionstart event when this function creates a new composition node, i.e.
+        //    m_compositionNode == 0 && !text.isEmpty().
+        // 2. Updating the existing composition node.
+        //    Send a compositionupdate event when this function updates the existing composition
+        //    node, i.e. m_compositionNode != 0 && !text.isEmpty().
+        // 3. Canceling the ongoing composition.
+        //    Send a compositionend event when function deletes the existing composition node, i.e.
+        //    m_compositionNode != 0 && test.isEmpty().
+        RefPtr<CompositionEvent> event;
+        if (!m_compositionNode) {
+            // We should send a compositionstart event only when the given text is not empty because this
+            // function doesn't create a composition node when the text is empty.
+            if (!text.isEmpty())
+                event = CompositionEvent::create(eventNames().compositionstartEvent, m_frame->domWindow(), text);
+        } else {
+            if (!text.isEmpty())
+                event = CompositionEvent::create(eventNames().compositionupdateEvent, m_frame->domWindow(), text);
+            else
+              event = CompositionEvent::create(eventNames().compositionendEvent, m_frame->domWindow(), text);
+        }
+        ExceptionCode ec = 0;
+        if (event.get())
+            target->dispatchEvent(event, ec);
+    }
+
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
@@ -1754,8 +1813,9 @@ static String findFirstMisspellingOrBadGrammarInRange(EditorClient* client, Rang
         }
         if (lastIteration || totalLengthProcessed + currentLength >= totalRangeLength)
             break;
-        setStart(paragraphRange.get(), startOfNextParagraph(paragraphRange->endPosition()));
-        setEnd(paragraphRange.get(), endOfParagraph(paragraphRange->startPosition()));
+        VisiblePosition newParagraphStart = startOfNextParagraph(paragraphRange->endPosition());
+        setStart(paragraphRange.get(), newParagraphStart);
+        setEnd(paragraphRange.get(), endOfParagraph(newParagraphStart));
         firstIteration = false;
         totalLengthProcessed += currentLength;
     }
@@ -2693,6 +2753,9 @@ bool Editor::insideVisibleArea(const IntPoint& point) const
         return true;
     
     RenderPart* renderer = frame->ownerRenderer();
+    if (!renderer)
+        return false;
+
     RenderBlock* container = renderer->containingBlock();
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
@@ -2719,6 +2782,9 @@ bool Editor::insideVisibleArea(Range* range) const
         return true;
     
     RenderPart* renderer = frame->ownerRenderer();
+    if (!renderer)
+        return false;
+
     RenderBlock* container = renderer->containingBlock();
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
diff --git a/WebCore/editing/IndentOutdentCommand.cpp b/WebCore/editing/IndentOutdentCommand.cpp
index 808a2f8..5e6f339 100644
--- a/WebCore/editing/IndentOutdentCommand.cpp
+++ b/WebCore/editing/IndentOutdentCommand.cpp
@@ -129,17 +129,8 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurr
         targetBlockquote = 0;
 }
 
-void IndentOutdentCommand::indentRegion()
+void IndentOutdentCommand::indentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
-    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
-    VisiblePosition startOfSelection = selection.visibleStart();
-    VisiblePosition endOfSelection = selection.visibleEnd();
-    int startIndex = indexForVisiblePosition(startOfSelection);
-    int endIndex = indexForVisiblePosition(endOfSelection);
-
-    ASSERT(!startOfSelection.isNull());
-    ASSERT(!endOfSelection.isNull());
-
     // Special case empty unsplittable elements because there's nothing to split
     // and there's nothing to move.
     Position start = startOfSelection.deepEquivalent().downstream();
@@ -162,6 +153,12 @@ void IndentOutdentCommand::indentRegion()
             blockquoteForNextIndent = 0;
         else
             indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+
+        // indentIntoBlockquote could move more than one paragraph if the paragraph
+        // is in a list item or a table. As a result, endAfterSelection could refer to a position
+        // no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
@@ -169,14 +166,7 @@ void IndentOutdentCommand::indentRegion()
             return;
         }
         endOfCurrentParagraph = endOfNextParagraph;
-    }
-    
-    updateLayout();
-    
-    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
-    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
-    if (startRange && endRange)
-        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
+    }   
 }
 
 void IndentOutdentCommand::outdentParagraph()
@@ -242,36 +232,40 @@ void IndentOutdentCommand::outdentParagraph()
     moveParagraph(startOfParagraph(visibleStartOfParagraph), endOfParagraph(visibleEndOfParagraph), VisiblePosition(Position(placeholder.get(), 0)), true);
 }
 
-void IndentOutdentCommand::outdentRegion()
+void IndentOutdentCommand::outdentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
-    VisiblePosition startOfSelection = endingSelection().visibleStart();
-    VisiblePosition endOfSelection = endingSelection().visibleEnd();
     VisiblePosition endOfLastParagraph = endOfParagraph(endOfSelection);
 
-    ASSERT(!startOfSelection.isNull());
-    ASSERT(!endOfSelection.isNull());
-
     if (endOfParagraph(startOfSelection) == endOfLastParagraph) {
         outdentParagraph();
         return;
     }
-
+    
     Position originalSelectionEnd = endingSelection().end();
-    setEndingSelection(endingSelection().visibleStart());
-    outdentParagraph();
-    Position originalSelectionStart = endingSelection().start();
-    VisiblePosition endOfCurrentParagraph = endOfParagraph(endOfParagraph(endingSelection().visibleStart()).next(true));
+    VisiblePosition endOfCurrentParagraph = endOfParagraph(startOfSelection);
     VisiblePosition endAfterSelection = endOfParagraph(endOfParagraph(endOfSelection).next());
+
     while (endOfCurrentParagraph != endAfterSelection) {
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
         if (endOfCurrentParagraph == endOfLastParagraph)
             setEndingSelection(VisibleSelection(originalSelectionEnd, DOWNSTREAM));
         else
             setEndingSelection(endOfCurrentParagraph);
+        
         outdentParagraph();
+        
+        // outdentParagraph could move more than one paragraph if the paragraph
+        // is in a list item. As a result, endAfterSelection and endOfNextParagraph
+        // could refer to positions no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
+            
+        if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
+            endOfCurrentParagraph = endingSelection().end();
+            endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
+        }
         endOfCurrentParagraph = endOfNextParagraph;
     }
-    setEndingSelection(VisibleSelection(originalSelectionStart, endingSelection().end(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::doApply()
@@ -295,10 +289,27 @@ void IndentOutdentCommand::doApply()
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
         setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
+    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
+    VisiblePosition startOfSelection = selection.visibleStart();
+    VisiblePosition endOfSelection = selection.visibleEnd();
+    
+    int startIndex = indexForVisiblePosition(startOfSelection);
+    int endIndex = indexForVisiblePosition(endOfSelection);
+    
+    ASSERT(!startOfSelection.isNull());
+    ASSERT(!endOfSelection.isNull());
+    
     if (m_typeOfAction == Indent)
-        indentRegion();
+        indentRegion(startOfSelection, endOfSelection);
     else
-        outdentRegion();
+        outdentRegion(startOfSelection, endOfSelection);
+
+    updateLayout();
+    
+    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
+    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
+    if (startRange && endRange)
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
 }
 
 }
diff --git a/WebCore/editing/IndentOutdentCommand.h b/WebCore/editing/IndentOutdentCommand.h
index 817b4c8..8705bf1 100644
--- a/WebCore/editing/IndentOutdentCommand.h
+++ b/WebCore/editing/IndentOutdentCommand.h
@@ -46,8 +46,8 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    void indentRegion();
-    void outdentRegion();
+    void indentRegion(const VisiblePosition&, const VisiblePosition&);
+    void outdentRegion(const VisiblePosition&, const VisiblePosition&);
     void outdentParagraph();
     bool tryIndentingAsListItem(const VisiblePosition&);
     void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
diff --git a/WebCore/editing/InsertIntoTextNodeCommand.cpp b/WebCore/editing/InsertIntoTextNodeCommand.cpp
index 4905fae..9c3423a 100644
--- a/WebCore/editing/InsertIntoTextNodeCommand.cpp
+++ b/WebCore/editing/InsertIntoTextNodeCommand.cpp
@@ -43,12 +43,18 @@ InsertIntoTextNodeCommand::InsertIntoTextNodeCommand(PassRefPtr<Text> node, unsi
 
 void InsertIntoTextNodeCommand::doApply()
 {
+    if (!m_node->isContentEditable())
+        return;
+    
     ExceptionCode ec;
     m_node->insertData(m_offset, m_text, ec);
 }
 
 void InsertIntoTextNodeCommand::doUnapply()
 {
+    if (!m_node->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->deleteData(m_offset, m_text.length(), ec);
 }
diff --git a/WebCore/editing/InsertNodeBeforeCommand.cpp b/WebCore/editing/InsertNodeBeforeCommand.cpp
index 4f60963..2ce9846 100644
--- a/WebCore/editing/InsertNodeBeforeCommand.cpp
+++ b/WebCore/editing/InsertNodeBeforeCommand.cpp
@@ -46,7 +46,7 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
 void InsertNodeBeforeCommand::doApply()
 {
     Node* parent = m_refChild->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec;
@@ -55,6 +55,9 @@ void InsertNodeBeforeCommand::doApply()
 
 void InsertNodeBeforeCommand::doUnapply()
 {
+    if (!m_insertChild->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_insertChild->remove(ec);
 }
diff --git a/WebCore/editing/JoinTextNodesCommand.cpp b/WebCore/editing/JoinTextNodesCommand.cpp
index f981481..fa0987d 100644
--- a/WebCore/editing/JoinTextNodesCommand.cpp
+++ b/WebCore/editing/JoinTextNodesCommand.cpp
@@ -45,6 +45,10 @@ void JoinTextNodesCommand::doApply()
     if (m_text1->nextSibling() != m_text2)
         return;
 
+    Node* parent = m_text2->parentNode();
+    if (!parent || !parent->isContentEditable())
+        return;
+    
     ExceptionCode ec = 0;
     m_text2->insertData(0, m_text1->data(), ec);
     if (ec)
@@ -59,7 +63,7 @@ void JoinTextNodesCommand::doUnapply()
         return;
 
     Node* parent = m_text2->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/WebCore/editing/MergeIdenticalElementsCommand.cpp b/WebCore/editing/MergeIdenticalElementsCommand.cpp
index 99ba286..f56f726 100644
--- a/WebCore/editing/MergeIdenticalElementsCommand.cpp
+++ b/WebCore/editing/MergeIdenticalElementsCommand.cpp
@@ -42,7 +42,7 @@ MergeIdenticalElementsCommand::MergeIdenticalElementsCommand(PassRefPtr<Element>
 
 void MergeIdenticalElementsCommand::doApply()
 {
-    if (m_element1->nextSibling() != m_element2)
+    if (m_element1->nextSibling() != m_element2 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
         return;
 
     m_atChild = m_element2->firstChild();
@@ -68,7 +68,7 @@ void MergeIdenticalElementsCommand::doUnapply()
     RefPtr<Node> atChild = m_atChild.release();
 
     Node* parent = m_element2->parent();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/WebCore/editing/RemoveNodeCommand.cpp b/WebCore/editing/RemoveNodeCommand.cpp
index 62a36be..f6d6a4b 100644
--- a/WebCore/editing/RemoveNodeCommand.cpp
+++ b/WebCore/editing/RemoveNodeCommand.cpp
@@ -42,7 +42,7 @@ RemoveNodeCommand::RemoveNodeCommand(PassRefPtr<Node> node)
 void RemoveNodeCommand::doApply()
 {
     Node* parent = m_node->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     m_parent = parent;
@@ -56,7 +56,7 @@ void RemoveNodeCommand::doUnapply()
 {
     RefPtr<Node> parent = m_parent.release();
     RefPtr<Node> refChild = m_refChild.release();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec;
diff --git a/WebCore/editing/SelectionController.cpp b/WebCore/editing/SelectionController.cpp
index 00672f2..af89ccb 100644
--- a/WebCore/editing/SelectionController.cpp
+++ b/WebCore/editing/SelectionController.cpp
@@ -994,11 +994,14 @@ void SelectionController::paintCaret(GraphicsContext* p, int tx, int ty, const I
     IntRect caret = intersection(drawingRect, clipRect);
     if (!caret.isEmpty()) {
         Color caretColor = Color::black;
+        ColorSpace colorSpace = DeviceColorSpace;
         Element* element = rootEditableElement();
-        if (element && element->renderer())
+        if (element && element->renderer()) {
             caretColor = element->renderer()->style()->color();
+            colorSpace = element->renderer()->style()->colorSpace();
+        }
 
-        p->fillRect(caret, caretColor);
+        p->fillRect(caret, caretColor, colorSpace);
     }
 }
 
diff --git a/WebCore/editing/SplitElementCommand.cpp b/WebCore/editing/SplitElementCommand.cpp
index 35dfc6f..2998c6a 100644
--- a/WebCore/editing/SplitElementCommand.cpp
+++ b/WebCore/editing/SplitElementCommand.cpp
@@ -41,35 +41,39 @@ SplitElementCommand::SplitElementCommand(PassRefPtr<Element> element, PassRefPtr
     ASSERT(m_atChild->parentNode() == m_element2);
 }
 
-void SplitElementCommand::doApply()
+void SplitElementCommand::executeApply()
 {
-    RefPtr<Element> prefixElement = m_element2->cloneElementWithoutChildren();
-
     if (m_atChild->parentNode() != m_element2)
         return;
-
+    
     Vector<RefPtr<Node> > children;
     for (Node* node = m_element2->firstChild(); node != m_atChild; node = node->nextSibling())
         children.append(node);
-
+    
     ExceptionCode ec = 0;
-
+    
     Node* parent = m_element2->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
-    parent->insertBefore(prefixElement.get(), m_element2.get(), ec);
+    parent->insertBefore(m_element1.get(), m_element2.get(), ec);
     if (ec)
         return;
-    m_element1 = prefixElement.release();
-
+    
     size_t size = children.size();
     for (size_t i = 0; i < size; ++i)
         m_element1->appendChild(children[i], ec);
 }
+    
+void SplitElementCommand::doApply()
+{
+    m_element1 = m_element2->cloneElementWithoutChildren();
+    
+    executeApply();
+}
 
 void SplitElementCommand::doUnapply()
 {
-    if (!m_element1)
+    if (!m_element1 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
         return;
 
     Vector<RefPtr<Node> > children;
@@ -85,7 +89,14 @@ void SplitElementCommand::doUnapply()
         m_element2->insertBefore(children[i].get(), refChild.get(), ec);
 
     m_element1->remove(ec);
-    m_element1 = 0;
 }
 
+void SplitElementCommand::doReapply()
+{
+    if (!m_element1)
+        return;
+    
+    executeApply();
+}
+    
 } // namespace WebCore
diff --git a/WebCore/editing/SplitElementCommand.h b/WebCore/editing/SplitElementCommand.h
index 2732762..7ea8f5b 100644
--- a/WebCore/editing/SplitElementCommand.h
+++ b/WebCore/editing/SplitElementCommand.h
@@ -42,6 +42,8 @@ private:
 
     virtual void doApply();
     virtual void doUnapply();
+    virtual void doReapply();
+    void executeApply();
 
     RefPtr<Element> m_element1;
     RefPtr<Element> m_element2;
diff --git a/WebCore/editing/SplitTextNodeCommand.cpp b/WebCore/editing/SplitTextNodeCommand.cpp
index 3b04e01..15daa49 100644
--- a/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/WebCore/editing/SplitTextNodeCommand.cpp
@@ -49,6 +49,10 @@ SplitTextNodeCommand::SplitTextNodeCommand(PassRefPtr<Text> text, int offset)
 
 void SplitTextNodeCommand::doApply()
 {
+    Node* parent = m_text2->parentNode();
+    if (!parent || !parent->isContentEditable())
+        return;
+
     ExceptionCode ec = 0;
 
     String prefixText = m_text2->substringData(0, m_offset, ec);
@@ -59,9 +63,6 @@ void SplitTextNodeCommand::doApply()
     ASSERT(prefixTextNode);
     document()->copyMarkers(m_text2.get(), 0, m_offset, prefixTextNode.get(), 0);
 
-    Node* parent = m_text2->parentNode();
-    if (!parent)
-        return;
     parent->insertBefore(prefixTextNode.get(), m_text2.get(), ec);
     if (ec)
         return;
@@ -72,7 +73,7 @@ void SplitTextNodeCommand::doApply()
 
 void SplitTextNodeCommand::doUnapply()
 {
-    if (!m_text1)
+    if (!m_text1 || !m_text1->isContentEditable())
         return;
 
     ASSERT(m_text1->document() == document());
diff --git a/WebCore/editing/TextIterator.cpp b/WebCore/editing/TextIterator.cpp
index d36849c..df271b6 100644
--- a/WebCore/editing/TextIterator.cpp
+++ b/WebCore/editing/TextIterator.cpp
@@ -218,7 +218,7 @@ static void pushFullyClippedState(BitStack& stack, Node* node)
 
     // Push true if this node full clips its contents, or if a parent already has fully
     // clipped and this is not a node that ignores its container's clip.
-    stack.push(fullyClipsContents(node) || stack.top() && !ignoresContainerClip(node));
+    stack.push(fullyClipsContents(node) || (stack.top() && !ignoresContainerClip(node)));
 }
 
 static void setUpFullyClippedStack(BitStack& stack, Node* node)
diff --git a/WebCore/editing/TypingCommand.cpp b/WebCore/editing/TypingCommand.cpp
index f5901d7..2b0f61e 100644
--- a/WebCore/editing/TypingCommand.cpp
+++ b/WebCore/editing/TypingCommand.cpp
@@ -90,7 +90,7 @@ void TypingCommand::deleteKeyPressed(Document *document, bool smartDelete, TextG
     ASSERT(frame);
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
-    if (isOpenForMoreTypingCommand(lastEditCommand)) {
+    if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
         static_cast<TypingCommand*>(lastEditCommand)->deleteKeyPressed(granularity, killRing);
         return;
     }
@@ -109,7 +109,7 @@ void TypingCommand::forwardDeleteKeyPressed(Document *document, bool smartDelete
     ASSERT(frame);
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
-    if (isOpenForMoreTypingCommand(lastEditCommand)) {
+    if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
         static_cast<TypingCommand*>(lastEditCommand)->forwardDeleteKeyPressed(granularity, killRing);
         return;
     }
diff --git a/WebCore/editing/VisibleSelection.cpp b/WebCore/editing/VisibleSelection.cpp
index 206de86..68d5a3e 100644
--- a/WebCore/editing/VisibleSelection.cpp
+++ b/WebCore/editing/VisibleSelection.cpp
@@ -237,7 +237,7 @@ void VisibleSelection::appendTrailingWhitespace()
 
     for (; charIt.length(); charIt.advance(1)) {
         UChar c = charIt.characters()[0];
-        if (!isSpaceOrNewline(c) && c != noBreakSpace || c == '\n')
+        if ((!isSpaceOrNewline(c) && c != noBreakSpace) || c == '\n')
             break;
         m_end = charIt.range()->endPosition();
     }
diff --git a/WebCore/editing/WrapContentsInDummySpanCommand.cpp b/WebCore/editing/WrapContentsInDummySpanCommand.cpp
index 7622c1e..5fa0b39 100644
--- a/WebCore/editing/WrapContentsInDummySpanCommand.cpp
+++ b/WebCore/editing/WrapContentsInDummySpanCommand.cpp
@@ -38,35 +38,37 @@ WrapContentsInDummySpanCommand::WrapContentsInDummySpanCommand(PassRefPtr<Elemen
     ASSERT(m_element);
 }
 
-void WrapContentsInDummySpanCommand::doApply()
+void WrapContentsInDummySpanCommand::executeApply()
 {
     Vector<RefPtr<Node> > children;
     for (Node* child = m_element->firstChild(); child; child = child->nextSibling())
         children.append(child);
-
-    RefPtr<HTMLElement> span = createStyleSpanElement(document());
- 
+    
     ExceptionCode ec;
-
+    
     size_t size = children.size();
     for (size_t i = 0; i < size; ++i)
-        span->appendChild(children[i].release(), ec);
-
-    m_element->appendChild(span.get(), ec);
-
-    m_dummySpan = span.release();
+        m_dummySpan->appendChild(children[i].release(), ec);
+    
+    m_element->appendChild(m_dummySpan.get(), ec);
 }
 
+void WrapContentsInDummySpanCommand::doApply()
+{
+    m_dummySpan = createStyleSpanElement(document());
+    
+    executeApply();
+}
+    
 void WrapContentsInDummySpanCommand::doUnapply()
 {
     ASSERT(m_element);
 
-    RefPtr<HTMLElement> span = m_dummySpan.release();
-    if (!span)
+    if (!m_dummySpan || !m_element->isContentEditable())
         return;
 
     Vector<RefPtr<Node> > children;
-    for (Node* child = span->firstChild(); child; child = child->nextSibling())
+    for (Node* child = m_dummySpan->firstChild(); child; child = child->nextSibling())
         children.append(child);
 
     ExceptionCode ec;
@@ -75,7 +77,17 @@ void WrapContentsInDummySpanCommand::doUnapply()
     for (size_t i = 0; i < size; ++i)
         m_element->appendChild(children[i].release(), ec);
 
-    span->remove(ec);
+    m_dummySpan->remove(ec);
 }
 
+void WrapContentsInDummySpanCommand::doReapply()
+{
+    ASSERT(m_element);
+    
+    if (!m_dummySpan || !m_element->isContentEditable())
+        return;
+
+    executeApply();
+}
+    
 } // namespace WebCore
diff --git a/WebCore/editing/WrapContentsInDummySpanCommand.h b/WebCore/editing/WrapContentsInDummySpanCommand.h
index b12131a..be3af66 100644
--- a/WebCore/editing/WrapContentsInDummySpanCommand.h
+++ b/WebCore/editing/WrapContentsInDummySpanCommand.h
@@ -44,6 +44,8 @@ private:
 
     virtual void doApply();
     virtual void doUnapply();
+    virtual void doReapply();
+    void executeApply();
 
     RefPtr<Element> m_element;
     RefPtr<HTMLElement> m_dummySpan;
diff --git a/WebCore/editing/htmlediting.cpp b/WebCore/editing/htmlediting.cpp
index d19ef6b..8b1c98d 100644
--- a/WebCore/editing/htmlediting.cpp
+++ b/WebCore/editing/htmlediting.cpp
@@ -289,7 +289,7 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
     
-    if (p.node() && !p.node()->isDescendantOf(highestRoot))
+    if (p.node() && p.node() != highestRoot && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
     
     return VisiblePosition(p);
@@ -310,7 +310,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
     
-    if (p.node() && !p.node()->isDescendantOf(highestRoot))
+    if (p.node() && p.node() != highestRoot && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
     
     return VisiblePosition(p);
@@ -494,6 +494,7 @@ bool validBlockTag(const AtomicString& blockTag)
 
 static Node* firstInSpecialElement(const Position& pos)
 {
+    // FIXME: This begins at pos.node(), which doesn't necessarily contain pos (suppose pos was [img, 0]).  See <rdar://problem/5027702>.
     Node* rootEditableElement = pos.node()->rootEditableElement();
     for (Node* n = pos.node(); n && n->rootEditableElement() == rootEditableElement; n = n->parentNode())
         if (isSpecialElement(n)) {
@@ -509,6 +510,7 @@ static Node* firstInSpecialElement(const Position& pos)
 
 static Node* lastInSpecialElement(const Position& pos)
 {
+    // FIXME: This begins at pos.node(), which doesn't necessarily contain pos (suppose pos was [img, 0]).  See <rdar://problem/5027702>.
     Node* rootEditableElement = pos.node()->rootEditableElement();
     for (Node* n = pos.node(); n && n->rootEditableElement() == rootEditableElement; n = n->parentNode())
         if (isSpecialElement(n)) {
@@ -1077,6 +1079,14 @@ bool isNodeVisiblyContainedWithin(Node* node, const Range* selectedRange)
         && visiblePositionAfterNode(node) == selectedRange->endPosition();
 }
 
+bool isRenderedAsNonInlineTableImageOrHR(const Node* node)
+{
+    if (!node)
+        return false;
+    RenderObject* renderer = node->renderer();
+    return renderer && ((renderer->isTable() && !renderer->isInline()) || (renderer->isImage() && !renderer->isInline()) || renderer->isHR());
+}
+
 PassRefPtr<Range> avoidIntersectionWithNode(const Range* range, Node* node)
 {
     if (!range)
diff --git a/WebCore/editing/htmlediting.h b/WebCore/editing/htmlediting.h
index f44181c..43048e0 100644
--- a/WebCore/editing/htmlediting.h
+++ b/WebCore/editing/htmlediting.h
@@ -91,6 +91,7 @@ bool isTableStructureNode(const Node*);
 bool isListElement(Node*);
 bool isNodeRendered(const Node*);
 bool isNodeVisiblyContainedWithin(Node*, const Range*);
+bool isRenderedAsNonInlineTableImageOrHR(const Node*);
     
     
 // -------------------------------------------------------------------------
diff --git a/WebCore/editing/visible_units.cpp b/WebCore/editing/visible_units.cpp
index c96fdfd..84ace83 100644
--- a/WebCore/editing/visible_units.cpp
+++ b/WebCore/editing/visible_units.cpp
@@ -776,12 +776,6 @@ VisiblePosition nextSentencePosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrBefore(next);
 }
 
-static bool renderedAsNonInlineTableOrHR(RenderObject* renderer)
-{
-    return renderer && ((renderer->isTable() && !renderer->isInline()) || renderer->isHR());
-}
-
-// FIXME: Broken for positions before/after images that aren't inline (5027702)
 VisiblePosition startOfParagraph(const VisiblePosition& c)
 {
     Position p = c.deepEquivalent();
@@ -790,7 +784,7 @@ VisiblePosition startOfParagraph(const VisiblePosition& c)
     if (!startNode)
         return VisiblePosition();
     
-    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atLastEditingPositionForNode())
+    if (isRenderedAsNonInlineTableImageOrHR(startNode))
         return firstDeepEditingPositionForNode(startNode);
 
     Node* startBlock = enclosingBlock(startNode);
@@ -841,7 +835,6 @@ VisiblePosition startOfParagraph(const VisiblePosition& c)
     return VisiblePosition(node, offset, DOWNSTREAM);
 }
 
-// FIXME: Broken for positions before/after images that aren't inline (5027702)
 VisiblePosition endOfParagraph(const VisiblePosition &c)
 {    
     if (c.isNull())
@@ -850,7 +843,7 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
     Position p = c.deepEquivalent();
     Node* startNode = p.node();
 
-    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atFirstEditingPositionForNode())
+    if (isRenderedAsNonInlineTableImageOrHR(startNode))
         return lastDeepEditingPositionForNode(startNode);
     
     Node* startBlock = enclosingBlock(startNode);
diff --git a/WebCore/history/BackForwardList.cpp b/WebCore/history/BackForwardList.cpp
index 0aad98b..3550e37 100644
--- a/WebCore/history/BackForwardList.cpp
+++ b/WebCore/history/BackForwardList.cpp
@@ -34,6 +34,7 @@
 #include "Logging.h"
 #include "Page.h"
 #include "PageCache.h"
+#include "SerializedScriptValue.h"
 
 using namespace std;
 
@@ -58,12 +59,17 @@ BackForwardList::~BackForwardList()
 
 void BackForwardList::addItem(PassRefPtr<HistoryItem> prpItem)
 {
+    insertItemAfterCurrent(prpItem, true);
+}
+
+void BackForwardList::insertItemAfterCurrent(PassRefPtr<HistoryItem> prpItem, bool removeForwardList)
+{
     ASSERT(prpItem);
     if (m_capacity == 0 || !m_enabled)
         return;
     
     // Toss anything in the forward list    
-    if (m_current != NoCurrentItemIndex) {
+    if (removeForwardList && m_current != NoCurrentItemIndex) {
         unsigned targetSize = m_current + 1;
         while (m_entries.size() > targetSize) {
             RefPtr<HistoryItem> item = m_entries.last();
@@ -84,8 +90,8 @@ void BackForwardList::addItem(PassRefPtr<HistoryItem> prpItem)
         m_page->mainFrame()->loader()->client()->dispatchDidRemoveBackForwardItem(item.get());
     }
     
-    m_entries.append(prpItem);
-    m_entryHash.add(m_entries.last());
+    m_entryHash.add(prpItem.get());
+    m_entries.insert(m_current + 1, prpItem);
     m_current++;
     m_page->mainFrame()->loader()->client()->dispatchDidAddBackForwardItem(currentItem());
 }
@@ -235,6 +241,30 @@ HistoryItemVector& BackForwardList::entries()
     return m_entries;
 }
 
+void BackForwardList::pushStateItem(PassRefPtr<HistoryItem> newItem)
+{
+    ASSERT(newItem);
+    ASSERT(newItem->document());
+    ASSERT(newItem->stateObject());
+    
+    RefPtr<HistoryItem> current = currentItem();
+    ASSERT(current);
+
+    Document* newItemDocument = newItem->document();
+    while (HistoryItem* item = forwardItem()) {
+        if (item->document() != newItemDocument)
+            break;
+        removeItem(item);
+    }
+
+    insertItemAfterCurrent(newItem, false);
+    
+    if (!current->document()) {
+        current->setDocument(newItemDocument);
+        current->setStateObject(SerializedScriptValue::create());
+    }
+}
+
 void BackForwardList::close()
 {
     int size = m_entries.size();
@@ -267,7 +297,7 @@ void BackForwardList::removeItem(HistoryItem* item)
             else {
                 size_t count = m_entries.size();
                 if (m_current >= count)
-                    m_current = count ? count-1 : NoCurrentItemIndex;
+                    m_current = count ? count - 1 : NoCurrentItemIndex;
             }
             break;
         }
diff --git a/WebCore/history/BackForwardList.h b/WebCore/history/BackForwardList.h
index fdc3360..88398a5 100644
--- a/WebCore/history/BackForwardList.h
+++ b/WebCore/history/BackForwardList.h
@@ -35,8 +35,11 @@
 
 namespace WebCore {
 
+class Document;
 class HistoryItem;
 class Page;
+class SerializedScriptValue;
+class String;
 
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 typedef HashSet<RefPtr<HistoryItem> > HistoryItemHashSet;
@@ -96,12 +99,16 @@ public:
     void removeItem(HistoryItem*);
     HistoryItemVector& entries();
     
+    void pushStateItem(PassRefPtr<HistoryItem>);
+
 #if ENABLE(WML)
     void clearWMLPageHistory();
 #endif
 
 private:
     BackForwardList(Page*);
+    
+    void insertItemAfterCurrent(PassRefPtr<HistoryItem>, bool removeForwardList);
 
     Page* m_page;
 #if PLATFORM(CHROMIUM) 
diff --git a/WebCore/history/BackForwardListChromium.cpp b/WebCore/history/BackForwardListChromium.cpp
index 34f294c..f539e80 100644
--- a/WebCore/history/BackForwardListChromium.cpp
+++ b/WebCore/history/BackForwardListChromium.cpp
@@ -121,6 +121,11 @@ HistoryItem* BackForwardList::itemAtIndex(int index)
     return m_client->itemAtIndex(index);
 }
 
+void BackForwardList::pushStateItem(PassRefPtr<HistoryItem> newItem)
+{
+  // FIXME: Need to implement state support for chromium.
+}
+
 HistoryItemVector& BackForwardList::entries()
 {
     static HistoryItemVector noEntries;
diff --git a/WebCore/history/CachedFrame.cpp b/WebCore/history/CachedFrame.cpp
index a868134..227c437 100644
--- a/WebCore/history/CachedFrame.cpp
+++ b/WebCore/history/CachedFrame.cpp
@@ -99,10 +99,13 @@ void CachedFrameBase::restore()
     for (unsigned i = 0; i < m_childFrames.size(); ++i)
         m_childFrames[i]->open();
 
+<<<<<<< HEAD:WebCore/history/CachedFrame.cpp
 #ifdef ANDROID_PAGE_CACHE_UNLOAD
     // matches pageshowEvent as in Document::implicitClose()
     m_document->dispatchWindowLoadEvent();
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/history/CachedFrame.cpp
     m_document->dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, true), m_document);
 }
 
diff --git a/WebCore/history/HistoryItem.cpp b/WebCore/history/HistoryItem.cpp
index ba0764c..f6fbd59 100644
--- a/WebCore/history/HistoryItem.cpp
+++ b/WebCore/history/HistoryItem.cpp
@@ -48,6 +48,7 @@ HistoryItem::HistoryItem()
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_document(0)
 {
 }
 
@@ -60,6 +61,7 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, double ti
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_document(0)
 {    
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
@@ -74,6 +76,7 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, const Str
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_document(0)
 {
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
@@ -89,6 +92,7 @@ HistoryItem::HistoryItem(const KURL& url, const String& target, const String& pa
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_document(0)
 {    
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
@@ -96,6 +100,7 @@ HistoryItem::HistoryItem(const KURL& url, const String& target, const String& pa
 HistoryItem::~HistoryItem()
 {
     ASSERT(!m_cachedPage);
+    ASSERT(!m_document);
     iconDatabase()->releaseIconForPageURL(m_urlString);
 #if PLATFORM(ANDROID)
     if (m_bridge)
@@ -120,10 +125,9 @@ inline HistoryItem::HistoryItem(const HistoryItem& item)
     , m_visitCount(item.m_visitCount)
     , m_dailyVisitCounts(item.m_dailyVisitCounts)
     , m_weeklyVisitCounts(item.m_weeklyVisitCounts)
+    , m_document(0)
     , m_formContentType(item.m_formContentType)
 {
-    ASSERT(!item.m_cachedPage);
-
     if (item.m_formData)
         m_formData = item.m_formData->copy();
         
@@ -389,6 +393,35 @@ void HistoryItem::setIsTargetItem(bool flag)
 #if PLATFORM(ANDROID)
     notifyHistoryItemChanged(this);
 #endif
+<<<<<<< HEAD:WebCore/history/HistoryItem.cpp
+=======
+}
+
+void HistoryItem::setStateObject(PassRefPtr<SerializedScriptValue> object)
+{
+    ASSERT(m_document);
+    m_stateObject = object;
+}
+
+void HistoryItem::setDocument(Document* document)
+{
+    if (m_document == document)
+        return;
+    
+    if (m_document)
+        m_document->unregisterHistoryItem(this);
+    if (document)
+        document->registerHistoryItem(this);
+        
+    m_document = document;
+}
+
+void HistoryItem::documentDetached(Document* document)
+{
+    ASSERT_UNUSED(document, m_document == document);
+    m_document = 0;
+    m_stateObject = 0;
+>>>>>>> webkit.org at r51976:WebCore/history/HistoryItem.cpp
 }
 
 void HistoryItem::addChildItem(PassRefPtr<HistoryItem> child)
diff --git a/WebCore/history/HistoryItem.h b/WebCore/history/HistoryItem.h
index e0cade0..4c91e76 100644
--- a/WebCore/history/HistoryItem.h
+++ b/WebCore/history/HistoryItem.h
@@ -28,6 +28,7 @@
 
 #include "IntPoint.h"
 #include "PlatformString.h"
+#include "SerializedScriptValue.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
@@ -54,7 +55,7 @@ class FormData;
 class HistoryItem;
 class Image;
 class KURL;
-struct ResourceRequest;
+class ResourceRequest;
 
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 
@@ -132,6 +133,12 @@ public:
     void setTitle(const String&);
     void setIsTargetItem(bool);
     
+    void setStateObject(PassRefPtr<SerializedScriptValue> object);
+    SerializedScriptValue* stateObject() const { return m_stateObject.get(); }
+    void setDocument(Document* document);
+    Document* document() const { return m_document; }
+    void documentDetached(Document*);
+    
     void setFormInfoFromRequest(const ResourceRequest&);
     void setFormData(PassRefPtr<FormData>);
     void setFormContentType(const String&);
@@ -235,6 +242,10 @@ private:
 
     OwnPtr<Vector<String> > m_redirectURLs;
 
+    // Support for HTML5 History
+    RefPtr<SerializedScriptValue> m_stateObject;
+    Document* m_document;
+    
     // info used to repost form data
     RefPtr<FormData> m_formData;
     String m_formContentType;
diff --git a/WebCore/history/android/AndroidWebHistoryBridge.h b/WebCore/history/android/AndroidWebHistoryBridge.h
index b401933..c6d5147 100644
--- a/WebCore/history/android/AndroidWebHistoryBridge.h
+++ b/WebCore/history/android/AndroidWebHistoryBridge.h
@@ -34,11 +34,19 @@ class HistoryItem;
 
 class AndroidWebHistoryBridge : public RefCounted<AndroidWebHistoryBridge> {
 public:
+<<<<<<< HEAD:WebCore/history/android/AndroidWebHistoryBridge.h
     AndroidWebHistoryBridge(HistoryItem* item)
+=======
+    AndroidWebHistoryBridge()
+>>>>>>> webkit.org at r51976:WebCore/history/android/AndroidWebHistoryBridge.h
         : m_scale(100)
         , m_screenWidthScale(100)
         , m_active(false)
+<<<<<<< HEAD:WebCore/history/android/AndroidWebHistoryBridge.h
         , m_historyItem(item) { }
+=======
+        , m_historyItem(0) { }
+>>>>>>> webkit.org at r51976:WebCore/history/android/AndroidWebHistoryBridge.h
     virtual ~AndroidWebHistoryBridge() { }
     virtual void updateHistoryItem(HistoryItem* item) = 0;
 
@@ -46,7 +54,10 @@ public:
     void setScreenWidthScale(int s) { m_screenWidthScale = s; }
     int scale() const { return m_scale; }
     int screenWidthScale() const { return m_screenWidthScale; }
+<<<<<<< HEAD:WebCore/history/android/AndroidWebHistoryBridge.h
     void detachHistoryItem() { m_historyItem = 0; }
+=======
+>>>>>>> webkit.org at r51976:WebCore/history/android/AndroidWebHistoryBridge.h
     HistoryItem* historyItem() const { return m_historyItem; }
     void setActive() { m_active = true; }
 
diff --git a/WebCore/html/CollectionCache.h b/WebCore/html/CollectionCache.h
index 7cdcdd5..0a49fb8 100644
--- a/WebCore/html/CollectionCache.h
+++ b/WebCore/html/CollectionCache.h
@@ -29,7 +29,7 @@ namespace WebCore {
 class AtomicStringImpl;
 class Element;
 
-struct CollectionCache {
+struct CollectionCache : FastAllocBase {
     CollectionCache();
     CollectionCache(const CollectionCache&);
     CollectionCache& operator=(const CollectionCache& other)
diff --git a/WebCore/html/HTMLAnchorElement.cpp b/WebCore/html/HTMLAnchorElement.cpp
index f735104..1d5d569 100644
--- a/WebCore/html/HTMLAnchorElement.cpp
+++ b/WebCore/html/HTMLAnchorElement.cpp
@@ -58,6 +58,15 @@ PassRefPtr<HTMLAnchorElement> HTMLAnchorElement::create(const QualifiedName& tag
     return adoptRef(new HTMLAnchorElement(tagName, document));
 }
 
+// This function does not allow leading spaces before the port number.
+static unsigned parsePortFromStringPosition(const String& value, unsigned portStart, unsigned& portEnd)
+{
+    portEnd = portStart;
+    while (isASCIIDigit(value[portEnd]))
+        ++portEnd;
+    return value.substring(portStart, portEnd - portStart).toUInt();
+}
+
 bool HTMLAnchorElement::supportsFocus() const
 {
     if (isContentEditable())
@@ -69,10 +78,12 @@ bool HTMLAnchorElement::supportsFocus() const
 bool HTMLAnchorElement::isMouseFocusable() const
 {
     // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
-#if PLATFORM(MAC)
+#if !PLATFORM(GTK) && !PLATFORM(QT)
     if (isLink())
-        return false;
+        // Only allow links with tabIndex or contentEditable to be mouse focusable.
+        return HTMLElement::supportsFocus();
 #endif
+
     // Allow tab index etc to control focus.
     return HTMLElement::isMouseFocusable();
 }
@@ -332,7 +343,7 @@ bool HTMLAnchorElement::hasRel(uint32_t relation) const
 void HTMLAnchorElement::setRel(const String& value)
 {
     m_linkRelations = 0;
-    ClassNames newLinkRelations(value, true);
+    SpaceSplitString newLinkRelations(value, true);
     // FIXME: Add link relations as they are implemented
     if (newLinkRelations.contains("noreferrer"))
         m_linkRelations |= RelationNoReferrer;
@@ -360,42 +371,165 @@ String HTMLAnchorElement::hash() const
     return fragmentIdentifier.isEmpty() ? "" : "#" + fragmentIdentifier;
 }
 
+void HTMLAnchorElement::setHash(const String& value)
+{
+    KURL url = href();
+    if (value[0] == '#')
+        url.setFragmentIdentifier(value.substring(1));
+    else
+        url.setFragmentIdentifier(value);
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::host() const
 {
     const KURL& url = href();
     if (url.hostEnd() == url.pathStart())
         return url.host();
-    if (SecurityOrigin::isDefaultPortForProtocol(url.port(), url.protocol()))
+    if (isDefaultPortForProtocol(url.port(), url.protocol()))
         return url.host();
     return url.host() + ":" + String::number(url.port());
 }
 
+void HTMLAnchorElement::setHost(const String& value)
+{
+    if (value.isEmpty())
+        return;
+    KURL url = href();
+    if (!url.canSetHostOrPort())
+        return;
+
+    int separator = value.find(':');
+    if (!separator)
+        return;
+
+    if (separator == -1)
+        url.setHostAndPort(value);
+    else {
+        unsigned portEnd;
+        unsigned port = parsePortFromStringPosition(value, separator + 1, portEnd);
+        if (!port) {
+            // http://dev.w3.org/html5/spec/infrastructure.html#url-decomposition-idl-attributes
+            // specifically goes against RFC 3986 (p3.2) and
+            // requires setting the port to "0" if it is set to empty string.
+            url.setHostAndPort(value.substring(0, separator + 1) + "0");
+        } else {
+            if (isDefaultPortForProtocol(port, url.protocol()))
+                url.setHostAndPort(value.substring(0, separator));
+            else
+                url.setHostAndPort(value.substring(0, portEnd));
+        }
+    }
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::hostname() const
 {
     return href().host();
 }
 
+void HTMLAnchorElement::setHostname(const String& value)
+{
+    // Before setting new value:
+    // Remove all leading U+002F SOLIDUS ("/") characters.
+    unsigned i = 0;
+    unsigned hostLength = value.length();
+    while (value[i] == '/')
+        i++;
+
+    if (i == hostLength)
+        return;
+
+    KURL url = href();
+    if (!url.canSetHostOrPort())
+        return;
+
+    url.setHost(value.substring(i));
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::pathname() const
 {
     return href().path();
 }
 
+void HTMLAnchorElement::setPathname(const String& value)
+{
+    KURL url = href();
+    if (!url.canSetPathname())
+        return;
+
+    if (value[0] == '/')
+        url.setPath(value);
+    else
+        url.setPath("/" + value);
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::port() const
 {
     return String::number(href().port());
 }
 
+void HTMLAnchorElement::setPort(const String& value)
+{
+    KURL url = href();
+    if (!url.canSetHostOrPort())
+        return;
+
+    // http://dev.w3.org/html5/spec/infrastructure.html#url-decomposition-idl-attributes
+    // specifically goes against RFC 3986 (p3.2) and
+    // requires setting the port to "0" if it is set to empty string.
+    unsigned port = value.toUInt();
+    if (isDefaultPortForProtocol(port, url.protocol()))
+        url.removePort();
+    else
+        url.setPort(port);
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::protocol() const
 {
     return href().protocol() + ":";
 }
 
+void HTMLAnchorElement::setProtocol(const String& value)
+{
+    int separator = value.find(':');
+
+    if (!separator)
+        return;
+    if (value.isEmpty())
+        return;
+
+    KURL url = href();
+    // Following Firefox 3.5.2 which removes anything after the first ":"
+    String newProtocol = value.substring(0, separator);
+    if (!isValidProtocol(newProtocol))
+        return;
+    url.setProtocol(newProtocol);
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::search() const
 {
     String query = href().query();
     return query.isEmpty() ? "" : "?" + query;
 }
 
+void HTMLAnchorElement::setSearch(const String& value)
+{
+    KURL url = href();
+    String newSearch = (value[0] == '?') ? value.substring(1) : value;
+    // Make sure that '#' in the query does not leak to the hash.
+    url.setQuery(newSearch.replace('#', "%23"));
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::text() const
 {
     return innerText();
diff --git a/WebCore/html/HTMLAnchorElement.h b/WebCore/html/HTMLAnchorElement.h
index e47ea99..03d3529 100644
--- a/WebCore/html/HTMLAnchorElement.h
+++ b/WebCore/html/HTMLAnchorElement.h
@@ -62,12 +62,26 @@ public:
     const AtomicString& name() const;
 
     String hash() const;
+    void setHash(const String&);
+
     String host() const;
+    void setHost(const String&);
+
     String hostname() const;
+    void setHostname(const String&);
+
     String pathname() const;
+    void setPathname(const String&);
+
     String port() const;
+    void setPort(const String&);
+
     String protocol() const;
+    void setProtocol(const String&);
+
     String search() const;
+    void setSearch(const String&);
+
     String text() const;
 
     String toString() const;
diff --git a/WebCore/html/HTMLAnchorElement.idl b/WebCore/html/HTMLAnchorElement.idl
index 057358e..e55bd86 100644
--- a/WebCore/html/HTMLAnchorElement.idl
+++ b/WebCore/html/HTMLAnchorElement.idl
@@ -37,7 +37,7 @@ module html {
         attribute [ConvertNullToNullString, Reflect] DOMString target;
         attribute [ConvertNullToNullString, Reflect] DOMString type;
 
-        // IE Extensions
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString hash;
         readonly attribute DOMString host;
         readonly attribute DOMString hostname;
@@ -45,6 +45,16 @@ module html {
         readonly attribute DOMString port;
         readonly attribute DOMString protocol;
         readonly attribute DOMString search;
+#else
+        attribute [ConvertNullToNullString] DOMString hash;
+        attribute [ConvertNullToNullString] DOMString host;
+        attribute [ConvertNullToNullString] DOMString hostname;
+        attribute [ConvertNullToNullString] DOMString pathname;
+        attribute [ConvertNullToNullString] DOMString port;
+        attribute [ConvertNullToNullString] DOMString protocol;
+        attribute [ConvertNullToNullString] DOMString search;
+#endif
+
         readonly attribute DOMString text;
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
diff --git a/WebCore/html/HTMLAppletElement.cpp b/WebCore/html/HTMLAppletElement.cpp
index 46045d6..f67e9dc 100644
--- a/WebCore/html/HTMLAppletElement.cpp
+++ b/WebCore/html/HTMLAppletElement.cpp
@@ -28,6 +28,7 @@
 #include "HTMLNames.h"
 #include "MappedAttribute.h"
 #include "RenderApplet.h"
+#include "SecurityOrigin.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -108,9 +109,7 @@ bool HTMLAppletElement::rendererIsNeeded(RenderStyle* style)
 
 RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style)
 {
-    Settings* settings = document()->settings();
-
-    if (settings && settings->isJavaEnabled()) {
+    if (canEmbedJava()) {
         HashMap<String, String> args;
 
         args.set("code", getAttribute(codeAttr));
@@ -142,8 +141,7 @@ RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style
 
 RenderWidget* HTMLAppletElement::renderWidgetForJSBindings() const
 {
-    Settings* settings = document()->settings();
-    if (!settings || !settings->isJavaEnabled())
+    if (!canEmbedJava())
         return 0;
 
     RenderApplet* applet = toRenderApplet(renderer());
@@ -153,6 +151,15 @@ RenderWidget* HTMLAppletElement::renderWidgetForJSBindings() const
     return applet;
 }
 
+bool HTMLAppletElement::canEmbedJava() const
+{
+    if (document()->securityOrigin()->isSandboxed(SandboxPlugins))
+        return false;
+
+    Settings* settings = document()->settings();
+    return settings && settings->isJavaEnabled();
+}
+
 void HTMLAppletElement::finishParsingChildren()
 {
     // The parser just reached </applet>, so all the params are available now.
diff --git a/WebCore/html/HTMLAppletElement.h b/WebCore/html/HTMLAppletElement.h
index baaab38..a53bd5c 100644
--- a/WebCore/html/HTMLAppletElement.h
+++ b/WebCore/html/HTMLAppletElement.h
@@ -51,6 +51,7 @@ private:
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
     void setupApplet() const;
+    bool canEmbedJava() const;
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
diff --git a/WebCore/html/HTMLAttributeNames.in b/WebCore/html/HTMLAttributeNames.in
index ac8ce11..c989dbd 100644
--- a/WebCore/html/HTMLAttributeNames.in
+++ b/WebCore/html/HTMLAttributeNames.in
@@ -14,16 +14,25 @@ alt
 archive
 aria-activedescendant
 aria-checked
+aria-controls
 aria-describedby
 aria-disabled
+aria-dropeffect
+aria-expanded
+aria-flowto
+aria-grabbed
 aria-hidden
 aria-label
 aria-labeledby
 aria-labelledby
 aria-level
+aria-multiselectable
+aria-orientation
+aria-owns
 aria-pressed
 aria-readonly
 aria-required
+aria-selected
 aria-valuemax
 aria-valuemin
 aria-valuenow
@@ -174,6 +183,7 @@ onpaste
 onpause
 onplay
 onplaying
+onpopstate
 onprogress
 onratechange
 onreset
@@ -201,6 +211,8 @@ onwaiting
 onwebkitanimationstart
 onwebkitanimationiteration
 onwebkitanimationend
+onwebkitbeginfullscreen
+onwebkitendfullscreen
 onwebkittransitionend
 pattern
 placeholder
@@ -220,6 +232,7 @@ role
 rows
 rowspan
 rules
+sandbox
 scheme
 scope
 scrollamount
@@ -235,6 +248,7 @@ spellcheck
 src
 standby
 start
+step
 style
 summary
 tabindex
diff --git a/WebCore/html/HTMLBodyElement.cpp b/WebCore/html/HTMLBodyElement.cpp
index b203cc0..b9e2c75 100644
--- a/WebCore/html/HTMLBodyElement.cpp
+++ b/WebCore/html/HTMLBodyElement.cpp
@@ -144,6 +144,8 @@ void HTMLBodyElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().pagehideEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onpageshowAttr)
         document()->setWindowAttributeEventListener(eventNames().pageshowEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpopstateAttr)
+        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onblurAttr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
diff --git a/WebCore/html/HTMLBodyElement.h b/WebCore/html/HTMLBodyElement.h
index e898c88..76b49a1 100644
--- a/WebCore/html/HTMLBodyElement.h
+++ b/WebCore/html/HTMLBodyElement.h
@@ -52,13 +52,15 @@ public:
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(load);
 
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(beforeunload);
-    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(hashchange);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(popstate);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
+
 #if ENABLE(ORIENTATION_EVENTS)
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(orientationchange);
 #endif
diff --git a/WebCore/html/HTMLBodyElement.idl b/WebCore/html/HTMLBodyElement.idl
index 2e93e2e..b2f0c65 100644
--- a/WebCore/html/HTMLBodyElement.idl
+++ b/WebCore/html/HTMLBodyElement.idl
@@ -40,6 +40,7 @@ module html {
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
+        attribute [DontEnum] EventListener onpopstate;
         attribute [DontEnum] EventListener onresize;
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
diff --git a/WebCore/html/HTMLButtonElement.idl b/WebCore/html/HTMLButtonElement.idl
index 55803df..cb9383d 100644
--- a/WebCore/html/HTMLButtonElement.idl
+++ b/WebCore/html/HTMLButtonElement.idl
@@ -37,6 +37,7 @@ module html {
         readonly attribute  DOMString            type;
                  attribute  [ConvertNullToNullString] DOMString            value;
         readonly attribute boolean               willValidate;
+        readonly attribute DOMString             validationMessage;
         boolean  checkValidity();
         void setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void click();
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index 0405669..be0fa36 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -31,7 +31,7 @@
 #include "CanvasPattern.h"
 #include "CanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)    
-#include "CanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
 #endif
 #include "CanvasStyle.h"
 #include "Chrome.h"
@@ -149,9 +149,9 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, ExceptionCode& ec)
 
 CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
 {
-    // A Canvas can either be "2D" or "3D" never both. If you request a 2D canvas and the existing
-    // context is already 2D, just return that. If the existing context is 3D, then destroy it
-    // before creating a new 2D context. Vice versa when requesting a 3D canvas. Requesting a
+    // A Canvas can either be "2D" or "webgl" but never both. If you request a 2D canvas and the existing
+    // context is already 2D, just return that. If the existing context is WebGL, then destroy it
+    // before creating a new 2D context. Vice versa when requesting a WebGL canvas. Requesting a
     // context with any other type string will destroy any existing context.
     
     // FIXME - The code depends on the context not going away once created, to prevent JS from
@@ -167,12 +167,14 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
 #if ENABLE(3D_CANVAS)    
     Settings* settings = document()->settings();
     if (settings && settings->webGLEnabled()) {
+        // Accept the legacy "webkit-3d" name as well as the provisional "experimental-webgl" name.
+        // Once ratified, we will also accept "webgl" as the context name.
         if ((type == "webkit-3d") ||
-            (type == "GL")) {
+            (type == "experimental-webgl")) {
             if (m_context && !m_context->is3d())
                 return 0;
             if (!m_context) {
-                m_context = CanvasRenderingContext3D::create(this);
+                m_context = WebGLRenderingContext::create(this);
                 if (m_context) {
                     // Need to make sure a RenderLayer and compositing layer get created for the Canvas
                     setNeedsStyleRecalc(SyntheticStyleChange);
@@ -249,9 +251,9 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
         return;
     
 #if ENABLE(3D_CANVAS)
-    CanvasRenderingContext3D* context3D = NULL;
+    WebGLRenderingContext* context3D = NULL;
     if (m_context && m_context->is3d()) {
-        context3D = static_cast<CanvasRenderingContext3D*>(m_context.get());
+        context3D = static_cast<WebGLRenderingContext*>(m_context.get());
         context3D->beginPaint();
     }
 #endif
@@ -259,7 +261,7 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     if (m_imageBuffer) {
         Image* image = m_imageBuffer->image();
         if (image)
-            context->drawImage(image, r);
+            context->drawImage(image, DeviceColorSpace, r);
     }
 
 #if ENABLE(3D_CANVAS)
diff --git a/WebCore/html/HTMLFieldSetElement.idl b/WebCore/html/HTMLFieldSetElement.idl
index ca8563b..c55e604 100644
--- a/WebCore/html/HTMLFieldSetElement.idl
+++ b/WebCore/html/HTMLFieldSetElement.idl
@@ -29,6 +29,7 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
     };
diff --git a/WebCore/html/HTMLFormControlElement.cpp b/WebCore/html/HTMLFormControlElement.cpp
index 96ecc7d..2531c48 100644
--- a/WebCore/html/HTMLFormControlElement.cpp
+++ b/WebCore/html/HTMLFormControlElement.cpp
@@ -288,6 +288,11 @@ bool HTMLFormControlElement::willValidate() const
     return form() && !name().isEmpty() && !disabled() && !isReadOnlyFormControl();
 }
 
+String HTMLFormControlElement::validationMessage()
+{
+    return validity()->validationMessage();
+}
+
 bool HTMLFormControlElement::checkValidity()
 {
     if (willValidate() && !isValidFormControlElement()) {
diff --git a/WebCore/html/HTMLFormControlElement.h b/WebCore/html/HTMLFormControlElement.h
index b5dc7ce..7105112 100644
--- a/WebCore/html/HTMLFormControlElement.h
+++ b/WebCore/html/HTMLFormControlElement.h
@@ -107,6 +107,7 @@ public:
     virtual short tabIndex() const;
 
     virtual bool willValidate() const;
+    String validationMessage();
     bool checkValidity();
     void updateValidity();
     void setCustomValidity(const String&);
diff --git a/WebCore/html/HTMLFrameOwnerElement.cpp b/WebCore/html/HTMLFrameOwnerElement.cpp
index 84958c2..7598da2 100644
--- a/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document, CreateElement)
     , m_contentFrame(0)
+    , m_sandboxFlags(SandboxNone)
 {
 }
 
@@ -64,6 +65,17 @@ DOMWindow* HTMLFrameOwnerElement::contentWindow() const
     return m_contentFrame ? m_contentFrame->domWindow() : 0;
 }
 
+void HTMLFrameOwnerElement::setSandboxFlags(SandboxFlags flags)
+{
+    if (m_sandboxFlags == flags)
+        return;
+
+    m_sandboxFlags = flags;
+    
+    if (Frame* frame = contentFrame())
+        frame->loader()->ownerElementSandboxFlagsChanged();
+}
+
 #if ENABLE(SVG)
 SVGDocument* HTMLFrameOwnerElement::getSVGDocument(ExceptionCode& ec) const
 {
diff --git a/WebCore/html/HTMLFrameOwnerElement.h b/WebCore/html/HTMLFrameOwnerElement.h
index 1437e2c..308a100 100644
--- a/WebCore/html/HTMLFrameOwnerElement.h
+++ b/WebCore/html/HTMLFrameOwnerElement.h
@@ -21,6 +21,7 @@
 #ifndef HTMLFrameOwnerElement_h
 #define HTMLFrameOwnerElement_h
 
+#include "FrameLoaderTypes.h"
 #include "HTMLElement.h"
 
 namespace WebCore {
@@ -46,9 +47,13 @@ public:
 
     virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
 
+    SandboxFlags sandboxFlags() const { return m_sandboxFlags; }
+    
 protected:
     HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
 
+    void setSandboxFlags(SandboxFlags);
+    
 private:
     friend class Frame;
 
@@ -58,6 +63,7 @@ private:
     virtual void willRemove();
 
     Frame* m_contentFrame;
+    SandboxFlags m_sandboxFlags;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameSetElement.cpp b/WebCore/html/HTMLFrameSetElement.cpp
index 5874b84..f4d1558 100644
--- a/WebCore/html/HTMLFrameSetElement.cpp
+++ b/WebCore/html/HTMLFrameSetElement.cpp
@@ -151,6 +151,8 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onofflineAttr)
         document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpopstateAttr)
+        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
diff --git a/WebCore/html/HTMLFrameSetElement.h b/WebCore/html/HTMLFrameSetElement.h
index 2b2d7ea..0c75efe 100644
--- a/WebCore/html/HTMLFrameSetElement.h
+++ b/WebCore/html/HTMLFrameSetElement.h
@@ -79,6 +79,7 @@ public:
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(popstate);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
diff --git a/WebCore/html/HTMLFrameSetElement.idl b/WebCore/html/HTMLFrameSetElement.idl
index b44a071..6ab1a8b 100644
--- a/WebCore/html/HTMLFrameSetElement.idl
+++ b/WebCore/html/HTMLFrameSetElement.idl
@@ -37,6 +37,7 @@ module html {
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
+        attribute [DontEnum] EventListener onpopstate;
         attribute [DontEnum] EventListener onresize;
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
diff --git a/WebCore/html/HTMLHeadElement.h b/WebCore/html/HTMLHeadElement.h
index 21d8a2f..14a4409 100644
--- a/WebCore/html/HTMLHeadElement.h
+++ b/WebCore/html/HTMLHeadElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/WebCore/html/HTMLHeadingElement.cpp b/WebCore/html/HTMLHeadingElement.cpp
index 452f7c3..95c82d1 100644
--- a/WebCore/html/HTMLHeadingElement.cpp
+++ b/WebCore/html/HTMLHeadingElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLHeadingElement.h b/WebCore/html/HTMLHeadingElement.h
index dac1107..765bede 100644
--- a/WebCore/html/HTMLHeadingElement.h
+++ b/WebCore/html/HTMLHeadingElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *
diff --git a/WebCore/html/HTMLHtmlElement.h b/WebCore/html/HTMLHtmlElement.h
index 86603b5..de80ba8 100644
--- a/WebCore/html/HTMLHtmlElement.h
+++ b/WebCore/html/HTMLHtmlElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/WebCore/html/HTMLIFrameElement.cpp b/WebCore/html/HTMLIFrameElement.cpp
index cae9b8d..a2f287e 100644
--- a/WebCore/html/HTMLIFrameElement.cpp
+++ b/WebCore/html/HTMLIFrameElement.cpp
@@ -4,6 +4,7 @@
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Ericsson AB. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -66,6 +67,40 @@ bool HTMLIFrameElement::mapToEntry(const QualifiedName& attrName, MappedAttribut
     return HTMLFrameElementBase::mapToEntry(attrName, result);
 }
 
+static SandboxFlags parseSandboxAttribute(MappedAttribute* attribute)
+{
+    if (attribute->isNull())
+        return SandboxNone;
+
+    // Parse the unordered set of unique space-separated tokens.
+    SandboxFlags flags = SandboxAll;
+    const UChar* characters = attribute->value().characters();
+    unsigned length = attribute->value().length();
+    unsigned start = 0;
+    while (true) {
+        while (start < length && isASCIISpace(characters[start]))
+            ++start;
+        if (start >= length)
+            break;
+        unsigned end = start + 1;
+        while (end < length && !isASCIISpace(characters[end]))
+            ++end;
+
+        // Turn off the corresponding sandbox flag if it's set as "allowed".
+        String sandboxToken = String(characters + start, end - start);
+        if (equalIgnoringCase(sandboxToken, "allow-same-origin"))
+            flags &= ~SandboxOrigin;
+        else if (equalIgnoringCase(sandboxToken, "allow-forms"))
+            flags &= ~SandboxForms;
+        else if (equalIgnoringCase(sandboxToken, "allow-scripts"))
+            flags &= ~SandboxScripts;
+
+        start = end + 1;
+    }
+    
+    return flags;
+}
+
 void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == widthAttr)
@@ -88,7 +123,9 @@ void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
         if (!attr->isNull() && !attr->value().toInt())
             // Add a rule that nulls out our border width.
             addCSSLength(attr, CSSPropertyBorderWidth, "0");
-    } else
+    } else if (attr->name() == sandboxAttr)
+        setSandboxFlags(parseSandboxAttribute(attr));
+    else
         HTMLFrameElementBase::parseMappedAttribute(attr);
 }
 
diff --git a/WebCore/html/HTMLIFrameElement.idl b/WebCore/html/HTMLIFrameElement.idl
index e288b54..dad8416 100644
--- a/WebCore/html/HTMLIFrameElement.idl
+++ b/WebCore/html/HTMLIFrameElement.idl
@@ -33,6 +33,7 @@ module html {
                  attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
                  attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
                  attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       sandbox;
                  attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
                  attribute [ConvertNullToNullString, CustomSetter, Reflect] DOMString       src;
                  attribute [ConvertNullToNullString, Reflect] DOMString       width;
diff --git a/WebCore/html/HTMLImageLoader.h b/WebCore/html/HTMLImageLoader.h
index 9e9564b..d3b6068 100644
--- a/WebCore/html/HTMLImageLoader.h
+++ b/WebCore/html/HTMLImageLoader.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index f63ccc8..85fa64d 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -45,6 +45,7 @@
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "HTMLOptionElement.h"
+#include "ISODateTime.h"
 #include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
@@ -59,12 +60,18 @@
 #include "RenderText.h"
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
+#include "StringHash.h"
 #include "TextEvent.h"
+<<<<<<< HEAD:WebCore/html/HTMLInputElement.cpp
 #ifdef ANDROID_ACCEPT_CHANGES_TO_FOCUSED_TEXTFIELDS
 #include "WebViewCore.h"
 #endif
+=======
+#include <wtf/HashMap.h>
+>>>>>>> webkit.org at r51976:WebCore/html/HTMLInputElement.cpp
 #include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/dtoa.h>
 
 using namespace std;
 
@@ -74,6 +81,16 @@ using namespace HTMLNames;
 
 const int maxSavedResults = 256;
 
+// Constant values for getAllowedValueStep().
+static const double numberDefaultStep = 1.0;
+static const double numberStepScaleFactor = 1.0;
+// Constant values for minimum().
+static const double numberDefaultMinimum = -DBL_MAX;
+static const double rangeDefaultMinimum = 0.0;
+// Constant values for maximum().
+static const double numberDefaultMaximum = DBL_MAX;
+static const double rangeDefaultMaximum = 100.0;
+
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLTextFormControlElement(tagName, doc, f)
     , m_xPos(0)
@@ -129,14 +146,20 @@ bool HTMLInputElement::valueMissing() const
         return false;
 
     switch (inputType()) {
-        case TEXT:
-        case SEARCH:
-        case URL:
-        case TELEPHONE:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
-        case PASSWORD:
-        case NUMBER:
         case FILE:
+        case MONTH:
+        case NUMBER:
+        case PASSWORD:
+        case SEARCH:
+        case TELEPHONE:
+        case TEXT:
+        case TIME:
+        case URL:
+        case WEEK:
             return value().isEmpty();
         case CHECKBOX:
             return !checked();
@@ -144,13 +167,13 @@ bool HTMLInputElement::valueMissing() const
             return !document()->checkedRadioButtons().checkedButtonForGroup(name());
         case COLOR:
             return false;
+        case BUTTON:
         case HIDDEN:
-        case RANGE:
-        case SUBMIT:
         case IMAGE:
-        case RESET:
-        case BUTTON:
         case ISINDEX:
+        case RANGE:
+        case RESET:
+        case SUBMIT:
             break;
     }
 
@@ -161,25 +184,31 @@ bool HTMLInputElement::valueMissing() const
 bool HTMLInputElement::patternMismatch() const
 {
     switch (inputType()) {
-        case ISINDEX:
+        case BUTTON:
         case CHECKBOX:
-        case RADIO:
-        case SUBMIT:
-        case RESET:
+        case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case FILE:
         case HIDDEN:
         case IMAGE:
-        case BUTTON:
-        case RANGE:
+        case ISINDEX:
+        case MONTH:
         case NUMBER:
-        case COLOR:
+        case RADIO:
+        case RANGE:
+        case RESET:
+        case SUBMIT:
+        case TIME:
+        case WEEK:
             return false;
-        case TEXT:
-        case SEARCH:
-        case URL:
-        case TELEPHONE:
         case EMAIL:
         case PASSWORD:
+        case SEARCH:
+        case TELEPHONE:
+        case TEXT:
+        case URL:
             const AtomicString& pattern = getAttribute(patternAttr);
             String value = this->value();
 
@@ -220,15 +249,21 @@ bool HTMLInputElement::tooLong() const
     case BUTTON:
     case CHECKBOX:
     case COLOR:
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
     case FILE:
     case HIDDEN:
     case IMAGE:
     case ISINDEX:
+    case MONTH:
     case NUMBER:
     case RADIO:
     case RANGE:
     case RESET:
     case SUBMIT:
+    case TIME:
+    case WEEK:
         return false;
     }
     ASSERT_NOT_REACHED();
@@ -237,60 +272,204 @@ bool HTMLInputElement::tooLong() const
 
 bool HTMLInputElement::rangeUnderflow() const
 {
-    if (inputType() == NUMBER) {
-        double min = 0.0;
-        double doubleValue = 0.0;
-        if (formStringToDouble(getAttribute(minAttr), &min) && formStringToDouble(value(), &doubleValue))
-            return doubleValue < min;
-    } else if (inputType() == RANGE) {
+    if (inputType() == NUMBER || inputType() == RANGE) {
         double doubleValue;
         if (formStringToDouble(value(), &doubleValue))
-            return doubleValue < rangeMinimum();
+            return doubleValue < minimum();
     }
     return false;
 }
 
 bool HTMLInputElement::rangeOverflow() const
 {
-    if (inputType() == NUMBER) {
-        double max = 0.0;
-        double doubleValue = 0.0;
-        if (formStringToDouble(getAttribute(maxAttr), &max) && formStringToDouble(value(), &doubleValue))
-            return doubleValue > max;
-    } else if (inputType() == RANGE) {
+    if (inputType() == NUMBER || inputType() == RANGE) {
         double doubleValue;
         if (formStringToDouble(value(), &doubleValue))
-            return doubleValue > rangeMaximum();
+            return doubleValue > maximum();
     }
     return false;
 }
 
-double HTMLInputElement::rangeMinimum() const
+double HTMLInputElement::minimum() const
 {
-    ASSERT(inputType() == RANGE);
-    // The range type's "default minimum" is 0.
-    double min = 0.0;
+    ASSERT(inputType() == NUMBER || inputType() == RANGE);
+    double min = inputType() == RANGE ? rangeDefaultMinimum : numberDefaultMinimum;
     formStringToDouble(getAttribute(minAttr), &min);
     return min;
 }
 
-double HTMLInputElement::rangeMaximum() const
+double HTMLInputElement::maximum() const
 {
-    ASSERT(inputType() == RANGE);
-    // The range type's "default maximum" is 100.
-    static const double defaultMaximum = 100.0;
+    ASSERT(inputType() == NUMBER || inputType() == RANGE);
+    double defaultMaximum = inputType() == RANGE ? rangeDefaultMaximum : numberDefaultMaximum;
     double max = defaultMaximum;
     formStringToDouble(getAttribute(maxAttr), &max);
-    const double min = rangeMinimum();
-
-    if (max < min) {
-        // A remedy for the inconsistent min/max values.
-        // Sets the maxmimum to the default (100.0) or the minimum value.
-        max = min < defaultMaximum ? defaultMaximum : min;
+    if (inputType() == RANGE) {
+        // A remedy for the inconsistent min/max values for RANGE.
+        // Sets the maxmimum to the default or the minimum value.
+        double min = minimum();
+        if (max < min)
+            max = std::max(min, defaultMaximum);
     }
     return max;
 }
 
+double HTMLInputElement::stepBase() const
+{
+    if (inputType() == RANGE)
+        return minimum();
+    if (inputType() == NUMBER) {
+        static const double defaultStepBase = 0.0;
+        double min = defaultStepBase;
+        formStringToDouble(getAttribute(minAttr), &min);
+        return min;
+    }
+    ASSERT_NOT_REACHED();
+    return 0.0;
+}
+
+bool HTMLInputElement::stepMismatch() const
+{
+    double step;
+    if (!getAllowedValueStep(&step))
+        return false;
+    if (inputType() == NUMBER) {
+        double doubleValue;
+        if (!formStringToDouble(value(), &doubleValue))
+            return false;
+        doubleValue = fabs(doubleValue - stepBase());
+        if (isinf(doubleValue))
+            return false;
+        // double's fractional part size is DBL_MAN_DIG-bit.  If the current
+        // value is greater than step*2^DBL_MANT_DIG, the following fmod() makes
+        // no sense.
+        if (doubleValue / pow(2, DBL_MANT_DIG) > step)
+            return false;
+        double remainder = fmod(doubleValue, step);
+        // Accepts errors in lower 7-bit.
+        double acceptableError = step / pow(2, DBL_MANT_DIG - 7);
+        return acceptableError < remainder && remainder < (step - acceptableError);
+    }
+    // Non-RANGE types should be rejected by getAllowedValueStep().
+    ASSERT(inputType() == RANGE);
+    // stepMismatch doesn't occur for RANGE. RenderSlider guarantees the
+    // value matches to step.
+    return false;
+}
+
+bool HTMLInputElement::getStepParameters(double* defaultStep, double* stepScaleFactor) const
+{
+    ASSERT(defaultStep);
+    ASSERT(stepScaleFactor);
+    switch (inputType()) {
+    case NUMBER:
+    case RANGE:
+        *defaultStep = numberDefaultStep;
+        *stepScaleFactor = numberStepScaleFactor;
+        return true;
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case MONTH:
+    case TIME:
+    case WEEK:
+        // FIXME: Implement for these types.
+        return false;
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool HTMLInputElement::getAllowedValueStep(double* step) const
+{
+    ASSERT(step);
+    double defaultStep;
+    double stepScaleFactor;
+    if (!getStepParameters(&defaultStep, &stepScaleFactor))
+        return false;
+    const AtomicString& stepString = getAttribute(stepAttr);
+    if (stepString.isEmpty()) {
+        *step = defaultStep * stepScaleFactor;
+        return true;
+    }
+    if (equalIgnoringCase(stepString, "any"))
+        return false;
+    double parsed;
+    if (!formStringToDouble(stepString, &parsed) || parsed <= 0.0) {
+        *step = defaultStep * stepScaleFactor;
+        return true;
+    }
+    *step = parsed * stepScaleFactor;
+    ASSERT(*step > 0);
+    return true;
+}
+
+void HTMLInputElement::applyStepForNumberOrRange(double count, ExceptionCode& ec)
+{
+    ASSERT(inputType() == NUMBER || inputType() == RANGE);
+    double step;
+    if (!getAllowedValueStep(&step)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    double current;
+    if (!formStringToDouble(value(), &current)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    double newValue = current + step * count;
+    if (isinf(newValue)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    if (newValue < minimum()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    double base = stepBase();
+    newValue = base + round((newValue - base) / step) * step;
+    if (newValue > maximum()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    setValue(formStringFromDouble(newValue));
+}
+
+void HTMLInputElement::stepUp(int n, ExceptionCode& ec)
+{
+    if (inputType() != NUMBER && inputType() != RANGE) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    applyStepForNumberOrRange(n, ec);
+}
+
+void HTMLInputElement::stepDown(int n, ExceptionCode& ec)
+{
+    if (inputType() != NUMBER && inputType() != RANGE) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    applyStepForNumberOrRange(-n, ec);
+}
+
 static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
@@ -375,8 +554,40 @@ void HTMLInputElement::setType(const String& t)
         setAttribute(typeAttr, t);
 }
 
+typedef HashMap<String, HTMLInputElement::InputType, CaseFoldingHash> InputTypeMap;
+static const InputTypeMap* createTypeMap()
+{
+    InputTypeMap* map = new InputTypeMap;
+    map->add("button", HTMLInputElement::BUTTON);
+    map->add("checkbox", HTMLInputElement::CHECKBOX);
+    map->add("color", HTMLInputElement::COLOR);
+    map->add("date", HTMLInputElement::DATE);
+    map->add("datetime", HTMLInputElement::DATETIME);
+    map->add("datetime-local", HTMLInputElement::DATETIMELOCAL);
+    map->add("email", HTMLInputElement::EMAIL);
+    map->add("file", HTMLInputElement::FILE);
+    map->add("hidden", HTMLInputElement::HIDDEN);
+    map->add("image", HTMLInputElement::IMAGE);
+    map->add("khtml_isindex", HTMLInputElement::ISINDEX);
+    map->add("month", HTMLInputElement::MONTH);
+    map->add("number", HTMLInputElement::NUMBER);
+    map->add("password", HTMLInputElement::PASSWORD);
+    map->add("radio", HTMLInputElement::RADIO);
+    map->add("range", HTMLInputElement::RANGE);
+    map->add("reset", HTMLInputElement::RESET);
+    map->add("search", HTMLInputElement::SEARCH);
+    map->add("submit", HTMLInputElement::SUBMIT);
+    map->add("tel", HTMLInputElement::TELEPHONE);
+    map->add("time", HTMLInputElement::TIME);
+    map->add("url", HTMLInputElement::URL);
+    map->add("week", HTMLInputElement::WEEK);
+    // No need to register "text" because it is the default type.
+    return map;
+}
+
 void HTMLInputElement::setInputType(const String& t)
 {
+<<<<<<< HEAD:WebCore/html/HTMLInputElement.cpp
     InputType newType;
     
     if (equalIgnoringCase(t, "password"))
@@ -425,6 +636,10 @@ void HTMLInputElement::setInputType(const String& t)
         newType = COLOR;
     else
         newType = TEXT;
+=======
+    static const InputTypeMap* typeMap = createTypeMap();
+    InputType newType = t.isNull() ? TEXT : typeMap->get(t);
+>>>>>>> webkit.org at r51976:WebCore/html/HTMLInputElement.cpp
 
     // IMPORTANT: Don't allow the type to be changed to FILE after the first
     // type change, otherwise a JavaScript programmer would be able to set a text
@@ -495,82 +710,42 @@ void HTMLInputElement::setInputType(const String& t)
         m_imageLoader.clear();
 }
 
+static const AtomicString* createFormControlTypes()
+{
+    AtomicString* types = new AtomicString[HTMLInputElement::numberOfTypes];
+    // The values must be lowercased because they will be the return values of
+    //  input.type and it must be lowercase according to DOM Level 2.
+    types[HTMLInputElement::BUTTON] = "button";
+    types[HTMLInputElement::CHECKBOX] = "checkbox";
+    types[HTMLInputElement::COLOR] = "color";
+    types[HTMLInputElement::DATE] = "date";
+    types[HTMLInputElement::DATETIME] = "datetime";
+    types[HTMLInputElement::DATETIMELOCAL] = "datetime-local";
+    types[HTMLInputElement::EMAIL] = "email";
+    types[HTMLInputElement::FILE] = "file";
+    types[HTMLInputElement::HIDDEN] = "hidden";
+    types[HTMLInputElement::IMAGE] = "image";
+    types[HTMLInputElement::ISINDEX] = emptyAtom;
+    types[HTMLInputElement::MONTH] = "month";
+    types[HTMLInputElement::NUMBER] = "number";
+    types[HTMLInputElement::PASSWORD] = "password";
+    types[HTMLInputElement::RADIO] = "radio";
+    types[HTMLInputElement::RANGE] = "range";
+    types[HTMLInputElement::RESET] = "reset";
+    types[HTMLInputElement::SEARCH] = "search";
+    types[HTMLInputElement::SUBMIT] = "submit";
+    types[HTMLInputElement::TELEPHONE] = "tel";
+    types[HTMLInputElement::TEXT] = "text";
+    types[HTMLInputElement::TIME] = "time";
+    types[HTMLInputElement::URL] = "url";
+    types[HTMLInputElement::WEEK] = "week";
+    return types;
+}
+
 const AtomicString& HTMLInputElement::formControlType() const
 {
-    // needs to be lowercase according to DOM spec
-    switch (inputType()) {
-        case BUTTON: {
-            DEFINE_STATIC_LOCAL(const AtomicString, button, ("button"));
-            return button;
-        }
-        case CHECKBOX: {
-            DEFINE_STATIC_LOCAL(const AtomicString, checkbox, ("checkbox"));
-            return checkbox;
-        }
-        case COLOR: {
-            DEFINE_STATIC_LOCAL(const AtomicString, color, ("color"));
-            return color;
-        }
-        case EMAIL: {
-            DEFINE_STATIC_LOCAL(const AtomicString, email, ("email"));
-            return email;
-        }
-        case FILE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, file, ("file"));
-            return file;
-        }
-        case HIDDEN: {
-            DEFINE_STATIC_LOCAL(const AtomicString, hidden, ("hidden"));
-            return hidden;
-        }
-        case IMAGE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, image, ("image"));
-            return image;
-        }
-        case ISINDEX:
-            return emptyAtom;
-        case NUMBER: {
-            DEFINE_STATIC_LOCAL(const AtomicString, number, ("number"));
-            return number;
-        }
-        case PASSWORD: {
-            DEFINE_STATIC_LOCAL(const AtomicString, password, ("password"));
-            return password;
-        }
-        case RADIO: {
-            DEFINE_STATIC_LOCAL(const AtomicString, radio, ("radio"));
-            return radio;
-        }
-        case RANGE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, range, ("range"));
-            return range;
-        }
-        case RESET: {
-            DEFINE_STATIC_LOCAL(const AtomicString, reset, ("reset"));
-            return reset;
-        }
-        case SEARCH: {
-            DEFINE_STATIC_LOCAL(const AtomicString, search, ("search"));
-            return search;
-        }
-        case SUBMIT: {
-            DEFINE_STATIC_LOCAL(const AtomicString, submit, ("submit"));
-            return submit;
-        }
-        case TELEPHONE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, telephone, ("tel"));
-            return telephone;
-        }
-        case TEXT: {
-            DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
-            return text;
-        }
-        case URL: {
-            DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
-            return url;
-        }
-    }
-    return emptyAtom;
+    static const AtomicString* formControlTypes = createFormControlTypes();
+    return formControlTypes[inputType()];
 }
 
 bool HTMLInputElement::saveFormControlState(String& result) const
@@ -581,11 +756,15 @@ bool HTMLInputElement::saveFormControlState(String& result) const
     switch (inputType()) {
         case BUTTON:
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case RANGE:
         case RESET:
@@ -593,7 +772,9 @@ bool HTMLInputElement::saveFormControlState(String& result) const
         case SUBMIT:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             result = value();
             return true;
         case CHECKBOX:
@@ -613,11 +794,15 @@ void HTMLInputElement::restoreFormControlState(const String& state)
     switch (inputType()) {
         case BUTTON:
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case RANGE:
         case RESET:
@@ -625,7 +810,9 @@ void HTMLInputElement::restoreFormControlState(const String& state)
         case SUBMIT:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             setValue(state);
             break;
         case CHECKBOX:
@@ -668,14 +855,20 @@ void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
             // a no-op for this type
             break;
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             // should never restore previous selection here
             focus(false);
             break;
@@ -714,12 +907,15 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             m_autocomplete = Off;
             registerForActivationCallbackIfNeeded();
         } else {
-            if (m_autocomplete == Off)
-                unregisterForActivationCallbackIfNeeded();
+            bool needsToUnregister = m_autocomplete == Off;
+
             if (attr->isEmpty())
                 m_autocomplete = Uninitialized;
             else
                 m_autocomplete = On;
+
+            if (needsToUnregister)
+                unregisterForActivationCallbackIfNeeded();
         }
     } else if (attr->name() == typeAttr) {
         setInputType(attr->value());
@@ -802,30 +998,9 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
 
 bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
 {
-    switch (inputType()) {
-        case BUTTON:
-        case CHECKBOX:
-        case COLOR:
-        case EMAIL:
-        case FILE:
-        case IMAGE:
-        case ISINDEX:
-        case NUMBER:
-        case PASSWORD:
-        case RADIO:
-        case RANGE:
-        case RESET:
-        case SEARCH:
-        case SUBMIT:
-        case TELEPHONE:
-        case TEXT:
-        case URL:
-            return HTMLFormControlElementWithState::rendererIsNeeded(style);
-        case HIDDEN:
-            return false;
-    }
-    ASSERT(false);
-    return false;
+    if (inputType() == HIDDEN)
+        return false;
+    return HTMLFormControlElementWithState::rendererIsNeeded(style);
 }
 
 RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *style)
@@ -847,14 +1022,20 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
         case RANGE:
             return new (arena) RenderSlider(this);
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             return new (arena) RenderTextControlSingleLine(this, placeholderShouldBeVisible());
     }
     ASSERT(false);
@@ -934,16 +1115,22 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
 
     switch (inputType()) {
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case HIDDEN:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             // always successful
             encoding.appendData(name(), value());
             return true;
@@ -1021,6 +1208,40 @@ void HTMLInputElement::reset()
     m_useDefaultChecked = true;
 }
 
+bool HTMLInputElement::isTextField() const
+{
+    switch (inputType()) {
+    case COLOR:
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case EMAIL:
+    case ISINDEX:
+    case MONTH:
+    case NUMBER:
+    case PASSWORD:
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case TIME:
+    case URL:
+    case WEEK:
+        return true;
+    case BUTTON:
+    case CHECKBOX:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case RADIO:
+    case RANGE:
+    case RESET:
+    case SUBMIT:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
 {
     if (checked() == nowChecked)
@@ -1112,11 +1333,15 @@ String HTMLInputElement::valueWithDefault() const
             case BUTTON:
             case CHECKBOX:
             case COLOR:
+            case DATE:
+            case DATETIME:
+            case DATETIMELOCAL:
             case EMAIL:
             case FILE:
             case HIDDEN:
             case IMAGE:
             case ISINDEX:
+            case MONTH:
             case NUMBER:
             case PASSWORD:
             case RADIO:
@@ -1124,7 +1349,9 @@ String HTMLInputElement::valueWithDefault() const
             case SEARCH:
             case TELEPHONE:
             case TEXT:
+            case TIME:
             case URL:
+            case WEEK:
                 break;
             case RESET:
                 v = resetButtonDefaultLabel();
@@ -1137,7 +1364,13 @@ String HTMLInputElement::valueWithDefault() const
     return v;
 }
 
-void HTMLInputElement::setValue(const String& value)
+void HTMLInputElement::setValueForUser(const String& value)
+{
+    // Call setValue and make it send a change event.
+    setValue(value, true);
+}
+
+void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
 {
     // For security reasons, we don't allow setting the filename, but we do allow clearing it.
     // The HTML5 spec (as of the 10/24/08 working draft) says that the value attribute isn't applicable to the file upload control
@@ -1162,7 +1395,7 @@ void HTMLInputElement::setValue(const String& value)
         setNeedsStyleRecalc();
     } else
         setAttribute(valueAttr, sanitizeValue(value));
-    
+
     if (isTextField()) {
         unsigned max = m_data.value().length();
 #ifdef ANDROID_ACCEPT_CHANGES_TO_FOCUSED_TEXTFIELDS
@@ -1174,6 +1407,12 @@ void HTMLInputElement::setValue(const String& value)
         else
             cacheSelection(max, max);
     }
+
+    // Don't dispatch the change event when focused, it will be dispatched
+    // when the control loses focus.
+    if (sendChangeEvent && document()->focusedNode() != this)
+        dispatchFormControlChangeEvent();
+
     InputElement::notifyFormStateChanged(this);
     updateValidity();
 }
@@ -1226,16 +1465,22 @@ bool HTMLInputElement::storesValueSeparateFromAttribute() const
         case SUBMIT:
             return false;
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case FILE:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             return true;
     }
     return false;
@@ -1402,16 +1647,22 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
             switch (inputType()) {
                 case CHECKBOX:
                 case COLOR:
+                case DATE:
+                case DATETIME:
+                case DATETIMELOCAL:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case MONTH:
                 case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
                 case TELEPHONE:
                 case TEXT:
+                case TIME:
                 case URL:
+                case WEEK:
                     // Simulate mouse click on the default form button for enter for these types of elements.
                     clickDefaultFormButton = true;
                     break;
@@ -1531,16 +1782,22 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                         clickElement = true;
                     break;
                 case COLOR:
+                case DATE:
+                case DATETIME:
+                case DATETIMELOCAL:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case MONTH:
                 case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
                 case TELEPHONE:
                 case TEXT:
+                case TIME:
                 case URL:
+                case WEEK:
                     break;
             }
         }
@@ -1560,12 +1817,12 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         }
         // Fire onChange for text fields.
         RenderObject* r = renderer();
-        if (r && r->isTextField() && toRenderTextControl(r)->isEdited()) {
+        if (r && r->isTextField() && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
             dispatchFormControlChangeEvent();
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
             if (r && r->isTextField())
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         RefPtr<HTMLFormElement> formForSubmission = form();
@@ -1771,25 +2028,31 @@ bool HTMLInputElement::isRequiredFormControl() const
         return false;
 
     switch (inputType()) {
-        case TEXT:
-        case SEARCH:
-        case URL:
-        case TELEPHONE:
+        case CHECKBOX:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
-        case PASSWORD:
+        case FILE:
+        case MONTH:
         case NUMBER:
-        case CHECKBOX:
+        case PASSWORD:
         case RADIO:
-        case FILE:
+        case SEARCH:
+        case TELEPHONE:
+        case TEXT:
+        case TIME:
+        case URL:
+        case WEEK:
             return true;
-        case HIDDEN:
-        case RANGE:
-        case SUBMIT:
-        case IMAGE:
-        case RESET:
         case BUTTON:
         case COLOR:
+        case HIDDEN:
+        case IMAGE:
         case ISINDEX:
+        case RANGE:
+        case RESET:
+        case SUBMIT:
             return false;
     }
 
@@ -1856,6 +2119,16 @@ bool HTMLInputElement::willValidate() const
            inputType() != BUTTON && inputType() != RESET;
 }
 
+String HTMLInputElement::formStringFromDouble(double number)
+{
+    // According to HTML5, "the best representation of the number n as a floating
+    // point number" is a string produced by applying ToString() to n.
+    DtoaBuffer buffer;
+    unsigned length;
+    doubleToStringInJavaScriptFormat(number, buffer, &length);
+    return String(buffer, length);
+}
+
 bool HTMLInputElement::formStringToDouble(const String& src, double* out)
 {
     // See HTML5 2.4.4.3 `Real numbers.'
@@ -1879,6 +2152,34 @@ bool HTMLInputElement::formStringToDouble(const String& src, double* out)
     return true;
 }
 
+bool HTMLInputElement::formStringToISODateTime(InputType type, const String& formString, ISODateTime* out)
+{
+    ISODateTime ignoredResult;
+    if (!out)
+        out = &ignoredResult;
+    const UChar* characters = formString.characters();
+    unsigned length = formString.length();
+    unsigned end;
+
+    switch (type) {
+    case DATE:
+        return out->parseDate(characters, length, 0, end) && end == length;
+    case DATETIME:
+        return out->parseDateTime(characters, length, 0, end) && end == length;
+    case DATETIMELOCAL:
+        return out->parseDateTimeLocal(characters, length, 0, end) && end == length;
+    case MONTH:
+        return out->parseMonth(characters, length, 0, end) && end == length;
+    case WEEK:
+        return out->parseWeek(characters, length, 0, end) && end == length;
+    case TIME:
+        return out->parseTime(characters, length, 0, end) && end == length;
+    default:
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+}
+
 #if ENABLE(DATALIST)
 HTMLElement* HTMLInputElement::list() const
 {
@@ -1891,29 +2192,35 @@ HTMLDataListElement* HTMLInputElement::dataList() const
         return 0;
 
     switch (inputType()) {
-    case TEXT:
-    case SEARCH:
-    case URL:
-    case TELEPHONE:
+    case COLOR:
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
     case EMAIL:
+    case MONTH:
     case NUMBER:
     case RANGE:
-    case COLOR: {
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case TIME:
+    case URL:
+    case WEEK: {
         Element* element = document()->getElementById(getAttribute(listAttr));
         if (element && element->hasTagName(datalistTag))
             return static_cast<HTMLDataListElement*>(element);
         break;
     }
-    case HIDDEN:
-    case PASSWORD:
+    case BUTTON:
     case CHECKBOX:
-    case RADIO:
     case FILE:
-    case SUBMIT:
+    case HIDDEN:
     case IMAGE:
-    case RESET:
-    case BUTTON:
     case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SUBMIT:
         break;
     }
     return 0;
diff --git a/WebCore/html/HTMLInputElement.h b/WebCore/html/HTMLInputElement.h
index 0e2da32..8f00aeb 100644
--- a/WebCore/html/HTMLInputElement.h
+++ b/WebCore/html/HTMLInputElement.h
@@ -34,13 +34,14 @@ class FileList;
 class HTMLDataListElement;
 class HTMLImageLoader;
 class HTMLOptionElement;
+class ISODateTime;
 class KURL;
 class VisibleSelection;
 
 class HTMLInputElement : public HTMLTextFormControlElement, public InputElement {
 public:
     enum InputType {
-        TEXT,
+        TEXT = 0, // TEXT must be 0.
         PASSWORD,
         ISINDEX,
         CHECKBOX,
@@ -57,9 +58,17 @@ public:
         NUMBER,
         TELEPHONE,
         URL,
-        COLOR
+        COLOR,
+        DATE,
+        DATETIME,
+        DATETIMELOCAL,
+        MONTH,
+        TIME,
+        WEEK,
+        // If you add new types or change the order of enum values, update numberOfTypes below.
     };
-    
+    static const int numberOfTypes = WEEK + 1;
+
     enum AutoCompleteSetting {
         Uninitialized,
         On,
@@ -97,15 +106,25 @@ public:
     // For ValidityState
     bool rangeUnderflow() const;
     bool rangeOverflow() const;
-    // Returns the minimum value for type=range.  Don't call this for other types.
-    double rangeMinimum() const;
-    // Returns the maximum value for type=range.  Don't call this for other types.
-    // This always returns a value which is <= rangeMinimum().
-    double rangeMaximum() const;
+    // Returns the minimum value for type=number or range.  Don't call this for other types.
+    double minimum() const;
+    // Returns the maximum value for type=number or range.  Don't call this for other types.
+    // This always returns a value which is >= minimum().
+    double maximum() const;
+    // Sets the "allowed value step" defined in the HTML spec to the specified double pointer.
+    // Returns false if there is no "allowed value step."
+    bool getAllowedValueStep(double*) const;
+    // For ValidityState.
+    bool stepMismatch() const;
+    // Implementations of HTMLInputElement::stepUp() and stepDown().
+    void stepUp(int, ExceptionCode&);
+    void stepDown(int, ExceptionCode&);
+    void stepUp(ExceptionCode& ec) { stepUp(1, ec); }
+    void stepDown(ExceptionCode& ec) { stepDown(1, ec); }
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
-    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL || m_type == COLOR; }
+    virtual bool isTextField() const;
     virtual bool isSearchField() const { return m_type == SEARCH; }
     virtual bool isInputTypeHidden() const { return m_type == HIDDEN; }
     virtual bool isPasswordField() const { return m_type == PASSWORD; }
@@ -119,7 +138,8 @@ public:
     void setType(const String&);
 
     virtual String value() const;
-    virtual void setValue(const String&);
+    virtual void setValue(const String&, bool sendChangeEvent = false);
+    virtual void setValueForUser(const String&);
 
     virtual String placeholder() const;
     virtual void setPlaceholder(const String&);
@@ -234,6 +254,13 @@ public:
     // If the conversion fails, the return value is false. Take care that leading or trailing unnecessary characters make failures.  This returns false for an empty string input.
     // The double* parameter may be 0.
     static bool formStringToDouble(const String&, double*);
+    // Converts the specified number to a string. This is an implementation of
+    // HTML5's "algorithm to convert a number to a string" for NUMBER/RANGE types.
+    static String formStringFromDouble(double);
+    // Parses the specified string as the InputType, and returns true if it is successfully parsed.
+    // An instance pointed by the ISODateTime* parameter will have parsed values and be
+    // modified even if the parsing fails.  The ISODateTime* parameter may be 0.
+    static bool formStringToISODateTime(InputType, const String&, ISODateTime*);
     
 protected:
     virtual void willMoveToNewOwnerDocument();
@@ -257,6 +284,12 @@ private:
     virtual bool isRequiredFormControl() const;
 
     PassRefPtr<HTMLFormElement> createTemporaryFormForIsIndex();
+    // Helper for getAllowedValueStep();
+    bool getStepParameters(double* defaultStep, double* stepScaleFactor) const;
+    // Helper for stepUp()/stepDown().  Adds step value * count to the current number/range value.
+    void applyStepForNumberOrRange(double count, ExceptionCode&);
+    // Helper for applyStepForNumberOrRange().
+    double stepBase() const;
 
 #if ENABLE(DATALIST)
     HTMLDataListElement* dataList() const;
diff --git a/WebCore/html/HTMLInputElement.idl b/WebCore/html/HTMLInputElement.idl
index 59248f4..2ac6674 100644
--- a/WebCore/html/HTMLInputElement.idl
+++ b/WebCore/html/HTMLInputElement.idl
@@ -43,16 +43,16 @@ module html {
         readonly attribute HTMLElement     list;
 #endif
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
-                 attribute [Reflect] DOMString max;
+                 attribute [ConvertNullToNullString, Reflect] DOMString max;
 #endif
                  attribute long            maxLength
                      setter raises(DOMException);
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
-                 attribute [Reflect] DOMString min;
+                 attribute [ConvertNullToNullString, Reflect] DOMString min;
 #endif
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
-                 attribute [Reflect] DOMString       pattern;
+                 attribute [ConvertNullToNullString, Reflect] DOMString pattern;
                  attribute DOMString       placeholder;
                  attribute boolean         readOnly;
                  attribute boolean         required;
@@ -63,18 +63,30 @@ module html {
                  attribute unsigned long   size; // Changed string -> long as part of DOM level 2
 #endif
                  attribute [ConvertNullToNullString] DOMString src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString step;
                  attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
                  attribute [ConvertNullToNullString] DOMString useMap;
                  attribute [ConvertNullToNullString] DOMString value;
 #if defined(ENABLE_DATALIST) && ENABLE_DATALIST
         readonly attribute HTMLOptionElement selectedOption;
 #endif
+
+        void               stepUp(in [Optional] long n)
+            raises(DOMException);
+        void               stepDown(in [Optional] long n)
+            raises(DOMException);
+
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void               select();
         void               click();
-        
+
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
+        void               setValueForUser(in [ConvertNullToNullString] DOMString value);
+#endif
+
         // WinIE extension:
                  attribute boolean         indeterminate;
 
diff --git a/WebCore/html/HTMLLinkElement.cpp b/WebCore/html/HTMLLinkElement.cpp
index 47bcca8..ab06544 100644
--- a/WebCore/html/HTMLLinkElement.cpp
+++ b/WebCore/html/HTMLLinkElement.cpp
@@ -218,7 +218,7 @@ void HTMLLinkElement::process()
 
     // Stylesheet
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
-    if (m_disabledState != 2 && (m_isStyleSheet || acceptIfTypeContainsTextCSS && type.contains("text/css")) && document()->frame() && m_url.isValid()) {
+    if (m_disabledState != 2 && (m_isStyleSheet || (acceptIfTypeContainsTextCSS && type.contains("text/css"))) && document()->frame() && m_url.isValid()) {
         // also, don't load style sheets for standalone documents
         
         String charset = getAttribute(charsetAttr);
diff --git a/WebCore/html/HTMLMediaElement.cpp b/WebCore/html/HTMLMediaElement.cpp
index 729aceb..30f762a 100644
--- a/WebCore/html/HTMLMediaElement.cpp
+++ b/WebCore/html/HTMLMediaElement.cpp
@@ -117,6 +117,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_pausedInternal(false)
     , m_sendProgressEvents(true)
     , m_isFullscreen(false)
+    , m_closedCaptionsVisible(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_needWidgetUpdate(false)
 #endif
@@ -213,6 +214,10 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().volumechangeEvent, createAttributeEventListener(this, attr));
     else if (attrName == onwaitingAttr)
         setAttributeEventListener(eventNames().waitingEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onwebkitbeginfullscreenAttr)
+        setAttributeEventListener(eventNames().webkitbeginfullscreenEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onwebkitendfullscreenAttr)
+        setAttributeEventListener(eventNames().webkitendfullscreenEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -292,24 +297,6 @@ void HTMLMediaElement::scheduleNextSourceChild()
     m_loadTimer.startOneShot(0);
 }
 
-void HTMLMediaElement::scheduleProgressEvent(const AtomicString& eventName)
-{
-    if (!m_sendProgressEvents)
-        return;
-
-    // FIXME: don't schedule timeupdate or progress events unless there are registered listeners
-
-    bool totalKnown = m_player && m_player->totalBytesKnown();
-    unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
-    unsigned total = m_player ? m_player->totalBytes() : 0;
-
-    RefPtr<ProgressEvent> evt = ProgressEvent::create(eventName, totalKnown, loaded, total);
-    enqueueEvent(evt);
-
-    if (renderer())
-        renderer()->updateFromElement();
-}
-
 void HTMLMediaElement::scheduleEvent(const AtomicString& eventName)
 {
     enqueueEvent(Event::create(eventName, false, true));
@@ -478,6 +465,7 @@ void HTMLMediaElement::loadInternal()
     m_autoplaying = true;
     m_playedTimeRanges = TimeRanges::create();
     m_lastSeekTime = 0;
+    m_closedCaptionsVisible = false;
 
     // 6
     setPlaybackRate(defaultPlaybackRate());
@@ -523,7 +511,7 @@ void HTMLMediaElement::selectMediaResource()
     m_networkState = NETWORK_LOADING;
 
     // 5
-    scheduleProgressEvent(eventNames().loadstartEvent);
+    scheduleEvent(eventNames().loadstartEvent);
 
     // 6 - If the media element has a src attribute, then run these substeps
     ContentType contentType("");
@@ -582,11 +570,10 @@ void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& content
         startProgressEventTimer();
 
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    m_player.clear();
-    m_player.set(new MediaPlayer(this));
+    m_player = MediaPlayer::create(this);
 #else
     if (!m_player)
-        m_player.set(new MediaPlayer(this));
+        m_player = MediaPlayer::create(this);
 #endif
 
     m_player->setPreservesPitch(m_webkitPreservesPitch);
@@ -647,7 +634,7 @@ void HTMLMediaElement::noneSupported()
     // 7 - Queue a task to fire a progress event called error at the media element, in
     // the context of the fetching process that was used to try to obtain the media
     // resource in the resource fetch algorithm.
-    scheduleProgressEvent(eventNames().errorEvent);
+    scheduleEvent(eventNames().errorEvent);
 
     // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
@@ -672,7 +659,7 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
 
     // 3 - Queue a task to fire a progress event called error at the media element, in
     // the context of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().errorEvent);
+    scheduleEvent(eventNames().errorEvent);
 
     // 4 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
     // task to fire a simple event called emptied at the element.
@@ -739,7 +726,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
     if (state == MediaPlayer::Idle) {
         if (m_networkState > NETWORK_IDLE) {
             stopPeriodicTimers();
-            scheduleProgressEvent(eventNames().suspendEvent);
+            scheduleEvent(eventNames().suspendEvent);
         }
         m_networkState = NETWORK_IDLE;
     }
@@ -759,7 +746,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
 
             // Schedule one last progress event so we guarantee that at least one is fired
             // for files that load very quickly.
-            scheduleProgressEvent(eventNames().progressEvent);
+            scheduleEvent(eventNames().progressEvent);
 
             // Check to see if readyState changes need to be dealt with before sending the 
             // 'load' event so we report 'canplaythrough' first. This is necessary because a
@@ -768,7 +755,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
             if (static_cast<ReadyState>(currentState) != m_readyState)
                 setReadyState(currentState);
 
-            scheduleProgressEvent(eventNames().loadEvent);
+            scheduleEvent(eventNames().loadEvent);
         }
     }
 }
@@ -885,14 +872,16 @@ void HTMLMediaElement::progressEventTimerFired(Timer<HTMLMediaElement>*)
 
     if (progress == m_previousProgress) {
         if (timedelta > 3.0 && !m_sentStalledEvent) {
-            scheduleProgressEvent(eventNames().stalledEvent);
+            scheduleEvent(eventNames().stalledEvent);
             m_sentStalledEvent = true;
         }
     } else {
-        scheduleProgressEvent(eventNames().progressEvent);
+        scheduleEvent(eventNames().progressEvent);
         m_previousProgress = progress;
         m_previousProgressTime = time;
         m_sentStalledEvent = false;
+        if (renderer())
+            renderer()->updateFromElement();
     }
 }
 
@@ -1652,7 +1641,7 @@ void HTMLMediaElement::userCancelledLoad()
 
     // 3 - Queue a task to fire a progress event called abort at the media element, in the context
     // of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().abortEvent);
+    scheduleEvent(eventNames().abortEvent);
 
     // 5 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the
     // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a
@@ -1784,7 +1773,7 @@ void HTMLMediaElement::finishParsingChildren()
 {
     HTMLElement::finishParsingChildren();
     if (!m_player)
-        m_player.set(new MediaPlayer(this));
+        m_player = MediaPlayer::create(this);
     
     document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer())
@@ -1796,25 +1785,96 @@ void HTMLMediaElement::finishParsingChildren()
 void HTMLMediaElement::enterFullscreen()
 {
     ASSERT(!m_isFullscreen);
-    if (!renderer())
-        return;
-    if (document() && document()->page())
+    if (document() && document()->page()) {
         document()->page()->chrome()->client()->enterFullscreenForNode(this);
-    m_isFullscreen = true;
+        scheduleEvent(eventNames().webkitbeginfullscreenEvent);
+        m_isFullscreen = true;
+    }
 }
 
 void HTMLMediaElement::exitFullscreen()
 {
     ASSERT(m_isFullscreen);
-    if (document() && document()->page())
+    if (document() && document()->page()) {
         document()->page()->chrome()->client()->exitFullscreenForNode(this);
+        scheduleEvent(eventNames().webkitendfullscreenEvent);
+    }
     m_isFullscreen = false;
 }
 
 PlatformMedia HTMLMediaElement::platformMedia() const
 {
     return m_player ? m_player->platformMedia() : NoPlatformMedia;
-}        
+}
+
+void HTMLMediaElement::webkitEnterFullScreen(ExceptionCode& ec)
+{
+    if (m_isFullscreen)
+        return;
+
+    // Generate an exception if this isn't called in response to a user gesture, or if the 
+    // element does not support fullscreen.
+    if (!processingUserGesture() || !supportsFullscreen()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    enterFullscreen();
+}
+
+void HTMLMediaElement::webkitExitFullScreen()
+{
+    if (m_isFullscreen)
+        exitFullscreen();
+}
+
+bool HTMLMediaElement::webkitSupportsFullscreen()
+{
+    return supportsFullscreen();
+}
+
+bool HTMLMediaElement::webkitDisplayingFullscreen()
+{
+    return m_isFullscreen;
+}
+
+bool HTMLMediaElement::hasClosedCaptions() const
+{
+    return m_player && m_player->hasClosedCaptions();
+}
+
+bool HTMLMediaElement::closedCaptionsVisible() const
+{
+    return m_closedCaptionsVisible;
+}
+
+void HTMLMediaElement::setClosedCaptionsVisible(bool closedCaptionVisible)
+{
+    if (!m_player ||!hasClosedCaptions())
+        return;
+
+    m_closedCaptionsVisible = closedCaptionVisible;
+    m_player->setClosedCaptionsVisible(closedCaptionVisible);
+    if (renderer())
+        renderer()->updateFromElement();
+}
+
+void HTMLMediaElement::setWebkitClosedCaptionsVisible(bool visible)
+{
+    setClosedCaptionsVisible(visible);
+}
+
+bool HTMLMediaElement::webkitClosedCaptionsVisible() const
+{
+    return closedCaptionsVisible();
+}
+
+
+bool HTMLMediaElement::webkitHasClosedCaptions() const
+{
+    return hasClosedCaptions();
+}
+
 }
 
 #endif
diff --git a/WebCore/html/HTMLMediaElement.h b/WebCore/html/HTMLMediaElement.h
index 405f013..bc39dd7 100644
--- a/WebCore/html/HTMLMediaElement.h
+++ b/WebCore/html/HTMLMediaElement.h
@@ -131,7 +131,18 @@ public:
     void setLoop(bool b);
     void play();
     void pause();
-    
+
+// fullscreen
+    void webkitEnterFullScreen(ExceptionCode&);
+    void webkitExitFullScreen();
+    bool webkitSupportsFullscreen();
+    bool webkitDisplayingFullscreen();
+
+// captions
+    bool webkitHasClosedCaptions() const;
+    bool webkitClosedCaptionsVisible() const;
+    void setWebkitClosedCaptionsVisible(bool);
+
 // controls
     bool controls() const;
     void setControls(bool);
@@ -162,6 +173,10 @@ public:
     void enterFullscreen();
     void exitFullscreen();
 
+    bool hasClosedCaptions() const;
+    bool closedCaptionsVisible() const;
+    void setClosedCaptionsVisible(bool);
+
 protected:
     float getTimeOffsetAttribute(const QualifiedName&, float valueOnError) const;
     void setTimeOffsetAttribute(const QualifiedName&, float value);
@@ -203,7 +218,6 @@ private:
     void addPlayedRange(float start, float end);
     
     void scheduleTimeupdateEvent(bool periodicEvent);
-    void scheduleProgressEvent(const AtomicString& eventName);
     void scheduleEvent(const AtomicString& eventName);
     void enqueueEvent(RefPtr<Event> event);
     
@@ -319,6 +333,7 @@ protected:
     bool m_sendProgressEvents : 1;
 
     bool m_isFullscreen : 1;
+    bool m_closedCaptionsVisible : 1;
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool m_needWidgetUpdate : 1;
diff --git a/WebCore/html/HTMLMediaElement.idl b/WebCore/html/HTMLMediaElement.idl
index 7278fa6..e418a63 100644
--- a/WebCore/html/HTMLMediaElement.idl
+++ b/WebCore/html/HTMLMediaElement.idl
@@ -77,7 +77,17 @@ interface [GenerateConstructor, Conditional=VIDEO] HTMLMediaElement : HTMLElemen
         setter raises (DOMException);
     attribute boolean muted;
     
-    // WebKit extension
+    // WebKit extensions
     attribute boolean webkitPreservesPitch;
+
+    readonly attribute boolean webkitSupportsFullscreen;
+    readonly attribute boolean webkitDisplayingFullscreen;
+
+    void webkitEnterFullScreen()
+        raises (DOMException);
+    void webkitExitFullScreen();
+
+    readonly attribute boolean webkitHasClosedCaptions;
+    attribute boolean webkitClosedCaptionsVisible;
 };
 }
diff --git a/WebCore/html/HTMLMetaElement.h b/WebCore/html/HTMLMetaElement.h
index d86df2e..19e8ecd 100644
--- a/WebCore/html/HTMLMetaElement.h
+++ b/WebCore/html/HTMLMetaElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLModElement.cpp b/WebCore/html/HTMLModElement.cpp
index b48182a..19b3403 100644
--- a/WebCore/html/HTMLModElement.cpp
+++ b/WebCore/html/HTMLModElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/WebCore/html/HTMLModElement.h b/WebCore/html/HTMLModElement.h
index 83697f9..9d9e6c1 100644
--- a/WebCore/html/HTMLModElement.h
+++ b/WebCore/html/HTMLModElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/WebCore/html/HTMLOptionsCollection.cpp b/WebCore/html/HTMLOptionsCollection.cpp
index 0b88183..db9a457 100644
--- a/WebCore/html/HTMLOptionsCollection.cpp
+++ b/WebCore/html/HTMLOptionsCollection.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/html/HTMLParser.cpp b/WebCore/html/HTMLParser.cpp
index 1cb47ae..f13c19b 100644
--- a/WebCore/html/HTMLParser.cpp
+++ b/WebCore/html/HTMLParser.cpp
@@ -203,6 +203,25 @@ void HTMLParser::setCurrent(Node* newCurrent)
     m_didRefCurrent = didRefNewCurrent;
 }
 
+inline static int tagPriorityOfNode(Node* n)
+{
+    return n->isHTMLElement() ? static_cast<HTMLElement*>(n)->tagPriority() : 0;
+}
+
+inline void HTMLParser::limitBlockDepth(int tagPriority)
+{
+    if (tagPriority >= minBlockLevelTagPriority) {
+        while (m_blocksInStack >= cMaxBlockDepth)
+            popBlock(m_blockStack->tagName);
+    }
+}
+
+inline bool HTMLParser::insertNodeAfterLimitBlockDepth(Node* n, bool flat)
+{
+    limitBlockDepth(tagPriorityOfNode(n));
+    return insertNode(n, flat);
+}
+
 PassRefPtr<Node> HTMLParser::parseToken(Token* t)
 {
     if (!m_skipModeTag.isNull()) {
@@ -241,7 +260,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         while (charsLeft) {
             // split large blocks of text to nodes of manageable size
             n = Text::createWithLengthLimit(m_document, text, charsLeft);
-            if (!insertNode(n.get(), t->selfClosingTag))
+            if (!insertNodeAfterLimitBlockDepth(n.get(), t->selfClosingTag))
                 return 0;
         }
         return n;
@@ -271,7 +290,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         }
     }
 
-    if (!insertNode(n.get(), t->selfClosingTag)) {
+    if (!insertNodeAfterLimitBlockDepth(n.get(), t->selfClosingTag)) {
         // we couldn't insert the node
 
         if (n->isElementNode()) {
@@ -329,21 +348,17 @@ bool HTMLParser::insertNode(Node* n, bool flat)
     RefPtr<Node> protectNode(n);
 
     const AtomicString& localName = n->localName();
-    int tagPriority = n->isHTMLElement() ? static_cast<HTMLElement*>(n)->tagPriority() : 0;
     
     // <table> is never allowed inside stray table content.  Always pop out of the stray table content
     // and close up the first table, and then start the second table as a sibling.
     if (m_inStrayTableContent && localName == tableTag)
         popBlock(tableTag);
 
-    if (tagPriority >= minBlockLevelTagPriority) {
-        while (m_blocksInStack >= cMaxBlockDepth)
-            popBlock(m_blockStack->tagName);
-    }
-
     if (m_parserQuirks && !m_parserQuirks->shouldInsertNode(m_current, n))
         return false;
 
+    int tagPriority = tagPriorityOfNode(n);
+
     // let's be stupid and just try to insert it.
     // this should work if the document is well-formed
     Node* newNode = m_current->addChild(n);
diff --git a/WebCore/html/HTMLParser.h b/WebCore/html/HTMLParser.h
index 0945826..f07b64b 100644
--- a/WebCore/html/HTMLParser.h
+++ b/WebCore/html/HTMLParser.h
@@ -111,6 +111,9 @@ private:
 
     void processCloseTag(Token*);
 
+    void limitBlockDepth(int tagPriority);
+
+    bool insertNodeAfterLimitBlockDepth(Node*, bool flat = false);
     bool insertNode(Node*, bool flat = false);
     bool handleError(Node*, bool flat, const AtomicString& localName, int tagPriority);
     
diff --git a/WebCore/html/HTMLPlugInElement.cpp b/WebCore/html/HTMLPlugInElement.cpp
index 2f429b4..9626c83 100644
--- a/WebCore/html/HTMLPlugInElement.cpp
+++ b/WebCore/html/HTMLPlugInElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
diff --git a/WebCore/html/HTMLPreElement.cpp b/WebCore/html/HTMLPreElement.cpp
index f340ae3..030660f 100644
--- a/WebCore/html/HTMLPreElement.cpp
+++ b/WebCore/html/HTMLPreElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLPreElement.h b/WebCore/html/HTMLPreElement.h
index 691daf8..e84f4b3 100644
--- a/WebCore/html/HTMLPreElement.h
+++ b/WebCore/html/HTMLPreElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *
diff --git a/WebCore/html/HTMLSelectElement.idl b/WebCore/html/HTMLSelectElement.idl
index 53fe848..ae47896 100644
--- a/WebCore/html/HTMLSelectElement.idl
+++ b/WebCore/html/HTMLSelectElement.idl
@@ -45,6 +45,7 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
diff --git a/WebCore/html/HTMLTableCellElement.cpp b/WebCore/html/HTMLTableCellElement.cpp
index f3b4674..94bf82e 100644
--- a/WebCore/html/HTMLTableCellElement.cpp
+++ b/WebCore/html/HTMLTableCellElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTableCellElement.h b/WebCore/html/HTMLTableCellElement.h
index fc74cae..9cb7cf5 100644
--- a/WebCore/html/HTMLTableCellElement.h
+++ b/WebCore/html/HTMLTableCellElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTableColElement.cpp b/WebCore/html/HTMLTableColElement.cpp
index e1008d1..27ff6f7 100644
--- a/WebCore/html/HTMLTableColElement.cpp
+++ b/WebCore/html/HTMLTableColElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTableColElement.h b/WebCore/html/HTMLTableColElement.h
index 83a26aa..af785f3 100644
--- a/WebCore/html/HTMLTableColElement.h
+++ b/WebCore/html/HTMLTableColElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTablePartElement.cpp b/WebCore/html/HTMLTablePartElement.cpp
index 0f9a3e8..f060dce 100644
--- a/WebCore/html/HTMLTablePartElement.cpp
+++ b/WebCore/html/HTMLTablePartElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTablePartElement.h b/WebCore/html/HTMLTablePartElement.h
index adbd63b..1fd5218 100644
--- a/WebCore/html/HTMLTablePartElement.h
+++ b/WebCore/html/HTMLTablePartElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTextAreaElement.idl b/WebCore/html/HTMLTextAreaElement.idl
index db5154e..107a1fe 100644
--- a/WebCore/html/HTMLTextAreaElement.idl
+++ b/WebCore/html/HTMLTextAreaElement.idl
@@ -48,6 +48,7 @@ module html {
         void     select();
 
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
diff --git a/WebCore/html/HTMLTitleElement.h b/WebCore/html/HTMLTitleElement.h
index 5335d8d..677bffd 100644
--- a/WebCore/html/HTMLTitleElement.h
+++ b/WebCore/html/HTMLTitleElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp
index c38a9be..3ca6958 100644
--- a/WebCore/html/HTMLTokenizer.cpp
+++ b/WebCore/html/HTMLTokenizer.cpp
@@ -564,12 +564,6 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
         return state;
     m_executingScript++;
     
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willEvaluateScriptTag(sourceCode.url().isNull() ? String() : sourceCode.url().string(), sourceCode.startLine());
-#endif
-    
     SegmentedString* savedPrependingSrc = m_currentPrependingSrc;
     SegmentedString prependingSrc;
     m_currentPrependingSrc = &prependingSrc;
@@ -627,11 +621,6 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
 
     m_currentPrependingSrc = savedPrependingSrc;
     
-#if ENABLE(INSPECTOR)
-    if (timelineAgent)
-        timelineAgent->didEvaluateScriptTag();
-#endif
-    
     return state;
 }
 
@@ -1692,8 +1681,7 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 #endif
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent())
         timelineAgent->willWriteHTML();
 #endif
   
@@ -1819,7 +1807,7 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 #endif
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent())
         timelineAgent->didWriteHTML();
 #endif
 
diff --git a/WebCore/html/HTMLVideoElement.cpp b/WebCore/html/HTMLVideoElement.cpp
index 5bbc167..d0b1042 100644
--- a/WebCore/html/HTMLVideoElement.cpp
+++ b/WebCore/html/HTMLVideoElement.cpp
@@ -35,6 +35,7 @@
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "MappedAttribute.h"
+#include "Page.h"
 #include "RenderImage.h"
 #include "RenderVideo.h"
 
@@ -119,9 +120,10 @@ bool HTMLVideoElement::supportsFullscreen() const
     if (!page) 
         return false;
 
-    if (!m_player || !m_player->supportsFullscreen())
+    if (!m_player || !m_player->supportsFullscreen() || !m_player->hasVideo())
         return false;
-    
+
+    // Check with the platform client.
     return page->chrome()->client()->supportsFullscreenForNode(this);
 }
 
diff --git a/WebCore/html/ISODateTime.cpp b/WebCore/html/ISODateTime.cpp
new file mode 100644
index 0000000..4c28ac0
--- /dev/null
+++ b/WebCore/html/ISODateTime.cpp
@@ -0,0 +1,435 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ISODateTime.h"
+
+#include <limits.h>
+#include <wtf/ASCIICType.h>
+
+namespace WebCore {
+
+// The oldest day of Gregorian Calendar is 1582-10-15. We don't support dates older than it.
+static const int gregorianStartYear = 1582;
+static const int gregorianStartMonth = 9; // This is October, since months are 0 based.
+static const int gregorianStartDay = 15;
+
+static const int daysInMonth[12] = {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31};
+
+static bool isLeapYear(int year)
+{
+    if (year % 4)
+        return false;
+    if (!(year % 400))
+        return true;
+    if (!(year % 100))
+        return false;
+    return true;
+}
+
+// `month' is 0-based.
+static int maxDayOfMonth(int year, int month)
+{
+    if (month != 1) // February?
+        return daysInMonth[month];
+    return isLeapYear(year) ? 29 : 28;
+}
+
+// `month' is 0-based.
+static int dayOfWeek(int year, int month, int day)
+{
+    int shiftedMonth = month + 2;
+    // 2:January, 3:Feburuary, 4:March, ...
+
+    // Zeller's congruence
+    if (shiftedMonth <= 3) {
+        shiftedMonth += 12;
+        year--;
+    }
+    // 4:March, ..., 14:January, 15:February
+
+    int highYear = year / 100;
+    int lowYear = year % 100;
+    // We add 6 to make the result Sunday-origin.
+    int result = (day + 13 * shiftedMonth / 5 + lowYear + lowYear / 4 + highYear / 4 + 5 * highYear + 6) % 7;
+    return result;
+}
+
+int ISODateTime::maxWeekNumberInYear() const
+{
+    int day = dayOfWeek(m_year, 0, 1); // January 1.
+    return day == Thursday || (day == Wednesday && isLeapYear(m_year)) ? 53 : 52;
+}
+
+static unsigned countDigits(const UChar* src, unsigned length, unsigned start)
+{
+    unsigned index = start;
+    for (; index < length; ++index) {
+        if (!isASCIIDigit(src[index]))
+            break;
+    }
+    return index - start;
+}
+
+// Very strict integer parser. Do not allow leading or trailing whitespace unlike charactersToIntStrict().
+static bool toInt(const UChar* src, unsigned length, unsigned parseStart, unsigned parseLength, int& out)
+{
+    if (parseStart + parseLength > length || parseLength <= 0)
+        return false;
+    int value = 0;
+    const UChar* current = src + parseStart;
+    const UChar* end = current + parseLength;
+
+    // We don't need to handle negative numbers for ISO 8601.
+    for (; current < end; ++current) {
+        if (!isASCIIDigit(*current))
+            return false;
+        int digit = *current - '0';
+        if (value > (INT_MAX - digit) / 10) // Check for overflow.
+            return false;
+        value = value * 10 + digit;
+    }
+    out = value;
+    return true;
+}
+
+bool ISODateTime::parseYear(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    unsigned digitsLength = countDigits(src, length, start);
+    // Needs at least 4 digits according to the standard.
+    if (digitsLength < 4)
+        return false;
+    int year;
+    if (!toInt(src, length, start, digitsLength, year))
+        return false;
+    // No support for years before Gregorian calendar.
+    if (year < gregorianStartYear)
+        return false;
+    m_year = year;
+    end = start + digitsLength;
+    return true;
+}
+
+bool ISODateTime::addDay(int dayDiff)
+{
+    ASSERT(m_monthDay);
+
+    int day = m_monthDay + dayDiff;
+    if (day > maxDayOfMonth(m_year, m_month)) {
+        day = m_monthDay;
+        int year = m_year;
+        int month = m_month;
+        int maxDay = maxDayOfMonth(year, month);
+        for (; dayDiff > 0; --dayDiff) {
+            ++day;
+            if (day > maxDay) {
+                day = 1;
+                ++month;
+                if (month >= 12) { // month is 0-origin.
+                    month = 0;
+                    ++year;
+                    if (year < 0) // Check for overflow.
+                        return false;
+                }
+                maxDay = maxDayOfMonth(year, month);
+            }
+        }
+        m_year = year;
+        m_month = month;
+    } else if (day < 1) {
+        int month = m_month;
+        int year = m_year;
+        day = m_monthDay;
+        for (; dayDiff < 0; ++dayDiff) {
+            --day;
+            if (day < 1) {
+                --month;
+                if (month < 0) {
+                    month = 11;
+                    --year;
+                }
+                day = maxDayOfMonth(year, month);
+            }
+            if (year < gregorianStartYear
+                    || (year == gregorianStartYear && month < gregorianStartMonth)
+                    || (year == gregorianStartYear && month == gregorianStartMonth && day < gregorianStartDay))
+                return false;
+        }
+        m_year = year;
+        m_month = month;
+    }
+    m_monthDay = day;
+    return true;
+}
+
+bool ISODateTime::addMinute(int minute)
+{
+    int carry;
+    // min can be negative or greater than 59.
+    minute += m_minute;
+    if (minute > 59) {
+        carry = minute / 60;
+        minute = minute % 60;
+    } else if (m_minute < 0) {
+        carry = (59 - m_minute) / 60;
+        minute += carry * 60;
+        carry = -carry;
+        ASSERT(minute >= 0 && minute <= 59);
+    } else {
+        m_minute = minute;
+        return true;
+    }
+
+    int hour = m_hour + carry;
+    if (hour > 23) {
+        carry = hour / 24;
+        hour = hour % 24;
+    } else if (hour < 0) {
+        carry = (23 - hour) / 24;
+        hour += carry * 24;
+        carry = -carry;
+        ASSERT(hour >= 0 && hour <= 23);
+    } else {
+        m_minute = minute;
+        m_hour = hour;
+        return true;
+    }
+    if (!addDay(carry))
+        return false;
+    m_minute = minute;
+    m_hour = hour;
+    return true;
+}
+
+// Parses a timezone part, and adjust year, month, monthDay, hour, minute, second, millisecond.
+bool ISODateTime::parseTimeZone(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    if (start >= length)
+        return false;
+    unsigned index = start;
+    if (src[index] == 'Z') {
+        end = index + 1;
+        return true;
+    }
+
+    bool minus;
+    if (src[index] == '+')
+        minus = false;
+    else if (src[index] == '-')
+        minus = true;
+    else
+        return false;
+    ++index;
+
+    int hour;
+    int minute;
+    if (!toInt(src, length, index, 2, hour) || hour < 0 || hour > 23)
+        return false;
+    index += 2;
+
+    if (index >= length || src[index] != ':')
+        return false;
+    ++index;
+
+    if (!toInt(src, length, index, 2, minute) || minute < 0 || minute > 59)
+        return false;
+    index += 2;
+
+    if (minus) {
+        hour = -hour;
+        minute = -minute;
+    }
+
+    // Subtract the timezone offset.
+    if (!addMinute(-(hour * 60 + minute)))
+        return false;
+    end = index;
+    return true;
+}
+
+bool ISODateTime::parseMonth(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseYear(src, length, start, index))
+        return false;
+    if (index >= length || src[index] != '-')
+        return false;
+    ++index;
+
+    int month;
+    if (!toInt(src, length, index, 2, month) || month < 1 || month > 12)
+        return false;
+    --month;
+    // No support for months before Gregorian calendar.
+    if (m_year == gregorianStartYear && month < gregorianStartMonth)
+        return false;
+    m_month = month;
+    end = index + 2;
+    return true;
+}
+
+bool ISODateTime::parseDate(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseMonth(src, length, start, index))
+        return false;
+    // '-' and 2-digits are needed.
+    if (index + 2 >= length)
+        return false;
+    if (src[index] != '-')
+        return false;
+    ++index;
+
+    int day;
+    if (!toInt(src, length, index, 2, day) || day < 1 || day > maxDayOfMonth(m_year, m_month))
+        return false;
+    // No support for dates before Gregorian calendar.
+    if (m_year == gregorianStartYear && m_month == gregorianStartMonth && day < gregorianStartDay)
+        return false;
+    m_monthDay = day;
+    end = index + 2;
+    return true;
+}
+
+bool ISODateTime::parseWeek(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseYear(src, length, start, index))
+        return false;
+
+    // 4 characters ('-' 'W' digit digit) are needed.
+    if (index + 3 >= length)
+        return false;
+    if (src[index] != '-')
+        return false;
+    ++index;
+    if (src[index] != 'W')
+        return false;
+    ++index;
+
+    int week;
+    if (!toInt(src, length, index, 2, week) || week < 1 || week > maxWeekNumberInYear())
+        return false;
+    // No support for years older than or equals to Gregorian calendar start year.
+    if (m_year <= gregorianStartYear)
+        return false;
+    m_week = week;
+    end = index + 2;
+    return true;
+}
+
+bool ISODateTime::parseTime(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    int hour;
+    if (!toInt(src, length, start, 2, hour) || hour < 0 || hour > 23)
+        return false;
+    unsigned index = start + 2;
+    if (index >= length)
+        return false;
+    if (src[index] != ':')
+        return false;
+    ++index;
+
+    int minute;
+    if (!toInt(src, length, index, 2, minute) || minute < 0 || minute > 59)
+        return false;
+    index += 2;
+
+    int second = 0;
+    int millisecond = 0;
+    // Optional second part.
+    // Do not return with false because the part is optional.
+    if (index + 2 < length && src[index] == ':') {
+        if (toInt(src, length, index + 1, 2, second) && second >= 0 && second <= 59) {
+            index += 3;
+
+            // Optional fractional second part.
+            if (index < length && src[index] == '.') {
+                unsigned digitsLength = countDigits(src, length, index + 1);
+                if (digitsLength >  0) {
+                    ++index;
+                    bool ok;
+                    if (digitsLength == 1) {
+                        ok = toInt(src, length, index, 1, millisecond);
+                        millisecond *= 100;
+                    } else if (digitsLength == 2) {
+                        ok = toInt(src, length, index, 2, millisecond);
+                        millisecond *= 10;
+                    } else // digitsLength >= 3
+                        ok = toInt(src, length, index, 3, millisecond);
+                    ASSERT(ok);
+                    index += digitsLength;
+                }
+            }
+        }
+    }
+    m_hour = hour;
+    m_minute = minute;
+    m_second = second;
+    m_millisecond = millisecond;
+    end = index;
+    return true;
+}
+
+bool ISODateTime::parseDateTimeLocal(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseDate(src, length, start, index))
+        return false;
+    if (index >= length)
+        return false;
+    if (src[index] != 'T')
+        return false;
+    ++index;
+    return parseTime(src, length, index, end);
+}
+
+bool ISODateTime::parseDateTime(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseDate(src, length, start, index))
+        return false;
+    if (index >= length)
+        return false;
+    if (src[index] != 'T')
+        return false;
+    ++index;
+    if (!parseTime(src, length, index, index))
+        return false;
+    return parseTimeZone(src, length, index, end);
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/ISODateTime.h b/WebCore/html/ISODateTime.h
new file mode 100644
index 0000000..ee4cfb9
--- /dev/null
+++ b/WebCore/html/ISODateTime.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ISODateTime_h
+#define ISODateTime_h
+
+#include <wtf/unicode/Unicode.h>
+
+namespace WebCore {
+
+// An ISODateTime instance represents one of the following date and time combinations:
+// * year-month
+// * year-month-day
+// * year-week
+// * hour-minute-second-millisecond
+// * year-month-day hour-minute-second-millisecond
+class ISODateTime {
+public:
+    ISODateTime()
+        : m_millisecond(0)
+        , m_second(0)
+        , m_minute(0)
+        , m_hour(0)
+        , m_monthDay(0)
+        , m_month(0)
+        , m_year(0)
+        , m_week(0)
+    {
+    }
+
+    int millisecond() const { return m_millisecond; }
+    int second() const { return m_second; }
+    int minute() const { return m_minute; }
+    int hour() const { return m_hour; }
+    int monthDay() const { return m_monthDay; }
+    int month() const { return m_month; }
+    int fullYear() const { return m_year; }
+    int week() const { return m_week; }
+
+    // The following six functions parse the input `src' whose length is
+    // `length', and updates some fields of this instance. The parsing starts at
+    // src[start] and examines characters before src[length].
+    // `src' `date' must be non-null. The `src' string doesn't need to be
+    // null-terminated.
+    // The functions return true if the parsing succeeds, and set `end' to the
+    // next index after the last consumed. Extra leading characters cause parse
+    // failures, and the trailing extra characters don't cause parse failures.
+
+    // Sets year and month.
+    bool parseMonth(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year, month and monthDay.
+    bool parseDate(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year and week.
+    bool parseWeek(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets hour, minute, second and millisecond.
+    bool parseTime(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year, month, monthDay, hour, minute, second and millisecond.
+    bool parseDateTimeLocal(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year, month, monthDay, hour, minute, second and millisecond, and adjusts timezone.
+    bool parseDateTime(const UChar* src, unsigned length, unsigned start, unsigned& end);
+
+private:
+    // Returns the maximum week number in this ISODateTime's year.
+    // The result is either of 52 and 53.
+    int maxWeekNumberInYear() const;
+    bool parseYear(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    bool addDay(int);
+    bool addMinute(int);
+    bool parseTimeZone(const UChar* src, unsigned length, unsigned start, unsigned& end);
+
+    // m_weekDay values
+    enum {
+        Sunday = 0,
+        Monday,
+        Tuesday,
+        Wednesday,
+        Thursday,
+        Friday,
+        Saturday,
+    };
+
+    int m_millisecond;  // 0 - 999
+    int m_second;
+    int m_minute;
+    int m_hour;
+    int m_monthDay;  // 1 - 31
+    int m_month;  // 0:January - 11:December
+    int m_year;  //  1582 -
+    int m_week;  // 1 - 53
+};
+
+
+} // namespace WebCore
+
+#endif // ISODateTime_h
diff --git a/WebCore/html/ValidityState.cpp b/WebCore/html/ValidityState.cpp
index 6b0a0b4..e7df225 100644
--- a/WebCore/html/ValidityState.cpp
+++ b/WebCore/html/ValidityState.cpp
@@ -26,6 +26,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "LocalizedStrings.h"
 #include "RegularExpression.h"
 #include <wtf/StdLibExtras.h>
 
@@ -43,6 +44,31 @@ ValidityState::ValidityState(HTMLFormControlElement* parent)
     ASSERT(parent);
 }
 
+String ValidityState::validationMessage()
+{
+    if (!control()->willValidate())
+        return String();
+
+    if (customError())
+        return m_customErrorMessage;
+    if (valueMissing())
+        return validationMessageValueMissingText();
+    if (typeMismatch())
+        return validationMessageTypeMismatchText();
+    if (patternMismatch())
+        return validationMessagePatternMismatchText();
+    if (tooLong())
+        return validationMessageTooLongText();
+    if (rangeUnderflow())
+        return validationMessageRangeUnderflowText();
+    if (rangeOverflow())
+        return validationMessageRangeOverflowText();
+    if (stepMismatch())
+        return validationMessageStepMismatchText();
+
+    return String();
+}
+
 bool ValidityState::typeMismatch()
 {
     if (!control()->hasTagName(inputTag))
@@ -74,6 +100,13 @@ bool ValidityState::typeMismatch()
 
         return false;
     }
+    case HTMLInputElement::DATE:
+    case HTMLInputElement::DATETIME:
+    case HTMLInputElement::DATETIMELOCAL:
+    case HTMLInputElement::MONTH:
+    case HTMLInputElement::TIME:
+    case HTMLInputElement::WEEK:
+        return !HTMLInputElement::formStringToISODateTime(input->inputType(), value, 0);
     default:
         return false;
     }
@@ -93,6 +126,13 @@ bool ValidityState::rangeOverflow()
     return static_cast<HTMLInputElement*>(control())->rangeOverflow();
 }
 
+bool ValidityState::stepMismatch()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->stepMismatch();
+}
+
 bool ValidityState::valid()
 {
     bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow() ||
diff --git a/WebCore/html/ValidityState.h b/WebCore/html/ValidityState.h
index 1dee306..7ae95d7 100644
--- a/WebCore/html/ValidityState.h
+++ b/WebCore/html/ValidityState.h
@@ -38,6 +38,7 @@ namespace WebCore {
 
         HTMLFormControlElement* control() const { return m_control; }
 
+        String validationMessage();
         void setCustomErrorMessage(const String& message) { m_customErrorMessage = message; }
 
         bool valueMissing() { return control()->valueMissing(); }
@@ -46,7 +47,7 @@ namespace WebCore {
         bool tooLong() { return control()->tooLong(); }
         bool rangeUnderflow();
         bool rangeOverflow();
-        bool stepMismatch() { return false; }
+        bool stepMismatch();
         bool customError() { return !m_customErrorMessage.isEmpty(); }
         bool valid();
 
diff --git a/WebCore/html/canvas/CanvasByteArray.h b/WebCore/html/canvas/CanvasByteArray.h
deleted file mode 100644
index 69cadf7..0000000
--- a/WebCore/html/canvas/CanvasByteArray.h
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasByteArray_h
-#define CanvasByteArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasArrayBuffer;
-
-    class CanvasByteArray : public CanvasArray {
-    public:
-        virtual bool isByteArray() const { return true; }
-
-        static PassRefPtr<CanvasByteArray> create(unsigned length);
-        static PassRefPtr<CanvasByteArray> create(signed char* array, unsigned length);
-        static PassRefPtr<CanvasByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        char* data() { return static_cast<char*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<signed char>::min())
-                value = std::numeric_limits<signed char>::min();
-            else if (value > std::numeric_limits<signed char>::max())
-                value = std::numeric_limits<signed char>::max();
-            signed char* storage = static_cast<signed char*>(m_baseAddress);
-            storage[index] = static_cast<signed char>(value);
-        }
-        
-        bool get(unsigned index, signed char& result) const
-        {
-            if (index >= m_size)
-                return false;
-            signed char* storage = static_cast<signed char*>(m_baseAddress);
-            result = storage[index];
-            return true;
-        }
-
-        signed char item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            signed char* storage = static_cast<signed char*>(m_baseAddress);
-            return storage[index];
-        }
-    private:
-        CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                        int offset,
-                        unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasByteArray_h
diff --git a/WebCore/html/canvas/CanvasFloatArray.cpp b/WebCore/html/canvas/CanvasFloatArray.cpp
deleted file mode 100644
index 09561cb..0000000
--- a/WebCore/html/canvas/CanvasFloatArray.cpp
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasFloatArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(float));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(float* array, unsigned length)
-    {
-        RefPtr<CanvasFloatArray> a = CanvasFloatArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(float)) != 0)
-            return NULL;
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(float))) > buffer->byteLength())
-                return NULL;
-        }
-        return adoptRef(new CanvasFloatArray(buffer, offset, length));
-    }
-    
-    CanvasFloatArray::CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasFloatArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasFloatArray::sizeInBytes() const {
-        return length() * sizeof(float);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasFloatArray.h b/WebCore/html/canvas/CanvasFloatArray.h
deleted file mode 100644
index d2dc4ff..0000000
--- a/WebCore/html/canvas/CanvasFloatArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasFloatArray_h
-#define CanvasFloatArray_h
-
-#include "CanvasArray.h"
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasFloatArray : public CanvasArray {
-    public:
-        virtual bool isFloatArray() const { return true; }
-
-        static PassRefPtr<CanvasFloatArray> create(unsigned length);
-        static PassRefPtr<CanvasFloatArray> create(float* array, unsigned length);
-        static PassRefPtr<CanvasFloatArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        float* data() { return static_cast<float*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            float* storage = static_cast<float*>(m_baseAddress);
-            storage[index] = static_cast<float>(value);
-        }
-        
-        bool get(unsigned index, float& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        float item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            float* storage = static_cast<float*>(m_baseAddress);
-            float result = storage[index];
-            if (isnan(result)) {
-                // Clamp NaN to 0
-                result = 0;
-            }
-            return result;
-        }
-    private:
-        CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasFloatArray_h
diff --git a/WebCore/html/canvas/CanvasIntArray.cpp b/WebCore/html/canvas/CanvasIntArray.cpp
deleted file mode 100644
index 4716d7b..0000000
--- a/WebCore/html/canvas/CanvasIntArray.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasIntArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasIntArray> CanvasIntArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(int));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasIntArray> CanvasIntArray::create(int* array, unsigned length)
-    {
-        RefPtr<CanvasIntArray> a = CanvasIntArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasIntArray> CanvasIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                      int offset,
-                                                      unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(int)) != 0)
-            return NULL;
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(int))) > buffer->byteLength())
-                return NULL;
-        }
-        
-        return adoptRef(new CanvasIntArray(buffer, offset, length));
-    }
-    
-    CanvasIntArray::CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasIntArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasIntArray::sizeInBytes() const {
-        return length() * sizeof(int);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasIntArray.h b/WebCore/html/canvas/CanvasIntArray.h
deleted file mode 100644
index 4977034..0000000
--- a/WebCore/html/canvas/CanvasIntArray.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasIntArray_h
-#define CanvasIntArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasIntArray : public CanvasArray {
-    public:
-        virtual bool isIntArray() const { return true; }
-
-        static PassRefPtr<CanvasIntArray> create(unsigned length);
-        static PassRefPtr<CanvasIntArray> create(int* array, unsigned length);
-        static PassRefPtr<CanvasIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        int* data() { return static_cast<int*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<int>::min())
-                value = std::numeric_limits<int>::min();
-            else if (value > std::numeric_limits<int>::max())
-                value = std::numeric_limits<int>::max();
-            int* storage = static_cast<int*>(m_baseAddress);
-            storage[index] = static_cast<int>(value);
-        }
-        
-        bool get(unsigned index, int& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        int item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            int* storage = static_cast<int*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                       int offset,
-                       unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasIntArray_h
diff --git a/WebCore/html/canvas/CanvasObject.cpp b/WebCore/html/canvas/CanvasObject.cpp
index 8a71a45..6c7667b 100644
--- a/WebCore/html/canvas/CanvasObject.cpp
+++ b/WebCore/html/canvas/CanvasObject.cpp
@@ -28,12 +28,13 @@
 #if ENABLE(3D_CANVAS)
 
 #include "CanvasObject.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-CanvasObject::CanvasObject(CanvasRenderingContext3D* context)
+CanvasObject::CanvasObject(WebGLRenderingContext* context)
     : m_object(0)
+    , m_shouldDeleteObject(true)
     , m_context(context)
 {
 }
@@ -44,24 +45,27 @@ CanvasObject::~CanvasObject()
         m_context->removeObject(this);
 }
 
-void CanvasObject::setObject(Platform3DObject object)
+void CanvasObject::setObject(Platform3DObject object, bool shouldDeleteObject)
 {
     if (object == m_object)
         return;
         
     deleteObject();
     m_object = object;
+    m_shouldDeleteObject = shouldDeleteObject;
 }
 
 void CanvasObject::deleteObject()
 {
     if (m_object) {
-        if (m_context) {
-            m_context->graphicsContext3D()->makeContextCurrent();
-            _deleteObject(m_object);
-        }
+        if (m_shouldDeleteObject)
+            if (m_context) {
+                m_context->graphicsContext3D()->makeContextCurrent();
+                _deleteObject(m_object);
+            }
         m_object = 0;
     }
+    m_shouldDeleteObject = true;
 }
 
 }
diff --git a/WebCore/html/canvas/CanvasObject.h b/WebCore/html/canvas/CanvasObject.h
index 748278d..b7b016a 100644
--- a/WebCore/html/canvas/CanvasObject.h
+++ b/WebCore/html/canvas/CanvasObject.h
@@ -33,14 +33,14 @@
 
 namespace WebCore {
 
-    class CanvasRenderingContext3D;
+    class WebGLRenderingContext;
     
     class CanvasObject : public RefCounted<CanvasObject> {
     public:
         virtual ~CanvasObject();
         
         Platform3DObject object() const { return m_object; }
-        void setObject(Platform3DObject);
+        void setObject(Platform3DObject, bool shouldDeleteObject = true);
         void deleteObject();
         
         void detachContext()
@@ -49,15 +49,22 @@ namespace WebCore {
             m_context = 0;
         }
 
-        CanvasRenderingContext3D* context() const { return m_context; }
+        WebGLRenderingContext* context() const { return m_context; }
 
     protected:
-        CanvasObject(CanvasRenderingContext3D*);
+        CanvasObject(WebGLRenderingContext*);
         virtual void _deleteObject(Platform3DObject) = 0;
     
     private:
         Platform3DObject m_object;
-        CanvasRenderingContext3D* m_context;
+        // The shouldDeleteObject flag indicates whether this wrapper
+        // owns the underlying resource and should delete it when the
+        // wrapper is unreferenced for the last time and deleted. It
+        // is only set to false for certain objects returned from get
+        // queries. FIXME: should consider canonicalizing all of these
+        // objects in the future.
+        bool m_shouldDeleteObject;
+        WebGLRenderingContext* m_context;
     };
     
 } // namespace WebCore
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.idl b/WebCore/html/canvas/CanvasRenderbuffer.idl
deleted file mode 100644
index 5e47cc3..0000000
--- a/WebCore/html/canvas/CanvasRenderbuffer.idl
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-module html {
-    interface [Conditional=3D_CANVAS] CanvasRenderbuffer {
-    };
-}
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 3341901..1ae9f75 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -355,6 +355,9 @@ void CanvasRenderingContext2D::scale(float sx, float sy)
     if (!state().m_invertibleCTM)
         return;
 
+    if (!isfinite(sx) | !isfinite(sy))
+        return;
+
     TransformationMatrix newTransform = state().m_transform;
     newTransform.scaleNonUniform(sx, sy);
     if (!newTransform.isInvertible()) {
@@ -375,6 +378,9 @@ void CanvasRenderingContext2D::rotate(float angleInRadians)
     if (!state().m_invertibleCTM)
         return;
 
+    if (!isfinite(angleInRadians))
+        return;
+
     TransformationMatrix newTransform = state().m_transform;
     newTransform.rotate(angleInRadians / piDouble * 180.0);
     if (!newTransform.isInvertible()) {
@@ -395,6 +401,9 @@ void CanvasRenderingContext2D::translate(float tx, float ty)
     if (!state().m_invertibleCTM)
         return;
 
+    if (!isfinite(tx) | !isfinite(ty))
+        return;
+
     TransformationMatrix newTransform = state().m_transform;
     newTransform.translate(tx, ty);
     if (!newTransform.isInvertible()) {
@@ -414,8 +423,7 @@ void CanvasRenderingContext2D::transform(float m11, float m12, float m21, float
         return;
     if (!state().m_invertibleCTM)
         return;
-    
-    // HTML5 3.14.11.1 -- ignore any calls that pass non-finite numbers
+
     if (!isfinite(m11) | !isfinite(m21) | !isfinite(dx) | 
         !isfinite(m12) | !isfinite(m22) | !isfinite(dy))
         return;
@@ -438,7 +446,6 @@ void CanvasRenderingContext2D::setTransform(float m11, float m12, float m21, flo
     if (!c)
         return;
     
-    // HTML5 3.14.11.1 -- ignore any calls that pass non-finite numbers
     if (!isfinite(m11) | !isfinite(m21) | !isfinite(dx) | 
         !isfinite(m12) | !isfinite(m22) | !isfinite(dy))
         return;
@@ -817,7 +824,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
         return;
 
     RGBA32 rgba = makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, 1.0f);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, const String& color, float alpha)
@@ -833,7 +840,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     RGBA32 rgba = 0; // default is transparent black
     if (!state().m_shadowColor.isEmpty())
         CSSParser::parseColor(rgba, state().m_shadowColor);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(colorWithOverrideAlpha(rgba, alpha)));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(colorWithOverrideAlpha(rgba, alpha)), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float grayLevel, float alpha)
@@ -847,7 +854,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
         return;
 
     RGBA32 rgba = makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, alpha);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float r, float g, float b, float a)
@@ -863,7 +870,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     RGBA32 rgba = makeRGBA32FromFloats(r, g, b, a); // default is transparent black
     if (!state().m_shadowColor.isEmpty())
         CSSParser::parseColor(rgba, state().m_shadowColor);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float c, float m, float y, float k, float a)
@@ -883,7 +890,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     CGContextSetShadowWithColor(dc->platformContext(), adjustedShadowSize(width, -height), blur, shadowColor);
     CGColorRelease(shadowColor);
 #else
-    dc->setShadow(IntSize(width, -height), blur, Color(c, m, y, k, a));
+    dc->setShadow(IntSize(width, -height), blur, Color(c, m, y, k, a), DeviceColorSpace);
 #endif
 }
 
@@ -906,7 +913,7 @@ void CanvasRenderingContext2D::applyShadow()
         CSSParser::parseColor(rgba, state().m_shadowColor);
     float width = state().m_shadowOffset.width();
     float height = state().m_shadowOffset.height();
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 static IntSize size(HTMLImageElement* image)
@@ -995,7 +1002,7 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
     FloatRect sourceRect = c->roundToDevicePixels(srcRect);
     FloatRect destRect = c->roundToDevicePixels(dstRect);
     willDraw(destRect);
-    c->drawImage(cachedImage->image(), destRect, sourceRect, state().m_globalComposite);
+    c->drawImage(cachedImage->image(), DeviceColorSpace, destRect, sourceRect, state().m_globalComposite);
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas, float x, float y)
@@ -1045,7 +1052,7 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const
     if (!sourceCanvas->originClean())
         canvas()->setOriginTainted();
 
-    c->drawImage(buffer->image(), destRect, sourceRect, state().m_globalComposite);
+    c->drawImage(buffer->image(), DeviceColorSpace, destRect, sourceRect, state().m_globalComposite);
     willDraw(destRect); // This call comes after drawImage, since the buffer we draw into may be our own, and we need to make sure it is dirty.
                         // FIXME: Arguably willDraw should become didDraw and occur after drawing calls and not before them to avoid problems like this.
 }
@@ -1139,7 +1146,7 @@ void CanvasRenderingContext2D::drawImageFromRect(HTMLImageElement* image,
 
     FloatRect destRect = FloatRect(dx, dy, dw, dh);
     willDraw(destRect);
-    c->drawImage(cachedImage->image(), destRect, FloatRect(sx, sy, sw, sh), op);
+    c->drawImage(cachedImage->image(), DeviceColorSpace, destRect, FloatRect(sx, sy, sw, sh), op);
 }
 
 void CanvasRenderingContext2D::setAlpha(float alpha)
@@ -1526,9 +1533,9 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         GraphicsContext* maskImageContext = maskImage->context();
 
         if (fill)
-            maskImageContext->setFillColor(Color::black);
+            maskImageContext->setFillColor(Color::black, DeviceColorSpace);
         else {
-            maskImageContext->setStrokeColor(Color::black);
+            maskImageContext->setStrokeColor(Color::black, DeviceColorSpace);
             maskImageContext->setStrokeThickness(c->strokeThickness());
         }
 
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/WebCore/html/canvas/CanvasRenderingContext3D.cpp
deleted file mode 100644
index 612b4c3..0000000
--- a/WebCore/html/canvas/CanvasRenderingContext3D.cpp
+++ /dev/null
@@ -1,1441 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasRenderingContext3D.h"
-
-#include "CanvasActiveInfo.h"
-#include "CanvasBuffer.h"
-#include "CanvasFramebuffer.h"
-#include "CanvasProgram.h"
-#include "CanvasRenderbuffer.h"
-#include "CanvasTexture.h"
-#include "CanvasShader.h"
-#include "HTMLCanvasElement.h"
-#include "RenderBox.h"
-#include "RenderLayer.h"
-
-namespace WebCore {
-
-PassOwnPtr<CanvasRenderingContext3D> CanvasRenderingContext3D::create(HTMLCanvasElement* canvas)
-{
-    OwnPtr<GraphicsContext3D> context(GraphicsContext3D::create());
-    if (!context)
-        return 0;
-        
-    return new CanvasRenderingContext3D(canvas, context.release());
-}
-
-CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* passedCanvas, PassOwnPtr<GraphicsContext3D> context)
-    : CanvasRenderingContext(passedCanvas)
-    , m_context(context)
-    , m_needsUpdate(true)
-    , m_markedCanvasDirty(false)
-{
-    ASSERT(m_context);
-    m_context->reshape(canvas()->width(), canvas()->height());
-}
-
-CanvasRenderingContext3D::~CanvasRenderingContext3D()
-{
-    detachAndRemoveAllObjects();
-}
-
-void CanvasRenderingContext3D::markContextChanged()
-{
-#if USE(ACCELERATED_COMPOSITING)
-    if (canvas()->renderBox() && canvas()->renderBox()->hasLayer()) {
-        canvas()->renderBox()->layer()->rendererContentChanged();
-    } else {
-#endif
-        if (!m_markedCanvasDirty) {
-            // Make sure the canvas's image buffer is allocated.
-            canvas()->buffer();
-            canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
-            m_markedCanvasDirty = true;
-        }
-#if USE(ACCELERATED_COMPOSITING)
-    }
-#endif
-}
-
-void CanvasRenderingContext3D::beginPaint()
-{
-    if (m_markedCanvasDirty) {
-        m_context->beginPaint(this);
-    }
-}
-
-void CanvasRenderingContext3D::endPaint()
-{
-    if (m_markedCanvasDirty) {
-        m_markedCanvasDirty = false;
-        m_context->endPaint();
-    }
-}
-
-void CanvasRenderingContext3D::reshape(int width, int height)
-{
-    if (m_needsUpdate) {
-#if USE(ACCELERATED_COMPOSITING)
-        if (canvas()->renderBox() && canvas()->renderBox()->hasLayer())
-            canvas()->renderBox()->layer()->rendererContentChanged();
-#endif
-        m_needsUpdate = false;
-    }
-    
-    m_context->reshape(width, height);
-}
-
-int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
-{
-    int result = m_context->sizeInBytes(type);
-    if (result <= 0) {
-        ec = SYNTAX_ERR;
-    }
-    return result;
-}
-
-void CanvasRenderingContext3D::activeTexture(unsigned long texture)
-{
-    m_context->activeTexture(texture);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
-{
-    if (!program || !shader)
-        return;
-    m_context->attachShader(program, shader);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
-{
-    if (!program)
-        return;
-    m_context->bindAttribLocation(program, index, name);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
-{
-    m_context->bindBuffer(target, buffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
-{
-    m_context->bindFramebuffer(target, buffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
-{
-    m_context->bindRenderbuffer(target, renderbuffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
-{
-    m_context->bindTexture(target, texture);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::blendColor(double red, double green, double blue, double alpha)
-{
-    m_context->blendColor(red, green, blue, alpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::blendEquation( unsigned long mode )
-{
-    m_context->blendEquation(mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
-{
-    m_context->blendEquationSeparate(modeRGB, modeAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
-{
-    m_context->blendFunc(sfactor, dfactor);
-    cleanupAfterGraphicsCall(false);
-}       
-
-void CanvasRenderingContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
-{
-    m_context->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bufferData(unsigned long target, int size, unsigned long usage)
-{
-    m_context->bufferData(target, size, usage);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bufferData(unsigned long target, CanvasArray* data, unsigned long usage)
-{
-    m_context->bufferData(target, data, usage);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* data)
-{
-    m_context->bufferSubData(target, offset, data);
-    cleanupAfterGraphicsCall(false);
-}
-
-unsigned long CanvasRenderingContext3D::checkFramebufferStatus(unsigned long target)
-{
-    return m_context->checkFramebufferStatus(target);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::clear(unsigned long mask)
-{
-    m_context->clear(mask);
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::clearColor(double r, double g, double b, double a)
-{
-    if (isnan(r))
-        r = 0;
-    if (isnan(g))
-        g = 0;
-    if (isnan(b))
-        b = 0;
-    if (isnan(a))
-        a = 1;
-    m_context->clearColor(r, g, b, a);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::clearDepth(double depth)
-{
-    m_context->clearDepth(depth);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::clearStencil(long s)
-{
-    m_context->clearStencil(s);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
-{
-    m_context->colorMask(red, green, blue, alpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::compileShader(CanvasShader* shader)
-{
-    m_context->compileShader(shader);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
-{
-    m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
-{
-    m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-PassRefPtr<CanvasBuffer> CanvasRenderingContext3D::createBuffer()
-{
-    RefPtr<CanvasBuffer> o = CanvasBuffer::create(this);
-    addObject(o.get());
-    return o;
-}
-        
-PassRefPtr<CanvasFramebuffer> CanvasRenderingContext3D::createFramebuffer()
-{
-    RefPtr<CanvasFramebuffer> o = CanvasFramebuffer::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasTexture> CanvasRenderingContext3D::createTexture()
-{
-    RefPtr<CanvasTexture> o = CanvasTexture::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasProgram> CanvasRenderingContext3D::createProgram()
-{
-    RefPtr<CanvasProgram> o = CanvasProgram::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasRenderbuffer> CanvasRenderingContext3D::createRenderbuffer()
-{
-    RefPtr<CanvasRenderbuffer> o = CanvasRenderbuffer::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasShader> CanvasRenderingContext3D::createShader(unsigned long type)
-{
-    // FIXME: Need to include GL_ constants for internal use
-    // FIXME: Need to do param checking and throw exception if an illegal value is passed in
-    GraphicsContext3D::ShaderType shaderType = GraphicsContext3D::VERTEX_SHADER;
-    if (type == 0x8B30) // GL_FRAGMENT_SHADER
-        shaderType = GraphicsContext3D::FRAGMENT_SHADER;
-        
-    RefPtr<CanvasShader> o = CanvasShader::create(this, shaderType);
-    addObject(o.get());
-    return o;
-}
-
-void CanvasRenderingContext3D::cullFace(unsigned long mode)
-{
-    m_context->cullFace(mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::deleteBuffer(CanvasBuffer* buffer)
-{
-    if (!buffer)
-        return;
-    
-    buffer->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteFramebuffer(CanvasFramebuffer* framebuffer)
-{
-    if (!framebuffer)
-        return;
-    
-    framebuffer->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteProgram(CanvasProgram* program)
-{
-    if (!program)
-        return;
-    
-    program->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteRenderbuffer(CanvasRenderbuffer* renderbuffer)
-{
-    if (!renderbuffer)
-        return;
-    
-    renderbuffer->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteShader(CanvasShader* shader)
-{
-    if (!shader)
-        return;
-    
-    shader->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteTexture(CanvasTexture* texture)
-{
-    if (!texture)
-        return;
-    
-    texture->deleteObject();
-}
-
-void CanvasRenderingContext3D::depthFunc(unsigned long func)
-{
-    m_context->depthFunc(func);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::depthMask(bool flag)
-{
-    m_context->depthMask(flag);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::depthRange(double zNear, double zFar)
-{
-    m_context->depthRange(zNear, zFar);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
-{
-    if (!program || !shader)
-        return;
-
-    m_context->detachShader(program, shader);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::disable(unsigned long cap)
-{
-    m_context->disable(cap);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::disableVertexAttribArray(unsigned long index)
-{
-    m_context->disableVertexAttribArray(index);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::drawArrays(unsigned long mode, long first, long count)
-{
-    m_context->drawArrays(mode, first, count);
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
-{
-    m_context->drawElements(mode, count, type, offset);
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::enable(unsigned long cap)
-{
-    m_context->enable(cap);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::enableVertexAttribArray(unsigned long index)
-{
-    m_context->enableVertexAttribArray(index);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::finish()
-{
-    m_context->finish();
-    cleanupAfterGraphicsCall(true);
-}
-
-
-void CanvasRenderingContext3D::flush()
-{
-    m_context->flush();
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
-{
-    if (!buffer)
-        return;
-        
-    m_context->framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
-{
-    if (!texture)
-        return;
-        
-    m_context->framebufferTexture2D(target, attachment, textarget, texture, level);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::frontFace(unsigned long mode)
-{
-    m_context->frontFace(mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::generateMipmap(unsigned long target)
-{
-    m_context->generateMipmap(target);
-    cleanupAfterGraphicsCall(false);
-}
-
-PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
-{
-    ActiveInfo info;
-    if (!program || program->context() != this || !m_context->getActiveAttrib(program, index, info)) {
-        ec = INDEX_SIZE_ERR;
-        return 0;
-    }
-    return CanvasActiveInfo::create(info.name, info.type, info.size);
-}
-
-PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
-{
-    ActiveInfo info;
-    if (!program || program->context() != this || !m_context->getActiveUniform(program, index, info)) {
-        ec = INDEX_SIZE_ERR;
-        return 0;
-    }
-    return CanvasActiveInfo::create(info.name, info.type, info.size);
-}
-
-int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
-{
-    return m_context->getAttribLocation(program, name);
-}
-
-bool CanvasRenderingContext3D::getBoolean(unsigned long pname)
-{
-    bool result = m_context->getBoolean(pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasUnsignedByteArray> CanvasRenderingContext3D::getBooleanv(unsigned long pname)
-{
-    RefPtr<CanvasUnsignedByteArray> array = m_context->getBooleanv(pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
-{
-    int result = m_context->getBufferParameteri(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getBufferParameteriv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-unsigned long CanvasRenderingContext3D::getError()
-{
-    return m_context->getError();
-}
-
-float CanvasRenderingContext3D::getFloat(unsigned long pname)
-{
-    float result = m_context->getFloat(pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getFloatv(unsigned long pname)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getFloatv(pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
-{
-    int result = m_context->getFramebufferAttachmentParameteri(target, attachment, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getFramebufferAttachmentParameteriv(target, attachment, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getInteger(unsigned long pname)
-{
-    float result = m_context->getInteger(pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getIntegerv(unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getIntegerv(pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
-{
-    int result = m_context->getProgrami(program, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getProgramiv(program, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-String CanvasRenderingContext3D::getProgramInfoLog(CanvasProgram* program)
-{
-    String s = m_context->getProgramInfoLog(program);
-    cleanupAfterGraphicsCall(false);
-    return s;
-}
-
-int CanvasRenderingContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
-{
-    int result = m_context->getRenderbufferParameteri(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getRenderbufferParameteriv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
-{
-    int result = m_context->getShaderi(shader, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getShaderiv(shader, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-String CanvasRenderingContext3D::getShaderInfoLog(CanvasShader* shader)
-{
-    String s = m_context->getShaderInfoLog(shader);
-    cleanupAfterGraphicsCall(false);
-    return s;
-}
-
-String CanvasRenderingContext3D::getShaderSource(CanvasShader* shader)
-{
-    String s = m_context->getShaderSource(shader);
-    cleanupAfterGraphicsCall(false);
-    return s;
-}
-
-String CanvasRenderingContext3D::getString(unsigned long name)
-{
-    return m_context->getString(name);
-}
-
-float CanvasRenderingContext3D::getTexParameterf(unsigned long target, unsigned long pname)
-{
-    float result = m_context->getTexParameterf(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getTexParameterfv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getTexParameteri(unsigned long target, unsigned long pname)
-{
-    int result = m_context->getTexParameteri(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getTexParameteriv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-float CanvasRenderingContext3D::getUniformf(CanvasProgram* program, long location)
-{
-    float result = m_context->getUniformf(program, location);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getUniformfv(CanvasProgram* program, long location)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getUniformfv(program, location);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getUniformi(CanvasProgram* program, long location)
-{
-    long result = m_context->getUniformi(program, location);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getUniformiv(CanvasProgram* program, long location)
-{
-    RefPtr<CanvasIntArray> array = m_context->getUniformiv(program, location);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getUniformLocation(CanvasProgram* program, const String& name)
-{
-    return m_context->getUniformLocation(program, name);
-}
-
-float CanvasRenderingContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
-{
-    float result = m_context->getVertexAttribf(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getVertexAttribfv(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
-{
-    long result = m_context->getVertexAttribi(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getVertexAttribiv(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
-{
-    long result = m_context->getVertexAttribOffset(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-void CanvasRenderingContext3D::hint(unsigned long target, unsigned long mode)
-{
-    m_context->hint(target, mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-bool CanvasRenderingContext3D::isBuffer(CanvasBuffer* buffer)
-{
-    if (!buffer)
-        return false;
-        
-    return m_context->isBuffer(buffer);
-}
-
-bool CanvasRenderingContext3D::isEnabled(unsigned long cap)
-{
-    return m_context->isEnabled(cap);
-}
-
-bool CanvasRenderingContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
-{
-    return m_context->isFramebuffer(framebuffer);
-}
-
-bool CanvasRenderingContext3D::isProgram(CanvasProgram* program)
-{
-    return m_context->isProgram(program);
-}
-
-bool CanvasRenderingContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
-{
-    return m_context->isRenderbuffer(renderbuffer);
-}
-
-bool CanvasRenderingContext3D::isShader(CanvasShader* shader)
-{
-    return m_context->isShader(shader);
-}
-
-bool CanvasRenderingContext3D::isTexture(CanvasTexture* texture)
-{
-    return m_context->isTexture(texture);
-}
-
-void CanvasRenderingContext3D::lineWidth(double width)
-{
-    m_context->lineWidth((float) width);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::linkProgram(CanvasProgram* program)
-{
-    if (!program)
-        return;
-        
-    m_context->linkProgram(program);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::pixelStorei(unsigned long pname, long param)
-{
-    m_context->pixelStorei(pname, param);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::polygonOffset(double factor, double units)
-{
-    m_context->polygonOffset((float) factor, (float) units);
-    cleanupAfterGraphicsCall(false);
-}
-
-PassRefPtr<CanvasArray> CanvasRenderingContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
-{
-    RefPtr<CanvasArray> array = m_context->readPixels(x, y, width, height, format, type);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-void CanvasRenderingContext3D::releaseShaderCompiler()
-{
-    m_context->releaseShaderCompiler();
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
-{
-    m_context->renderbufferStorage(target, internalformat, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::sampleCoverage(double value, bool invert)
-{
-    m_context->sampleCoverage((float) value, invert);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
-{
-    m_context->scissor(x, y, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::shaderSource(CanvasShader* shader, const String& string)
-{
-    m_context->shaderSource(shader, string);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
-{
-    m_context->stencilFunc(func, ref, mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
-{
-    m_context->stencilFuncSeparate(face, func, ref, mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilMask(unsigned long mask)
-{
-    m_context->stencilMask(mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
-{
-    m_context->stencilMaskSeparate(face, mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
-{
-    m_context->stencilOp(fail, zfail, zpass);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
-{
-    m_context->stencilOpSeparate(face, fail, zfail, zpass);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                                          unsigned width, unsigned height, unsigned border,
-                                          unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, internalformat, width, height,
-                         border, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                                          unsigned width, unsigned height, unsigned border,
-                                          unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, internalformat, width, height,
-                         border, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
-                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, image, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
-                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, canvas, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
-                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, video, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texParameterf(unsigned target, unsigned pname, float param)
-{
-    m_context->texParameterf(target, pname, param);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texParameteri(unsigned target, unsigned pname, int param)
-{
-    m_context->texParameteri(target, pname, param);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height,
-                                             unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height,
-                                             unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height, HTMLImageElement* image,
-                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height, HTMLCanvasElement* canvas,
-                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height, HTMLVideoElement* video,
-                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1f(long location, float x)
-{
-    m_context->uniform1f(location, x);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1fv(location, v->data(), v->length());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1fv(location, v, size);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1i(long location, int x)
-{
-    m_context->uniform1i(location, x);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1iv(location, v->data(), v->length());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1iv(location, v, size);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2f(long location, float x, float y)
-{
-    m_context->uniform2f(location, x, y);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2fv(location, v->data(), v->length() / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2fv(location, v, size / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2i(long location, int x, int y)
-{
-    m_context->uniform2i(location, x, y);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2iv(location, v->data(), v->length() / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2iv(location, v, size / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3f(long location, float x, float y, float z)
-{
-    m_context->uniform3f(location, x, y, z);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3fv(location, v->data(), v->length() / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3fv(location, v, size / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3i(long location, int x, int y, int z)
-{
-    m_context->uniform3i(location, x, y, z);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3iv(location, v->data(), v->length() / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3iv(location, v, size / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4f(long location, float x, float y, float z, float w)
-{
-    m_context->uniform4f(location, x, y, z, w);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4fv(location, v->data(), v->length() / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4fv(location, v, size / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4i(long location, int x, int y, int z, int w)
-{
-    m_context->uniform4i(location, x, y, z, w);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4iv(location, v->data(), v->length() / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4iv(location, v, size / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniformMatrix2fv(location, transpose, v, size / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 9
-    m_context->uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 9
-    m_context->uniformMatrix3fv(location, transpose, v, size / 9);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 16
-    m_context->uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 16
-    m_context->uniformMatrix4fv(location, transpose, v, size / 16);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::useProgram(CanvasProgram* program)
-{
-    m_context->useProgram(program);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::validateProgram(CanvasProgram* program)
-{
-    m_context->validateProgram(program);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib1f(unsigned long indx, float v0)
-{
-    m_context->vertexAttrib1f(indx, v0);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib1fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib1fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
-{
-    m_context->vertexAttrib2f(indx, v0, v1);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib2fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib2fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
-{
-    m_context->vertexAttrib3f(indx, v0, v1, v2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib3fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib3fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
-{
-    m_context->vertexAttrib4f(indx, v0, v1, v2, v3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib4fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib4fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset)
-{
-    m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
-{
-    if (isnan(x))
-        x = 0;
-    if (isnan(y))
-        y = 0;
-    if (isnan(width))
-        width = 100;
-    if (isnan(height))
-        height = 100;
-    m_context->viewport(x, y, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::removeObject(CanvasObject* object)
-{
-    m_canvasObjects.remove(object);
-}
-
-void CanvasRenderingContext3D::addObject(CanvasObject* object)
-{
-    removeObject(object);
-    m_canvasObjects.add(object);
-}
-
-void CanvasRenderingContext3D::detachAndRemoveAllObjects()
-{
-    HashSet<CanvasObject*>::iterator pend = m_canvasObjects.end();
-    for (HashSet<CanvasObject*>::iterator it = m_canvasObjects.begin(); it != pend; ++it)
-        (*it)->detachContext();
-        
-    m_canvasObjects.clear();
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.h b/WebCore/html/canvas/CanvasRenderingContext3D.h
deleted file mode 100644
index 70d9b95..0000000
--- a/WebCore/html/canvas/CanvasRenderingContext3D.h
+++ /dev/null
@@ -1,327 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasRenderingContext3D_h
-#define CanvasRenderingContext3D_h
-
-#include "CanvasRenderingContext.h"
-#include "ExceptionCode.h"
-#include "CanvasFloatArray.h"
-#include "CanvasIntArray.h"
-#include "CanvasUnsignedByteArray.h"
-#include "GraphicsContext3D.h"
-#include "PlatformString.h"
-
-namespace WebCore {
-
-class CanvasActiveInfo;
-class CanvasBuffer;
-class CanvasFramebuffer;
-class CanvasObject;
-class CanvasProgram;
-class CanvasRenderbuffer;
-class CanvasShader;
-class CanvasTexture;
-class HTMLImageElement;
-class HTMLVideoElement;
-class ImageData;
-class WebKitCSSMatrix;
-
-    class CanvasRenderingContext3D : public CanvasRenderingContext {
-    public:
-        static PassOwnPtr<CanvasRenderingContext3D> create(HTMLCanvasElement*);
-        virtual ~CanvasRenderingContext3D();
-
-        virtual bool is3d() const { return true; }
-
-        // Helper to return the size in bytes of OpenGL data types
-        // like GL_FLOAT, GL_INT, etc.
-        int sizeInBytes(int type, ExceptionCode& ec);
-
-        void activeTexture(unsigned long texture);
-        void attachShader(CanvasProgram*, CanvasShader*);
-        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
-        void bindBuffer(unsigned long target, CanvasBuffer*);
-        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
-        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
-        void bindTexture(unsigned long target, CanvasTexture*);
-        void blendColor(double red, double green, double blue, double alpha);
-        void blendEquation(unsigned long mode);
-        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
-        void blendFunc(unsigned long sfactor, unsigned long dfactor);
-        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
-
-        void bufferData(unsigned long target, int size, unsigned long usage);
-        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
-        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
-
-        unsigned long checkFramebufferStatus(unsigned long target);
-        void clear(unsigned long mask);
-        void clearColor(double red, double green, double blue, double alpha);
-        void clearDepth(double);
-        void clearStencil(long);
-        void colorMask(bool red, bool green, bool blue, bool alpha);
-        void compileShader(CanvasShader*);
-        
-        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
-        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
-        
-        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
-        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
-
-        PassRefPtr<CanvasBuffer> createBuffer();
-        PassRefPtr<CanvasFramebuffer> createFramebuffer();
-        PassRefPtr<CanvasProgram> createProgram();
-        PassRefPtr<CanvasRenderbuffer> createRenderbuffer();
-        PassRefPtr<CanvasShader> createShader(unsigned long type);
-        PassRefPtr<CanvasTexture> createTexture();
-
-        void cullFace(unsigned long mode);
-
-        void deleteBuffer(CanvasBuffer*);
-        void deleteFramebuffer(CanvasFramebuffer*);
-        void deleteProgram(CanvasProgram*);
-        void deleteRenderbuffer(CanvasRenderbuffer*);
-        void deleteShader(CanvasShader*);
-        void deleteTexture(CanvasTexture*);
-        
-        void depthFunc(unsigned long);
-        void depthMask(bool);
-        void depthRange(double zNear, double zFar);
-        void detachShader(CanvasProgram*, CanvasShader*);
-        void disable(unsigned long cap);
-        void disableVertexAttribArray(unsigned long index);
-        void drawArrays(unsigned long mode, long first, long count);
-        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
-
-        void enable(unsigned long cap);
-        void enableVertexAttribArray(unsigned long index);
-        void finish();
-        void flush();
-        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
-        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
-        void frontFace(unsigned long mode);
-        void generateMipmap(unsigned long target);
-
-        PassRefPtr<CanvasActiveInfo> getActiveAttrib(CanvasProgram*, unsigned long index, ExceptionCode&);
-        PassRefPtr<CanvasActiveInfo> getActiveUniform(CanvasProgram*, unsigned long index, ExceptionCode&);
-
-        int  getAttribLocation(CanvasProgram*, const String& name);
-
-        bool getBoolean(unsigned long pname);
-        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
-        int getBufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
-
-        unsigned long getError();
-
-        float getFloat(unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
-        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
-        int getInteger(unsigned long pname);
-        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
-        int getProgrami(CanvasProgram*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
-        String getProgramInfoLog(CanvasProgram*);
-        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
-        int getShaderi(CanvasShader*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
-
-        String getShaderInfoLog(CanvasShader*);
-
-        // TBD
-        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
-
-        String getShaderSource(CanvasShader*);
-        String getString(unsigned long name);
-
-        float getTexParameterf(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
-        int getTexParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
-
-        float getUniformf(CanvasProgram* program, long location);
-        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
-        long getUniformi(CanvasProgram* program, long location);
-        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
-
-        long getUniformLocation(CanvasProgram*, const String& name);
-
-        float getVertexAttribf(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
-        long getVertexAttribi(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
-
-        long getVertexAttribOffset(unsigned long index, unsigned long pname);
-
-        void hint(unsigned long target, unsigned long mode);
-        bool isBuffer(CanvasBuffer*);
-        bool isEnabled(unsigned long cap);
-        bool isFramebuffer(CanvasFramebuffer*);
-        bool isProgram(CanvasProgram*);
-        bool isRenderbuffer(CanvasRenderbuffer*);
-        bool isShader(CanvasShader*);
-        bool isTexture(CanvasTexture*);
-        void lineWidth(double);
-        void linkProgram(CanvasProgram*);
-        void pixelStorei(unsigned long pname, long param);
-        void polygonOffset(double factor, double units);
-        
-        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
-        
-        void releaseShaderCompiler();
-        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
-        void sampleCoverage(double value, bool invert);
-        void scissor(long x, long y, unsigned long width, unsigned long height);
-        void shaderSource(CanvasShader*, const String&);
-        void stencilFunc(unsigned long func, long ref, unsigned long mask);
-        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
-        void stencilMask(unsigned long);
-        void stencilMaskSeparate(unsigned long face, unsigned long mask);
-        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
-        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
-
-        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                        unsigned width, unsigned height, unsigned border,
-                        unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                        unsigned width, unsigned height, unsigned border,
-                        unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
-                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
-                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
-                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
-
-        void texParameterf(unsigned target, unsigned pname, float param);
-        void texParameteri(unsigned target, unsigned pname, int param);
-
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height,
-                           unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height,
-                           unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height, HTMLImageElement* image,
-                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height, HTMLCanvasElement* canvas,
-                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height, HTMLVideoElement* video,
-                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
-
-        void uniform1f(long location, float x);
-        void uniform1fv(long location, CanvasFloatArray* v);
-        void uniform1fv(long location, float* v, int size);
-        void uniform1i(long location, int x);
-        void uniform1iv(long location, CanvasIntArray* v);
-        void uniform1iv(long location, int* v, int size);
-        void uniform2f(long location, float x, float y);
-        void uniform2fv(long location, CanvasFloatArray* v);
-        void uniform2fv(long location, float* v, int size);
-        void uniform2i(long location, int x, int y);
-        void uniform2iv(long location, CanvasIntArray* v);
-        void uniform2iv(long location, int* v, int size);
-        void uniform3f(long location, float x, float y, float z);
-        void uniform3fv(long location, CanvasFloatArray* v);
-        void uniform3fv(long location, float* v, int size);
-        void uniform3i(long location, int x, int y, int z);
-        void uniform3iv(long location, CanvasIntArray* v);
-        void uniform3iv(long location, int* v, int size);
-        void uniform4f(long location, float x, float y, float z, float w);
-        void uniform4fv(long location, CanvasFloatArray* v);
-        void uniform4fv(long location, float* v, int size);
-        void uniform4i(long location, int x, int y, int z, int w);
-        void uniform4iv(long location, CanvasIntArray* v);
-        void uniform4iv(long location, int* v, int size);
-        void uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* value);
-        void uniformMatrix2fv(long location, bool transpose, float* value, int size);
-        void uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* value);
-        void uniformMatrix3fv(long location, bool transpose, float* value, int size);
-        void uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* value);
-        void uniformMatrix4fv(long location, bool transpose, float* value, int size);
-
-        void useProgram(CanvasProgram*);
-        void validateProgram(CanvasProgram*);
-
-        void vertexAttrib1f(unsigned long indx, float x);
-        void vertexAttrib1fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib1fv(unsigned long indx, float* values, int size);
-        void vertexAttrib2f(unsigned long indx, float x, float y);
-        void vertexAttrib2fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib2fv(unsigned long indx, float* values, int size);
-        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
-        void vertexAttrib3fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib3fv(unsigned long indx, float* values, int size);
-        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
-        void vertexAttrib4fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib4fv(unsigned long indx, float* values, int size);
-        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
-                                 unsigned long stride, unsigned long offset);
-
-        void viewport(long x, long y, unsigned long width, unsigned long height);
-
-        GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
-    
-        void reshape(int width, int height);
-
-        // Helpers for notification about paint events.
-        void beginPaint();
-        void endPaint();
-        
-        void removeObject(CanvasObject*);
-        
-    private:
-        friend class CanvasObject;
-
-        CanvasRenderingContext3D(HTMLCanvasElement*, PassOwnPtr<GraphicsContext3D>);
-
-        void addObject(CanvasObject*);
-        void detachAndRemoveAllObjects();
-
-        void markContextChanged();
-        void cleanupAfterGraphicsCall(bool changed)
-        {
-            m_context->checkError();
-            if (changed)
-                markContextChanged();
-        }
-        
-        OwnPtr<GraphicsContext3D> m_context;
-        bool m_needsUpdate;
-        bool m_markedCanvasDirty;
-        // FIXME: I think this is broken -- it does not increment any
-        // reference counts, so may refer to destroyed objects.
-        HashSet<CanvasObject*> m_canvasObjects;
-    };
-
-} // namespace WebCore
-
-#endif
diff --git a/WebCore/html/canvas/CanvasShortArray.cpp b/WebCore/html/canvas/CanvasShortArray.cpp
deleted file mode 100644
index d0cf135..0000000
--- a/WebCore/html/canvas/CanvasShortArray.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasShortArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasShortArray> CanvasShortArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(short));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasShortArray> CanvasShortArray::create(short* array, unsigned length)
-    {
-        RefPtr<CanvasShortArray> a = CanvasShortArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasShortArray> CanvasShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                          int offset,
-                                                          unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(short)) != 0)
-            return NULL;
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(short))) > buffer->byteLength())
-                return NULL;
-        }
-
-        return adoptRef(new CanvasShortArray(buffer, offset, length));
-    }
-    
-    CanvasShortArray::CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasShortArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasShortArray::sizeInBytes() const {
-        return length() * sizeof(short);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasShortArray.h b/WebCore/html/canvas/CanvasShortArray.h
deleted file mode 100644
index 1eeef0c..0000000
--- a/WebCore/html/canvas/CanvasShortArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasShortArray_h
-#define CanvasShortArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasShortArray : public CanvasArray {
-    public:
-        virtual bool isShortArray() const { return true; }
-
-        static PassRefPtr<CanvasShortArray> create(unsigned length);
-        static PassRefPtr<CanvasShortArray> create(short* array, unsigned length);
-        static PassRefPtr<CanvasShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        short* data() { return static_cast<short*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<short>::min())
-                value = std::numeric_limits<short>::min();
-            else if (value > std::numeric_limits<short>::max())
-                value = std::numeric_limits<short>::max();
-            short* storage = static_cast<short*>(m_baseAddress);
-            storage[index] = static_cast<short>(value);
-        }
-        
-        bool get(unsigned index, short& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        short item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            short* storage = static_cast<short*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasShortArray_h
diff --git a/WebCore/html/canvas/CanvasStyle.cpp b/WebCore/html/canvas/CanvasStyle.cpp
index 946cac7..5352473 100644
--- a/WebCore/html/canvas/CanvasStyle.cpp
+++ b/WebCore/html/canvas/CanvasStyle.cpp
@@ -114,33 +114,33 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
         case ColorString: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setStrokeColor(c.rgb());
+                context->setStrokeColor(c.rgb(), DeviceColorSpace);
                 break;
             }
             RGBA32 color = 0; // default is transparent black
             if (CSSParser::parseColor(color, m_color))
-                context->setStrokeColor(color);
+                context->setStrokeColor(color, DeviceColorSpace);
             break;
         }
         case ColorStringWithAlpha: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setStrokeColor(colorWithOverrideAlpha(c.rgb(), m_alpha));
+                context->setStrokeColor(colorWithOverrideAlpha(c.rgb(), m_alpha), DeviceColorSpace);
                 break;
             }
             RGBA32 color = 0; // default is transparent black
             if (CSSParser::parseColor(color, m_color))
-                context->setStrokeColor(colorWithOverrideAlpha(color, m_alpha));
+                context->setStrokeColor(colorWithOverrideAlpha(color, m_alpha), DeviceColorSpace);
             break;
         }
         case GrayLevel:
             // We're only supporting 255 levels of gray here.  Since this isn't
             // even part of HTML5, I don't expect anyone will care.  If they do
             // we'll make a fancier Color abstraction.
-            context->setStrokeColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha));
+            context->setStrokeColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha), DeviceColorSpace);
             break;
         case RGBA:
-            context->setStrokeColor(Color(m_red, m_green, m_blue, m_alpha));
+            context->setStrokeColor(Color(m_red, m_green, m_blue, m_alpha), DeviceColorSpace);
             break;
         case CMYKA: {
             // FIXME: Do this through platform-independent GraphicsContext API.
@@ -154,7 +154,7 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
             currentPen.setColor(clr);
             context->platformContext()->setPen(currentPen);
 #else
-            context->setStrokeColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
+            context->setStrokeColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha), DeviceColorSpace);
 #endif
             break;
         }
@@ -175,33 +175,33 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
         case ColorString: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setFillColor(c.rgb());
+                context->setFillColor(c.rgb(), DeviceColorSpace);
                 break;
             }
             RGBA32 rgba = 0; // default is transparent black
             if (CSSParser::parseColor(rgba, m_color))
-                context->setFillColor(rgba);
+                context->setFillColor(rgba, DeviceColorSpace);
             break;
         }
         case ColorStringWithAlpha: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setFillColor(colorWithOverrideAlpha(c.rgb(), m_alpha));
+                context->setFillColor(colorWithOverrideAlpha(c.rgb(), m_alpha), DeviceColorSpace);
                 break;
             }
             RGBA32 color = 0; // default is transparent black
             if (CSSParser::parseColor(color, m_color))
-                context->setFillColor(colorWithOverrideAlpha(color, m_alpha));
+                context->setFillColor(colorWithOverrideAlpha(color, m_alpha), DeviceColorSpace);
             break;
         }
         case GrayLevel:
             // We're only supporting 255 levels of gray here.  Since this isn't
             // even part of HTML5, I don't expect anyone will care.  If they do
             // we'll make a fancier Color abstraction.
-            context->setFillColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha));
+            context->setFillColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha), DeviceColorSpace);
             break;
         case RGBA:
-            context->setFillColor(Color(m_red, m_green, m_blue, m_alpha));
+            context->setFillColor(Color(m_red, m_green, m_blue, m_alpha), DeviceColorSpace);
             break;
         case CMYKA: {
             // FIXME: Do this through platform-independent GraphicsContext API.
@@ -215,7 +215,7 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
             currentBrush.setColor(clr);
             context->platformContext()->setBrush(currentBrush);
 #else
-            context->setFillColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
+            context->setFillColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha), DeviceColorSpace);
 #endif
             break;
         }
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.cpp b/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
deleted file mode 100644
index a75066c..0000000
--- a/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedByteArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned char));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned char* array, unsigned length)
-    {
-        RefPtr<CanvasUnsignedByteArray> a = CanvasUnsignedByteArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                                        int offset,
-                                                                        unsigned length)
-    {
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength())
-                return NULL;
-        }
-
-        return adoptRef(new CanvasUnsignedByteArray(buffer, offset, length));
-    }
-    
-    CanvasUnsignedByteArray::CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasUnsignedByteArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasUnsignedByteArray::sizeInBytes() const {
-        return length() * sizeof(unsigned char);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.h b/WebCore/html/canvas/CanvasUnsignedByteArray.h
deleted file mode 100644
index d8864e0..0000000
--- a/WebCore/html/canvas/CanvasUnsignedByteArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasUnsignedByteArray_h
-#define CanvasUnsignedByteArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasUnsignedByteArray : public CanvasArray {
-    public:
-        virtual bool isUnsignedByteArray() const { return true; }
-
-        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned length);
-        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned char* array, unsigned length);
-        static PassRefPtr<CanvasUnsignedByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        unsigned char* data() { return static_cast<unsigned char*>(baseAddress()); }
-        
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<unsigned char>::min())
-                value = std::numeric_limits<unsigned char>::min();
-            else if (value > std::numeric_limits<unsigned char>::max())
-                value = std::numeric_limits<unsigned char>::max();
-            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
-            storage[index] = static_cast<unsigned char>(value);
-        }
-        
-        bool get(unsigned index, unsigned char& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        unsigned char item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasUnsignedByteArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.cpp b/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
deleted file mode 100644
index bd26343..0000000
--- a/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedIntArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned int));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned int* array, unsigned length)
-    {
-        RefPtr<CanvasUnsignedIntArray> a = CanvasUnsignedIntArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                                      int offset,
-                                                                      unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(unsigned int)) != 0) {
-            return NULL;
-        }
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength())
-                return NULL;
-        }
-
-        return adoptRef(new CanvasUnsignedIntArray(buffer, offset, length));
-    }
-    
-    CanvasUnsignedIntArray::CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasUnsignedIntArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasUnsignedIntArray::sizeInBytes() const {
-        return length() * sizeof(unsigned int);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.h b/WebCore/html/canvas/CanvasUnsignedIntArray.h
deleted file mode 100644
index 10b8edf..0000000
--- a/WebCore/html/canvas/CanvasUnsignedIntArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasUnsignedIntArray_h
-#define CanvasUnsignedIntArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasUnsignedIntArray : public CanvasArray {
-    public:
-        virtual bool isUnsignedIntArray() const { return true; }
-
-        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned length);
-        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned int* array, unsigned length);
-        static PassRefPtr<CanvasUnsignedIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        unsigned int* data() { return static_cast<unsigned int*>(baseAddress()); }
-        
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<unsigned int>::min())
-                value = std::numeric_limits<unsigned int>::min();
-            else if (value > std::numeric_limits<unsigned int>::max())
-                value = std::numeric_limits<unsigned int>::max();
-            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
-            storage[index] = static_cast<unsigned int>(value);
-        }
-        
-        bool get(unsigned index, unsigned int& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        unsigned int item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasUnsignedIntArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.cpp b/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
deleted file mode 100644
index 45d827b..0000000
--- a/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedShortArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned short));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned short* array, unsigned length)
-    {
-        RefPtr<CanvasUnsignedShortArray> a = CanvasUnsignedShortArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                                          int offset,
-                                                                          unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(unsigned short)) != 0) {
-            return NULL;
-        }
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) 
-                return NULL;
-        }
-
-        return adoptRef(new CanvasUnsignedShortArray(buffer, offset, length));
-    }
-    
-    CanvasUnsignedShortArray::CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                                         int offset,
-                                         unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasUnsignedShortArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasUnsignedShortArray::sizeInBytes() const {
-        return length() * sizeof(unsigned short);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.h b/WebCore/html/canvas/CanvasUnsignedShortArray.h
deleted file mode 100644
index 9e27566..0000000
--- a/WebCore/html/canvas/CanvasUnsignedShortArray.h
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasUnsignedShortArray_h
-#define CanvasUnsignedShortArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasUnsignedShortArray : public CanvasArray {
-    public:
-        virtual bool isUnsignedShortArray() const { return true; }
-
-        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned length);
-        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned short* array, unsigned length);
-        static PassRefPtr<CanvasUnsignedShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        unsigned short* data() { return static_cast<unsigned short*>(baseAddress()); }
-        
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<unsigned short>::min())
-                value = std::numeric_limits<unsigned short>::min();
-            else if (value > std::numeric_limits<unsigned short>::max())
-                value = std::numeric_limits<unsigned short>::max();
-            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
-            storage[index] = static_cast<unsigned short>(value);
-        }
-        
-        bool get(unsigned index, unsigned short& result) const
-        {
-            if (index >= m_size)
-                return false;
-            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
-            result = storage[index];
-            return true;
-        }
-        
-        unsigned short item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,int offset,unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasUnsignedShortArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.idl b/WebCore/html/canvas/CanvasUnsignedShortArray.idl
deleted file mode 100644
index 99fc6a2..0000000
--- a/WebCore/html/canvas/CanvasUnsignedShortArray.idl
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-module html {
-    interface [
-        Conditional=3D_CANVAS,
-        HasNumericIndexGetter,
-        HasCustomIndexSetter,
-        GenerateNativeConverter,
-        GenerateCustomConstructor,
-        CustomToJS
-    ] CanvasUnsignedShortArray : CanvasArray {
-    };
-}
diff --git a/WebCore/html/canvas/CanvasActiveInfo.h b/WebCore/html/canvas/WebGLActiveInfo.h
index b04b0d0..4650ea1 100644
--- a/WebCore/html/canvas/CanvasActiveInfo.h
+++ b/WebCore/html/canvas/WebGLActiveInfo.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasActiveInfo_h
-#define CanvasActiveInfo_h
+#ifndef WebGLActiveInfo_h
+#define WebGLActiveInfo_h
 
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
@@ -32,18 +32,18 @@
 
 namespace WebCore {
 
-class CanvasActiveInfo : public RefCounted<CanvasActiveInfo> {
+class WebGLActiveInfo : public RefCounted<WebGLActiveInfo> {
 public:
-    static PassRefPtr<CanvasActiveInfo> create(const String& name, unsigned type, int size)
+    static PassRefPtr<WebGLActiveInfo> create(const String& name, unsigned type, int size)
     {
-        return adoptRef(new CanvasActiveInfo(name, type, size));
+        return adoptRef(new WebGLActiveInfo(name, type, size));
     }
     String name() const { return m_name; }
     unsigned type() const { return m_type; }
     int size() const { return m_size; }
 
 private:
-    CanvasActiveInfo(const String& name, unsigned type, int size)
+    WebGLActiveInfo(const String& name, unsigned type, int size)
         : m_name(name)
         , m_type(type)
         , m_size(size)
@@ -59,4 +59,4 @@ private:
 
 }
 
-#endif // CanvasActiveInfo_h
+#endif // WebGLActiveInfo_h
diff --git a/WebCore/html/canvas/CanvasActiveInfo.idl b/WebCore/html/canvas/WebGLActiveInfo.idl
index 6ceae29..a3f79b8 100644
--- a/WebCore/html/canvas/CanvasActiveInfo.idl
+++ b/WebCore/html/canvas/WebGLActiveInfo.idl
@@ -27,7 +27,7 @@ module html {
 
     interface [
         Conditional=3D_CANVAS,
-    ] CanvasActiveInfo {
+    ] WebGLActiveInfo {
         readonly attribute int size;
         readonly attribute unsigned int type;
         readonly attribute DOMString name;
diff --git a/WebCore/html/canvas/CanvasArray.cpp b/WebCore/html/canvas/WebGLArray.cpp
index 6b5688a..c5a712d 100644
--- a/WebCore/html/canvas/CanvasArray.cpp
+++ b/WebCore/html/canvas/WebGLArray.cpp
@@ -27,26 +27,34 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArray.h"
-#include "CanvasArrayBuffer.h"
+#include "WebGLArray.h"
+#include "WebGLArrayBuffer.h"
 
 namespace WebCore {
-    CanvasArray::CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                             unsigned offset)
-        : m_offset(offset)
+
+WebGLArray::WebGLArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                       unsigned byteOffset)
+        : m_byteOffset(byteOffset)
         , m_buffer(buffer)
-    {
-        m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_offset) : 0;
-    }
+{
+    m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_byteOffset) : 0;
+}
 
-    CanvasArray::~CanvasArray()
-    {
-    }
+WebGLArray::~WebGLArray()
+{
+}
 
-    unsigned CanvasArray::alignedSizeInBytes() const {
-        // Assume we only need to round up to 4-byte boundaries for alignment.
-        return ((sizeInBytes() + 3) / 4) * 4;
+void WebGLArray::setImpl(WebGLArray* array, unsigned byteOffset, ExceptionCode& ec)
+{
+    if (byteOffset + array->byteLength() > byteLength()) {
+        ec = INDEX_SIZE_ERR;
+        return;
     }
+
+    char* base = static_cast<char*>(baseAddress());
+    memcpy(base + byteOffset, array->baseAddress(), array->byteLength());
+}
+
 }
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasArray.h b/WebCore/html/canvas/WebGLArray.h
index 8cedbbe..11065cc 100644
--- a/WebCore/html/canvas/CanvasArray.h
+++ b/WebCore/html/canvas/WebGLArray.h
@@ -23,53 +23,59 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasArray_h
-#define CanvasArray_h
+#ifndef WebGLArray_h
+#define WebGLArray_h
 
+#include "ExceptionCode.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
-#include "CanvasArrayBuffer.h"
+#include "WebGLArrayBuffer.h"
 
 namespace WebCore {
-    class CanvasArray : public RefCounted<CanvasArray> {
-    public:
-        virtual bool isByteArray() const { return false; }
-        virtual bool isUnsignedByteArray() const { return false; }
-        virtual bool isShortArray() const { return false; }
-        virtual bool isUnsignedShortArray() const { return false; }
-        virtual bool isIntArray() const { return false; }
-        virtual bool isUnsignedIntArray() const { return false; }
-        virtual bool isFloatArray() const { return false; }
-        
-        PassRefPtr<CanvasArrayBuffer> buffer() {
-            return m_buffer;
-        }
-
-        void* baseAddress() {
-            return m_baseAddress;
-        }
-
-        unsigned offset() const {
-            return m_offset;
-        }
-
-        virtual unsigned length() const = 0;
-        virtual unsigned sizeInBytes() const = 0;
-        virtual unsigned alignedSizeInBytes() const;
-        virtual ~CanvasArray();
-
-    protected:
-        CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer, unsigned offset);
-
-        // This is the address of the CanvasArrayBuffer's storage, plus the offset.
-        void* m_baseAddress;
-        unsigned m_offset;
-        
-    private:
-        RefPtr<CanvasArrayBuffer> m_buffer;
-    };
-    
+
+class WebGLArray : public RefCounted<WebGLArray> {
+  public:
+    virtual bool isByteArray() const { return false; }
+    virtual bool isUnsignedByteArray() const { return false; }
+    virtual bool isShortArray() const { return false; }
+    virtual bool isUnsignedShortArray() const { return false; }
+    virtual bool isIntArray() const { return false; }
+    virtual bool isUnsignedIntArray() const { return false; }
+    virtual bool isFloatArray() const { return false; }
+
+    PassRefPtr<WebGLArrayBuffer> buffer() {
+        return m_buffer;
+    }
+
+    void* baseAddress() {
+        return m_baseAddress;
+    }
+
+    unsigned byteOffset() const {
+        return m_byteOffset;
+    }
+
+    virtual unsigned length() const = 0;
+    virtual unsigned byteLength() const = 0;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length) = 0;
+
+    virtual ~WebGLArray();
+
+  protected:
+    WebGLArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset);
+
+    void setImpl(WebGLArray* array, unsigned byteOffset, ExceptionCode& ec);
+
+    // This is the address of the WebGLArrayBuffer's storage, plus the byte offset.
+    void* m_baseAddress;
+
+    unsigned m_byteOffset;
+
+  private:
+    RefPtr<WebGLArrayBuffer> m_buffer;
+};
+
 } // namespace WebCore
 
-#endif // CanvasArray_h
+#endif // WebGLArray_h
diff --git a/WebCore/html/canvas/CanvasByteArray.idl b/WebCore/html/canvas/WebGLArray.idl
index ccf49ad..156ca5b 100644
--- a/WebCore/html/canvas/CanvasByteArray.idl
+++ b/WebCore/html/canvas/WebGLArray.idl
@@ -24,13 +24,12 @@
  */
 
 module html {
-    interface [
-        Conditional=3D_CANVAS,
-        HasNumericIndexGetter,
-        HasCustomIndexSetter,
-        GenerateNativeConverter,
-        GenerateCustomConstructor,
-        CustomToJS
-    ] CanvasByteArray : CanvasArray {
+    interface [Conditional=3D_CANVAS, CustomToJS] WebGLArray {
+        readonly attribute WebGLArrayBuffer buffer;
+        readonly attribute unsigned long byteOffset;
+        readonly attribute unsigned long byteLength;
+        readonly attribute unsigned long length;
+
+        WebGLArray slice(in unsigned long offset, in unsigned long length);
     };
 }
diff --git a/WebCore/html/canvas/CanvasBuffer.cpp b/WebCore/html/canvas/WebGLArrayBuffer.cpp
index 009f8ad..c565691 100644
--- a/WebCore/html/canvas/CanvasBuffer.cpp
+++ b/WebCore/html/canvas/WebGLArrayBuffer.cpp
@@ -27,25 +27,43 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasBuffer.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLArrayBuffer.h"
+
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
-    
-PassRefPtr<CanvasBuffer> CanvasBuffer::create(CanvasRenderingContext3D* ctx)
+
+PassRefPtr<WebGLArrayBuffer> WebGLArrayBuffer::create(unsigned sizeInBytes)
 {
-    return adoptRef(new CanvasBuffer(ctx));
+    return adoptRef(new WebGLArrayBuffer(sizeInBytes));
 }
 
-CanvasBuffer::CanvasBuffer(CanvasRenderingContext3D* ctx)
-    : CanvasObject(ctx)
+PassRefPtr<WebGLArrayBuffer> WebGLArrayBuffer::create(WebGLArrayBuffer* other)
 {
-    setObject(context()->graphicsContext3D()->createBuffer());
+    RefPtr<WebGLArrayBuffer> buffer = adoptRef(new WebGLArrayBuffer(other->byteLength()));
+    memcpy(buffer->data(), other->data(), other->byteLength());
+    return buffer.release();
 }
 
-void CanvasBuffer::_deleteObject(Platform3DObject object)
-{
-    context()->graphicsContext3D()->deleteBuffer(object);
+WebGLArrayBuffer::WebGLArrayBuffer(unsigned sizeInBytes) {
+    m_sizeInBytes = sizeInBytes;
+    m_data = WTF::fastZeroedMalloc(sizeInBytes);
+}
+
+void* WebGLArrayBuffer::data() {
+    return m_data;
+}
+
+const void* WebGLArrayBuffer::data() const {
+    return m_data;
+}
+
+unsigned WebGLArrayBuffer::byteLength() const {
+    return m_sizeInBytes;
+}
+
+WebGLArrayBuffer::~WebGLArrayBuffer() {
+    WTF::fastFree(m_data);
 }
 
 }
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.h b/WebCore/html/canvas/WebGLArrayBuffer.h
index e3ff2b0..a076e16 100644
--- a/WebCore/html/canvas/CanvasArrayBuffer.h
+++ b/WebCore/html/canvas/WebGLArrayBuffer.h
@@ -23,29 +23,31 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasArrayBuffer_h
-#define CanvasArrayBuffer_h
+#ifndef WebGLArrayBuffer_h
+#define WebGLArrayBuffer_h
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
-    
-    class CanvasArrayBuffer : public RefCounted<CanvasArrayBuffer> {
-    public:
-        static PassRefPtr<CanvasArrayBuffer> create(unsigned sizeInBytes);
-
-        void* data();
-        unsigned byteLength() const;
-
-        ~CanvasArrayBuffer();
-
-    private:
-        CanvasArrayBuffer(unsigned sizeInBytes);
-        unsigned m_sizeInBytes;
-        void* m_data;
-    };
-    
+
+class WebGLArrayBuffer : public RefCounted<WebGLArrayBuffer> {
+  public:
+    static PassRefPtr<WebGLArrayBuffer> create(unsigned sizeInBytes);
+    static PassRefPtr<WebGLArrayBuffer> create(WebGLArrayBuffer*);
+
+    void* data();
+    const void* data() const;
+    unsigned byteLength() const;
+
+    ~WebGLArrayBuffer();
+
+  private:
+    WebGLArrayBuffer(unsigned sizeInBytes);
+    unsigned m_sizeInBytes;
+    void* m_data;
+};
+
 } // namespace WebCore
 
-#endif // CanvasArrayBuffer_h
+#endif // WebGLArrayBuffer_h
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.idl b/WebCore/html/canvas/WebGLArrayBuffer.idl
index 5dc0f7f..ec4a67a 100644
--- a/WebCore/html/canvas/CanvasArrayBuffer.idl
+++ b/WebCore/html/canvas/WebGLArrayBuffer.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasArrayBuffer {
+    interface [Conditional=3D_CANVAS] WebGLArrayBuffer {
         readonly attribute int byteLength;
     };
 }
diff --git a/WebCore/html/canvas/WebGLBuffer.cpp b/WebCore/html/canvas/WebGLBuffer.cpp
new file mode 100644
index 0000000..cbad6a0
--- /dev/null
+++ b/WebCore/html/canvas/WebGLBuffer.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLBuffer.h"
+#include "WebGLRenderingContext.h"
+
+namespace WebCore {
+    
+PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContext* ctx)
+{
+    return adoptRef(new WebGLBuffer(ctx));
+}
+
+PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContext* ctx, Platform3DObject obj)
+{
+    return adoptRef(new WebGLBuffer(ctx, obj));
+}
+
+WebGLBuffer::WebGLBuffer(WebGLRenderingContext* ctx)
+    : CanvasObject(ctx)
+    , m_elementArrayBufferByteLength(0)
+    , m_arrayBufferByteLength(0)
+    , m_elementArrayBufferCloned(false)
+{
+    setObject(context()->graphicsContext3D()->createBuffer());
+}
+
+WebGLBuffer::WebGLBuffer(WebGLRenderingContext* ctx, Platform3DObject obj)
+    : CanvasObject(ctx)
+{
+    setObject(obj, false);
+}
+
+void WebGLBuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteBuffer(object);
+}
+
+bool WebGLBuffer::associateBufferData(unsigned long target, int size)
+{
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_elementArrayBufferByteLength = size;
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER) {
+        m_arrayBufferByteLength = size;
+        return true;
+    }
+
+    return false;
+}
+
+bool WebGLBuffer::associateBufferData(unsigned long target, WebGLArray* array)
+{
+    if (!array)
+        return false;
+        
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_elementArrayBufferByteLength = array->byteLength();
+        m_elementArrayBuffer = array->buffer();
+        m_elementArrayBufferCloned = false;
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER) {
+        m_arrayBufferByteLength = array->byteLength();
+        return true;
+    }
+    
+    return false;
+}
+
+bool WebGLBuffer::associateBufferSubData(unsigned long target, long offset, WebGLArray* array)
+{
+    if (!array)
+        return false;
+        
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        // We need to protect against integer overflow with these tests
+        if (offset < 0)
+            return false;
+            
+        unsigned long uoffset = static_cast<unsigned long>(offset);
+        if (uoffset > m_elementArrayBufferByteLength || array->byteLength() > m_elementArrayBufferByteLength - uoffset)
+            return false;
+            
+        // If we already have a buffer, we need to clone it and add the new data
+        if (m_elementArrayBuffer && !m_elementArrayBufferCloned) {
+            m_elementArrayBuffer = WebGLArrayBuffer::create(m_elementArrayBuffer.get());
+            m_elementArrayBufferCloned = true;
+        }
+            
+        memcpy(static_cast<unsigned char*>(m_elementArrayBuffer->data()) + offset, array->baseAddress(), array->byteLength());
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER)
+        return array->byteLength() + offset <= m_arrayBufferByteLength;
+
+    return false;
+}
+
+unsigned WebGLBuffer::byteLength(unsigned long target) const
+{
+    return (target == GraphicsContext3D::ARRAY_BUFFER) ? m_arrayBufferByteLength : m_elementArrayBufferByteLength;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLBuffer.h b/WebCore/html/canvas/WebGLBuffer.h
new file mode 100644
index 0000000..cb953c6
--- /dev/null
+++ b/WebCore/html/canvas/WebGLBuffer.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLBuffer_h
+#define WebGLBuffer_h
+
+#include "CanvasObject.h"
+#include "WebGLArrayBuffer.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class WebGLBuffer : public CanvasObject {
+    public:
+        virtual ~WebGLBuffer() { deleteObject(); }
+        
+        static PassRefPtr<WebGLBuffer> create(WebGLRenderingContext*);
+        
+        // For querying previously created objects via e.g. getFramebufferAttachmentParameter
+        // FIXME: should consider canonicalizing these objects
+        static PassRefPtr<WebGLBuffer> create(WebGLRenderingContext*, Platform3DObject);
+
+        bool associateBufferData(unsigned long target, int size);
+        bool associateBufferData(unsigned long target, WebGLArray* array);
+        bool associateBufferSubData(unsigned long target, long offset, WebGLArray* array);
+        
+        unsigned byteLength(unsigned long target) const;
+        const WebGLArrayBuffer* elementArrayBuffer() const { return m_elementArrayBuffer.get(); }
+                        
+    protected:
+        WebGLBuffer(WebGLRenderingContext*);
+        WebGLBuffer(WebGLRenderingContext*, Platform3DObject obj);
+        
+        virtual void _deleteObject(Platform3DObject o);
+    
+    private:
+        RefPtr<WebGLArrayBuffer> m_elementArrayBuffer;
+        unsigned m_elementArrayBufferByteLength;
+        unsigned m_arrayBufferByteLength;
+        bool m_elementArrayBufferCloned;
+    };
+    
+} // namespace WebCore
+
+#endif // WebGLBuffer_h
diff --git a/WebCore/html/canvas/CanvasBuffer.idl b/WebCore/html/canvas/WebGLBuffer.idl
index 9bca42b..30b7606 100644
--- a/WebCore/html/canvas/CanvasBuffer.idl
+++ b/WebCore/html/canvas/WebGLBuffer.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasBuffer {
+    interface [Conditional=3D_CANVAS] WebGLBuffer {
     };
 }
diff --git a/WebCore/html/canvas/CanvasByteArray.cpp b/WebCore/html/canvas/WebGLByteArray.cpp
index 0f72ccf..1c2849b 100644
--- a/WebCore/html/canvas/CanvasByteArray.cpp
+++ b/WebCore/html/canvas/WebGLByteArray.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,49 +28,64 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasByteArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLByteArray.h"
 
 namespace WebCore {
-    
-PassRefPtr<CanvasByteArray> CanvasByteArray::create(unsigned length)
+
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(unsigned length)
 {
-    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(signed char));
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(signed char));
     return create(buffer, 0, length);
 }
 
-PassRefPtr<CanvasByteArray> CanvasByteArray::create(signed char* array, unsigned length)
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(signed char* array, unsigned length)
 {
-    RefPtr<CanvasByteArray> a = CanvasByteArray::create(length);
+    RefPtr<WebGLByteArray> a = WebGLByteArray::create(length);
     for (unsigned i = 0; i < length; ++i)
         a->set(i, array[i]);
     return a;
 }
 
-PassRefPtr<CanvasByteArray> CanvasByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
 {
     if (buffer) {
         // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(signed char))) > buffer->byteLength())
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(signed char))) > buffer->byteLength())
             return NULL;
     }
-    
-    return adoptRef(new CanvasByteArray(buffer, offset, length));
+
+    return adoptRef(new WebGLByteArray(buffer, byteOffset, length));
 }
 
-CanvasByteArray::CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-    : CanvasArray(buffer, offset)
+WebGLByteArray::WebGLByteArray(PassRefPtr<WebGLArrayBuffer> buffer, int offset, unsigned length)
+    : WebGLArray(buffer, offset)
     , m_size(length)
 {
 }
 
-unsigned CanvasByteArray::length() const {
+unsigned WebGLByteArray::length() const {
     return m_size;
 }
-    
-unsigned CanvasByteArray::sizeInBytes() const {
-    return length() * sizeof(signed char);
+
+unsigned WebGLByteArray::byteLength() const {
+    return m_size * sizeof(signed char);
+}
+
+PassRefPtr<WebGLArray> WebGLByteArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(signed char);
+    unsigned limitByte = startByte + length * sizeof(signed char);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLByteArray::set(WebGLByteArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(signed char), ec);
 }
 
 }
diff --git a/WebCore/html/canvas/WebGLByteArray.h b/WebCore/html/canvas/WebGLByteArray.h
new file mode 100644
index 0000000..c517c03
--- /dev/null
+++ b/WebCore/html/canvas/WebGLByteArray.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLByteArray_h
+#define WebGLByteArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLArrayBuffer;
+
+class WebGLByteArray : public WebGLArray {
+  public:
+    virtual bool isByteArray() const { return true; }
+
+    static PassRefPtr<WebGLByteArray> create(unsigned length);
+    static PassRefPtr<WebGLByteArray> create(signed char* array, unsigned length);
+    static PassRefPtr<WebGLByteArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    char* data() { return static_cast<char*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<signed char>::min())
+            value = std::numeric_limits<signed char>::min();
+        else if (value > std::numeric_limits<signed char>::max())
+            value = std::numeric_limits<signed char>::max();
+        signed char* storage = static_cast<signed char*>(m_baseAddress);
+        storage[index] = static_cast<signed char>(value);
+    }
+
+    bool get(unsigned index, signed char& result) const
+    {
+        if (index >= m_size)
+            return false;
+        signed char* storage = static_cast<signed char*>(m_baseAddress);
+        result = storage[index];
+        return true;
+    }
+
+    signed char get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    signed char item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        signed char* storage = static_cast<signed char*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLByteArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLByteArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                   int offset,
+                   unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLByteArray_h
diff --git a/WebCore/html/canvas/CanvasIntArray.idl b/WebCore/html/canvas/WebGLByteArray.idl
index 2c81b87..054a912 100644
--- a/WebCore/html/canvas/CanvasIntArray.idl
+++ b/WebCore/html/canvas/WebGLByteArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +32,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasIntArray : CanvasArray {
+    ] WebGLByteArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLByteArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/WebGLFloatArray.cpp b/WebCore/html/canvas/WebGLFloatArray.cpp
new file mode 100644
index 0000000..6192898
--- /dev/null
+++ b/WebCore/html/canvas/WebGLFloatArray.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLFloatArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLFloatArray> WebGLFloatArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(float));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLFloatArray> WebGLFloatArray::create(float* array, unsigned length)
+{
+    RefPtr<WebGLFloatArray> a = WebGLFloatArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLFloatArray> WebGLFloatArray::create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(float)) != 0)
+        return NULL;
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(float))) > buffer->byteLength())
+            return NULL;
+    }
+    return adoptRef(new WebGLFloatArray(buffer, byteOffset, length));
+}
+
+WebGLFloatArray::WebGLFloatArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLFloatArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLFloatArray::byteLength() const {
+    return m_size * sizeof(float);
+}
+
+PassRefPtr<WebGLArray> WebGLFloatArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(float);
+    unsigned limitByte = startByte + length * sizeof(float);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLFloatArray::set(WebGLFloatArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(float), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLFloatArray.h b/WebCore/html/canvas/WebGLFloatArray.h
new file mode 100644
index 0000000..4607962
--- /dev/null
+++ b/WebCore/html/canvas/WebGLFloatArray.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLFloatArray_h
+#define WebGLFloatArray_h
+
+#include "WebGLArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLFloatArray : public WebGLArray {
+  public:
+    virtual bool isFloatArray() const { return true; }
+
+    static PassRefPtr<WebGLFloatArray> create(unsigned length);
+    static PassRefPtr<WebGLFloatArray> create(float* array, unsigned length);
+    static PassRefPtr<WebGLFloatArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    float* data() { return static_cast<float*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        float* storage = static_cast<float*>(m_baseAddress);
+        storage[index] = static_cast<float>(value);
+    }
+
+    bool get(unsigned index, float& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    float get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    float item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        float* storage = static_cast<float*>(m_baseAddress);
+        float result = storage[index];
+        if (isnan(result)) {
+            // Clamp NaN to 0
+            result = 0;
+        }
+        return result;
+    }
+
+    void set(WebGLFloatArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLFloatArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLFloatArray_h
diff --git a/WebCore/html/canvas/CanvasShortArray.idl b/WebCore/html/canvas/WebGLFloatArray.idl
index 6d64e1c..83479b3 100644
--- a/WebCore/html/canvas/CanvasShortArray.idl
+++ b/WebCore/html/canvas/WebGLFloatArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +32,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasShortArray : CanvasArray {
+    ] WebGLFloatArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLFloatArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/CanvasFramebuffer.cpp b/WebCore/html/canvas/WebGLFramebuffer.cpp
index 9700354..7ade990 100644
--- a/WebCore/html/canvas/CanvasFramebuffer.cpp
+++ b/WebCore/html/canvas/WebGLFramebuffer.cpp
@@ -27,23 +27,23 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasFramebuffer.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasFramebuffer> CanvasFramebuffer::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLFramebuffer> WebGLFramebuffer::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasFramebuffer(ctx));
+    return adoptRef(new WebGLFramebuffer(ctx));
 }
 
-CanvasFramebuffer::CanvasFramebuffer(CanvasRenderingContext3D* ctx)
+WebGLFramebuffer::WebGLFramebuffer(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createFramebuffer());
 }
 
-void CanvasFramebuffer::_deleteObject(Platform3DObject object)
+void WebGLFramebuffer::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteFramebuffer(object);
 }
diff --git a/WebCore/html/canvas/CanvasFramebuffer.h b/WebCore/html/canvas/WebGLFramebuffer.h
index ec3cb97..10b6772 100644
--- a/WebCore/html/canvas/CanvasFramebuffer.h
+++ b/WebCore/html/canvas/WebGLFramebuffer.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasFramebuffer_h
-#define CanvasFramebuffer_h
+#ifndef WebGLFramebuffer_h
+#define WebGLFramebuffer_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,18 @@
 
 namespace WebCore {
     
-    class CanvasFramebuffer : public CanvasObject {
+    class WebGLFramebuffer : public CanvasObject {
     public:
-        virtual ~CanvasFramebuffer() { deleteObject(); }
+        virtual ~WebGLFramebuffer() { deleteObject(); }
         
-        static PassRefPtr<CanvasFramebuffer> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLFramebuffer> create(WebGLRenderingContext*);
         
     protected:
-        CanvasFramebuffer(CanvasRenderingContext3D*);
+        WebGLFramebuffer(WebGLRenderingContext*);
         
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasFramebuffer_h
+#endif // WebGLFramebuffer_h
diff --git a/WebCore/html/canvas/WebGLFramebuffer.idl b/WebCore/html/canvas/WebGLFramebuffer.idl
new file mode 100644
index 0000000..8c1d9fd
--- /dev/null
+++ b/WebCore/html/canvas/WebGLFramebuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] WebGLFramebuffer {
+    };
+}
diff --git a/WebCore/html/canvas/WebGLGetInfo.cpp b/WebCore/html/canvas/WebGLGetInfo.cpp
new file mode 100644
index 0000000..96218e5
--- /dev/null
+++ b/WebCore/html/canvas/WebGLGetInfo.cpp
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLGetInfo.h"
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+WebGLGetInfo::WebGLGetInfo(bool value)
+    : m_type(kTypeBool)
+    , m_bool(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(float value)
+    : m_type(kTypeFloat)
+    , m_float(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(long value)
+    : m_type(kTypeLong)
+    , m_long(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo()
+    : m_type(kTypeNull)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(const String& value)
+    : m_type(kTypeString)
+    , m_string(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(unsigned long value)
+    : m_type(kTypeUnsignedLong)
+    , m_unsignedLong(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLBuffer> value)
+    : m_type(kTypeWebGLBuffer)
+    , m_webglBuffer(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLFloatArray> value)
+    : m_type(kTypeWebGLFloatArray)
+    , m_webglFloatArray(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLFramebuffer> value)
+    : m_type(kTypeWebGLFramebuffer)
+    , m_webglFramebuffer(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLIntArray> value)
+    : m_type(kTypeWebGLIntArray)
+    , m_webglIntArray(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLProgram> value)
+    : m_type(kTypeWebGLProgram)
+    , m_webglProgram(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLRenderbuffer> value)
+    : m_type(kTypeWebGLRenderbuffer)
+    , m_webglRenderbuffer(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLTexture> value)
+    : m_type(kTypeWebGLTexture)
+    , m_webglTexture(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLUnsignedByteArray> value)
+    : m_type(kTypeWebGLUnsignedByteArray)
+    , m_webglUnsignedByteArray(value)
+{
+}
+
+WebGLGetInfo::~WebGLGetInfo()
+{
+}
+
+WebGLGetInfo::Type WebGLGetInfo::getType() const
+{
+    return m_type;
+}
+
+bool WebGLGetInfo::getBool() const
+{
+    ASSERT(getType() == kTypeBool);
+    return m_bool;
+}
+
+float WebGLGetInfo::getFloat() const
+{
+    ASSERT(getType() == kTypeFloat);
+    return m_float;
+}
+
+long WebGLGetInfo::getLong() const
+{
+    ASSERT(getType() == kTypeLong);
+    return m_long;
+}
+
+const String& WebGLGetInfo::getString() const
+{
+    ASSERT(getType() == kTypeString);
+    return m_string;
+}
+
+unsigned long WebGLGetInfo::getUnsignedLong() const
+{
+    ASSERT(getType() == kTypeUnsignedLong);
+    return m_unsignedLong;
+}
+
+PassRefPtr<WebGLBuffer> WebGLGetInfo::getWebGLBuffer() const
+{
+    ASSERT(getType() == kTypeWebGLBuffer);
+    return m_webglBuffer;
+}
+
+PassRefPtr<WebGLFloatArray> WebGLGetInfo::getWebGLFloatArray() const
+{
+    ASSERT(getType() == kTypeWebGLFloatArray);
+    return m_webglFloatArray;
+}
+
+PassRefPtr<WebGLFramebuffer> WebGLGetInfo::getWebGLFramebuffer() const
+{
+    ASSERT(getType() == kTypeWebGLFramebuffer);
+    return m_webglFramebuffer;
+}
+
+PassRefPtr<WebGLIntArray> WebGLGetInfo::getWebGLIntArray() const
+{
+    ASSERT(getType() == kTypeWebGLIntArray);
+    return m_webglIntArray;
+}
+
+PassRefPtr<WebGLProgram> WebGLGetInfo::getWebGLProgram() const
+{
+    ASSERT(getType() == kTypeWebGLProgram);
+    return m_webglProgram;
+}
+
+PassRefPtr<WebGLRenderbuffer> WebGLGetInfo::getWebGLRenderbuffer() const
+{
+    ASSERT(getType() == kTypeWebGLRenderbuffer);
+    return m_webglRenderbuffer;
+}
+
+PassRefPtr<WebGLTexture> WebGLGetInfo::getWebGLTexture() const
+{
+    ASSERT(getType() == kTypeWebGLTexture);
+    return m_webglTexture;
+}
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLGetInfo::getWebGLUnsignedByteArray() const
+{
+    ASSERT(getType() == kTypeWebGLUnsignedByteArray);
+    return m_webglUnsignedByteArray;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLGetInfo.h b/WebCore/html/canvas/WebGLGetInfo.h
new file mode 100644
index 0000000..8ac42c4
--- /dev/null
+++ b/WebCore/html/canvas/WebGLGetInfo.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebGLGetInfo_h
+#define WebGLGetInfo_h
+
+#include "wtf/PassRefPtr.h"
+#include "wtf/RefPtr.h"
+#include "PlatformString.h"
+
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+// FIXME: implement WebGLObjectArray
+//#include "WebGLObjectArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+// A tagged union representing the result of get queries like
+// getParameter (encompassing getBooleanv, getIntegerv, getFloatv) and
+// similar variants. For reference counted types, increments and
+// decrements the reference count of the target object.
+
+class WebGLGetInfo {
+public:
+    enum Type {
+        kTypeBool,
+        kTypeFloat,
+        kTypeLong,
+        kTypeNull,
+        kTypeString,
+        kTypeUnsignedLong,
+        kTypeWebGLBuffer,
+        kTypeWebGLFloatArray,
+        kTypeWebGLFramebuffer,
+        kTypeWebGLIntArray,
+        kTypeWebGLObjectArray,
+        kTypeWebGLProgram,
+        kTypeWebGLRenderbuffer,
+        kTypeWebGLTexture,
+        kTypeWebGLUnsignedByteArray
+    };
+
+    WebGLGetInfo(bool value);
+    WebGLGetInfo(float value);
+    WebGLGetInfo(long value);
+    // Represents the NULL value and type
+    WebGLGetInfo();
+    WebGLGetInfo(const String& value);
+    WebGLGetInfo(unsigned long value);
+    WebGLGetInfo(PassRefPtr<WebGLBuffer> value);
+    WebGLGetInfo(PassRefPtr<WebGLFloatArray> value);
+    WebGLGetInfo(PassRefPtr<WebGLFramebuffer> value);
+    WebGLGetInfo(PassRefPtr<WebGLIntArray> value);
+    // FIXME: implement WebGLObjectArray
+    // WebGLGetInfo(PassRefPtr<WebGLObjectArray> value);
+    WebGLGetInfo(PassRefPtr<WebGLProgram> value);
+    WebGLGetInfo(PassRefPtr<WebGLRenderbuffer> value);
+    WebGLGetInfo(PassRefPtr<WebGLTexture> value);
+    WebGLGetInfo(PassRefPtr<WebGLUnsignedByteArray> value);
+
+    virtual ~WebGLGetInfo();
+
+    Type getType() const;
+
+    bool getBool() const;
+    float getFloat() const;
+    long getLong() const;
+    const String& getString() const;
+    unsigned long getUnsignedLong() const;
+    PassRefPtr<WebGLBuffer> getWebGLBuffer() const;
+    PassRefPtr<WebGLFloatArray> getWebGLFloatArray() const;
+    PassRefPtr<WebGLFramebuffer> getWebGLFramebuffer() const;
+    PassRefPtr<WebGLIntArray> getWebGLIntArray() const;
+    // FIXME: implement WebGLObjectArray
+    // PassRefPtr<WebGLObjectArray> getWebGLObjectArray() const;
+    PassRefPtr<WebGLProgram> getWebGLProgram() const;
+    PassRefPtr<WebGLRenderbuffer> getWebGLRenderbuffer() const;
+    PassRefPtr<WebGLTexture> getWebGLTexture() const;
+    PassRefPtr<WebGLUnsignedByteArray> getWebGLUnsignedByteArray() const;
+
+private:
+    Type m_type;
+    bool m_bool;
+    float m_float;
+    long m_long;
+    String m_string;
+    unsigned long m_unsignedLong;
+    RefPtr<WebGLBuffer> m_webglBuffer;
+    RefPtr<WebGLFloatArray> m_webglFloatArray;
+    RefPtr<WebGLFramebuffer> m_webglFramebuffer;
+    RefPtr<WebGLIntArray> m_webglIntArray;
+    // FIXME: implement WebGLObjectArray
+    // RefPtr<WebGLObjectArray> m_webglObjectArray;
+    RefPtr<WebGLProgram> m_webglProgram;
+    RefPtr<WebGLRenderbuffer> m_webglRenderbuffer;
+    RefPtr<WebGLTexture> m_webglTexture;
+    RefPtr<WebGLUnsignedByteArray> m_webglUnsignedByteArray;
+};
+
+} // namespace WebCore
+
+#endif  // WebGLGetInfo_h
diff --git a/WebCore/html/canvas/WebGLIntArray.cpp b/WebCore/html/canvas/WebGLIntArray.cpp
new file mode 100644
index 0000000..4617010
--- /dev/null
+++ b/WebCore/html/canvas/WebGLIntArray.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLIntArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLIntArray> WebGLIntArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(int));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLIntArray> WebGLIntArray::create(int* array, unsigned length)
+{
+    RefPtr<WebGLIntArray> a = WebGLIntArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLIntArray> WebGLIntArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                int byteOffset,
+                                                unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(int)) != 0)
+        return NULL;
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(int))) > buffer->byteLength())
+            return NULL;
+    }
+
+    return adoptRef(new WebGLIntArray(buffer, byteOffset, length));
+}
+
+WebGLIntArray::WebGLIntArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLIntArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLIntArray::byteLength() const {
+    return m_size * sizeof(int);
+}
+
+PassRefPtr<WebGLArray> WebGLIntArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(int);
+    unsigned limitByte = startByte + length * sizeof(int);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLIntArray::set(WebGLIntArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(int), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLIntArray.h b/WebCore/html/canvas/WebGLIntArray.h
new file mode 100644
index 0000000..25108ac
--- /dev/null
+++ b/WebCore/html/canvas/WebGLIntArray.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLIntArray_h
+#define WebGLIntArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLIntArray : public WebGLArray {
+  public:
+    virtual bool isIntArray() const { return true; }
+
+    static PassRefPtr<WebGLIntArray> create(unsigned length);
+    static PassRefPtr<WebGLIntArray> create(int* array, unsigned length);
+    static PassRefPtr<WebGLIntArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    int* data() { return static_cast<int*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<int>::min())
+            value = std::numeric_limits<int>::min();
+        else if (value > std::numeric_limits<int>::max())
+            value = std::numeric_limits<int>::max();
+        int* storage = static_cast<int*>(m_baseAddress);
+        storage[index] = static_cast<int>(value);
+    }
+
+    bool get(unsigned index, int& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    int get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    int item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        int* storage = static_cast<int*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLIntArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLIntArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                  int byteOffset,
+                  unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLIntArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.idl b/WebCore/html/canvas/WebGLIntArray.idl
index d46f708..3bc037c 100644
--- a/WebCore/html/canvas/CanvasUnsignedByteArray.idl
+++ b/WebCore/html/canvas/WebGLIntArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +32,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasUnsignedByteArray : CanvasArray {
+    ] WebGLIntArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLIntArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/CanvasProgram.cpp b/WebCore/html/canvas/WebGLProgram.cpp
index 83da270..c2606c1 100644
--- a/WebCore/html/canvas/CanvasProgram.cpp
+++ b/WebCore/html/canvas/WebGLProgram.cpp
@@ -27,23 +27,23 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasProgram.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasProgram> CanvasProgram::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLProgram> WebGLProgram::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasProgram(ctx));
+    return adoptRef(new WebGLProgram(ctx));
 }
 
-CanvasProgram::CanvasProgram(CanvasRenderingContext3D* ctx)
+WebGLProgram::WebGLProgram(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createProgram());
 }
 
-void CanvasProgram::_deleteObject(Platform3DObject object)
+void WebGLProgram::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteProgram(object);
 }
diff --git a/WebCore/html/canvas/CanvasProgram.h b/WebCore/html/canvas/WebGLProgram.h
index af817c8..8804d39 100644
--- a/WebCore/html/canvas/CanvasProgram.h
+++ b/WebCore/html/canvas/WebGLProgram.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasProgram_h
-#define CanvasProgram_h
+#ifndef WebGLProgram_h
+#define WebGLProgram_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,18 @@
 
 namespace WebCore {
     
-    class CanvasProgram : public CanvasObject {
+    class WebGLProgram : public CanvasObject {
     public:
-        virtual ~CanvasProgram() { deleteObject(); }
+        virtual ~WebGLProgram() { deleteObject(); }
         
-        static PassRefPtr<CanvasProgram> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLProgram> create(WebGLRenderingContext*);
         
     protected:
-        CanvasProgram(CanvasRenderingContext3D*);
+        WebGLProgram(WebGLRenderingContext*);
         
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasProgram_h
+#endif // WebGLProgram_h
diff --git a/WebCore/html/canvas/CanvasShader.idl b/WebCore/html/canvas/WebGLProgram.idl
index 7474c3a..562fa3a 100644
--- a/WebCore/html/canvas/CanvasShader.idl
+++ b/WebCore/html/canvas/WebGLProgram.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasShader {
+    interface [Conditional=3D_CANVAS] WebGLProgram {
     };
 }
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.cpp b/WebCore/html/canvas/WebGLRenderbuffer.cpp
index 51054cd..286ad2e 100644
--- a/WebCore/html/canvas/CanvasRenderbuffer.cpp
+++ b/WebCore/html/canvas/WebGLRenderbuffer.cpp
@@ -27,23 +27,34 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasRenderbuffer.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasRenderbuffer> CanvasRenderbuffer::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLRenderbuffer> WebGLRenderbuffer::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasRenderbuffer(ctx));
+    return adoptRef(new WebGLRenderbuffer(ctx));
 }
 
-CanvasRenderbuffer::CanvasRenderbuffer(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLRenderbuffer> WebGLRenderbuffer::create(WebGLRenderingContext* ctx, Platform3DObject obj)
+{
+    return adoptRef(new WebGLRenderbuffer(ctx, obj));
+}
+
+WebGLRenderbuffer::WebGLRenderbuffer(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createRenderbuffer());
 }
 
-void CanvasRenderbuffer::_deleteObject(Platform3DObject object)
+WebGLRenderbuffer::WebGLRenderbuffer(WebGLRenderingContext* ctx, Platform3DObject obj)
+    : CanvasObject(ctx)
+{
+    setObject(obj, false);
+}
+
+void WebGLRenderbuffer::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteRenderbuffer(object);
 }
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.h b/WebCore/html/canvas/WebGLRenderbuffer.h
index 3fb99e9..790fdcd 100644
--- a/WebCore/html/canvas/CanvasRenderbuffer.h
+++ b/WebCore/html/canvas/WebGLRenderbuffer.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasRenderbuffer_h
-#define CanvasRenderbuffer_h
+#ifndef WebGLRenderbuffer_h
+#define WebGLRenderbuffer_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,23 @@
 
 namespace WebCore {
     
-    class CanvasRenderbuffer : public CanvasObject {
+    class WebGLRenderbuffer : public CanvasObject {
     public:
-        virtual ~CanvasRenderbuffer() { deleteObject(); }
+        virtual ~WebGLRenderbuffer() { deleteObject(); }
         
-        static PassRefPtr<CanvasRenderbuffer> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLRenderbuffer> create(WebGLRenderingContext*);
         
+        // For querying previously created objects via e.g. getFramebufferAttachmentParameter
+        // FIXME: should consider canonicalizing these objects
+        static PassRefPtr<WebGLRenderbuffer> create(WebGLRenderingContext*, Platform3DObject renderbuffer);
+
     protected:
-        CanvasRenderbuffer(CanvasRenderingContext3D*);
+        WebGLRenderbuffer(WebGLRenderingContext*);
+        WebGLRenderbuffer(WebGLRenderingContext*, Platform3DObject);
         
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasRenderbuffer_h
+#endif // WebGLRenderbuffer_h
diff --git a/WebCore/html/canvas/CanvasFramebuffer.idl b/WebCore/html/canvas/WebGLRenderbuffer.idl
index 0a9b668..2524433 100644
--- a/WebCore/html/canvas/CanvasFramebuffer.idl
+++ b/WebCore/html/canvas/WebGLRenderbuffer.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasFramebuffer {
+    interface [Conditional=3D_CANVAS] WebGLRenderbuffer {
     };
 }
diff --git a/WebCore/html/canvas/WebGLRenderingContext.cpp b/WebCore/html/canvas/WebGLRenderingContext.cpp
new file mode 100644
index 0000000..7a7215d
--- /dev/null
+++ b/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -0,0 +1,2424 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLRenderingContext.h"
+
+#include "WebGLActiveInfo.h"
+#include "WebGLBuffer.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLTexture.h"
+#include "WebGLShader.h"
+#include "WebGLUniformLocation.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "ImageBuffer.h"
+#include "NotImplemented.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+
+namespace WebCore {
+
+class WebGLStateRestorer {
+public:
+    WebGLStateRestorer(WebGLRenderingContext* context,
+                       bool changed)
+        : m_context(context)
+        , m_changed(changed)
+    {
+    }
+
+    ~WebGLStateRestorer()
+    {
+        m_context->cleanupAfterGraphicsCall(m_changed);
+    }
+
+private:
+    WebGLRenderingContext* m_context;
+    bool m_changed;
+};
+
+PassOwnPtr<WebGLRenderingContext> WebGLRenderingContext::create(HTMLCanvasElement* canvas)
+{
+    OwnPtr<GraphicsContext3D> context(GraphicsContext3D::create());
+    if (!context)
+        return 0;
+        
+    return new WebGLRenderingContext(canvas, context.release());
+}
+
+WebGLRenderingContext::WebGLRenderingContext(HTMLCanvasElement* passedCanvas, PassOwnPtr<GraphicsContext3D> context)
+    : CanvasRenderingContext(passedCanvas)
+    , m_context(context)
+    , m_needsUpdate(true)
+    , m_markedCanvasDirty(false)
+    , m_activeTextureUnit(0)
+{
+    ASSERT(m_context);
+    int numVertexAttribs = 0;
+    m_context->getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &numVertexAttribs);
+    m_maxVertexAttribs = numVertexAttribs;
+    m_context->reshape(canvas()->width(), canvas()->height());
+}
+
+WebGLRenderingContext::~WebGLRenderingContext()
+{
+    detachAndRemoveAllObjects();
+}
+
+void WebGLRenderingContext::markContextChanged()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (canvas()->renderBox() && canvas()->renderBox()->hasLayer()) {
+        canvas()->renderBox()->layer()->rendererContentChanged();
+    } else {
+#endif
+        if (!m_markedCanvasDirty) {
+            // Make sure the canvas's image buffer is allocated.
+            canvas()->buffer();
+            canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
+            m_markedCanvasDirty = true;
+        }
+#if USE(ACCELERATED_COMPOSITING)
+    }
+#endif
+}
+
+void WebGLRenderingContext::beginPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_context->beginPaint(this);
+    }
+}
+
+void WebGLRenderingContext::endPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_markedCanvasDirty = false;
+        m_context->endPaint();
+    }
+}
+
+void WebGLRenderingContext::reshape(int width, int height)
+{
+    if (m_needsUpdate) {
+#if USE(ACCELERATED_COMPOSITING)
+        if (canvas()->renderBox() && canvas()->renderBox()->hasLayer())
+            canvas()->renderBox()->layer()->rendererContentChanged();
+#endif
+        m_needsUpdate = false;
+    }
+    
+    m_context->reshape(width, height);
+}
+
+int WebGLRenderingContext::sizeInBytes(int type, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    int result = m_context->sizeInBytes(type);
+    if (result <= 0)
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+
+    return result;
+}
+
+void WebGLRenderingContext::activeTexture(unsigned long texture, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if ((texture - GraphicsContext3D::TEXTURE0) > sizeof(m_textureUnits) / sizeof(TextureUnitState)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_activeTextureUnit = texture - GraphicsContext3D::TEXTURE0;
+    m_context->activeTexture(texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::attachShader(WebGLProgram* program, WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this || !shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->attachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bindAttribLocation(WebGLProgram* program, unsigned long index, const String& name, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->bindAttribLocation(program, index, name);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bindBuffer(unsigned long target, WebGLBuffer* buffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (buffer && buffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (target == GraphicsContext3D::ARRAY_BUFFER)
+        m_boundArrayBuffer = buffer;
+    else if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER)
+        m_boundElementArrayBuffer = buffer;
+    else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bindBuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::bindFramebuffer(unsigned long target, WebGLFramebuffer* buffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (buffer && buffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    if (target != GraphicsContext3D::FRAMEBUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_framebufferBinding = buffer;
+    m_context->bindFramebuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bindRenderbuffer(unsigned long target, WebGLRenderbuffer* renderBuffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (renderBuffer && renderBuffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    if (target != GraphicsContext3D::RENDERBUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_renderbufferBinding = renderBuffer;
+    m_context->bindRenderbuffer(target, renderBuffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::bindTexture(unsigned long target, WebGLTexture* texture, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (texture && texture->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    if (target == GraphicsContext3D::TEXTURE_2D)
+        m_textureUnits[m_activeTextureUnit].m_texture2DBinding = texture;
+    else if (target == GraphicsContext3D::TEXTURE_CUBE_MAP)
+        m_textureUnits[m_activeTextureUnit].m_textureCubeMapBinding = texture;
+    else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_context->bindTexture(target, texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::blendColor(double red, double green, double blue, double alpha)
+{
+    m_context->blendColor(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::blendEquation( unsigned long mode )
+{
+    m_context->blendEquation(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
+{
+    m_context->blendEquationSeparate(modeRGB, modeAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::blendFunc(unsigned long sfactor, unsigned long dfactor)
+{
+    m_context->blendFunc(sfactor, dfactor);
+    cleanupAfterGraphicsCall(false);
+}       
+
+void WebGLRenderingContext::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
+{
+    m_context->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bufferData(unsigned long target, int size, unsigned long usage, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferData(target, size)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferData(target, size)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bufferData(target, size, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bufferData(unsigned long target, WebGLArray* data, unsigned long usage, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferData(target, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferData(target, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bufferData(target, data, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bufferSubData(unsigned long target, long offset, WebGLArray* data, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferSubData(target, offset, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferSubData(target, offset, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bufferSubData(target, offset, data);
+    cleanupAfterGraphicsCall(false);
+}
+
+unsigned long WebGLRenderingContext::checkFramebufferStatus(unsigned long target)
+{
+    return m_context->checkFramebufferStatus(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::clear(unsigned long mask)
+{
+    m_context->clear(mask);
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::clearColor(double r, double g, double b, double a)
+{
+    if (isnan(r))
+        r = 0;
+    if (isnan(g))
+        g = 0;
+    if (isnan(b))
+        b = 0;
+    if (isnan(a))
+        a = 1;
+    m_context->clearColor(r, g, b, a);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::clearDepth(double depth)
+{
+    m_context->clearDepth(depth);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::clearStencil(long s)
+{
+    m_context->clearStencil(s);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::colorMask(bool red, bool green, bool blue, bool alpha)
+{
+    m_context->colorMask(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::compileShader(WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->compileShader(shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
+{
+    m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
+{
+    m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<WebGLBuffer> WebGLRenderingContext::createBuffer()
+{
+    RefPtr<WebGLBuffer> o = WebGLBuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+        
+PassRefPtr<WebGLFramebuffer> WebGLRenderingContext::createFramebuffer()
+{
+    RefPtr<WebGLFramebuffer> o = WebGLFramebuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLTexture> WebGLRenderingContext::createTexture()
+{
+    RefPtr<WebGLTexture> o = WebGLTexture::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLProgram> WebGLRenderingContext::createProgram()
+{
+    RefPtr<WebGLProgram> o = WebGLProgram::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLRenderbuffer> WebGLRenderingContext::createRenderbuffer()
+{
+    RefPtr<WebGLRenderbuffer> o = WebGLRenderbuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLShader> WebGLRenderingContext::createShader(unsigned long type, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (type != GraphicsContext3D::VERTEX_SHADER && type != GraphicsContext3D::FRAGMENT_SHADER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return 0;
+    }
+    
+    RefPtr<WebGLShader> o = WebGLShader::create(this, static_cast<GraphicsContext3D::WebGLEnumType>(type));
+    addObject(o.get());
+    return o;
+}
+
+void WebGLRenderingContext::cullFace(unsigned long mode)
+{
+    m_context->cullFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::deleteBuffer(WebGLBuffer* buffer)
+{
+    if (!buffer)
+        return;
+    
+    buffer->deleteObject();
+}
+
+void WebGLRenderingContext::deleteFramebuffer(WebGLFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return;
+    
+    framebuffer->deleteObject();
+}
+
+void WebGLRenderingContext::deleteProgram(WebGLProgram* program)
+{
+    if (!program)
+        return;
+    
+    program->deleteObject();
+}
+
+void WebGLRenderingContext::deleteRenderbuffer(WebGLRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return;
+    
+    renderbuffer->deleteObject();
+}
+
+void WebGLRenderingContext::deleteShader(WebGLShader* shader)
+{
+    if (!shader)
+        return;
+    
+    shader->deleteObject();
+}
+
+void WebGLRenderingContext::deleteTexture(WebGLTexture* texture)
+{
+    if (!texture)
+        return;
+    
+    texture->deleteObject();
+}
+
+void WebGLRenderingContext::depthFunc(unsigned long func)
+{
+    m_context->depthFunc(func);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::depthMask(bool flag)
+{
+    m_context->depthMask(flag);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::depthRange(double zNear, double zFar)
+{
+    m_context->depthRange(zNear, zFar);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::detachShader(WebGLProgram* program, WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this || !shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->detachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::disable(unsigned long cap)
+{
+    m_context->disable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::disableVertexAttribArray(unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (index >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    if (index < m_vertexAttribState.size())
+        m_vertexAttribState[index].enabled = false;
+    
+    m_context->disableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+bool WebGLRenderingContext::validateIndexArray(unsigned long count, unsigned long type, long offset, long& numElements)
+{
+    long lastIndex = -1;
+    if (!m_boundElementArrayBuffer)
+        return false;
+        
+    if (offset < 0)
+        return false;
+        
+    // The GL spec says that count must be "greater
+    
+    unsigned long uoffset = static_cast<unsigned long>(offset);
+    
+    if (type == GraphicsContext3D::UNSIGNED_SHORT) {
+        // For an unsigned short array, offset must be divisible by 2 for alignment reasons.
+        if (uoffset & 1)
+            return false;
+        
+        // Make uoffset an element offset.
+        uoffset /= 2;
+    
+        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER) / 2;
+        if (uoffset > n || count > n - uoffset)
+            return false;
+            
+        const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+        while (n-- > 0) {
+            if (*p > lastIndex)
+                lastIndex = *p;
+            ++p;
+        }
+    } else if (type == GraphicsContext3D::UNSIGNED_BYTE) {
+        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER);
+        if (uoffset > n || count > n - uoffset)
+            return false;
+            
+        const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+        while (n-- > 0) {
+            if (*p > lastIndex)
+                lastIndex = *p;
+            ++p;
+        }
+    }    
+        
+    // Then set the last index in the index array and make sure it is valid.
+    numElements = lastIndex + 1;
+    return numElements > 0;
+}
+
+bool WebGLRenderingContext::validateRenderingState(long numElements)
+{
+    // Look in each enabled vertex attrib and find the smallest buffer size
+    long smallestNumElements = LONG_MAX;
+    for (unsigned i = 0; i < m_vertexAttribState.size(); ++i) {
+        const VertexAttribState& state = m_vertexAttribState[i];
+        if (state.enabled && state.numElements < smallestNumElements)
+            smallestNumElements = state.numElements;
+    }
+    
+    if (smallestNumElements == LONG_MAX)
+        smallestNumElements = 0;
+    
+    return numElements <= smallestNumElements;
+}
+
+void WebGLRenderingContext::drawArrays(unsigned long mode, long first, long count, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    // Ensure we have a valid rendering state
+    if (first < 0 || count < 0 || !validateRenderingState(first + count)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    
+    m_context->drawArrays(mode, first, count);
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    // Ensure we have a valid rendering state
+    long numElements;
+    
+    if (offset < 0 || !validateIndexArray(count, type, offset, numElements) || !validateRenderingState(numElements)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    
+    m_context->drawElements(mode, count, type, offset);
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::enable(unsigned long cap)
+{
+    m_context->enable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::enableVertexAttribArray(unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (index >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    if (index >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(index + 1);
+        
+    m_vertexAttribState[index].enabled = true;
+    
+    m_context->enableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::finish()
+{
+    m_context->finish();
+    cleanupAfterGraphicsCall(true);
+}
+
+
+void WebGLRenderingContext::flush()
+{
+    m_context->flush();
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer* buffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (buffer && buffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }       
+    m_context->framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture* texture, long level, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (texture && texture->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->framebufferTexture2D(target, attachment, textarget, texture, level);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::frontFace(unsigned long mode)
+{
+    m_context->frontFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::generateMipmap(unsigned long target)
+{
+    m_context->generateMipmap(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<WebGLActiveInfo> WebGLRenderingContext::getActiveAttrib(WebGLProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    ActiveInfo info;
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return 0;
+    }
+    if (!m_context->getActiveAttrib(program, index, info)) {
+        return 0;
+    }
+    return WebGLActiveInfo::create(info.name, info.type, info.size);
+}
+
+PassRefPtr<WebGLActiveInfo> WebGLRenderingContext::getActiveUniform(WebGLProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    ActiveInfo info;
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return 0;
+    }
+    if (!m_context->getActiveUniform(program, index, info)) {
+        return 0;
+    }
+    return WebGLActiveInfo::create(info.name, info.type, info.size);
+}
+
+int WebGLRenderingContext::getAttribLocation(WebGLProgram* program, const String& name)
+{
+    return m_context->getAttribLocation(program, name);
+}
+
+WebGLGetInfo WebGLRenderingContext::getBufferParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::ARRAY_BUFFER && target != GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    if (pname != GraphicsContext3D::BUFFER_SIZE && pname != GraphicsContext3D::BUFFER_USAGE) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    WebGLStateRestorer(this, false);
+    int value;
+    m_context->getBufferParameteriv(target, pname, &value);
+    if (pname == GraphicsContext3D::BUFFER_SIZE)
+        return WebGLGetInfo(static_cast<long>(value));
+    else
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+}
+
+unsigned long WebGLRenderingContext::getError()
+{
+    return m_context->getError();
+}
+
+WebGLGetInfo WebGLRenderingContext::getFramebufferAttachmentParameter(unsigned long target, unsigned long attachment, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::FRAMEBUFFER
+        || (attachment != GraphicsContext3D::COLOR_ATTACHMENT0
+            && attachment != GraphicsContext3D::DEPTH_ATTACHMENT
+            && attachment != GraphicsContext3D::STENCIL_ATTACHMENT)
+        || (pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE
+            && pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_NAME
+            && pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL
+            && pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    if (pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_NAME) {
+        WebGLStateRestorer(this, false);
+        int value;
+        m_context->getFramebufferAttachmentParameteriv(target, attachment, pname, &value);
+        if (pname == GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE)
+            return WebGLGetInfo(static_cast<unsigned long>(value));
+        else
+            return WebGLGetInfo(static_cast<long>(value));
+    } else {
+        WebGLStateRestorer(this, false);
+        int type = 0;
+        m_context->getFramebufferAttachmentParameteriv(target, attachment, GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE, &type);
+        int value = 0;
+        m_context->getFramebufferAttachmentParameteriv(target, attachment, GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_NAME, &value);
+        // FIXME: should consider canonicalizing these objects
+        switch (type) {
+        case GraphicsContext3D::RENDERBUFFER: {
+            RefPtr<WebGLRenderbuffer> tmp = WebGLRenderbuffer::create(this, value);
+            addObject(tmp.get());
+            return WebGLGetInfo(PassRefPtr<WebGLRenderbuffer>(tmp));
+        }
+        case GraphicsContext3D::TEXTURE: {
+            RefPtr<WebGLTexture> tmp = WebGLTexture::create(this, value);
+            addObject(tmp.get());
+            return WebGLGetInfo(PassRefPtr<WebGLTexture>(tmp));
+        }
+        default:
+            // FIXME: raise exception?
+            return WebGLGetInfo();
+        }
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getParameter(unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    WebGLStateRestorer(this, false);
+    switch (pname) {
+    case GraphicsContext3D::ACTIVE_TEXTURE:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::ALIASED_LINE_WIDTH_RANGE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::ALIASED_POINT_SIZE_RANGE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::ALPHA_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::ARRAY_BUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(m_boundArrayBuffer));
+    case GraphicsContext3D::BLEND:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::BLEND_COLOR:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::BLEND_DST_ALPHA:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_DST_RGB:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_EQUATION_ALPHA:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_EQUATION_RGB:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_SRC_ALPHA:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_SRC_RGB:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLUE_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::COLOR_CLEAR_VALUE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::COLOR_WRITEMASK:
+        return getWebGLUnsignedByteArrayParameter(pname);
+    case GraphicsContext3D::COMPRESSED_TEXTURE_FORMATS:
+        // Defined as null in the spec
+        return WebGLGetInfo();
+    case GraphicsContext3D::CULL_FACE:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::CULL_FACE_MODE:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::CURRENT_PROGRAM:
+        return WebGLGetInfo(PassRefPtr<WebGLProgram>(m_currentProgram));
+    case GraphicsContext3D::DEPTH_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::DEPTH_CLEAR_VALUE:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::DEPTH_FUNC:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::DEPTH_RANGE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::DEPTH_TEST:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::DEPTH_WRITEMASK:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::DITHER:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::ELEMENT_ARRAY_BUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(m_boundElementArrayBuffer));
+    case GraphicsContext3D::FRAMEBUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLFramebuffer>(m_framebufferBinding));
+    case GraphicsContext3D::FRONT_FACE:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::GENERATE_MIPMAP_HINT:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::GREEN_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::LINE_WIDTH:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_CUBE_MAP_TEXTURE_SIZE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_RENDERBUFFER_SIZE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_TEXTURE_SIZE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VARYING_VECTORS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VERTEX_ATTRIBS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VIEWPORT_DIMS:
+        return getWebGLIntArrayParameter(pname);
+    case GraphicsContext3D::NUM_COMPRESSED_TEXTURE_FORMATS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::NUM_SHADER_BINARY_FORMATS:
+        // FIXME: should we always return 0 for this?
+        return getLongParameter(pname);
+    case GraphicsContext3D::PACK_ALIGNMENT:
+        return getLongParameter(pname);
+    case GraphicsContext3D::POLYGON_OFFSET_FACTOR:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::POLYGON_OFFSET_FILL:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::POLYGON_OFFSET_UNITS:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::RED_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::RENDERBUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLRenderbuffer>(m_renderbufferBinding));
+    case GraphicsContext3D::SAMPLE_BUFFERS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::SAMPLE_COVERAGE_INVERT:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::SAMPLE_COVERAGE_VALUE:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::SAMPLES:
+        return getLongParameter(pname);
+    case GraphicsContext3D::SCISSOR_BOX:
+        return getWebGLIntArrayParameter(pname);
+    case GraphicsContext3D::SCISSOR_TEST:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_FUNC:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_PASS_DEPTH_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_PASS_DEPTH_PASS:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_REF:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_VALUE_MASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_WRITEMASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_CLEAR_VALUE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_FUNC:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_PASS_DEPTH_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_PASS_DEPTH_PASS:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_REF:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_TEST:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::STENCIL_VALUE_MASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_WRITEMASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::SUBPIXEL_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::TEXTURE_BINDING_2D:
+        return WebGLGetInfo(PassRefPtr<WebGLTexture>(m_textureUnits[m_activeTextureUnit].m_texture2DBinding));
+    case GraphicsContext3D::TEXTURE_BINDING_CUBE_MAP:
+        return WebGLGetInfo(PassRefPtr<WebGLTexture>(m_textureUnits[m_activeTextureUnit].m_textureCubeMapBinding));
+    case GraphicsContext3D::UNPACK_ALIGNMENT:
+        // FIXME: should this be "long" in the spec?
+        return getIntParameter(pname);
+    case GraphicsContext3D::VIEWPORT:
+        return getWebGLIntArrayParameter(pname);
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getProgramParameter(WebGLProgram* program, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return WebGLGetInfo();
+    }
+
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::DELETE_STATUS:
+    case GraphicsContext3D::LINK_STATUS:
+    case GraphicsContext3D::VALIDATE_STATUS:
+        m_context->getProgramiv(program, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
+    case GraphicsContext3D::INFO_LOG_LENGTH:
+    case GraphicsContext3D::ATTACHED_SHADERS:
+    case GraphicsContext3D::ACTIVE_ATTRIBUTES:
+    case GraphicsContext3D::ACTIVE_ATTRIBUTE_MAX_LENGTH:
+    case GraphicsContext3D::ACTIVE_UNIFORMS:
+    case GraphicsContext3D::ACTIVE_UNIFORM_MAX_LENGTH:
+        m_context->getProgramiv(program, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+String WebGLRenderingContext::getProgramInfoLog(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return "";
+    }
+    WebGLStateRestorer(this, false);
+    return m_context->getProgramInfoLog(program);
+}
+
+WebGLGetInfo WebGLRenderingContext::getRenderbufferParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::RENDERBUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::RENDERBUFFER_WIDTH:
+    case GraphicsContext3D::RENDERBUFFER_HEIGHT:
+    case GraphicsContext3D::RENDERBUFFER_RED_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_GREEN_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_BLUE_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_ALPHA_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_DEPTH_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_STENCIL_SIZE:
+        m_context->getRenderbufferParameteriv(target, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    case GraphicsContext3D::RENDERBUFFER_INTERNAL_FORMAT:
+        m_context->getRenderbufferParameteriv(target, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getShaderParameter(WebGLShader* shader, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return WebGLGetInfo();
+    }
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::DELETE_STATUS:
+    case GraphicsContext3D::COMPILE_STATUS:
+        m_context->getShaderiv(shader, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
+    case GraphicsContext3D::SHADER_TYPE:
+        m_context->getShaderiv(shader, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    case GraphicsContext3D::INFO_LOG_LENGTH:
+    case GraphicsContext3D::SHADER_SOURCE_LENGTH:
+        m_context->getShaderiv(shader, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+String WebGLRenderingContext::getShaderInfoLog(WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return "";
+    }
+    WebGLStateRestorer(this, false);
+    return m_context->getShaderInfoLog(shader);
+}
+
+String WebGLRenderingContext::getShaderSource(WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return "";
+    }
+    WebGLStateRestorer(this, false);
+    return m_context->getShaderSource(shader);
+}
+
+String WebGLRenderingContext::getString(unsigned long name)
+{
+    WebGLStateRestorer(this, false);
+    return m_context->getString(name);
+}
+
+WebGLGetInfo WebGLRenderingContext::getTexParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::TEXTURE_2D
+        && target != GraphicsContext3D::TEXTURE_CUBE_MAP) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::TEXTURE_MAG_FILTER:
+    case GraphicsContext3D::TEXTURE_MIN_FILTER:
+    case GraphicsContext3D::TEXTURE_WRAP_S:
+    case GraphicsContext3D::TEXTURE_WRAP_T:
+        m_context->getTexParameteriv(target, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getUniform(WebGLProgram* program, const WebGLUniformLocation* uniformLocation, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || uniformLocation->program() != program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return WebGLGetInfo();
+    }
+    long location = uniformLocation->location();
+    
+    WebGLStateRestorer(this, false);
+    // FIXME: make this more efficient using WebGLUniformLocation and caching types in it
+    int activeUniforms = 0;
+    m_context->getProgramiv(program, GraphicsContext3D::ACTIVE_UNIFORMS, &activeUniforms);
+    for (int i = 0; i < activeUniforms; i++) {
+        ActiveInfo info;
+        if (!m_context->getActiveUniform(program, i, info))
+            return WebGLGetInfo();
+        // Now need to look this up by name again to find its location
+        long loc = m_context->getUniformLocation(program, info.name);
+        if (loc == location) {
+            // Found it. Use the type in the ActiveInfo to determine the return type.
+            GraphicsContext3D::WebGLEnumType baseType;
+            unsigned length;
+            switch (info.type) {
+                case GraphicsContext3D::BOOL:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 1;
+                    break;
+                case GraphicsContext3D::BOOL_VEC2:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 2;
+                    break;
+                case GraphicsContext3D::BOOL_VEC3:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 3;
+                    break;
+                case GraphicsContext3D::BOOL_VEC4:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::INT:
+                    baseType = GraphicsContext3D::INT;
+                    length = 1;
+                    break;
+                case GraphicsContext3D::INT_VEC2:
+                    baseType = GraphicsContext3D::INT;
+                    length = 2;
+                    break;
+                case GraphicsContext3D::INT_VEC3:
+                    baseType = GraphicsContext3D::INT;
+                    length = 3;
+                    break;
+                case GraphicsContext3D::INT_VEC4:
+                    baseType = GraphicsContext3D::INT;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::FLOAT:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 1;
+                    break;
+                case GraphicsContext3D::FLOAT_VEC2:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 2;
+                    break;
+                case GraphicsContext3D::FLOAT_VEC3:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 3;
+                    break;
+                case GraphicsContext3D::FLOAT_VEC4:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::FLOAT_MAT2:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::FLOAT_MAT3:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 9;
+                    break;
+                case GraphicsContext3D::FLOAT_MAT4:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 16;
+                    break;
+                default:
+                    // Can't handle this type
+                    // FIXME: what to do about samplers?
+                    m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+                    return WebGLGetInfo();
+            }
+            switch (baseType) {
+            case GraphicsContext3D::FLOAT: {
+                float value[16] = {0};
+                m_context->getUniformfv(program, location, value);
+                if (length == 1)
+                    return WebGLGetInfo(value[0]);
+                else
+                    return WebGLGetInfo(WebGLFloatArray::create(value, length));
+            }
+            case GraphicsContext3D::INT: {
+                int value[16] = {0};
+                m_context->getUniformiv(program, location, value);
+                if (length == 1)
+                    return WebGLGetInfo(static_cast<long>(value[0]));
+                else
+                    return WebGLGetInfo(WebGLIntArray::create(value, length));
+            }
+            case GraphicsContext3D::BOOL: {
+                int value[16] = {0};
+                m_context->getUniformiv(program, location, value);
+                if (length == 1)
+                    return WebGLGetInfo(static_cast<bool>(value[0]));
+                else {
+                    unsigned char boolValue[16] = {0};
+                    for (unsigned j = 0; j < length; j++)
+                        boolValue[j] = static_cast<bool>(value[j]);
+                    return WebGLGetInfo(WebGLUnsignedByteArray::create(boolValue, length));
+                }
+            }
+            default:
+                notImplemented();
+            }
+        }
+    }
+    // If we get here, something went wrong in our unfortunately complex logic above
+    m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+    return WebGLGetInfo();
+}
+
+PassRefPtr<WebGLUniformLocation> WebGLRenderingContext::getUniformLocation(WebGLProgram* program, const String& name, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return 0;
+    }
+    WebGLStateRestorer(this, false);
+    return WebGLUniformLocation::create(program, m_context->getUniformLocation(program, name));
+}
+
+WebGLGetInfo WebGLRenderingContext::getVertexAttrib(unsigned long index, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    WebGLStateRestorer(this, false);
+    switch (pname) {
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_BUFFER_BINDING: {
+        int name = 0;
+        m_context->getVertexAttribiv(index, pname, &name);
+        if (name == 0)
+            return WebGLGetInfo();
+        RefPtr<WebGLBuffer> tmp = WebGLBuffer::create(this, name);
+        addObject(tmp.get());
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(tmp));
+    }
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_ENABLED:
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_NORMALIZED: {
+        int value = 0;
+        m_context->getVertexAttribiv(index, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
+    }
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_SIZE:
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_STRIDE: {
+        int value = 0;
+        m_context->getVertexAttribiv(index, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    }
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_TYPE: {
+        int value = 0;
+        m_context->getVertexAttribiv(index, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    }
+    case GraphicsContext3D::CURRENT_VERTEX_ATTRIB: {
+        float value[4] = {0};
+        m_context->getVertexAttribfv(index, pname, value);
+        return WebGLGetInfo(WebGLFloatArray::create(value, 4));
+    }
+    default: {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+    }
+}
+
+long WebGLRenderingContext::getVertexAttribOffset(unsigned long index, unsigned long pname)
+{
+    long result = m_context->getVertexAttribOffset(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+void WebGLRenderingContext::hint(unsigned long target, unsigned long mode)
+{
+    m_context->hint(target, mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+bool WebGLRenderingContext::isBuffer(WebGLBuffer* buffer)
+{
+    if (!buffer)
+        return false;
+
+    return m_context->isBuffer(buffer);
+}
+
+bool WebGLRenderingContext::isEnabled(unsigned long cap)
+{
+    return m_context->isEnabled(cap);
+}
+
+bool WebGLRenderingContext::isFramebuffer(WebGLFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return false;
+
+    return m_context->isFramebuffer(framebuffer);
+}
+
+bool WebGLRenderingContext::isProgram(WebGLProgram* program)
+{
+    if (!program)
+        return false;
+
+    return m_context->isProgram(program);
+}
+
+bool WebGLRenderingContext::isRenderbuffer(WebGLRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return false;
+
+    return m_context->isRenderbuffer(renderbuffer);
+}
+
+bool WebGLRenderingContext::isShader(WebGLShader* shader)
+{
+    if (!shader)
+        return false;
+
+    return m_context->isShader(shader);
+}
+
+bool WebGLRenderingContext::isTexture(WebGLTexture* texture)
+{
+    if (!texture)
+        return false;
+
+    return m_context->isTexture(texture);
+}
+
+void WebGLRenderingContext::lineWidth(double width)
+{
+    m_context->lineWidth((float) width);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::linkProgram(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+        
+    m_context->linkProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::pixelStorei(unsigned long pname, long param)
+{
+    m_context->pixelStorei(pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::polygonOffset(double factor, double units)
+{
+    m_context->polygonOffset((float) factor, (float) units);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<WebGLArray> WebGLRenderingContext::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+{
+    RefPtr<WebGLArray> array = m_context->readPixels(x, y, width, height, format, type);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+void WebGLRenderingContext::releaseShaderCompiler()
+{
+    m_context->releaseShaderCompiler();
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    m_context->renderbufferStorage(target, internalformat, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::sampleCoverage(double value, bool invert)
+{
+    m_context->sampleCoverage((float) value, invert);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::scissor(long x, long y, unsigned long width, unsigned long height)
+{
+    m_context->scissor(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::shaderSource(WebGLShader* shader, const String& string, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->shaderSource(shader, string);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilFunc(unsigned long func, long ref, unsigned long mask)
+{
+    m_context->stencilFunc(func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
+{
+    m_context->stencilFuncSeparate(face, func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilMask(unsigned long mask)
+{
+    m_context->stencilMask(mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilMaskSeparate(unsigned long face, unsigned long mask)
+{
+    m_context->stencilMaskSeparate(face, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context->stencilOp(fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context->stencilOpSeparate(face, fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!image) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    CachedImage* cachedImage = image->cachedImage();
+    if (!cachedImage) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    // FIXME: For now we ignore any errors returned
+    m_context->texImage2D(target, level, cachedImage->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!canvas) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    ImageBuffer* buffer = canvas->buffer();
+    if (!buffer) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    // FIXME: For now we ignore any errors returned
+    m_context->texImage2D(target, level, buffer->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texImage2D(target, level, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texParameterf(unsigned target, unsigned pname, float param)
+{
+    m_context->texParameterf(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texParameteri(unsigned target, unsigned pname, int param)
+{
+    m_context->texParameteri(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLImageElement* image,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    if (!image) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    CachedImage* cachedImage = image->cachedImage();
+    if (!cachedImage) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, cachedImage->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!canvas) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    ImageBuffer* buffer = canvas->buffer();
+    if (!buffer) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    // FIXME: For now we ignore any errors returned
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, buffer->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLVideoElement* video,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1f(const WebGLUniformLocation* location, float x, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform1f(location->location(), x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1fv(location->location(), v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1fv(location->location(), v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1i(const WebGLUniformLocation* location, int x, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform1i(location->location(), x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1iv(location->location(), v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1iv(location->location(), v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2f(const WebGLUniformLocation* location, float x, float y, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform2f(location->location(), x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2fv(location->location(), v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2fv(location->location(), v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2i(const WebGLUniformLocation* location, int x, int y, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform2i(location->location(), x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2iv(location->location(), v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2iv(location->location(), v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3f(const WebGLUniformLocation* location, float x, float y, float z, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform3f(location->location(), x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3fv(location->location(), v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3fv(location->location(), v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3i(const WebGLUniformLocation* location, int x, int y, int z, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform3i(location->location(), x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3iv(location->location(), v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3iv(location->location(), v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4f(const WebGLUniformLocation* location, float x, float y, float z, float w, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform4f(location->location(), x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4fv(location->location(), v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4fv(location->location(), v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4i(const WebGLUniformLocation* location, int x, int y, int z, int w, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform4i(location->location(), x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4iv(location->location(), v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4iv(location->location(), v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniformMatrix2fv(location->location(), transpose, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniformMatrix2fv(location->location(), transpose, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 9
+    m_context->uniformMatrix3fv(location->location(), transpose, v->data(), v->length() / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 9
+    m_context->uniformMatrix3fv(location->location(), transpose, v, size / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 16
+    m_context->uniformMatrix4fv(location->location(), transpose, v->data(), v->length() / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 16
+    m_context->uniformMatrix4fv(location->location(), transpose, v, size / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+        
+    m_currentProgram = program;
+    m_context->useProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::validateProgram(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+        
+    m_context->validateProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib1f(unsigned long indx, float v0)
+{
+    m_context->vertexAttrib1f(indx, v0);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib1fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib1fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib1fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib1fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib2f(unsigned long indx, float v0, float v1)
+{
+    m_context->vertexAttrib2f(indx, v0, v1);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib2fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib2fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib2fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib2fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+{
+    m_context->vertexAttrib3f(indx, v0, v1, v2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib3fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib3fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib3fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib3fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+{
+    m_context->vertexAttrib4f(indx, v0, v1, v2, v3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib4fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib4fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib4fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib4fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!m_boundArrayBuffer || indx >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    if (indx >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(indx + 1);
+
+    // Determine the number of elements the bound buffer can hold, given the offset, size, type and stride
+    long bytesPerElement = size * sizeInBytes(type, ec);
+    if (bytesPerElement <= 0)
+        return;
+    long validatedStride = bytesPerElement;
+    if (stride != 0) {
+        if ((long) stride < bytesPerElement) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+        
+        validatedStride = stride;
+    }
+        
+    // Avoid off-by-one errors in numElements computation.
+    // For the last element, we will only touch the data for the
+    // element and nothing beyond it.
+    long bytesRemaining = m_boundArrayBuffer->byteLength(GraphicsContext3D::ARRAY_BUFFER) - offset;
+    if (bytesRemaining < bytesPerElement)
+        m_vertexAttribState[indx].numElements = 0;
+    else
+        m_vertexAttribState[indx].numElements = 1 + (bytesRemaining - bytesPerElement) / validatedStride;
+
+    m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(width))
+        width = 100;
+    if (isnan(height))
+        height = 100;
+    m_context->viewport(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::removeObject(CanvasObject* object)
+{
+    m_canvasObjects.remove(object);
+}
+
+void WebGLRenderingContext::addObject(CanvasObject* object)
+{
+    removeObject(object);
+    m_canvasObjects.add(object);
+}
+
+void WebGLRenderingContext::detachAndRemoveAllObjects()
+{
+    HashSet<RefPtr<CanvasObject> >::iterator pend = m_canvasObjects.end();
+    for (HashSet<RefPtr<CanvasObject> >::iterator it = m_canvasObjects.begin(); it != pend; ++it)
+        (*it)->detachContext();
+        
+    m_canvasObjects.clear();
+}
+
+WebGLGetInfo WebGLRenderingContext::getBooleanParameter(unsigned long pname)
+{
+    unsigned char value;
+    m_context->getBooleanv(pname, &value);
+    return WebGLGetInfo(static_cast<bool>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getFloatParameter(unsigned long pname)
+{
+    float value;
+    m_context->getFloatv(pname, &value);
+    return WebGLGetInfo(static_cast<float>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getIntParameter(unsigned long pname)
+{
+    return getLongParameter(pname);
+}
+
+WebGLGetInfo WebGLRenderingContext::getLongParameter(unsigned long pname)
+{
+    int value;
+    m_context->getIntegerv(pname, &value);
+    return WebGLGetInfo(static_cast<long>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getUnsignedLongParameter(unsigned long pname)
+{
+    int value;
+    m_context->getIntegerv(pname, &value);
+    return WebGLGetInfo(static_cast<unsigned long>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getWebGLFloatArrayParameter(unsigned long pname)
+{
+    float value[4] = {0};
+    m_context->getFloatv(pname, value);
+    unsigned length = 0;
+    switch (pname) {
+    case GraphicsContext3D::ALIASED_POINT_SIZE_RANGE:
+    case GraphicsContext3D::ALIASED_LINE_WIDTH_RANGE:
+    case GraphicsContext3D::DEPTH_RANGE:
+        length = 2;
+        break;
+    case GraphicsContext3D::BLEND_COLOR:
+    case GraphicsContext3D::COLOR_CLEAR_VALUE:
+        length = 4;
+        break;
+    default:
+        notImplemented();
+    }
+    return WebGLGetInfo(WebGLFloatArray::create(value, length));
+}
+
+WebGLGetInfo WebGLRenderingContext::getWebGLIntArrayParameter(unsigned long pname)
+{
+    int value[4] = {0};
+    m_context->getIntegerv(pname, value);
+    unsigned length = 0;
+    switch (pname) {
+    case GraphicsContext3D::MAX_VIEWPORT_DIMS:
+        length = 2;
+        break;
+    case GraphicsContext3D::SCISSOR_BOX:
+    case GraphicsContext3D::VIEWPORT:
+        length = 4;
+        break;
+    default:
+        notImplemented();
+    }
+    return WebGLGetInfo(WebGLIntArray::create(value, length));
+}
+
+WebGLGetInfo WebGLRenderingContext::getWebGLUnsignedByteArrayParameter(unsigned long pname)
+{
+    unsigned char value[4] = {0};
+    m_context->getBooleanv(pname, value);
+    unsigned length = 0;
+    switch (pname) {
+    case GraphicsContext3D::COLOR_WRITEMASK:
+        length = 4;
+        break;
+    default:
+        notImplemented();
+    }
+    return WebGLGetInfo(WebGLUnsignedByteArray::create(value, length));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLRenderingContext.h b/WebCore/html/canvas/WebGLRenderingContext.h
new file mode 100644
index 0000000..3335eba
--- /dev/null
+++ b/WebCore/html/canvas/WebGLRenderingContext.h
@@ -0,0 +1,355 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLRenderingContext_h
+#define WebGLRenderingContext_h
+
+#include "CanvasRenderingContext.h"
+#include "ExceptionCode.h"
+#include "WebGLFloatArray.h"
+#include "WebGLGetInfo.h"
+#include "WebGLIntArray.h"
+#include "WebGLUnsignedByteArray.h"
+#include "GraphicsContext3D.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class WebGLActiveInfo;
+class WebGLBuffer;
+class WebGLFramebuffer;
+class CanvasObject;
+class WebGLProgram;
+class WebGLRenderbuffer;
+class WebGLShader;
+class WebGLTexture;
+class WebGLUniformLocation;
+class HTMLImageElement;
+class HTMLVideoElement;
+class ImageData;
+class WebKitCSSMatrix;
+
+    class WebGLRenderingContext : public CanvasRenderingContext {
+    public:
+        static PassOwnPtr<WebGLRenderingContext> create(HTMLCanvasElement*);
+        virtual ~WebGLRenderingContext();
+
+        virtual bool is3d() const { return true; }
+
+        // Helper to return the size in bytes of OpenGL data types
+        // like GL_FLOAT, GL_INT, etc.
+        int sizeInBytes(int type, ExceptionCode& ec);
+
+        void activeTexture(unsigned long texture, ExceptionCode& ec);
+        void attachShader(WebGLProgram*, WebGLShader*, ExceptionCode& ec);
+        void bindAttribLocation(WebGLProgram*, unsigned long index, const String& name, ExceptionCode& ec);
+        void bindBuffer(unsigned long target, WebGLBuffer*, ExceptionCode& ec);
+        void bindFramebuffer(unsigned long target, WebGLFramebuffer*, ExceptionCode& ec);
+        void bindRenderbuffer(unsigned long target, WebGLRenderbuffer*, ExceptionCode& ec);
+        void bindTexture(unsigned long target, WebGLTexture*, ExceptionCode& ec);
+        void blendColor(double red, double green, double blue, double alpha);
+        void blendEquation(unsigned long mode);
+        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
+        void blendFunc(unsigned long sfactor, unsigned long dfactor);
+        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
+
+        void bufferData(unsigned long target, int size, unsigned long usage, ExceptionCode&);
+        void bufferData(unsigned long target, WebGLArray* data, unsigned long usage, ExceptionCode&);
+        void bufferSubData(unsigned long target, long offset, WebGLArray* data, ExceptionCode&);
+
+        unsigned long checkFramebufferStatus(unsigned long target);
+        void clear(unsigned long mask);
+        void clearColor(double red, double green, double blue, double alpha);
+        void clearDepth(double);
+        void clearStencil(long);
+        void colorMask(bool red, bool green, bool blue, bool alpha);
+        void compileShader(WebGLShader*, ExceptionCode& ec);
+        
+        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
+        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
+        
+        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
+        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
+
+        PassRefPtr<WebGLBuffer> createBuffer();
+        PassRefPtr<WebGLFramebuffer> createFramebuffer();
+        PassRefPtr<WebGLProgram> createProgram();
+        PassRefPtr<WebGLRenderbuffer> createRenderbuffer();
+        PassRefPtr<WebGLShader> createShader(unsigned long type, ExceptionCode&);
+        PassRefPtr<WebGLTexture> createTexture();
+
+        void cullFace(unsigned long mode);
+
+        void deleteBuffer(WebGLBuffer*);
+        void deleteFramebuffer(WebGLFramebuffer*);
+        void deleteProgram(WebGLProgram*);
+        void deleteRenderbuffer(WebGLRenderbuffer*);
+        void deleteShader(WebGLShader*);
+        void deleteTexture(WebGLTexture*);
+        
+        void depthFunc(unsigned long);
+        void depthMask(bool);
+        void depthRange(double zNear, double zFar);
+        void detachShader(WebGLProgram*, WebGLShader*, ExceptionCode&);
+        void disable(unsigned long cap);
+        void disableVertexAttribArray(unsigned long index, ExceptionCode&);
+        void drawArrays(unsigned long mode, long first, long count, ExceptionCode&);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset, ExceptionCode&);
+
+        void enable(unsigned long cap);
+        void enableVertexAttribArray(unsigned long index, ExceptionCode&);
+        void finish();
+        void flush();
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer*, ExceptionCode& ec);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture*, long level, ExceptionCode& ec);
+        void frontFace(unsigned long mode);
+        void generateMipmap(unsigned long target);
+
+        PassRefPtr<WebGLActiveInfo> getActiveAttrib(WebGLProgram*, unsigned long index, ExceptionCode&);
+        PassRefPtr<WebGLActiveInfo> getActiveUniform(WebGLProgram*, unsigned long index, ExceptionCode&);
+
+        int  getAttribLocation(WebGLProgram*, const String& name);
+
+        WebGLGetInfo getBufferParameter(unsigned long target, unsigned long pname, ExceptionCode&);
+
+        unsigned long getError();
+
+        WebGLGetInfo getFramebufferAttachmentParameter(unsigned long target, unsigned long attachment, unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getParameter(unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getProgramParameter(WebGLProgram*, unsigned long pname, ExceptionCode&);
+
+        String getProgramInfoLog(WebGLProgram*, ExceptionCode& ec);
+
+        WebGLGetInfo getRenderbufferParameter(unsigned long target, unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getShaderParameter(WebGLShader*, unsigned long pname, ExceptionCode& ec);
+
+        String getShaderInfoLog(WebGLShader*, ExceptionCode& ec);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        String getShaderSource(WebGLShader*, ExceptionCode&);
+        String getString(unsigned long name);
+
+        WebGLGetInfo getTexParameter(unsigned long target, unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getUniform(WebGLProgram*, const WebGLUniformLocation*, ExceptionCode&);
+
+        PassRefPtr<WebGLUniformLocation> getUniformLocation(WebGLProgram*, const String&, ExceptionCode&);
+
+        WebGLGetInfo getVertexAttrib(unsigned long index, unsigned long pname, ExceptionCode&);
+
+        long getVertexAttribOffset(unsigned long index, unsigned long pname);
+
+        void hint(unsigned long target, unsigned long mode);
+        bool isBuffer(WebGLBuffer*);
+        bool isEnabled(unsigned long cap);
+        bool isFramebuffer(WebGLFramebuffer*);
+        bool isProgram(WebGLProgram*);
+        bool isRenderbuffer(WebGLRenderbuffer*);
+        bool isShader(WebGLShader*);
+        bool isTexture(WebGLTexture*);
+        void lineWidth(double);
+        void linkProgram(WebGLProgram*, ExceptionCode&);
+        void pixelStorei(unsigned long pname, long param);
+        void polygonOffset(double factor, double units);
+        
+        PassRefPtr<WebGLArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
+        
+        void releaseShaderCompiler();
+        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
+        void sampleCoverage(double value, bool invert);
+        void scissor(long x, long y, unsigned long width, unsigned long height);
+        void shaderSource(WebGLShader*, const String&, ExceptionCode&);
+        void stencilFunc(unsigned long func, long ref, unsigned long mask);
+        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
+        void stencilMask(unsigned long);
+        void stencilMaskSeparate(unsigned long face, unsigned long mask);
+        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
+        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
+
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void texParameterf(unsigned target, unsigned pname, float param);
+        void texParameteri(unsigned target, unsigned pname, int param);
+
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLImageElement* image,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLVideoElement* video,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void uniform1f(const WebGLUniformLocation* location, float x, ExceptionCode&);
+        void uniform1fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform1fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform1i(const WebGLUniformLocation* location, int x, ExceptionCode&);
+        void uniform1iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform1iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniform2f(const WebGLUniformLocation* location, float x, float y, ExceptionCode&);
+        void uniform2fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform2fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform2i(const WebGLUniformLocation* location, int x, int y, ExceptionCode&);
+        void uniform2iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform2iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniform3f(const WebGLUniformLocation* location, float x, float y, float z, ExceptionCode&);
+        void uniform3fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform3fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform3i(const WebGLUniformLocation* location, int x, int y, int z, ExceptionCode&);
+        void uniform3iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform3iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniform4f(const WebGLUniformLocation* location, float x, float y, float z, float w, ExceptionCode&);
+        void uniform4fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform4fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform4i(const WebGLUniformLocation* location, int x, int y, int z, int w, ExceptionCode&);
+        void uniform4iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform4iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* value, ExceptionCode&);
+        void uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, float* value, int size, ExceptionCode&);
+        void uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* value, ExceptionCode&);
+        void uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, float* value, int size, ExceptionCode&);
+        void uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* value, ExceptionCode&);
+        void uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, float* value, int size, ExceptionCode&);
+
+        void useProgram(WebGLProgram*, ExceptionCode&);
+        void validateProgram(WebGLProgram*, ExceptionCode&);
+
+        void vertexAttrib1f(unsigned long indx, float x);
+        void vertexAttrib1fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib1fv(unsigned long indx, float* values, int size);
+        void vertexAttrib2f(unsigned long indx, float x, float y);
+        void vertexAttrib2fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib2fv(unsigned long indx, float* values, int size);
+        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib3fv(unsigned long indx, float* values, int size);
+        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib4fv(unsigned long indx, float* values, int size);
+        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
+                                 unsigned long stride, unsigned long offset, ExceptionCode&);
+
+        void viewport(long x, long y, unsigned long width, unsigned long height);
+
+        GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
+    
+        void reshape(int width, int height);
+
+        // Helpers for notification about paint events.
+        void beginPaint();
+        void endPaint();
+        
+        void removeObject(CanvasObject*);
+        
+    private:
+        friend class CanvasObject;
+
+        WebGLRenderingContext(HTMLCanvasElement*, PassOwnPtr<GraphicsContext3D>);
+
+        void addObject(CanvasObject*);
+        void detachAndRemoveAllObjects();
+
+        void markContextChanged();
+        void cleanupAfterGraphicsCall(bool changed)
+        {
+            if (changed)
+                markContextChanged();
+        }
+        
+        bool validateIndexArray(unsigned long count, unsigned long type, long offset, long& numElements);
+        bool validateRenderingState(long numElements);
+
+        OwnPtr<GraphicsContext3D> m_context;
+        bool m_needsUpdate;
+        bool m_markedCanvasDirty;
+        // FIXME: I think this is broken -- it does not increment any
+        // reference counts, so may refer to destroyed objects.
+        HashSet<RefPtr<CanvasObject> > m_canvasObjects;
+        
+        // List of bound VBO's. Used to maintain info about sizes for ARRAY_BUFFER and stored values for ELEMENT_ARRAY_BUFFER
+        RefPtr<WebGLBuffer> m_boundArrayBuffer;
+        RefPtr<WebGLBuffer> m_boundElementArrayBuffer;
+    
+        // Cached values for vertex attrib range checks
+        class VertexAttribState {
+        public:
+            VertexAttribState() : enabled(false), numElements(0) { }
+            bool enabled;
+            long numElements;
+        };
+        
+        Vector<VertexAttribState> m_vertexAttribState;
+        unsigned m_maxVertexAttribs;
+
+        RefPtr<WebGLProgram> m_currentProgram;
+        RefPtr<WebGLFramebuffer> m_framebufferBinding;
+        RefPtr<WebGLRenderbuffer> m_renderbufferBinding;
+        class TextureUnitState {
+        public:
+            RefPtr<WebGLTexture> m_texture2DBinding;
+            RefPtr<WebGLTexture> m_textureCubeMapBinding;
+        };
+        TextureUnitState m_textureUnits[32];
+        unsigned long m_activeTextureUnit;
+
+        // Helpers for getParameter and others
+        WebGLGetInfo getBooleanParameter(unsigned long pname);
+        WebGLGetInfo getFloatParameter(unsigned long pname);
+        WebGLGetInfo getIntParameter(unsigned long pname);
+        WebGLGetInfo getLongParameter(unsigned long pname);
+        WebGLGetInfo getUnsignedLongParameter(unsigned long pname);
+        WebGLGetInfo getWebGLFloatArrayParameter(unsigned long pname);
+        WebGLGetInfo getWebGLIntArrayParameter(unsigned long pname);
+        WebGLGetInfo getWebGLUnsignedByteArrayParameter(unsigned long pname);
+
+        friend class WebGLStateRestorer;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.idl b/WebCore/html/canvas/WebGLRenderingContext.idl
index db0fff3..78de8c8 100644
--- a/WebCore/html/canvas/CanvasRenderingContext3D.idl
+++ b/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -30,7 +30,7 @@ module html {
         GenerateConstructor,
         InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
         ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
-    ] CanvasRenderingContext3D : CanvasRenderingContext {
+    ] WebGLRenderingContext : CanvasRenderingContext {
 
         /* ClearBufferMask */
         const unsigned int DEPTH_BUFFER_BIT               = 0x00000100;
@@ -460,25 +460,26 @@ module html {
 
         long sizeInBytes(in unsigned long type) raises(DOMException);
 
-        void         activeTexture(in unsigned long texture);
-        void         attachShader(in CanvasProgram program, in CanvasShader shader);
-        void         bindAttribLocation(in CanvasProgram program, in unsigned long index, in DOMString name);
-        void         bindBuffer(in unsigned long target, in CanvasBuffer buffer);
-        void         bindFramebuffer(in unsigned long target, in CanvasFramebuffer framebuffer);
-        void         bindRenderbuffer(in unsigned long target, in CanvasRenderbuffer renderbuffer);
-        void         bindTexture(in unsigned long target, in CanvasTexture texture);
+        void         activeTexture(in unsigned long texture) raises(DOMException);
+        void         attachShader(in WebGLProgram program, in WebGLShader shader) raises(DOMException);
+        void         bindAttribLocation(in WebGLProgram program, in unsigned long index, in DOMString name) raises(DOMException);
+        void         bindBuffer(in unsigned long target, in WebGLBuffer buffer) raises(DOMException);
+        void         bindFramebuffer(in unsigned long target, in WebGLFramebuffer framebuffer) raises(DOMException);
+        void         bindRenderbuffer(in unsigned long target, in WebGLRenderbuffer renderbuffer) raises(DOMException);
+        void         bindTexture(in unsigned long target, in WebGLTexture texture) raises(DOMException);
         void         blendColor(in double red, in double green, in double blue, in double alpha);
         void         blendEquation( in unsigned long mode );
         void         blendEquationSeparate(in unsigned long modeRGB, in unsigned long modeAlpha);
         void         blendFunc(in unsigned long sfactor, in unsigned long dfactor);
         void         blendFuncSeparate(in unsigned long srcRGB, in unsigned long dstRGB, in unsigned long srcAlpha, in unsigned long dstAlpha);
+
         // Supported forms:
         //   void bufferData (in GLenum target, in GLsizei size, in GLenum usage);
-        //   void bufferData (in GLenum target, in CanvasArray data, in GLenum usage);
-        [Custom] void bufferData();
+        //   void bufferData (in GLenum target, in WebGLArray data, in GLenum usage);
+        [Custom] void bufferData() raises(DOMException);
         // Supported forms:
-        //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in CanvasArray data);
-        [Custom] void bufferSubData();
+        //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in WebGLArray data);
+        [Custom] void bufferSubData() raises(DOMException);
 
         unsigned long checkFramebufferStatus(in unsigned long target);
         void         clear(in unsigned long mask);
@@ -486,7 +487,7 @@ module html {
         void         clearDepth(in double depth);
         void         clearStencil(in long s);
         void         colorMask(in boolean red, in boolean green, in boolean blue, in boolean alpha);
-        void         compileShader(in CanvasShader shader);
+        void         compileShader(in WebGLShader shader) raises(DOMException);
         
         //void         compressedTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in unsigned long width, in unsigned long height, in long border, in unsigned long imageSize, const void* data);
         //void         compressedTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long imageSize, const void* data);
@@ -494,119 +495,108 @@ module html {
         void         copyTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in long x, in long y, in unsigned long width, in unsigned long height, in long border);
         void         copyTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in long x, in long y, in unsigned long width, in unsigned long height);
 
-        CanvasBuffer createBuffer();
-        CanvasFramebuffer createFramebuffer();
-        CanvasProgram createProgram();
-        CanvasRenderbuffer createRenderbuffer();
-        CanvasShader createShader(in unsigned long type);
-        CanvasTexture createTexture();
+        WebGLBuffer createBuffer();
+        WebGLFramebuffer createFramebuffer();
+        WebGLProgram createProgram();
+        WebGLRenderbuffer createRenderbuffer();
+        WebGLShader createShader(in unsigned long type) raises(DOMException);
+        WebGLTexture createTexture();
 
         void         cullFace(in unsigned long mode);
 
-        void         deleteBuffer(in CanvasBuffer buffer);
-        void         deleteFramebuffer(in CanvasFramebuffer framebuffer);
-        void         deleteProgram(in CanvasProgram program);
-        void         deleteRenderbuffer(in CanvasRenderbuffer renderbuffer);
-        void         deleteShader(in CanvasShader shader);
-        void         deleteTexture(in CanvasTexture texture);
+        void         deleteBuffer(in WebGLBuffer buffer);
+        void         deleteFramebuffer(in WebGLFramebuffer framebuffer);
+        void         deleteProgram(in WebGLProgram program);
+        void         deleteRenderbuffer(in WebGLRenderbuffer renderbuffer);
+        void         deleteShader(in WebGLShader shader);
+        void         deleteTexture(in WebGLTexture texture);
 
         void         depthFunc(in unsigned long func);
         void         depthMask(in boolean flag);
         // FIXME: this differs from the current WebGL spec (depthRangef)
         void         depthRange(in double zNear, in double zFar);
-        void         detachShader(in CanvasProgram program, in CanvasShader shader);
+        void         detachShader(in WebGLProgram program, in WebGLShader shader) raises(DOMException);
         void         disable(in unsigned long cap);
-        void         disableVertexAttribArray(in unsigned long index);
-        void         drawArrays(in unsigned long mode, in long first, in unsigned long count);
-        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset);
+        void         disableVertexAttribArray(in unsigned long index) raises(DOMException);
+        void         drawArrays(in unsigned long mode, in long first, in unsigned long count) raises(DOMException);
+        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset) raises(DOMException);
 
         void         enable(in unsigned long cap);
-        void         enableVertexAttribArray(in unsigned long index);
+        void         enableVertexAttribArray(in unsigned long index) raises(DOMException);
         void         finish();
         void         flush();
-        void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in CanvasRenderbuffer renderbuffer);
-        void         framebufferTexture2D(in unsigned long target, in unsigned long attachment, in unsigned long textarget, in CanvasTexture texture, in long level);
+        void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in WebGLRenderbuffer renderbuffer) raises(DOMException);
+        void         framebufferTexture2D(in unsigned long target, in unsigned long attachment, in unsigned long textarget, in WebGLTexture texture, in long level) raises(DOMException);
         void         frontFace(in unsigned long mode);
         void         generateMipmap(in unsigned long target);
         
-        // FIXME: these need to be added per the WebGL spec
-        CanvasActiveInfo getActiveAttrib(in CanvasProgram program, in unsigned long index)
+        WebGLActiveInfo getActiveAttrib(in WebGLProgram program, in unsigned long index)
             raises (DOMException);
-        CanvasActiveInfo getActiveUniform(in CanvasProgram program, in unsigned long index)
+        WebGLActiveInfo getActiveUniform(in WebGLProgram program, in unsigned long index)
             raises (DOMException);
 
-        // CanvasShaderArray glGetAttachedShaders(GLuint program);
+        // WebGLShaderArray glGetAttachedShaders(GLuint program);
 
-        int          getAttribLocation(in CanvasProgram program, in DOMString name);
+        int          getAttribLocation(in WebGLProgram program, in DOMString name);
 
-        boolean getBoolean(in unsigned long pname);
-        CanvasUnsignedByteArray getBooleanv(in unsigned long pname);
-        long getBufferParameteri(in unsigned long target, in unsigned long pname);
-        CanvasIntArray getBufferParameteriv(in unsigned long target, in unsigned long pname);
+        // any getBufferParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
+        [Custom] void getBufferParameter();
 
         unsigned long getError();
 
-        float getFloat(in unsigned long pname);
-        CanvasFloatArray getFloatv(in unsigned long pname);
-        long getFramebufferAttachmentParameteri(in unsigned long target, in unsigned long attachment, in unsigned long pname);
-        CanvasIntArray getFramebufferAttachmentParameteriv(in unsigned long target, in unsigned long attachment, in unsigned long pname);
-        long getInteger(in unsigned long pname);
-        CanvasIntArray getIntegerv(in unsigned long pname);
-        long getProgrami(in CanvasProgram program, in unsigned long pname);
-        CanvasIntArray getProgramiv(in CanvasProgram program, in unsigned long pname);
-        DOMString getProgramInfoLog(in CanvasProgram program);
-        long getRenderbufferParameteri(in unsigned long target, in unsigned long pname);
-        CanvasIntArray getRenderbufferParameteriv(in unsigned long target, in unsigned long pname);
-        long getShaderi(in CanvasShader shader, in unsigned long pname);
-        CanvasIntArray getShaderiv(in CanvasShader shader, in unsigned long pname);
-
-        DOMString    getShaderInfoLog(in CanvasShader shader);
+        // any getFramebufferAttachmentParameter(in unsigned long target, in unsigned long attachment, in unsigned long pname) raises(DOMException);
+        [Custom] void getFramebufferAttachmentParameter();
+        // any getParameter(in unsigned long pname) raises(DOMException);
+        [Custom] void getParameter();
+        // any getProgramParameter(in WebGLProgram program, in unsigned long pname) raises(DOMException);
+        [Custom] void getProgramParameter();
+        DOMString getProgramInfoLog(in WebGLProgram program) raises(DOMException);
+        // any getRenderbufferParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
+        [Custom] void getRenderbufferParameter();
+        // any getShaderParameter(in WebGLShader shader, in unsigned long pname) raises(DOMException);
+        [Custom] void getShaderParameter() raises(DOMException);
+
+        DOMString    getShaderInfoLog(in WebGLShader shader) raises(DOMException);
 
         // TBD
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
-        DOMString    getShaderSource(in CanvasShader shader);
+        DOMString    getShaderSource(in WebGLShader shader) raises(DOMException);
         DOMString    getString(in unsigned long name);
 
-        float getTexParameterf(in unsigned long target, in unsigned long pname);
-        CanvasFloatArray getTexParameterfv(in unsigned long target, in unsigned long pname);
-        long getTexParameteri(in unsigned long target, in unsigned long pname);
-        CanvasIntArray getTexParameteriv(in unsigned long target, in unsigned long pname);
+        // any getTexParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
+        [Custom] void getTexParameter();
 
-        float getUniformf(in CanvasProgram program, in long location);
-        CanvasFloatArray getUniformfv(in CanvasProgram program, in long location);
-        long getUniformi(in CanvasProgram program, in long location);
-        CanvasIntArray getUniformiv(in CanvasProgram program, in long location);
-        
-        long getUniformLocation(in CanvasProgram program, in DOMString name);
+        // any getUniform(in WebGLProgram program, in WebGLUniformLocation location) raises(DOMException);
+        [Custom] void getUniform();
 
-        float getVertexAttribf(in unsigned long index, in unsigned long pname);
-        CanvasFloatArray getVertexAttribfv(in unsigned long index, in unsigned long pname);
-        long getVertexAttribi(in unsigned long index, in unsigned long pname);
-        CanvasIntArray getVertexAttribiv(in unsigned long index, in unsigned long pname);
+        WebGLUniformLocation getUniformLocation(in WebGLProgram program, in DOMString name) raises(DOMException);
+
+        // any getVertexAttrib(in unsigned long index, in unsigned long pname) raises(DOMException);
+        [Custom] void getVertexAttrib();
 
         long getVertexAttribOffset(in unsigned long index, in unsigned long pname);
 
         void         hint(in unsigned long target, in unsigned long mode);
-        boolean      isBuffer(in CanvasBuffer buffer);
+        boolean      isBuffer(in WebGLBuffer buffer);
         boolean      isEnabled(in unsigned long cap);
-        boolean      isFramebuffer(in CanvasFramebuffer framebuffer);
-        boolean      isProgram(in CanvasProgram program);
-        boolean      isRenderbuffer(in CanvasRenderbuffer renderbuffer);
-        boolean      isShader(in CanvasShader shader);
-        boolean      isTexture(in CanvasTexture texture);
+        boolean      isFramebuffer(in WebGLFramebuffer framebuffer);
+        boolean      isProgram(in WebGLProgram program);
+        boolean      isRenderbuffer(in WebGLRenderbuffer renderbuffer);
+        boolean      isShader(in WebGLShader shader);
+        boolean      isTexture(in WebGLTexture texture);
         void         lineWidth(in double width);
-        void         linkProgram(in CanvasProgram program);
+        void         linkProgram(in WebGLProgram program) raises(DOMException);
         void         pixelStorei(in unsigned long pname, in long param);
         void         polygonOffset(in double factor, in double units);
-        
-        CanvasArray readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type);
+
+        WebGLArray readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type);
         
         void         releaseShaderCompiler();
         void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
         void         sampleCoverage(in double value, in boolean invert);
         void         scissor(in long x, in long y, in unsigned long width, in unsigned long height);
-        void         shaderSource(in CanvasShader shader, in DOMString string);
+        void         shaderSource(in WebGLShader shader, in DOMString string) raises(DOMException);
         void         stencilFunc(in unsigned long func, in long ref, in unsigned long mask);
         void         stencilFuncSeparate(in unsigned long face, in unsigned long func, in long ref, in unsigned long mask);
         void         stencilMask(in unsigned long mask);
@@ -619,7 +609,7 @@ module html {
 
         // Supported forms:
         //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
-        //                   in GLint border, in GLenum format, in GLenum type, in CanvasArray pixels);
+        //                   in GLint border, in GLenum format, in GLenum type, in WebGLArray pixels);
         //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
         //                   in GLint border, in GLenum format, in GLenum type, in ImageData pixels);
         //   void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
@@ -633,7 +623,7 @@ module html {
         // Supported forms:
         //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
         //                      in GLsizei width, in GLsizei height, 
-        //                      in GLenum format, in GLenum type, in CanvasArray pixels);
+        //                      in GLenum format, in GLenum type, in WebGLArray pixels);
         //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
         //                      in GLsizei width, in GLsizei height, 
         //                      in GLenum format, in GLenum type, in ImageData pixels);
@@ -648,40 +638,40 @@ module html {
         //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
         [Custom] void texSubImage2D();
 
-        void uniform1f(in long location, in float x);
-        [Custom] void uniform1fv(in long location, in CanvasFloatArray v);
-        void uniform1i(in long location, in long x);
-        [Custom] void uniform1iv(in long location, in CanvasIntArray v);
-        void uniform2f(in long location, in float x, in float y);
-        [Custom] void uniform2fv(in long location, in CanvasFloatArray v);
-        void uniform2i(in long location, in long x, in long y);
-        [Custom] void uniform2iv(in long location, in CanvasIntArray v);
-        void uniform3f(in long location, in float x, in float y, in float z);
-        [Custom] void uniform3fv(in long location, in CanvasFloatArray v);
-        void uniform3i(in long location, in long x, in long y, in long z);
-        [Custom] void uniform3iv(in long location, in CanvasIntArray v);
-        void uniform4f(in long location, in float x, in float y, in float z, in float w);
-        [Custom] void uniform4fv(in long location, in CanvasFloatArray v);
-        void uniform4i(in long location, in long x, in long y, in long z, in long w);
-        [Custom] void uniform4iv(in long location, in CanvasIntArray v);
-
-        [Custom] void uniformMatrix2fv(in long location, in boolean transpose, in CanvasFloatArray array);
-        [Custom] void uniformMatrix3fv(in long location, in boolean transpose, in CanvasFloatArray array);
-        [Custom] void uniformMatrix4fv(in long location, in boolean transpose, in CanvasFloatArray array);
-
-        void         useProgram(in CanvasProgram program);
-        void         validateProgram(in CanvasProgram program);
+        void uniform1f(in WebGLUniformLocation location, in float x) raises(DOMException);
+        [Custom] void uniform1fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform1i(in WebGLUniformLocation location, in long x) raises(DOMException);
+        [Custom] void uniform1iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+        void uniform2f(in WebGLUniformLocation location, in float x, in float y) raises(DOMException);
+        [Custom] void uniform2fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform2i(in WebGLUniformLocation location, in long x, in long y) raises(DOMException);
+        [Custom] void uniform2iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+        void uniform3f(in WebGLUniformLocation location, in float x, in float y, in float z) raises(DOMException);
+        [Custom] void uniform3fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform3i(in WebGLUniformLocation location, in long x, in long y, in long z) raises(DOMException);
+        [Custom] void uniform3iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+        void uniform4f(in WebGLUniformLocation location, in float x, in float y, in float z, in float w) raises(DOMException);
+        [Custom] void uniform4fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform4i(in WebGLUniformLocation location, in long x, in long y, in long z, in long w) raises(DOMException);
+        [Custom] void uniform4iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+
+        [Custom] void uniformMatrix2fv(in WebGLUniformLocation location, in boolean transpose, in WebGLFloatArray array) raises(DOMException);
+        [Custom] void uniformMatrix3fv(in WebGLUniformLocation location, in boolean transpose, in WebGLFloatArray array) raises(DOMException);
+        [Custom] void uniformMatrix4fv(in WebGLUniformLocation location, in boolean transpose, in WebGLFloatArray array) raises(DOMException);
+
+        void         useProgram(in WebGLProgram program) raises(DOMException);
+        void         validateProgram(in WebGLProgram program) raises(DOMException);
 
         void         vertexAttrib1f(in unsigned long indx, in float x);
-        [Custom] void         vertexAttrib1fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib1fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttrib2f(in unsigned long indx, in float x, in float y);
-        [Custom] void         vertexAttrib2fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib2fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttrib3f(in unsigned long indx, in float x, in float y, in float z);
-        [Custom] void         vertexAttrib3fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib3fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttrib4f(in unsigned long indx, in float x, in float y, in float z, in float w);
-        [Custom] void         vertexAttrib4fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib4fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttribPointer(in unsigned long indx, in long size, in unsigned long type, in boolean normalized, 
-                                         in long stride, in unsigned long offset);
+                                         in long stride, in unsigned long offset) raises(DOMException);
 
         void         viewport(in long x, in long y, in unsigned long width, in unsigned long height);
     };
diff --git a/WebCore/html/canvas/CanvasShader.cpp b/WebCore/html/canvas/WebGLShader.cpp
index 7f134fa..a353b15 100644
--- a/WebCore/html/canvas/CanvasShader.cpp
+++ b/WebCore/html/canvas/WebGLShader.cpp
@@ -27,23 +27,23 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasShader.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLShader.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasShader> CanvasShader::create(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+PassRefPtr<WebGLShader> WebGLShader::create(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnumType type)
 {
-    return adoptRef(new CanvasShader(ctx, type));
+    return adoptRef(new WebGLShader(ctx, type));
 }
 
-CanvasShader::CanvasShader(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+WebGLShader::WebGLShader(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnumType type)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createShader(type));
 }
 
-void CanvasShader::_deleteObject(Platform3DObject object)
+void WebGLShader::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteShader(object);
 }
diff --git a/WebCore/html/canvas/CanvasShader.h b/WebCore/html/canvas/WebGLShader.h
index bb7980e..1ef912c 100644
--- a/WebCore/html/canvas/CanvasShader.h
+++ b/WebCore/html/canvas/WebGLShader.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasShader_h
-#define CanvasShader_h
+#ifndef WebGLShader_h
+#define WebGLShader_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,18 @@
 
 namespace WebCore {
     
-    class CanvasShader : public CanvasObject {
+    class WebGLShader : public CanvasObject {
     public:
-        virtual ~CanvasShader() { deleteObject(); }
+        virtual ~WebGLShader() { deleteObject(); }
         
-        static PassRefPtr<CanvasShader> create(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+        static PassRefPtr<WebGLShader> create(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
         
     private:
-        CanvasShader(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+        WebGLShader(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
 
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasShader_h
+#endif // WebGLShader_h
diff --git a/WebCore/html/canvas/CanvasTexture.idl b/WebCore/html/canvas/WebGLShader.idl
index 77eedd7..45e7f54 100644
--- a/WebCore/html/canvas/CanvasTexture.idl
+++ b/WebCore/html/canvas/WebGLShader.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasTexture {
+    interface [Conditional=3D_CANVAS] WebGLShader {
     };
 }
diff --git a/WebCore/html/canvas/WebGLShortArray.cpp b/WebCore/html/canvas/WebGLShortArray.cpp
new file mode 100644
index 0000000..f96a290
--- /dev/null
+++ b/WebCore/html/canvas/WebGLShortArray.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLShortArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLShortArray> WebGLShortArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(short));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLShortArray> WebGLShortArray::create(short* array, unsigned length)
+{
+    RefPtr<WebGLShortArray> a = WebGLShortArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLShortArray> WebGLShortArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                    int byteOffset,
+                                                    unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(short)) != 0)
+        return NULL;
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(short))) > buffer->byteLength())
+            return NULL;
+    }
+
+    return adoptRef(new WebGLShortArray(buffer, byteOffset, length));
+}
+
+WebGLShortArray::WebGLShortArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLShortArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLShortArray::byteLength() const {
+    return m_size * sizeof(short);
+}
+
+PassRefPtr<WebGLArray> WebGLShortArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(short);
+    unsigned limitByte = startByte + length * sizeof(short);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLShortArray::set(WebGLShortArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(short), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLShortArray.h b/WebCore/html/canvas/WebGLShortArray.h
new file mode 100644
index 0000000..70c66ca
--- /dev/null
+++ b/WebCore/html/canvas/WebGLShortArray.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLShortArray_h
+#define WebGLShortArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLShortArray : public WebGLArray {
+  public:
+    virtual bool isShortArray() const { return true; }
+
+    static PassRefPtr<WebGLShortArray> create(unsigned length);
+    static PassRefPtr<WebGLShortArray> create(short* array, unsigned length);
+    static PassRefPtr<WebGLShortArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    short* data() { return static_cast<short*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<short>::min())
+            value = std::numeric_limits<short>::min();
+        else if (value > std::numeric_limits<short>::max())
+            value = std::numeric_limits<short>::max();
+        short* storage = static_cast<short*>(m_baseAddress);
+        storage[index] = static_cast<short>(value);
+    }
+
+    bool get(unsigned index, short& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    short get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    short item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        short* storage = static_cast<short*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLShortArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLShortArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLShortArray_h
diff --git a/WebCore/html/canvas/CanvasFloatArray.idl b/WebCore/html/canvas/WebGLShortArray.idl
index bb236b9..bd8380f 100644
--- a/WebCore/html/canvas/CanvasFloatArray.idl
+++ b/WebCore/html/canvas/WebGLShortArray.idl
@@ -31,6 +31,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasFloatArray : CanvasArray {
+    ] WebGLShortArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLShortArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/CanvasTexture.cpp b/WebCore/html/canvas/WebGLTexture.cpp
index 624c275..ae09b48 100644
--- a/WebCore/html/canvas/CanvasTexture.cpp
+++ b/WebCore/html/canvas/WebGLTexture.cpp
@@ -27,24 +27,36 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasTexture.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLTexture.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasTexture> CanvasTexture::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLTexture> WebGLTexture::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasTexture(ctx));
+    return adoptRef(new WebGLTexture(ctx));
 }
 
-CanvasTexture::CanvasTexture(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLTexture> WebGLTexture::create(WebGLRenderingContext* ctx, Platform3DObject obj)
+{
+    return adoptRef(new WebGLTexture(ctx, obj));
+}
+
+WebGLTexture::WebGLTexture(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
     , cubeMapRWrapModeInitialized(false)
 {
     setObject(context()->graphicsContext3D()->createTexture());
 }
 
-void CanvasTexture::_deleteObject(Platform3DObject object)
+WebGLTexture::WebGLTexture(WebGLRenderingContext* ctx, Platform3DObject obj)
+    : CanvasObject(ctx)
+    , cubeMapRWrapModeInitialized(false)
+{
+    setObject(obj, false);
+}
+
+void WebGLTexture::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteTexture(object);
 }
diff --git a/WebCore/html/canvas/CanvasTexture.h b/WebCore/html/canvas/WebGLTexture.h
index 32a669a..c64dd41 100644
--- a/WebCore/html/canvas/CanvasTexture.h
+++ b/WebCore/html/canvas/WebGLTexture.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasTexture_h
-#define CanvasTexture_h
+#ifndef WebGLTexture_h
+#define WebGLTexture_h
 
 #include "CanvasObject.h"
 
@@ -33,12 +33,16 @@
 
 namespace WebCore {
     
-    class CanvasTexture : public CanvasObject {
+    class WebGLTexture : public CanvasObject {
     public:
-        virtual ~CanvasTexture() { deleteObject(); }
+        virtual ~WebGLTexture() { deleteObject(); }
         
-        static PassRefPtr<CanvasTexture> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLTexture> create(WebGLRenderingContext*);
     
+        // For querying previously created objects via e.g. getFramebufferAttachmentParameter
+        // FIXME: should consider canonicalizing these objects
+        static PassRefPtr<WebGLTexture> create(WebGLRenderingContext*, Platform3DObject);
+
         bool isCubeMapRWrapModeInitialized() {
             return cubeMapRWrapModeInitialized;
         }
@@ -48,7 +52,8 @@ namespace WebCore {
         }
 
     protected:
-        CanvasTexture(CanvasRenderingContext3D*);
+        WebGLTexture(WebGLRenderingContext*);
+        WebGLTexture(WebGLRenderingContext*, Platform3DObject);
 
         virtual void _deleteObject(Platform3DObject);
 
@@ -58,4 +63,4 @@ namespace WebCore {
     
 } // namespace WebCore
 
-#endif // CanvasTexture_h
+#endif // WebGLTexture_h
diff --git a/WebCore/html/canvas/CanvasProgram.idl b/WebCore/html/canvas/WebGLTexture.idl
index 46daaf2..da7e066 100644
--- a/WebCore/html/canvas/CanvasProgram.idl
+++ b/WebCore/html/canvas/WebGLTexture.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasProgram {
+    interface [Conditional=3D_CANVAS] WebGLTexture {
     };
 }
diff --git a/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/WebCore/html/canvas/WebGLUniformLocation.cpp
index 8442b87..2157470 100644
--- a/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
+++ b/WebCore/html/canvas/WebGLUniformLocation.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,24 +28,21 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasIntArray.h"
-
-#include "CanvasIntArray.h"
-
-using namespace JSC;
+#include "WebGLUniformLocation.h"
 
 namespace WebCore {
-
-void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+    
+PassRefPtr<WebGLUniformLocation> WebGLUniformLocation::create(WebGLProgram* program, long location)
 {
-    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+    return adoptRef(new WebGLUniformLocation(program, location));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
+WebGLUniformLocation::WebGLUniformLocation(WebGLProgram* program, long location)
+    : m_program(program)
+    , m_location(location)
 {
-    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
 }
 
-} // namespace WebCore
+}
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasBuffer.h b/WebCore/html/canvas/WebGLUniformLocation.h
index 8fdab82..f9f7a11 100644
--- a/WebCore/html/canvas/CanvasBuffer.h
+++ b/WebCore/html/canvas/WebGLUniformLocation.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,28 +24,35 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasBuffer_h
-#define CanvasBuffer_h
+#ifndef WebGLUniformLocation_h
+#define WebGLUniformLocation_h
 
 #include "CanvasObject.h"
+#include "WebGLProgram.h"
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
-    
-    class CanvasBuffer : public CanvasObject {
-    public:
-        virtual ~CanvasBuffer() { deleteObject(); }
-        
-        static PassRefPtr<CanvasBuffer> create(CanvasRenderingContext3D*);
-        
-    protected:
-        CanvasBuffer(CanvasRenderingContext3D*);
-        
-        virtual void _deleteObject(Platform3DObject o);
-    };
-    
+
+class WebGLUniformLocation : public RefCounted<WebGLUniformLocation> {
+public:
+    virtual ~WebGLUniformLocation() { }
+
+    static PassRefPtr<WebGLUniformLocation> create(WebGLProgram* program, long location);
+
+    WebGLProgram* program() const { return m_program.get(); }
+
+    long location() const { return m_location; }
+
+protected:
+    WebGLUniformLocation(WebGLProgram* program, long location);
+
+private:
+    RefPtr<WebGLProgram> m_program;
+    long m_location;
+};
+
 } // namespace WebCore
 
-#endif // CanvasBuffer_h
+#endif // WebGLUniformLocation_h
diff --git a/WebCore/html/canvas/WebGLUniformLocation.idl b/WebCore/html/canvas/WebGLUniformLocation.idl
new file mode 100644
index 0000000..b080241
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUniformLocation.idl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] WebGLUniformLocation {
+    };
+}
diff --git a/WebCore/html/canvas/WebGLUnsignedByteArray.cpp b/WebCore/html/canvas/WebGLUnsignedByteArray.cpp
new file mode 100644
index 0000000..3fd1b50
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedByteArray.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLUnsignedByteArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(unsigned char));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLUnsignedByteArray::create(unsigned char* array, unsigned length)
+{
+    RefPtr<WebGLUnsignedByteArray> a = WebGLUnsignedByteArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLUnsignedByteArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                                  int byteOffset,
+                                                                  unsigned length)
+{
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(unsigned char))) > buffer->byteLength())
+            return NULL;
+    }
+
+    return adoptRef(new WebGLUnsignedByteArray(buffer, byteOffset, length));
+}
+
+WebGLUnsignedByteArray::WebGLUnsignedByteArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLUnsignedByteArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLUnsignedByteArray::byteLength() const {
+    return m_size * sizeof(unsigned char);
+}
+
+PassRefPtr<WebGLArray> WebGLUnsignedByteArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(unsigned char);
+    unsigned limitByte = startByte + length * sizeof(unsigned char);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLUnsignedByteArray::set(WebGLUnsignedByteArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(unsigned char), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLUnsignedByteArray.h b/WebCore/html/canvas/WebGLUnsignedByteArray.h
new file mode 100644
index 0000000..6909de5
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedByteArray.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLUnsignedByteArray_h
+#define WebGLUnsignedByteArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLUnsignedByteArray : public WebGLArray {
+  public:
+    virtual bool isUnsignedByteArray() const { return true; }
+
+    static PassRefPtr<WebGLUnsignedByteArray> create(unsigned length);
+    static PassRefPtr<WebGLUnsignedByteArray> create(unsigned char* array, unsigned length);
+    static PassRefPtr<WebGLUnsignedByteArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    unsigned char* data() { return static_cast<unsigned char*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<unsigned char>::min())
+            value = std::numeric_limits<unsigned char>::min();
+        else if (value > std::numeric_limits<unsigned char>::max())
+            value = std::numeric_limits<unsigned char>::max();
+        unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+        storage[index] = static_cast<unsigned char>(value);
+    }
+
+    bool get(unsigned index, unsigned char& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    unsigned char get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    unsigned char item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLUnsignedByteArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLUnsignedByteArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLUnsignedByteArray_h
diff --git a/WebCore/html/canvas/WebGLUnsignedByteArray.idl b/WebCore/html/canvas/WebGLUnsignedByteArray.idl
new file mode 100644
index 0000000..57aa4ff
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedByteArray.idl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] WebGLUnsignedByteArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLUnsignedByteArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
+    };
+}
diff --git a/WebCore/html/canvas/WebGLUnsignedIntArray.cpp b/WebCore/html/canvas/WebGLUnsignedIntArray.cpp
new file mode 100644
index 0000000..97910f9
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedIntArray.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedIntArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLUnsignedIntArray> WebGLUnsignedIntArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(unsigned int));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLUnsignedIntArray> WebGLUnsignedIntArray::create(unsigned int* array, unsigned length)
+{
+    RefPtr<WebGLUnsignedIntArray> a = WebGLUnsignedIntArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLUnsignedIntArray> WebGLUnsignedIntArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                                int byteOffset,
+                                                                unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(unsigned int)) != 0) {
+        return NULL;
+    }
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(unsigned int))) > buffer->byteLength())
+            return NULL;
+    }
+
+    return adoptRef(new WebGLUnsignedIntArray(buffer, byteOffset, length));
+}
+
+WebGLUnsignedIntArray::WebGLUnsignedIntArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLUnsignedIntArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLUnsignedIntArray::byteLength() const {
+    return m_size * sizeof(unsigned int);
+}
+
+PassRefPtr<WebGLArray> WebGLUnsignedIntArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(unsigned int);
+    unsigned limitByte = startByte + length * sizeof(unsigned int);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLUnsignedIntArray::set(WebGLUnsignedIntArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(unsigned int), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLUnsignedIntArray.h b/WebCore/html/canvas/WebGLUnsignedIntArray.h
new file mode 100644
index 0000000..b0d9b65
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedIntArray.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLUnsignedIntArray_h
+#define WebGLUnsignedIntArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLUnsignedIntArray : public WebGLArray {
+  public:
+    virtual bool isUnsignedIntArray() const { return true; }
+
+    static PassRefPtr<WebGLUnsignedIntArray> create(unsigned length);
+    static PassRefPtr<WebGLUnsignedIntArray> create(unsigned int* array, unsigned length);
+    static PassRefPtr<WebGLUnsignedIntArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    unsigned int* data() { return static_cast<unsigned int*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<unsigned int>::min())
+            value = std::numeric_limits<unsigned int>::min();
+        else if (value > std::numeric_limits<unsigned int>::max())
+            value = std::numeric_limits<unsigned int>::max();
+        unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+        storage[index] = static_cast<unsigned int>(value);
+    }
+
+    bool get(unsigned index, unsigned int& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    unsigned int get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    unsigned int item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLUnsignedIntArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLUnsignedIntArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLUnsignedIntArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.idl b/WebCore/html/canvas/WebGLUnsignedIntArray.idl
index 3ab60d6..8697e70 100644
--- a/WebCore/html/canvas/CanvasUnsignedIntArray.idl
+++ b/WebCore/html/canvas/WebGLUnsignedIntArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +32,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasUnsignedIntArray : CanvasArray {
+    ] WebGLUnsignedIntArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLUnsignedIntArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/WebGLUnsignedShortArray.cpp b/WebCore/html/canvas/WebGLUnsignedShortArray.cpp
new file mode 100644
index 0000000..86fae8c
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedShortArray.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedShortArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLUnsignedShortArray> WebGLUnsignedShortArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(unsigned short));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLUnsignedShortArray> WebGLUnsignedShortArray::create(unsigned short* array, unsigned length)
+{
+    RefPtr<WebGLUnsignedShortArray> a = WebGLUnsignedShortArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLUnsignedShortArray> WebGLUnsignedShortArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                                    int byteOffset,
+                                                                    unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(unsigned short)) != 0) {
+        return NULL;
+    }
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(unsigned short))) > buffer->byteLength()) 
+            return NULL;
+    }
+
+    return adoptRef(new WebGLUnsignedShortArray(buffer, byteOffset, length));
+}
+
+WebGLUnsignedShortArray::WebGLUnsignedShortArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                 int byteOffset,
+                                                 unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLUnsignedShortArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLUnsignedShortArray::byteLength() const {
+    return m_size * sizeof(unsigned short);
+}
+
+PassRefPtr<WebGLArray> WebGLUnsignedShortArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(unsigned short);
+    unsigned limitByte = startByte + length * sizeof(unsigned short);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLUnsignedShortArray::set(WebGLUnsignedShortArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(unsigned short), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLUnsignedShortArray.h b/WebCore/html/canvas/WebGLUnsignedShortArray.h
new file mode 100644
index 0000000..3bad1b6
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedShortArray.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLUnsignedShortArray_h
+#define WebGLUnsignedShortArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLUnsignedShortArray : public WebGLArray {
+  public:
+    virtual bool isUnsignedShortArray() const { return true; }
+
+    static PassRefPtr<WebGLUnsignedShortArray> create(unsigned length);
+    static PassRefPtr<WebGLUnsignedShortArray> create(unsigned short* array, unsigned length);
+    static PassRefPtr<WebGLUnsignedShortArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    unsigned short* data() { return static_cast<unsigned short*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<unsigned short>::min())
+            value = std::numeric_limits<unsigned short>::min();
+        else if (value > std::numeric_limits<unsigned short>::max())
+            value = std::numeric_limits<unsigned short>::max();
+        unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+        storage[index] = static_cast<unsigned short>(value);
+    }
+
+    bool get(unsigned index, unsigned short& result) const
+    {
+        if (index >= m_size)
+            return false;
+        unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+        result = storage[index];
+        return true;
+    }
+
+    unsigned short get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    unsigned short item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLUnsignedShortArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLUnsignedShortArray(PassRefPtr<WebGLArrayBuffer> buffer,int byteOffset,unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLUnsignedShortArray_h
diff --git a/WebCore/html/canvas/WebGLUnsignedShortArray.idl b/WebCore/html/canvas/WebGLUnsignedShortArray.idl
new file mode 100644
index 0000000..d546444
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedShortArray.idl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] WebGLUnsignedShortArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLUnsignedShortArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
+    };
+}
diff --git a/WebCore/inspector/ConsoleMessage.cpp b/WebCore/inspector/ConsoleMessage.cpp
index eb8d49a..fe32da7 100644
--- a/WebCore/inspector/ConsoleMessage.cpp
+++ b/WebCore/inspector/ConsoleMessage.cpp
@@ -34,7 +34,6 @@
 #include "InspectorFrontend.h"
 #include "ScriptCallStack.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 
 namespace WebCore {
 
@@ -75,7 +74,7 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
 
 #if ENABLE(INSPECTOR)
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
-        m_wrappedArguments[i] = quarantineValue(callStack->state(), lastCaller.argumentAt(i));
+        m_wrappedArguments[i] = ScriptObject::quarantineValue(callStack->state(), lastCaller.argumentAt(i));
 #endif
 }
 
diff --git a/WebCore/inspector/InjectedScriptHost.cpp b/WebCore/inspector/InjectedScriptHost.cpp
new file mode 100644
index 0000000..f326f52
--- /dev/null
+++ b/WebCore/inspector/InjectedScriptHost.cpp
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptHost.h"
+
+#if ENABLE(INSPECTOR)
+
+
+#include "Element.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLFrameOwnerElement.h"
+#include "InspectorClient.h"
+#include "InspectorController.h"
+#include "InspectorDOMAgent.h"
+#include "InspectorFrontend.h"
+#include "InspectorResource.h"
+#include "Pasteboard.h"
+#include "ScriptArray.h"
+#include "ScriptFunctionCall.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JavaScriptCallFrame.h"
+#include "JavaScriptDebugServer.h"
+using namespace JSC;
+#endif
+
+#if ENABLE(DATABASE)
+#include "Database.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#endif
+
+#include "markup.h"
+
+#include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+InjectedScriptHost::InjectedScriptHost(InspectorController* inspectorController)
+    : m_inspectorController(inspectorController)
+{
+}
+
+InjectedScriptHost::~InjectedScriptHost()
+{
+}
+
+void InjectedScriptHost::copyText(const String& text)
+{
+    Pasteboard::generalPasteboard()->writePlainText(text);
+}
+
+Node* InjectedScriptHost::nodeForId(long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        return domAgent->nodeForId(nodeId);
+    return 0;
+}
+
+ScriptValue InjectedScriptHost::wrapObject(const ScriptValue& object, const String& objectGroup)
+{
+    if (m_inspectorController)
+        return m_inspectorController->wrapObject(object, objectGroup);
+    return ScriptValue();
+}
+
+ScriptValue InjectedScriptHost::unwrapObject(const String& objectId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->unwrapObject(objectId);
+    return ScriptValue();
+}
+
+long InjectedScriptHost::pushNodePathToFrontend(Node* node, bool selectInUI)
+{
+    InspectorFrontend* frontend = inspectorFrontend();
+    InspectorDOMAgent* domAgent = inspectorDOMAgent();
+    if (!domAgent || !frontend)
+        return 0;
+    long id = domAgent->pushNodePathToFrontend(node);
+    if (selectInUI)
+        frontend->updateFocusedNode(id);
+    return id;
+}
+
+void InjectedScriptHost::addNodesToSearchResult(const String& nodeIds)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->addNodesToSearchResult(nodeIds);
+}
+
+long InjectedScriptHost::pushNodeByPathToFrontend(const String& path)
+{
+    InspectorDOMAgent* domAgent = inspectorDOMAgent();
+    if (!domAgent)
+        return 0;
+
+    Node* node = domAgent->nodeForPath(path);
+    if (!node)
+        return 0;
+
+    return domAgent->pushNodePathToFrontend(node);
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+JavaScriptCallFrame* InjectedScriptHost::currentCallFrame() const
+{
+    return JavaScriptDebugServer::shared().currentCallFrame();
+}
+#endif
+
+#if ENABLE(DATABASE)
+Database* InjectedScriptHost::databaseForId(long databaseId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->databaseForId(databaseId);
+    return 0;
+}
+
+void InjectedScriptHost::selectDatabase(Database* database)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDatabase(database);
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+void InjectedScriptHost::selectDOMStorage(Storage* storage)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDOMStorage(storage);
+}
+#endif
+
+void InjectedScriptHost::reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->didDispatchOnInjectedScript(callId, result, isException);
+}
+
+InspectorDOMAgent* InjectedScriptHost::inspectorDOMAgent()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->domAgent();
+}
+
+InspectorFrontend* InjectedScriptHost::inspectorFrontend()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->m_frontend.get();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InjectedScriptHost.h b/WebCore/inspector/InjectedScriptHost.h
new file mode 100644
index 0000000..aa2fd76
--- /dev/null
+++ b/WebCore/inspector/InjectedScriptHost.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedScriptHost_h
+#define InjectedScriptHost_h
+
+#include "Console.h"
+#include "InspectorController.h"
+#include "PlatformString.h"
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class Database;
+class InspectorDOMAgent;
+class InspectorFrontend;
+class JavaScriptCallFrame;
+class Node;
+class Storage;
+
+class InjectedScriptHost : public RefCounted<InjectedScriptHost>
+{
+public:
+    static PassRefPtr<InjectedScriptHost> create(InspectorController* inspectorController)
+    {
+        return adoptRef(new InjectedScriptHost(inspectorController));
+    }
+
+    ~InjectedScriptHost();
+
+    InspectorController* inspectorController() { return m_inspectorController; }
+    void disconnectController() { m_inspectorController = 0; }
+
+    void copyText(const String& text);
+    Node* nodeForId(long nodeId);
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
+    ScriptValue unwrapObject(const String& objectId);
+    long pushNodePathToFrontend(Node* node, bool selectInUI);
+
+    void addNodesToSearchResult(const String& nodeIds);
+    long pushNodeByPathToFrontend(const String& path);
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    JavaScriptCallFrame* currentCallFrame() const;
+#endif
+#if ENABLE(DATABASE)
+    Database* databaseForId(long databaseId);
+    void selectDatabase(Database* database);
+#endif
+#if ENABLE(DOM_STORAGE)
+    void selectDOMStorage(Storage* storage);
+#endif
+    void reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException);
+
+private:
+    InjectedScriptHost(InspectorController* inspectorController);
+    InspectorDOMAgent* inspectorDOMAgent();
+    InspectorFrontend* inspectorFrontend();
+
+    InspectorController* m_inspectorController;
+};
+
+} // namespace WebCore
+
+#endif // !defined(InjectedScriptHost_h)
diff --git a/WebCore/inspector/InjectedScriptHost.idl b/WebCore/inspector/InjectedScriptHost.idl
new file mode 100644
index 0000000..be627ec
--- /dev/null
+++ b/WebCore/inspector/InjectedScriptHost.idl
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        GenerateConstructor
+    ] InjectedScriptHost {
+        [Custom] DOMWindow inspectedWindow();
+        [Custom] DOMObject wrapCallback(in DOMObject callback);
+        void copyText(in DOMString text);
+        [Custom] DOMObject nodeForId(in long nodeId);
+        [Custom] long wrapObject(in DOMObject object, in DOMString objectGroup);
+        [Custom] DOMObject unwrapObject(in long objectId);
+        [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
+
+        void addNodesToSearchResult(in DOMString nodeIds);
+        long pushNodeByPathToFrontend(in DOMString path);
+
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+        [Custom] DOMObject currentCallFrame();
+#endif
+
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+        [Custom] DOMObject databaseForId(in long databaseId);
+        [Custom] void selectDatabase(in DOMObject database);
+#endif
+
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+        [Custom] void selectDOMStorage(in DOMObject storage);
+#endif
+
+        void reportDidDispatchOnInjectedScript(in long callId, in DOMString result, in boolean isException);
+    };
+}
diff --git a/WebCore/inspector/InspectorBackend.cpp b/WebCore/inspector/InspectorBackend.cpp
index 83a9719..11f58c7 100644
--- a/WebCore/inspector/InspectorBackend.cpp
+++ b/WebCore/inspector/InspectorBackend.cpp
@@ -68,9 +68,8 @@ using namespace std;
 
 namespace WebCore {
 
-InspectorBackend::InspectorBackend(InspectorController* inspectorController, InspectorClient* client)
+InspectorBackend::InspectorBackend(InspectorController* inspectorController)
     : m_inspectorController(inspectorController)
-    , m_client(client)
 {
 }
 
@@ -78,117 +77,22 @@ InspectorBackend::~InspectorBackend()
 {
 }
 
-void InspectorBackend::hideDOMNodeHighlight()
-{
-    if (m_inspectorController)
-        m_inspectorController->hideHighlight();
-}
-
-String InspectorBackend::localizedStringsURL()
-{
-    return m_client->localizedStringsURL();
-}
-
-String InspectorBackend::hiddenPanels()
-{
-    return m_client->hiddenPanels();
-}
-
-void InspectorBackend::windowUnloading()
-{
-    if (m_inspectorController)
-        m_inspectorController->close();
-}
-
-bool InspectorBackend::isWindowVisible()
-{
-    if (m_inspectorController)
-        return m_inspectorController->windowVisible();
-    return false;
-}
-
-void InspectorBackend::addResourceSourceToFrame(long identifier, Node* frame)
-{
-    if (!m_inspectorController)
-        return;
-    RefPtr<InspectorResource> resource = m_inspectorController->resources().get(identifier);
-    if (resource) {
-        String sourceString = resource->sourceString();
-        if (!sourceString.isEmpty())
-            addSourceToFrame(resource->mimeType(), sourceString, frame);
-    }
-}
-
-bool InspectorBackend::addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
-{
-    ASSERT_ARG(frameNode, frameNode);
-
-    if (!frameNode)
-        return false;
-
-    if (!frameNode->attached()) {
-        ASSERT_NOT_REACHED();
-        return false;
-    }
-
-    ASSERT(frameNode->isElementNode());
-    if (!frameNode->isElementNode())
-        return false;
-
-    Element* element = static_cast<Element*>(frameNode);
-    ASSERT(element->isFrameOwnerElement());
-    if (!element->isFrameOwnerElement())
-        return false;
-
-    HTMLFrameOwnerElement* frameOwner = static_cast<HTMLFrameOwnerElement*>(element);
-    ASSERT(frameOwner->contentFrame());
-    if (!frameOwner->contentFrame())
-        return false;
-
-    FrameLoader* loader = frameOwner->contentFrame()->loader();
-
-    loader->setResponseMIMEType(mimeType);
-    loader->begin();
-    loader->write(source);
-    loader->end();
-
-    return true;
-}
-
 void InspectorBackend::clearMessages(bool clearUI)
 {
     if (m_inspectorController)
         m_inspectorController->clearConsoleMessages(clearUI);
 }
 
-void InspectorBackend::toggleNodeSearch()
-{
-    if (m_inspectorController)
-        m_inspectorController->toggleSearchForNodeInPage();
-}
-
-void InspectorBackend::attach()
-{
-    if (m_inspectorController)
-        m_inspectorController->attachWindow();
-}
-
-void InspectorBackend::detach()
-{
-    if (m_inspectorController)
-        m_inspectorController->detachWindow();
-}
-
-void InspectorBackend::setAttachedWindowHeight(unsigned height)
+void InspectorBackend::storeLastActivePanel(const String& panelName)
 {
     if (m_inspectorController)
-        m_inspectorController->setAttachedWindowHeight(height);
+        m_inspectorController->storeLastActivePanel(panelName);
 }
 
-void InspectorBackend::storeLastActivePanel(const String& panelName)
+void InspectorBackend::toggleNodeSearch()
 {
     if (m_inspectorController)
-        m_inspectorController->storeLastActivePanel(panelName);
+        m_inspectorController->toggleSearchForNodeInPage();
 }
 
 bool InspectorBackend::searchingForNode()
@@ -198,10 +102,11 @@ bool InspectorBackend::searchingForNode()
     return false;
 }
 
-void InspectorBackend::loaded()
+bool InspectorBackend::resourceTrackingEnabled() const
 {
     if (m_inspectorController)
-        m_inspectorController->scriptObjectReady();
+        return m_inspectorController->resourceTrackingEnabled();
+    return false;
 }
 
 void InspectorBackend::enableResourceTracking(bool always)
@@ -216,48 +121,6 @@ void InspectorBackend::disableResourceTracking(bool always)
         m_inspectorController->disableResourceTracking(always);
 }
 
-bool InspectorBackend::resourceTrackingEnabled() const
-{
-    if (m_inspectorController)
-        return m_inspectorController->resourceTrackingEnabled();
-    return false;
-}
-
-void InspectorBackend::moveWindowBy(float x, float y) const
-{
-    if (m_inspectorController)
-        m_inspectorController->moveWindowBy(x, y);
-}
-
-void InspectorBackend::closeWindow()
-{
-    if (m_inspectorController)
-        m_inspectorController->closeWindow();
-}
-
-const String& InspectorBackend::platform() const
-{
-#if PLATFORM(MAC)
-#ifdef BUILDING_ON_TIGER
-    DEFINE_STATIC_LOCAL(const String, platform, ("mac-tiger"));
-#else
-    DEFINE_STATIC_LOCAL(const String, platform, ("mac-leopard"));
-#endif
-#elif PLATFORM(WIN_OS)
-    DEFINE_STATIC_LOCAL(const String, platform, ("windows"));
-#elif PLATFORM(QT)
-    DEFINE_STATIC_LOCAL(const String, platform, ("qt"));
-#elif PLATFORM(GTK)
-    DEFINE_STATIC_LOCAL(const String, platform, ("gtk"));
-#elif PLATFORM(WX)
-    DEFINE_STATIC_LOCAL(const String, platform, ("wx"));
-#else
-    DEFINE_STATIC_LOCAL(const String, platform, ("unknown"));
-#endif
-
-    return platform;
-}
-
 void InspectorBackend::startTimelineProfiler()
 {
     if (m_inspectorController)
@@ -270,135 +133,127 @@ void InspectorBackend::stopTimelineProfiler()
         m_inspectorController->stopTimelineProfiler();
 }
 
-bool InspectorBackend::timelineProfilerEnabled() const
-{
-    if (m_inspectorController)
-        return m_inspectorController->timelineProfilerEnabled();
-    return false;
-}
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorBackend::startProfiling()
+bool InspectorBackend::debuggerEnabled() const
 {
     if (m_inspectorController)
-        m_inspectorController->startUserInitiatedProfiling();
+        return m_inspectorController->debuggerEnabled();
+    return false;
 }
 
-void InspectorBackend::stopProfiling()
+void InspectorBackend::enableDebugger(bool always)
 {
     if (m_inspectorController)
-        m_inspectorController->stopUserInitiatedProfiling();
+        m_inspectorController->enableDebuggerFromFrontend(always);
 }
 
-void InspectorBackend::enableProfiler(bool always)
+void InspectorBackend::disableDebugger(bool always)
 {
     if (m_inspectorController)
-        m_inspectorController->enableProfiler(always);
+        m_inspectorController->disableDebugger(always);
 }
 
-void InspectorBackend::disableProfiler(bool always)
+void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
 {
-    if (m_inspectorController)
-        m_inspectorController->disableProfiler(always);
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber, condition);
 }
 
-bool InspectorBackend::profilerEnabled()
+void InspectorBackend::updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
 {
-    if (m_inspectorController)
-        return m_inspectorController->profilerEnabled();
-    return false;
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().updateBreakpoint(sourceIDValue, lineNumber, condition);
 }
 
-void InspectorBackend::getProfileHeaders(long callId)
+void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
 {
-    if (m_inspectorController)
-        m_inspectorController->getProfileHeaders(callId);
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().removeBreakpoint(sourceIDValue, lineNumber);
 }
 
-void InspectorBackend::getProfile(long callId, unsigned uid)
+void InspectorBackend::pauseInDebugger()
 {
-    if (m_inspectorController)
-        m_inspectorController->getProfile(callId, uid);
+    JavaScriptDebugServer::shared().pauseProgram();
 }
 
-void InspectorBackend::enableDebugger(bool always)
+void InspectorBackend::resumeDebugger()
 {
     if (m_inspectorController)
-        m_inspectorController->enableDebuggerFromFrontend(always);
+        m_inspectorController->resumeDebugger();
 }
 
-void InspectorBackend::disableDebugger(bool always)
+void InspectorBackend::stepOverStatementInDebugger()
 {
-    if (m_inspectorController)
-        m_inspectorController->disableDebugger(always);
+    JavaScriptDebugServer::shared().stepOverStatement();
 }
 
-bool InspectorBackend::debuggerEnabled() const
+void InspectorBackend::stepIntoStatementInDebugger()
 {
-    if (m_inspectorController)
-        return m_inspectorController->debuggerEnabled();
-    return false;
+    JavaScriptDebugServer::shared().stepIntoStatement();
 }
 
-JavaScriptCallFrame* InspectorBackend::currentCallFrame() const
+void InspectorBackend::stepOutOfFunctionInDebugger()
 {
-    return JavaScriptDebugServer::shared().currentCallFrame();
+    JavaScriptDebugServer::shared().stepOutOfFunction();
 }
 
-void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
+bool InspectorBackend::pauseOnExceptions()
 {
-    intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber, condition);
+    return JavaScriptDebugServer::shared().pauseOnExceptions();
 }
 
-void InspectorBackend::updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
+void InspectorBackend::setPauseOnExceptions(bool pause)
 {
-    intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().updateBreakpoint(sourceIDValue, lineNumber, condition);
+    JavaScriptDebugServer::shared().setPauseOnExceptions(pause);
 }
 
-void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
+bool InspectorBackend::profilerEnabled()
 {
-    intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().removeBreakpoint(sourceIDValue, lineNumber);
+    if (m_inspectorController)
+        return m_inspectorController->profilerEnabled();
+    return false;
 }
 
-bool InspectorBackend::pauseOnExceptions()
+void InspectorBackend::enableProfiler(bool always)
 {
-    return JavaScriptDebugServer::shared().pauseOnExceptions();
+    if (m_inspectorController)
+        m_inspectorController->enableProfiler(always);
 }
 
-void InspectorBackend::setPauseOnExceptions(bool pause)
+void InspectorBackend::disableProfiler(bool always)
 {
-    JavaScriptDebugServer::shared().setPauseOnExceptions(pause);
+    if (m_inspectorController)
+        m_inspectorController->disableProfiler(always);
 }
 
-void InspectorBackend::pauseInDebugger()
+void InspectorBackend::startProfiling()
 {
-    JavaScriptDebugServer::shared().pauseProgram();
+    if (m_inspectorController)
+        m_inspectorController->startUserInitiatedProfiling();
 }
 
-void InspectorBackend::resumeDebugger()
+void InspectorBackend::stopProfiling()
 {
     if (m_inspectorController)
-        m_inspectorController->resumeDebugger();
+        m_inspectorController->stopUserInitiatedProfiling();
 }
 
-void InspectorBackend::stepOverStatementInDebugger()
+void InspectorBackend::getProfileHeaders(long callId)
 {
-    JavaScriptDebugServer::shared().stepOverStatement();
+    if (m_inspectorController)
+        m_inspectorController->getProfileHeaders(callId);
 }
 
-void InspectorBackend::stepIntoStatementInDebugger()
+void InspectorBackend::getProfile(long callId, unsigned uid)
 {
-    JavaScriptDebugServer::shared().stepIntoStatement();
+    if (m_inspectorController)
+        m_inspectorController->getProfile(callId, uid);
 }
 
-void InspectorBackend::stepOutOfFunctionInDebugger()
+JavaScriptCallFrame* InspectorBackend::currentCallFrame() const
 {
-    JavaScriptDebugServer::shared().stepOutOfFunction();
+    return JavaScriptDebugServer::shared().currentCallFrame();
 }
-
 #endif
 
 void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async)
@@ -411,7 +266,7 @@ void InspectorBackend::dispatchOnInjectedScript(long callId, const String& metho
     function.appendArgument(methodName);
     function.appendArgument(arguments);
     if (async)
-        function.appendArgument(static_cast<int>(callId));
+        function.appendArgument(callId);
     bool hadException = false;
     ScriptValue result = function.call(hadException);
     if (async)
@@ -490,45 +345,30 @@ void InspectorBackend::removeNode(long callId, long nodeId)
     frontend->didRemoveNode(callId, nodeId);
 }
 
-void InspectorBackend::getCookies(long callId, const String& domain)
-{
-    if (!m_inspectorController)
-        return;
-    m_inspectorController->getCookies(callId, domain);
-}
-
-void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
-{
-    if (!m_inspectorController)
-        return;
-    m_inspectorController->deleteCookie(cookieName, domain);
-}
-
-void InspectorBackend::highlight(long nodeId)
+void InspectorBackend::highlightDOMNode(long nodeId)
 {
     if (Node* node = nodeForId(nodeId))
         m_inspectorController->highlight(node);
 }
 
-Node* InspectorBackend::nodeForId(long nodeId)
+void InspectorBackend::hideDOMNodeHighlight()
 {
-    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
-        return domAgent->nodeForId(nodeId);
-    return 0;
+    if (m_inspectorController)
+        m_inspectorController->hideHighlight();
 }
 
-ScriptValue InspectorBackend::wrapObject(const ScriptValue& object, const String& objectGroup)
+void InspectorBackend::getCookies(long callId)
 {
-    if (m_inspectorController)
-        return m_inspectorController->wrapObject(object, objectGroup);
-    return ScriptValue();
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->getCookies(callId);
 }
 
-ScriptValue InspectorBackend::unwrapObject(const String& objectId)
+void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
 {
-    if (m_inspectorController)
-        return m_inspectorController->unwrapObject(objectId);
-    return ScriptValue();
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->deleteCookie(cookieName, domain);
 }
 
 void InspectorBackend::releaseWrapperObjectGroup(const String& objectGroup)
@@ -537,38 +377,13 @@ void InspectorBackend::releaseWrapperObjectGroup(const String& objectGroup)
         m_inspectorController->releaseWrapperObjectGroup(objectGroup);
 }
 
-long InspectorBackend::pushNodePathToFrontend(Node* node, bool selectInUI)
-{
-    InspectorFrontend* frontend = inspectorFrontend();
-    InspectorDOMAgent* domAgent = inspectorDOMAgent();
-    if (!domAgent || !frontend)
-        return 0;
-    long id = domAgent->pushNodePathToFrontend(node);
-    if (selectInUI)
-        frontend->updateFocusedNode(id);
-    return id;
-}
-
-void InspectorBackend::addNodesToSearchResult(const String& nodeIds)
-{
-    if (InspectorFrontend* frontend = inspectorFrontend())
-        frontend->addNodesToSearchResult(nodeIds);
-}
-
-#if ENABLE(DATABASE)
-Database* InspectorBackend::databaseForId(long databaseId)
-{
-    if (m_inspectorController)
-        return m_inspectorController->databaseForId(databaseId);
-    return 0;
-}
-
-void InspectorBackend::selectDatabase(Database* database)
+void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
 {
     if (m_inspectorController)
-        m_inspectorController->selectDatabase(database);
+        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
 }
 
+#if ENABLE(DATABASE)
 void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
 {
     if (InspectorFrontend* frontend = inspectorFrontend()) {
@@ -586,12 +401,6 @@ void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
 #endif
 
 #if ENABLE(DOM_STORAGE)
-void InspectorBackend::selectDOMStorage(Storage* storage)
-{
-    if (m_inspectorController)
-        m_inspectorController->selectDOMStorage(storage);
-}
-
 void InspectorBackend::getDOMStorageEntries(long callId, long storageId)
 {
     if (m_inspectorController)
@@ -611,18 +420,6 @@ void InspectorBackend::removeDOMStorageItem(long callId, long storageId, const S
 }
 #endif
 
-void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
-{
-    if (m_inspectorController)
-        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
-}
-
-void InspectorBackend::reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException)
-{
-    if (InspectorFrontend* frontend = inspectorFrontend())
-        frontend->didDispatchOnInjectedScript(callId, result, isException);
-}
-
 InspectorDOMAgent* InspectorBackend::inspectorDOMAgent()
 {
     if (!m_inspectorController)
@@ -637,6 +434,13 @@ InspectorFrontend* InspectorBackend::inspectorFrontend()
     return m_inspectorController->m_frontend.get();
 }
 
+Node* InspectorBackend::nodeForId(long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        return domAgent->nodeForId(nodeId);
+    return 0;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorBackend.h b/WebCore/inspector/InspectorBackend.h
index 9d75e2f..d6e89fa 100644
--- a/WebCore/inspector/InspectorBackend.h
+++ b/WebCore/inspector/InspectorBackend.h
@@ -39,8 +39,8 @@ namespace WebCore {
 
 class CachedResource;
 class Database;
-class InspectorClient;
 class InspectorDOMAgent;
+class InspectorFrontend;
 class JavaScriptCallFrame;
 class Node;
 class Storage;
@@ -48,87 +48,59 @@ class Storage;
 class InspectorBackend : public RefCounted<InspectorBackend>
 {
 public:
-    static PassRefPtr<InspectorBackend> create(InspectorController* inspectorController, InspectorClient* client)
+    static PassRefPtr<InspectorBackend> create(InspectorController* inspectorController)
     {
-        return adoptRef(new InspectorBackend(inspectorController, client));
+        return adoptRef(new InspectorBackend(inspectorController));
     }
 
     ~InspectorBackend();
 
     InspectorController* inspectorController() { return m_inspectorController; }
-    
     void disconnectController() { m_inspectorController = 0; }
 
-    void hideDOMNodeHighlight();
-
-    String localizedStringsURL();
-    String hiddenPanels();
-
-    void windowUnloading();
-
-    bool isWindowVisible();
-
-    void addResourceSourceToFrame(long identifier, Node* frame);
-    bool addSourceToFrame(const String& mimeType, const String& source, Node* frame);
-
     void clearMessages(bool clearUI);
-
-    void toggleNodeSearch();
-
-    void attach();
-    void detach();
-
-    void setAttachedWindowHeight(unsigned height);
-
     void storeLastActivePanel(const String& panelName);
 
+    void toggleNodeSearch();
     bool searchingForNode();
 
-    void loaded();
-
     void enableResourceTracking(bool always);
     void disableResourceTracking(bool always);
     bool resourceTrackingEnabled() const;
 
-    void moveWindowBy(float x, float y) const;
-    void closeWindow();
-
-    const String& platform() const;
-
     void startTimelineProfiler();
     void stopTimelineProfiler();
-    bool timelineProfilerEnabled() const;
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    void startProfiling();
-    void stopProfiling();
-
-    void enableProfiler(bool always);
-    void disableProfiler(bool always);
-    bool profilerEnabled();
-
-    void getProfileHeaders(long callId);
-    void getProfile(long callId, unsigned uid);
-
+    bool debuggerEnabled() const;
     void enableDebugger(bool always);
     void disableDebugger(bool always);
-    bool debuggerEnabled() const;
-
-    JavaScriptCallFrame* currentCallFrame() const;
 
     void addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
     void updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
 
-    bool pauseOnExceptions();
-    void setPauseOnExceptions(bool pause);
-
     void pauseInDebugger();
     void resumeDebugger();
 
+    bool pauseOnExceptions();
+    void setPauseOnExceptions(bool pause);
+
     void stepOverStatementInDebugger();
     void stepIntoStatementInDebugger();
     void stepOutOfFunctionInDebugger();
+
+    bool profilerEnabled();
+    void enableProfiler(bool always);
+    void disableProfiler(bool always);
+
+    void startProfiling();
+    void stopProfiling();
+
+    void getProfileHeaders(long callId);
+    void getProfile(long callId, unsigned uid);
+
+    JavaScriptCallFrame* currentCallFrame() const;
 #endif
 
     void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async);
@@ -139,39 +111,33 @@ public:
     void getEventListenersForNode(long callId, long nodeId);
     void copyNode(long nodeId);
     void removeNode(long callId, long nodeId);
+    void highlightDOMNode(long nodeId);
+    void hideDOMNodeHighlight();
 
-    void getCookies(long callId, const String& domain);
+    void getCookies(long callId);
     void deleteCookie(const String& cookieName, const String& domain);
 
     // Generic code called from custom implementations.
-    void highlight(long nodeId);
-    Node* nodeForId(long nodeId);
-    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
-    ScriptValue unwrapObject(const String& objectId);
     void releaseWrapperObjectGroup(const String& objectGroup);
-    long pushNodePathToFrontend(Node* node, bool selectInUI);
-    void addNodesToSearchResult(const String& nodeIds);
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
+
 #if ENABLE(DATABASE)
-    Database* databaseForId(long databaseId);
-    void selectDatabase(Database* database);
     void getDatabaseTableNames(long callId, long databaseId);
 #endif
+
 #if ENABLE(DOM_STORAGE)
-    void selectDOMStorage(Storage* storage);
     void getDOMStorageEntries(long callId, long storageId);
     void setDOMStorageItem(long callId, long storageId, const String& key, const String& value);
     void removeDOMStorageItem(long callId, long storageId, const String& key);
 #endif
-    void reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException);
-    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
 
 private:
-    InspectorBackend(InspectorController* inspectorController, InspectorClient* client);
+    InspectorBackend(InspectorController* inspectorController);
     InspectorDOMAgent* inspectorDOMAgent();
     InspectorFrontend* inspectorFrontend();
+    Node* nodeForId(long nodeId);
 
     InspectorController* m_inspectorController;
-    InspectorClient* m_client;
 };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorBackend.idl b/WebCore/inspector/InspectorBackend.idl
index 7a00c6a..61c76d6 100644
--- a/WebCore/inspector/InspectorBackend.idl
+++ b/WebCore/inspector/InspectorBackend.idl
@@ -34,43 +34,18 @@ module core {
     interface [
         GenerateConstructor
     ] InspectorBackend {
-        void hideDOMNodeHighlight();
-        [Custom] void highlightDOMNode(in long nodeId);
-        void loaded();
-        void windowUnloading();
-        void attach();
-        void detach();
-
-        void closeWindow();
         void clearMessages(in boolean clearUI);
-        void toggleNodeSearch();
+        void storeLastActivePanel(in DOMString panelName);
 
-        boolean isWindowVisible();
+        void toggleNodeSearch();
         boolean searchingForNode();
 
-        void addResourceSourceToFrame(in long identifier, in Node frame);
-        boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
-        [Custom] void search(in Node node, in DOMString query);
-#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        void getDatabaseTableNames(in long callId, in long databaseId);
-#endif
-
-        [Custom] DOMObject setting(in DOMString key);
-        [Custom] void setSetting(in DOMString key, in DOMObject  value);
-        [Custom] DOMWindow inspectedWindow();
-        DOMString localizedStringsURL();
-        DOMString hiddenPanels();
-        DOMString platform();
-        void startTimelineProfiler();
-        void stopTimelineProfiler();
-        boolean timelineProfilerEnabled();
-        [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
-        void setAttachedWindowHeight(in unsigned long height);
-        [Custom] DOMObject wrapCallback(in DOMObject callback);
         boolean resourceTrackingEnabled();
         void enableResourceTracking(in boolean always);
         void disableResourceTracking(in boolean always);
-        void storeLastActivePanel(in DOMString panelName);
+
+        void startTimelineProfiler();
+        void stopTimelineProfiler();
 
 #if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         boolean debuggerEnabled();
@@ -88,8 +63,6 @@ module core {
         void stepIntoStatementInDebugger();
         void stepOutOfFunctionInDebugger();
 
-        [Custom] DOMObject currentCallFrame();
-
         boolean pauseOnExceptions();
         void setPauseOnExceptions(in boolean pauseOnExceptions);
 
@@ -111,29 +84,23 @@ module core {
         void getEventListenersForNode(in long callId, in long nodeId);
         void copyNode(in long nodeId);
         void removeNode(in long callId, in long nodeId);
+        void highlightDOMNode(in long nodeId);
+        void hideDOMNodeHighlight();
 
-        void getCookies(in long callId, in DOMString domain);
+        void getCookies(in long callId);
         void deleteCookie(in DOMString cookieName, in DOMString domain);
 
-        // Called from InjectedScript.
-        // TODO: extract into a separate IDL.
-        [Custom] DOMObject nodeForId(in long nodeId);
-        [Custom] long wrapObject(in DOMObject object, in DOMString objectGroup);
-        [Custom] DOMObject unwrapObject(in long objectId);
         void releaseWrapperObjectGroup(in DOMString objectGroup);
-        [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
-        void addNodesToSearchResult(in DOMString nodeIds);
+        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
+
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        [Custom] void selectDatabase(in DOMObject database);
-        [Custom] DOMObject databaseForId(in long databaseId);
+        void getDatabaseTableNames(in long callId, in long databaseId);
 #endif
+
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
-        [Custom] void selectDOMStorage(in DOMObject storage);
         void getDOMStorageEntries(in long callId, in long storageId);
         void setDOMStorageItem(in long callId, in long storageId, in DOMString key, in DOMString value);
         void removeDOMStorageItem(in long callId, in long storageId, in DOMString key);
 #endif
-        void reportDidDispatchOnInjectedScript(in long callId, in DOMString result, in boolean isException);
-        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
     };
 }
diff --git a/WebCore/inspector/InspectorClient.h b/WebCore/inspector/InspectorClient.h
index f96662a..e448cd2 100644
--- a/WebCore/inspector/InspectorClient.h
+++ b/WebCore/inspector/InspectorClient.h
@@ -59,9 +59,8 @@ public:
 
     virtual void inspectedURLChanged(const String& newURL) = 0;
 
-    virtual void populateSetting(const String& key, InspectorController::Setting&) = 0;
-    virtual void storeSetting(const String& key, const InspectorController::Setting&) = 0;
-    virtual void removeSetting(const String& key) = 0;
+    virtual void populateSetting(const String& key, String* value) = 0;
+    virtual void storeSetting(const String& key, const String& value) = 0;
 
     virtual void inspectorWindowObjectCleared() = 0;
 };
diff --git a/WebCore/inspector/InspectorController.cpp b/WebCore/inspector/InspectorController.cpp
index a6628cd..fd319a4 100644
--- a/WebCore/inspector/InspectorController.cpp
+++ b/WebCore/inspector/InspectorController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -24,7 +24,7 @@
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 #include "config.h"
@@ -53,8 +53,10 @@
 #include "HTMLFrameOwnerElement.h"
 #include "HitTestResult.h"
 #include "InspectorBackend.h"
+#include "InjectedScriptHost.h"
 #include "InspectorClient.h"
 #include "InspectorFrontend.h"
+#include "InspectorFrontendHost.h"
 #include "InspectorDatabaseResource.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDOMStorageResource.h"
@@ -62,6 +64,7 @@
 #include "InspectorResource.h"
 #include "JavaScriptProfile.h"
 #include "Page.h"
+#include "ProgressTracker.h"
 #include "Range.h"
 #include "RenderInline.h"
 #include "ResourceRequest.h"
@@ -69,7 +72,6 @@
 #include "ScriptCallStack.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 #include "ScriptString.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -119,7 +121,6 @@ static const float minimumAttachedHeight = 250.0f;
 static const float maximumAttachedHeightRatio = 0.75f;
 
 static unsigned s_inspectorControllerCount;
-static HashMap<String, InspectorController::Setting*>* s_settingCache;
 
 InspectorController::InspectorController(Page* page, InspectorClient* client)
     : m_inspectedPage(page)
@@ -128,13 +129,14 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
     , m_scriptState(0)
     , m_windowVisible(false)
     , m_showAfterVisible(CurrentPanel)
-    , m_nextIdentifier(-2)
     , m_groupLevel(0)
     , m_searchingForNode(false)
     , m_previousMessage(0)
     , m_resourceTrackingEnabled(false)
     , m_resourceTrackingSettingsLoaded(false)
-    , m_inspectorBackend(InspectorBackend::create(this, client))
+    , m_inspectorBackend(InspectorBackend::create(this))
+    , m_inspectorFrontendHost(InspectorFrontendHost::create(this, client))
+    , m_injectedScriptHost(InjectedScriptHost::create(this))
     , m_lastBoundObjectId(1)
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_debuggerEnabled(false)
@@ -165,24 +167,22 @@ InspectorController::~InspectorController()
     ASSERT(s_inspectorControllerCount);
     --s_inspectorControllerCount;
 
-    if (!s_inspectorControllerCount && s_settingCache) {
-        deleteAllValues(*s_settingCache);
-        delete s_settingCache;
-        s_settingCache = 0;
-    }
-    
     releaseDOMAgent();
 
     m_inspectorBackend->disconnectController();
+    m_inspectorFrontendHost->disconnectController();
+    m_injectedScriptHost->disconnectController();
 }
 
 void InspectorController::inspectedPageDestroyed()
 {
     close();
 
-    if (m_scriptState)
-        ScriptGlobalObject::remove(m_scriptState, "InspectorController");
-
+    if (m_scriptState) {
+        ScriptGlobalObject::remove(m_scriptState, "InspectorBackend");
+        ScriptGlobalObject::remove(m_scriptState, "InspectorFrontendHost");
+        ScriptGlobalObject::remove(m_scriptState, "InjectedScriptHost");
+    }
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
 
@@ -197,46 +197,22 @@ bool InspectorController::enabled() const
     return m_inspectedPage->settings()->developerExtrasEnabled();
 }
 
-const InspectorController::Setting& InspectorController::setting(const String& key) const
+String InspectorController::setting(const String& key) const
 {
-    if (!s_settingCache)
-        s_settingCache = new HashMap<String, Setting*>;
-
-    if (Setting* cachedSetting = s_settingCache->get(key))
-        return *cachedSetting;
-
-    Setting* newSetting = new Setting;
-    s_settingCache->set(key, newSetting);
-
-    m_client->populateSetting(key, *newSetting);
+    Settings::iterator it = m_settings.find(key);
+    if (it != m_settings.end())
+        return it->second;
 
-    return *newSetting;
+    String value;
+    m_client->populateSetting(key, &value);
+    m_settings.set(key, value);
+    return value;
 }
 
-void InspectorController::setSetting(const String& key, const Setting& setting)
+void InspectorController::setSetting(const String& key, const String& value)
 {
-    if (setting.type() == Setting::NoType) {
-        if (s_settingCache) {
-            Setting* cachedSetting = s_settingCache->get(key);
-            if (cachedSetting) {
-                s_settingCache->remove(key);
-                delete cachedSetting;
-            }
-        }
-
-        m_client->removeSetting(key);
-        return;
-    }
-
-    if (!s_settingCache)
-        s_settingCache = new HashMap<String, Setting*>;
-
-    if (Setting* cachedSetting = s_settingCache->get(key))
-        *cachedSetting = setting;
-    else
-        s_settingCache->set(key, new Setting(setting));
-
-    m_client->storeSetting(key, setting);
+    m_settings.set(key, value);
+    m_client->storeSetting(key, value);
 }
 
 // Trying to inspect something in a frame with JavaScript disabled would later lead to
@@ -315,15 +291,9 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
         setAttachedWindow(attached);
         populateScriptObjects();
 
-        // Console panel is implemented as a 'fast view', so there should be
-        // real panel opened along with it.
-        bool showConsole = m_showAfterVisible == ConsolePanel;
-        if (m_showAfterVisible == CurrentPanel || showConsole) {
-          Setting lastActivePanelSetting = setting(lastActivePanelSettingName);
-          if (lastActivePanelSetting.type() == Setting::StringType)
-              m_showAfterVisible = specialPanelForJSName(lastActivePanelSetting.string());
-          else
-              m_showAfterVisible = ElementsPanel;
+        if (m_showAfterVisible == CurrentPanel) {
+          String lastActivePanelSetting = setting(lastActivePanelSettingName);
+          m_showAfterVisible = specialPanelForJSName(lastActivePanelSetting);
         }
 
         if (m_nodeToFocus)
@@ -333,8 +303,6 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
             enableDebugger();
 #endif
         showPanel(m_showAfterVisible);
-        if (showConsole)
-            showPanel(ConsolePanel);
     } else {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
         // If the window is being closed with the debugger enabled,
@@ -345,7 +313,10 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
         if (debuggerWasEnabled)
             m_attachDebuggerWhenShown = true;
 #endif
+        if (m_searchingForNode)
+            toggleSearchForNodeInPage();
         resetScriptObjects();
+        stopTimelineProfiler();
     }
     m_showAfterVisible = CurrentPanel;
 }
@@ -414,6 +385,12 @@ void InspectorController::endGroup(MessageSource source, unsigned lineNumber, co
     addConsoleMessage(0, new ConsoleMessage(source, EndGroupMessageType, LogMessageLevel, String(), lineNumber, sourceURL, m_groupLevel));
 }
 
+void InspectorController::markTimeline(const String& message)
+{
+    if (timelineAgent())
+        timelineAgent()->didMarkTimeline(message);
+}
+
 static unsigned constrainedAttachedWindowHeight(unsigned preferredHeight, unsigned totalWindowHeight)
 {
     return roundf(max(minimumAttachedHeight, min<float>(preferredHeight, totalWindowHeight * maximumAttachedHeightRatio)));
@@ -428,8 +405,10 @@ void InspectorController::attachWindow()
 
     m_client->attachWindow();
 
-    Setting attachedHeight = setting(inspectorAttachedHeightName);
-    unsigned preferredHeight = attachedHeight.type() == Setting::IntegerType ? attachedHeight.integerValue() : defaultAttachedHeight;
+    String attachedHeight = setting(inspectorAttachedHeightName);
+    bool success = true;
+    int height = attachedHeight.toInt(&success);
+    unsigned preferredHeight = success ? height : defaultAttachedHeight;
 
     // We need to constrain the window height here in case the user has resized the inspected page's window so that
     // the user's preferred height would be too big to display.
@@ -459,14 +438,14 @@ void InspectorController::setAttachedWindowHeight(unsigned height)
     unsigned totalHeight = m_page->mainFrame()->view()->visibleHeight() + m_inspectedPage->mainFrame()->view()->visibleHeight();
     unsigned attachedHeight = constrainedAttachedWindowHeight(height, totalHeight);
     
-    setSetting(inspectorAttachedHeightName, Setting(attachedHeight));
+    setSetting(inspectorAttachedHeightName, String::number(attachedHeight));
     
     m_client->setAttachedWindowHeight(attachedHeight);
 }
 
 void InspectorController::storeLastActivePanel(const String& panelName)
 {
-    setSetting(lastActivePanelSettingName, Setting(panelName));
+    setSetting(lastActivePanelSettingName, panelName);
 }
 
 void InspectorController::toggleSearchForNodeInPage()
@@ -517,8 +496,10 @@ void InspectorController::windowScriptObjectAvailable()
 
     // Grant the inspector the ability to script the inspected page.
     m_page->mainFrame()->document()->securityOrigin()->grantUniversalAccess();
-    m_scriptState = scriptStateFromPage(m_page);
-    ScriptGlobalObject::set(m_scriptState, "InspectorController", m_inspectorBackend.get());
+    m_scriptState = scriptStateFromPage(debuggerWorld(), m_page);
+    ScriptGlobalObject::set(m_scriptState, "InspectorBackend", m_inspectorBackend.get());
+    ScriptGlobalObject::set(m_scriptState, "InspectorFrontendHost", m_inspectorFrontendHost.get());
+    ScriptGlobalObject::set(m_scriptState, "InjectedScriptHost", m_injectedScriptHost.get());
 }
 
 void InspectorController::scriptObjectReady()
@@ -536,11 +517,11 @@ void InspectorController::scriptObjectReady()
     setFrontendProxyObject(m_scriptState, webInspectorObj, injectedScriptObj);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    Setting debuggerEnabled = setting(debuggerEnabledSettingName);
-    if (debuggerEnabled.type() == Setting::BooleanType && debuggerEnabled.booleanValue())
+    String debuggerEnabled = setting(debuggerEnabledSettingName);
+    if (debuggerEnabled == "true")
         enableDebugger();
-    Setting profilerEnabled = setting(profilerEnabledSettingName);
-    if (profilerEnabled.type() == Setting::BooleanType && profilerEnabled.booleanValue())
+    String profilerEnabled = setting(profilerEnabledSettingName);
+    if (profilerEnabled == "true")
         enableProfiler();
 #endif
 
@@ -611,14 +592,17 @@ void InspectorController::close()
 #endif
     closeWindow();
 
-    m_frontend.set(0);
     m_injectedScriptObj = ScriptObject();
     releaseDOMAgent();
+    m_frontend.set(0);
     m_timelineAgent = 0;
     m_scriptState = 0;
-    if (m_page)
-        m_page->setParentInspectorController(0);
-    m_page = 0;
+    if (m_page) {
+        if (!m_page->mainFrame() || !m_page->mainFrame()->loader() || !m_page->mainFrame()->loader()->isLoading()) {
+            m_page->setParentInspectorController(0);
+            m_page = 0;
+        }
+    }
 }
 
 void InspectorController::showWindow()
@@ -629,8 +613,10 @@ void InspectorController::showWindow()
 
     m_client->showWindow();
 
-    Setting attachedHeight = setting(inspectorAttachedHeightName);
-    unsigned preferredHeight = attachedHeight.type() == Setting::IntegerType ? attachedHeight.integerValue() : defaultAttachedHeight;
+    String attachedHeight = setting(inspectorAttachedHeightName);
+    bool success = true;
+    int height = attachedHeight.toInt(&success);
+    unsigned preferredHeight = success ? height : defaultAttachedHeight;
 
     // This call might not go through (if the window starts out detached), but if the window is initially created attached,
     // InspectorController::attachWindow is never called, so we need to make sure to set the attachedWindowHeight.
@@ -648,7 +634,7 @@ void InspectorController::releaseDOMAgent()
     // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
     // no references to the DOM agent from the DOM tree.
     if (m_domAgent)
-        m_domAgent->setDocument(0);
+        m_domAgent->reset();
     m_domAgent = 0;
 }
 
@@ -661,12 +647,8 @@ void InspectorController::populateScriptObjects()
     m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
         it->second->createScriptObject(m_frontend.get());
-        KURL resourceURL = it->second->frame()->document()->url();
-        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
-            m_frontend->addCookieDomain(resourceURL.host());
-    }
 
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
@@ -715,7 +697,7 @@ void InspectorController::resetScriptObjects()
         m_timelineAgent->reset();
 
     m_frontend->reset();
-    m_domAgent->setDocument(0);
+    m_domAgent->reset();
     m_objectGroups.clear();
     m_idToWrappedObject.clear();
 }
@@ -761,6 +743,7 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         // resetScriptObjects should be called before database and DOM storage
         // resources are cleared so that it has a chance to unbind them.
         resetScriptObjects();
+
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
 #endif
@@ -840,7 +823,7 @@ void InspectorController::removeResource(InspectorResource* resource)
     }
 }
 
-InspectorResource* InspectorController::getTrackedResource(long long identifier)
+InspectorResource* InspectorController::getTrackedResource(unsigned long identifier)
 {
     if (!enabled())
         return 0;
@@ -870,7 +853,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
 
-    RefPtr<InspectorResource> resource = InspectorResource::createCached(m_nextIdentifier--, loader, cachedResource);
+    RefPtr<InspectorResource> resource = InspectorResource::createCached(m_inspectedPage->progress()->createUniqueIdentifier() , loader, cachedResource);
 
     if (isMainResource) {
         m_mainResource = resource;
@@ -938,8 +921,12 @@ bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KUR
     return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
 }
 
-void InspectorController::willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+void InspectorController::willSendRequest(unsigned long identifier, const ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
+    bool isMainResource = (m_mainResource && m_mainResource->identifier() == identifier);
+    if (m_timelineAgent)
+        m_timelineAgent->willSendResourceRequest(identifier, isMainResource, request);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -955,8 +942,11 @@ void InspectorController::willSendRequest(DocumentLoader*, unsigned long identif
         resource->createScriptObject(m_frontend.get());
 }
 
-void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse& response)
+void InspectorController::didReceiveResponse(unsigned long identifier, const ResourceResponse& response)
 {
+    if (m_timelineAgent)
+        m_timelineAgent->didReceiveResourceResponse(identifier, response);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -968,7 +958,7 @@ void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long iden
         resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived)
+void InspectorController::didReceiveContentLength(unsigned long identifier, int lengthReceived)
 {
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
@@ -980,8 +970,11 @@ void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long
         resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identifier)
+void InspectorController::didFinishLoading(unsigned long identifier)
 {
+    if (m_timelineAgent)
+        m_timelineAgent->didFinishLoadingResource(identifier, false);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -992,16 +985,15 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     addResource(resource.get());
 
-    if (windowVisible()) {
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
-        KURL resourceURL = resource->frame()->document()->url();
-        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
-            m_frontend->addCookieDomain(resourceURL.host());
-    }
 }
 
-void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
+void InspectorController::didFailLoading(unsigned long identifier, const ResourceError& /*error*/)
 {
+    if (m_timelineAgent)
+        m_timelineAgent->didFinishLoadingResource(identifier, true);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -1055,7 +1047,7 @@ void InspectorController::enableResourceTracking(bool always, bool reload)
         return;
 
     if (always)
-        setSetting(resourceTrackingEnabledSettingName, Setting(true));
+        setSetting(resourceTrackingEnabledSettingName, "true");
 
     if (m_resourceTrackingEnabled)
         return;
@@ -1075,7 +1067,7 @@ void InspectorController::disableResourceTracking(bool always)
         return;
 
     if (always)
-        setSetting(resourceTrackingEnabledSettingName, Setting(false));
+        setSetting(resourceTrackingEnabledSettingName, "false");
 
     ASSERT(m_inspectedPage);
     m_resourceTrackingEnabled = false;
@@ -1089,8 +1081,8 @@ void InspectorController::ensureResourceTrackingSettingsLoaded()
         return;
     m_resourceTrackingSettingsLoaded = true;
 
-    Setting resourceTracking = setting(resourceTrackingEnabledSettingName);
-    if (resourceTracking.type() == Setting::BooleanType && resourceTracking.booleanValue())
+    String resourceTracking = setting(resourceTrackingEnabledSettingName);
+    if (resourceTracking == "true")
         m_resourceTrackingEnabled = true;
 }
 
@@ -1120,14 +1112,6 @@ void InspectorController::stopTimelineProfiler()
         m_frontend->timelineProfilerWasStopped();
 }
 
-bool InspectorController::timelineProfilerEnabled() const
-{
-    if (!enabled())
-        return false;
-
-    return m_timelineAgent;
-}
-
 #if ENABLE(DATABASE)
 void InspectorController::selectDatabase(Database* database)
 {
@@ -1165,42 +1149,44 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
 }
 #endif
 
-void InspectorController::getCookies(long callId, const String& host)
+void InspectorController::getCookies(long callId)
 {
     if (!m_frontend)
         return;
-    
+
     // If we can get raw cookies.
     ListHashSet<Cookie> rawCookiesList;
-    
+
     // If we can't get raw cookies - fall back to String representation
     String stringCookiesList;
-    
+
     // Return value to getRawCookies should be the same for every call because
     // the return value is platform/network backend specific, and the call will
     // always return the same true/false value.
     bool rawCookiesImplemented = false;
-    
+
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
         Document* document = it->second->frame()->document();
-        if (document->url().host() == host) {
-            Vector<Cookie> docCookiesList;
-            rawCookiesImplemented = getRawCookies(document, document->cookieURL(), docCookiesList);
-            
-            if (!rawCookiesImplemented)
-                // FIXME: We need duplication checking for the String representation of cookies.
-                stringCookiesList += document->cookie();
-            else {
-                int cookiesSize = docCookiesList.size();
-                for (int i = 0; i < cookiesSize; i++) {
-                    if (!rawCookiesList.contains(docCookiesList[i]))
-                        rawCookiesList.add(docCookiesList[i]);
-                }
+        Vector<Cookie> docCookiesList;
+        rawCookiesImplemented = getRawCookies(document, document->cookieURL(), docCookiesList);
+
+        if (!rawCookiesImplemented) {
+            // FIXME: We need duplication checking for the String representation of cookies.
+            ExceptionCode ec = 0;
+            stringCookiesList += document->cookie(ec);
+            // Exceptions are thrown by cookie() in sandboxed frames. That won't happen here
+            // because "document" is the document of the main frame of the page.
+            ASSERT(!ec);
+        } else {
+            int cookiesSize = docCookiesList.size();
+            for (int i = 0; i < cookiesSize; i++) {
+                if (!rawCookiesList.contains(docCookiesList[i]))
+                    rawCookiesList.add(docCookiesList[i]);
             }
         }
     }
-    
+
     if (!rawCookiesImplemented)
         m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), stringCookiesList);
     else
@@ -1412,6 +1398,7 @@ ScriptObject InspectorController::createProfileHeader(const JSC::Profile& profil
     ScriptObject header = m_frontend->newScriptObject();
     header.set("title", profile.title());
     header.set("uid", profile.uid());
+    header.set("typeId", UString(CPUProfileType));
     return header;
 }
 
@@ -1481,7 +1468,7 @@ void InspectorController::toggleRecordButton(bool isProfiling)
 void InspectorController::enableProfiler(bool always, bool skipRecompile)
 {
     if (always)
-        setSetting(profilerEnabledSettingName, Setting(true));
+        setSetting(profilerEnabledSettingName, "true");
 
     if (m_profilerEnabled)
         return;
@@ -1498,7 +1485,7 @@ void InspectorController::enableProfiler(bool always, bool skipRecompile)
 void InspectorController::disableProfiler(bool always)
 {
     if (always)
-        setSetting(profilerEnabledSettingName, Setting(false));
+        setSetting(profilerEnabledSettingName, "false");
 
     if (!m_profilerEnabled)
         return;
@@ -1514,7 +1501,7 @@ void InspectorController::disableProfiler(bool always)
 void InspectorController::enableDebuggerFromFrontend(bool always)
 {
     if (always)
-        setSetting(debuggerEnabledSettingName, Setting(true));
+        setSetting(debuggerEnabledSettingName, "true");
 
     ASSERT(m_inspectedPage);
 
@@ -1547,7 +1534,7 @@ void InspectorController::disableDebugger(bool always)
         return;
 
     if (always)
-        setSetting(debuggerEnabledSettingName, Setting(false));
+        setSetting(debuggerEnabledSettingName, "false");
 
     ASSERT(m_inspectedPage);
 
@@ -1603,11 +1590,11 @@ void InspectorController::evaluateForTestInFrontend(long callId, const String& s
 
 void InspectorController::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
 {
-    ScriptState* scriptState = scriptStateFromPage(m_inspectedPage);
+    ScriptState* scriptState = scriptStateFromPage(debuggerWorld(), m_inspectedPage);
     ScriptObject window;
     ScriptGlobalObject::get(scriptState, "window", window);
     ScriptFunctionCall function(scriptState, window, "didEvaluateForTestInFrontend");
-    function.appendArgument(static_cast<int>(callId));
+    function.appendArgument(callId);
     function.appendArgument(jsonResult);
     function.call();
 }
@@ -1639,7 +1626,7 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
 
         context.addPath(quadPath);
         context.setStrokeThickness(outlineThickness);
-        context.setStrokeColor(outlineColor);
+        context.setStrokeColor(outlineColor, DeviceColorSpace);
         context.strokePath();
 
         context.restore();
@@ -1647,7 +1634,7 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
     
     // Now do the fill
     context.addPath(quadPath);
-    context.setFillColor(fillColor);
+    context.setFillColor(fillColor, DeviceColorSpace);
     context.fillPath();
 }
 
@@ -1798,10 +1785,14 @@ InspectorController::SpecialPanels InspectorController::specialPanelForJSName(co
         return ResourcesPanel;
     else if (panelName == "scripts")
         return ScriptsPanel;
+    else if (panelName == "timeline")
+        return TimelinePanel;
     else if (panelName == "profiles")
         return ProfilesPanel;
     else if (panelName == "storage" || panelName == "databases")
         return StoragePanel;
+    else if (panelName == "console")
+        return ConsolePanel;
     else
         return ElementsPanel;
 }
@@ -1861,5 +1852,5 @@ void InspectorController::deleteCookie(const String& cookieName, const String& d
 }
 
 } // namespace WebCore
-
+    
 #endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorController.h b/WebCore/inspector/InspectorController.h
index 382d887..bb4e1f3 100644
--- a/WebCore/inspector/InspectorController.h
+++ b/WebCore/inspector/InspectorController.h
@@ -62,16 +62,18 @@ class Document;
 class DocumentLoader;
 class GraphicsContext;
 class HitTestResult;
+class InjectedScriptHost;
 class InspectorBackend;
 class InspectorClient;
 class InspectorDOMAgent;
 class InspectorFrontend;
+class InspectorFrontendHost;
 class InspectorTimelineAgent;
 class JavaScriptCallFrame;
 class KURL;
 class Node;
 class Page;
-struct ResourceRequest;
+class ResourceRequest;
 class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
@@ -91,7 +93,7 @@ class InspectorController
 #endif
                                                     {
 public:
-    typedef HashMap<long long, RefPtr<InspectorResource> > ResourcesMap;
+    typedef HashMap<unsigned long, RefPtr<InspectorResource> > ResourcesMap;
     typedef HashMap<RefPtr<Frame>, ResourcesMap*> FrameResourcesMap;
     typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
     typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
@@ -101,70 +103,19 @@ public:
         CurrentPanel,
         ConsolePanel,
         ElementsPanel,
-        ProfilesPanel,
         ResourcesPanel,
         ScriptsPanel,
+        TimelinePanel,
+        ProfilesPanel,
         StoragePanel
     } SpecialPanels;
 
-    struct Setting {
-        enum Type {
-            NoType, StringType, StringVectorType, DoubleType, IntegerType, BooleanType
-        };
-
-        Setting()
-            : m_type(NoType)
-        {
-        }
-
-        explicit Setting(bool value)
-            : m_type(BooleanType)
-        {
-            m_simpleContent.m_boolean = value;
-        }
-
-        explicit Setting(unsigned value)
-            : m_type(IntegerType)
-        {
-            m_simpleContent.m_integer = value;
-        }
-
-        explicit Setting(const String& value)
-            : m_type(StringType)
-        {
-            m_string = value;
-        }
-
-        Type type() const { return m_type; }
-
-        String string() const { ASSERT(m_type == StringType); return m_string; }
-        const Vector<String>& stringVector() const { ASSERT(m_type == StringVectorType); return m_stringVector; }
-        double doubleValue() const { ASSERT(m_type == DoubleType); return m_simpleContent.m_double; }
-        long integerValue() const { ASSERT(m_type == IntegerType); return m_simpleContent.m_integer; }
-        bool booleanValue() const { ASSERT(m_type == BooleanType); return m_simpleContent.m_boolean; }
-
-        void set(const String& value) { m_type = StringType; m_string = value; }
-        void set(const Vector<String>& value) { m_type = StringVectorType; m_stringVector = value; }
-        void set(double value) { m_type = DoubleType; m_simpleContent.m_double = value; }
-        void set(long value) { m_type = IntegerType; m_simpleContent.m_integer = value; }
-        void set(bool value) { m_type = BooleanType; m_simpleContent.m_boolean = value; }
-
-    private:
-        Type m_type;
-
-        String m_string;
-        Vector<String> m_stringVector;
-
-        union {
-            double m_double;
-            long m_integer;
-            bool m_boolean;
-        } m_simpleContent;
-    };
     InspectorController(Page*, InspectorClient*);
     ~InspectorController();
 
     InspectorBackend* inspectorBackend() { return m_inspectorBackend.get(); }
+    InspectorFrontendHost* inspectorFrontendHost() { return m_inspectorFrontendHost.get(); }
+    InjectedScriptHost* injectedScriptHost() { return m_injectedScriptHost.get(); }
 
     void inspectedPageDestroyed();
     void pageDestroyed() { m_page = 0; }
@@ -173,8 +124,8 @@ public:
 
     Page* inspectedPage() const { return m_inspectedPage; }
 
-    const Setting& setting(const String& key) const;
-    void setSetting(const String& key, const Setting&);
+    String setting(const String& key) const;
+    void setSetting(const String& key, const String& value);
 
     void inspect(Node*);
     void highlight(Node*);
@@ -215,11 +166,11 @@ public:
     void didLoadResourceFromMemoryCache(DocumentLoader*, const CachedResource*);
 
     void identifierForInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-    void willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
-    void didReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
-    void didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived);
-    void didFinishLoading(DocumentLoader*, unsigned long identifier);
-    void didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&);
+    void willSendRequest(unsigned long identifier, const ResourceRequest&, const ResourceResponse& redirectResponse);
+    void didReceiveResponse(unsigned long identifier, const ResourceResponse&);
+    void didReceiveContentLength(unsigned long identifier, int lengthReceived);
+    void didFinishLoading(unsigned long identifier);
+    void didFailLoading(unsigned long identifier, const ResourceError&);
     void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     void scriptImported(unsigned long identifier, const String& sourceString);
 
@@ -230,13 +181,12 @@ public:
 
     void startTimelineProfiler();
     void stopTimelineProfiler();
-    bool timelineProfilerEnabled() const;
     InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
 
     void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
     void mainResourceFiredDOMContentEvent(DocumentLoader*, const KURL&);
                                                         
-    void getCookies(long callId, const String& url);
+    void getCookies(long callId);
 
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
@@ -261,6 +211,8 @@ public:
     void startGroup(MessageSource source, ScriptCallStack* callFrame);
     void endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL);
 
+    void markTimeline(const String& message); 
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
@@ -292,6 +244,8 @@ public:
 
 private:
     friend class InspectorBackend;
+    friend class InspectorFrontendHost;
+    friend class InjectedScriptHost;
     // Following are used from InspectorBackend and internally.
     void scriptObjectReady();
     void moveWindowBy(float x, float y) const;
@@ -341,7 +295,7 @@ private:
 
     void addResource(InspectorResource*);
     void removeResource(InspectorResource*);
-    InspectorResource* getTrackedResource(long long identifier);
+    InspectorResource* getTrackedResource(unsigned long identifier);
 
     void pruneResources(ResourcesMap*, DocumentLoader* loaderToKeep = 0);
     void removeAllResources(ResourcesMap* map) { pruneResources(map); }
@@ -378,7 +332,6 @@ private:
     ScriptState* m_scriptState;
     bool m_windowVisible;
     SpecialPanels m_showAfterVisible;
-    long long m_nextIdentifier;
     RefPtr<Node> m_highlightedNode;
     unsigned m_groupLevel;
     bool m_searchingForNode;
@@ -386,10 +339,15 @@ private:
     bool m_resourceTrackingEnabled;
     bool m_resourceTrackingSettingsLoaded;
     RefPtr<InspectorBackend> m_inspectorBackend;
+    RefPtr<InspectorFrontendHost> m_inspectorFrontendHost;
+    RefPtr<InjectedScriptHost> m_injectedScriptHost;
     HashMap<String, ScriptValue> m_idToWrappedObject;
     ObjectGroupsMap m_objectGroups;
-
     long m_lastBoundObjectId;
+
+    typedef HashMap<String, String> Settings;
+    mutable Settings m_settings;
+
     Vector<pair<long, String> > m_pendingEvaluateTestCommands;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     bool m_debuggerEnabled;
diff --git a/WebCore/inspector/InspectorDOMAgent.cpp b/WebCore/inspector/InspectorDOMAgent.cpp
index f6c2d46..1aaf309 100644
--- a/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/WebCore/inspector/InspectorDOMAgent.cpp
@@ -68,13 +68,11 @@ InspectorDOMAgent::InspectorDOMAgent(InspectorFrontend* frontend)
 
 InspectorDOMAgent::~InspectorDOMAgent()
 {
-    setDocument(0);
+    reset();
 }
 
-void InspectorDOMAgent::setDocument(Document* doc)
+void InspectorDOMAgent::reset()
 {
-    if (doc == mainFrameDocument())
-        return;
     discardBindings();
 
     ListHashSet<RefPtr<Document> > copy = m_documents;
@@ -82,13 +80,21 @@ void InspectorDOMAgent::setDocument(Document* doc)
         stopListening((*it).get());
 
     ASSERT(!m_documents.size());
+}
+
+void InspectorDOMAgent::setDocument(Document* doc)
+{
+    if (doc == mainFrameDocument())
+        return;
+
+    reset();
 
     if (doc) {
         startListening(doc);
-        if (doc->documentElement()) {
+        if (doc->documentElement())
             pushDocumentToFrontend();
-        }
-    }
+    } else
+        m_frontend->setDocument(ScriptObject());
 }
 
 void InspectorDOMAgent::releaseDanglingNodes()
@@ -193,8 +199,9 @@ void InspectorDOMAgent::handleEvent(ScriptExecutionContext*, Event* event)
             // Re-add frame owner element together with its new children.
             long parentId = m_documentNodeToIdMap.get(innerParentNode(node));
             m_frontend->childNodeRemoved(parentId, frameOwnerId);
-            long prevId = m_documentNodeToIdMap.get(innerPreviousSibling(node));
             ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
+            Node* previousSibling = innerPreviousSibling(node);
+            long prevId = previousSibling ? m_documentNodeToIdMap.get(previousSibling) : 0;
             m_frontend->childNodeInserted(parentId, prevId, value);
             // Invalidate children requested flag for the element.
             m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
@@ -238,11 +245,14 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
     }
 }
 
-void InspectorDOMAgent::pushDocumentToFrontend()
+bool InspectorDOMAgent::pushDocumentToFrontend()
 {
     Document* document = mainFrameDocument();
+    if (!document)
+        return false;
     if (!m_documentNodeToIdMap.contains(document))
         m_frontend->setDocument(buildObjectForNode(document, 2, &m_documentNodeToIdMap));
+    return true;
 }
 
 void InspectorDOMAgent::pushChildNodesToFrontend(long nodeId)
@@ -278,6 +288,35 @@ Node* InspectorDOMAgent::nodeForId(long id)
     return 0;
 }
 
+Node* InspectorDOMAgent::nodeForPath(const String& path)
+{
+    // The path is of form "1,HTML,2,BODY,1,DIV"
+    Node* node = mainFrameDocument();
+    if (!node)
+        return 0;
+
+    Vector<String> pathTokens;
+    path.split(",", false, pathTokens);
+    for (size_t i = 0; i < pathTokens.size() - 1; i += 2) {
+        bool success = true;
+        unsigned childNumber = pathTokens[i].toUInt(&success);
+        if (!success)
+            return 0;
+        if (childNumber >= innerChildNodeCount(node))
+            return 0;
+
+        Node* child = innerFirstChild(node);
+        String childName = pathTokens[i + 1];
+        for (size_t j = 0; child && j < childNumber; ++j)
+            child = innerNextSibling(child);
+
+        if (!child || child->nodeName() != childName)
+            return 0;
+        node = child;
+    }
+    return node;
+}
+
 void InspectorDOMAgent::getChildNodes(long callId, long nodeId)
 {
     pushChildNodesToFrontend(nodeId);
@@ -289,7 +328,8 @@ long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
     ASSERT(nodeToPush);  // Invalid input
 
     // If we are sending information to the client that is currently being created. Send root node first.
-    pushDocumentToFrontend();
+    if (!pushDocumentToFrontend())
+        return 0;
 
     // Return id in case the node is known.
     long result = m_documentNodeToIdMap.get(nodeToPush);
@@ -380,8 +420,8 @@ void InspectorDOMAgent::getEventListenersForNode(long callId, long nodeId)
     // Get the list of event types this Node is concerned with
     Vector<AtomicString> eventTypes;
     const EventListenerMap& listenerMap = d->eventListenerMap;
-    HashMap<AtomicString, EventListenerVector>::const_iterator end = listenerMap.end();
-    for (HashMap<AtomicString, EventListenerVector>::const_iterator iter = listenerMap.begin(); iter != end; ++iter)
+    EventListenerMap::const_iterator end = listenerMap.end();
+    for (EventListenerMap::const_iterator iter = listenerMap.begin(); iter != end; ++iter)
         eventTypes.append(iter->first);
 
     // Quick break if no useful listeners
@@ -465,7 +505,7 @@ ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth, NodeTo
             break;
     }
 
-    value.set("id", static_cast<int>(id));
+    value.set("id", id);
     value.set("nodeType", node->nodeType());
     value.set("nodeName", nodeName);
     value.set("localName", localName);
@@ -532,7 +572,7 @@ ScriptObject InspectorDOMAgent::buildObjectForEventListener(const RegisteredEven
     value.set("type", eventType);
     value.set("useCapture", registeredEventListener.useCapture);
     value.set("isAttribute", eventListener->isAttribute());
-    value.set("nodeId", static_cast<long long>(pushNodePathToFrontend(node)));
+    value.set("nodeId", pushNodePathToFrontend(node));
     value.set("listener", getEventListenerHandlerBody(node->document(), m_frontend->scriptState(), eventListener.get()));
     return value;
 }
@@ -569,9 +609,9 @@ Node* InspectorDOMAgent::innerPreviousSibling(Node* node)
     return node;
 }
 
-int InspectorDOMAgent::innerChildNodeCount(Node* node)
+unsigned InspectorDOMAgent::innerChildNodeCount(Node* node)
 {
-    int count = 0;
+    unsigned count = 0;
     Node* child = innerFirstChild(node);
     while (child) {
         count++;
diff --git a/WebCore/inspector/InspectorDOMAgent.h b/WebCore/inspector/InspectorDOMAgent.h
index 3f736f7..4579548 100644
--- a/WebCore/inspector/InspectorDOMAgent.h
+++ b/WebCore/inspector/InspectorDOMAgent.h
@@ -83,6 +83,8 @@ namespace WebCore {
         InspectorDOMAgent(InspectorFrontend* frontend);
         ~InspectorDOMAgent();
 
+        void reset();
+
         virtual bool operator==(const EventListener& other);
 
         // Methods called from the frontend.
@@ -97,6 +99,7 @@ namespace WebCore {
         void releaseDanglingNodes();
 
         Node* nodeForId(long nodeId);
+        Node* nodeForPath(const String& path);
         long pushNodePathToFrontend(Node* node);
 
    private:
@@ -109,7 +112,7 @@ namespace WebCore {
         long bind(Node* node, NodeToIdMap* nodesMap);
         void unbind(Node* node, NodeToIdMap* nodesMap);
 
-        void pushDocumentToFrontend();
+        bool pushDocumentToFrontend();
         void pushChildNodesToFrontend(long nodeId);
 
         ScriptObject buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap);
@@ -123,7 +126,7 @@ namespace WebCore {
         Node* innerFirstChild(Node* node);
         Node* innerNextSibling(Node* node);
         Node* innerPreviousSibling(Node* node);
-        int innerChildNodeCount(Node* node);
+        unsigned innerChildNodeCount(Node* node);
         Node* innerParentNode(Node* node);
         bool isWhitespace(Node* node);
 
diff --git a/WebCore/inspector/InspectorDatabaseResource.cpp b/WebCore/inspector/InspectorDatabaseResource.cpp
index c2dc5c6..cec0e28 100644
--- a/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -37,7 +37,6 @@
 #include "Frame.h"
 #include "InspectorFrontend.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 
 namespace WebCore {
 
@@ -59,9 +58,6 @@ void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
         return;
 
     ScriptObject jsonObject = frontend->newScriptObject();
-    ScriptObject database;
-    if (!getQuarantinedScriptObject(m_database.get(), database))
-        return;
     jsonObject.set("id", m_id);
     jsonObject.set("domain", m_domain);
     jsonObject.set("name", m_name);
diff --git a/WebCore/inspector/InspectorFrontend.cpp b/WebCore/inspector/InspectorFrontend.cpp
index 2c422ac..70f4868 100644
--- a/WebCore/inspector/InspectorFrontend.cpp
+++ b/WebCore/inspector/InspectorFrontend.cpp
@@ -38,7 +38,6 @@
 #include "Node.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 #include "ScriptState.h"
 #include "ScriptString.h"
 #include <wtf/OwnPtr.h>
@@ -80,24 +79,26 @@ void InspectorFrontend::didCommitLoad()
 
 void InspectorFrontend::addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addConsoleMessage"));
-    function->appendArgument(messageObj);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addConsoleMessage");
+    function.appendArgument(messageObj);
     if (!frames.isEmpty()) {
         for (unsigned i = 0; i < frames.size(); ++i)
-            function->appendArgument(frames[i]);
+            function.appendArgument(frames[i]);
     } else if (!wrappedArguments.isEmpty()) {
         for (unsigned i = 0; i < wrappedArguments.size(); ++i)
-            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i], "console"));
+            function.appendArgument(m_inspectorController->wrapObject(wrappedArguments[i], "console"));
     } else
-        function->appendArgument(message);
-    function->call();
+        function.appendArgument(message);
+    function.call();
 }
 
 void InspectorFrontend::updateConsoleMessageRepeatCount(const int count)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateConsoleMessageRepeatCount"));
-    function->appendArgument(count);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("updateConsoleMessageRepeatCount");
+    function.appendArgument(count);
+    function.call();
 }
 
 void InspectorFrontend::clearConsoleMessages()
@@ -105,52 +106,50 @@ void InspectorFrontend::clearConsoleMessages()
     callSimpleFunction("clearConsoleMessages");
 }
 
-bool InspectorFrontend::addResource(long long identifier, const ScriptObject& resourceObj)
+bool InspectorFrontend::addResource(unsigned long identifier, const ScriptObject& resourceObj)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addResource"));
-    function->appendArgument(identifier);
-    function->appendArgument(resourceObj);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addResource");
+    function.appendArgument(identifier);
+    function.appendArgument(resourceObj);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
-bool InspectorFrontend::updateResource(long long identifier, const ScriptObject& resourceObj)
+bool InspectorFrontend::updateResource(unsigned long identifier, const ScriptObject& resourceObj)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateResource"));
-    function->appendArgument(identifier);
-    function->appendArgument(resourceObj);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("updateResource");
+    function.appendArgument(identifier);
+    function.appendArgument(resourceObj);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
-void InspectorFrontend::removeResource(long long identifier)
+void InspectorFrontend::removeResource(unsigned long identifier)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("removeResource"));
-    function->appendArgument(identifier);
-    function->call();
-}
-
-void InspectorFrontend::addCookieDomain(String domain)
-{
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addCookieDomain"));
-    function->appendArgument(domain);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("removeResource");
+    function.appendArgument(identifier);
+    function.call();
 }
 
-void InspectorFrontend::updateFocusedNode(long long nodeId)
+void InspectorFrontend::updateFocusedNode(long nodeId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
-    function->appendArgument(nodeId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("updateFocusedNode");
+    function.appendArgument(nodeId);
+    function.call();
 }
 
 void InspectorFrontend::setAttachedWindow(bool attached)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setAttachedWindow"));
-    function->appendArgument(attached);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setAttachedWindow");
+    function.appendArgument(attached);
+    function.call();
 }
 
 void InspectorFrontend::showPanel(int panel)
@@ -158,20 +157,23 @@ void InspectorFrontend::showPanel(int panel)
     const char* showFunctionName;
     switch (panel) {
         case InspectorController::ConsolePanel:
-            showFunctionName = "showConsole";
+            showFunctionName = "showConsolePanel";
             break;
         case InspectorController::ElementsPanel:
             showFunctionName = "showElementsPanel";
             break;
-        case InspectorController::ProfilesPanel:
-            showFunctionName = "showProfilesPanel";
-            break;
         case InspectorController::ResourcesPanel:
             showFunctionName = "showResourcesPanel";
             break;
         case InspectorController::ScriptsPanel:
             showFunctionName = "showScriptsPanel";
             break;
+        case InspectorController::TimelinePanel:
+            showFunctionName = "showTimelinePanel";
+            break;
+        case InspectorController::ProfilesPanel:
+            showFunctionName = "showProfilesPanel";
+            break;
         case InspectorController::StoragePanel:
             showFunctionName = "showStoragePanel";
             break;
@@ -216,9 +218,10 @@ void InspectorFrontend::timelineProfilerWasStopped()
 
 void InspectorFrontend::addRecordToTimeline(const ScriptObject& record)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addRecordToTimeline"));
-    function->appendArgument(record);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addRecordToTimeline");
+    function.appendArgument(record);
+    function.call();
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -249,60 +252,67 @@ void InspectorFrontend::profilerWasDisabled()
 
 void InspectorFrontend::parsedScriptSource(const JSC::SourceCode& source)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("parsedScriptSource"));
-    function->appendArgument(JSC::UString(JSC::UString::from(source.provider()->asID())));
-    function->appendArgument(source.provider()->url());
-    function->appendArgument(JSC::UString(source.data(), source.length()));
-    function->appendArgument(source.firstLine());
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("parsedScriptSource");
+    function.appendArgument(JSC::UString(JSC::UString::from(source.provider()->asID())));
+    function.appendArgument(source.provider()->url());
+    function.appendArgument(JSC::UString(source.data(), source.length()));
+    function.appendArgument(source.firstLine());
+    function.call();
 }
 
 void InspectorFrontend::failedToParseScriptSource(const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("failedToParseScriptSource"));
-    function->appendArgument(source.provider()->url());
-    function->appendArgument(JSC::UString(source.data(), source.length()));
-    function->appendArgument(source.firstLine());
-    function->appendArgument(errorLine);
-    function->appendArgument(errorMessage);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("failedToParseScriptSource");
+    function.appendArgument(source.provider()->url());
+    function.appendArgument(JSC::UString(source.data(), source.length()));
+    function.appendArgument(source.firstLine());
+    function.appendArgument(errorLine);
+    function.appendArgument(errorMessage);
+    function.call();
 }
 
 void InspectorFrontend::addProfileHeader(const ScriptValue& profile)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfileHeader"));
-    function->appendArgument(profile);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addProfileHeader");
+    function.appendArgument(profile);
+    function.call();
 }
 
 void InspectorFrontend::setRecordingProfile(bool isProfiling)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setRecordingProfile"));
-    function->appendArgument(isProfiling);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setRecordingProfile");
+    function.appendArgument(isProfiling);
+    function.call();
 }
 
 void InspectorFrontend::didGetProfileHeaders(int callId, const ScriptArray& headers)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfileHeaders"));
-    function->appendArgument(callId);
-    function->appendArgument(headers);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetProfileHeaders");
+    function.appendArgument(callId);
+    function.appendArgument(headers);
+    function.call();
 }
 
 void InspectorFrontend::didGetProfile(int callId, const ScriptValue& profile)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfile"));
-    function->appendArgument(callId);
-    function->appendArgument(profile);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetProfile");
+    function.appendArgument(callId);
+    function.appendArgument(profile);
+    function.call();
 }
 
 void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
-    function->appendArgument(callFrames);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("pausedScript");
+    function.appendArgument(callFrames);
+    function.call();
 }
 
 void InspectorFrontend::resumedScript()
@@ -313,203 +323,233 @@ void InspectorFrontend::resumedScript()
 
 void InspectorFrontend::setDocument(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDocument"));
-    function->appendArgument(root);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setDocument");
+    function.appendArgument(root);
+    function.call();
 }
 
 void InspectorFrontend::setDetachedRoot(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDetachedRoot"));
-    function->appendArgument(root);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setDetachedRoot");
+    function.appendArgument(root);
+    function.call();
 }
 
 void InspectorFrontend::setChildNodes(int parentId, const ScriptArray& nodes)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setChildNodes"));
-    function->appendArgument(parentId);
-    function->appendArgument(nodes);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setChildNodes");
+    function.appendArgument(parentId);
+    function.appendArgument(nodes);
+    function.call();
 }
 
 void InspectorFrontend::childNodeCountUpdated(int id, int newValue)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeCountUpdated"));
-    function->appendArgument(id);
-    function->appendArgument(newValue);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("childNodeCountUpdated");
+    function.appendArgument(id);
+    function.appendArgument(newValue);
+    function.call();
 }
 
 void InspectorFrontend::childNodeInserted(int parentId, int prevId, const ScriptObject& node)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeInserted"));
-    function->appendArgument(parentId);
-    function->appendArgument(prevId);
-    function->appendArgument(node);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("childNodeInserted");
+    function.appendArgument(parentId);
+    function.appendArgument(prevId);
+    function.appendArgument(node);
+    function.call();
 }
 
 void InspectorFrontend::childNodeRemoved(int parentId, int id)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeRemoved"));
-    function->appendArgument(parentId);
-    function->appendArgument(id);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("childNodeRemoved");
+    function.appendArgument(parentId);
+    function.appendArgument(id);
+    function.call();
 }
 
 void InspectorFrontend::attributesUpdated(int id, const ScriptArray& attributes)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("attributesUpdated"));
-    function->appendArgument(id);
-    function->appendArgument(attributes);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("attributesUpdated");
+    function.appendArgument(id);
+    function.appendArgument(attributes);
+    function.call();
 }
 
 void InspectorFrontend::didRemoveNode(int callId, int nodeId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveNode"));
-    function->appendArgument(callId);
-    function->appendArgument(nodeId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didRemoveNode");
+    function.appendArgument(callId);
+    function.appendArgument(nodeId);
+    function.call();
 }
 
 void InspectorFrontend::didGetChildNodes(int callId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetChildNodes"));
-    function->appendArgument(callId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetChildNodes");
+    function.appendArgument(callId);
+    function.call();
 }
 
 void InspectorFrontend::didApplyDomChange(int callId, bool success)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didApplyDomChange"));
-    function->appendArgument(callId);
-    function->appendArgument(success);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didApplyDomChange");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
 }
 
 void InspectorFrontend::didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetEventListenersForNode"));
-    function->appendArgument(callId);
-    function->appendArgument(nodeId);
-    function->appendArgument(listenersArray);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetEventListenersForNode");
+    function.appendArgument(callId);
+    function.appendArgument(nodeId);
+    function.appendArgument(listenersArray);
+    function.call();
 }
 
 void InspectorFrontend::didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetCookies"));
-    function->appendArgument(callId);
-    function->appendArgument(cookies);
-    function->appendArgument(cookiesString);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetCookies");
+    function.appendArgument(callId);
+    function.appendArgument(cookies);
+    function.appendArgument(cookiesString);
+    function.call();
 }
 
 void InspectorFrontend::didDispatchOnInjectedScript(int callId, const String& result, bool isException)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didDispatchOnInjectedScript"));
-    function->appendArgument(callId);
-    function->appendArgument(result);
-    function->appendArgument(isException);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didDispatchOnInjectedScript");
+    function.appendArgument(callId);
+    function.appendArgument(result);
+    function.appendArgument(isException);
+    function.call();
 }
 
 #if ENABLE(DATABASE)
 bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
-    function->appendArgument(dbObject);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addDatabase");
+    function.appendArgument(dbObject);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
 void InspectorFrontend::selectDatabase(int databaseId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDatabase"));
-    function->appendArgument(databaseId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("selectDatabase");
+    function.appendArgument(databaseId);
+    function.call();
 }
 void InspectorFrontend::didGetDatabaseTableNames(int callId, const ScriptArray& tableNames)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDatabaseTableNames"));
-    function->appendArgument(callId);
-    function->appendArgument(tableNames);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetDatabaseTableNames");
+    function.appendArgument(callId);
+    function.appendArgument(tableNames);
+    function.call();
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
 bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
-    function->appendArgument(domStorageObj);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addDOMStorage");
+    function.appendArgument(domStorageObj);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
 void InspectorFrontend::selectDOMStorage(int storageId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDOMStorage"));
-    function->appendArgument(storageId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("selectDOMStorage");
+    function.appendArgument(storageId);
+    function.call();
 }
 
 void InspectorFrontend::didGetDOMStorageEntries(int callId, const ScriptArray& entries)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDOMStorageEntries"));
-    function->appendArgument(callId);
-    function->appendArgument(entries);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetDOMStorageEntries");
+    function.appendArgument(callId);
+    function.appendArgument(entries);
+    function.call();
 }
 
 void InspectorFrontend::didSetDOMStorageItem(int callId, bool success)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didSetDOMStorageItem"));
-    function->appendArgument(callId);
-    function->appendArgument(success);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didSetDOMStorageItem");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
 }
 
 void InspectorFrontend::didRemoveDOMStorageItem(int callId, bool success)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveDOMStorageItem"));
-    function->appendArgument(callId);
-    function->appendArgument(success);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didRemoveDOMStorageItem");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
 }
 
 void InspectorFrontend::updateDOMStorage(int storageId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateDOMStorage"));
-    function->appendArgument(storageId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("updateDOMStorage");
+    function.appendArgument(storageId);
+    function.call();
 }
 #endif
 
 void InspectorFrontend::addNodesToSearchResult(const String& nodeIds)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addNodesToSearchResult"));
-    function->appendArgument(nodeIds);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addNodesToSearchResult");
+    function.appendArgument(nodeIds);
+    function.call();
 }
 
-void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
+void InspectorFrontend::contextMenuItemSelected(int itemId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("evaluateForTestInFrontend"));
-    function->appendArgument(callId);
-    function->appendArgument(script);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch");
+    function.appendArgument("contextMenuItemSelected");
+    function.appendArgument(itemId);
+    function.call();
+}
+
+void InspectorFrontend::contextMenuCleared()
+{
+    callSimpleFunction("contextMenuCleared");
 }
 
-PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
+void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
 {
-    ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
-    function->appendArgument(functionName);
-    return function;
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("evaluateForTestInFrontend");
+    function.appendArgument(callId);
+    function.appendArgument(script);
+    function.call();
 }
 
 void InspectorFrontend::callSimpleFunction(const String& functionName)
diff --git a/WebCore/inspector/InspectorFrontend.h b/WebCore/inspector/InspectorFrontend.h
index 3cb9b8c..03dac14 100644
--- a/WebCore/inspector/InspectorFrontend.h
+++ b/WebCore/inspector/InspectorFrontend.h
@@ -67,13 +67,11 @@ namespace WebCore {
         void updateConsoleMessageRepeatCount(const int count);
         void clearConsoleMessages();
 
-        bool addResource(long long identifier, const ScriptObject& resourceObj);
-        bool updateResource(long long identifier, const ScriptObject& resourceObj);
-        void removeResource(long long identifier);
+        bool addResource(unsigned long identifier, const ScriptObject& resourceObj);
+        bool updateResource(unsigned long identifier, const ScriptObject& resourceObj);
+        void removeResource(unsigned long identifier);
 
-        void addCookieDomain(String);
-
-        void updateFocusedNode(long long nodeId);
+        void updateFocusedNode(long nodeId);
         void setAttachedWindow(bool attached);
         void showPanel(int panel);
         void populateInterface();
@@ -134,11 +132,13 @@ namespace WebCore {
 
         void addNodesToSearchResult(const String& nodeIds);
 
+        void contextMenuItemSelected(int itemId);
+        void contextMenuCleared();
+
         ScriptState* scriptState() const { return m_scriptState; }
 
         void evaluateForTestInFrontend(int callId, const String& script);
     private:
-        PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
         void callSimpleFunction(const String& functionName);
         InspectorController* m_inspectorController;
         ScriptState* m_scriptState;
diff --git a/WebCore/inspector/InspectorFrontendHost.cpp b/WebCore/inspector/InspectorFrontendHost.cpp
new file mode 100644
index 0000000..2b83942
--- /dev/null
+++ b/WebCore/inspector/InspectorFrontendHost.cpp
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontendHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ContextMenu.h"
+#include "ContextMenuItem.h"
+#include "ContextMenuController.h"
+#include "ContextMenuSelectionHandler.h"
+#include "Element.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HitTestResult.h"
+#include "HTMLFrameOwnerElement.h"
+#include "InspectorClient.h"
+#include "InspectorFrontend.h"
+#include "InspectorResource.h"
+#include "Page.h"
+
+#include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+InspectorFrontendHost::InspectorFrontendHost(InspectorController* inspectorController, InspectorClient* client)
+    : m_inspectorController(inspectorController)
+    , m_client(client)
+    , m_menuSelectionHandler(MenuSelectionHandler::create(this))
+{
+}
+
+InspectorFrontendHost::~InspectorFrontendHost()
+{
+    m_menuSelectionHandler->disconnect();
+}
+
+void InspectorFrontendHost::loaded()
+{
+    if (m_inspectorController)
+        m_inspectorController->scriptObjectReady();
+}
+
+void InspectorFrontendHost::attach()
+{
+    if (m_inspectorController)
+        m_inspectorController->attachWindow();
+}
+
+void InspectorFrontendHost::detach()
+{
+    if (m_inspectorController)
+        m_inspectorController->detachWindow();
+}
+
+void InspectorFrontendHost::closeWindow()
+{
+    if (m_inspectorController)
+        m_inspectorController->closeWindow();
+}
+
+void InspectorFrontendHost::windowUnloading()
+{
+    if (m_inspectorController)
+        m_inspectorController->close();
+}
+
+void InspectorFrontendHost::setAttachedWindowHeight(unsigned height)
+{
+    if (m_inspectorController)
+        m_inspectorController->setAttachedWindowHeight(height);
+}
+
+void InspectorFrontendHost::moveWindowBy(float x, float y) const
+{
+    if (m_inspectorController)
+        m_inspectorController->moveWindowBy(x, y);
+}
+
+String InspectorFrontendHost::localizedStringsURL()
+{
+    return m_client->localizedStringsURL();
+}
+
+String InspectorFrontendHost::hiddenPanels()
+{
+    return m_client->hiddenPanels();
+}
+
+const String& InspectorFrontendHost::platform() const
+{
+#if PLATFORM(MAC)
+#ifdef BUILDING_ON_TIGER
+    DEFINE_STATIC_LOCAL(const String, platform, ("mac-tiger"));
+#else
+    DEFINE_STATIC_LOCAL(const String, platform, ("mac-leopard"));
+#endif
+#elif PLATFORM(WIN_OS)
+    DEFINE_STATIC_LOCAL(const String, platform, ("windows"));
+#else
+    DEFINE_STATIC_LOCAL(const String, platform, ("unknown"));
+#endif
+    return platform;
+}
+
+
+const String& InspectorFrontendHost::port() const
+{
+#if PLATFORM(QT)
+    DEFINE_STATIC_LOCAL(const String, port, ("qt"));
+#elif PLATFORM(GTK)
+    DEFINE_STATIC_LOCAL(const String, port, ("gtk"));
+#elif PLATFORM(WX)
+    DEFINE_STATIC_LOCAL(const String, port, ("wx"));
+#else
+    DEFINE_STATIC_LOCAL(const String, port, ("unknown"));
+#endif
+
+    return port;
+}
+
+void InspectorFrontendHost::addResourceSourceToFrame(long identifier, Node* frame)
+{
+    if (!m_inspectorController)
+        return;
+    RefPtr<InspectorResource> resource = m_inspectorController->resources().get(identifier);
+    if (resource) {
+        String sourceString = resource->sourceString();
+        if (!sourceString.isEmpty())
+            addSourceToFrame(resource->mimeType(), sourceString, frame);
+    }
+}
+
+bool InspectorFrontendHost::addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
+{
+    ASSERT_ARG(frameNode, frameNode);
+
+    if (!frameNode)
+        return false;
+
+    if (!frameNode->attached()) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    ASSERT(frameNode->isElementNode());
+    if (!frameNode->isElementNode())
+        return false;
+
+    Element* element = static_cast<Element*>(frameNode);
+    ASSERT(element->isFrameOwnerElement());
+    if (!element->isFrameOwnerElement())
+        return false;
+
+    HTMLFrameOwnerElement* frameOwner = static_cast<HTMLFrameOwnerElement*>(element);
+    ASSERT(frameOwner->contentFrame());
+    if (!frameOwner->contentFrame())
+        return false;
+
+    FrameLoader* loader = frameOwner->contentFrame()->loader();
+
+    loader->setResponseMIMEType(mimeType);
+    loader->begin();
+    loader->write(source);
+    loader->end();
+
+    return true;
+}
+
+String InspectorFrontendHost::setting(const String& key)
+{
+    return m_inspectorController ? m_inspectorController->setting(key) : "";
+}
+
+void InspectorFrontendHost::setSetting(const String& key, const String& value)
+{
+    if (m_inspectorController)
+        m_inspectorController->setSetting(key, value);
+}
+
+void InspectorFrontendHost::showContextMenu(Event* event, Vector<ContextMenuItem>& items)
+{
+    if (!m_inspectorController)
+        return;
+    if (!m_inspectorController->windowVisible())
+        return;
+
+    ContextMenuController* menuController = m_inspectorController->m_page->contextMenuController();
+    menuController->showContextMenu(event, items, m_menuSelectionHandler);
+}
+
+void InspectorFrontendHost::contextMenuItemSelected(ContextMenuItem* item)
+{
+    if (m_inspectorController && m_inspectorController->windowVisible()) {
+        int itemNumber = item->action() - ContextMenuItemBaseCustomTag;
+        m_inspectorController->m_frontend->contextMenuItemSelected(itemNumber);
+    }
+}
+
+void InspectorFrontendHost::contextMenuCleared()
+{
+    if (m_inspectorController && m_inspectorController->windowVisible())
+        m_inspectorController->m_frontend->contextMenuCleared();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorFrontendHost.h b/WebCore/inspector/InspectorFrontendHost.h
new file mode 100644
index 0000000..e0cfa6d
--- /dev/null
+++ b/WebCore/inspector/InspectorFrontendHost.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorFrontendHost_h
+#define InspectorFrontendHost_h
+
+#include "Console.h"
+#include "ContextMenuSelectionHandler.h"
+#include "InspectorController.h"
+#include "PlatformString.h"
+
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class ContextMenuItem;
+class Event;
+class InspectorClient;
+class Node;
+
+class InspectorFrontendHost : public RefCounted<InspectorFrontendHost>
+{
+public:
+    static PassRefPtr<InspectorFrontendHost> create(InspectorController* inspectorController, InspectorClient* client)
+    {
+        return adoptRef(new InspectorFrontendHost(inspectorController, client));
+    }
+
+    ~InspectorFrontendHost();
+
+    InspectorController* inspectorController() { return m_inspectorController; }
+
+    void disconnectController() { m_inspectorController = 0; }
+
+    void loaded();
+    void attach();
+    void detach();
+    void closeWindow();
+    void windowUnloading();
+
+    void setAttachedWindowHeight(unsigned height);
+    void moveWindowBy(float x, float y) const;
+
+    String localizedStringsURL();
+    String hiddenPanels();
+    const String& platform() const;
+    const String& port() const;
+
+    void addResourceSourceToFrame(long identifier, Node* frame);
+    bool addSourceToFrame(const String& mimeType, const String& source, Node* frame);
+
+    String setting(const String& key);
+    void setSetting(const String& key, const String& value);
+
+    // Called from [Custom] implementations.
+    void showContextMenu(Event*, Vector<ContextMenuItem>& items);
+    void contextMenuItemSelected(ContextMenuItem*);
+    void contextMenuCleared();
+
+private:
+    class MenuSelectionHandler : public ContextMenuSelectionHandler {
+    public:
+        static PassRefPtr<MenuSelectionHandler> create(InspectorFrontendHost* frontendHost)
+        {
+            return adoptRef(new MenuSelectionHandler(frontendHost));
+        }
+
+        virtual ~MenuSelectionHandler() { }
+
+        void disconnect() { m_frontendHost = 0; }
+
+        virtual void contextMenuItemSelected(ContextMenuItem* item)
+        {
+            if (m_frontendHost)
+                m_frontendHost->contextMenuItemSelected(item);
+        }
+
+        virtual void contextMenuCleared()
+        {
+            if (m_frontendHost)
+                m_frontendHost->contextMenuCleared();
+        }
+
+    private:
+        MenuSelectionHandler(InspectorFrontendHost* frontendHost)
+            : m_frontendHost(frontendHost) { }
+        InspectorFrontendHost* m_frontendHost;
+    };
+
+    InspectorFrontendHost(InspectorController* inspectorController, InspectorClient* client);
+
+    InspectorController* m_inspectorController;
+    InspectorClient* m_client;
+    RefPtr<MenuSelectionHandler> m_menuSelectionHandler;
+};
+
+} // namespace WebCore
+
+#endif // !defined(InspectorFrontendHost_h)
diff --git a/WebCore/inspector/InspectorFrontendHost.idl b/WebCore/inspector/InspectorFrontendHost.idl
new file mode 100644
index 0000000..c62a7e2
--- /dev/null
+++ b/WebCore/inspector/InspectorFrontendHost.idl
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        GenerateConstructor
+    ] InspectorFrontendHost {
+        void loaded();
+        void attach();
+        void detach();
+        void closeWindow();
+        void windowUnloading();
+
+        void setAttachedWindowHeight(in unsigned long height);
+        void moveWindowBy(in float x, in float y);
+
+        DOMString localizedStringsURL();
+        DOMString hiddenPanels();
+        DOMString platform();
+        DOMString port();
+
+        void addResourceSourceToFrame(in long identifier, in Node frame);
+        boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
+
+        DOMString setting(in DOMString key);
+        void setSetting(in DOMString key, in DOMString value);
+
+        [Custom] void search(in Node node, in DOMString query);
+        [Custom] void showContextMenu(in MouseEvent event, in DOMObject items);
+    };
+}
diff --git a/WebCore/inspector/InspectorResource.cpp b/WebCore/inspector/InspectorResource.cpp
index b8bb22b..0a4cb73 100644
--- a/WebCore/inspector/InspectorResource.cpp
+++ b/WebCore/inspector/InspectorResource.cpp
@@ -46,7 +46,7 @@
 
 namespace WebCore {
 
-InspectorResource::InspectorResource(long long identifier, DocumentLoader* loader)
+InspectorResource::InspectorResource(unsigned long identifier, DocumentLoader* loader)
     : m_identifier(identifier)
     , m_loader(loader)
     , m_frame(loader->frame())
@@ -70,7 +70,7 @@ InspectorResource::~InspectorResource()
 {
 }
 
-PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifier, DocumentLoader* loader, const CachedResource* cachedResource)
+PassRefPtr<InspectorResource> InspectorResource::createCached(unsigned long identifier, DocumentLoader* loader, const CachedResource* cachedResource)
 {
     PassRefPtr<InspectorResource> resource = create(identifier, loader);
 
@@ -105,6 +105,11 @@ void InspectorResource::updateResponse(const ResourceResponse& response)
 {
     m_expectedContentLength = response.expectedContentLength();
     m_mimeType = response.mimeType();
+    if (m_mimeType.isEmpty() && response.httpStatusCode() == 304) {
+        CachedResource* cachedResource = cache()->resourceForURL(response.url().string());
+        if (cachedResource)
+            m_mimeType = cachedResource->response().mimeType();
+    }
     m_responseHeaderFields = response.httpHeaderFields();
     m_responseStatusCode = response.httpStatusCode();
     m_suggestedFilename = response.suggestedFilename();
@@ -128,6 +133,7 @@ void InspectorResource::createScriptObject(InspectorFrontend* frontend)
         ScriptObject requestHeaders = frontend->newScriptObject();
         populateHeadersObject(&requestHeaders, m_requestHeaderFields);
         jsonObject.set("requestHeaders", requestHeaders);
+        jsonObject.set("documentURL", m_frame->document()->url().string());
         jsonObject.set("requestURL", requestURL());
         jsonObject.set("host", m_requestURL.host());
         jsonObject.set("path", m_requestURL.path());
@@ -156,6 +162,7 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
     ScriptObject jsonObject = frontend->newScriptObject();
     if (m_changes.hasChange(RequestChange)) {
         jsonObject.set("url", requestURL());
+        jsonObject.set("documentURL", m_frame->document()->url().string());
         jsonObject.set("domain", m_requestURL.host());
         jsonObject.set("path", m_requestURL.path());
         jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
@@ -184,7 +191,7 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
         jsonObject.set("type", static_cast<int>(type()));
         jsonObject.set("didTypeChange", true);
     }
-    
+
     if (m_changes.hasChange(LengthChange)) {
         jsonObject.set("contentLength", m_length);
         jsonObject.set("didLengthChange", true);
@@ -240,18 +247,10 @@ CachedResource* InspectorResource::cachedResource() const
     return cachedResource;
 }
 
-InspectorResource::Type InspectorResource::type() const
+InspectorResource::Type InspectorResource::cachedResourceType() const
 {
-    if (!m_xmlHttpResponseText.isNull())
-        return XHR;
-
-    if (m_requestURL == m_loader->requestURL())
-        return Doc;
-
-    if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
-        return Image;
-
     CachedResource* cachedResource = this->cachedResource();
+
     if (!cachedResource)
         return Other;
 
@@ -272,6 +271,26 @@ InspectorResource::Type InspectorResource::type() const
     }
 }
 
+InspectorResource::Type InspectorResource::type() const
+{
+    if (!m_xmlHttpResponseText.isNull())
+        return XHR;
+
+    if (m_requestURL == m_loader->requestURL()) {
+        InspectorResource::Type resourceType = cachedResourceType();
+        if (resourceType == Other)
+            return Doc;
+
+        return resourceType;
+    }
+
+    if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
+        return Image;
+
+    return cachedResourceType();
+
+}
+
 void InspectorResource::setXMLHttpResponseText(const ScriptString& data)
 {
     m_xmlHttpResponseText = data;
@@ -362,6 +381,12 @@ void InspectorResource::addLength(int lengthReceived)
 {
     m_length += lengthReceived;
     m_changes.set(LengthChange);
+
+    // Update load time, otherwise the resource will
+    // have start time == end time and  0 load duration
+    // until its loading is completed.
+    m_endTime = currentTime();
+    m_changes.set(TimingChange);
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorResource.h b/WebCore/inspector/InspectorResource.h
index 0335586..7d9b977 100644
--- a/WebCore/inspector/InspectorResource.h
+++ b/WebCore/inspector/InspectorResource.h
@@ -51,7 +51,7 @@ namespace WebCore {
     class Frame;
     class ResourceResponse;
 
-    struct ResourceRequest;
+    class ResourceRequest;
 
     class InspectorResource : public RefCounted<InspectorResource> {
     public:
@@ -68,12 +68,12 @@ namespace WebCore {
             Other
         };
 
-        static PassRefPtr<InspectorResource> create(long long identifier, DocumentLoader* loader)
+        static PassRefPtr<InspectorResource> create(unsigned long identifier, DocumentLoader* loader)
         {
             return adoptRef(new InspectorResource(identifier, loader));
         }
 
-        static PassRefPtr<InspectorResource> createCached(long long identifier, DocumentLoader*, const CachedResource*);
+        static PassRefPtr<InspectorResource> createCached(unsigned long identifier, DocumentLoader*, const CachedResource*);
 
         ~InspectorResource();
 
@@ -91,7 +91,7 @@ namespace WebCore {
 
         bool isSameLoader(DocumentLoader* loader) const { return loader == m_loader; }
         void markMainResource() { m_isMainResource = true; }
-        long long identifier() const { return m_identifier; }
+        unsigned long identifier() const { return m_identifier; }
         String requestURL() const { return m_requestURL.string(); }
         Frame* frame() const { return m_frame.get(); }
         const String& mimeType() const { return m_mimeType; }
@@ -125,10 +125,13 @@ namespace WebCore {
         public:
             Changes() : m_change(NoChange) {}
 
-            inline bool hasChange(ChangeType change) { return (m_change & change) || !(m_change + change); }
+            inline bool hasChange(ChangeType change)
+            {
+                return m_change & change || (m_change == NoChange && change == NoChange);
+            }
             inline void set(ChangeType change)
             {
-                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) | static_cast<unsigned>(change));            
+                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) | static_cast<unsigned>(change));
             }
             inline void clear(ChangeType change)
             {
@@ -142,12 +145,13 @@ namespace WebCore {
             ChangeType m_change;
         };
 
-        InspectorResource(long long identifier, DocumentLoader*);
+        InspectorResource(unsigned long identifier, DocumentLoader*);
         Type type() const;
 
+        Type cachedResourceType() const;
         CachedResource* cachedResource() const;
 
-        long long m_identifier;
+        unsigned long m_identifier;
         RefPtr<DocumentLoader> m_loader;
         RefPtr<Frame> m_frame;
         KURL m_requestURL;
diff --git a/WebCore/inspector/InspectorTimelineAgent.cpp b/WebCore/inspector/InspectorTimelineAgent.cpp
index 4f7b736..b28aa97 100644
--- a/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -35,6 +35,9 @@
 
 #include "Event.h"
 #include "InspectorFrontend.h"
+#include "IntRect.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "TimelineRecordFactory.h"
 
 #include <wtf/CurrentTime.h>
@@ -51,14 +54,15 @@ InspectorTimelineAgent::~InspectorTimelineAgent()
 {
 }
 
-void InspectorTimelineAgent::willDispatchDOMEvent(const Event& event)
+void InspectorTimelineAgent::willDispatchEvent(const Event& event)
 {
-    pushCurrentRecord(TimelineRecordFactory::createDOMDispatchRecord(m_frontend, currentTimeInMilliseconds(), event), DOMDispatchTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createEventDispatchRecord(m_frontend, currentTimeInMilliseconds(), event),
+        EventDispatchTimelineRecordType);
 }
 
-void InspectorTimelineAgent::didDispatchDOMEvent()
+void InspectorTimelineAgent::didDispatchEvent()
 {
-    didCompleteCurrentRecord(DOMDispatchTimelineRecordType);
+    didCompleteCurrentRecord(EventDispatchTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willLayout()
@@ -81,9 +85,10 @@ void InspectorTimelineAgent::didRecalculateStyle()
     didCompleteCurrentRecord(RecalculateStylesTimelineRecordType);
 }
 
-void InspectorTimelineAgent::willPaint()
+void InspectorTimelineAgent::willPaint(const IntRect& rect)
 {
-    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), PaintTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createPaintRecord(m_frontend, currentTimeInMilliseconds(), rect),
+        PaintTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didPaint()
@@ -126,7 +131,7 @@ void InspectorTimelineAgent::didFireTimer()
 
 void InspectorTimelineAgent::willChangeXHRReadyState(const String& url, int readyState)
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, readyState),
+    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeRecord(m_frontend, currentTimeInMilliseconds(), url, readyState),
         XHRReadyStateChangeRecordType);
 }
 
@@ -137,7 +142,7 @@ void InspectorTimelineAgent::didChangeXHRReadyState()
 
 void InspectorTimelineAgent::willLoadXHR(const String& url) 
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRLoadTimelineRecord(m_frontend, currentTimeInMilliseconds(), url), XHRLoadRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createXHRLoadRecord(m_frontend, currentTimeInMilliseconds(), url), XHRLoadRecordType);
 }
 
 void InspectorTimelineAgent::didLoadXHR()
@@ -145,14 +150,44 @@ void InspectorTimelineAgent::didLoadXHR()
     didCompleteCurrentRecord(XHRLoadRecordType);
 }
 
-void InspectorTimelineAgent::willEvaluateScriptTag(const String& url, int lineNumber)
+void InspectorTimelineAgent::willEvaluateScript(const String& url, int lineNumber)
 {
-    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, lineNumber), EvaluateScriptTagTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptRecord(m_frontend, currentTimeInMilliseconds(), url, lineNumber), EvaluateScriptTimelineRecordType);
 }
     
-void InspectorTimelineAgent::didEvaluateScriptTag()
+void InspectorTimelineAgent::didEvaluateScript()
 {
-    didCompleteCurrentRecord(EvaluateScriptTagTimelineRecordType);
+    didCompleteCurrentRecord(EvaluateScriptTimelineRecordType);
+}
+
+void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, bool isMainResource,
+    const ResourceRequest& request)
+{
+    ScriptObject record = TimelineRecordFactory::createResourceSendRequestRecord(m_frontend, currentTimeInMilliseconds(),
+        identifier, isMainResource, request);
+    record.set("type", ResourceSendRequestTimelineRecordType);
+    m_frontend->addRecordToTimeline(record);
+}
+
+void InspectorTimelineAgent::didReceiveResourceResponse(unsigned long identifier, const ResourceResponse& response)
+{
+    ScriptObject record = TimelineRecordFactory::createResourceReceiveResponseRecord(m_frontend, currentTimeInMilliseconds(),
+        identifier, response);
+    record.set("type", ResourceReceiveResponseTimelineRecordType);
+    m_frontend->addRecordToTimeline(record);
+}
+
+void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier, bool didFail)
+{
+    ScriptObject record = TimelineRecordFactory::createResourceFinishRecord(m_frontend, currentTimeInMilliseconds(),
+        identifier, didFail);
+    record.set("type", ResourceFinishTimelineRecordType);
+    m_frontend->addRecordToTimeline(record);
+}
+
+void InspectorTimelineAgent::didMarkTimeline(const String& message)
+{
+    addRecordToTimeline(TimelineRecordFactory::createMarkTimelineRecord(m_frontend, currentTimeInMilliseconds(), message), MarkTimelineRecordType);
 }
 
 void InspectorTimelineAgent::reset()
@@ -180,13 +215,16 @@ void InspectorTimelineAgent::addRecordToTimeline(ScriptObject record, TimelineRe
 
 void InspectorTimelineAgent::didCompleteCurrentRecord(TimelineRecordType type)
 {
-    ASSERT(!m_recordStack.isEmpty());
-    TimelineRecordEntry entry = m_recordStack.last();
-    m_recordStack.removeLast();
-    ASSERT(entry.type == type);
-    entry.record.set("children", entry.children);
-    entry.record.set("endTime", currentTimeInMilliseconds());
-    addRecordToTimeline(entry.record, type);
+    // An empty stack could merely mean that the timeline agent was turned on in the middle of
+    // an event.  Don't treat as an error.
+    if (!m_recordStack.isEmpty()) {
+        TimelineRecordEntry entry = m_recordStack.last();
+        m_recordStack.removeLast();
+        ASSERT(entry.type == type);
+        entry.record.set("children", entry.children);
+        entry.record.set("endTime", currentTimeInMilliseconds());
+        addRecordToTimeline(entry.record, type);
+    }
 }
 
 double InspectorTimelineAgent::currentTimeInMilliseconds()
diff --git a/WebCore/inspector/InspectorTimelineAgent.h b/WebCore/inspector/InspectorTimelineAgent.h
index d1d3675..1929286 100644
--- a/WebCore/inspector/InspectorTimelineAgent.h
+++ b/WebCore/inspector/InspectorTimelineAgent.h
@@ -42,10 +42,13 @@
 namespace WebCore {
     class Event;
     class InspectorFrontend;
+    class IntRect;
+    class ResourceRequest;
+    class ResourceResponse;
 
     // Must be kept in sync with TimelineAgent.js
     enum TimelineRecordType {
-        DOMDispatchTimelineRecordType = 0,
+        EventDispatchTimelineRecordType = 0,
         LayoutTimelineRecordType = 1,
         RecalculateStylesTimelineRecordType = 2,
         PaintTimelineRecordType = 3,
@@ -55,7 +58,11 @@ namespace WebCore {
         TimerFireTimelineRecordType = 7,
         XHRReadyStateChangeRecordType = 8,
         XHRLoadRecordType = 9,
-        EvaluateScriptTagTimelineRecordType = 10,
+        EvaluateScriptTimelineRecordType = 10,
+        MarkTimelineRecordType = 11,
+        ResourceSendRequestTimelineRecordType = 12,
+        ResourceReceiveResponseTimelineRecordType = 13,
+        ResourceFinishTimelineRecordType = 14,
     };
 
     class InspectorTimelineAgent {
@@ -67,8 +74,8 @@ namespace WebCore {
         void resetFrontendProxyObject(InspectorFrontend*);
 
         // Methods called from WebCore.
-        void willDispatchDOMEvent(const Event&);
-        void didDispatchDOMEvent();
+        void willDispatchEvent(const Event&);
+        void didDispatchEvent();
 
         void willLayout();
         void didLayout();
@@ -76,7 +83,7 @@ namespace WebCore {
         void willRecalculateStyle();
         void didRecalculateStyle();
 
-        void willPaint();
+        void willPaint(const IntRect&);
         void didPaint();
 
         void willWriteHTML();
@@ -92,8 +99,14 @@ namespace WebCore {
         void willLoadXHR(const String&);
         void didLoadXHR();
 
-        void willEvaluateScriptTag(const String&, int);
-        void didEvaluateScriptTag();
+        void willEvaluateScript(const String&, int);
+        void didEvaluateScript();
+
+        void didMarkTimeline(const String&);
+
+        void willSendResourceRequest(unsigned long, bool isMainResource, const ResourceRequest&);
+        void didReceiveResourceResponse(unsigned long, const ResourceResponse&);
+        void didFinishLoadingResource(unsigned long, bool didFail);
 
         static InspectorTimelineAgent* retrieve(ScriptExecutionContext*);
     private:
diff --git a/WebCore/inspector/JavaScriptCallFrame.cpp b/WebCore/inspector/JavaScriptCallFrame.cpp
index 1559d82..cbc5314 100644
--- a/WebCore/inspector/JavaScriptCallFrame.cpp
+++ b/WebCore/inspector/JavaScriptCallFrame.cpp
@@ -106,7 +106,7 @@ JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception)
         return jsNull();
 
     JSLock lock(SilenceAssertionsOnly);
-    return DebuggerCallFrame_evaluateInWorld(m_debuggerCallFrame, script, exception);
+    return m_debuggerCallFrame.evaluate(script, exception);
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/TimelineRecordFactory.cpp b/WebCore/inspector/TimelineRecordFactory.cpp
index 085bcd9..4fdd502 100644
--- a/WebCore/inspector/TimelineRecordFactory.cpp
+++ b/WebCore/inspector/TimelineRecordFactory.cpp
@@ -35,11 +35,14 @@
 
 #include "Event.h"
 #include "InspectorFrontend.h"
+#include "IntRect.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "ScriptArray.h"
 #include "ScriptObject.h"
+
 namespace WebCore {
 
-// static
 ScriptObject TimelineRecordFactory::createGenericRecord(InspectorFrontend* frontend, double startTime)
 {
     ScriptObject record = frontend->newScriptObject();
@@ -47,8 +50,7 @@ ScriptObject TimelineRecordFactory::createGenericRecord(InspectorFrontend* front
     return record;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createDOMDispatchRecord(InspectorFrontend* frontend, double startTime, const Event& event)
+ScriptObject TimelineRecordFactory::createEventDispatchRecord(InspectorFrontend* frontend, double startTime, const Event& event)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
@@ -57,7 +59,6 @@ ScriptObject TimelineRecordFactory::createDOMDispatchRecord(InspectorFrontend* f
     return record;
 }
 
-// static
 ScriptObject TimelineRecordFactory::createGenericTimerRecord(InspectorFrontend* frontend, double startTime, int timerId)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
@@ -67,7 +68,6 @@ ScriptObject TimelineRecordFactory::createGenericTimerRecord(InspectorFrontend*
     return record;
 }
 
-// static
 ScriptObject TimelineRecordFactory::createTimerInstallRecord(InspectorFrontend* frontend, double startTime, int timerId, int timeout, bool singleShot)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
@@ -79,8 +79,7 @@ ScriptObject TimelineRecordFactory::createTimerInstallRecord(InspectorFrontend*
     return record;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, int readyState)
+ScriptObject TimelineRecordFactory::createXHRReadyStateChangeRecord(InspectorFrontend* frontend, double startTime, const String& url, int readyState)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
@@ -90,8 +89,7 @@ ScriptObject TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(Insp
     return record;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createXHRLoadTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url)
+ScriptObject TimelineRecordFactory::createXHRLoadRecord(InspectorFrontend* frontend, double startTime, const String& url)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
@@ -100,15 +98,73 @@ ScriptObject TimelineRecordFactory::createXHRLoadTimelineRecord(InspectorFronten
     return record;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, double lineNumber) 
+ScriptObject TimelineRecordFactory::createEvaluateScriptRecord(InspectorFrontend* frontend, double startTime, const String& url, double lineNumber) 
 {
-    ScriptObject item = createGenericRecord(frontend, startTime);
+    ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
     data.set("url", url);
     data.set("lineNumber", lineNumber);
-    item.set("data", data);
-    return item;
+    record.set("data", data);
+    return record;
+}
+
+ScriptObject TimelineRecordFactory::createMarkTimelineRecord(InspectorFrontend* frontend, double startTime, const String& message) 
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("message", message);
+    record.set("data", data);
+    return record;
+}
+
+
+ScriptObject TimelineRecordFactory::createResourceSendRequestRecord(InspectorFrontend* frontend, double startTime,
+    unsigned long identifier, bool isMainResource, const ResourceRequest& request)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    data.set("url", request.url().string());
+    data.set("requestMethod", request.httpMethod());
+    data.set("isMainResource", isMainResource);
+    record.set("data", data);
+    return record;
+}
+
+ScriptObject TimelineRecordFactory::createResourceReceiveResponseRecord(InspectorFrontend* frontend, double startTime,
+    unsigned long identifier, const ResourceResponse& response)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    data.set("statusCode", response.httpStatusCode());
+    data.set("mimeType", response.mimeType());
+    data.set("expectedContentLength", response.expectedContentLength());
+    record.set("data", data);
+    return record;
+}
+
+ScriptObject TimelineRecordFactory::createResourceFinishRecord(InspectorFrontend* frontend, double startTime,
+    unsigned long identifier, bool didFail)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    data.set("didFail", didFail);
+    record.set("data", data);
+    return record;
+}
+
+ScriptObject TimelineRecordFactory::createPaintRecord(InspectorFrontend* frontend, double startTime, const IntRect& rect)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("x", rect.x());
+    data.set("y", rect.y());
+    data.set("width", rect.width());
+    data.set("height", rect.height());
+    record.set("data", data);
+    return record;
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/TimelineRecordFactory.h b/WebCore/inspector/TimelineRecordFactory.h
index 3d36649..e0ccc95 100644
--- a/WebCore/inspector/TimelineRecordFactory.h
+++ b/WebCore/inspector/TimelineRecordFactory.h
@@ -37,22 +37,36 @@ namespace WebCore {
 
     class Event;
     class InspectorFrontend;
+    class IntRect;
+    class ResourceRequest;
+    class ResourceResponse;
     class ScriptObject;
 
     class TimelineRecordFactory {
     public:
         static ScriptObject createGenericRecord(InspectorFrontend*, double startTime);
 
-        static ScriptObject createDOMDispatchRecord(InspectorFrontend*, double startTime, const Event&);
+        static ScriptObject createEventDispatchRecord(InspectorFrontend*, double startTime, const Event&);
 
         static ScriptObject createGenericTimerRecord(InspectorFrontend*, double startTime, int timerId);
 
         static ScriptObject createTimerInstallRecord(InspectorFrontend*, double startTime, int timerId, int timeout, bool singleShot);
 
-        static ScriptObject createXHRReadyStateChangeTimelineRecord(InspectorFrontend*, double startTime, const String& url, int readyState);
-        static ScriptObject createXHRLoadTimelineRecord(InspectorFrontend*, double startTime, const String& url);
+        static ScriptObject createXHRReadyStateChangeRecord(InspectorFrontend*, double startTime, const String& url, int readyState);
+        static ScriptObject createXHRLoadRecord(InspectorFrontend*, double startTime, const String& url);
         
-        static ScriptObject createEvaluateScriptTagTimelineRecord(InspectorFrontend*, double startTime, const String&, double lineNumber);
+        static ScriptObject createEvaluateScriptRecord(InspectorFrontend*, double startTime, const String&, double lineNumber);
+        
+        static ScriptObject createMarkTimelineRecord(InspectorFrontend*, double startTime, const String&);
+
+        static ScriptObject createResourceSendRequestRecord(InspectorFrontend*, double startTime,
+            unsigned long identifier, bool isMainResource, const ResourceRequest&);
+        static ScriptObject createResourceReceiveResponseRecord(InspectorFrontend*, double startTime,
+            unsigned long identifier, const ResourceResponse&);
+        static ScriptObject createResourceFinishRecord(InspectorFrontend*, double startTime,
+            unsigned long identifier, bool didFail);
+
+        static ScriptObject createPaintRecord(InspectorFrontend*, double startTime, const IntRect&);
 
     private:
         TimelineRecordFactory() { }
diff --git a/WebCore/inspector/front-end/AbstractTimelinePanel.js b/WebCore/inspector/front-end/AbstractTimelinePanel.js
index 75e4062..c5180f6 100644
--- a/WebCore/inspector/front-end/AbstractTimelinePanel.js
+++ b/WebCore/inspector/front-end/AbstractTimelinePanel.js
@@ -57,10 +57,13 @@ WebInspector.AbstractTimelinePanel.prototype = {
         // Should be implemented by the concrete subclasses.
     },
 
-    createInterface: function()
+    get items()
     {
-        this._createFilterPanel();
+        return this._items;
+    },
 
+    createInterface: function()
+    {
         this.containerElement = document.createElement("div");
         this.containerElement.id = "resources-container";
         this.containerElement.addEventListener("scroll", this._updateDividersLabelBarPosition.bind(this), false);
@@ -70,10 +73,20 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this.sidebarElement.id = "resources-sidebar";
         this.populateSidebar();
 
-        this._createGraph();
+        this._containerContentElement = document.createElement("div");
+        this._containerContentElement.id = "resources-container-content";
+        this.containerElement.appendChild(this._containerContentElement);
+
+        this.summaryBar = new WebInspector.SummaryBar(this.categories);
+        this.summaryBar.element.id = "resources-summary";
+        this._containerContentElement.appendChild(this.summaryBar.element);
+
+        this._timelineGrid = new WebInspector.TimelineGrid();
+        this._containerContentElement.appendChild(this._timelineGrid.element);
+        this.itemsGraphsElement = this._timelineGrid.itemsGraphsElement;
     },
 
-    _createFilterPanel: function()
+    createFilterPanel: function()
     {
         this.filterBarElement = document.createElement("div");
         this.filterBarElement.id = "resources-filter";
@@ -108,14 +121,14 @@ WebInspector.AbstractTimelinePanel.prototype = {
             createFilterElement.call(this, category);
     },
 
-    _showCategory: function(category)
+    showCategory: function(category)
     {
         var filterClass = "filter-" + category.toLowerCase();
         this.itemsGraphsElement.addStyleClass(filterClass);
         this.itemsTreeElement.childrenListElement.addStyleClass(filterClass);
     },
 
-    _hideCategory: function(category)
+    hideCategory: function(category)
     {
         var filterClass = "filter-" + category.toLowerCase();
         this.itemsGraphsElement.removeStyleClass(filterClass);
@@ -132,7 +145,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
                     continue;
 
                 child.removeStyleClass("selected");
-                this._hideCategory(child.category);
+                this.hideCategory(child.category);
             }
         }
 
@@ -148,7 +161,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
             // Something other than All is being selected, so we want to unselect All.
             if (this.filterAllElement.hasStyleClass("selected")) {
                 this.filterAllElement.removeStyleClass("selected");
-                this._hideCategory("all");
+                this.hideCategory("all");
             }
         }
 
@@ -158,7 +171,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
             unselectAll.call(this);
 
             target.addStyleClass("selected");
-            this._showCategory(target.category);
+            this.showCategory(target.category);
             return;
         }
 
@@ -166,18 +179,18 @@ WebInspector.AbstractTimelinePanel.prototype = {
             // If selectMultiple is turned on, and we were selected, we just
             // want to unselect ourselves.
             target.removeStyleClass("selected");
-            this._hideCategory(target.category);
+            this.hideCategory(target.category);
         } else {
             // If selectMultiple is turned on, and we weren't selected, we just
             // want to select ourselves.
             target.addStyleClass("selected");
-            this._showCategory(target.category);
+            this.showCategory(target.category);
         }
     },
 
     _updateFilter: function(e)
     {
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var isMac = WebInspector.isMac();
         var selectMultiple = false;
         if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
             selectMultiple = true;
@@ -191,83 +204,20 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this.containerElement.scrollTop = 0;
     },
 
-    _createGraph: function()
-    {
-        this._containerContentElement = document.createElement("div");
-        this._containerContentElement.id = "resources-container-content";
-        this.containerElement.appendChild(this._containerContentElement);
-
-        this.summaryBar = new WebInspector.SummaryBar(this.categories);
-        this.summaryBar.element.id = "resources-summary";
-        this._containerContentElement.appendChild(this.summaryBar.element);
-
-        this.itemsGraphsElement = document.createElement("div");
-        this.itemsGraphsElement.id = "resources-graphs";
-        this._containerContentElement.appendChild(this.itemsGraphsElement);
-
-        this.dividersElement = document.createElement("div");
-        this.dividersElement.id = "resources-dividers";
-        this._containerContentElement.appendChild(this.dividersElement);
-
-        this.eventDividersElement = document.createElement("div");
-        this.eventDividersElement.id = "resources-event-dividers";
-        this._containerContentElement.appendChild(this.eventDividersElement);
-
-        this.dividersLabelBarElement = document.createElement("div");
-        this.dividersLabelBarElement.id = "resources-dividers-label-bar";
-        this._containerContentElement.appendChild(this.dividersLabelBarElement);
-    },
-
     updateGraphDividersIfNeeded: function(force)
     {
         if (!this.visible) {
             this.needsRefresh = true;
             return false;
         }
-
-        if (document.body.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return false;
-        }
-
-        var dividerCount = Math.round(this.dividersElement.offsetWidth / 64);
-        var slice = this.calculator.boundarySpan / dividerCount;
-        if (!force && this._currentDividerSlice === slice)
-            return false;
-
-        this._currentDividerSlice = slice;
-
-        this.dividersElement.removeChildren();
-        this.eventDividersElement.removeChildren();
-        this.dividersLabelBarElement.removeChildren();
-
-        for (var i = 1; i <= dividerCount; ++i) {
-            var divider = document.createElement("div");
-            divider.className = "resources-divider";
-            if (i === dividerCount)
-                divider.addStyleClass("last");
-            divider.style.left = ((i / dividerCount) * 100) + "%";
-
-            this.dividersElement.appendChild(divider.cloneNode());
-
-            var label = document.createElement("div");
-            label.className = "resources-divider-label";
-            if (!isNaN(slice))
-                label.textContent = this.calculator.formatValue(slice * i);
-            divider.appendChild(label);
-
-            this.dividersLabelBarElement.appendChild(divider);
-        }
+        return this._timelineGrid.updateDividers(force, this.calculator);
     },
 
     _updateDividersLabelBarPosition: function()
     {
         var scrollTop = this.containerElement.scrollTop;
         var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
-        this.dividersElement.style.top = scrollTop + "px";
-        this.eventDividersElement.style.top = scrollTop + "px";
-        this.dividersLabelBarElement.style.top = dividersTop + "px";
+        this._timelineGrid.setScrollAndDividerTop(scrollTop, dividersTop);
     },
 
     get needsRefresh()
@@ -318,26 +268,32 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this.updateGraphDividersIfNeeded();
     },
 
+    invalidateAllItems: function()
+    {
+        this._staleItems = this._items.slice();
+    },
+
     refresh: function()
     {
         this.needsRefresh = false;
 
         var staleItemsLength = this._staleItems.length;
+
         var boundariesChanged = false;
 
         for (var i = 0; i < staleItemsLength; ++i) {
             var item = this._staleItems[i];
-            if (!item._itemTreeElement) {
+            if (!item._itemsTreeElement) {
                 // Create the timeline tree element and graph.
-                item._itemTreeElement = this.createItemTreeElement(item);
-                item._itemTreeElement._itemGraph = this.createItemGraph(item);
+                item._itemsTreeElement = this.createItemTreeElement(item);
+                item._itemsTreeElement._itemGraph = this.createItemGraph(item);
 
-                this.itemsTreeElement.appendChild(item._itemTreeElement);
-                this.itemsGraphsElement.appendChild(item._itemTreeElement._itemGraph.graphElement);
+                this.itemsTreeElement.appendChild(item._itemsTreeElement);
+                this.itemsGraphsElement.appendChild(item._itemsTreeElement._itemGraph.graphElement);
             }
 
-            if (item._itemTreeElement.refresh)
-                item._itemTreeElement.refresh();
+            if (item._itemsTreeElement.refresh)
+                item._itemsTreeElement.refresh();
 
             if (this.calculator.updateBoundaries(item))
                 boundariesChanged = true;
@@ -345,12 +301,12 @@ WebInspector.AbstractTimelinePanel.prototype = {
 
         if (boundariesChanged) {
             // The boundaries changed, so all item graphs are stale.
-            this._staleItems = this._items;
+            this._staleItems = this._items.slice();
             staleItemsLength = this._staleItems.length;
         }
 
         for (var i = 0; i < staleItemsLength; ++i)
-            this._staleItems[i]._itemTreeElement._itemGraph.refresh(this.calculator);
+            this._staleItems[i]._itemsTreeElement._itemGraph.refresh(this.calculator);
 
         this._staleItems = [];
 
@@ -394,7 +350,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this._calculator = x;
         this._calculator.reset();
 
-        this._staleItems = this._items;
+        this._staleItems = this._items.slice();
         this.refresh();
     },
 
@@ -408,12 +364,12 @@ WebInspector.AbstractTimelinePanel.prototype = {
     {
         this._items.remove(item, true);
 
-        if (item._itemTreeElement) {
-            this.itemsTreeElement.removeChild(resource._itemTreeElement);
-            this.itemsGraphsElement.removeChild(resource._itemTreeElement._itemGraph.graphElement);
+        if (item._itemsTreeElement) {
+            this.itemsTreeElement.removeChild(item._itemsTreeElement);
+            this.itemsGraphsElement.removeChild(item._itemsTreeElement._itemGraph.graphElement);
         }
 
-        delete item._itemTreeElement;
+        delete item._itemsTreeElement;
         this.adjustScrollPosition();
     },
 
@@ -458,6 +414,11 @@ WebInspector.AbstractTimelinePanel.prototype = {
         // Prevent the container from being scrolled off the end.
         if ((this.containerElement.scrollTop + this.containerElement.offsetHeight) > this.sidebarElement.offsetHeight)
             this.containerElement.scrollTop = (this.sidebarElement.offsetHeight - this.containerElement.offsetHeight);
+    },
+
+    addEventDivider: function(divider)
+    {
+        this._timelineGrid.addEventDivider(divider);
     }
 }
 
diff --git a/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js b/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
index 41a8a3a..5aaae0c 100644
--- a/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
+++ b/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
@@ -31,11 +31,7 @@
 
 WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
 {
-    // In bottom up mode, our parents are our children since we display an inverted tree.
-    // However, we don't want to show the very top parent since it is redundant.
-    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
-
-    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, this._willHaveChildren(profileNode));
 
     this._remainingNodeInfos = [];
 }
@@ -78,6 +74,14 @@ WebInspector.BottomUpProfileDataGridNode.prototype = {
             this._merge(child, true);
     },
 
+    _restore: function()
+    {
+        WebInspector.ProfileDataGridNode.prototype._restore();
+
+        if (!this.children.length)
+            this.hasChildren = this._willHaveChildren();
+    },
+
     _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
     {
         this.selfTime -= child.selfTime;
@@ -128,6 +132,14 @@ WebInspector.BottomUpProfileDataGridNode.prototype = {
         }
 
         delete this._remainingNodeInfos;
+    },
+
+    _willHaveChildren: function(profileNode)
+    {
+        profileNode = profileNode || this.profileNode;
+        // In bottom up mode, our parents are our children since we display an inverted tree.
+        // However, we don't want to show the very top parent since it is redundant.
+        return !!(profileNode.parent && profileNode.parent.parent);
     }
 }
 
diff --git a/WebCore/inspector/front-end/Breakpoint.js b/WebCore/inspector/front-end/Breakpoint.js
index 292975a..5d46cc9 100644
--- a/WebCore/inspector/front-end/Breakpoint.js
+++ b/WebCore/inspector/front-end/Breakpoint.js
@@ -89,7 +89,7 @@ WebInspector.Breakpoint.prototype = {
         this.dispatchEventToListeners("condition-changed");
 
         if (this.enabled)
-            InspectorController.updateBreakpoint(this.sourceID, this.line, c);
+            InspectorBackend.updateBreakpoint(this.sourceID, this.line, c);
     }
 }
 
diff --git a/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index e6edece..9d4fe55 100644
--- a/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -58,21 +58,24 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             this.bodyElement.appendChild(this.listElement);
         }
 
-        if (!InspectorController.debuggerEnabled() || !breakpoint.sourceID)
+        if (!InspectorBackend.debuggerEnabled() || !breakpoint.sourceID)
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
+            InspectorBackend.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
     },
 
     _appendBreakpointElement: function(breakpoint)
     {
-        function checkboxClicked()
+        function checkboxClicked(event)
         {
             breakpoint.enabled = !breakpoint.enabled;
+
+            // without this, we'd switch to the source of the clicked breakpoint
+            event.stopPropagation();
         }
 
-        function labelClicked()
+        function breakpointClicked()
         {
             var script = WebInspector.panels.scripts.scriptOrResourceForID(breakpoint.sourceID);
             if (script)
@@ -82,6 +85,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
         var breakpointElement = document.createElement("li");
         breakpoint._breakpointListElement = breakpointElement;
         breakpointElement._breakpointObject = breakpoint;
+        breakpointElement.addEventListener("click", breakpointClicked, false);
 
         var checkboxElement = document.createElement("input");
         checkboxElement.className = "checkbox-elem";
@@ -90,9 +94,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
         checkboxElement.addEventListener("click", checkboxClicked, false);
         breakpointElement.appendChild(checkboxElement);
 
-        var labelElement = document.createElement("a");
-        labelElement.textContent = breakpoint.label;
-        labelElement.addEventListener("click", labelClicked, false);
+        var labelElement = document.createTextNode(breakpoint.label);
         breakpointElement.appendChild(labelElement);
 
         var sourceTextElement = document.createElement("div");
@@ -133,10 +135,10 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             this.bodyElement.appendChild(this.emptyElement);
         }
 
-        if (!InspectorController.debuggerEnabled() || !breakpoint.sourceID)
+        if (!InspectorBackend.debuggerEnabled() || !breakpoint.sourceID)
             return;
 
-        InspectorController.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
+        InspectorBackend.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
     },
 
     _breakpointEnableChanged: function(event)
@@ -146,13 +148,13 @@ WebInspector.BreakpointsSidebarPane.prototype = {
         var checkbox = breakpoint._breakpointListElement.firstChild;
         checkbox.checked = breakpoint.enabled;
 
-        if (!InspectorController.debuggerEnabled() || !breakpoint.sourceID)
+        if (!InspectorBackend.debuggerEnabled() || !breakpoint.sourceID)
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
+            InspectorBackend.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
         else
-            InspectorController.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
+            InspectorBackend.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
     },
 
     _breakpointTextChanged: function(event)
diff --git a/WebCore/inspector/front-end/Color.js b/WebCore/inspector/front-end/Color.js
index 9d9cd76..11d6bad 100644
--- a/WebCore/inspector/front-end/Color.js
+++ b/WebCore/inspector/front-end/Color.js
@@ -437,7 +437,7 @@ WebInspector.Color.HexTable = {
     "B0C4DE": [[176, 196, 222], [214, 41, 78], "lightSteelBlue"],
     "B0E0E6": [[176, 224, 230], [187, 52, 80], "powderBlue"],
     "B22222": [[178, 34, 34], [0, 68, 42], "fireBrick"],
-    "B8860B": [[184, 134, 11], [43, 89, 38], "darkGoldenRod"],
+    "B8860B": [[184, 134, 11], [43, 89, 38], "darkGoldenrod"],
     "BA55D3": [[186, 85, 211], [288, 59, 58], "mediumOrchid"],
     "BC8F8F": [[188, 143, 143], [0, 25, 65], "rosyBrown"],
     "BDB76B": [[189, 183, 107], [56, 38, 58], "darkKhaki"],
@@ -451,7 +451,7 @@ WebInspector.Color.HexTable = {
     "D87093": [[219, 112, 147], [340, 60, 65], "paleVioletRed"],
     "D8BFD8": [[216, 191, 216], [300, 24, 80], "thistle"],
     "DA70D6": [[218, 112, 214], [302, 59, 65], "orchid"],
-    "DAA520": [[218, 165, 32], [43, 74, 49], "goldenRod"],
+    "DAA520": [[218, 165, 32], [43, 74, 49], "goldenrod"],
     "DC143C": [[237, 164, 61], [35, 83, 58], "crimson"],
     "DCDCDC": [[220, 220, 220], [0, 0, 86], "gainsboro"],
     "DDA0DD": [[221, 160, 221], [300, 47, 75], "plum"],
@@ -460,7 +460,7 @@ WebInspector.Color.HexTable = {
     "E6E6FA": [[230, 230, 250], [240, 67, 94], "lavender"],
     "E9967A": [[233, 150, 122], [15, 72, 70], "darkSalmon"],
     "EE82EE": [[238, 130, 238], [300, 76, 72], "violet"],
-    "EEE8AA": [[238, 232, 170], [55, 67, 80], "paleGoldenRod"],
+    "EEE8AA": [[238, 232, 170], [55, 67, 80], "paleGoldenrod"],
     "F08080": [[240, 128, 128], [0, 79, 72], "lightCoral"],
     "F0E68C": [[240, 230, 140], [54, 77, 75], "khaki"],
     "F0F8FF": [[240, 248, 255], [208, 100, 97], "aliceBlue"],
@@ -475,7 +475,7 @@ WebInspector.Color.HexTable = {
     "FA8072": [[250, 128, 114], [6, 93, 71], "salmon"],
     "FAEBD7": [[250, 235, 215], [34, 78, 91], "antiqueWhite"],
     "FAF0E6": [[250, 240, 230], [30, 67, 94], "linen"],
-    "FAFAD2": [[250, 250, 210], [60, 80, 90], "lightGoldenRodYellow"],
+    "FAFAD2": [[250, 250, 210], [60, 80, 90], "lightGoldenrodYellow"],
     "FDF5E6": [[253, 245, 230], [39, 85, 95], "oldLace"],
     "FF0000": [[255, 0, 0], [0, 100, 50], "red"],
     "FF00FF": [[255, 0, 255], [300, 100, 50], "magenta"],
diff --git a/WebCore/inspector/front-end/ConsolePanel.js b/WebCore/inspector/front-end/ConsolePanel.js
new file mode 100644
index 0000000..6dbc558
--- /dev/null
+++ b/WebCore/inspector/front-end/ConsolePanel.js
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ConsolePanel = function()
+{
+    WebInspector.Panel.call(this);
+}
+
+WebInspector.ConsolePanel.prototype = {
+    toolbarItemClass: "console",
+
+    get toolbarItemLabel()
+    {
+        return WebInspector.UIString("Console");
+    },
+
+    show: function()
+    {
+        WebInspector.Panel.prototype.show.call(this);
+
+        this._previousConsoleState = WebInspector.drawer.state;
+        WebInspector.drawer.enterPanelMode();
+        WebInspector.showConsole();
+        
+        // Move the scope bar to the top of the messages, like the resources filter.
+        var scopeBar = document.getElementById("console-filter");
+        var consoleMessages = document.getElementById("console-messages");
+
+        scopeBar.parentNode.removeChild(scopeBar);
+        document.getElementById("console-view").insertBefore(scopeBar, consoleMessages);
+        
+        // Update styles, and give console-messages a top margin so it doesn't overwrite the scope bar.
+        scopeBar.addStyleClass("console-filter-top");
+        scopeBar.removeStyleClass("status-bar-item");
+
+        consoleMessages.addStyleClass("console-filter-top");
+    },
+
+    hide: function()
+    {
+        WebInspector.Panel.prototype.hide.call(this);
+
+        if (this._previousConsoleState === WebInspector.Drawer.State.Hidden)
+            WebInspector.drawer.immediatelyExitPanelMode();
+        else
+            WebInspector.drawer.exitPanelMode();
+        delete this._previousConsoleState;
+        
+        // Move the scope bar back to the bottom bar, next to Clear Console.
+        var scopeBar = document.getElementById("console-filter");
+
+        scopeBar.parentNode.removeChild(scopeBar);
+        document.getElementById("other-drawer-status-bar-items").appendChild(scopeBar);
+        
+        // Update styles, and remove the top margin on console-messages.
+        scopeBar.removeStyleClass("console-filter-top");
+        scopeBar.addStyleClass("status-bar-item");
+
+        document.getElementById("console-messages").removeStyleClass("console-filter-top");
+    }
+}
+
+WebInspector.ConsolePanel.prototype.__proto__ = WebInspector.Panel.prototype;
diff --git a/WebCore/inspector/front-end/ConsoleView.js b/WebCore/inspector/front-end/ConsoleView.js
index 9317824..9815f4a 100644
--- a/WebCore/inspector/front-end/ConsoleView.js
+++ b/WebCore/inspector/front-end/ConsoleView.js
@@ -57,51 +57,60 @@ WebInspector.ConsoleView = function(drawer)
     this.toggleConsoleButton.title = WebInspector.UIString("Show console.");
     this.toggleConsoleButton.addEventListener("click", this._toggleConsoleButtonClicked.bind(this), false);
 
-    var anchoredStatusBar = document.getElementById("anchored-status-bar-items");
-    anchoredStatusBar.appendChild(this.toggleConsoleButton);
-    
     // Will hold the list of filter elements
     this.filterBarElement = document.getElementById("console-filter");
-    
+
     function createDividerElement() {
         var dividerElement = document.createElement("div");
-        
         dividerElement.addStyleClass("divider");
-        
         this.filterBarElement.appendChild(dividerElement);
     }
-    
+
+    var updateFilterHandler = this._updateFilter.bind(this);
     function createFilterElement(category) {
         var categoryElement = document.createElement("li");
         categoryElement.category = category;
-     
-        categoryElement.addStyleClass(categoryElement.category);
-            
+        categoryElement.addStyleClass(categoryElement.category);            
+        categoryElement.addEventListener("click", updateFilterHandler, false);
+
         var label = category.toString();
         categoryElement.appendChild(document.createTextNode(label));
-     
-        categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
-     
+
         this.filterBarElement.appendChild(categoryElement);
         return categoryElement;
     }
     
     this.allElement = createFilterElement.call(this, "All");
-    
     createDividerElement.call(this);
-    
     this.errorElement = createFilterElement.call(this, "Errors");
     this.warningElement = createFilterElement.call(this, "Warnings");
     this.logElement = createFilterElement.call(this, "Logs");
 
     this.filter(this.allElement, false);
+
+    this._shortcuts = {};
+
+    var shortcut;
+    var handler = this.clearMessages.bind(this, true);
+
+    shortcut = WebInspector.KeyboardShortcut.makeKey("k", WebInspector.KeyboardShortcut.Modifiers.Meta);
+    this._shortcuts[shortcut] = handler;
+    this._shortcuts[shortcut].isMacOnly = true;
+    shortcut = WebInspector.KeyboardShortcut.makeKey("l", WebInspector.KeyboardShortcut.Modifiers.Ctrl);
+    this._shortcuts[shortcut] = handler;
+
+    this._customFormatters = {
+        "object": this._formatobject,
+        "array":  this._formatarray,
+        "node":   this._formatnode
+    };
 }
 
 WebInspector.ConsoleView.prototype = {
     
     _updateFilter: function(e)
     {
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var isMac = WebInspector.isMac();
         var selectMultiple = false;
         if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
             selectMultiple = true;
@@ -242,7 +251,8 @@ WebInspector.ConsoleView.prototype = {
         this.promptElement.scrollIntoView(false);
     },
 
-    updateMessageRepeatCount: function(count) {
+    updateMessageRepeatCount: function(count)
+    {
         var msg = this.previousMessage;
         var prevRepeatCount = msg.totalRepeatCount;
         
@@ -260,7 +270,8 @@ WebInspector.ConsoleView.prototype = {
         }
     },
 
-    _incrementErrorWarningCount: function(msg) {
+    _incrementErrorWarningCount: function(msg)
+    {
         switch (msg.level) {
             case WebInspector.ConsoleMessage.MessageLevel.Warning:
                 WebInspector.warnings += msg.repeatDelta;
@@ -274,7 +285,7 @@ WebInspector.ConsoleView.prototype = {
     clearMessages: function(clearInspectorController)
     {
         if (clearInspectorController)
-            InspectorController.clearMessages(false);
+            InspectorBackend.clearMessages(false);
         if (WebInspector.panels.resources)
             WebInspector.panels.resources.clearMessages();
 
@@ -396,6 +407,23 @@ WebInspector.ConsoleView.prototype = {
             return;
         }
 
+        if (isFnKey(event)) {
+            if (WebInspector.currentPanel && WebInspector.currentPanel.handleKeyEvent) {
+                WebInspector.currentPanel.handleKeyEvent(event);
+                return;
+            }
+        }
+
+        var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
+        var handler = this._shortcuts[shortcut];
+        if (handler) {
+            if (!this._shortcuts[shortcut].isMacOnly || WebInspector.isMac()) {
+                handler();
+                event.preventDefault();
+                return;
+            }
+        }
+
         this.prompt.handleKeyEvent(event);
     },
 
@@ -453,44 +481,18 @@ WebInspector.ConsoleView.prototype = {
     _format: function(output, forceObjectFormat)
     {
         var isProxy = (output != null && typeof output === "object");
+        var type = (forceObjectFormat ? "object" : Object.proxyType(output));
 
-        if (forceObjectFormat)
-            var type = "object";
-        else
-            var type = Object.proxyType(output);
-
-        if (isProxy && type !== "object" && type !== "function" && type !== "array" && type !== "node") {
-            // Unwrap primitive value, skip decoration.
-            output = output.description;
-            type = "undecorated"
-        }
-
-        // We don't perform any special formatting on these types, so we just
-        // pass them through the simple _formatvalue function.
-        var undecoratedTypes = {
-            "undefined": 1,
-            "null": 1,
-            "boolean": 1,
-            "number": 1,
-            "undecorated": 1
-        };
-
-        var formatter;
-        if (forceObjectFormat)
-            formatter = "_formatobject";
-        else if (type in undecoratedTypes)
-            formatter = "_formatvalue";
-        else {
-            formatter = "_format" + type;
-            if (!(formatter in this)) {
-                formatter = "_formatobject";
-                type = "object";
-            }
+        var formatter = this._customFormatters[type];
+        if (!formatter || !isProxy) {
+            formatter = this._formatvalue;
+            output = output.description || output;
+            type = "undecorated";
         }
 
         var span = document.createElement("span");
         span.addStyleClass("console-formatted-" + type);
-        this[formatter](output, span);
+        formatter.call(this, output, span);
         return span;
     },
 
@@ -499,25 +501,27 @@ WebInspector.ConsoleView.prototype = {
         elem.appendChild(document.createTextNode(val));
     },
 
-    _formatfunction: function(func, elem)
-    {
-        elem.appendChild(document.createTextNode(func.description));
-    },
-
-    _formatdate: function(date, elem)
+    _formatobject: function(obj, elem)
     {
-        elem.appendChild(document.createTextNode(date));
+        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
     },
 
-    _formatstring: function(str, elem)
+    _formatnode: function(object, elem)
     {
-        elem.appendChild(document.createTextNode("\"" + str + "\""));
-    },
+        function printNode(nodeId)
+        {
+            if (!nodeId)
+                return;
+            var treeOutline = new WebInspector.ElementsTreeOutline();
+            treeOutline.showInElementsPanelEnabled = true;
+            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
+            treeOutline.element.addStyleClass("outline-disclosure");
+            if (!treeOutline.children[0].hasChildren)
+                treeOutline.element.addStyleClass("single-node");
+            elem.appendChild(treeOutline.element);
+        }
 
-    _formatregexp: function(re, elem)
-    {
-        var formatted = String(re.description).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
-        elem.appendChild(document.createTextNode(formatted));
+        InjectedScriptAccess.pushNodeToFrontend(object, printNode);
     },
 
     _formatarray: function(arr, elem)
@@ -529,6 +533,7 @@ WebInspector.ConsoleView.prototype = {
     {
         if (!properties)
             return;
+
         var elements = [];
         for (var i = 0; i < properties.length; ++i) {
             var name = properties[i].name;
@@ -547,53 +552,6 @@ WebInspector.ConsoleView.prototype = {
                 elem.appendChild(document.createTextNode(", "));
         }
         elem.appendChild(document.createTextNode("]"));
-    },
-
-    _formatnode: function(object, elem)
-    {
-        function printNode(nodeId)
-        {
-            if (!nodeId)
-                return;
-            var treeOutline = new WebInspector.ElementsTreeOutline();
-            treeOutline.showInElementsPanelEnabled = true;
-            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
-            treeOutline.element.addStyleClass("outline-disclosure");
-            if (!treeOutline.children[0].hasChildren)
-                treeOutline.element.addStyleClass("single-node");
-            elem.appendChild(treeOutline.element);
-        }
-        InjectedScriptAccess.pushNodeToFrontend(object, printNode);
-    },
-
-    _formatobject: function(obj, elem)
-    {
-        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
-    },
-
-    _formaterror: function(obj, elem)
-    {
-        var messageElement = document.createElement("span");
-        messageElement.className = "error-message";
-        messageElement.textContent = obj.name + ": " + obj.message;
-        elem.appendChild(messageElement);
-
-        if (obj.sourceURL) {
-            var urlElement = document.createElement("a");
-            urlElement.className = "webkit-html-resource-link";
-            urlElement.href = obj.sourceURL;
-            urlElement.lineNumber = obj.line;
-            urlElement.preferredPanel = "scripts";
-
-            if (obj.line > 0)
-                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL) + ":" + obj.line;
-            else
-                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL);
-
-            elem.appendChild(document.createTextNode(" ("));
-            elem.appendChild(urlElement);
-            elem.appendChild(document.createTextNode(")"));
-        }
     }
 }
 
@@ -648,62 +606,28 @@ WebInspector.ConsoleMessage.prototype = {
 
     _format: function(parameters)
     {
+        // This node is used like a Builder. Values are contintually appended onto it.
         var formattedResult = document.createElement("span");
-
         if (!parameters.length)
             return formattedResult;
 
         // Formatting code below assumes that parameters are all wrappers whereas frontend console
-        // API allows passing arbitrary values as messages (strings, numberts, etc.). Wrap them here.
-        for (var i = 0; i < parameters.length; ++i) {
+        // API allows passing arbitrary values as messages (strings, numbers, etc.). Wrap them here.
+        for (var i = 0; i < parameters.length; ++i)
             if (typeof parameters[i] !== "object" && typeof parameters[i] !== "function")
                 parameters[i] = WebInspector.ObjectProxy.wrapPrimitiveValue(parameters[i]);
-        }
 
-        function formatForConsole(obj)
-        {
-            return WebInspector.console._format(obj);
-        }
-
-        function formatAsObjectForConsole(obj)
-        {
-            return WebInspector.console._format(obj, true);
-        }
-
-        if (Object.proxyType(parameters[0]) === "string") {
-            var formatters = {}
-            for (var i in String.standardFormatters)
-                formatters[i] = String.standardFormatters[i];
-
-            // Firebug uses %o for formatting objects.
-            formatters.o = formatForConsole;
-            // Firebug allows both %i and %d for formatting integers.
-            formatters.i = formatters.d;
-            // Support %O to force object formating, instead of the type-based %o formatting.
-            formatters.O = formatAsObjectForConsole;
-
-            function append(a, b)
-            {
-                if (!(b instanceof Node))
-                    a.appendChild(WebInspector.linkifyStringAsFragment(b.toString()));
-                else
-                    a.appendChild(b);
-                return a;
-            }
-
-            var result = String.format(parameters[0].description, parameters.slice(1), formatters, formattedResult, append);
-            formattedResult = result.formattedResult;
+        // Multiple parameters with the first being a format string. Save unused substitutions.
+        if (parameters.length > 1 && Object.proxyType(parameters[0]) === "string") {
+            var result = this._formatWithSubstitutionString(parameters, formattedResult)
             parameters = result.unusedSubstitutions;
             if (parameters.length)
                 formattedResult.appendChild(document.createTextNode(" "));
         }
 
+        // Single parameter, or unused substitutions from above.
         for (var i = 0; i < parameters.length; ++i) {
-            if (Object.proxyType(parameters[i]) === "string")
-                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(parameters[i].description));
-            else
-                formattedResult.appendChild(formatForConsole(parameters[i]));
-
+            this._formatIndividualValue(parameters[i], formattedResult);
             if (i < parameters.length - 1)
                 formattedResult.appendChild(document.createTextNode(" "));
         }
@@ -711,6 +635,51 @@ WebInspector.ConsoleMessage.prototype = {
         return formattedResult;
     },
 
+    _formatWithSubstitutionString: function(parameters, formattedResult)
+    {
+        var formatters = {}
+        for (var i in String.standardFormatters)
+            formatters[i] = String.standardFormatters[i];
+
+        function consoleFormatWrapper(force)
+        {
+            return function(obj) {
+                return WebInspector.console._format(obj, force);
+            };
+        }
+
+        // Firebug uses %o for formatting objects.
+        formatters.o = consoleFormatWrapper();
+        // Firebug allows both %i and %d for formatting integers.
+        formatters.i = formatters.d;
+        // Support %O to force object formating, instead of the type-based %o formatting.
+        formatters.O = consoleFormatWrapper(true);
+
+        function append(a, b)
+        {
+            if (!(b instanceof Node))
+                a.appendChild(WebInspector.linkifyStringAsFragment(b.toString()));
+            else
+                a.appendChild(b);
+            return a;
+        }
+
+        // String.format does treat formattedResult like a Builder, result is an object.
+        return String.format(parameters[0].description, parameters.slice(1), formatters, formattedResult, append);
+    },
+
+    _formatIndividualValue: function(param, formattedResult)
+    {
+        if (Object.proxyType(param) === "string") {
+            if (this.originatingCommand && this.level === WebInspector.ConsoleMessage.MessageLevel.Log) {
+                var quotedString = "\"" + param.description.replace(/"/g, "\\\"") + "\"";
+                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(quotedString));
+            } else
+                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(param.description));
+        } else
+            formattedResult.appendChild(WebInspector.console._format(param));
+    },
+
     toMessageElement: function()
     {
         if (this._element)
@@ -958,9 +927,9 @@ WebInspector.ConsoleCommandResult = function(result, exception, originatingComma
     var line = (exception ? result.line : -1);
     var url = (exception ? result.sourceURL : null);
 
-    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, WebInspector.ConsoleMessage.MessageType.Log, level, line, url, null, 1, message);
-
     this.originatingCommand = originatingCommand;
+
+    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, WebInspector.ConsoleMessage.MessageType.Log, level, line, url, null, 1, message);
 }
 
 WebInspector.ConsoleCommandResult.prototype = {
diff --git a/WebCore/inspector/front-end/ContextMenu.js b/WebCore/inspector/front-end/ContextMenu.js
new file mode 100644
index 0000000..3cdb152
--- /dev/null
+++ b/WebCore/inspector/front-end/ContextMenu.js
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ContextMenu = function() {
+    this._items = [];
+    this._handlers = {};
+}
+
+WebInspector.ContextMenu.prototype = {
+    show: function(event)
+    {
+        // Remove trailing separator.
+        while (this._items.length > 0 && !("id" in this._items[this._items.length - 1]))
+            this._items.splice(this._items.length - 1, 1);
+
+        if (this._items.length) {
+            WebInspector._contextMenu = this;
+            InspectorFrontendHost.showContextMenu(event, this._items);
+        }
+    },
+
+    appendItem: function(label, handler)
+    {
+        var id = this._items.length;
+        this._items.push({id: id, label: label});
+        this._handlers[id] = handler;
+    },
+
+    appendSeparator: function()
+    {
+        // No separator dupes allowed.
+        if (this._items.length === 0)
+            return;
+        if (!("id" in this._items[this._items.length - 1]))
+            return;
+        this._items.push({});
+    },
+
+    _itemSelected: function(id)
+    {
+        if (this._handlers[id])
+            this._handlers[id].call(this);
+    }
+}
+
+WebInspector.contextMenuItemSelected = function(id)
+{
+    if (WebInspector._contextMenu)
+        WebInspector._contextMenu._itemSelected(id);
+}
+
+WebInspector.contextMenuCleared = function()
+{
+    // FIXME: Unfortunately, contextMenuCleared is invoked between show and item selected
+    // so we can't delete last menu object from WebInspector. Fix the contract.
+}
diff --git a/WebCore/inspector/front-end/CookieItemsView.js b/WebCore/inspector/front-end/CookieItemsView.js
index 9f9845c..b31b7ea 100644
--- a/WebCore/inspector/front-end/CookieItemsView.js
+++ b/WebCore/inspector/front-end/CookieItemsView.js
@@ -67,7 +67,8 @@ WebInspector.CookieItemsView.prototype = {
         this.element.removeChildren();
 
         var self = this;
-        function callback(cookies, isAdvanced) {
+        function callback(allCookies, isAdvanced) {
+            var cookies = self._cookiesForDomain(allCookies);
             var dataGrid = (isAdvanced ? self.dataGridForCookies(cookies) : self.simpleDataGridForCookies(cookies));
             if (dataGrid) {
                 self._dataGrid = dataGrid;
@@ -85,7 +86,31 @@ WebInspector.CookieItemsView.prototype = {
             }
         }
 
-        WebInspector.Cookies.getCookiesAsync(callback, this._cookieDomain);
+        WebInspector.Cookies.getCookiesAsync(callback);
+    },
+
+    _cookiesForDomain: function(allCookies)
+    {
+        var cookiesForDomain = [];
+        var resourceURLsForDocumentURL = [];
+
+        for (var id in WebInspector.resources) {
+            var resource = WebInspector.resources[id];
+            var match = resource.documentURL.match(WebInspector.URLRegExp);
+            if (match && match[2] === this._cookieDomain)
+                resourceURLsForDocumentURL.push(resource.url);
+        }
+
+        for (var i = 0; i < allCookies.length; ++i) {
+            for (var j = 0; j < resourceURLsForDocumentURL.length; ++j) {
+                var resourceURL = resourceURLsForDocumentURL[j];
+                if (WebInspector.Cookies.cookieMatchesResourceURL(allCookies[i], resourceURL)) {
+                    cookiesForDomain.push(allCookies[i]);
+                    break;
+                }
+            }
+        }
+        return cookiesForDomain;
     },
 
     dataGridForCookies: function(cookies)
@@ -185,7 +210,7 @@ WebInspector.CookieItemsView.prototype = {
         for (var columnIdentifier in columns)
             columns[columnIdentifier].width += "%";
 
-        var dataGrid = new WebInspector.DataGrid(columns);
+        var dataGrid = new WebInspector.DataGrid(columns, null, this._deleteCookieCallback.bind(this));
         var length = nodes.length;
         for (var i = 0; i < length; ++i)
             dataGrid.appendChild(nodes[i]);
@@ -258,11 +283,16 @@ WebInspector.CookieItemsView.prototype = {
 
     _deleteButtonClicked: function(event)
     {
-        if (!this._dataGrid)
+        if (!this._dataGrid || !this._dataGrid.selectedNode)
             return;
 
-        var cookie = this._dataGrid.selectedNode.cookie;
-        InspectorController.deleteCookie(cookie.name, this._cookieDomain);
+        this._deleteCookieCallback(this._dataGrid.selectedNode);
+    },
+    
+    _deleteCookieCallback: function(node)
+    {
+        var cookie = node.cookie;
+        InspectorBackend.deleteCookie(cookie.name, this._cookieDomain);
         this.update();
     },
 
diff --git a/WebCore/inspector/front-end/DOMAgent.js b/WebCore/inspector/front-end/DOMAgent.js
index 25ffafa..4ccf843 100644
--- a/WebCore/inspector/front-end/DOMAgent.js
+++ b/WebCore/inspector/front-end/DOMAgent.js
@@ -61,9 +61,10 @@ WebInspector.DOMNode = function(doc, payload) {
     this._matchedCSSRules = [];
 
     if (this.nodeType == Node.ELEMENT_NODE) {
-        if (this.nodeName == "HTML")
+        // HTML and BODY from internal iframes should not overwrite top-level ones.
+        if (!this.ownerDocument.documentElement && this.nodeName === "HTML")
             this.ownerDocument.documentElement = this;
-        if (this.nodeName == "BODY")
+        if (!this.ownerDocument.body && this.nodeName === "BODY")
             this.ownerDocument.body = this;
     }
 }
@@ -178,6 +179,7 @@ WebInspector.DOMNode.prototype = {
         this.lastChild = this.children[this._childNodeCount - 1];
         for (var i = 0; i < this._childNodeCount; ++i) {
             var child = this.children[i];
+            child.index = i;
             child.nextSibling = i + 1 < this._childNodeCount ? this.children[i + 1] : null;
             child.prevSibling = i - 1 >= 0 ? this.children[i - 1] : null;
             child.parentNode = this;
@@ -326,25 +328,25 @@ WebInspector.DOMAgent.prototype = {
             callback(parent.children);
         }
         var callId = WebInspector.Callback.wrap(mycallback);
-        InspectorController.getChildNodes(callId, parent.id);
+        InspectorBackend.getChildNodes(callId, parent.id);
     },
 
     setAttributeAsync: function(node, name, value, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setAttribute(WebInspector.Callback.wrap(mycallback), node.id, name, value);
+        InspectorBackend.setAttribute(WebInspector.Callback.wrap(mycallback), node.id, name, value);
     },
 
     removeAttributeAsync: function(node, name, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.removeAttribute(WebInspector.Callback.wrap(mycallback), node.id, name);
+        InspectorBackend.removeAttribute(WebInspector.Callback.wrap(mycallback), node.id, name);
     },
 
     setTextNodeValueAsync: function(node, text, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node.id, text);
+        InspectorBackend.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node.id, text);
     },
 
     _didApplyDomChange: function(node, callback, success)
@@ -372,13 +374,13 @@ WebInspector.DOMAgent.prototype = {
     _setDocument: function(payload)
     {
         this._idToDOMNode = {};
-        if (payload) {
+        if (payload && "id" in payload) {
             this.document = new WebInspector.DOMDocument(this, this._window, payload);
             this._idToDOMNode[payload.id] = this.document;
             this._bindNodes(this.document.children);
         } else
             this.document = null;
-        WebInspector.panels.elements.reset();
+        WebInspector.panels.elements.setDocument(this.document);
     },
 
     _setDetachedRoot: function(payload)
@@ -437,7 +439,7 @@ WebInspector.DOMAgent.prototype = {
 
 WebInspector.Cookies = {}
 
-WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
+WebInspector.Cookies.getCookiesAsync = function(callback)
 {
     function mycallback(cookies, cookiesString) {
         if (cookiesString)
@@ -446,7 +448,7 @@ WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
             callback(cookies, true);
     }
     var callId = WebInspector.Callback.wrap(mycallback);
-    InspectorController.getCookies(callId, cookieDomain);
+    InspectorBackend.getCookies(callId);
 }
 
 WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
@@ -468,6 +470,28 @@ WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
     return cookies;
 }
 
+WebInspector.Cookies.cookieMatchesResourceURL = function(cookie, resourceURL)
+{
+    var match = resourceURL.match(WebInspector.URLRegExp);
+    if (!match)
+        return false;
+    // See WebInspector.URLRegExp for definitions of the group index constants.
+    if (!this.cookieDomainMatchesResourceDomain(cookie.domain, match[2]))
+        return false;
+    var resourcePort = match[3] ? match[3] : undefined;
+    var resourcePath = match[4] ? match[4] : '/';
+    return (resourcePath.indexOf(cookie.path) === 0
+        && (!cookie.port || resourcePort == cookie.port)
+        && (!cookie.secure || match[1].toLowerCase() === 'https'));
+}
+
+WebInspector.Cookies.cookieDomainMatchesResourceDomain = function(cookieDomain, resourceDomain)
+{
+    if (cookieDomain.charAt(0) !== '.')
+        return resourceDomain === cookieDomain;
+    return !!resourceDomain.match(new RegExp("^([^\\.]+\\.)?" + cookieDomain.substring(1).escapeForRegExp() + "$"), "i");
+}
+
 WebInspector.EventListeners = {}
 
 WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callback)
@@ -476,7 +500,7 @@ WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callb
         return;
 
     var callId = WebInspector.Callback.wrap(callback);
-    InspectorController.getEventListenersForNode(callId, node.id);
+    InspectorBackend.getEventListenersForNode(callId, node.id);
 }
 
 WebInspector.CSSStyleDeclaration = function(payload)
diff --git a/WebCore/inspector/front-end/DOMStorage.js b/WebCore/inspector/front-end/DOMStorage.js
index 03a10bf..c5f658d 100644
--- a/WebCore/inspector/front-end/DOMStorage.js
+++ b/WebCore/inspector/front-end/DOMStorage.js
@@ -57,19 +57,19 @@ WebInspector.DOMStorage.prototype = {
     getEntries: function(callback)
     {
         var callId = WebInspector.Callback.wrap(callback);
-        InspectorController.getDOMStorageEntries(callId, this._id);
+        InspectorBackend.getDOMStorageEntries(callId, this._id);
     },
     
     setItem: function(key, value, callback)
     {
         var callId = WebInspector.Callback.wrap(callback);
-        InspectorController.setDOMStorageItem(callId, this._id, key, value);
+        InspectorBackend.setDOMStorageItem(callId, this._id, key, value);
     },
     
     removeItem: function(key, callback)
     {
         var callId = WebInspector.Callback.wrap(callback);
-        InspectorController.removeDOMStorageItem(callId, this._id, key);
+        InspectorBackend.removeDOMStorageItem(callId, this._id, key);
     }
 }
 
diff --git a/WebCore/inspector/front-end/DOMStorageDataGrid.js b/WebCore/inspector/front-end/DOMStorageDataGrid.js
deleted file mode 100644
index 45a9ba1..0000000
--- a/WebCore/inspector/front-end/DOMStorageDataGrid.js
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
- * Copyright (C) 2009 Nokia Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *        notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *        notice, this list of conditions and the following disclaimer in the
- *        documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.         IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-WebInspector.DOMStorageDataGrid = function(columns, domStorage, keys)
-{
-    WebInspector.DataGrid.call(this, columns);
-    this.dataTableBody.addEventListener("dblclick", this._ondblclick.bind(this), false);
-    this._domStorage = domStorage;
-    this._keys = keys;
-}
-
-WebInspector.DOMStorageDataGrid.prototype = {
-    _ondblclick: function(event)
-    {
-        if (this._editing)
-            return;
-        if (this._editingNode)
-            return;
-        this._startEditing(event);
-    },
-
-    _startEditingColumnOfDataGridNode: function(node, column)
-    {
-        this._editing = true;
-        this._editingNode = node;
-        this._editingNode.select();
-
-        var element = this._editingNode._element.children[column];
-        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
-        window.getSelection().setBaseAndExtent(element, 0, element, 1);
-    },
-
-    _startEditing: function(event)
-    {
-        var element = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!element)
-            return;
-
-        this._editingNode = this.dataGridNodeFromEvent(event);
-        if (!this._editingNode) {
-            if (!this.creationNode)
-                return;
-            this._editingNode = this.creationNode;
-        }
-
-        // Force editing the "Key" column when editing the creation node
-        if (this._editingNode.isCreationNode)
-            return this._startEditingColumnOfDataGridNode(this._editingNode, 0);
-
-        this._editing = true;
-        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
-        window.getSelection().setBaseAndExtent(element, 0, element, 1);
-    },
-
-    _editingCommitted: function(element, newText, oldText, context, moveDirection)
-    {
-        var columnIdentifier = (element.hasStyleClass("0-column") ? 0 : 1);
-        var textBeforeEditing = this._editingNode.data[columnIdentifier];
-        var currentEditingNode = this._editingNode;
-
-        function moveToNextIfNeeded(wasChange) {
-            if (!moveDirection)
-                return;
-
-            if (moveDirection === "forward") {
-                if (currentEditingNode.isCreationNode && columnIdentifier === 0 && !wasChange)
-                    return;
-
-                if (columnIdentifier === 0)
-                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 1);
-
-                var nextDataGridNode = currentEditingNode.traverseNextNode(true, null, true);
-                if (nextDataGridNode)
-                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 0);
-                if (currentEditingNode.isCreationNode && wasChange) {
-                    addCreationNode(false);
-                    return this._startEditingColumnOfDataGridNode(this.creationNode, 0);
-                }
-                return;
-            }
-
-            if (moveDirection === "backward") {
-                if (columnIdentifier === 1)
-                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 0);
-                    var nextDataGridNode = currentEditingNode.traversePreviousNode(true, null, true);
-
-                if (nextDataGridNode)
-                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 1);
-                return;
-            }
-        }
-
-        if (textBeforeEditing == newText) {
-            this._editingCancelled(element);
-            moveToNextIfNeeded.call(this, false);
-            return;
-        }
-
-        var domStorage = this._domStorage;
-        if (columnIdentifier === 0) {
-            if (this._keys.indexOf(newText) !== -1) {
-                element.textContent = this._editingNode.data[0];
-                this._editingCancelled(element);
-                moveToNextIfNeeded.call(this, false);
-                return;
-            }
-            domStorage.removeItem(this._editingNode.data[0]);
-            domStorage.setItem(newText, this._editingNode.data[1]);
-            this._editingNode.data[0] = newText;
-        } else {
-            domStorage.setItem(this._editingNode.data[0], newText);
-            this._editingNode.data[1] = newText;
-        }
-
-        if (this._editingNode.isCreationNode)
-            this.addCreationNode(false);
-
-        this._editingCancelled(element);
-        moveToNextIfNeeded.call(this, true);
-    },
-
-    _editingCancelled: function(element, context)
-    {
-        delete this._editing;
-        this._editingNode = null;
-    },
-
-    deleteSelectedRow: function()
-    {
-        var node = this.selectedNode;
-        if (!node || node.isCreationNode)
-            return;
-
-        if (this._domStorage)
-            this._domStorage.removeItem(node.data[0]);
-    }
-}
-
-WebInspector.DOMStorageDataGrid.prototype.__proto__ = WebInspector.DataGrid.prototype;
diff --git a/WebCore/inspector/front-end/DOMStorageItemsView.js b/WebCore/inspector/front-end/DOMStorageItemsView.js
index a7da370..7441f2e 100644
--- a/WebCore/inspector/front-end/DOMStorageItemsView.js
+++ b/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -65,22 +65,12 @@ WebInspector.DOMStorageItemsView.prototype = {
         this.domStorage.getEntries(callback);
     },
 
-    _showDOMStorageEntries: function(entries) 
+    _showDOMStorageEntries: function(entries)
     {
-        if (entries.length > 0) {
-            this._dataGrid = this._dataGridForDOMStorageEntries(entries);
-            this.element.appendChild(this._dataGrid.element);
-            this._dataGrid.updateWidths();
-            this.deleteButton.visible = true;
-        } else {
-            var emptyMsgElement = document.createElement("div");
-            emptyMsgElement.className = "storage-table-empty";
-            if (this.domStorage)
-                emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
-            this.element.appendChild(emptyMsgElement);
-            this._dataGrid = null;
-            this.deleteButton.visible = false;
-        }
+        this._dataGrid = this._dataGridForDOMStorageEntries(entries);
+        this.element.appendChild(this._dataGrid.element);
+        this._dataGrid.updateWidths();
+        this.deleteButton.visible = true;
     },
 
     resize: function()
@@ -133,7 +123,7 @@ WebInspector.DOMStorageItemsView.prototype = {
         columns[0].width += "%";
         columns[1].width += "%";
 
-        var dataGrid = new WebInspector.DOMStorageDataGrid(columns, this.domStorage, keys);
+        var dataGrid = new WebInspector.DataGrid(columns, this._editingCallback.bind(this), this._deleteCallback.bind(this));
         var length = nodes.length;
         for (var i = 0; i < length; ++i)
             dataGrid.appendChild(nodes[i]);
@@ -145,16 +135,41 @@ WebInspector.DOMStorageItemsView.prototype = {
 
     _deleteButtonClicked: function(event)
     {
-        if (this._dataGrid) {
-            this._dataGrid.deleteSelectedRow();
-            
-            this.show();
-        }
+        if (!this._dataGrid || !this._dataGrid.selectedNode)
+            return;
+
+        this._deleteCallback(this._dataGrid.selectedNode);
     },
 
     _refreshButtonClicked: function(event)
     {
         this.update();
+    },
+    
+    _editingCallback: function(editingNode, columnIdentifier, oldText, newText)
+    {
+        var domStorage = this.domStorage;
+        if (columnIdentifier === 0) {
+            if (oldText)
+                domStorage.removeItem(oldText);
+
+            domStorage.setItem(newText, editingNode.data[1]);
+        } else {
+            domStorage.setItem(editingNode.data[0], newText);
+        }
+        
+        this.update();
+    },
+    
+    _deleteCallback: function(node)
+    {
+        if (!node || node.isCreationNode)
+            return;
+
+        if (this.domStorage)
+            this.domStorage.removeItem(node.data[0]);
+            
+        this.update();
     }
 }
 
diff --git a/WebCore/inspector/front-end/DataGrid.js b/WebCore/inspector/front-end/DataGrid.js
index ce61548..7b58c8e 100644
--- a/WebCore/inspector/front-end/DataGrid.js
+++ b/WebCore/inspector/front-end/DataGrid.js
@@ -23,7 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DataGrid = function(columns)
+WebInspector.DataGrid = function(columns, editCallback, deleteCallback)
 {
     this.element = document.createElement("div");
     this.element.className = "data-grid";
@@ -38,7 +38,16 @@ WebInspector.DataGrid = function(columns)
 
     this._dataTable.addEventListener("mousedown", this._mouseDownInDataTable.bind(this), true);
     this._dataTable.addEventListener("click", this._clickInDataTable.bind(this), true);
-
+    
+    // FIXME: Add a createCallback which is different from editCallback and has different
+    // behavior when creating a new node.
+    if (editCallback) {
+        this._dataTable.addEventListener("dblclick", this._ondblclick.bind(this), false);
+        this._editCallback = editCallback;
+    }
+    if (deleteCallback)
+        this._deleteCallback = deleteCallback;
+    
     this.aligned = {};
 
     var scrollContainer = document.createElement("div");
@@ -128,6 +137,116 @@ WebInspector.DataGrid = function(columns)
 }
 
 WebInspector.DataGrid.prototype = {
+    _ondblclick: function(event)
+    {
+        if (this._editing || this._editingNode)
+            return;
+
+        this._startEditing(event.target);
+    },
+
+    _startEditingColumnOfDataGridNode: function(node, column)
+    {
+        this._editing = true;
+        this._editingNode = node;
+        this._editingNode.select();
+
+        var element = this._editingNode._element.children[column];
+        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+
+    _startEditing: function(target)
+    {
+        var element = target.enclosingNodeOrSelfWithNodeName("td");
+        if (!element)
+            return;
+
+        this._editingNode = this.dataGridNodeFromNode(target);
+        if (!this._editingNode) {
+            if (!this.creationNode)
+                return;
+            this._editingNode = this.creationNode;
+        }
+
+        // Force editing the 1st column when editing the creation node
+        if (this._editingNode.isCreationNode)
+            return this._startEditingColumnOfDataGridNode(this._editingNode, 0);
+
+        this._editing = true;
+        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+
+    _editingCommitted: function(element, newText, oldText, context, moveDirection)
+    {
+        // FIXME: We need more column identifiers here throughout this function.
+        // Not needed yet since only editable DataGrid is DOM Storage, which is Key - Value.
+        
+        // FIXME: Better way to do this than regular expressions?
+        var columnIdentifier = parseInt(element.className.match(/\b(\d+)-column\b/)[1]);
+
+        var textBeforeEditing = this._editingNode.data[columnIdentifier];
+        var currentEditingNode = this._editingNode;
+
+        function moveToNextIfNeeded(wasChange) {
+            if (!moveDirection)
+                return;
+
+            if (moveDirection === "forward") {
+                if (currentEditingNode.isCreationNode && columnIdentifier === 0 && !wasChange)
+                    return;
+
+                if (columnIdentifier === 0)
+                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 1);
+
+                var nextDataGridNode = currentEditingNode.traverseNextNode(true, null, true);
+                if (nextDataGridNode)
+                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 0);
+                if (currentEditingNode.isCreationNode && wasChange) {
+                    addCreationNode(false);
+                    return this._startEditingColumnOfDataGridNode(this.creationNode, 0);
+                }
+                return;
+            }
+
+            if (moveDirection === "backward") {
+                if (columnIdentifier === 1)
+                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 0);
+                    var nextDataGridNode = currentEditingNode.traversePreviousNode(true, null, true);
+
+                if (nextDataGridNode)
+                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 1);
+                return;
+            }
+        }
+
+        if (textBeforeEditing == newText) {
+            this._editingCancelled(element);
+            moveToNextIfNeeded.call(this, false);
+            return;
+        }
+
+        // Update the text in the datagrid that we typed
+        this._editingNode.data[columnIdentifier] = newText;
+        
+        // Make the callback - expects an editing node (table row), the column number that is being edited,
+        // the text that used to be there, and the new text.
+        this._editCallback(this._editingNode, columnIdentifier, textBeforeEditing, newText);
+
+        if (this._editingNode.isCreationNode)
+            this.addCreationNode(false);
+
+        this._editingCancelled(element);
+        moveToNextIfNeeded.call(this, true);
+    },
+
+    _editingCancelled: function(element, context)
+    {
+        delete this._editing;
+        this._editingNode = null;
+    },
+    
     get sortColumnIdentifier()
     {
         if (!this._sortColumnCell)
@@ -266,6 +385,7 @@ WebInspector.DataGrid.prototype = {
         delete child._depth;
         delete child._revealed;
         delete child._attached;
+        child._shouldRefreshChildren = true;
 
         var current = child.children[0];
         while (current) {
@@ -273,6 +393,7 @@ WebInspector.DataGrid.prototype = {
             delete current._depth;
             delete current._revealed;
             delete current._attached;
+            current._shouldRefreshChildren = true;
             current = current.traverseNextNode(false, child, true);
         }
 
@@ -350,7 +471,7 @@ WebInspector.DataGrid.prototype = {
 
     handleKeyEvent: function(event)
     {
-        if (!this.selectedNode || event.shiftKey || event.metaKey || event.ctrlKey)
+        if (!this.selectedNode || event.shiftKey || event.metaKey || event.ctrlKey || this._editing)
             return false;
 
         var handled = false;
@@ -396,6 +517,18 @@ WebInspector.DataGrid.prototype = {
                         this.selectedNode.expand();
                 }
             }
+        } else if (event.keyCode === 8 || event.keyCode === 46) {
+            if (this._deleteCallback) {
+                handled = true;
+                this._deleteCallback(this.selectedNode);
+            }
+        } else if (isEnterKey(event)) {
+            if (this._editCallback) {
+                handled = true;
+                // The first child of the selected element is the <td class="0-column">,
+                // and that's what we want to edit.
+                this._startEditing(this.selectedNode._element.children[0]);
+            }
         }
 
         if (nextSelectedNode) {
@@ -426,9 +559,9 @@ WebInspector.DataGrid.prototype = {
         // This is the root, do nothing.
     },
 
-    dataGridNodeFromEvent: function(event)
+    dataGridNodeFromNode: function(target)
     {
-        var rowElement = event.target.enclosingNodeOrSelfWithNodeName("tr");
+        var rowElement = target.enclosingNodeOrSelfWithNodeName("tr");
         return rowElement._dataGridNode;
     },
 
@@ -473,7 +606,7 @@ WebInspector.DataGrid.prototype = {
 
     _mouseDownInDataTable: function(event)
     {
-        var gridNode = this.dataGridNodeFromEvent(event);
+        var gridNode = this.dataGridNodeFromNode(event.target);
         if (!gridNode || !gridNode.selectable)
             return;
 
@@ -491,7 +624,7 @@ WebInspector.DataGrid.prototype = {
 
     _clickInDataTable: function(event)
     {
-        var gridNode = this.dataGridNodeFromEvent(event);
+        var gridNode = this.dataGridNodeFromNode(event.target);
         if (!gridNode || !gridNode.hasChildren)
             return;
 
@@ -1019,6 +1152,30 @@ WebInspector.DataGridNode.prototype = {
 
         for (var i = 0; i < this.children.length; ++i)
             this.children[i]._detach();
+    },
+
+    savePosition: function()
+    {
+        if (this._savedPosition)
+            return;
+
+        if (!this.parent)
+            throw("savePosition: Node must have a parent.");
+        this._savedPosition = {
+            parent: this.parent,
+            index: this.parent.children.indexOf(this)
+        };
+    },
+
+    restorePosition: function()
+    {
+        if (!this._savedPosition)
+            return;
+
+        if (this.parent !== this._savedPosition.parent)
+            this._savedPosition.parent.insertChild(this, this._savedPosition.index);
+
+        delete this._savedPosition;
     }
 }
 
diff --git a/WebCore/inspector/front-end/Database.js b/WebCore/inspector/front-end/Database.js
index 1a348fc..5edefb1 100644
--- a/WebCore/inspector/front-end/Database.js
+++ b/WebCore/inspector/front-end/Database.js
@@ -82,7 +82,7 @@ WebInspector.Database.prototype = {
             callback(names.sort());
         }
         var callId = WebInspector.Callback.wrap(sortingCallback);
-        InspectorController.getDatabaseTableNames(callId, this._id);
+        InspectorBackend.getDatabaseTableNames(callId, this._id);
     },
     
     executeSql: function(query, onSuccess, onError)
diff --git a/WebCore/inspector/front-end/Drawer.js b/WebCore/inspector/front-end/Drawer.js
index 1b50f91..0426a39 100644
--- a/WebCore/inspector/front-end/Drawer.js
+++ b/WebCore/inspector/front-end/Drawer.js
@@ -7,13 +7,13 @@
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
+ *     documentation and/or other materials provided with the distribution.
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -31,6 +31,12 @@ WebInspector.Drawer = function()
 {
     WebInspector.View.call(this, document.getElementById("drawer"));
 
+    this._savedHeight = 200; // Default.
+    this.state = WebInspector.Drawer.State.Hidden;
+    this.fullPanel = false;
+
+    this.mainElement = document.getElementById("main");
+    this.toolbarElement = document.getElementById("toolbar");
     this.mainStatusBar = document.getElementById("main-status-bar");
     this.mainStatusBar.addEventListener("mousedown", this._startStatusBarDragging.bind(this), true);
     this.viewStatusBar = document.getElementById("other-drawer-status-bar-items");
@@ -45,6 +51,8 @@ WebInspector.Drawer.prototype = {
     set visibleView(x)
     {
         if (this._visibleView === x) {
+            if (this.visible && this.fullPanel)
+                return;
             this.visible = !this.visible;
             return;
         }
@@ -64,6 +72,12 @@ WebInspector.Drawer.prototype = {
         }
     },
 
+    get savedHeight()
+    {
+        var height = this._savedHeight || this.element.offsetHeight;
+        return Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - this.mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+    },
+
     showView: function(view)
     {
         if (!this.visible || this.visibleView !== view)
@@ -85,15 +99,16 @@ WebInspector.Drawer.prototype = {
         document.body.addStyleClass("drawer-visible");
 
         var anchoredItems = document.getElementById("anchored-status-bar-items");
-
+        var height = (this.fullPanel ? window.innerHeight - this.toolbarElement.offsetHeight : this.savedHeight);
         var animations = [
-            {element: document.getElementById("main"), end: {bottom: this.element.offsetHeight}},
+            {element: this.element, end: {height: height}},
+            {element: document.getElementById("main"), end: {bottom: height}},
             {element: document.getElementById("main-status-bar"), start: {"padding-left": anchoredItems.offsetWidth - 1}, end: {"padding-left": 0}},
             {element: document.getElementById("other-drawer-status-bar-items"), start: {opacity: 0}, end: {opacity: 1}}
         ];
 
-        var consoleStatusBar = document.getElementById("drawer-status-bar");
-        consoleStatusBar.insertBefore(anchoredItems, consoleStatusBar.firstChild);
+        var drawerStatusBar = document.getElementById("drawer-status-bar");
+        drawerStatusBar.insertBefore(anchoredItems, drawerStatusBar.firstChild);
 
         function animationFinished()
         {
@@ -102,9 +117,11 @@ WebInspector.Drawer.prototype = {
             if (this.visibleView.afterShow)
                 this.visibleView.afterShow();
             delete this._animating;
+            delete this._currentAnimationInterval;
+            this.state = (this.fullPanel ? WebInspector.Drawer.State.Full : WebInspector.Drawer.State.Variable);
         }
 
-        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
     },
 
     hide: function()
@@ -113,20 +130,23 @@ WebInspector.Drawer.prototype = {
             return;
 
         WebInspector.View.prototype.hide.call(this);
-        
+
         if (this.visibleView)
             this.visibleView.hide();
 
         this._animating = true;
 
+        if (!this.fullPanel)
+            this._savedHeight = this.element.offsetHeight;
+
         if (this.element === WebInspector.currentFocusElement || this.element.isAncestor(WebInspector.currentFocusElement))
             WebInspector.currentFocusElement = WebInspector.previousFocusElement;
 
         var anchoredItems = document.getElementById("anchored-status-bar-items");
 
-        // Temporally set properties and classes to mimic the post-animation values so panels
+        // Temporarily set properties and classes to mimic the post-animation values so panels
         // like Elements in their updateStatusBarItems call will size things to fit the final location.
-        document.getElementById("main-status-bar").style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
+        this.mainStatusBar.style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
         document.body.removeStyleClass("drawer-visible");
         if ("updateStatusBarItems" in WebInspector.currentPanel)
             WebInspector.currentPanel.updateStatusBarItems();
@@ -145,9 +165,96 @@ WebInspector.Drawer.prototype = {
             mainStatusBar.style.removeProperty("padding-left");
             document.body.removeStyleClass("drawer-visible");
             delete this._animating;
+            delete this._currentAnimationInterval;
+            this.state = WebInspector.Drawer.State.Hidden;
+        }
+
+        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
+    },
+
+    resize: function()
+    {
+        if (this.state === WebInspector.Drawer.State.Hidden)
+            return;
+
+        var height;
+        var mainElement = document.getElementById("main");
+        if (this.state === WebInspector.Drawer.State.Variable) {
+            height = parseInt(this.element.style.height);
+            height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+        } else
+            height = window.innerHeight - this.toolbarElement.offsetHeight;
+
+        mainElement.style.bottom = height + "px";
+        this.element.style.height = height + "px";
+    },
+
+    enterPanelMode: function()
+    {
+        this._cancelAnimationIfNeeded();
+        this.fullPanel = true;
+        
+        if (this.visible) {
+            this._savedHeight = this.element.offsetHeight;
+            var height = window.innerHeight - this.toolbarElement.offsetHeight;
+            this._animateDrawerHeight(height, WebInspector.Drawer.State.Full);
+        }
+    },
+
+    exitPanelMode: function()
+    {
+        this._cancelAnimationIfNeeded();
+        this.fullPanel = false;
+
+        if (this.visible) {
+            // If this animation gets cancelled, we want the state of the drawer to be Variable,
+            // so that the new animation can't do an immediate transition between Hidden/Full states.
+            this.state = WebInspector.Drawer.State.Variable;
+            var height = this.savedHeight;
+            this._animateDrawerHeight(height, WebInspector.Drawer.State.Variable);
+        }
+    },
+
+    immediatelyExitPanelMode: function()
+    {
+        this.visible = false;
+        this.fullPanel = false;
+    },
+
+    _cancelAnimationIfNeeded: function()
+    {
+        if (this._animating) {
+            clearInterval(this._currentAnimationInterval);
+            delete this._animating;
+            delete this._currentAnimationInterval;
+        }
+    },
+
+    _animateDrawerHeight: function(height, finalState)
+    {
+        this._animating = true;
+        var animations = [
+            {element: this.element, end: {height: height}},
+            {element: document.getElementById("main"), end: {bottom: height}}
+        ];
+
+        function animationFinished()
+        {
+            delete this._animating;
+            delete this._currentAnimationInterval;
+            this.state = finalState;
         }
 
-        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
+    },
+
+    _animationDuration: function()
+    {
+        // Immediate if going between Hidden and Full in full panel mode
+        if (this.fullPanel && (this.state === WebInspector.Drawer.State.Hidden || this.state === WebInspector.Drawer.State.Full))
+            return 0;
+
+        return (window.event && window.event.shiftKey ? 2000 : 250);
     },
 
     _safelyRemoveChildren: function()
@@ -165,10 +272,10 @@ WebInspector.Drawer.prototype = {
 
     _startStatusBarDragging: function(event)
     {
-        if (!this.visible || event.target !== document.getElementById("main-status-bar"))
+        if (!this.visible || event.target !== this.mainStatusBar)
             return;
 
-        WebInspector.elementDragStart(document.getElementById("main-status-bar"), this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
+        WebInspector.elementDragStart(this.mainStatusBar, this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
 
         this._statusBarDragOffset = event.pageY - this.element.totalOffsetTop;
 
@@ -178,7 +285,6 @@ WebInspector.Drawer.prototype = {
     _statusBarDragging: function(event)
     {
         var mainElement = document.getElementById("main");
-
         var height = window.innerHeight - event.pageY + this._statusBarDragOffset;
         height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
 
@@ -193,6 +299,7 @@ WebInspector.Drawer.prototype = {
     {
         WebInspector.elementDragEnd(event);
 
+        this._savedHeight = this.element.offsetHeight;
         delete this._statusBarDragOffset;
 
         event.stopPropagation();
@@ -200,3 +307,9 @@ WebInspector.Drawer.prototype = {
 }
 
 WebInspector.Drawer.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.Drawer.State = {
+    Hidden: 0,
+    Variable: 1,
+    Full: 2
+};
diff --git a/WebCore/inspector/front-end/ElementsPanel.js b/WebCore/inspector/front-end/ElementsPanel.js
index aa6319c..9b18251 100644
--- a/WebCore/inspector/front-end/ElementsPanel.js
+++ b/WebCore/inspector/front-end/ElementsPanel.js
@@ -58,8 +58,8 @@ WebInspector.ElementsPanel = function()
         this.panel.updateProperties();
         this.panel.updateEventListeners();
 
-        if (InspectorController.searchingForNode()) {
-            InspectorController.toggleNodeSearch();
+        if (InspectorBackend.searchingForNode()) {
+            InspectorBackend.toggleNodeSearch();
             this.panel.nodeSearchButton.toggled = false;
         }
         if (this._focusedDOMNode)
@@ -150,8 +150,8 @@ WebInspector.ElementsPanel.prototype = {
 
         WebInspector.hoveredDOMNode = null;
 
-        if (InspectorController.searchingForNode()) {
-            InspectorController.toggleNodeSearch();
+        if (InspectorBackend.searchingForNode()) {
+            InspectorBackend.toggleNodeSearch();
             this.nodeSearchButton.toggled = false;
         }
     },
@@ -164,13 +164,24 @@ WebInspector.ElementsPanel.prototype = {
 
     reset: function()
     {
+        if (this.focusedDOMNode) {
+            this._selectedPathOnReset = [];
+            var node = this.focusedDOMNode;
+            while ("index" in node) {
+                this._selectedPathOnReset.push(node.nodeName);
+                this._selectedPathOnReset.push(node.index);
+                node = node.parentNode;
+            }
+            this._selectedPathOnReset.reverse();
+        }
+
         this.rootDOMNode = null;
         this.focusedDOMNode = null;
 
         WebInspector.hoveredDOMNode = null;
 
-        if (InspectorController.searchingForNode()) {
-            InspectorController.toggleNodeSearch();
+        if (InspectorBackend.searchingForNode()) {
+            InspectorBackend.toggleNodeSearch();
             this.nodeSearchButton.toggled = false;
         }
 
@@ -178,31 +189,48 @@ WebInspector.ElementsPanel.prototype = {
 
         delete this.currentQuery;
         this.searchCanceled();
+    },
 
-        var domWindow = WebInspector.domAgent.domWindow;
-        if (!domWindow || !domWindow.document || !domWindow.document.firstChild)
-            return;
+    setDocument: function(inspectedRootDocument)
+    {
+        this.reset();
 
-        // If the window isn't visible, return early so the DOM tree isn't built
-        // and mutation event listeners are not added.
-        if (!InspectorController.isWindowVisible())
+        if (!inspectedRootDocument)
             return;
 
-        var inspectedRootDocument = domWindow.document;
         inspectedRootDocument.addEventListener("DOMNodeInserted", this._nodeInserted.bind(this));
         inspectedRootDocument.addEventListener("DOMNodeRemoved", this._nodeRemoved.bind(this));
 
+        this.treeOutline.suppressSelectHighlight = true;
         this.rootDOMNode = inspectedRootDocument;
+        this.treeOutline.suppressSelectHighlight = false;
 
-        var canidateFocusNode = inspectedRootDocument.body || inspectedRootDocument.documentElement;
-        if (canidateFocusNode) {
-            this.treeOutline.suppressSelectHighlight = true;
-            this.focusedDOMNode = canidateFocusNode;
-            this.treeOutline.suppressSelectHighlight = false;
+        function selectNode(candidateFocusNode)
+        {
+            if (!candidateFocusNode)
+                candidateFocusNode = inspectedRootDocument.body || inspectedRootDocument.documentElement;
+
+            if (!candidateFocusNode)
+                return;
 
+            this.treeOutline.suppressSelectHighlight = true;
+            this.focusedDOMNode = candidateFocusNode;
             if (this.treeOutline.selectedTreeElement)
                 this.treeOutline.selectedTreeElement.expand();
+            this.treeOutline.suppressSelectHighlight = false;
+        }
+
+        function selectLastSelectedNode(nodeId)
+        {
+            var node = nodeId ? WebInspector.domAgent.nodeForId(nodeId) : 0;
+            selectNode.call(this, node);
         }
+
+        if (this._selectedPathOnReset)
+            InjectedScriptAccess.nodeByPath(this._selectedPathOnReset, selectLastSelectedNode.bind(this));
+        else
+            selectNode.call(this);
+        delete this._selectedPathOnReset;
     },
 
     searchCanceled: function()
@@ -525,7 +553,7 @@ WebInspector.ElementsPanel.prototype = {
     _mouseMovedOutOfCrumbs: function(event)
     {
         var nodeUnderMouse = document.elementFromPoint(event.pageX, event.pageY);
-        if (nodeUnderMouse.isDescendant(this.crumbsElement))
+        if (nodeUnderMouse && nodeUnderMouse.isDescendant(this.crumbsElement))
             return;
 
         WebInspector.hoveredDOMNode = null;
@@ -998,6 +1026,21 @@ WebInspector.ElementsPanel.prototype = {
 
     handleKeyEvent: function(event)
     {
+        // Cmd/Control + Shift + C should be a shortcut to clicking the Node Search Button.
+        // This shortcut matches Firebug.
+        if (event.keyIdentifier === "U+0043") {     // C key
+            if (WebInspector.isMac())
+                var isNodeSearchKey = event.metaKey && !event.ctrlKey && !event.altKey && event.shiftKey;
+            else
+                var isNodeSearchKey = event.ctrlKey && !event.metaKey && !event.altKey && event.shiftKey;
+
+            if (isNodeSearchKey) {
+                this._nodeSearchButtonClicked(event);
+                event.preventDefault();
+                return;
+            }
+        }
+        
         this.treeOutline.handleKeyEvent(event);
     },
 
@@ -1008,7 +1051,7 @@ WebInspector.ElementsPanel.prototype = {
             return;
         event.clipboardData.clearData();
         event.preventDefault();
-        InspectorController.copyNode(this.focusedDOMNode.id);
+        InspectorBackend.copyNode(this.focusedDOMNode.id);
     },
 
     rightSidebarResizerDragStart: function(event)
@@ -1037,9 +1080,9 @@ WebInspector.ElementsPanel.prototype = {
 
     _nodeSearchButtonClicked: function(event)
     {
-        InspectorController.toggleNodeSearch();
+        InspectorBackend.toggleNodeSearch();
 
-        this.nodeSearchButton.toggled = InspectorController.searchingForNode();
+        this.nodeSearchButton.toggled = InspectorBackend.searchingForNode();
     }
 }
 
diff --git a/WebCore/inspector/front-end/ElementsTreeOutline.js b/WebCore/inspector/front-end/ElementsTreeOutline.js
index be01647..a035e7d 100644
--- a/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -41,6 +41,8 @@ WebInspector.ElementsTreeOutline = function() {
     this.showInElementsPanelEnabled = false;
     this.rootDOMNode = null;
     this.focusedDOMNode = null;
+
+    this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
 }
 
 WebInspector.ElementsTreeOutline.prototype = {
@@ -83,7 +85,7 @@ WebInspector.ElementsTreeOutline.prototype = {
             this.focusedNodeChanged();
 
             if (x && !this.suppressSelectHighlight) {
-                InspectorController.highlightDOMNode(x.id);
+                InspectorBackend.highlightDOMNode(x.id);
 
                 if ("_restorePreviousHighlightNodeTimeout" in this)
                     clearTimeout(this._restorePreviousHighlightNodeTimeout);
@@ -92,9 +94,9 @@ WebInspector.ElementsTreeOutline.prototype = {
                 {
                     var hoveredNode = WebInspector.hoveredDOMNode;
                     if (hoveredNode)
-                        InspectorController.highlightDOMNode(hoveredNode.id);
+                        InspectorBackend.highlightDOMNode(hoveredNode.id);
                     else
-                        InspectorController.hideDOMNodeHighlight();
+                        InspectorBackend.hideDOMNodeHighlight();
                 }
 
                 this._restorePreviousHighlightNodeTimeout = setTimeout(restoreHighlightToHoveredNode, 2000);
@@ -104,6 +106,8 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     update: function()
     {
+        var selectedNode = this.selectedTreeElement ? this.selectedTreeElement.representedObject : null;
+
         this.removeChildren();
 
         if (!this.rootDOMNode)
@@ -125,7 +129,8 @@ WebInspector.ElementsTreeOutline.prototype = {
             }
         }
 
-        this.updateSelection();
+        if (selectedNode)
+            this.revealAndSelectNode(selectedNode);
     },
 
     updateSelection: function()
@@ -192,9 +197,10 @@ WebInspector.ElementsTreeOutline.prototype = {
         if (!selectedElement)
             return;
 
-        // Delete or backspace pressed, delete the node.
-        if (event.keyCode === 8 || event.keyCode === 46) {
+        if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Backspace ||
+                event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Delete) {
             selectedElement.remove();
+            event.preventDefault();
             return;
         }
 
@@ -255,6 +261,23 @@ WebInspector.ElementsTreeOutline.prototype = {
         }
 
         WebInspector.hoveredDOMNode = null;
+    },
+
+    _contextMenuEventFired: function(event)
+    {
+        var listItem = event.target.enclosingNodeOrSelfWithNodeName("LI");
+        if (!listItem || !listItem.treeElement)
+            return;
+
+        var contextMenu = new WebInspector.ContextMenu();
+
+        var tag = event.target.enclosingNodeOrSelfWithClass("webkit-html-tag");
+        var textNode = event.target.enclosingNodeOrSelfWithClass("webkit-html-text-node");
+        if (tag)
+            listItem.treeElement._populateTagContextMenu(contextMenu, event);
+        else if (textNode)
+            listItem.treeElement._populateTextContextMenu(contextMenu, textNode);
+        contextMenu.show(event);
     }
 }
 
@@ -321,6 +344,26 @@ WebInspector.ElementsTreeElement.prototype = {
         }
     },
 
+    createTooltipForImageNode: function(node, callback)
+    {
+        function createTooltipThenCallback(properties)
+        {
+            if (!properties) {
+                callback();
+                return;
+            }
+
+            var tooltipText = null;
+            if (properties.offsetHeight === properties.naturalHeight && properties.offsetWidth === properties.naturalWidth)
+                tooltipText = WebInspector.UIString("%d × %d pixels", properties.offsetWidth, properties.offsetHeight);
+            else
+                tooltipText = WebInspector.UIString("%d × %d pixels (Natural: %d × %d pixels)", properties.offsetWidth, properties.offsetHeight, properties.naturalWidth, properties.naturalHeight);
+            callback(tooltipText);
+        }
+        var objectProxy = new WebInspector.ObjectProxy(node.id);
+        WebInspector.ObjectProxy.getPropertiesAsync(objectProxy, ["naturalHeight", "naturalWidth", "offsetHeight", "offsetWidth"], createTooltipThenCallback);
+    },
+
     toggleNewAttributeButton: function(visible)
     {
         function removeAddAttributeSpan()
@@ -525,12 +568,12 @@ WebInspector.ElementsTreeElement.prototype = {
             event.preventDefault();
     },
 
-    ondblclick: function(treeElement, event)
+    ondblclick: function(event)
     {
         if (this._editing)
             return;
 
-        if (this._startEditingFromEvent(event, treeElement))
+        if (this._startEditingFromEvent(event))
             return;
 
         if (this.hasChildren && !this.expanded)
@@ -552,7 +595,7 @@ WebInspector.ElementsTreeElement.prototype = {
         this.updateSelection();
     },
 
-    _startEditingFromEvent: function(event, treeElement)
+    _startEditingFromEvent: function(event)
     {
         if (this.treeOutline.focusedDOMNode != this.representedObject)
             return;
@@ -570,11 +613,31 @@ WebInspector.ElementsTreeElement.prototype = {
 
         var newAttribute = event.target.enclosingNodeOrSelfWithClass("add-attribute");
         if (newAttribute)
-            return this._addNewAttribute(treeElement.listItemElement);
+            return this._addNewAttribute();
 
         return false;
     },
 
+    _populateTagContextMenu: function(contextMenu, event)
+    {
+        var attribute = event.target.enclosingNodeOrSelfWithClass("webkit-html-attribute");
+        var newAttribute = event.target.enclosingNodeOrSelfWithClass("add-attribute");
+
+        // Add attribute-related actions.
+        contextMenu.appendItem(WebInspector.UIString("Add Attribute"), this._addNewAttribute.bind(this));
+        if (attribute && !newAttribute)
+            contextMenu.appendItem(WebInspector.UIString("Edit Attribute"), this._startEditingAttribute.bind(this, attribute, event.target));
+        contextMenu.appendSeparator();
+
+        // Add node-related actions.
+        contextMenu.appendItem(WebInspector.UIString("Delete Node"), this.remove.bind(this));
+    },
+
+    _populateTextContextMenu: function(contextMenu, textNode)
+    {
+        contextMenu.appendItem(WebInspector.UIString("Edit Text"), this._startEditingTextNode.bind(this, textNode));
+    },
+
     _startEditing: function()
     {
         if (this.treeOutline.focusedDOMNode !== this.representedObject)
@@ -588,7 +651,7 @@ WebInspector.ElementsTreeElement.prototype = {
             if (attribute)
                 return this._startEditingAttribute(attribute, attribute.getElementsByClassName("webkit-html-attribute-value")[0]);
 
-            return this._addNewAttribute(listItem);
+            return this._addNewAttribute();
         }
 
         if (this.representedObject.nodeType === Node.TEXT_NODE) {
@@ -599,7 +662,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
     },
 
-    _addNewAttribute: function(listItemElement)
+    _addNewAttribute: function()
     {
         var attr = document.createElement("span");
         attr.className = "webkit-html-attribute";
@@ -613,7 +676,7 @@ WebInspector.ElementsTreeElement.prototype = {
         attr.appendChild(name);
         attr.appendChild(value);
 
-        var tag = listItemElement.getElementsByClassName("webkit-html-tag")[0];
+        var tag = this.listItemElement.getElementsByClassName("webkit-html-tag")[0];
         this._insertInLastAttributePosition(tag, attr);
         return this._startEditingAttribute(attr, attr);
     },
@@ -731,7 +794,6 @@ WebInspector.ElementsTreeElement.prototype = {
 
         if (!parseElement.hasAttributes()) {
             this.representedObject.removeAttribute(attributeName);
-            this._updateTitle();
             moveToNextAttributeIfNeeded.call(this);
             return;
         }
@@ -748,8 +810,6 @@ WebInspector.ElementsTreeElement.prototype = {
         if (!foundOriginalAttribute)
             this.representedObject.removeAttribute(attributeName);
 
-        this._updateTitle();
-
         this.treeOutline.focusedNodeChanged(true);
 
         moveToNextAttributeIfNeeded.call(this);
@@ -768,26 +828,42 @@ WebInspector.ElementsTreeElement.prototype = {
             textNode = this.representedObject;
 
         textNode.nodeValue = newText;
-        this._updateTitle();
+
+        // No need to call _updateTitle here, it will be called after the nodeValue is committed.
     },
 
     _editingCancelled: function(element, context)
     {
         delete this._editing;
 
-        this._updateTitle();
+        // No need to call _updateTitle here, the editing code will revert to the original text.
     },
 
     _updateTitle: function()
     {
-        var title = this._nodeTitleInfo(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
-        this.title = "<span class=\"highlight\">" + title + "</span>";
-        delete this.selectionElement;
-        this.updateSelection();
-        this._preventFollowingLinksOnDoubleClick();
+        // If we are editing, return early to prevent canceling the edit.
+        // After editing is committed _updateTitle will be called.
+        if (this._editing)
+            return;
+
+        var self = this;
+        function callback(tooltipText)
+        {
+            var title = self._nodeTitleInfo(self.representedObject, self.hasChildren, WebInspector.linkifyURL, tooltipText).title;
+            self.title = "<span class=\"highlight\">" + title + "</span>";
+            delete self.selectionElement;
+            self.updateSelection();
+            self._preventFollowingLinksOnDoubleClick();
+        };
+
+        // TODO: Replace with InjectedScriptAccess.getBasicProperties(obj, [names]).
+        if (this.representedObject.nodeName.toLowerCase() !== "img")
+            callback();
+        else
+            this.createTooltipForImageNode(this.representedObject, callback);
     },
 
-    _nodeTitleInfo: function(node, hasChildren, linkify)
+    _nodeTitleInfo: function(node, hasChildren, linkify, tooltipText)
     {
         var info = {title: "", hasChildren: hasChildren};
         
@@ -807,7 +883,7 @@ WebInspector.ElementsTreeElement.prototype = {
                         var value = attr.value;
                         if (linkify && (attr.name === "src" || attr.name === "href")) {
                             var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
-                            info.title += linkify(attr.value, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a");
+                            info.title += linkify(attr.value, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a", tooltipText);
                         } else {
                             var value = value.escapeHTML();
                             value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
@@ -847,8 +923,8 @@ WebInspector.ElementsTreeElement.prototype = {
                         var newNode = document.createElement("span");
                         newNode.textContent = node.textContent;
                         
-                        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(null, null);
-                        cssSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighlighter(null, null);
+                        cssSyntaxHighlighter.syntaxHighlightNode(newNode);
                         
                         info.title = "<span class=\"webkit-html-text-node webkit-html-css-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
                     } else {
@@ -908,7 +984,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
 
         var callId = WebInspector.Callback.wrap(removeNodeCallback);
-        InspectorController.removeNode(callId, this.representedObject.id);
+        InspectorBackend.removeNode(callId, this.representedObject.id);
     }
 }
 
diff --git a/WebCore/inspector/front-end/EventListenersSidebarPane.js b/WebCore/inspector/front-end/EventListenersSidebarPane.js
index 2938196..c083c0e 100644
--- a/WebCore/inspector/front-end/EventListenersSidebarPane.js
+++ b/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -108,7 +108,7 @@ WebInspector.EventListenersSidebarPane.prototype = {
         var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
         Preferences.eventListenersFilter = selectedOption.value;
 
-        InspectorController.setSetting("event-listeners-filter", Preferences.eventListenersFilter);
+        InspectorFrontendHost.setSetting("event-listeners-filter", Preferences.eventListenersFilter);
 
         for (var i = 0; i < this.sections.length; ++i)
             this.sections[i].update();
diff --git a/WebCore/inspector/front-end/FontView.js b/WebCore/inspector/front-end/FontView.js
index 4e1c931..8468cc9 100644
--- a/WebCore/inspector/front-end/FontView.js
+++ b/WebCore/inspector/front-end/FontView.js
@@ -36,7 +36,7 @@ WebInspector.FontView = function(resource)
 
     this.fontStyleElement = document.createElement("style");
     this.fontStyleElement.textContent = "@font-face { font-family: \"" + uniqueFontName + "\"; src: url(" + this.resource.url + "); }";
-    document.getElementsByTagName("head").item(0).appendChild(this.fontStyleElement);
+    document.head.appendChild(this.fontStyleElement);
 
     this.fontPreviewElement = document.createElement("div");
     this.fontPreviewElement.className = "preview";
diff --git a/WebCore/inspector/front-end/Images/consoleIcon.png b/WebCore/inspector/front-end/Images/consoleIcon.png
new file mode 100644
index 0000000..94ffa95
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/consoleIcon.png
diff --git a/WebCore/inspector/front-end/InjectedScript.js b/WebCore/inspector/front-end/InjectedScript.js
index 3bed8da..209e99f 100644
--- a/WebCore/inspector/front-end/InjectedScript.js
+++ b/WebCore/inspector/front-end/InjectedScript.js
@@ -59,7 +59,8 @@ InjectedScript.getStyles = function(nodeId, authorOnly)
     var node = InjectedScript._nodeForId(nodeId);
     if (!node)
         return false;
-    var matchedRules = InjectedScript._window().getMatchedCSSRules(node, "", authorOnly);
+    var defaultView = node.ownerDocument.defaultView;
+    var matchedRules = defaultView.getMatchedCSSRules(node, "", authorOnly);
     var matchedCSSRules = [];
     for (var i = 0; matchedRules && i < matchedRules.length; ++i)
         matchedCSSRules.push(InjectedScript._serializeRule(matchedRules[i]));
@@ -72,7 +73,7 @@ InjectedScript.getStyles = function(nodeId, authorOnly)
     }
     var result = {};
     result.inlineStyle = InjectedScript._serializeStyle(node.style, true);
-    result.computedStyle = InjectedScript._serializeStyle(InjectedScript._window().getComputedStyle(node));
+    result.computedStyle = InjectedScript._serializeStyle(defaultView.getComputedStyle(node));
     result.matchedCSSRules = matchedCSSRules;
     result.styleAttributes = styleAttributes;
     return result;
@@ -83,7 +84,7 @@ InjectedScript.getComputedStyle = function(nodeId)
     var node = InjectedScript._nodeForId(nodeId);
     if (!node)
         return false;
-    return InjectedScript._serializeStyle(InjectedScript._window().getComputedStyle(node));
+    return InjectedScript._serializeStyle(node.ownerDocument.defaultView.getComputedStyle(node));
 }
 
 InjectedScript.getInlineStyle = function(nodeId)
@@ -230,15 +231,19 @@ InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNodeId)
 
 InjectedScript.addStyleSelector = function(newContent, selectedNodeId)
 {
-    var stylesheet = InjectedScript.stylesheet;
+    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
+    if (!selectedNode)
+        return false;
+    var ownerDocument = selectedNode.ownerDocument;
+
+    var stylesheet = ownerDocument.__stylesheet;
     if (!stylesheet) {
-        var inspectedDocument = InjectedScript._window().document;
-        var head = inspectedDocument.getElementsByTagName("head")[0];
-        var styleElement = inspectedDocument.createElement("style");
+        var head = ownerDocument.head;
+        var styleElement = ownerDocument.createElement("style");
         styleElement.type = "text/css";
         head.appendChild(styleElement);
-        stylesheet = inspectedDocument.styleSheets[inspectedDocument.styleSheets.length - 1];
-        InjectedScript.stylesheet = stylesheet;
+        stylesheet = ownerDocument.styleSheets[ownerDocument.styleSheets.length - 1];
+        ownerDocument.__stylesheet = stylesheet;
     }
 
     try {
@@ -248,7 +253,6 @@ InjectedScript.addStyleSelector = function(newContent, selectedNodeId)
         return false;
     }
 
-    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
     var rule = stylesheet.cssRules[stylesheet.cssRules.length - 1];
     rule.__isViaInspector = true;
 
@@ -557,7 +561,7 @@ InjectedScript._evaluateAndWrap = function(evalFunction, object, expression, obj
 {
     var result = {};
     try {
-        result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
+        result.value = InjectedScriptHost.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
         // Handle error that might have happened while describing result.
         if (result.value.errorText) {
             result.value = result.value.errorText;
@@ -575,7 +579,7 @@ InjectedScript._evaluateOn = function(evalFunction, object, expression)
     InjectedScript._ensureCommandLineAPIInstalled(evalFunction, object);
     // Surround the expression in with statements to inject our command line API so that
     // the window object properties still take more precedent than our API functions.
-    expression = "with (window.console._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
+    expression = "with (window.console._inspectorCommandLineAPI) { with (window) {\n" + expression + "\n} }";
     var value = evalFunction.call(object, expression);
 
     // When evaluating on call frame error is not thrown, but returned as a value.
@@ -642,10 +646,10 @@ InjectedScript.performSearch = function(whitespaceTrimmedQuery)
 
             node[searchResultsProperty] = true;
             InjectedScript._searchResults.push(node);
-            var nodeId = InspectorController.pushNodePathToFrontend(node, false);
+            var nodeId = InjectedScriptHost.pushNodePathToFrontend(node, false);
             nodeIds.push(nodeId);
         }
-        InspectorController.addNodesToSearchResult(nodeIds.join(","));
+        InjectedScriptHost.addNodesToSearchResult(nodeIds.join(","));
     }
 
     function matchExactItems(doc)
@@ -844,7 +848,7 @@ InjectedScript.openInInspectedWindow = function(url)
 
 InjectedScript.getCallFrames = function()
 {
-    var callFrame = InspectorController.currentCallFrame();
+    var callFrame = InjectedScriptHost.currentCallFrame();
     if (!callFrame)
         return false;
 
@@ -867,7 +871,7 @@ InjectedScript.evaluateInCallFrame = function(callFrameId, code, objectGroup)
 
 InjectedScript._callFrameForId = function(id)
 {
-    var callFrame = InspectorController.currentCallFrame();
+    var callFrame = InjectedScriptHost.currentCallFrame();
     while (--id >= 0 && callFrame)
         callFrame = callFrame.caller;
     return callFrame;
@@ -875,7 +879,7 @@ InjectedScript._callFrameForId = function(id)
 
 InjectedScript._clearConsoleMessages = function()
 {
-    InspectorController.clearMessages(true);
+    InjectedScriptHost.clearMessages(true);
 }
 
 InjectedScript._inspectObject = function(o)
@@ -886,90 +890,105 @@ InjectedScript._inspectObject = function(o)
     var inspectedWindow = InjectedScript._window();
     inspectedWindow.console.log(o);
     if (Object.type(o) === "node") {
-        InspectorController.pushNodePathToFrontend(o, true);
+        InjectedScriptHost.pushNodePathToFrontend(o, true);
     } else {
         switch (Object.describe(o)) {
             case "Database":
-                InspectorController.selectDatabase(o);
+                InjectedScriptHost.selectDatabase(o);
                 break;
             case "Storage":
-                InspectorController.selectDOMStorage(o);
+                InjectedScriptHost.selectDOMStorage(o);
                 break;
         }
     }
 }
 
+InjectedScript._copy = function(o)
+{
+    if (Object.type(o) === "node") {
+        var nodeId = InjectedScriptHost.pushNodePathToFrontend(o, false);
+        InjectedScriptHost.copyNode(nodeId);
+    } else {
+        InjectedScriptHost.copyText(o);
+    }
+}
+
 InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObject)
 {
     if (evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI"))
         return;
-    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI = { \
-        $: function() { return document.getElementById.apply(document, arguments) }, \
-        $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
-        $x: function(xpath, context) { \
-            var nodes = []; \
-            try { \
-                var doc = context || document; \
-                var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \
-                var node; \
-                while (node = results.iterateNext()) nodes.push(node); \
-            } catch (e) {} \
-            return nodes; \
-        }, \
-        dir: function() { return console.dir.apply(console, arguments) }, \
-        dirxml: function() { return console.dirxml.apply(console, arguments) }, \
-        keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \
-        values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
-        profile: function() { return console.profile.apply(console, arguments) }, \
-        profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
-        _logEvent: function _inspectorCommandLineAPI_logEvent(e) { console.log(e.type, e); }, \
-        _allEventTypes: [\"mouse\", \"key\", \"load\", \"unload\", \"abort\", \"error\", \
-            \"select\", \"change\", \"submit\", \"reset\", \"focus\", \"blur\", \
-            \"resize\", \"scroll\"], \
-        _normalizeEventTypes: function(t) { \
-            if (typeof t === \"undefined\") \
-                t = _inspectorCommandLineAPI._allEventTypes; \
-            else if (typeof t === \"string\") \
-                t = [t]; \
-            var i, te = []; \
-            for (i = 0; i < t.length; i++) { \
-                if (t[i] === \"mouse\") \
-                    te.splice(0, 0, \"mousedown\", \"mouseup\", \"click\", \"dblclick\", \
-                        \"mousemove\", \"mouseover\", \"mouseout\"); \
-                else if (t[i] === \"key\") \
-                    te.splice(0, 0, \"keydown\", \"keyup\", \"keypress\"); \
-                else \
-                    te.push(t[i]); \
-            } \
-            return te; \
-        }, \
-        monitorEvent: function(o, t) { \
-            if (!o || !o.addEventListener || !o.removeEventListener) \
-                return; \
-            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
-            for (i = 0; i < t.length; i++) { \
-                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
-                o.addEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
-            } \
-        }, \
-        unmonitorEvent: function(o, t) { \
-            if (!o || !o.removeEventListener) \
-                return; \
-            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
-            for (i = 0; i < t.length; i++) { \
-                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
-            } \
-        }, \
-        _inspectedNodes: [], \
-        get $0() { return console._inspectorCommandLineAPI._inspectedNodes[0] }, \
-        get $1() { return console._inspectorCommandLineAPI._inspectedNodes[1] }, \
-        get $2() { return console._inspectorCommandLineAPI._inspectedNodes[2] }, \
-        get $3() { return console._inspectorCommandLineAPI._inspectedNodes[3] }, \
-        get $4() { return console._inspectorCommandLineAPI._inspectedNodes[4] } \
+    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI = { \n\
+        $: function() { return document.getElementById.apply(document, arguments) }, \n\
+        $$: function() { return document.querySelectorAll.apply(document, arguments) }, \n\
+        $x: function(xpath, context) \n\
+        { \n\
+            var nodes = []; \n\
+            try { \n\
+                var doc = context || document; \n\
+                var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \n\
+                var node; \n\
+                while (node = results.iterateNext()) nodes.push(node); \n\
+            } catch (e) {} \n\
+            return nodes; \n\
+        }, \n\
+        dir: function() { return console.dir.apply(console, arguments) }, \n\
+        dirxml: function() { return console.dirxml.apply(console, arguments) }, \n\
+        keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \n\
+        values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \n\
+        profile: function() { return console.profile.apply(console, arguments) }, \n\
+        profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \n\
+        _logEvent: function _inspectorCommandLineAPI_logEvent(e) { console.log(e.type, e); }, \n\
+        _allEventTypes: [\"mouse\", \"key\", \"load\", \"unload\", \"abort\", \"error\", \n\
+            \"select\", \"change\", \"submit\", \"reset\", \"focus\", \"blur\", \n\
+            \"resize\", \"scroll\"], \n\
+        _normalizeEventTypes: function(t) \n\
+        { \n\
+            if (typeof t === \"undefined\") \n\
+                t = console._inspectorCommandLineAPI._allEventTypes; \n\
+            else if (typeof t === \"string\") \n\
+                t = [t]; \n\
+            var i, te = []; \n\
+            for (i = 0; i < t.length; i++) { \n\
+                if (t[i] === \"mouse\") \n\
+                    te.splice(0, 0, \"mousedown\", \"mouseup\", \"click\", \"dblclick\", \n\
+                        \"mousemove\", \"mouseover\", \"mouseout\"); \n\
+                else if (t[i] === \"key\") \n\
+                    te.splice(0, 0, \"keydown\", \"keyup\", \"keypress\"); \n\
+                else \n\
+                    te.push(t[i]); \n\
+            } \n\
+            return te; \n\
+        }, \n\
+        monitorEvents: function(o, t) \n\
+        { \n\
+            if (!o || !o.addEventListener || !o.removeEventListener) \n\
+                return; \n\
+            t = console._inspectorCommandLineAPI._normalizeEventTypes(t); \n\
+            for (i = 0; i < t.length; i++) { \n\
+                o.removeEventListener(t[i], console._inspectorCommandLineAPI._logEvent, false); \n\
+                o.addEventListener(t[i], console._inspectorCommandLineAPI._logEvent, false); \n\
+            } \n\
+        }, \n\
+        unmonitorEvents: function(o, t) \n\
+        { \n\
+            if (!o || !o.removeEventListener) \n\
+                return; \n\
+            t = console._inspectorCommandLineAPI._normalizeEventTypes(t); \n\
+            for (i = 0; i < t.length; i++) { \n\
+                o.removeEventListener(t[i], console._inspectorCommandLineAPI._logEvent, false); \n\
+            } \n\
+        }, \n\
+        _inspectedNodes: [], \n\
+        get $0() { return console._inspectorCommandLineAPI._inspectedNodes[0] }, \n\
+        get $1() { return console._inspectorCommandLineAPI._inspectedNodes[1] }, \n\
+        get $2() { return console._inspectorCommandLineAPI._inspectedNodes[2] }, \n\
+        get $3() { return console._inspectorCommandLineAPI._inspectedNodes[3] }, \n\
+        get $4() { return console._inspectorCommandLineAPI._inspectedNodes[4] }, \n\
     };");
 
-    inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
-    inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
+    inspectorCommandLineAPI.clear = InjectedScriptHost.wrapCallback(InjectedScript._clearConsoleMessages);
+    inspectorCommandLineAPI.inspect = InjectedScriptHost.wrapCallback(InjectedScript._inspectObject);
+    inspectorCommandLineAPI.copy = InjectedScriptHost.wrapCallback(InjectedScript._copy);
 }
 
 InjectedScript._resolveObject = function(objectProxy)
@@ -993,14 +1012,14 @@ InjectedScript._window = function()
 {
     // TODO: replace with 'return window;' once this script is injected into
     // the page's context.
-    return InspectorController.inspectedWindow();
+    return InjectedScriptHost.inspectedWindow();
 }
 
 InjectedScript._nodeForId = function(nodeId)
 {
     if (!nodeId)
         return null;
-    return InspectorController.nodeForId(nodeId);
+    return InjectedScriptHost.nodeForId(nodeId);
 }
 
 InjectedScript._objectForId = function(objectId)
@@ -1012,7 +1031,7 @@ InjectedScript._objectForId = function(objectId)
     if (typeof objectId === "number") {
         return InjectedScript._nodeForId(objectId);
     } else if (typeof objectId === "string") {
-        return InspectorController.unwrapObject(objectId);
+        return InjectedScriptHost.unwrapObject(objectId);
     } else if (typeof objectId === "object") {
         var callFrame = InjectedScript._callFrameForId(objectId.callFrame);
         if (objectId.thisObject)
@@ -1028,7 +1047,14 @@ InjectedScript.pushNodeToFrontend = function(objectProxy)
     var object = InjectedScript._resolveObject(objectProxy);
     if (!object || Object.type(object) !== "node")
         return false;
-    return InspectorController.pushNodePathToFrontend(object, false);
+    return InjectedScriptHost.pushNodePathToFrontend(object, false);
+}
+
+InjectedScript.nodeByPath = function(path)
+{
+    // We make this call through the injected script only to get a nice
+    // callback for it.
+    return InjectedScriptHost.pushNodeByPathToFrontend(path.join(","));
 }
 
 // Called from within InspectorController on the 'inspected page' side.
@@ -1111,23 +1137,23 @@ InjectedScript.executeSql = function(callId, databaseId, query)
                 data[columnIdentifier] = String(text);
             }
         }
-        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(result), false);
+        InjectedScriptHost.reportDidDispatchOnInjectedScript(callId, JSON.stringify(result), false);
     }
 
     function errorCallback(tx, error)
     {
-        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(error), false);
+        InjectedScriptHost.reportDidDispatchOnInjectedScript(callId, JSON.stringify(error), false);
     }
 
     function queryTransaction(tx)
     {
-        tx.executeSql(query, null, InspectorController.wrapCallback(successCallback), InspectorController.wrapCallback(errorCallback));
+        tx.executeSql(query, null, InjectedScriptHost.wrapCallback(successCallback), InjectedScriptHost.wrapCallback(errorCallback));
     }
 
-    var database = InspectorController.databaseForId(databaseId);
+    var database = InjectedScriptHost.databaseForId(databaseId);
     if (!database)
         errorCallback(null, { code : 2 });  // Return as unexpected version.
-    database.transaction(InspectorController.wrapCallback(queryTransaction), InspectorController.wrapCallback(errorCallback));
+    database.transaction(InjectedScriptHost.wrapCallback(queryTransaction), InjectedScriptHost.wrapCallback(errorCallback));
     return true;
 }
 
@@ -1197,8 +1223,6 @@ Object.describe = function(obj, abbreviated)
         else if (abbreviated)
             objectText = /.*/.exec(obj)[0].replace(/ +$/g, "");
         return objectText;
-    case "regexp":
-        return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
     default:
         return String(obj);
     }
diff --git a/WebCore/inspector/front-end/InjectedScriptAccess.js b/WebCore/inspector/front-end/InjectedScriptAccess.js
index c6d4b65..14a3a6b 100644
--- a/WebCore/inspector/front-end/InjectedScriptAccess.js
+++ b/WebCore/inspector/front-end/InjectedScriptAccess.js
@@ -47,11 +47,11 @@ InjectedScriptAccess._installHandler = function(methodName, async)
                 WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage("Error dispatching: " + methodName));
         }
         var callId = WebInspector.Callback.wrap(myCallback);
-        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString, !!async);
+        InspectorBackend.dispatchOnInjectedScript(callId, methodName, argsString, !!async);
     };
 }
 
-// InjectedScriptAccess message forwarding puts some constraints on the way methods are imlpemented and called:
+// InjectedScriptAccess message forwarding puts some constraints on the way methods are implemented and called:
 // - Make sure corresponding methods in InjectedScript return non-null and non-undefined values,
 // - Make sure last parameter of all the InjectedSriptAccess.* calls is a callback function.
 // We keep these sorted.
@@ -70,6 +70,7 @@ InjectedScriptAccess._installHandler("getStyles");
 InjectedScriptAccess._installHandler("openInInspectedWindow");
 InjectedScriptAccess._installHandler("performSearch");
 InjectedScriptAccess._installHandler("pushNodeToFrontend");
+InjectedScriptAccess._installHandler("nodeByPath");
 InjectedScriptAccess._installHandler("searchCanceled");
 InjectedScriptAccess._installHandler("setPropertyValue");
 InjectedScriptAccess._installHandler("setStyleProperty");
diff --git a/WebCore/inspector/front-end/InspectorBackendStub.js b/WebCore/inspector/front-end/InspectorBackendStub.js
new file mode 100644
index 0000000..1710b12
--- /dev/null
+++ b/WebCore/inspector/front-end/InspectorBackendStub.js
@@ -0,0 +1,290 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+if (!window.InspectorBackend) {
+
+WebInspector.InspectorBackendStub = function()
+{
+    this._searchingForNode = false;
+    this._attachedWindowHeight = 0;
+    this._debuggerEnabled = true;
+    this._profilerEnabled = true;
+    this._resourceTrackingEnabled = false;
+    this._timelineEnabled = false;
+    this._settings = {};
+}
+
+WebInspector.InspectorBackendStub.prototype = {
+    wrapCallback: function(func)
+    {
+        return func;
+    },
+
+    platform: function()
+    {
+        return "mac-leopard";
+    },
+
+    port: function()
+    {
+        return "unknown";
+    },
+
+
+    closeWindow: function()
+    {
+        this._windowVisible = false;
+    },
+
+    attach: function()
+    {
+    },
+
+    detach: function()
+    {
+    },
+
+    storeLastActivePanel: function(panel)
+    {
+    },
+
+    clearMessages: function()
+    {
+    },
+
+    searchingForNode: function()
+    {
+        return this._searchingForNode;
+    },
+
+    search: function(sourceRow, query)
+    {
+    },
+
+    toggleNodeSearch: function()
+    {
+        this._searchingForNode = !this._searchingForNode;
+    },
+
+    setAttachedWindowHeight: function(height)
+    {
+    },
+
+    moveByUnrestricted: function(x, y)
+    {
+    },
+
+
+    addResourceSourceToFrame: function(identifier, element)
+    {
+    },
+
+    addSourceToFrame: function(mimeType, source, element)
+    {
+        return false;
+    },
+
+    getResourceDocumentNode: function(identifier)
+    {
+        return undefined;
+    },
+
+    highlightDOMNode: function(node)
+    {
+    },
+
+    hideDOMNodeHighlight: function()
+    {
+    },
+
+    inspectedWindow: function()
+    {
+        return window;
+    },
+
+    loaded: function()
+    {
+    },
+
+    localizedStringsURL: function()
+    {
+        return undefined;
+    },
+
+    windowUnloading: function()
+    {
+        return false;
+    },
+
+    hiddenPanels: function()
+    {
+        return "";
+    },
+
+    debuggerEnabled: function()
+    {
+        return this._debuggerEnabled;
+    },
+
+    enableResourceTracking: function()
+    {
+        this._resourceTrackingEnabled = true;
+        WebInspector.resourceTrackingWasEnabled();
+    },
+
+    disableResourceTracking: function()
+    {
+        this._resourceTrackingEnabled = false;
+        WebInspector.resourceTrackingWasDisabled();
+    },
+
+    resourceTrackingEnabled: function()
+    {
+        return this._resourceTrackingEnabled;
+    },
+
+    enableDebugger: function()
+    {
+        this._debuggerEnabled = true;
+    },
+
+    disableDebugger: function()
+    {
+        this._debuggerEnabled = false;
+    },
+
+    addBreakpoint: function(sourceID, line, condition)
+    {
+    },
+
+    removeBreakpoint: function(sourceID, line)
+    {
+    },
+
+    updateBreakpoint: function(sourceID, line, condition)
+    {
+    },
+
+    pauseInDebugger: function()
+    {
+    },
+
+    pauseOnExceptions: function()
+    {
+        return false;
+    },
+
+    setPauseOnExceptions: function(value)
+    {
+    },
+
+    resumeDebugger: function()
+    {
+    },
+
+    profilerEnabled: function()
+    {
+        return true;
+    },
+
+    enableProfiler: function()
+    {
+        this._profilerEnabled = true;
+    },
+
+    disableProfiler: function()
+    {
+        this._profilerEnabled = false;
+    },
+
+    startProfiling: function()
+    {
+    },
+
+    stopProfiling: function()
+    {
+    },
+
+    getProfileHeaders: function(callId)
+    {
+        WebInspector.didGetProfileHeaders(callId, []);
+    },
+
+    getProfile: function(callId, uid)
+    {
+        if (WebInspector.__fullProfiles && (uid in WebInspector.__fullProfiles))
+        {
+            WebInspector.didGetProfile(callId, WebInspector.__fullProfiles[uid]);
+        }
+    },
+
+    takeHeapSnapshot: function()
+    {
+    },
+
+    databaseTableNames: function(database)
+    {
+        return [];
+    },
+
+    stepIntoStatementInDebugger: function()
+    {
+    },
+
+    stepOutOfFunctionInDebugger: function()
+    {
+    },
+
+    stepOverStatementInDebugger: function()
+    {
+    },
+
+    setSetting: function(setting, value)
+    {
+        this._settings[setting] = value;
+    },
+
+    dispatchOnInjectedScript: function()
+    {
+    },
+
+    releaseWrapperObjectGroup: function()
+    {
+    },
+
+    setting: function(setting)
+    {
+        return this._settings[setting];
+    }
+}
+
+InspectorBackend = new WebInspector.InspectorBackendStub();
+
+}
diff --git a/WebCore/inspector/front-end/InspectorControllerStub.js b/WebCore/inspector/front-end/InspectorControllerStub.js
index 6fb5a1b..e69de29 100644
--- a/WebCore/inspector/front-end/InspectorControllerStub.js
+++ b/WebCore/inspector/front-end/InspectorControllerStub.js
@@ -1,291 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-if (!window.InspectorController) {
-
-WebInspector.InspectorControllerStub = function()
-{
-    this._searchingForNode = false;
-    this._windowVisible = true;
-    this._attachedWindowHeight = 0;
-    this._debuggerEnabled = true;
-    this._profilerEnabled = true;
-    this._resourceTrackingEnabled = false;
-    this._timelineEnabled = false;
-    this._settings = {};
-}
-
-WebInspector.InspectorControllerStub.prototype = {
-    wrapCallback: function(func)
-    {
-        return func;
-    },
-
-    isWindowVisible: function()
-    {
-        return this._windowVisible;
-    },
-
-    platform: function()
-    {
-        return "mac-leopard";
-    },
-
-
-    closeWindow: function()
-    {
-        this._windowVisible = false;
-    },
-
-    attach: function()
-    {
-    },
-
-    detach: function()
-    {
-    },
-
-    storeLastActivePanel: function(panel)
-    {
-    },
-
-    clearMessages: function()
-    {
-    },
-
-    searchingForNode: function()
-    {
-        return this._searchingForNode;
-    },
-
-    search: function(sourceRow, query)
-    {
-    },
-
-    toggleNodeSearch: function()
-    {
-        this._searchingForNode = !this._searchingForNode;
-    },
-
-    setAttachedWindowHeight: function(height)
-    {
-    },
-
-    moveByUnrestricted: function(x, y)
-    {
-    },
-
-
-    addResourceSourceToFrame: function(identifier, element)
-    {
-    },
-
-    addSourceToFrame: function(mimeType, source, element)
-    {
-        return false;
-    },
-
-    getResourceDocumentNode: function(identifier)
-    {
-        return undefined;
-    },
-
-    highlightDOMNode: function(node)
-    {
-    },
-
-    hideDOMNodeHighlight: function()
-    {
-    },
-
-    inspectedWindow: function()
-    {
-        return window;
-    },
-
-    loaded: function()
-    {
-    },
-
-    localizedStringsURL: function()
-    {
-        return undefined;
-    },
-
-    windowUnloading: function()
-    {
-        return false;
-    },
-
-    hiddenPanels: function()
-    {
-        return "";
-    },
-
-    debuggerEnabled: function()
-    {
-        return this._debuggerEnabled;
-    },
-
-    enableResourceTracking: function()
-    {
-        this._resourceTrackingEnabled = true;
-        WebInspector.resourceTrackingWasEnabled();
-    },
-
-    disableResourceTracking: function()
-    {
-        this._resourceTrackingEnabled = false;
-        WebInspector.resourceTrackingWasDisabled();
-    },
-
-    resourceTrackingEnabled: function()
-    {
-        return this._resourceTrackingEnabled;
-    },
-
-    enableDebugger: function()
-    {
-        this._debuggerEnabled = true;
-    },
-
-    disableDebugger: function()
-    {
-        this._debuggerEnabled = false;
-    },
-
-    addBreakpoint: function(sourceID, line, condition)
-    {
-    },
-
-    removeBreakpoint: function(sourceID, line)
-    {
-    },
-
-    updateBreakpoint: function(sourceID, line, condition)
-    {
-    },
-
-    pauseInDebugger: function()
-    {
-    },
-
-    pauseOnExceptions: function()
-    {
-        return false;
-    },
-
-    setPauseOnExceptions: function(value)
-    {
-    },
-
-    resumeDebugger: function()
-    {
-    },
-
-    profilerEnabled: function()
-    {
-        return true;
-    },
-
-    enableProfiler: function()
-    {
-        this._profilerEnabled = true;
-    },
-
-    disableProfiler: function()
-    {
-        this._profilerEnabled = false;
-    },
-
-    startProfiling: function()
-    {
-    },
-
-    stopProfiling: function()
-    {
-    },
-
-    getProfileHeaders: function(callId)
-    {
-        WebInspector.didGetProfileHeaders(callId, []);
-    },
-
-    getProfile: function(callId, uid)
-    {
-        if (WebInspector.__fullProfiles && (uid in WebInspector.__fullProfiles))
-        {
-            WebInspector.didGetProfile(callId, WebInspector.__fullProfiles[uid]);
-        }
-    },
-
-    takeHeapSnapshot: function()
-    {
-    },
-
-    databaseTableNames: function(database)
-    {
-        return [];
-    },
-
-    stepIntoStatementInDebugger: function()
-    {
-    },
-
-    stepOutOfFunctionInDebugger: function()
-    {
-    },
-
-    stepOverStatementInDebugger: function()
-    {
-    },
-
-    setSetting: function(setting, value)
-    {
-        this._settings[setting] = value;
-    },
-
-    dispatchOnInjectedScript: function()
-    {
-    },
-
-    releaseWrapperObjectGroup: function()
-    {
-    },
-
-    setting: function(setting)
-    {
-        return this._settings[setting];
-    }
-}
-
-window.InspectorController = new WebInspector.InspectorControllerStub();
-
-}
diff --git a/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/WebCore/inspector/front-end/InspectorFrontendHostStub.js
new file mode 100644
index 0000000..facea4e
--- /dev/null
+++ b/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+if (!window.InspectorFrontendHost) {
+
+WebInspector.InspectorFrontendHostStub = function()
+{
+    this._attachedWindowHeight = 0;
+    this._settings = {};
+}
+
+WebInspector.InspectorFrontendHostStub.prototype = {
+    platform: function()
+    {
+        return "mac-leopard";
+    },
+
+    port: function()
+    {
+        return "unknown";
+    },
+
+    closeWindow: function()
+    {
+        this._windowVisible = false;
+    },
+
+    attach: function()
+    {
+    },
+
+    detach: function()
+    {
+    },
+
+    search: function(sourceRow, query)
+    {
+    },
+
+    setAttachedWindowHeight: function(height)
+    {
+    },
+
+    moveWindowBy: function(x, y)
+    {
+    },
+
+    addResourceSourceToFrame: function(identifier, element)
+    {
+    },
+
+    addSourceToFrame: function(mimeType, source, element)
+    {
+        return false;
+    },
+
+    loaded: function()
+    {
+    },
+
+    localizedStringsURL: function()
+    {
+        return undefined;
+    },
+
+    hiddenPanels: function()
+    {
+        return "";
+    },
+
+    setSetting: function(setting, value)
+    {
+        this._settings[setting] = value;
+    },
+
+    setting: function(setting)
+    {
+        return this._settings[setting];
+    }
+}
+
+InspectorFrontendHost = new WebInspector.InspectorFrontendHostStub();
+
+}
diff --git a/WebCore/inspector/front-end/KeyboardShortcut.js b/WebCore/inspector/front-end/KeyboardShortcut.js
index ed28a48..0a068d5 100644
--- a/WebCore/inspector/front-end/KeyboardShortcut.js
+++ b/WebCore/inspector/front-end/KeyboardShortcut.js
@@ -44,6 +44,7 @@ WebInspector.KeyboardShortcut.Modifiers = {
 };
 
 WebInspector.KeyboardShortcut.KeyCodes = {
+    Backspace: 8,
     Esc: 27,
     Space: 32,
     PageUp: 33,      // also NUM_NORTH_EAST
@@ -54,6 +55,7 @@ WebInspector.KeyboardShortcut.KeyCodes = {
     Up: 38,          // also NUM_NORTH
     Right: 39,       // also NUM_EAST
     Down: 40,        // also NUM_SOUTH
+    Delete: 46,
     F1: 112,
     F2: 113,
     F3: 114,
@@ -76,12 +78,14 @@ WebInspector.KeyboardShortcut.KeyCodes = {
 
 /**
  * Creates a number encoding keyCode in the lower 8 bits and modifiers mask in the higher 8 bits.
- * It is usefull for matching pressed keys.
- * @param {number} keyCode Code of the key.
- * @param {number} optModifiers Optional list of modifiers passed as additional paramerters.
+ * It is useful for matching pressed keys.
+ * keyCode is the Code of the key, or a character "a-z" which is converted to a keyCode value.
+ * optModifiers is an Optional list of modifiers passed as additional paramerters.
  */
 WebInspector.KeyboardShortcut.makeKey = function(keyCode, optModifiers)
 {
+    if (typeof keyCode === "string")
+        keyCode = keyCode.charCodeAt(0) - 32;
     var modifiers = WebInspector.KeyboardShortcut.Modifiers.None;
     for (var i = 1; i < arguments.length; i++)
         modifiers |= arguments[i];
diff --git a/WebCore/inspector/front-end/MetricsSidebarPane.js b/WebCore/inspector/front-end/MetricsSidebarPane.js
index a33653b..f5e6758 100644
--- a/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -35,27 +35,22 @@ WebInspector.MetricsSidebarPane = function()
 WebInspector.MetricsSidebarPane.prototype = {
     update: function(node)
     {
-        var body = this.bodyElement;
-
-        body.removeChildren();
-
         if (node)
             this.node = node;
         else
             node = this.node;
 
-        if (!node || !node.ownerDocument.defaultView)
-            return;
-
-        if (node.nodeType !== Node.ELEMENT_NODE)
+        if (!node || !node.ownerDocument.defaultView || node.nodeType !== Node.ELEMENT_NODE) {
+            this.bodyElement.removeChildren();
             return;
+        }
 
         var self = this;
         var callback = function(stylePayload) {
             if (!stylePayload)
                 return;
             var style = WebInspector.CSSStyleDeclaration.parseStyle(stylePayload);
-            self._update(node, body, style);
+            self._update(style);
         };
         InjectedScriptAccess.getComputedStyle(node.id, callback);
 
@@ -67,7 +62,7 @@ WebInspector.MetricsSidebarPane.prototype = {
         InjectedScriptAccess.getInlineStyle(node.id, inlineStyleCallback);
     },
 
-    _update: function(node, body, style)
+    _update: function(style)
     {
         var metricsElement = document.createElement("div");
         metricsElement.className = "metrics";
@@ -169,7 +164,8 @@ WebInspector.MetricsSidebarPane.prototype = {
         }
 
         metricsElement.appendChild(previousBox);
-        body.appendChild(metricsElement);
+        this.bodyElement.removeChildren();
+        this.bodyElement.appendChild(metricsElement);
     },
 
     startEditing: function(targetElement, box, styleProperty)
diff --git a/WebCore/inspector/front-end/ObjectPropertiesSection.js b/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 8bb4e35..7bdf17f 100644
--- a/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -150,7 +150,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         InjectedScriptAccess.getProperties(this.property.value, false, callback.bind(this));
     },
 
-    ondblclick: function(element, event)
+    ondblclick: function(event)
     {
         this.startEditing();
     },
diff --git a/WebCore/inspector/front-end/ObjectProxy.js b/WebCore/inspector/front-end/ObjectProxy.js
index bb4afa5..f4a59a7 100644
--- a/WebCore/inspector/front-end/ObjectProxy.js
+++ b/WebCore/inspector/front-end/ObjectProxy.js
@@ -45,6 +45,24 @@ WebInspector.ObjectProxy.wrapPrimitiveValue = function(value)
     return proxy;
 }
 
+WebInspector.ObjectProxy.getPropertiesAsync = function(objectProxy, propertiesToQueryFor, callback)
+{
+    function createPropertiesMapThenCallback(propertiesPayload)
+    {
+        if (!propertiesPayload) {
+            callback();
+            return;
+        }
+
+        var result = [];
+        for (var i = 0; i < propertiesPayload.length; ++i)
+            if (propertiesToQueryFor.indexOf(propertiesPayload[i].name) !== -1)
+                result[propertiesPayload[i].name] = propertiesPayload[i].value.description;
+        callback(result);
+    };
+    InjectedScriptAccess.getProperties(objectProxy, true, createPropertiesMapThenCallback);
+}
+
 WebInspector.ObjectPropertyProxy = function(name, value)
 {
     this.name = name;
diff --git a/WebCore/inspector/front-end/Panel.js b/WebCore/inspector/front-end/Panel.js
index 6cd200b..d816ce5 100644
--- a/WebCore/inspector/front-end/Panel.js
+++ b/WebCore/inspector/front-end/Panel.js
@@ -231,8 +231,11 @@ WebInspector.Panel.prototype = {
             showFirstResult = true;
         }
 
-        if (currentView !== this.visibleView)
-            this.showView(currentView);
+        if (currentView !== this.visibleView) {
+            currentView = this.visibleView;
+            this._currentSearchResultIndex = 0;
+            showFirstResult = true;
+        }
 
         if (showFirstResult)
             currentView.jumpToFirstSearchResult();
diff --git a/WebCore/inspector/front-end/ProfileView.js b/WebCore/inspector/front-end/ProfileView.js
index afced41..c164e94 100644
--- a/WebCore/inspector/front-end/ProfileView.js
+++ b/WebCore/inspector/front-end/ProfileView.js
@@ -83,7 +83,7 @@ WebInspector.CPUProfileView = function(profile)
     var self = this;
     function profileCallback(profile)
     {
-        self.profile.representedObject = profile;
+        self.profile = profile;
         self._assignParentsInProfile();
       
         self.profileDataGridTree = self.bottomUpProfileDataGridTree;
@@ -95,7 +95,7 @@ WebInspector.CPUProfileView = function(profile)
     }
 
     var callId = WebInspector.Callback.wrap(profileCallback);
-    InspectorController.getProfile(callId, this.profile.uid);
+    InspectorBackend.getProfile(callId, this.profile.uid);
 }
 
 WebInspector.CPUProfileView.prototype = {
@@ -505,7 +505,7 @@ WebInspector.CPUProfileView.prototype = {
 
     _sortData: function(event)
     {
-        this._sortProfile(this.profile.representedObject);
+        this._sortProfile(this.profile);
     },
 
     _sortProfile: function()
@@ -594,9 +594,9 @@ WebInspector.CPUProfileType.prototype = {
         this._recording = !this._recording;
 
         if (this._recording)
-            InspectorController.startProfiling();
+            InspectorBackend.startProfiling();
         else
-            InspectorController.stopProfiling();
+            InspectorBackend.stopProfiling();
     },
 
     setRecordingProfile: function(isProfiling)
@@ -616,26 +616,3 @@ WebInspector.CPUProfileType.prototype = {
 }
 
 WebInspector.CPUProfileType.prototype.__proto__ = WebInspector.ProfileType.prototype;
-
-WebInspector.CPUProfile = function(profile)
-{
-    this.representedObject = profile;
-    this.typeId = WebInspector.CPUProfileType.TypeId;
-}
-
-WebInspector.CPUProfile.prototype = {
-    get title()
-    {
-        return this.representedObject.title;
-    },
-
-    get uid()
-    {
-        return this.representedObject.uid;
-    },
-
-    get head()
-    {
-        return this.representedObject.head;
-    }
-}
diff --git a/WebCore/inspector/front-end/ProfilesPanel.js b/WebCore/inspector/front-end/ProfilesPanel.js
index 74c2bb6..b276ecb 100644
--- a/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/WebCore/inspector/front-end/ProfilesPanel.js
@@ -210,8 +210,9 @@ WebInspector.ProfilesPanel.prototype = {
         return escape(text) + '/' + escape(profileTypeId);
     },
 
-    addProfileHeader: function(typeId, profile)
+    addProfileHeader: function(profile)
     {
+        var typeId = profile.typeId;
         var profileType = this.getProfileType(typeId);
         var sidebarParent = profileType.treeElement;
         var small = false;
@@ -361,7 +362,8 @@ WebInspector.ProfilesPanel.prototype = {
 
         var profilesLength = this._profiles.length;
         for (var i = 0; i < profilesLength; ++i) {
-            var view = this._profiles[i].viewForProfile();
+            var profile = this._profiles[i];
+            var view = profile.__profilesPanelProfileType.viewForProfile(profile);
             if (!view.performSearch || view === visibleView)
                 continue;
             views.push(view);
@@ -398,7 +400,7 @@ WebInspector.ProfilesPanel.prototype = {
     _updateInterface: function()
     {
         // FIXME: Replace ProfileType-specific button visibility changes by a single ProfileType-agnostic "combo-button" visibility change.
-        if (InspectorController.profilerEnabled()) {
+        if (InspectorBackend.profilerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Profiling enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
             for (var typeId in this._profileTypeButtonsByIdMap)
@@ -417,26 +419,27 @@ WebInspector.ProfilesPanel.prototype = {
 
     _enableProfiling: function()
     {
-        if (InspectorController.profilerEnabled())
+        if (InspectorBackend.profilerEnabled())
             return;
         this._toggleProfiling(this.panelEnablerView.alwaysEnabled);
     },
 
     _toggleProfiling: function(optionalAlways)
     {
-        if (InspectorController.profilerEnabled())
-            InspectorController.disableProfiler(true);
+        if (InspectorBackend.profilerEnabled())
+            InspectorBackend.disableProfiler(true);
         else
-            InspectorController.enableProfiler(!!optionalAlways);
+            InspectorBackend.enableProfiler(!!optionalAlways);
     },
 
     _populateProfiles: function()
     {
-        // FIXME: This code needs to be adjusted when more profiling types are added.
-        // Currently defaults to CPU profiles.
-        var cpuProfiles = this.getProfileType(WebInspector.CPUProfileType.TypeId).treeElement;
-        if (cpuProfiles.children.length)
-            return;
+        var sidebarTreeChildrenCount = this.sidebarTree.children.length;
+        for (var i = 0; i < sidebarTreeChildrenCount; ++i) {
+            var treeElement = this.sidebarTree.children[i];
+            if (treeElement.children.length)
+                return;
+        }
 
         function populateCallback(profileHeaders) {
             profileHeaders.sort(function(a, b) { return a.uid - b.uid; });
@@ -446,7 +449,7 @@ WebInspector.ProfilesPanel.prototype = {
         }
 
         var callId = WebInspector.Callback.wrap(populateCallback);
-        InspectorController.getProfileHeaders(callId);
+        InspectorBackend.getProfileHeaders(callId);
 
         delete this._shouldPopulateProfiles;
     },
diff --git a/WebCore/inspector/front-end/PropertiesSidebarPane.js b/WebCore/inspector/front-end/PropertiesSidebarPane.js
index ec08210..d84874e 100644
--- a/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -36,12 +36,11 @@ WebInspector.PropertiesSidebarPane.prototype = {
     {
         var body = this.bodyElement;
 
-        body.removeChildren();
-
-        this.sections = [];
-
-        if (!node)
+        if (!node) {
+            body.removeChildren();
+            this.sections = [];
             return;
+        }
 
         var self = this;
         var callback = function(prototypes) {
diff --git a/WebCore/inspector/front-end/Resource.js b/WebCore/inspector/front-end/Resource.js
index 56696e3..d23b5da 100644
--- a/WebCore/inspector/front-end/Resource.js
+++ b/WebCore/inspector/front-end/Resource.js
@@ -26,7 +26,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComponent, identifier, mainResource, cached, requestMethod, requestFormData)
+WebInspector.Resource = function(requestHeaders, url, documentURL, domain, path, lastPathComponent, identifier, mainResource, cached, requestMethod, requestFormData)
 {
     this.identifier = identifier;
 
@@ -35,6 +35,7 @@ WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComp
     this.mainResource = mainResource;
     this.requestHeaders = requestHeaders;
     this.url = url;
+    this.documentURL = documentURL;
     this.domain = domain;
     this.path = path;
     this.lastPathComponent = lastPathComponent;
@@ -111,7 +112,8 @@ WebInspector.Resource.Type = {
     Font:       3,
     Script:     4,
     XHR:        5,
-    Other:      6,
+    Media:      6,
+    Other:      7,
 
     isTextType: function(type)
     {
@@ -161,6 +163,18 @@ WebInspector.Resource.prototype = {
         this.dispatchEventToListeners("url changed");
     },
 
+    get documentURL()
+    {
+        return this._documentURL;
+    },
+
+    set documentURL(x)
+    {
+        if (this._documentURL === x)
+            return;
+        this._documentURL = x;
+    },
+
     get domain()
     {
         return this._domain;
@@ -587,7 +601,7 @@ WebInspector.Resource.prototype = {
         if (this.mimeType in WebInspector.MIMETypes)
             return this.type in WebInspector.MIMETypes[this.mimeType];
 
-        return true;
+        return false;
     },
 
     _checkWarnings: function()
diff --git a/WebCore/inspector/front-end/ResourceView.js b/WebCore/inspector/front-end/ResourceView.js
index 2ea7fdb..8175c2f 100644
--- a/WebCore/inspector/front-end/ResourceView.js
+++ b/WebCore/inspector/front-end/ResourceView.js
@@ -248,7 +248,7 @@ WebInspector.ResourceView.prototype = {
         }
     },
 
-    _toggleURLdecoding: function(treeElement, event)
+    _toggleURLdecoding: function(event)
     {
         this._decodeRequestParameters = !this._decodeRequestParameters;
         this._refreshQueryString();
diff --git a/WebCore/inspector/front-end/ResourcesPanel.js b/WebCore/inspector/front-end/ResourcesPanel.js
index 940570f..60c1895 100644
--- a/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/WebCore/inspector/front-end/ResourcesPanel.js
@@ -39,6 +39,7 @@ WebInspector.ResourcesPanel = function()
     this.viewsContainerElement.id = "resource-views";
     this.element.appendChild(this.viewsContainerElement);
 
+    this.createFilterPanel();
     this.createInterface();
 
     this._createStatusbarButtons();
@@ -348,7 +349,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         this.summaryBar.reset();
 
-        if (InspectorController.resourceTrackingEnabled()) {
+        if (InspectorBackend.resourceTrackingEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
             this.largerResourcesButton.visible = true;
@@ -564,8 +565,8 @@ WebInspector.ResourcesPanel.prototype = {
             loadDividerPadding.style.left = percent + "%";
             loadDividerPadding.title = WebInspector.UIString("Load event fired");
             loadDividerPadding.appendChild(loadDivider);
-            
-            this.eventDividersElement.appendChild(loadDividerPadding);
+
+            this.addEventDivider(loadDividerPadding);
         }
         
         if (this.mainResourceDOMContentTime !== -1) {
@@ -579,8 +580,8 @@ WebInspector.ResourcesPanel.prototype = {
             domContentDividerPadding.style.left = percent + "%";
             domContentDividerPadding.title = WebInspector.UIString("DOMContent event fired");
             domContentDividerPadding.appendChild(domContentDivider);
-            
-            this.eventDividersElement.appendChild(domContentDividerPadding);
+
+            this.addEventDivider(domContentDividerPadding);
         }
     },
 
@@ -615,7 +616,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         this.itemsTreeElement.smallChildren = !this.itemsTreeElement.smallChildren;
         Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
-        InspectorController.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
+        InspectorFrontendHost.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
 
         if (this.itemsTreeElement.smallChildren) {
             this.itemsGraphsElement.addStyleClass("small");
@@ -674,27 +675,27 @@ WebInspector.ResourcesPanel.prototype = {
 
     _enableResourceTracking: function()
     {
-        if (InspectorController.resourceTrackingEnabled())
+        if (InspectorBackend.resourceTrackingEnabled())
             return;
         this._toggleResourceTracking(this.panelEnablerView.alwaysEnabled);
     },
 
     _toggleResourceTracking: function(optionalAlways)
     {
-        if (InspectorController.resourceTrackingEnabled()) {
+        if (InspectorBackend.resourceTrackingEnabled()) {
             this.largerResourcesButton.visible = false;
             this.sortingSelectElement.visible = false;
-            InspectorController.disableResourceTracking(true);
+            InspectorBackend.disableResourceTracking(true);
         } else {
             this.largerResourcesButton.visible = true;
             this.sortingSelectElement.visible = true;
-            InspectorController.enableResourceTracking(!!optionalAlways);
+            InspectorBackend.enableResourceTracking(!!optionalAlways);
         }
     },
 
     get _resources()
     {
-        return this._items;
+        return this.items;
     }
 }
 
@@ -958,6 +959,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         // FIXME: should actually add handler to parent, to be resolved via
         // https://bugs.webkit.org/show_bug.cgi?id=30227
         this._listItemNode.addEventListener("dragstart", this.ondragstart.bind(this), false);
+        this.updateErrorsAndWarnings();
     },
 
     onselect: function()
@@ -965,7 +967,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         WebInspector.panels.resources.showResource(this.resource);
     },
     
-    ondblclick: function(treeElement, event)
+    ondblclick: function(event)
     {
         InjectedScriptAccess.openInInspectedWindow(this.resource.url, function() {});
     },
@@ -1041,6 +1043,8 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
 
             this.createIconElement();
         }
+
+        this.tooltip = this.resource.url;
     },
 
     resetBubble: function()
diff --git a/WebCore/inspector/front-end/ScriptView.js b/WebCore/inspector/front-end/ScriptView.js
index 124190c..38157ac 100644
--- a/WebCore/inspector/front-end/ScriptView.js
+++ b/WebCore/inspector/front-end/ScriptView.js
@@ -59,7 +59,7 @@ WebInspector.ScriptView.prototype = {
 
         this.attach();
 
-        if (!InspectorController.addSourceToFrame("text/javascript", this.script.source, this.sourceFrame.element))
+        if (!InspectorFrontendHost.addSourceToFrame("text/javascript", this.script.source, this.sourceFrame.element))
             return;
 
         delete this._frameNeedsSetup;
diff --git a/WebCore/inspector/front-end/ScriptsPanel.js b/WebCore/inspector/front-end/ScriptsPanel.js
index 4aa0ab2..8b31a8b 100644
--- a/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/WebCore/inspector/front-end/ScriptsPanel.js
@@ -161,36 +161,35 @@ WebInspector.ScriptsPanel = function()
     this._breakpointsURLMap = {};
 
     this._shortcuts = {};
-
-    var isMac = InspectorController.platform().indexOf("mac-") === 0;
-    var platformSpecificModifier = isMac ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
+    var handler, shortcut;
+    var platformSpecificModifier = WebInspector.isMac() ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
 
     // Continue.
-    var handler = this.pauseButton.click.bind(this.pauseButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F8);
+    handler = this.pauseButton.click.bind(this.pauseButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F8);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Slash, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Slash, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     // Step over.
-    var handler = this.stepOverButton.click.bind(this.stepOverButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F10);
+    handler = this.stepOverButton.click.bind(this.stepOverButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F10);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.SingleQuote, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.SingleQuote, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     // Step into.
-    var handler = this.stepIntoButton.click.bind(this.stepIntoButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11);
+    handler = this.stepIntoButton.click.bind(this.stepIntoButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     // Step out.
-    var handler = this.stepOutButton.click.bind(this.stepOutButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11, WebInspector.KeyboardShortcut.Modifiers.Shift);
+    handler = this.stepOutButton.click.bind(this.stepOutButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11, WebInspector.KeyboardShortcut.Modifiers.Shift);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, WebInspector.KeyboardShortcut.Modifiers.Shift, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, WebInspector.KeyboardShortcut.Modifiers.Shift, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     this.reset();
@@ -236,7 +235,7 @@ WebInspector.ScriptsPanel.prototype = {
             view.visible = false;
         }
         if (this._attachDebuggerWhenShown) {
-            InspectorController.enableDebugger(false);
+            InspectorBackend.enableDebugger(false);
             delete this._attachDebuggerWhenShown;
         }
     },
@@ -276,22 +275,29 @@ WebInspector.ScriptsPanel.prototype = {
             resource.addScript(script);
         }
 
+        sourceURL = script.sourceURL;
+
+        if (sourceID)
+            this._sourceIDMap[sourceID] = (resource || script);
+
         if (sourceURL in this._breakpointsURLMap && sourceID) {
             var breakpoints = this._breakpointsURLMap[sourceURL];
             var breakpointsLength = breakpoints.length;
             for (var i = 0; i < breakpointsLength; ++i) {
                 var breakpoint = breakpoints[i];
+
                 if (startingLine <= breakpoint.line) {
+                    // remove and add the breakpoint, to clean up things like the sidebar
+                    this.removeBreakpoint(breakpoint);
                     breakpoint.sourceID = sourceID;
+                    this.addBreakpoint(breakpoint);
+                    
                     if (breakpoint.enabled)
-                        InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
+                        InspectorBackend.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
                 }
             }
         }
 
-        if (sourceID)
-            this._sourceIDMap[sourceID] = (resource || script);
-
         this._addScriptToFilesMenu(script);
     },
 
@@ -415,7 +421,7 @@ WebInspector.ScriptsPanel.prototype = {
     attachDebuggerWhenShown: function()
     {
         if (this.element.parentElement) {
-            InspectorController.enableDebugger(false);
+            InspectorBackend.enableDebugger(false);
         } else {
             this._attachDebuggerWhenShown = true;
         }
@@ -438,7 +444,7 @@ WebInspector.ScriptsPanel.prototype = {
         delete this.currentQuery;
         this.searchCanceled();
 
-        if (!InspectorController.debuggerEnabled()) {
+        if (!InspectorBackend.debuggerEnabled()) {
             this._paused = false;
             this._waitingToPause = false;
             this._stepping = false;
@@ -489,17 +495,17 @@ WebInspector.ScriptsPanel.prototype = {
 
     canShowResource: function(resource)
     {
-        return resource && resource.scripts.length && InspectorController.debuggerEnabled();
+        return resource && resource.scripts.length && InspectorBackend.debuggerEnabled();
     },
 
     showScript: function(script, line)
     {
-        this._showScriptOrResource(script, line, true);
+        this._showScriptOrResource(script, {line: line, shouldHighlightLine: true});
     },
 
     showResource: function(resource, line)
     {
-        this._showScriptOrResource(resource, line, true);
+        this._showScriptOrResource(resource, {line: line, shouldHighlightLine: true});
     },
 
     showView: function(view)
@@ -567,8 +573,12 @@ WebInspector.ScriptsPanel.prototype = {
             return this.sourceFrameForScript(scriptOrResource);
     },
 
-    _showScriptOrResource: function(scriptOrResource, line, shouldHighlightLine, fromBackForwardAction)
+    _showScriptOrResource: function(scriptOrResource, options)
     {
+        // options = {line:, shouldHighlightLine:, fromBackForwardAction:, initialLoad:}
+        if (!options) 
+            options = {};
+
         if (!scriptOrResource)
             return;
 
@@ -594,7 +604,11 @@ WebInspector.ScriptsPanel.prototype = {
         if (!view)
             return;
 
-        if (!fromBackForwardAction) {
+        var url = scriptOrResource.url || scriptOrResource.sourceURL;
+        if (url && !options.initialLoad)
+            InspectorFrontendHost.setSetting("LastViewedScriptFile", url);
+
+        if (!options.fromBackForwardAction) {
             var oldIndex = this._currentBackForwardIndex;
             if (oldIndex >= 0)
                 this._backForwardList.splice(oldIndex + 1, this._backForwardList.length - oldIndex);
@@ -615,19 +629,26 @@ WebInspector.ScriptsPanel.prototype = {
 
         this.visibleView = view;
 
-        if (line) {
+        if (options.line) {
             if (view.revealLine)
-                view.revealLine(line);
-            if (view.highlightLine && shouldHighlightLine)
-                view.highlightLine(line);
+                view.revealLine(options.line);
+            if (view.highlightLine && options.shouldHighlightLine)
+                view.highlightLine(options.line);
         }
 
         var option;
         if (scriptOrResource instanceof WebInspector.Script) {
             option = scriptOrResource.filesSelectOption;
+
+            // hasn't been added yet - happens for stepping in evals,
+            // so use the force option to force the script into the menu.
+            if (!option) {
+                this._addScriptToFilesMenu(scriptOrResource, {force: true});
+                option = scriptOrResource.filesSelectOption;
+            }
+
             console.assert(option);
         } else {
-            var url = scriptOrResource.url;
             var script = this._scriptsForURLsInFilesSelect[url];
             if (script)
                option = script.filesSelectOption;
@@ -637,8 +658,13 @@ WebInspector.ScriptsPanel.prototype = {
             this.filesSelectElement.selectedIndex = option.index;
     },
 
-    _addScriptToFilesMenu: function(script)
+    _addScriptToFilesMenu: function(script, options)
     {
+        var force = options && options.force;
+
+        if (!script.sourceURL && !force)
+            return;
+
         if (script.resource && this._scriptsForURLsInFilesSelect[script.sourceURL])
             return;
 
@@ -679,7 +705,14 @@ WebInspector.ScriptsPanel.prototype = {
         // Call _showScriptOrResource if the option we just appended ended up being selected.
         // This will happen for the first item added to the menu.
         if (select.options[select.selectedIndex] === option)
-            this._showScriptOrResource(option.representedObject);
+            this._showScriptOrResource(option.representedObject, {initialLoad: true});
+        else {
+            // if not first item, check to see if this was the last viewed
+            var url = option.representedObject.url || option.representedObject.sourceURL;
+            var lastURL = InspectorFrontendHost.setting("LastViewedScriptFile");
+            if (url && url === lastURL)
+                this._showScriptOrResource(option.representedObject, {initialLoad: true});
+        }
     },
 
     _clearCurrentExecutionLine: function()
@@ -702,7 +735,7 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.watchExpressions.refreshExpressions();
 
         var scriptOrResource = this._sourceIDMap[currentFrame.sourceID];
-        this._showScriptOrResource(scriptOrResource, currentFrame.line);
+        this._showScriptOrResource(scriptOrResource, {line: currentFrame.line});
 
         this._executionSourceFrame = this._sourceFrameForScriptOrResource(scriptOrResource);
         if (this._executionSourceFrame)
@@ -748,7 +781,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _updatePauseOnExceptionsButton: function()
     {
-        if (InspectorController.pauseOnExceptions()) {
+        if (InspectorBackend.pauseOnExceptions()) {
             this.pauseOnExceptionButton.title = WebInspector.UIString("Don't pause on exceptions.");
             this.pauseOnExceptionButton.toggled = true;
         } else {
@@ -759,7 +792,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _updateDebuggerButtons: function()
     {
-        if (InspectorController.debuggerEnabled()) {
+        if (InspectorBackend.debuggerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Debugging enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
             this.pauseOnExceptionButton.visible = true;
@@ -821,7 +854,7 @@ WebInspector.ScriptsPanel.prototype = {
             return;
         }
 
-        this._showScriptOrResource(this._backForwardList[--this._currentBackForwardIndex], null, false, true);
+        this._showScriptOrResource(this._backForwardList[--this._currentBackForwardIndex], {fromBackForwardAction: true});
         this._updateBackAndForwardButtons();
     },
 
@@ -832,13 +865,13 @@ WebInspector.ScriptsPanel.prototype = {
             return;
         }
 
-        this._showScriptOrResource(this._backForwardList[++this._currentBackForwardIndex], null, false, true);
+        this._showScriptOrResource(this._backForwardList[++this._currentBackForwardIndex], {fromBackForwardAction: true});
         this._updateBackAndForwardButtons();
     },
 
     _enableDebugging: function()
     {
-        if (InspectorController.debuggerEnabled())
+        if (InspectorBackend.debuggerEnabled())
             return;
         this._toggleDebugging(this.panelEnablerView.alwaysEnabled);
     },
@@ -849,15 +882,15 @@ WebInspector.ScriptsPanel.prototype = {
         this._waitingToPause = false;
         this._stepping = false;
 
-        if (InspectorController.debuggerEnabled())
-            InspectorController.disableDebugger(true);
+        if (InspectorBackend.debuggerEnabled())
+            InspectorBackend.disableDebugger(true);
         else
-            InspectorController.enableDebugger(!!optionalAlways);
+            InspectorBackend.enableDebugger(!!optionalAlways);
     },
 
     _togglePauseOnExceptions: function()
     {
-        InspectorController.setPauseOnExceptions(!InspectorController.pauseOnExceptions());
+        InspectorBackend.setPauseOnExceptions(!InspectorBackend.pauseOnExceptions());
         this._updatePauseOnExceptionsButton();
     },
 
@@ -866,11 +899,11 @@ WebInspector.ScriptsPanel.prototype = {
         if (this._paused) {
             this._paused = false;
             this._waitingToPause = false;
-            InspectorController.resumeDebugger();
+            InspectorBackend.resumeDebugger();
         } else {
             this._stepping = false;
             this._waitingToPause = true;
-            InspectorController.pauseInDebugger();
+            InspectorBackend.pauseInDebugger();
         }
 
         this._clearInterface();
@@ -883,7 +916,7 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._clearInterface();
 
-        InspectorController.stepOverStatementInDebugger();
+        InspectorBackend.stepOverStatementInDebugger();
     },
 
     _stepIntoClicked: function()
@@ -893,7 +926,7 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._clearInterface();
 
-        InspectorController.stepIntoStatementInDebugger();
+        InspectorBackend.stepIntoStatementInDebugger();
     },
 
     _stepOutClicked: function()
@@ -903,7 +936,7 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._clearInterface();
 
-        InspectorController.stepOutOfFunctionInDebugger();
+        InspectorBackend.stepOutOfFunctionInDebugger();
     }
 }
 
diff --git a/WebCore/inspector/front-end/SourceFrame.js b/WebCore/inspector/front-end/SourceFrame.js
index 1c11f76..b5cf4c0 100644
--- a/WebCore/inspector/front-end/SourceFrame.js
+++ b/WebCore/inspector/front-end/SourceFrame.js
@@ -207,12 +207,11 @@ WebInspector.SourceFrame.prototype = {
         this.element.contentDocument.addEventListener("webkitAnimationEnd", this._highlightLineEnds.bind(this), false);
 
         // Register 'eval' shortcut.
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
-        var platformSpecificModifier = isMac ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
+        var platformSpecificModifier = WebInspector.isMac() ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
         var shortcut = WebInspector.KeyboardShortcut.makeKey(69 /* 'E' */, platformSpecificModifier | WebInspector.KeyboardShortcut.Modifiers.Shift);
         this._shortcuts[shortcut] = this._evalSelectionInCallFrame.bind(this);
 
-        var headElement = this.element.contentDocument.getElementsByTagName("head")[0];
+        var headElement = this.element.contentDocument.head;
         if (!headElement) {
             headElement = this.element.contentDocument.createElement("head");
             this.element.contentDocument.documentElement.insertBefore(headElement, this.element.contentDocument.documentElement.firstChild);
@@ -264,6 +263,7 @@ WebInspector.SourceFrame.prototype = {
 
         this.element.contentWindow.Element.prototype.addStyleClass = Element.prototype.addStyleClass;
         this.element.contentWindow.Element.prototype.removeStyleClass = Element.prototype.removeStyleClass;
+        this.element.contentWindow.Element.prototype.removeChildren = Element.prototype.removeChildren;
         this.element.contentWindow.Element.prototype.positionAt = Element.prototype.positionAt;
         this.element.contentWindow.Element.prototype.removeMatchingStyleClasses = Element.prototype.removeMatchingStyleClasses;
         this.element.contentWindow.Element.prototype.hasStyleClass = Element.prototype.hasStyleClass;
@@ -336,6 +336,8 @@ WebInspector.SourceFrame.prototype = {
             WebInspector.panels.scripts.removeBreakpoint(sourceRow._breakpointObject);
         else if (this.addBreakpointDelegate)
             this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
+
+        event.preventDefault();
     },
 
     _editBreakpointCondition: function(eventTarget, sourceRow, breakpoint)
@@ -729,20 +731,20 @@ WebInspector.SourceFrame.prototype = {
         if (!table)
             return;
 
-        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(table, this);
+        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighlighter(table, this);
         cssSyntaxHighlighter.process();
     }
 }
 
 WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
 
-WebInspector.SourceSyntaxHighligher = function(table, sourceFrame)
+WebInspector.SourceSyntaxHighlighter = function(table, sourceFrame)
 {
     this.table = table;
     this.sourceFrame = sourceFrame;
 }
 
-WebInspector.SourceSyntaxHighligher.prototype = {
+WebInspector.SourceSyntaxHighlighter.prototype = {
     createSpan: function(content, className)
     {
         var span = document.createElement("span");
@@ -751,234 +753,1089 @@ WebInspector.SourceSyntaxHighligher.prototype = {
         return span;
     },
 
-    generateFinder: function(regex, matchNumber, className)
-    {
-        return function(str) {
-            var match = regex.exec(str);
-            if (!match)
-                return null;
-            this.previousMatchLength = match[matchNumber].length;
-            return this.createSpan(match[matchNumber], className);
-        };
-    },
-
     process: function()
     {
         // Split up the work into chunks so we don't block the
         // UI thread while processing.
 
-        var i = 0;
         var rows = this.table.rows;
         var rowsLength = rows.length;
-        var previousCell = null;
-        const linesPerChunk = 10;
-
+        const tokensPerChunk = 100;
+        const lineLengthLimit = 20000;
+        
+        var boundProcessChunk = processChunk.bind(this);
+        var processChunkInterval = setInterval(boundProcessChunk, 25);
+        boundProcessChunk();
+        
         function processChunk()
         {
-            for (var end = Math.min(i + linesPerChunk, rowsLength); i < end; ++i) {
-                var row = rows[i];
-                if (!row)
-                    continue;
-                var cell = row.cells[1];
-                if (!cell)
-                    continue;
-                this.syntaxHighlightLine(cell, previousCell);
-                if (i < (end - 1))
-                    this.deleteContinueFlags(previousCell);
-                previousCell = cell;
-            }
+            for (var i = 0; i < tokensPerChunk; i++) {
+                if (this.cursor >= this.lineCode.length)
+                    moveToNextLine.call(this);
+                if (this.lineIndex >= rowsLength) {
+                    this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+                    return;
+                }
+                if (this.cursor > lineLengthLimit) {
+                    var codeFragment = this.lineCode.substring(this.cursor);
+                    this.nonToken += codeFragment;
+                    this.cursor += codeFragment.length;
+                }
 
-            if (i >= rowsLength && processChunkInterval) {
-                this.deleteContinueFlags(previousCell);
-                delete this.previousMatchLength;
+                this.lex();
+            }
+        }
+        
+        function moveToNextLine()
+        {
+            this.appendNonToken();
+            
+            var row = rows[this.lineIndex];
+            var line = row ? row.cells[1] : null;
+            if (line && this.newLine) {
+                line.removeChildren();
+                
+                if (this.messageBubble)
+                    this.newLine.appendChild(this.messageBubble);
+                
+                line.parentNode.insertBefore(this.newLine, line);
+                line.parentNode.removeChild(line);
+                
+                this.newLine = null;
+            }
+            this.lineIndex++;
+            if (this.lineIndex >= rowsLength && processChunkInterval) {
                 clearInterval(processChunkInterval);
-
                 this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+                return;
+            }
+            row = rows[this.lineIndex];
+            line = row ? row.cells[1] : null;
+            
+            this.messageBubble = null;
+            if (line.lastChild && line.lastChild.nodeType === Node.ELEMENT_NODE && line.lastChild.hasStyleClass("webkit-html-message-bubble")) {
+                this.messageBubble = line.lastChild;
+                line.removeChild(this.messageBubble);
             }
-        }
-
-        var boundProcessChunk = processChunk.bind(this);
-        var processChunkInterval = setInterval(boundProcessChunk, 25);
-        boundProcessChunk();
-    }
-}
-
-WebInspector.CSSSourceSyntaxHighligher = function(table, sourceFrame) {
-    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
-
-    this.findNumber = this.generateFinder(/^((-?(\d+|\d*\.\d+))|^(#[a-fA-F0-9]{3,6}))(?:\D|$)/, 1, "webkit-css-number");
-    this.findUnits = this.generateFinder(/^(px|em|pt|in|cm|mm|pc|ex)(?:\W|$)/, 1, "webkit-css-unit");
-    this.findKeyword = this.generateFinder(/^(rgba?|hsla?|var)(?:\W|$)/, 1, "webkit-css-keyword");
-    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-css-string"); // " this quote keeps Xcode happy
-    this.findSingleLineComment = this.generateFinder(/^\/\*.*?\*\//, 0, "webkit-css-comment");
-    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-css-comment");
-    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-css-comment");
-    this.findSelector = this.generateFinder(/^([#\.]?[_a-zA-Z].*?)(?:\W|$)/, 1, "webkit-css-selector");
-    this.findProperty = this.generateFinder(/^(-?[_a-z0-9][_a-z0-9-]*\s*)(?:\:)/, 1, "webkit-css-property");
-    this.findGenericIdent = this.generateFinder(/^([@-]?[_a-z0-9][_a-z0-9-]*)(?:\W|$)/, 1, "webkit-css-string");
-}
 
-WebInspector.CSSSourceSyntaxHighligher.prototype = {
-    deleteContinueFlags: function(cell)
-    {
-        if (!cell)
-            return;
-        delete cell._commentContinues;
-        delete cell._inSelector;
+            this.lineCode = line.textContent;
+            this.newLine = line.cloneNode(false);
+            this.cursor = 0;
+            if (!line)
+                moveToNextLine();
+        }
     },
-
-    findPseudoClass: function(str)
+    
+    lex: function()
     {
-        var match = /^(::?)([_a-z0-9][_a-z0-9-]*)/.exec(str);
-        if (!match)
-            return null;
-        this.previousMatchLength = match[0].length;
-        var span = document.createElement("span");
-        span.appendChild(document.createTextNode(match[1]));
-        span.appendChild(this.createSpan(match[2], "webkit-css-pseudo-class"));
-        return span;
-    },
-
-    findURL: function(str)
-    {
-        var match = /^(?:local|url)\(([^\)]*?)\)/.exec(str);
-        if (!match)
-            return null;
-        this.previousMatchLength = match[0].length;
-        var innerUrlSpan = this.createSpan(match[1], "webkit-css-url");
-        var outerSpan = document.createElement("span");
-        outerSpan.appendChild(this.createSpan("url", "webkit-css-keyword"));
-        outerSpan.appendChild(document.createTextNode("("));
-        outerSpan.appendChild(innerUrlSpan);
-        outerSpan.appendChild(document.createTextNode(")"));
-        return outerSpan;
+        var token = null;
+        var codeFragment = this.lineCode.substring(this.cursor);
+        
+        for (var i = 0; i < this.rules.length; i++) {
+            var rule = this.rules[i];
+            var ruleContinueStateCondition = typeof rule.continueStateCondition === "undefined" ? this.ContinueState.None : rule.continueStateCondition;
+            if (this.continueState === ruleContinueStateCondition) {
+                if (typeof rule.lexStateCondition !== "undefined" && this.lexState !== rule.lexStateCondition)
+                    continue;
+                var match = rule.pattern.exec(codeFragment);
+                if (match) {
+                    token = match[0];
+                    if (token) {
+                        if (!rule.dontAppendNonToken)
+                            this.appendNonToken();
+                        return rule.action.call(this, token);
+                    }
+                }
+            }
+        }
+        this.nonToken += codeFragment[0];
+        this.cursor++;
     },
-
-    findAtRule: function(str)
+    
+    appendNonToken: function ()
     {
-        var match = /^@[_a-z0-9][_a-z0-9-]*(?:\W|$)/.exec(str);
-        if (!match)
-            return null;
-        this.previousMatchLength = match[0].length;
-        return this.createSpan(match[0], "webkit-css-at-rule");
+        if (this.nonToken.length > 0) {
+            this.newLine.appendChild(document.createTextNode(this.nonToken));
+            this.nonToken = "";
+        }
     },
-
-    syntaxHighlightLine: function(line, prevLine)
+    
+    syntaxHighlightNode: function(node)
     {
-        var code = line.textContent;
-        while (line.firstChild)
-            line.removeChild(line.firstChild);
-
-        var token;
-        var tmp = 0;
-        var i = 0;
-        this.previousMatchLength = 0;
-
-        if (prevLine) {
-            if (prevLine._commentContinues) {
-                if (!(token = this.findMultilineCommentEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-comment");
-                    line._commentContinues = true;
-                }
-            }
-            if (token) {
-                i += this.previousMatchLength ? this.previousMatchLength : code.length;
-                tmp = i;
-                line.appendChild(token);
+        this.lineCode = node.textContent;
+        node.removeChildren();
+        this.newLine = node;
+        this.cursor = 0;
+        while (true) {
+            if (this.cursor >= this.lineCode.length) {
+                var codeFragment = this.lineCode.substring(this.cursor);
+                this.nonToken += codeFragment;
+                this.cursor += codeFragment.length;
+                this.appendNonToken();
+                this.newLine = null;
+                return;
             }
-        }
 
-        var inSelector = (prevLine && prevLine._inSelector); // inside a selector, we can now parse properties and values
-        var inAtRuleBlock = (prevLine && prevLine._inAtRuleBlock); // inside an @rule block, but not necessarily inside a selector yet
-        var atRuleStarted = (prevLine && prevLine._atRuleStarted); // we received an @rule, we may stop the @rule at a semicolon or open a block and become inAtRuleBlock
-        var atRuleIsSelector = (prevLine && prevLine._atRuleIsSelector); // when this @rule opens a block it immediately goes into parsing properties and values instead of selectors
-
-        for ( ; i < code.length; ++i) {
-            var codeFragment = code.substr(i);
-            var prevChar = code[i - 1];
-            var currChar = codeFragment[0];
-            token = this.findSingleLineComment(codeFragment);
-            if (!token) {
-                if ((token = this.findMultilineCommentStart(codeFragment)))
-                    line._commentContinues = true;
-                else if (currChar === ";" && !inAtRuleBlock)
-                    atRuleStarted = false;
-                else if (currChar === "}") {
-                    if (inSelector && inAtRuleBlock && atRuleIsSelector) {
-                        inSelector = false;
-                        inAtRuleBlock = false;
-                        atRuleStarted = false;
-                    } else if (inSelector) {
-                        inSelector = false;
-                    } else if (inAtRuleBlock) {
-                        inAtRuleBlock = false;
-                        atRuleStarted = false;
-                    }
-                } else if (currChar === "{") {
-                    if (!atRuleStarted || inAtRuleBlock) {
-                        inSelector = true;
-                    } else if (!inAtRuleBlock && atRuleIsSelector) {
-                        inAtRuleBlock = true;
-                        inSelector = true;
-                    } else if (!inAtRuleBlock) {
-                        inAtRuleBlock = true;
-                        inSelector = false;
-                    }
-                } else if (inSelector) {
-                    if (!prevChar || /^\d/.test(prevChar)) {
-                        token = this.findUnits(codeFragment);
-                    } else if (!prevChar || /^\W/.test(prevChar)) {
-                        token = this.findNumber(codeFragment) ||
-                                this.findKeyword(codeFragment) ||
-                                this.findURL(codeFragment) ||
-                                this.findProperty(codeFragment) ||
-                                this.findAtRule(codeFragment) ||
-                                this.findGenericIdent(codeFragment) ||
-                                this.findSingleLineString(codeFragment);
-                    }
-                } else if (!inSelector) {
-                    if (atRuleStarted && !inAtRuleBlock)
-                        token = this.findURL(codeFragment); // for @import
-                    if (!token) {
-                        token = this.findSelector(codeFragment) ||
-                                this.findPseudoClass(codeFragment) ||
-                                this.findAtRule(codeFragment);
-                    }
-                }
-            }
+            this.lex();
+        }
+    }
+}
 
-            if (token) {
-                if (currChar === "@") {
-                    atRuleStarted = true;
+WebInspector.CSSSourceSyntaxHighlighter = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighlighter.call(this, table, sourceFrame);
 
-                    // The @font-face, @page, and @variables at-rules do not contain selectors like other at-rules
-                    // instead it acts as a selector and contains properties and values.
-                    var text = token.textContent;
-                    atRuleIsSelector = /font-face/.test(text) || /page/.test(text) || /variables/.test(text);
-                }
+    this.LexState = {
+        Initial: 1,
+        DeclarationProperty: 2,
+        DeclarationValue: 3,
+        AtMedia: 4,
+        AtRule: 5,
+        AtKeyframes: 6
+    };
+    this.ContinueState = {
+        None: 0,
+        Comment: 1
+    };
+    
+    this.nonToken = "";
+    this.cursor = 0;
+    this.lineIndex = -1;
+    this.lineCode = "";
+    this.newLine = null;
+    this.lexState = this.LexState.Initial;
+    this.continueState = this.ContinueState.None;
+    
+    const urlPattern = /^url\(\s*(?:(?:"(?:[^\\\"]|(?:\\[\da-f]{1,6}\s?|\.))*"|'(?:[^\\\']|(?:\\[\da-f]{1,6}\s?|\.))*')|(?:[!#$%&*-~\w]|(?:\\[\da-f]{1,6}\s?|\.))*)\s*\)/i;
+    const stringPattern = /^(?:"(?:[^\\\"]|(?:\\[\da-f]{1,6}\s?|\.))*"|'(?:[^\\\']|(?:\\[\da-f]{1,6}\s?|\.))*')/i;
+    const identPattern = /^-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*/i;
+    const startBlockPattern = /^{/i;
+    const endBlockPattern = /^}/i;
+    this.rules = [{
+        pattern: /^\/\*[^\*]*\*+([^\/*][^*]*\*+)*\//i,
+        action: commentAction
+    }, {
+        pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*)/i,
+        action: commentStartAction
+    }, {
+        pattern: /^(?:(?:[^\*]|\*[^\/])*\*+\/)/i,
+        action: commentEndAction,
+        continueStateCondition: this.ContinueState.Comment
+    }, {
+        pattern: /^.*/i,
+        action: commentMiddleAction,
+        continueStateCondition: this.ContinueState.Comment
+    }, {
+        pattern: /^(?:(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\*)(?:#-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\.-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\[\s*-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\s*(?:(?:=|~=|\|=)\s*(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|(?:"(?:[^\\\"]|(?:\\[\da-f]{1,6}\s?|\.))*"|'(?:[^\\\']|(?:\\[\da-f]{1,6}\s?|\.))*'))\s*)?\]|:(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\(\s*(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\s*)?\)))*|(?:#-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\.-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\[\s*-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\s*(?:(?:=|~=|\|=)\s*(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|(?:"(?:[^\\\"]|(?:\\[\da-f]{1,6}\s?|\.))*"|'(?:[^\\\']|(?:\\[\da-f]{1,6}\s?|\.))*'))\s*)?\]|:(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\(\s*(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\s*)?\)))+)/i,
+        action: selectorAction,
+        lexStateCondition: this.LexState.Initial
+    }, {
+        pattern: startBlockPattern,
+        action: startRulesetBlockAction,
+        lexStateCondition: this.LexState.Initial,
+        dontAppendNonToken: true
+    }, {
+        pattern: identPattern,
+        action: propertyAction,
+        lexStateCondition: this.LexState.DeclarationProperty,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^:/i,
+        action: declarationColonAction,
+        lexStateCondition: this.LexState.DeclarationProperty,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^(?:#(?:[\da-f]{6}|[\da-f]{3})|rgba\(\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*\)|hsla\(\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*\)|rgb\(\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*\)|hsl\(\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*\))/i,
+        action: colorAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: /^(?:-?(?:\d+|\d*\.\d+)(?:em|rem|__qem|ex|px|cm|mm|in|pt|pc|deg|rad|grad|turn|ms|s|Hz|kHz|%)?)/i,
+        action: numvalueAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: urlPattern,
+        action: urlAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: stringPattern,
+        action: stringAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: /^!\s*important/i,
+        action: importantAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: identPattern,
+        action: valueIdentAction,
+        lexStateCondition: this.LexState.DeclarationValue,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^;/i,
+        action: declarationSemicolonAction,
+        lexStateCondition: this.LexState.DeclarationValue,
+        dontAppendNonToken: true
+    }, {
+        pattern: endBlockPattern,
+        action: endRulesetBlockAction,
+        lexStateCondition: this.LexState.DeclarationProperty,
+        dontAppendNonToken: true
+    }, {
+        pattern: endBlockPattern,
+        action: endRulesetBlockAction,
+        lexStateCondition: this.LexState.DeclarationValue,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^@media/i,
+        action: atMediaAction,
+        lexStateCondition: this.LexState.Initial
+    }, {
+        pattern: startBlockPattern,
+        action: startAtMediaBlockAction,
+        lexStateCondition: this.LexState.AtMedia,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^@-webkit-keyframes/i,
+        action: atKeyframesAction,
+        lexStateCondition: this.LexState.Initial
+    }, {
+        pattern: startBlockPattern,
+        action: startAtMediaBlockAction,
+        lexStateCondition: this.LexState.AtKeyframes,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^@-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*/i,
+        action: atRuleAction,
+        lexStateCondition: this.LexState.Initial
+    }, {
+        pattern: /^;/i,
+        action: endAtRuleAction,
+        lexStateCondition: this.LexState.AtRule
+    }, {
+        pattern: urlPattern,
+        action: urlAction,
+        lexStateCondition: this.LexState.AtRule
+    }, {
+        pattern: stringPattern,
+        action: stringAction,
+        lexStateCondition: this.LexState.AtRule
+    }, {
+        pattern: stringPattern,
+        action: stringAction,
+        lexStateCondition: this.LexState.AtKeyframes
+    }, {
+        pattern: identPattern,
+        action: atRuleIdentAction,
+        lexStateCondition: this.LexState.AtRule,
+        dontAppendNonToken: true
+    }, {
+        pattern: identPattern,
+        action: atRuleIdentAction,
+        lexStateCondition: this.LexState.AtMedia,
+        dontAppendNonToken: true
+    }, {
+        pattern: startBlockPattern,
+        action: startAtRuleBlockAction,
+        lexStateCondition: this.LexState.AtRule,
+        dontAppendNonToken: true
+    }];
+    
+    function commentAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-comment"));
+    }
+    
+    function commentStartAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-comment"));
+        this.continueState = this.ContinueState.Comment;
+    }
+    
+    function commentEndAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-comment"));
+        this.continueState = this.ContinueState.None;
+    }
 
-                if (tmp !== i)
-                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
-                line.appendChild(token);
-                i += this.previousMatchLength - 1;
-                tmp = i + 1;
-            }
-        }
+    function commentMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-comment"));
+    }
+    
+    function selectorAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-selector"));
+    }
+    
+    function startRulesetBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DeclarationProperty;
+    }
+    
+    function endRulesetBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    const propertyKeywords = {
+        "background": true,
+        "background-attachment": true,
+        "background-clip": true,
+        "background-color": true,
+        "background-image": true,
+        "background-origin": true,
+        "background-position": true,
+        "background-position-x": true,
+        "background-position-y": true,
+        "background-repeat": true,
+        "background-repeat-x": true,
+        "background-repeat-y": true,
+        "background-size": true,
+        "border": true,
+        "border-bottom": true,
+        "border-bottom-color": true,
+        "border-bottom-left-radius": true,
+        "border-bottom-right-radius": true,
+        "border-bottom-style": true,
+        "border-bottom-width": true,
+        "border-collapse": true,
+        "border-color": true,
+        "border-left": true,
+        "border-left-color": true,
+        "border-left-style": true,
+        "border-left-width": true,
+        "border-radius": true,
+        "border-right": true,
+        "border-right-color": true,
+        "border-right-style": true,
+        "border-right-width": true,
+        "border-spacing": true,
+        "border-style": true,
+        "border-top": true,
+        "border-top-color": true,
+        "border-top-left-radius": true,
+        "border-top-right-radius": true,
+        "border-top-style": true,
+        "border-top-width": true,
+        "border-width": true,
+        "bottom": true,
+        "caption-side": true,
+        "clear": true,
+        "clip": true,
+        "color": true,
+        "content": true,
+        "counter-increment": true,
+        "counter-reset": true,
+        "cursor": true,
+        "direction": true,
+        "display": true,
+        "empty-cells": true,
+        "float": true,
+        "font": true,
+        "font-family": true,
+        "font-size": true,
+        "font-stretch": true,
+        "font-style": true,
+        "font-variant": true,
+        "font-weight": true,
+        "height": true,
+        "left": true,
+        "letter-spacing": true,
+        "line-height": true,
+        "list-style": true,
+        "list-style-image": true,
+        "list-style-position": true,
+        "list-style-type": true,
+        "margin": true,
+        "margin-bottom": true,
+        "margin-left": true,
+        "margin-right": true,
+        "margin-top": true,
+        "max-height": true,
+        "max-width": true,
+        "min-height": true,
+        "min-width": true,
+        "opacity": true,
+        "orphans": true,
+        "outline": true,
+        "outline-color": true,
+        "outline-offset": true,
+        "outline-style": true,
+        "outline-width": true,
+        "overflow": true,
+        "overflow-x": true,
+        "overflow-y": true,
+        "padding": true,
+        "padding-bottom": true,
+        "padding-left": true,
+        "padding-right": true,
+        "padding-top": true,
+        "page": true,
+        "page-break-after": true,
+        "page-break-before": true,
+        "page-break-inside": true,
+        "pointer-events": true,
+        "position": true,
+        "quotes": true,
+        "resize": true,
+        "right": true,
+        "size": true,
+        "src": true,
+        "table-layout": true,
+        "text-align": true,
+        "text-decoration": true,
+        "text-indent": true,
+        "text-line-through": true,
+        "text-line-through-color": true,
+        "text-line-through-mode": true,
+        "text-line-through-style": true,
+        "text-line-through-width": true,
+        "text-overflow": true,
+        "text-overline": true,
+        "text-overline-color": true,
+        "text-overline-mode": true,
+        "text-overline-style": true,
+        "text-overline-width": true,
+        "text-rendering": true,
+        "text-shadow": true,
+        "text-transform": true,
+        "text-underline": true,
+        "text-underline-color": true,
+        "text-underline-mode": true,
+        "text-underline-style": true,
+        "text-underline-width": true,
+        "top": true,
+        "unicode-bidi": true,
+        "unicode-range": true,
+        "vertical-align": true,
+        "visibility": true,
+        "white-space": true,
+        "widows": true,
+        "width": true,
+        "word-break": true,
+        "word-spacing": true,
+        "word-wrap": true,
+        "z-index": true,
+        "zoom": true,
+        "-webkit-animation": true,
+        "-webkit-animation-delay": true,
+        "-webkit-animation-direction": true,
+        "-webkit-animation-duration": true,
+        "-webkit-animation-iteration-count": true,
+        "-webkit-animation-name": true,
+        "-webkit-animation-play-state": true,
+        "-webkit-animation-timing-function": true,
+        "-webkit-appearance": true,
+        "-webkit-backface-visibility": true,
+        "-webkit-background-clip": true,
+        "-webkit-background-composite": true,
+        "-webkit-background-origin": true,
+        "-webkit-background-size": true,
+        "-webkit-binding": true,
+        "-webkit-border-fit": true,
+        "-webkit-border-horizontal-spacing": true,
+        "-webkit-border-image": true,
+        "-webkit-border-radius": true,
+        "-webkit-border-vertical-spacing": true,
+        "-webkit-box-align": true,
+        "-webkit-box-direction": true,
+        "-webkit-box-flex": true,
+        "-webkit-box-flex-group": true,
+        "-webkit-box-lines": true,
+        "-webkit-box-ordinal-group": true,
+        "-webkit-box-orient": true,
+        "-webkit-box-pack": true,
+        "-webkit-box-reflect": true,
+        "-webkit-box-shadow": true,
+        "-webkit-box-sizing": true,
+        "-webkit-column-break-after": true,
+        "-webkit-column-break-before": true,
+        "-webkit-column-break-inside": true,
+        "-webkit-column-count": true,
+        "-webkit-column-gap": true,
+        "-webkit-column-rule": true,
+        "-webkit-column-rule-color": true,
+        "-webkit-column-rule-style": true,
+        "-webkit-column-rule-width": true,
+        "-webkit-column-width": true,
+        "-webkit-columns": true,
+        "-webkit-font-size-delta": true,
+        "-webkit-font-smoothing": true,
+        "-webkit-highlight": true,
+        "-webkit-line-break": true,
+        "-webkit-line-clamp": true,
+        "-webkit-margin-bottom-collapse": true,
+        "-webkit-margin-collapse": true,
+        "-webkit-margin-start": true,
+        "-webkit-margin-top-collapse": true,
+        "-webkit-marquee": true,
+        "-webkit-marquee-direction": true,
+        "-webkit-marquee-increment": true,
+        "-webkit-marquee-repetition": true,
+        "-webkit-marquee-speed": true,
+        "-webkit-marquee-style": true,
+        "-webkit-mask": true,
+        "-webkit-mask-attachment": true,
+        "-webkit-mask-box-image": true,
+        "-webkit-mask-clip": true,
+        "-webkit-mask-composite": true,
+        "-webkit-mask-image": true,
+        "-webkit-mask-origin": true,
+        "-webkit-mask-position": true,
+        "-webkit-mask-position-x": true,
+        "-webkit-mask-position-y": true,
+        "-webkit-mask-repeat": true,
+        "-webkit-mask-repeat-x": true,
+        "-webkit-mask-repeat-y": true,
+        "-webkit-mask-size": true,
+        "-webkit-match-nearest-mail-blockquote-color": true,
+        "-webkit-nbsp-mode": true,
+        "-webkit-padding-start": true,
+        "-webkit-perspective": true,
+        "-webkit-perspective-origin": true,
+        "-webkit-perspective-origin-x": true,
+        "-webkit-perspective-origin-y": true,
+        "-webkit-rtl-ordering": true,
+        "-webkit-text-decorations-in-effect": true,
+        "-webkit-text-fill-color": true,
+        "-webkit-text-security": true,
+        "-webkit-text-size-adjust": true,
+        "-webkit-text-stroke": true,
+        "-webkit-text-stroke-color": true,
+        "-webkit-text-stroke-width": true,
+        "-webkit-transform": true,
+        "-webkit-transform-origin": true,
+        "-webkit-transform-origin-x": true,
+        "-webkit-transform-origin-y": true,
+        "-webkit-transform-origin-z": true,
+        "-webkit-transform-style": true,
+        "-webkit-transition": true,
+        "-webkit-transition-delay": true,
+        "-webkit-transition-duration": true,
+        "-webkit-transition-property": true,
+        "-webkit-transition-timing-function": true,
+        "-webkit-user-drag": true,
+        "-webkit-user-modify": true,
+        "-webkit-user-select": true,
+        "-webkit-variable-declaration-block": true
+    };
+    function propertyAction(token)
+    {
+        this.cursor += token.length;
+        if (token in propertyKeywords) {
+            this.appendNonToken.call(this);
+            this.newLine.appendChild(this.createSpan(token, "webkit-css-property"));
+        } else
+            this.nonToken += token;
+    }
+    
+    function declarationColonAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DeclarationValue;
+    }
 
-        line._inSelector = inSelector;
-        line._inAtRuleBlock = inAtRuleBlock;
-        line._atRuleStarted = atRuleStarted;
-        line._atRuleIsSelector = atRuleIsSelector;
+    const valueKeywords = {
+        "inherit": true,
+        "initial": true,
+        "none": true,
+        "hidden": true,
+        "inset": true,
+        "groove": true,
+        "ridge": true,
+        "outset": true,
+        "dotted": true,
+        "dashed": true,
+        "solid": true,
+        "double": true,
+        "caption": true,
+        "icon": true,
+        "menu": true,
+        "message-box": true,
+        "small-caption": true,
+        "-webkit-mini-control": true,
+        "-webkit-small-control": true,
+        "-webkit-control": true,
+        "status-bar": true,
+        "italic": true,
+        "oblique": true,
+        "all": true,
+        "small-caps": true,
+        "normal": true,
+        "bold": true,
+        "bolder": true,
+        "lighter": true,
+        "xx-small": true,
+        "x-small": true,
+        "small": true,
+        "medium": true,
+        "large": true,
+        "x-large": true,
+        "xx-large": true,
+        "-webkit-xxx-large": true,
+        "smaller": true,
+        "larger": true,
+        "wider": true,
+        "narrower": true,
+        "ultra-condensed": true,
+        "extra-condensed": true,
+        "condensed": true,
+        "semi-condensed": true,
+        "semi-expanded": true,
+        "expanded": true,
+        "extra-expanded": true,
+        "ultra-expanded": true,
+        "serif": true,
+        "sans-serif": true,
+        "cursive": true,
+        "fantasy": true,
+        "monospace": true,
+        "-webkit-body": true,
+        "aqua": true,
+        "black": true,
+        "blue": true,
+        "fuchsia": true,
+        "gray": true,
+        "green": true,
+        "lime": true,
+        "maroon": true,
+        "navy": true,
+        "olive": true,
+        "orange": true,
+        "purple": true,
+        "red": true,
+        "silver": true,
+        "teal": true,
+        "white": true,
+        "yellow": true,
+        "transparent": true,
+        "-webkit-link": true,
+        "-webkit-activelink": true,
+        "activeborder": true,
+        "activecaption": true,
+        "appworkspace": true,
+        "background": true,
+        "buttonface": true,
+        "buttonhighlight": true,
+        "buttonshadow": true,
+        "buttontext": true,
+        "captiontext": true,
+        "graytext": true,
+        "highlight": true,
+        "highlighttext": true,
+        "inactiveborder": true,
+        "inactivecaption": true,
+        "inactivecaptiontext": true,
+        "infobackground": true,
+        "infotext": true,
+        "match": true,
+        "menutext": true,
+        "scrollbar": true,
+        "threeddarkshadow": true,
+        "threedface": true,
+        "threedhighlight": true,
+        "threedlightshadow": true,
+        "threedshadow": true,
+        "window": true,
+        "windowframe": true,
+        "windowtext": true,
+        "-webkit-focus-ring-color": true,
+        "currentcolor": true,
+        "grey": true,
+        "-webkit-text": true,
+        "repeat": true,
+        "repeat-x": true,
+        "repeat-y": true,
+        "no-repeat": true,
+        "clear": true,
+        "copy": true,
+        "source-over": true,
+        "source-in": true,
+        "source-out": true,
+        "source-atop": true,
+        "destination-over": true,
+        "destination-in": true,
+        "destination-out": true,
+        "destination-atop": true,
+        "xor": true,
+        "plus-darker": true,
+        "plus-lighter": true,
+        "baseline": true,
+        "middle": true,
+        "sub": true,
+        "super": true,
+        "text-top": true,
+        "text-bottom": true,
+        "top": true,
+        "bottom": true,
+        "-webkit-baseline-middle": true,
+        "-webkit-auto": true,
+        "left": true,
+        "right": true,
+        "center": true,
+        "justify": true,
+        "-webkit-left": true,
+        "-webkit-right": true,
+        "-webkit-center": true,
+        "outside": true,
+        "inside": true,
+        "disc": true,
+        "circle": true,
+        "square": true,
+        "decimal": true,
+        "decimal-leading-zero": true,
+        "lower-roman": true,
+        "upper-roman": true,
+        "lower-greek": true,
+        "lower-alpha": true,
+        "lower-latin": true,
+        "upper-alpha": true,
+        "upper-latin": true,
+        "hebrew": true,
+        "armenian": true,
+        "georgian": true,
+        "cjk-ideographic": true,
+        "hiragana": true,
+        "katakana": true,
+        "hiragana-iroha": true,
+        "katakana-iroha": true,
+        "inline": true,
+        "block": true,
+        "list-item": true,
+        "run-in": true,
+        "compact": true,
+        "inline-block": true,
+        "table": true,
+        "inline-table": true,
+        "table-row-group": true,
+        "table-header-group": true,
+        "table-footer-group": true,
+        "table-row": true,
+        "table-column-group": true,
+        "table-column": true,
+        "table-cell": true,
+        "table-caption": true,
+        "-webkit-box": true,
+        "-webkit-inline-box": true,
+        "-wap-marquee": true,
+        "auto": true,
+        "crosshair": true,
+        "default": true,
+        "pointer": true,
+        "move": true,
+        "vertical-text": true,
+        "cell": true,
+        "context-menu": true,
+        "alias": true,
+        "progress": true,
+        "no-drop": true,
+        "not-allowed": true,
+        "-webkit-zoom-in": true,
+        "-webkit-zoom-out": true,
+        "e-resize": true,
+        "ne-resize": true,
+        "nw-resize": true,
+        "n-resize": true,
+        "se-resize": true,
+        "sw-resize": true,
+        "s-resize": true,
+        "w-resize": true,
+        "ew-resize": true,
+        "ns-resize": true,
+        "nesw-resize": true,
+        "nwse-resize": true,
+        "col-resize": true,
+        "row-resize": true,
+        "text": true,
+        "wait": true,
+        "help": true,
+        "all-scroll": true,
+        "-webkit-grab": true,
+        "-webkit-grabbing": true,
+        "ltr": true,
+        "rtl": true,
+        "capitalize": true,
+        "uppercase": true,
+        "lowercase": true,
+        "visible": true,
+        "collapse": true,
+        "above": true,
+        "absolute": true,
+        "always": true,
+        "avoid": true,
+        "below": true,
+        "bidi-override": true,
+        "blink": true,
+        "both": true,
+        "close-quote": true,
+        "crop": true,
+        "cross": true,
+        "embed": true,
+        "fixed": true,
+        "hand": true,
+        "hide": true,
+        "higher": true,
+        "invert": true,
+        "landscape": true,
+        "level": true,
+        "line-through": true,
+        "local": true,
+        "loud": true,
+        "lower": true,
+        "-webkit-marquee": true,
+        "mix": true,
+        "no-close-quote": true,
+        "no-open-quote": true,
+        "nowrap": true,
+        "open-quote": true,
+        "overlay": true,
+        "overline": true,
+        "portrait": true,
+        "pre": true,
+        "pre-line": true,
+        "pre-wrap": true,
+        "relative": true,
+        "scroll": true,
+        "separate": true,
+        "show": true,
+        "static": true,
+        "thick": true,
+        "thin": true,
+        "underline": true,
+        "-webkit-nowrap": true,
+        "stretch": true,
+        "start": true,
+        "end": true,
+        "reverse": true,
+        "horizontal": true,
+        "vertical": true,
+        "inline-axis": true,
+        "block-axis": true,
+        "single": true,
+        "multiple": true,
+        "forwards": true,
+        "backwards": true,
+        "ahead": true,
+        "up": true,
+        "down": true,
+        "slow": true,
+        "fast": true,
+        "infinite": true,
+        "slide": true,
+        "alternate": true,
+        "read-only": true,
+        "read-write": true,
+        "read-write-plaintext-only": true,
+        "element": true,
+        "ignore": true,
+        "intrinsic": true,
+        "min-intrinsic": true,
+        "clip": true,
+        "ellipsis": true,
+        "discard": true,
+        "dot-dash": true,
+        "dot-dot-dash": true,
+        "wave": true,
+        "continuous": true,
+        "skip-white-space": true,
+        "break-all": true,
+        "break-word": true,
+        "space": true,
+        "after-white-space": true,
+        "checkbox": true,
+        "radio": true,
+        "push-button": true,
+        "square-button": true,
+        "button": true,
+        "button-bevel": true,
+        "default-button": true,
+        "list-button": true,
+        "listbox": true,
+        "listitem": true,
+        "media-fullscreen-button": true,
+        "media-mute-button": true,
+        "media-play-button": true,
+        "media-seek-back-button": true,
+        "media-seek-forward-button": true,
+        "media-rewind-button": true,
+        "media-return-to-realtime-button": true,
+        "media-slider": true,
+        "media-sliderthumb": true,
+        "media-volume-slider-container": true,
+        "media-volume-slider": true,
+        "media-volume-sliderthumb": true,
+        "media-controls-background": true,
+        "media-current-time-display": true,
+        "media-time-remaining-display": true,
+        "menulist": true,
+        "menulist-button": true,
+        "menulist-text": true,
+        "menulist-textfield": true,
+        "slider-horizontal": true,
+        "slider-vertical": true,
+        "sliderthumb-horizontal": true,
+        "sliderthumb-vertical": true,
+        "caret": true,
+        "searchfield": true,
+        "searchfield-decoration": true,
+        "searchfield-results-decoration": true,
+        "searchfield-results-button": true,
+        "searchfield-cancel-button": true,
+        "textfield": true,
+        "textarea": true,
+        "caps-lock-indicator": true,
+        "round": true,
+        "border": true,
+        "border-box": true,
+        "content": true,
+        "content-box": true,
+        "padding": true,
+        "padding-box": true,
+        "contain": true,
+        "cover": true,
+        "logical": true,
+        "visual": true,
+        "lines": true,
+        "running": true,
+        "paused": true,
+        "flat": true,
+        "preserve-3d": true,
+        "ease": true,
+        "linear": true,
+        "ease-in": true,
+        "ease-out": true,
+        "ease-in-out": true,
+        "document": true,
+        "reset": true,
+        "visiblePainted": true,
+        "visibleFill": true,
+        "visibleStroke": true,
+        "painted": true,
+        "fill": true,
+        "stroke": true,
+        "antialiased": true,
+        "subpixel-antialiased": true,
+        "optimizeSpeed": true,
+        "optimizeLegibility": true,
+        "geometricPrecision": true
+    };
+    function valueIdentAction(token) {
+        this.cursor += token.length;
+        if (token in valueKeywords) {
+            this.appendNonToken.call(this);
+            this.newLine.appendChild(this.createSpan(token, "webkit-css-keyword"));
+        } else
+            this.nonToken += token;
+    }
 
-        if (tmp < code.length)
-            line.appendChild(document.createTextNode(code.substring(tmp, i)));
+    function numvalueAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-number"));
+    }
+    
+    function declarationSemicolonAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DeclarationProperty;
+    }
+    
+    function urlAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-url"));
+    }
+    
+    function stringAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-string"));
+    }
+    
+    function colorAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-color"));
+    }
+    
+    function importantAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-important"));
+    }
+    
+    function atMediaAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-at-rule"));
+        this.lexState = this.LexState.AtMedia;
+    }
+    
+    function startAtMediaBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function atKeyframesAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-at-rule"));
+        this.lexState = this.LexState.AtKeyframes;
+    }
+    
+    function startAtKeyframesBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function atRuleAction(token) {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-at-rule"));
+        this.lexState = this.LexState.AtRule;
+    }
+    
+    function endAtRuleAction(token) {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function startAtRuleBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DeclarationProperty;
+    }
+    
+    const mediaTypes = ["all", "aural", "braille", "embossed", "handheld", "print", "projection", "screen", "tty", "tv"];
+    function atRuleIdentAction(token) {
+        this.cursor += token.length;
+        if (mediaTypes.indexOf(token) === -1)
+            this.nonToken += token;
+        else {
+            this.appendNonToken.call(this);
+            this.newLine.appendChild(this.createSpan(token, "webkit-css-keyword"));
+        }
     }
 }
 
-WebInspector.CSSSourceSyntaxHighligher.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
+WebInspector.CSSSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighlighter.prototype;
 
 WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
-    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+    WebInspector.SourceSyntaxHighlighter.call(this, table, sourceFrame);
 
     this.LexState = {
         Initial: 1,
@@ -996,212 +1853,282 @@ WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
     this.cursor = 0;
     this.lineIndex = -1;
     this.lineCode = "";
-    this.lineFragment = null;
+    this.newLine = null;
     this.lexState = this.LexState.Initial;
     this.continueState = this.ContinueState.None;
     
     this.rules = [{
-            pattern: /^(?:\/\/.*)/,
-            action: singleLineCommentAction
-        }, {
-            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*\*+\/)/,
-            action: multiLineSingleLineCommentAction
-        }, {
-            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*)/,
-            action: multiLineCommentStartAction
-        }, {
-            pattern: /^(?:(?:[^\*]|\*[^\/])*\*+\/)/,
-            action: multiLineCommentEndAction,
-            continueStateCondition: this.ContinueState.Comment
-        }, {
-            pattern: /^.*/,
-            action: multiLineCommentMiddleAction,
-            continueStateCondition: this.ContinueState.Comment
-        }, {
-            pattern: /^(?:(?:0|[1-9]\d*)\.\d+?(?:[eE](?:\d+|\+\d+|-\d+))?|\.\d+(?:[eE](?:\d+|\+\d+|-\d+))?|(?:0|[1-9]\d*)(?:[eE](?:\d+|\+\d+|-\d+))?|0x[0-9a-fA-F]+|0X[0-9a-fA-F]+)/,
-            action: numericLiteralAction
-        }, {
-            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*"|'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
-            action: stringLiteralAction
-        }, {
-            pattern: /^(?:'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: singleQuoteStringStartAction
-        }, {
-            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
-            action: singleQuoteStringEndAction,
-            continueStateCondition: this.ContinueState.SingleQuoteString
-        }, {
-            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: singleQuoteStringMiddleAction,
-            continueStateCondition: this.ContinueState.SingleQuoteString
-        }, {
-            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: doubleQuoteStringStartAction
-        }, {
-            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*")/,
-            action: doubleQuoteStringEndAction,
-            continueStateCondition: this.ContinueState.DoubleQuoteString
-        }, {
-            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: doubleQuoteStringMiddleAction,
-            continueStateCondition: this.ContinueState.DoubleQuoteString
-        }, {
-            pattern: /^(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
-            action: identOrKeywordAction,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^\)/,
-            action: rightParenAction,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^(?:<=|>=|===|==|!=|!==|\+\+|\-\-|<<|>>|>>>|&&|\|\||\+=|\-=|\*=|%=|<<=|>>=|>>>=|&=|\|=|^=|[{}\(\[\]\.;,<>\+\-\*%&\|\^!~\?:=])/,
-            action: punctuatorAction,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^(?:\/=?)/,
-            action: divPunctuatorAction,
-            stateCondition: this.LexState.DivisionAllowed,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
-            action: regExpLiteralAction
-        }, {
-            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*)\\$/,
-            action: regExpStartAction
-        }, {
-            pattern: /^(?:(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
-            action: regExpEndAction,
-            continueStateCondition: this.ContinueState.RegExp
-        }, {
-            pattern: /^(?:(?:(?:\\.)|[^\\/])*)\\$/,
-            action: regExpMiddleAction,
-            continueStateCondition: this.ContinueState.RegExp
-        }];
+        pattern: /^(?:\/\/.*)/,
+        action: singleLineCommentAction
+    }, {
+        pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*\*+\/)/,
+        action: multiLineSingleLineCommentAction
+    }, {
+        pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*)/,
+        action: multiLineCommentStartAction
+    }, {
+        pattern: /^(?:(?:[^\*]|\*[^\/])*\*+\/)/,
+        action: multiLineCommentEndAction,
+        continueStateCondition: this.ContinueState.Comment
+    }, {
+        pattern: /^.*/,
+        action: multiLineCommentMiddleAction,
+        continueStateCondition: this.ContinueState.Comment
+    }, {
+        pattern: /^(?:(?:0|[1-9]\d*)\.\d+?(?:[eE](?:\d+|\+\d+|-\d+))?|\.\d+(?:[eE](?:\d+|\+\d+|-\d+))?|(?:0|[1-9]\d*)(?:[eE](?:\d+|\+\d+|-\d+))?|0x[0-9a-fA-F]+|0X[0-9a-fA-F]+)/,
+        action: numericLiteralAction
+    }, {
+        pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*"|'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
+        action: stringLiteralAction
+    }, {
+        pattern: /^(?:'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+        action: singleQuoteStringStartAction
+    }, {
+        pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
+        action: singleQuoteStringEndAction,
+        continueStateCondition: this.ContinueState.SingleQuoteString
+    }, {
+        pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+        action: singleQuoteStringMiddleAction,
+        continueStateCondition: this.ContinueState.SingleQuoteString
+    }, {
+        pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+        action: doubleQuoteStringStartAction
+    }, {
+        pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*")/,
+        action: doubleQuoteStringEndAction,
+        continueStateCondition: this.ContinueState.DoubleQuoteString
+    }, {
+        pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+        action: doubleQuoteStringMiddleAction,
+        continueStateCondition: this.ContinueState.DoubleQuoteString
+    }, {
+        pattern: /^(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+        action: identOrKeywordAction
+    }, {
+        pattern: /^\)/,
+        action: rightParenAction,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^(?:<=|>=|===|==|!=|!==|\+\+|\-\-|<<|>>|>>>|&&|\|\||\+=|\-=|\*=|%=|<<=|>>=|>>>=|&=|\|=|^=|[{}\(\[\]\.;,<>\+\-\*%&\|\^!~\?:=])/,
+        action: punctuatorAction,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^(?:\/=?)/,
+        action: divPunctuatorAction,
+        lexStateCondition: this.LexState.DivisionAllowed,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+        action: regExpLiteralAction
+    }, {
+        pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*)\\$/,
+        action: regExpStartAction
+    }, {
+        pattern: /^(?:(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+        action: regExpEndAction,
+        continueStateCondition: this.ContinueState.RegExp
+    }, {
+        pattern: /^(?:(?:(?:\\.)|[^\\/])*)\\$/,
+        action: regExpMiddleAction,
+        continueStateCondition: this.ContinueState.RegExp
+    }];
     
     function singleLineCommentAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
     }
     
     function multiLineSingleLineCommentAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
     }
     
     function multiLineCommentStartAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
         this.continueState = this.ContinueState.Comment;
     }
     
     function multiLineCommentEndAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
         this.continueState = this.ContinueState.None;
     }
     
     function multiLineCommentMiddleAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
     }
     
     function numericLiteralAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-number"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-number"));
         this.lexState = this.LexState.DivisionAllowed;
     }
     
     function stringLiteralAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.lexState = this.LexState.Initial;
     }
     
     function singleQuoteStringStartAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.continueState = this.ContinueState.SingleQuoteString;
     }
     
     function singleQuoteStringEndAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.continueState = this.ContinueState.None;
     }
     
     function singleQuoteStringMiddleAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
     }
     
     function doubleQuoteStringStartAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.continueState = this.ContinueState.DoubleQuoteString;
     }
     
     function doubleQuoteStringEndAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.continueState = this.ContinueState.None;
     }
     
     function doubleQuoteStringMiddleAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
     }
     
     function regExpLiteralAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
         this.lexState = this.LexState.Initial;
     }
 
     function regExpStartAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
         this.continueState = this.ContinueState.RegExp;
     }
 
     function regExpEndAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
         this.continueState = this.ContinueState.None;
     }
 
     function regExpMiddleAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
     }
     
+    const keywords = {
+        "null": true,
+        "true": true,
+        "false": true,
+        "break": true,
+        "case": true,
+        "catch": true,
+        "const": true,
+        "default": true,
+        "finally": true,
+        "for": true,
+        "instanceof": true,
+        "new": true,
+        "var": true,
+        "continue": true,
+        "function": true,
+        "return": true,
+        "void": true,
+        "delete": true,
+        "if": true,
+        "this": true,
+        "do": true,
+        "while": true,
+        "else": true,
+        "in": true,
+        "switch": true,
+        "throw": true,
+        "try": true,
+        "typeof": true,
+        "debugger": true,
+        "class": true,
+        "enum": true,
+        "export": true,
+        "extends": true,
+        "import": true,
+        "super": true,
+        "get": true,
+        "set": true
+    };
     function identOrKeywordAction(token)
     {
-        const keywords = ["null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for", "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if", "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "with", "debugger", "class", "enum", "export", "extends", "import", "super", "get", "set"];
         this.cursor += token.length;
-        if (keywords.indexOf(token) === -1) {
-            this.nonToken += token;
-            this.lexState = this.LexState.DivisionAllowed;
-        } else {
-            this.appendNonToken();
-            this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-keyword"));
+        
+        if (token in keywords) {
+            this.newLine.appendChild(this.createSpan(token, "webkit-javascript-keyword"));
             this.lexState = this.LexState.Initial;
+        } else {
+            var identElement = this.createSpan(token, "webkit-javascript-ident");
+            identElement.addEventListener("mouseover", showDatatip, false);
+            this.newLine.appendChild(identElement);
+            this.lexState = this.LexState.DivisionAllowed;
+        }
+    }
+    
+    function showDatatip(event) {
+        if (!WebInspector.panels.scripts || !WebInspector.panels.scripts.paused)
+            return;
+
+        var node = event.target;
+        var parts = [node.textContent];
+        while (node.previousSibling && node.previousSibling.textContent === ".") {
+            node = node.previousSibling.previousSibling;
+            if (!node || !node.hasStyleClass("webkit-javascript-ident"))
+                break;
+            parts.unshift(node.textContent);
+        }
+
+        var expression = parts.join(".");
+
+        WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, "console", callback);
+        function callback(result, exception)
+        {
+            if (exception)
+                return;
+            event.target.setAttribute("title", result.description);
+            event.target.addEventListener("mouseout", onmouseout, false);
+            
+            function onmouseout(event)
+            {
+                event.target.removeAttribute("title");
+                event.target.removeEventListener("mouseout", onmouseout, false);
+            }
         }
     }
     
@@ -1227,131 +2154,4 @@ WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
     }
 }
 
-WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
-    process: function()
-    {
-        // Split up the work into chunks so we don't block the
-        // UI thread while processing.
-
-        var rows = this.table.rows;
-        var rowsLength = rows.length;
-        const tokensPerChunk = 100;
-        const lineLengthLimit = 20000;
-        
-        var boundProcessChunk = processChunk.bind(this);
-        var processChunkInterval = setInterval(boundProcessChunk, 25);
-        boundProcessChunk();
-        
-        function processChunk()
-        {
-            for (var i = 0; i < tokensPerChunk; i++) {
-                if (this.cursor >= this.lineCode.length)
-                    moveToNextLine.call(this);
-                if (this.lineIndex >= rowsLength) {
-                    this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
-                    return;
-                }
-                if (this.cursor > lineLengthLimit) {
-                    var codeFragment = this.lineCode.substring(this.cursor);
-                    this.nonToken += codeFragment;
-                    this.cursor += codeFragment.length;
-                }
-
-                this.lex();
-            }
-        }
-        
-        function moveToNextLine()
-        {
-            this.appendNonToken();
-            
-            var row = rows[this.lineIndex];
-            var line = row ? row.cells[1] : null;
-            if (line && this.lineFragment) {
-                var messageBubble = null;
-                if (line.lastChild && line.lastChild.nodeType === Node.ELEMENT_NODE && line.lastChild.hasStyleClass("webkit-html-message-bubble")) {
-                    messageBubble = line.lastChild;
-                    line.removeChild(messageBubble);
-                }
-                
-                Element.prototype.removeChildren.call(line);
-                
-                line.appendChild(this.lineFragment);
-                if (messageBubble)
-                    line.appendChild(messageBubble);
-                this.lineFragment = null;
-            }
-            this.lineIndex++;
-            if (this.lineIndex >= rowsLength && processChunkInterval) {
-                clearInterval(processChunkInterval);
-                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
-                return;
-            }
-            row = rows[this.lineIndex];
-            line = row ? row.cells[1] : null;
-            this.lineCode = line.textContent;
-            this.lineFragment = document.createDocumentFragment();
-            this.cursor = 0;
-            if (!line)
-                moveToNextLine();
-        }
-    },
-    
-    lex: function()
-    {
-        var token = null;
-        var codeFragment = this.lineCode.substring(this.cursor);
-        
-        for (var i = 0; i < this.rules.length; i++) {
-            var rule = this.rules[i];
-            var ruleContinueStateCondition = typeof rule.continueStateCondition === "undefined" ? this.ContinueState.None : rule.continueStateCondition;
-            if (this.continueState === ruleContinueStateCondition) {
-                if (typeof rule.stateCondition !== "undefined" && this.lexState !== rule.stateCondition)
-                    continue;
-                var match = rule.pattern.exec(codeFragment);
-                if (match) {
-                    token = match[0];
-                    if (token) {
-                        if (!rule.dontAppendNonToken)
-                            this.appendNonToken();
-                        return rule.action.call(this, token);
-                    }
-                }
-            }
-        }
-        this.nonToken += codeFragment[0];
-        this.cursor++;
-    },
-    
-    appendNonToken: function ()
-    {
-        if (this.nonToken.length > 0) {
-            this.lineFragment.appendChild(document.createTextNode(this.nonToken));
-            this.nonToken = "";
-        }
-    },
-    
-    syntaxHighlightNode: function(node)
-    {
-        this.lineCode = node.textContent;
-        this.lineFragment = document.createDocumentFragment();
-        this.cursor = 0;
-        while (true) {
-            if (this.cursor >= this.lineCode.length) {
-                var codeFragment = this.lineCode.substring(this.cursor);
-                this.nonToken += codeFragment;
-                this.cursor += codeFragment.length;
-                this.appendNonToken();
-                while (node.firstChild)
-                    node.removeChild(node.firstChild);
-                node.appendChild(this.lineFragment);
-                this.lineFragment =null;
-                return;
-            }
-
-            this.lex();
-        }
-    }
-}
-
-WebInspector.JavaScriptSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighlighter.prototype;
diff --git a/WebCore/inspector/front-end/SourceView.js b/WebCore/inspector/front-end/SourceView.js
index c1b1bbf..7ab7b5b 100644
--- a/WebCore/inspector/front-end/SourceView.js
+++ b/WebCore/inspector/front-end/SourceView.js
@@ -97,7 +97,7 @@ WebInspector.SourceView.prototype = {
 
         delete this._frameNeedsSetup;
         this.sourceFrame.addEventListener("content loaded", this._contentLoaded, this);
-        InspectorController.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element);
+        InspectorFrontendHost.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element);
     },
     
     _contentLoaded: function()
@@ -180,13 +180,13 @@ WebInspector.SourceView.prototype = {
         {
             if (isNaN(lineToSearch)) {
                 // Search the whole document since there was no line to search.
-                this._searchResults = (InspectorController.search(this.sourceFrame.element.contentDocument, query) || []);
+                this._searchResults = (InspectorFrontendHost.search(this.sourceFrame.element.contentDocument, query) || []);
             } else {
                 var sourceRow = this.sourceFrame.sourceRow(lineToSearch);
                 if (sourceRow) {
                     if (filterlessQuery) {
                         // There is still a query string, so search for that string in the line.
-                        this._searchResults = (InspectorController.search(sourceRow, filterlessQuery) || []);
+                        this._searchResults = (InspectorFrontendHost.search(sourceRow, filterlessQuery) || []);
                     } else {
                         // Match the whole line, since there was no remaining query string to match.
                         var rowRange = this.sourceFrame.element.contentDocument.createRange();
@@ -196,7 +196,7 @@ WebInspector.SourceView.prototype = {
                 }
 
                 // Attempt to search for the whole query, just incase it matches a color like "#333".
-                var wholeQueryMatches = InspectorController.search(this.sourceFrame.element.contentDocument, query);
+                var wholeQueryMatches = InspectorFrontendHost.search(this.sourceFrame.element.contentDocument, query);
                 if (wholeQueryMatches)
                     this._searchResults = this._searchResults.concat(wholeQueryMatches);
             }
diff --git a/WebCore/inspector/front-end/StoragePanel.js b/WebCore/inspector/front-end/StoragePanel.js
index 1aa11ee..dd558df 100644
--- a/WebCore/inspector/front-end/StoragePanel.js
+++ b/WebCore/inspector/front-end/StoragePanel.js
@@ -97,7 +97,6 @@ WebInspector.StoragePanel.prototype = {
 
         this._domStorage = [];
 
-        this._cookieDomains = {};
         this._cookieViews = {};
 
         this.databasesListTreeElement.removeChildren();
@@ -124,13 +123,8 @@ WebInspector.StoragePanel.prototype = {
     
     addCookieDomain: function(domain)
     {
-        // Eliminate duplicate domains from the list.
-        if (typeof this._cookieDomains[domain] !== "undefined")
-            return;
-
         var cookieDomainTreeElement = new WebInspector.CookieSidebarTreeElement(domain);
         this.cookieListTreeElement.appendChild(cookieDomainTreeElement);
-        this._cookieDomains[domain] = true;
     },
 
     addDOMStorage: function(domStorage)
diff --git a/WebCore/inspector/front-end/StylesSidebarPane.js b/WebCore/inspector/front-end/StylesSidebarPane.js
index a95dae3..5178a98 100644
--- a/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -93,13 +93,12 @@ WebInspector.StylesSidebarPane.prototype = {
             node = this.node;
 
         var body = this.bodyElement;
-        if (!refresh || !node) {
+
+        if (!node) {
             body.removeChildren();
             this.sections = [];
-        }
-
-        if (!node)
             return;
+        }
 
         var self = this;
         function callback(styles)
@@ -335,7 +334,7 @@ WebInspector.StylesSidebarPane.prototype = {
         var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
         Preferences.colorFormat = selectedOption.value;
 
-        InspectorController.setSetting("color-format", Preferences.colorFormat);
+        InspectorFrontendHost.setSetting("color-format", Preferences.colorFormat);
 
         for (var i = 0; i < this.sections.length; ++i)
             this.sections[i].update(true);
@@ -1099,7 +1098,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
     },
 
-    ondblclick: function(element, event)
+    ondblclick: function(event)
     {
         this.startEditing(event.target);
         event.stopPropagation();
@@ -1354,7 +1353,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
             if (updateInterface)
                 self.updateAll(true);
 
-            if (!self.rule)
+            if (!section.rule)
                 WebInspector.panels.elements.treeOutline.update();
         }
 
diff --git a/WebCore/inspector/front-end/TestController.js b/WebCore/inspector/front-end/TestController.js
index 12e1ac7..b2630ae 100644
--- a/WebCore/inspector/front-end/TestController.js
+++ b/WebCore/inspector/front-end/TestController.js
@@ -42,8 +42,8 @@ WebInspector.TestController.prototype = {
 
     notifyDone: function(result)
     {
-        var message = typeof result === "undefined" ? "<undefined>" : JSON.stringify(result);
-        InspectorController.didEvaluateForTestInFrontend(this._callId, message);
+        var message = typeof result === "undefined" ? "\"<undefined>\"" : JSON.stringify(result);
+        InspectorBackend.didEvaluateForTestInFrontend(this._callId, message);
     },
 
     runAfterPendingDispatches: function(callback)
@@ -52,7 +52,6 @@ WebInspector.TestController.prototype = {
             callback();
             return;
         }
-
         setTimeout(this.runAfterPendingDispatches.bind(this), 0, callback);
     }
 }
@@ -60,16 +59,20 @@ WebInspector.TestController.prototype = {
 WebInspector.evaluateForTestInFrontend = function(callId, script)
 {
     var controller = new WebInspector.TestController(callId);
-    try {
-        var result;
-        if (window[script] && typeof window[script] === "function")
-            result = window[script].call(this, controller);
-        else
-            result = window.eval(script);
+    function invokeMethod()
+    {
+        try {
+            var result;
+            if (window[script] && typeof window[script] === "function")
+                result = window[script].call(WebInspector, controller);
+            else
+                result = window.eval(script);
 
-        if (!controller._waitUntilDone)
-            controller.notifyDone(result);
-    } catch (e) {
-        controller.notifyDone(e.toString());
+            if (!controller._waitUntilDone)
+                controller.notifyDone(result);
+        } catch (e) {
+            controller.notifyDone(e.toString());
+        }
     }
+    controller.runAfterPendingDispatches(invokeMethod);
 }
diff --git a/WebCore/inspector/front-end/TextPrompt.js b/WebCore/inspector/front-end/TextPrompt.js
index f73ab0d..2230eaa 100644
--- a/WebCore/inspector/front-end/TextPrompt.js
+++ b/WebCore/inspector/front-end/TextPrompt.js
@@ -55,6 +55,13 @@ WebInspector.TextPrompt.prototype = {
 
     handleKeyEvent: function(event)
     {
+        function defaultAction()
+        {
+            this.clearAutoComplete();
+            this.autoCompleteSoon();
+        }
+
+        var handled = false;
         switch (event.keyIdentifier) {
             case "Up":
                 this._upKeyPressed(event);
@@ -70,11 +77,36 @@ WebInspector.TextPrompt.prototype = {
                 if (!this.acceptAutoComplete())
                     this.autoCompleteSoon();
                 break;
+            case "Alt":
+            case "Meta":
+            case "Shift":
+            case "Control":
+                break;
+            case "U+0050": // Ctrl+P = Previous
+                if (WebInspector.isMac() && event.ctrlKey && !event.metaKey && !event.altKey && !event.shiftKey) {
+                    handled = true;
+                    this._moveBackInHistory();
+                    break;
+                }
+                defaultAction.call(this);
+                break;
+            case "U+004E": // Ctrl+N = Next
+                if (WebInspector.isMac() && event.ctrlKey && !event.metaKey && !event.altKey && !event.shiftKey) {
+                    handled = true;
+                    this._moveForwardInHistory();
+                    break;
+                }
+                defaultAction.call(this);
+                break;
             default:
-                this.clearAutoComplete();
-                this.autoCompleteSoon();
+                defaultAction.call(this);
                 break;
         }
+
+        if (handled) {
+            event.preventDefault();
+            event.stopPropagation();
+        }
     },
 
     acceptAutoComplete: function()
@@ -118,7 +150,7 @@ WebInspector.TextPrompt.prototype = {
         this._userEnteredRange.deleteContents();
 
         var userTextNode = document.createTextNode(this._userEnteredText);
-        this._userEnteredRange.insertNode(userTextNode);           
+        this._userEnteredRange.insertNode(userTextNode);
 
         var selectionRange = document.createRange();
         selectionRange.setStart(userTextNode, this._userEnteredText.length);
@@ -174,10 +206,9 @@ WebInspector.TextPrompt.prototype = {
             var currentText = fullWordRange.toString();
 
             var foundIndex = null;
-            for (var i = 0; i < completions.length; ++i) {
+            for (var i = 0; i < completions.length; ++i)
                 if (completions[i] === currentText)
                     foundIndex = i;
-            }
 
             if (foundIndex === null || (foundIndex + 1) >= completions.length)
                 var completionText = completions[0];
@@ -199,7 +230,7 @@ WebInspector.TextPrompt.prototype = {
             var suffixText = completionText.substring(wordPrefixLength);
 
             var prefixTextNode = document.createTextNode(prefixText);
-            fullWordRange.insertNode(prefixTextNode);           
+            fullWordRange.insertNode(prefixTextNode);
 
             this.autoCompleteElement = document.createElement("span");
             this.autoCompleteElement.className = "auto-complete-text";
@@ -211,7 +242,7 @@ WebInspector.TextPrompt.prototype = {
             finalSelectionRange.setEnd(prefixTextNode, wordPrefixLength);
         } else {
             var completionTextNode = document.createTextNode(completionText);
-            fullWordRange.insertNode(completionTextNode);           
+            fullWordRange.insertNode(completionTextNode);
 
             if (completions.length > 1)
                 finalSelectionRange.setStart(completionTextNode, wordPrefixLength);
@@ -258,6 +289,50 @@ WebInspector.TextPrompt.prototype = {
         return true;
     },
 
+    isCaretOnFirstLine: function()
+    {
+        var selection = window.getSelection();
+        var focusNode = selection.focusNode;
+        if (!focusNode || focusNode.nodeType !== Node.TEXT_NODE || focusNode.parentNode !== this.element)
+            return true;
+
+        if (focusNode.textContent.substring(0, selection.focusOffset).indexOf("\n") !== -1)
+            return false;
+        focusNode = focusNode.previousSibling;
+
+        while (focusNode) {
+            if (focusNode.nodeType !== Node.TEXT_NODE)
+                return true;
+            if (focusNode.textContent.indexOf("\n") !== -1)
+                return false;
+            focusNode = focusNode.previousSibling;
+        }
+
+        return true;
+    },
+
+    isCaretOnLastLine: function()
+    {
+        var selection = window.getSelection();
+        var focusNode = selection.focusNode;
+        if (!focusNode || focusNode.nodeType !== Node.TEXT_NODE || focusNode.parentNode !== this.element)
+            return true;
+
+        if (focusNode.textContent.substring(selection.focusOffset).indexOf("\n") !== -1)
+            return false;
+        focusNode = focusNode.nextSibling;
+
+        while (focusNode) {
+            if (focusNode.nodeType !== Node.TEXT_NODE)
+                return true;
+            if (focusNode.textContent.indexOf("\n") !== -1)
+                return false;
+            focusNode = focusNode.nextSibling;
+        }
+
+        return true;
+    },
+
     moveCaretToEndOfPrompt: function()
     {
         var selection = window.getSelection();
@@ -281,39 +356,71 @@ WebInspector.TextPrompt.prototype = {
 
     _upKeyPressed: function(event)
     {
+        if (!this.isCaretOnFirstLine())
+            return;
+
+        event.preventDefault();
+        event.stopPropagation();
+
+        this._moveBackInHistory();
+    },
+
+    _downKeyPressed: function(event)
+    {
+        if (!this.isCaretOnLastLine())
+            return;
+
         event.preventDefault();
         event.stopPropagation();
 
+        this._moveForwardInHistory();
+    },
+
+    _moveBackInHistory: function()
+    {
         if (this.historyOffset == this.history.length)
             return;
 
         this.clearAutoComplete(true);
 
-        if (this.historyOffset == 0)
+        if (this.historyOffset === 0)
             this.tempSavedCommand = this.text;
 
         ++this.historyOffset;
         this.text = this.history[this.history.length - this.historyOffset];
+
+        this.element.scrollIntoViewIfNeeded();
+        var firstNewlineIndex = this.text.indexOf("\n");
+        if (firstNewlineIndex === -1)
+            this.moveCaretToEndOfPrompt();
+        else {
+            var selection = window.getSelection();
+            var selectionRange = document.createRange();
+
+            selectionRange.setStart(this.element.firstChild, firstNewlineIndex);
+            selectionRange.setEnd(this.element.firstChild, firstNewlineIndex);
+
+            selection.removeAllRanges();
+            selection.addRange(selectionRange);
+        }
     },
 
-    _downKeyPressed: function(event)
+    _moveForwardInHistory: function()
     {
-        event.preventDefault();
-        event.stopPropagation();
-
-        if (this.historyOffset == 0)
+        if (this.historyOffset === 0)
             return;
 
         this.clearAutoComplete(true);
 
         --this.historyOffset;
 
-        if (this.historyOffset == 0) {
+        if (this.historyOffset === 0) {
             this.text = this.tempSavedCommand;
             delete this.tempSavedCommand;
             return;
         }
 
         this.text = this.history[this.history.length - this.historyOffset];
+        this.element.scrollIntoViewIfNeeded();
     }
 }
diff --git a/WebCore/inspector/front-end/TimelineAgent.js b/WebCore/inspector/front-end/TimelineAgent.js
index cbbb736..c9e9d64 100644
--- a/WebCore/inspector/front-end/TimelineAgent.js
+++ b/WebCore/inspector/front-end/TimelineAgent.js
@@ -34,17 +34,21 @@ WebInspector.TimelineAgent = function() {
 
 // Must be kept in sync with TimelineItem.h
 WebInspector.TimelineAgent.RecordType = {
-    DOMDispatch         : 0,
-    Layout              : 1,
-    RecalculateStyles   : 2,
-    Paint               : 3,
-    ParseHTML           : 4,
-    TimerInstall        : 5,
-    TimerRemove         : 6,
-    TimerFire           : 7,
+    EventDispatch : 0,
+    Layout : 1,
+    RecalculateStyles : 2,
+    Paint : 3,
+    ParseHTML : 4,
+    TimerInstall : 5,
+    TimerRemove : 6,
+    TimerFire : 7,
     XHRReadyStateChange : 8,
-    XHRLoad             : 9,
-    EvaluateScriptTag   : 10
+    XHRLoad : 9,
+    EvaluateScript : 10,
+    MarkTimeline : 11,
+    ResourceSendRequest : 12,
+    ResourceReceiveResponse : 13,
+    ResourceFinish : 14
 };
 
 WebInspector.addRecordToTimeline = function(record) {
diff --git a/WebCore/inspector/front-end/TimelineGrid.js b/WebCore/inspector/front-end/TimelineGrid.js
new file mode 100644
index 0000000..2866ecd
--- /dev/null
+++ b/WebCore/inspector/front-end/TimelineGrid.js
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelineGrid = function()
+{
+    this.element = document.createElement("div");
+
+    this._itemsGraphsElement = document.createElement("div");
+    this._itemsGraphsElement.id = "resources-graphs";
+    this.element.appendChild(this._itemsGraphsElement);
+
+    this._dividersElement = document.createElement("div");
+    this._dividersElement.id = "resources-dividers";
+    this.element.appendChild(this._dividersElement);
+
+    this._eventDividersElement = document.createElement("div");
+    this._eventDividersElement.id = "resources-event-dividers";
+    this.element.appendChild(this._eventDividersElement);
+
+    this._dividersLabelBarElement = document.createElement("div");
+    this._dividersLabelBarElement.id = "resources-dividers-label-bar";
+    this.element.appendChild(this._dividersLabelBarElement);
+}
+
+WebInspector.TimelineGrid.prototype = {
+    get itemsGraphsElement()
+    {
+        return this._itemsGraphsElement;
+    },
+
+    updateDividers: function(force, calculator, paddingLeft)
+    {
+        var dividerCount = Math.round(this._dividersElement.offsetWidth / 64);
+        var slice = calculator.boundarySpan / dividerCount;
+        if (!force && this._currentDividerSlice === slice)
+            return false;
+
+        if (!(typeof paddingLeft === "number"))
+            paddingLeft = 0;
+        this._currentDividerSlice = slice;
+
+        this._eventDividersElement.removeChildren();
+        // Reuse divider elements and labels.
+        var divider = this._dividersElement.firstChild;
+        var dividerLabelBar = this._dividersLabelBarElement.firstChild;
+
+        var clientWidth = this._dividersLabelBarElement.clientWidth - paddingLeft;
+        for (var i = paddingLeft ? 0 : 1; i <= dividerCount; ++i) {
+            if (!divider) {
+                divider = document.createElement("div");
+                divider.className = "resources-divider";
+                this._dividersElement.appendChild(divider);
+
+                dividerLabelBar = document.createElement("div");
+                dividerLabelBar.className = "resources-divider";
+                var label = document.createElement("div");
+                label.className = "resources-divider-label";
+                dividerLabelBar._labelElement = label;
+                dividerLabelBar.appendChild(label);
+                this._dividersLabelBarElement.appendChild(dividerLabelBar);
+            }
+
+            if (i === dividerCount)
+                divider.addStyleClass("last");
+            else
+                divider.removeStyleClass("last");
+
+            var left = paddingLeft + clientWidth * (i / dividerCount);
+            var percentLeft = 100 * left / this._dividersLabelBarElement.clientWidth + "%";
+            divider.style.left = percentLeft;
+            dividerLabelBar.style.left = percentLeft;
+
+            if (!isNaN(slice))
+                dividerLabelBar._labelElement.textContent = calculator.formatValue(slice * i);
+
+            divider = divider.nextSibling;
+            dividerLabelBar = dividerLabelBar.nextSibling;
+        }
+
+        // Remove extras.
+        while (divider) {
+            var nextDivider = divider.nextSibling;
+            this._dividersElement.removeChild(divider);
+            divider = nextDivider;
+        }
+        while (dividerLabelBar) {
+            var nextDivider = dividerLabelBar.nextSibling;
+            this._dividersLabelBarElement.removeChild(dividerLabelBar);
+            dividerLabelBar = nextDivider;
+        }
+        return true;
+    },
+
+    addEventDivider: function(divider)
+    {
+        this._eventDividersElement.appendChild(divider);
+    },
+
+    setScrollAndDividerTop: function(scrollTop, dividersTop)
+    {
+        this._dividersElement.style.top = scrollTop + "px";
+        this._eventDividersElement.style.top = scrollTop + "px";
+        this._dividersLabelBarElement.style.top = dividersTop + "px";
+    }
+}
diff --git a/WebCore/inspector/front-end/TimelineOverviewPane.js b/WebCore/inspector/front-end/TimelineOverviewPane.js
new file mode 100644
index 0000000..b673abe
--- /dev/null
+++ b/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -0,0 +1,387 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelineOverviewPane = function(categories)
+{
+    this.element = document.createElement("div");
+    this.element.id = "timeline-overview-panel";
+
+    this._categories = categories;
+    this._overviewSidebarElement = document.createElement("div");
+    this._overviewSidebarElement.id = "timeline-overview-sidebar";
+    this.element.appendChild(this._overviewSidebarElement);
+
+    var overviewTreeElement = document.createElement("ol");
+    overviewTreeElement.className = "sidebar-tree";
+    this._overviewSidebarElement.appendChild(overviewTreeElement);
+    var sidebarTree = new TreeOutline(overviewTreeElement);
+
+    var categoriesTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("TIMELINES"), {}, true);
+    categoriesTreeElement.expanded = true;
+    sidebarTree.appendChild(categoriesTreeElement);
+    for (var categoryName in this._categories) {
+        var category = this._categories[categoryName];
+        categoriesTreeElement.appendChild(new WebInspector.TimelineCategoryTreeElement(category, this._onCheckboxClicked.bind(this, category)));
+    }
+
+    this._overviewGrid = new WebInspector.TimelineGrid();
+    this._overviewGrid.element.id = "timeline-overview-grid";
+    this._overviewGrid.itemsGraphsElement.id = "timeline-overview-graphs";
+    this.element.appendChild(this._overviewGrid.element);
+
+    this._categoryGraphs = {};
+    var i = 0;
+    for (var category in this._categories) {
+        var categoryGraph = new WebInspector.TimelineCategoryGraph(this._categories[category], i++ % 2);
+        this._categoryGraphs[category] = categoryGraph;
+        this._overviewGrid.itemsGraphsElement.appendChild(categoryGraph.graphElement);
+    }
+    this._overviewGrid.setScrollAndDividerTop(0, 0);
+
+    this._overviewWindowElement = document.createElement("div");
+    this._overviewWindowElement.id = "timeline-overview-window";
+    this._overviewWindowElement.addEventListener("mousedown", this._dragWindow.bind(this), false);
+    this._overviewGrid.element.appendChild(this._overviewWindowElement);
+
+    this._leftResizeElement = document.createElement("div");
+    this._leftResizeElement.className = "timeline-window-resizer";
+    this._leftResizeElement.style.left = 0;
+    this._overviewGrid.element.appendChild(this._leftResizeElement);
+    this._leftResizeElement.addEventListener("mousedown", this._resizeWindow.bind(this, this._leftResizeElement), false);
+
+    this._rightResizeElement = document.createElement("div");
+    this._rightResizeElement.className = "timeline-window-resizer timeline-window-resizer-right";
+    this._rightResizeElement.style.right = 0;
+    this._overviewGrid.element.appendChild(this._rightResizeElement);
+    this._rightResizeElement.addEventListener("mousedown", this._resizeWindow.bind(this, this._rightResizeElement), false);
+
+    this._overviewCalculator = new WebInspector.TimelineOverviewCalculator();
+
+    var separatorElement = document.createElement("div");
+    separatorElement.id = "timeline-overview-separator";
+    this.element.appendChild(separatorElement);
+
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+}
+
+
+WebInspector.TimelineOverviewPane.prototype = {
+    _onCheckboxClicked: function (category, event) {
+        if (event.target.checked)
+            category.hidden = false;
+        else
+            category.hidden = true;
+        this._categoryGraphs[category.name].dimmed = !event.target.checked;
+        this.dispatchEventToListeners("filter changed");
+    },
+
+    update: function(records)
+    {
+        // Clear summary bars.
+        var timelines = {};
+        for (var category in this._categories) {
+            timelines[category] = [];
+            this._categoryGraphs[category].clearChunks();
+        }
+
+        function forAllRecords(recordsArray, callback)
+        {
+            if (!recordsArray)
+                return;
+            for (var i = 0; i < recordsArray.length; ++i) {
+                callback(recordsArray[i]);
+                forAllRecords(recordsArray[i].children, callback);
+            }
+        }
+
+        // Create sparse arrays with 101 cells each to fill with chunks for a given category.
+        this._overviewCalculator.reset();
+        forAllRecords(records, this._overviewCalculator.updateBoundaries.bind(this._overviewCalculator));
+
+        function markTimeline(record)
+        {
+            var percentages = this._overviewCalculator.computeBarGraphPercentages(record);
+
+            var end = Math.round(percentages.end);
+            var categoryName = record.category.name;
+            for (var j = Math.round(percentages.start); j <= end; ++j)
+                timelines[categoryName][j] = true;
+        }
+        forAllRecords(records, markTimeline.bind(this));
+
+        // Convert sparse arrays to continuous segments, render graphs for each.
+        for (var category in this._categories) {
+            var timeline = timelines[category];
+            window.timelineSaved = timeline;
+            var chunkStart = -1;
+            for (var j = 0; j < 101; ++j) {
+                if (timeline[j]) {
+                    if (chunkStart === -1)
+                        chunkStart = j;
+                } else {
+                    if (chunkStart !== -1) {
+                        this._categoryGraphs[category].addChunk(chunkStart, j);
+                        chunkStart = -1;
+                    }
+                }
+            }
+            if (chunkStart !== -1) {
+                this._categoryGraphs[category].addChunk(chunkStart, 100);
+                chunkStart = -1;
+            }
+        }
+        this._overviewGrid.updateDividers(true, this._overviewCalculator);
+    },
+
+    setSidebarWidth: function(width)
+    {
+        this._overviewSidebarElement.style.width = width + "px";
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        this._overviewGrid.element.style.left = width + "px";
+    },
+
+    reset: function()
+    {
+        this._overviewCalculator.reset();
+        this._overviewGrid.updateDividers(true, this._overviewCalculator);
+        this.windowLeft = 0.0;
+        this.windowRight = 1.0;
+    },
+
+    _resizeWindow: function(resizeElement, event)
+    {
+        WebInspector.elementDragStart(resizeElement, this._windowResizeDragging.bind(this, resizeElement), this._endWindowDragging.bind(this), event, "col-resize");
+    },
+
+    _windowResizeDragging: function(resizeElement, event)
+    {
+        if (resizeElement === this._leftResizeElement)
+            this._resizeWindowLeft(event.pageX - this._overviewGrid.element.offsetLeft);
+        else
+            this._resizeWindowRight(event.pageX - this._overviewGrid.element.offsetLeft);
+        event.preventDefault();
+    },
+
+    _dragWindow: function(event)
+    {
+        WebInspector.elementDragStart(this._overviewWindowElement, this._windowDragging.bind(this, event.pageX,
+            this._leftResizeElement.offsetLeft, this._rightResizeElement.offsetLeft), this._endWindowDragging.bind(this), event, "ew-resize");
+    },
+
+    _windowDragging: function(startX, windowLeft, windowRight, event)
+    {
+        var delta = event.pageX - startX;
+        var start = windowLeft + delta;
+        var end = windowRight + delta;
+        var windowSize = windowRight - windowLeft;
+
+        if (start < 0) {
+            start = 0;
+            end = windowSize;
+        }
+
+        if (end > this._overviewGrid.element.clientWidth) {
+            end = this._overviewGrid.element.clientWidth;
+            start = end - windowSize;
+        }
+        this._setWindowPosition(start, end);
+
+        event.preventDefault();
+    },
+
+    _resizeWindowLeft: function(start)
+    {
+        // Glue to edge.
+        if (start < 10)
+            start = 0;
+        this._setWindowPosition(start, null);
+    },
+
+    _resizeWindowRight: function(end)
+    {
+        // Glue to edge.
+        if (end > this._overviewGrid.element.clientWidth - 10)
+            end = this._overviewGrid.element.clientWidth;
+        this._setWindowPosition(null, end);
+    },
+
+    _setWindowPosition: function(start, end)
+    {
+        if (typeof start === "number") {
+            if (start > this._rightResizeElement.offsetLeft - 4)
+                start = this._rightResizeElement.offsetLeft - 4;
+
+            this.windowLeft = start / this._overviewGrid.element.clientWidth;
+            this._leftResizeElement.style.left = this.windowLeft * 100 + "%";
+            this._overviewWindowElement.style.left = this.windowLeft * 100 + "%";
+        }
+        if (typeof end === "number") {
+            if (end < this._leftResizeElement.offsetLeft + 12)
+                end = this._leftResizeElement.offsetLeft + 12;
+
+            this.windowRight = end / this._overviewGrid.element.clientWidth;
+            this._rightResizeElement.style.left = this.windowRight * 100 + "%";
+        }
+        this._overviewWindowElement.style.width = (this.windowRight - this.windowLeft) * 100 + "%";
+        this.dispatchEventToListeners("window changed");
+    },
+
+    _endWindowDragging: function(event)
+    {
+        WebInspector.elementDragEnd(event);
+    }
+}
+
+WebInspector.TimelineOverviewPane.prototype.__proto__ = WebInspector.Object.prototype;
+
+
+WebInspector.TimelineOverviewCalculator = function()
+{
+    this._uiString = WebInspector.UIString.bind(WebInspector);
+}
+
+WebInspector.TimelineOverviewCalculator.prototype = {
+    computeBarGraphPercentages: function(record)
+    {
+        var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var end = (record.endTime - this.minimumBoundary) / this.boundarySpan * 100;
+        return {start: start, end: end};
+    },
+
+    reset: function()
+    {
+        delete this.minimumBoundary;
+        delete this.maximumBoundary;
+    },
+
+    updateBoundaries: function(record)
+    {
+        if (typeof this.minimumBoundary === "undefined" || record.startTime < this.minimumBoundary) {
+            this.minimumBoundary = record.startTime;
+            return true;
+        }
+        if (typeof this.maximumBoundary === "undefined" || record.endTime > this.maximumBoundary) {
+            this.maximumBoundary = record.endTime;
+            return true;
+        }
+        return false;
+    },
+
+    get boundarySpan()
+    {
+        return this.maximumBoundary - this.minimumBoundary;
+    },
+
+    formatValue: function(value)
+    {
+        return Number.secondsToString(value, this._uiString);
+    }
+}
+
+
+WebInspector.TimelineCategoryTreeElement = function(category, onCheckboxClicked)
+{
+    this._category = category;
+    this._onCheckboxClicked = onCheckboxClicked;
+    // Pass an empty title, the title gets made later in onattach.
+    TreeElement.call(this, "", null, false);
+}
+
+WebInspector.TimelineCategoryTreeElement.prototype = {
+    onattach: function()
+    {
+        this.listItemElement.removeChildren();
+        this.listItemElement.addStyleClass("timeline-category-tree-item");
+        this.listItemElement.addStyleClass("timeline-category-" + this._category.name);
+
+        var label = document.createElement("label");
+
+        var checkElement = document.createElement("input");
+        checkElement.type = "checkbox";
+        checkElement.className = "timeline-category-checkbox";
+        checkElement.checked = true;
+        checkElement.addEventListener("click", this._onCheckboxClicked);
+        label.appendChild(checkElement);
+
+        var typeElement = document.createElement("span");
+        typeElement.className = "type";
+        typeElement.textContent = this._category.title;
+        label.appendChild(typeElement);
+
+        this.listItemElement.appendChild(label);
+    }
+}
+
+WebInspector.TimelineCategoryTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+WebInspector.TimelineCategoryGraph = function(category, isEven)
+{
+    this._category = category;
+
+    this._graphElement = document.createElement("div");
+    this._graphElement.className = "timeline-graph-side timeline-overview-graph-side" + (isEven ? " even" : "");
+
+    this._barAreaElement = document.createElement("div");
+    this._barAreaElement.className = "timeline-graph-bar-area timeline-category-" + category.name;
+    this._graphElement.appendChild(this._barAreaElement);
+}
+
+WebInspector.TimelineCategoryGraph.prototype = {
+    get graphElement()
+    {
+        return this._graphElement;
+    },
+
+    addChunk: function(start, end)
+    {
+        var chunk = document.createElement("div");
+        chunk.className = "timeline-graph-bar";
+        this._barAreaElement.appendChild(chunk);
+        chunk.style.setProperty("left", start + "%");
+        chunk.style.setProperty("width", (end - start) + "%");
+    },
+
+    clearChunks: function()
+    {
+        this._barAreaElement.removeChildren();
+    },
+
+    set dimmed(dimmed)
+    {
+        if (dimmed)
+            this._barAreaElement.removeStyleClass("timeline-category-" + this._category.name);
+        else
+            this._barAreaElement.addStyleClass("timeline-category-" + this._category.name);
+    }
+}
diff --git a/WebCore/inspector/front-end/TimelinePanel.js b/WebCore/inspector/front-end/TimelinePanel.js
index df63a0b..ac36fa5 100644
--- a/WebCore/inspector/front-end/TimelinePanel.js
+++ b/WebCore/inspector/front-end/TimelinePanel.js
@@ -30,19 +30,56 @@
 
 WebInspector.TimelinePanel = function()
 {
-    WebInspector.AbstractTimelinePanel.call(this);
-
+    WebInspector.Panel.call(this);
     this.element.addStyleClass("timeline");
 
-    this.createInterface();
-    this.summaryBar.element.id = "timeline-summary";
-    this.itemsGraphsElement.id = "timeline-graphs";
+    this._overviewPane = new WebInspector.TimelineOverviewPane(this.categories);
+    this._overviewPane.addEventListener("window changed", this._scheduleRefresh, this);
+    this._overviewPane.addEventListener("filter changed", this._refresh, this);
+    this.element.appendChild(this._overviewPane.element);
 
-    this._createStatusbarButtons();
+    this._sidebarBackgroundElement = document.createElement("div");
+    this._sidebarBackgroundElement.className = "sidebar timeline-sidebar-background";
+    this.element.appendChild(this._sidebarBackgroundElement);
+
+    this._containerElement = document.createElement("div");
+    this._containerElement.id = "timeline-container";
+    this._containerElement.addEventListener("scroll", this._onScroll.bind(this), false);
+    this.element.appendChild(this._containerElement);
+
+    this.createSidebar(this._containerElement, this._containerElement);
+    var itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
+    itemsTreeElement.expanded = true;
+    this.sidebarTree.appendChild(itemsTreeElement);
+
+    this._sidebarListElement = document.createElement("div");
+    this.sidebarElement.appendChild(this._sidebarListElement);
+
+    this._containerContentElement = document.createElement("div");
+    this._containerContentElement.id = "resources-container-content";
+    this._containerElement.appendChild(this._containerContentElement);
+
+    this._timelineGrid = new WebInspector.TimelineGrid();
+    this._itemsGraphsElement = this._timelineGrid.itemsGraphsElement;
+    this._itemsGraphsElement.id = "timeline-graphs";
+    this._containerContentElement.appendChild(this._timelineGrid.element);
+
+    this._topGapElement = document.createElement("div");
+    this._topGapElement.className = "timeline-gap";
+    this._itemsGraphsElement.appendChild(this._topGapElement);
 
-    this.calculator = new WebInspector.TimelineCalculator();
+    this._graphRowsElement = document.createElement("div");
+    this._itemsGraphsElement.appendChild(this._graphRowsElement);
 
-    this.filter(this.filterAllElement, false);
+    this._bottomGapElement = document.createElement("div");
+    this._bottomGapElement.className = "timeline-gap";
+    this._itemsGraphsElement.appendChild(this._bottomGapElement);
+
+    this._createStatusbarButtons();
+
+    this._records = [];
+    this._sendRequestRecords = {};
+    this._calculator = new WebInspector.TimelineCalculator();
 }
 
 WebInspector.TimelinePanel.prototype = {
@@ -64,20 +101,12 @@ WebInspector.TimelinePanel.prototype = {
             this._categories = {
                 loading: new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"),
                 scripting: new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"),
-                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"),
-                other: new WebInspector.TimelineCategory("other", WebInspector.UIString("Other"), "rgb(186,186,186)")
+                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)")
             };
         }
         return this._categories;
     },
 
-    populateSidebar: function()
-    {
-        this.itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
-        this.itemsTreeElement.expanded = true;
-        this.sidebarTree.appendChild(this.itemsTreeElement);
-    },
-
     _createStatusbarButtons: function()
     {
         this.toggleTimelineButton = new WebInspector.StatusBarButton("", "record-profile-status-bar-item");
@@ -87,6 +116,14 @@ WebInspector.TimelinePanel.prototype = {
         this.clearButton.addEventListener("click", this.reset.bind(this), false);
     },
 
+    _toggleTimelineButtonClicked: function()
+    {
+        if (this.toggleTimelineButton.toggled)
+            InspectorBackend.stopTimelineProfiler();
+        else
+            InspectorBackend.startTimelineProfiler();
+    },
+
     timelineWasStarted: function()
     {
         this.toggleTimelineButton.toggled = true;
@@ -99,7 +136,14 @@ WebInspector.TimelinePanel.prototype = {
 
     addRecordToTimeline: function(record)
     {
+        this._innerAddRecordToTimeline(record, this._records);
+        this._scheduleRefresh();
+    },
+
+    _innerAddRecordToTimeline: function(record, collection)
+    {
         var formattedRecord = this._formatRecord(record);
+
         // Glue subsequent records with same category and title together if they are closer than 100ms to each other.
         if (this._lastRecord && (!record.children || !record.children.length) &&
                 this._lastRecord.category == formattedRecord.category &&
@@ -108,40 +152,25 @@ WebInspector.TimelinePanel.prototype = {
                 formattedRecord.startTime - this._lastRecord.endTime < 0.1) {
             this._lastRecord.endTime = formattedRecord.endTime;
             this._lastRecord.count++;
-            this.refreshItem(this._lastRecord);
         } else {
-            this.addItem(formattedRecord);
-
-            for (var i = 0; record.children && i < record.children.length; ++i)
-                this.addRecordToTimeline(record.children[i]);
+            collection.push(formattedRecord);
+            for (var i = 0; record.children && i < record.children.length; ++i) {
+                if (!formattedRecord.children)
+                    formattedRecord.children = [];
+                var formattedChild = this._innerAddRecordToTimeline(record.children[i], formattedRecord.children);
+                formattedChild.parent = formattedRecord;
+            }
             this._lastRecord = record.children && record.children.length ? null : formattedRecord;
         }
-    },
-
-    createItemTreeElement: function(item)
-    {
-        return new WebInspector.TimelineRecordTreeElement(item);
-    },
-
-    createItemGraph: function(item)
-    {
-        return new WebInspector.TimelineGraph(item);
-    },
-
-    _toggleTimelineButtonClicked: function()
-    {
-        if (InspectorController.timelineProfilerEnabled())
-            InspectorController.stopTimelineProfiler();
-        else
-            InspectorController.startTimelineProfiler();
+        return formattedRecord;
     },
 
     _formatRecord: function(record)
     {
+        var recordTypes = WebInspector.TimelineAgent.RecordType;
         if (!this._recordStyles) {
             this._recordStyles = {};
-            var recordTypes = WebInspector.TimelineAgent.RecordType;
-            this._recordStyles[recordTypes.DOMDispatch] = { title: WebInspector.UIString("DOM Event"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: this.categories.scripting };
             this._recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: this.categories.rendering };
             this._recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: this.categories.rendering };
             this._recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: this.categories.rendering };
@@ -151,13 +180,16 @@ WebInspector.TimelinePanel.prototype = {
             this._recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: this.categories.scripting };
             this._recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: this.categories.scripting };
             this._recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: this.categories.scripting };
-            this._recordStyles[recordTypes.EvaluateScriptTag] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
-            this._recordStyles["Other"] = { title: WebInspector.UIString("Other"), icon: 0, category: this.categories.other };
+            this._recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.MarkTimeline] = { title: WebInspector.UIString("Mark"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: this.categories.loading };
+            this._recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: this.categories.loading };
+            this._recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: this.categories.loading };
         }
 
         var style = this._recordStyles[record.type];
         if (!style)
-            style = this._recordStyles["Other"];
+            style = this._recordStyles[recordTypes.EventDispatch];
 
         var formattedRecord = {};
         formattedRecord.category = style.category;
@@ -166,119 +198,278 @@ WebInspector.TimelinePanel.prototype = {
         formattedRecord.data = record.data;
         formattedRecord.count = 1;
         formattedRecord.type = record.type;
-        formattedRecord.details = this._getRecordDetails(record);
         formattedRecord.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : formattedRecord.startTime;
+        formattedRecord.record = record;
+
+        // Make resource receive record last since request was sent; make finish record last since response received.
+        if (record.type === WebInspector.TimelineAgent.RecordType.ResourceSendRequest) {
+            this._sendRequestRecords[record.data.identifier] = formattedRecord;
+        } else if (record.type === WebInspector.TimelineAgent.RecordType.ResourceReceiveResponse) {
+            var sendRequestRecord = this._sendRequestRecords[record.data.identifier];
+            if (sendRequestRecord) { // False if we started instrumentation in the middle of request.
+                sendRequestRecord._responseReceivedFormattedTime = formattedRecord.startTime;
+                formattedRecord.startTime = sendRequestRecord.startTime;
+                sendRequestRecord.details = this._getRecordDetails(record);
+            }
+        } else if (record.type === WebInspector.TimelineAgent.RecordType.ResourceFinish) {
+            var sendRequestRecord = this._sendRequestRecords[record.data.identifier];
+            if (sendRequestRecord) // False for main resource.
+                formattedRecord.startTime = sendRequestRecord._responseReceivedFormattedTime;
+        }
+        formattedRecord.details = this._getRecordDetails(record);
+
         return formattedRecord;
     },
-    
+
     _getRecordDetails: function(record)
     {
         switch (record.type) {
-        case WebInspector.TimelineAgent.RecordType.DOMDispatch:
-            return record.data.type;
+        case WebInspector.TimelineAgent.RecordType.EventDispatch:
+            return record.data ? record.data.type : "";
+        case WebInspector.TimelineAgent.RecordType.Paint:
+            return record.data.width + "\u2009\u00d7\u2009" + record.data.height;
         case WebInspector.TimelineAgent.RecordType.TimerInstall:
         case WebInspector.TimelineAgent.RecordType.TimerRemove:
         case WebInspector.TimelineAgent.RecordType.TimerFire:
             return record.data.timerId;
         case WebInspector.TimelineAgent.RecordType.XHRReadyStateChange:
         case WebInspector.TimelineAgent.RecordType.XHRLoad:
-        case WebInspector.TimelineAgent.RecordType.EvaluateScriptTag:
-            return record.data.url;
+        case WebInspector.TimelineAgent.RecordType.EvaluateScript:
+        case WebInspector.TimelineAgent.RecordType.ResourceSendRequest:
+            return WebInspector.displayNameForURL(record.data.url);
+        case WebInspector.TimelineAgent.RecordType.ResourceReceiveResponse:
+        case WebInspector.TimelineAgent.RecordType.ResourceFinish:
+            var sendRequestRecord = this._sendRequestRecords[record.data.identifier];
+            return sendRequestRecord ? WebInspector.displayNameForURL(sendRequestRecord.data.url) : "";
+        case WebInspector.TimelineAgent.RecordType.MarkTimeline:
+            return record.data.message;
         default:
             return "";
         }
     },
 
+    setSidebarWidth: function(width)
+    {
+        WebInspector.Panel.prototype.setSidebarWidth.call(this, width);
+        this._sidebarBackgroundElement.style.width = width + "px";
+        this._overviewPane.setSidebarWidth(width);
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        this._containerContentElement.style.left = width + "px";
+        this._scheduleRefresh();
+        this._overviewPane.updateMainViewWidth(width);
+    },
+
+    resize: function() {
+        this._scheduleRefresh();
+    },
+
     reset: function()
     {
-        WebInspector.AbstractTimelinePanel.prototype.reset.call(this);
         this._lastRecord = null;
-    }
-}
+        this._sendRequestRecords = {};
+        this._overviewPane.reset();
+        this._records = [];
+        this._refresh();
+    },
 
-WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.AbstractTimelinePanel.prototype;
+    show: function()
+    {
+        WebInspector.Panel.prototype.show.call(this);
 
+        if (this._needsRefresh)
+            this._refresh();
+    },
 
-WebInspector.TimelineCategory = function(name, title, color)
-{
-    WebInspector.AbstractTimelineCategory.call(this, name, title, color);
-}
+    _onScroll: function(event)
+    {
+        var scrollTop = this._containerElement.scrollTop;
+        var dividersTop = Math.max(0, scrollTop);
+        this._timelineGrid.setScrollAndDividerTop(scrollTop, dividersTop);
+        this._scheduleRefresh(true);
+    },
 
-WebInspector.TimelineCategory.prototype = {
-}
+    _scheduleRefresh: function(immediate)
+    {
+        if (this._needsRefresh)
+            return;
+        this._needsRefresh = true;
+
+        if (this.visible && !("_refreshTimeout" in this))
+            this._refreshTimeout = setTimeout(this._refresh.bind(this), immediate ? 0 : 100);
+    },
 
-WebInspector.TimelineCategory.prototype.__proto__ = WebInspector.AbstractTimelineCategory.prototype;
+    _refresh: function()
+    {
+        this._needsRefresh = false;
+        if ("_refreshTimeout" in this) {
+            clearTimeout(this._refreshTimeout);
+            delete this._refreshTimeout;
+        }
+        this._overviewPane.update(this._records);
+        this._refreshRecords();
+    },
 
+    _refreshRecords: function()
+    {
+        this._calculator.windowLeft = this._overviewPane.windowLeft;
+        this._calculator.windowRight = this._overviewPane.windowRight;
+        this._calculator.reset();
+
+        for (var i = 0; i < this._records.length; ++i)
+            this._calculator.updateBoundaries(this._records[i]);
+
+        var recordsInWindow = [];
+        for (var i = 0; i < this._records.length; ++i) {
+            var record = this._records[i];
+            var percentages = this._calculator.computeBarGraphPercentages(record);
+            if (percentages.start < 100 && percentages.end >= 0 && !record.category.hidden)
+                this._addToRecordsWindow(record, recordsInWindow);
+        }
 
-WebInspector.TimelineRecordTreeElement = function(record)
-{
-    this._record = record;
+        // Calculate the visible area.
+        var visibleTop = this._containerElement.scrollTop;
+        var visibleBottom = visibleTop + this._containerElement.clientHeight;
+
+        // Define row height, should be in sync with styles for timeline graphs.
+        const rowHeight = 18;
+        const expandOffset = 15;
+
+        // Convert visible area to visible indexes. Always include top-level record for a visible nested record.
+        var startIndex = Math.max(0, Math.floor(visibleTop / rowHeight) - 1);
+        while (startIndex > 0 && recordsInWindow[startIndex].parent)
+            startIndex--;
+        var endIndex = Math.min(recordsInWindow.length, Math.ceil(visibleBottom / rowHeight));
+        while (endIndex < recordsInWindow.length - 1 && recordsInWindow[startIndex].parent)
+            endIndex++;
+
+        // Resize gaps first.
+        const top = (startIndex * rowHeight) + "px";
+        this._topGapElement.style.height = top;
+        this.sidebarElement.style.top = top;
+        this.sidebarResizeElement.style.top = top;
+        this._bottomGapElement.style.height = (recordsInWindow.length - endIndex) * rowHeight + "px";
+
+        // Update visible rows.
+        var listRowElement = this._sidebarListElement.firstChild;
+        var graphRowElement = this._graphRowsElement.firstChild;
+        var width = this._graphRowsElement.offsetWidth;
+        var scheduleRefreshCallback = this._scheduleRefresh.bind(this, true);
+        for (var i = startIndex; i < endIndex; ++i) {
+            var record = recordsInWindow[i];
+            var isEven = !(i % 2);
+
+            if (!listRowElement) {
+                listRowElement = new WebInspector.TimelineRecordListRow().element;
+                this._sidebarListElement.appendChild(listRowElement);
+            }
+            if (!graphRowElement) {
+                graphRowElement = new WebInspector.TimelineRecordGraphRow(this._itemsGraphsElement, scheduleRefreshCallback, rowHeight).element;
+                this._graphRowsElement.appendChild(graphRowElement);
+            }
+
+            listRowElement.listRow.update(record, isEven);
+            graphRowElement.graphRow.update(record, isEven, this._calculator, width, expandOffset);
+
+            listRowElement = listRowElement.nextSibling;
+            graphRowElement = graphRowElement.nextSibling;
+        }
 
-    // Pass an empty title, the title gets made later in onattach.
-    TreeElement.call(this, "", null, false);
-}
+        // Remove extra rows.
+        while (listRowElement) {
+            var nextElement = listRowElement.nextSibling;
+            listRowElement.listRow.dispose();
+            listRowElement = nextElement;
+        }
+        while (graphRowElement) {
+            var nextElement = graphRowElement.nextSibling;
+            graphRowElement.graphRow.dispose();
+            graphRowElement = nextElement;
+        }
+
+        // Reserve some room for expand / collapse controls to the left for records that start at 0ms.
+        var timelinePaddingLeft = this._calculator.windowLeft === 0 ? expandOffset : 0;
+        this._timelineGrid.updateDividers(true, this._calculator, timelinePaddingLeft);
+        this._adjustScrollPosition((recordsInWindow.length + 1) * rowHeight);
+    },
 
-WebInspector.TimelineRecordTreeElement.prototype = {
-    onattach: function()
-    {
-        this.listItemElement.removeChildren();
-        this.listItemElement.addStyleClass("timeline-tree-item");
-        this.listItemElement.addStyleClass("timeline-category-" + this._record.category.name);
-
-        var iconElement = document.createElement("span");
-        iconElement.className = "timeline-tree-icon";
-        this.listItemElement.appendChild(iconElement);
-
-        this.typeElement = document.createElement("span");
-        this.typeElement.className = "type";
-        this.typeElement.textContent = this._record.title;
-        this.listItemElement.appendChild(this.typeElement);
-
-        if (this._record.details) {
-            var separatorElement = document.createElement("span");
-            separatorElement.className = "separator";
-            separatorElement.textContent = " ";
-
-            var dataElement = document.createElement("span");
-            dataElement.className = "data";
-            dataElement.textContent = "(" + this._record.details + ")";
-            dataElement.addStyleClass("dimmed");
-            this.listItemElement.appendChild(separatorElement);
-            this.listItemElement.appendChild(dataElement);
+    _addToRecordsWindow: function(record, recordsWindow)
+    {
+        recordsWindow.push(record);
+        if (!record.collapsed) {
+            var index = recordsWindow.length;
+            for (var i = 0; record.children && i < record.children.length; ++i)
+                this._addToRecordsWindow(record.children[i], recordsWindow);
+            record.visibleChildrenCount = recordsWindow.length - index;
         }
     },
 
-    refresh: function()
+    _adjustScrollPosition: function(totalHeight)
     {
-        if (this._record.count > 1)
-            this.typeElement.textContent = this._record.title + " x " + this._record.count;
+        // Prevent the container from being scrolled off the end.
+        if ((this._containerElement.scrollTop + this._containerElement.offsetHeight) > totalHeight + 1)
+            this._containerElement.scrollTop = (totalHeight - this._containerElement.offsetHeight);
     }
 }
 
-WebInspector.TimelineRecordTreeElement.prototype.__proto__ = TreeElement.prototype;
+WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.Panel.prototype;
+
+
+WebInspector.TimelineCategory = function(name, title, color)
+{
+    this.name = name;
+    this.title = title;
+    this.color = color;
+}
 
 
 WebInspector.TimelineCalculator = function()
 {
-    WebInspector.AbstractTimelineCalculator.call(this);
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+    this._uiString = WebInspector.UIString.bind(WebInspector);
 }
 
 WebInspector.TimelineCalculator.prototype = {
     computeBarGraphPercentages: function(record)
     {
-        var start = ((record.startTime - this.minimumBoundary) / this.boundarySpan) * 100;
-        var end = ((record.endTime - this.minimumBoundary) / this.boundarySpan) * 100;
+        var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var end = (record.endTime - this.minimumBoundary) / this.boundarySpan * 100;
         return {start: start, end: end};
     },
 
-    computePercentageFromEventTime: function(eventTime)
+    get minimumBoundary()
+    {
+        if (typeof this._minimumBoundary === "number")
+            return this._minimumBoundary;
+
+        if (typeof this.windowLeft === "number")
+            this._minimumBoundary = this._absoluteMinimumBoundary + this.windowLeft * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
+        else
+            this._minimumBoundary = this._absoluteMinimumBoundary;
+        return this._minimumBoundary;
+    },
+
+    get maximumBoundary()
     {
-        return ((eventTime - this.minimumBoundary) / this.boundarySpan) * 100;
+        if (typeof this._maximumBoundary === "number")
+            return this._maximumBoundary;
+
+        if (typeof this.windowLeft === "number")
+            this._maximumBoundary = this._absoluteMinimumBoundary + this.windowRight * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
+        else
+            this._maximumBoundary = this._absoluteMaximumBoundary;
+        return this._maximumBoundary;
     },
 
-    computeBarGraphLabels: function(record)
+    reset: function()
     {
-        return {tooltip: record.title};
+        delete this._absoluteMinimumBoundary;
+        delete this._absoluteMaximumBoundary;
+        delete this._minimumBoundary;
+        delete this._maximumBoundary;
     },
 
     updateBoundaries: function(record)
@@ -287,76 +478,153 @@ WebInspector.TimelineCalculator.prototype = {
 
         var lowerBound = record.startTime;
 
-        if (typeof this.minimumBoundary === "undefined" || lowerBound < this.minimumBoundary) {
-            this.minimumBoundary = lowerBound;
+        if (typeof this._absoluteMinimumBoundary === "undefined" || lowerBound < this._absoluteMinimumBoundary) {
+            this._absoluteMinimumBoundary = lowerBound;
+            delete this._minimumBoundary;
             didChange = true;
         }
 
         var upperBound = record.endTime;
-        if (typeof this.maximumBoundary === "undefined" || upperBound > this.maximumBoundary) {
-            this.maximumBoundary = upperBound;
+        if (typeof this._absoluteMaximumBoundary === "undefined" || upperBound > this._absoluteMaximumBoundary) {
+            this._absoluteMaximumBoundary = upperBound;
+            delete this._maximumBoundary;
             didChange = true;
         }
 
         return didChange;
     },
 
-    formatValue: function(value)
+    get boundarySpan()
     {
-        return Number.secondsToString(value, WebInspector.UIString.bind(WebInspector));
+        return this.maximumBoundary - this.minimumBoundary;
     },
 
+    formatValue: function(value)
+    {
+        return Number.secondsToString(value + this.minimumBoundary - this._absoluteMinimumBoundary, this._uiString);
+    }
 }
 
-WebInspector.TimelineCalculator.prototype.__proto__ = WebInspector.AbstractTimelineCalculator.prototype;
 
-
-WebInspector.TimelineGraph = function(record)
+WebInspector.TimelineRecordListRow = function()
 {
-    this.record = record;
+    this.element = document.createElement("div");
+    this.element.listRow = this;
+    var iconElement = document.createElement("span");
+    iconElement.className = "timeline-tree-icon";
+    this.element.appendChild(iconElement);
 
-    this._graphElement = document.createElement("div");
-    this._graphElement.className = "timeline-graph-side";
+    this._typeElement = document.createElement("span");
+    this._typeElement.className = "type";
+    this.element.appendChild(this._typeElement);
 
-    this._barAreaElement = document.createElement("div");
-    this._barAreaElement.className = "timeline-graph-bar-area hidden";
-    this._graphElement.appendChild(this._barAreaElement);
+    var separatorElement = document.createElement("span");
+    separatorElement.className = "separator";
+    separatorElement.textContent = " ";
 
-    this._barElement = document.createElement("div");
-    this._barElement.className = "timeline-graph-bar";
-    this._barAreaElement.appendChild(this._barElement);
+    this._dataElement = document.createElement("span");
+    this._dataElement.className = "data dimmed";
+
+    this._repeatCountElement = document.createElement("span");
+    this._repeatCountElement.className = "count";
 
-    this._graphElement.addStyleClass("timeline-category-" + record.category.name);
+    this.element.appendChild(separatorElement);
+    this.element.appendChild(this._dataElement);
+    this.element.appendChild(this._repeatCountElement);
 }
 
-WebInspector.TimelineGraph.prototype = {
-    get graphElement()
+WebInspector.TimelineRecordListRow.prototype = {
+    update: function(record, isEven)
     {
-        return this._graphElement;
-    },
+        this.element.className = "timeline-tree-item timeline-category-" + record.category.name + (isEven ? " even" : "");
+        this._typeElement.textContent = record.title;
 
-    refreshLabelPositions: function()
-    {
+        if (record.details) {
+            this._dataElement.textContent = "(" + record.details + ")";
+            this._dataElement.title = record.details;
+        } else {
+            this._dataElement.textContent = "";
+            this._dataElement.title = "";
+        }
+
+        if (record.count > 1)
+            this._repeatCountElement.textContent = "\u2009\u00d7\u2009" + record.count;
+        else
+            this._repeatCountElement.textContent = "";
     },
 
-    refresh: function(calculator)
+    dispose: function()
     {
-        var percentages = calculator.computeBarGraphPercentages(this.record);
-        var labels = calculator.computeBarGraphLabels(this.record);
+        this.element.parentElement.removeChild(this.element);
+    }
+}
 
-        this._percentages = percentages;
 
-        this._barAreaElement.removeStyleClass("hidden");
+WebInspector.TimelineRecordGraphRow = function(graphContainer, refreshCallback, rowHeight)
+{
+    this.element = document.createElement("div");
+    this.element.graphRow = this;
 
-        if (!this._graphElement.hasStyleClass("timeline-category-" + this.record.category.name)) {
-            this._graphElement.removeMatchingStyleClasses("timeline-category-\\w+");
-            this._graphElement.addStyleClass("timeline-category-" + this.record.category.name);
+    this._barAreaElement = document.createElement("div");
+    this._barAreaElement.className = "timeline-graph-bar-area";
+    this.element.appendChild(this._barAreaElement);
+
+    this._barElement = document.createElement("div");
+    this._barElement.className = "timeline-graph-bar";
+    this._barAreaElement.appendChild(this._barElement);
+
+    this._expandElement = document.createElement("div");
+    this._expandElement.className = "timeline-expandable";
+    graphContainer.appendChild(this._expandElement);
+
+    var leftBorder = document.createElement("div");
+    leftBorder.className = "timeline-expandable-left";
+    this._expandElement.appendChild(leftBorder);
+
+    this._expandElement.addEventListener("click", this._onClick.bind(this));
+    this._refreshCallback = refreshCallback;
+    this._rowHeight = rowHeight;
+}
+
+WebInspector.TimelineRecordGraphRow.prototype = {
+    update: function(record, isEven, calculator, clientWidth, expandOffset)
+    {
+        this._record = record;
+        this.element.className = "timeline-graph-side timeline-category-" + record.category.name + (isEven ? " even" : "");
+        var percentages = calculator.computeBarGraphPercentages(record);
+        var left = percentages.start / 100 * clientWidth;
+        var width = (percentages.end - percentages.start) / 100 * clientWidth;
+        this._barElement.style.left = (left + expandOffset) + "px";
+        this._barElement.style.width = width + "px";
+
+        if (record.visibleChildrenCount) {
+            this._expandElement.style.top = this.element.offsetTop + "px";
+            this._expandElement.style.left = left + "px";
+            this._expandElement.style.width = Math.max(12, width + 25) + "px";
+            if (!record.collapsed) {
+                this._expandElement.style.height = (record.visibleChildrenCount + 1) * this._rowHeight + "px";
+                this._expandElement.addStyleClass("timeline-expandable-expanded");
+                this._expandElement.removeStyleClass("timeline-expandable-collapsed");
+            } else {
+                this._expandElement.style.height = this._rowHeight + "px";
+                this._expandElement.addStyleClass("timeline-expandable-collapsed");
+                this._expandElement.removeStyleClass("timeline-expandable-expanded");
+            }
+            this._expandElement.removeStyleClass("hidden");
+        } else {
+            this._expandElement.addStyleClass("hidden");
         }
+    },
 
-        this._barElement.style.setProperty("left", percentages.start + "%");
-        this._barElement.style.setProperty("right", (100 - percentages.end) + "%");
+    _onClick: function(event)
+    {
+        this._record.collapsed = !this._record.collapsed;
+        this._refreshCallback();
+    },
 
-        var tooltip = (labels.tooltip || "");
-        this._barElement.title = tooltip;
+    dispose: function()
+    {
+        this.element.parentElement.removeChild(this.element);
+        this._expandElement.parentElement.removeChild(this._expandElement);
     }
 }
diff --git a/WebCore/inspector/front-end/TopDownProfileDataGridTree.js b/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
index 1b07883..bfcc25e 100644
--- a/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
+++ b/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
@@ -82,6 +82,7 @@ WebInspector.TopDownProfileDataGridTree.prototype = {
             return;
 
         this._save();
+        profileDataGrideNode.savePosition();
 
         this.children = [profileDataGrideNode];
         this.totalTime = profileDataGrideNode.totalTime;
@@ -102,6 +103,16 @@ WebInspector.TopDownProfileDataGridTree.prototype = {
             this.sort(this.lastComparator, true);
     },
 
+    restore: function()
+    {
+        if (!this._savedChildren)
+            return;
+
+        this.children[0].restorePosition();
+
+        WebInspector.ProfileDataGridTree.prototype.restore.call(this);
+    },
+
     _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge,
 
     _sharedPopulate: WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate
diff --git a/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index 96a20ab..4804897 100644
--- a/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -67,6 +67,8 @@ WebInspector.WatchExpressionsSidebarPane.prototype.__proto__ = WebInspector.Side
 
 WebInspector.WatchExpressionsSection = function()
 {
+    this._watchObjectGroupId = "watch-group";
+
     WebInspector.ObjectPropertiesSection.call(this);
 
     this.watchExpressions = this.loadSavedExpressions();
@@ -75,8 +77,6 @@ WebInspector.WatchExpressionsSection = function()
     this.editable = true;
     this.expanded = true;
     this.propertiesElement.addStyleClass("watch-expressions");
-
-    this._watchObjectGroupId = "watch-group";
 }
 
 WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
@@ -112,11 +112,22 @@ WebInspector.WatchExpressionsSection.prototype = {
             // method to get all the properties refreshed at once.
             properties.push(property);
             
-            if (properties.length == propertyCount)
+            if (properties.length == propertyCount) {
                 this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
+
+                // check to see if we just added a new watch expression,
+                // which will always be the last property
+                if (this._newExpressionAdded) {
+                    delete this._newExpressionAdded;
+
+                    treeElement = this.findAddedTreeElement();
+                    if (treeElement)
+                        treeElement.startEditing();
+                }
+            }
         }
 
-        InspectorController.releaseWrapperObjectGroup(this._watchObjectGroupId)
+        InspectorBackend.releaseWrapperObjectGroup(this._watchObjectGroupId)
         var properties = [];
 
         // Count the properties, so we known when to call this.updateProperties()
@@ -150,14 +161,9 @@ WebInspector.WatchExpressionsSection.prototype = {
 
     addExpression: function()
     {
+        this._newExpressionAdded = true;
         this.watchExpressions.push(WebInspector.WatchExpressionsSection.NewWatchExpression);
         this.update();
-
-        // After update(), the new empty expression to be edited
-        // will be in the tree, but we have to find it.
-        treeElement = this.findAddedTreeElement();
-        if (treeElement)
-            treeElement.startEditing();
     },
 
     updateExpression: function(element, value)
@@ -177,7 +183,7 @@ WebInspector.WatchExpressionsSection.prototype = {
 
     loadSavedExpressions: function()
     {
-        var json = InspectorController.setting("watchExpressions");
+        var json = InspectorFrontendHost.setting("watchExpressions");
         if (!json)
             return [];
 
@@ -198,7 +204,7 @@ WebInspector.WatchExpressionsSection.prototype = {
                 toSave.push(this.watchExpressions[i]);
 
         var json = JSON.stringify({expressions: toSave});
-        InspectorController.setSetting("watchExpressions", json);
+        InspectorFrontendHost.setSetting("watchExpressions", json);
 
         return toSave.length;
     }
diff --git a/WebCore/inspector/front-end/WebKit.qrc b/WebCore/inspector/front-end/WebKit.qrc
index a1d671e..eb299fc 100644
--- a/WebCore/inspector/front-end/WebKit.qrc
+++ b/WebCore/inspector/front-end/WebKit.qrc
@@ -9,7 +9,9 @@
     <file>CallStackSidebarPane.js</file>
     <file>ChangesView.js</file>
     <file>Color.js</file>
+    <file>ConsolePanel.js</file>
     <file>ConsoleView.js</file>
+    <file>ContextMenu.js</file>
     <file>CookieItemsView.js</file>
     <file>Database.js</file>
     <file>DatabaseQueryView.js</file>
@@ -17,7 +19,6 @@
     <file>DataGrid.js</file>
     <file>DOMAgent.js</file>
     <file>DOMStorage.js</file>
-    <file>DOMStorageDataGrid.js</file>
     <file>DOMStorageItemsView.js</file>
     <file>Drawer.js</file>
     <file>ElementsPanel.js</file>
@@ -28,6 +29,8 @@
     <file>InjectedScript.js</file>
     <file>InjectedScriptAccess.js</file>
     <file>inspector.js</file>
+    <file>InspectorBackendStub.js</file>
+    <file>InspectorFrontendHostStub.js</file>
     <file>KeyboardShortcut.js</file>
     <file>MetricsSidebarPane.js</file>
     <file>Object.js</file>
@@ -61,6 +64,8 @@
     <file>TestController.js</file>
     <file>TextPrompt.js</file>
     <file>TimelineAgent.js</file>
+    <file>TimelineGrid.js</file>
+    <file>TimelineOverviewPane.js</file>
     <file>TimelinePanel.js</file>
     <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
@@ -75,6 +80,7 @@
     <file>Images/closeButtons.png</file>
     <file>Images/consoleButtonGlyph.png</file>
     <file>Images/cookie.png</file>
+    <file>Images/consoleIcon.png</file>
     <file>Images/database.png</file>
     <file>Images/databaseTable.png</file>
     <file>Images/debuggerContinue.png</file>
@@ -161,6 +167,15 @@
     <file>Images/statusbarResizerVertical.png</file>
     <file>Images/storageIcon.png</file>
     <file>Images/successGreenDot.png</file>
+    <file>Images/timelineBarBlue.png</file>
+    <file>Images/timelineBarGray.png</file>
+    <file>Images/timelineBarGreen.png</file>
+    <file>Images/timelineBarOrange.png</file>
+    <file>Images/timelineBarPurple.png</file>
+    <file>Images/timelineBarRed.png</file>
+    <file>Images/timelineBarYellow.png</file>
+    <file>Images/timelineCheckmarks.png</file>
+    <file>Images/timelineDots.png</file>
     <file>Images/timelineHollowPillBlue.png</file>
     <file>Images/timelineHollowPillGray.png</file>
     <file>Images/timelineHollowPillGreen.png</file>
@@ -168,6 +183,7 @@
     <file>Images/timelineHollowPillPurple.png</file>
     <file>Images/timelineHollowPillRed.png</file>
     <file>Images/timelineHollowPillYellow.png</file>
+    <file>Images/timelineIcon.png</file>
     <file>Images/timelinePillBlue.png</file>
     <file>Images/timelinePillGray.png</file>
     <file>Images/timelinePillGreen.png</file>
diff --git a/WebCore/inspector/front-end/inspector.css b/WebCore/inspector/front-end/inspector.css
index 78ab23d..7cae8b2 100644
--- a/WebCore/inspector/front-end/inspector.css
+++ b/WebCore/inspector/front-end/inspector.css
@@ -94,7 +94,7 @@ body.attached #toolbar {
     padding-left: 0;
 }
 
-body.attached.platform-qt #toolbar {
+body.attached.port-qt #toolbar {
     cursor: auto;
 }
 
@@ -215,6 +215,10 @@ body.attached #search-results-matches {
     background-image: url(Images/profilesIcon.png);
 }
 
+.toolbar-item.console .toolbar-icon {
+    background-image: url(Images/consoleIcon.png);
+}
+
 #close-button-left, #close-button-right {
     width: 14px;
     height: 14px;
@@ -237,7 +241,7 @@ body.detached .toolbar-item.close-left, body.detached .toolbar-item.close-right
     display: none;
 }
 
-body.attached.platform-qt .toolbar-item.close-left, body.attached.platform-qt .toolbar-item.close-right {
+body.attached.port-qt .toolbar-item.close-left, body.attached.port-qt .toolbar-item.close-right {
     display: none;
 }
 
@@ -392,7 +396,7 @@ body.detached #dock-status-bar-item .glyph {
     -webkit-mask-image: url(Images/dockButtonGlyph.png);
 }
 
-body.platform-qt #dock-status-bar-item {
+body.port-qt #dock-status-bar-item {
     display: none
 }
 
@@ -1432,7 +1436,7 @@ body.inactive .placard.selected {
 }
 
 .event-bars .event-bar .header .subtitle {
-    color: rgba(90, 90, 90, 0.742188);
+    color: rgba(90, 90, 90, 0.75);
 }
 
 .event-bars .event-bar .header::before {
@@ -1777,8 +1781,8 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
 .sidebar {
     position: absolute;
     top: 0;
+    min-height: 100%;
     left: 0;
-    bottom: 0;
     width: 200px;
     overflow-y: auto;
     overflow-x: hidden;
@@ -1957,6 +1961,7 @@ body.inactive .sidebar {
 .data-grid td {
     vertical-align: top;
     height: 12px;
+    line-height: 12px;
     padding: 2px 4px;
     white-space: nowrap;
     border-right: 1px solid #aaa;
@@ -2413,9 +2418,14 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-mask-image: url(Images/largerResourcesButtonGlyph.png);
 }
 
-#resources-filter {
+#resources-filter, #console-filter.console-filter-top {
     background: -webkit-gradient(linear, left top, left bottom, from(rgb(236, 236, 236)), to(rgb(217, 217, 217)));
     border-bottom: 1px solid rgb(64%, 64%, 64%);
+    width: 100%;
+}
+
+#console-messages.console-filter-top {
+    margin-top: 23px;
 }
 
 #console-filter {
@@ -2589,7 +2599,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 
 #resources-dividers-label-bar {
     position: absolute;
-    top: 93px;
+    top: 0;
     left: 0px;
     right: 0;
     background-color: rgba(255, 255, 255, 0.8);
@@ -2740,6 +2750,10 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     display: block;
 }
 
+.console-user-command-result {
+    display: block;
+}
+
 .resources-graph-bar.waiting {
     opacity: 0.35;
 }
@@ -2857,7 +2871,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 .sidebar-resizer-vertical {
     position: absolute;
     top: 0;
-    bottom: 0;
+    min-height: 100%;
     width: 5px;
     z-index: 500;
     cursor: col-resize;
@@ -3266,20 +3280,148 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
 
 /* Timeline Style */
 
-#timeline-summary {
+#timeline-overview-panel {
     position: absolute;
     top: 0;
     left: 0;
-    width: 0;
-    height: 0;
+    right: 0;
+    height: 80px;
+}
+
+.timeline-sidebar-background {
+    top: 90px;
+    bottom: 0;
+}
+
+.timeline .sidebar {
+    overflow-y: hidden;
+    z-index: 100;
+}
+
+#timeline-overview-separator {
+    position: absolute;
+    top: 80px;
+    left: 0;
+    right: 0;
+    background: -webkit-gradient(linear, 0% 0%, 0% 100%, from(rgb(253, 253, 253)), to(rgb(213, 213, 213)));
+    border-top: 1px solid rgb(140, 140, 140);
+    border-bottom: 1px solid rgb(115, 115, 115);
+    height: 10px;
+}
+
+#timeline-overview-sidebar {
+    position: absolute;
+    width: 200px;
+    top: 0px;
+    bottom: 0px;
+    left: 0px;
+    padding-top: 1px;
+    background: -webkit-gradient(linear, 0% 0%, 0% 100%, from(rgb(242, 242, 242)), to(rgb(209, 209, 209)));
+    border-right: 1px solid rgb(163, 163, 163);
+}
+
+#timeline-overview-grid {
+    position: absolute;
+    top: 0px;
+    bottom: 0px;
+    left: 200px;
+    right: 0px;
+    background-color: rgb(224, 224, 224);
+}
+
+#timeline-overview-window {
+    background-color: white;
+    position: absolute;
+    left: 0;
+    right: 0;
+    top: 0;
+    bottom: 0;
+    z-index: 150;
+}
+
+.timeline-window-resizer {
+    position: absolute;
+    top: 35px;
+    bottom: 15px;
+    width: 5px;
+    margin-left: -3px;
+    margin-right: -2px;
+    background-color: rgb(153, 153, 153);
+    z-index: 500;
+    cursor: col-resize;
+    -webkit-border-radius: 2px;
+    -webkit-box-shadow: white 1px 0 0, white -1px 0 0, white 0 1px 0, white 0 -1px 0;
+}
+
+#timeline-overview-grid #resources-graphs {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    height: 80px;
+}
+
+#timeline-container {
+    position: absolute;
+    top: 90px;
+    left: 0;
+    bottom: 0;
+    right: 0;
+    border-right: 0 none transparent;
+    overflow-y: auto;
+    overflow-x: hidden;
 }
 
 .timeline-clear-status-bar-item .glyph {
     -webkit-mask-image: url(Images/clearConsoleButtonGlyph.png);
 }
 
+.timeline-category-tree-item {
+    height: 20px;
+    line-height: 20px;
+    padding-left: 6px;
+    white-space: nowrap;
+    text-overflow: ellipsis;
+    overflow: hidden;
+    font-weight: bold;
+}
+
+.timeline-category-tree-item .timeline-category-checkbox {
+    width: 10px;
+    height: 11px;
+    margin: 0 3px 0 5px;
+    padding: 0;
+    background-image: url(Images/timelineCheckmarks.png);
+    background-repeat: no-repeat;
+    background-position: 0 -66px;
+    vertical-align: -1px;
+    -webkit-appearance: none;
+}
+
+.timeline-category-tree-item .timeline-category-checkbox:checked {
+    background-position-x: -10px;
+}
+
+.timeline-category-tree-item.timeline-category-loading .timeline-category-checkbox {
+    background-position-y: 0;
+}
+
+.timeline-category-tree-item.timeline-category-scripting .timeline-category-checkbox {
+    background-position-y: -33px;
+}
+
+.timeline-category-tree-item.timeline-category-rendering .timeline-category-checkbox {
+    background-position-y: -11px;
+}
+
+.timeline-category-tree-item:nth-of-type(2n) {
+    background-color: rgba(0, 0, 0, 0.05);
+}
+
 .timeline-tree-item {
     height: 18px;
+    line-height: 15px;
+    padding-right: 5px;
     padding-left: 10px;
     padding-top: 2px;
     white-space: nowrap;
@@ -3287,10 +3429,44 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     overflow: hidden;
 }
 
+.timeline-expandable {
+    position: absolute;
+    border-left: 1px solid rgb(163, 163, 163);
+}
+
+.timeline-expandable-left {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    width: 3px;
+    border-top: 1px solid rgb(163, 163, 163);
+    border-bottom: 1px solid rgb(163, 163, 163);
+}
+
+.timeline-expandable-collapsed {
+    background-image: url(Images/disclosureTriangleSmallRightBlack.png);
+    background-position-x: 1px;
+    background-position-y: 2px;
+    background-repeat: no-repeat;
+}
+
+.timeline-expandable-expanded {
+    background-image: url(Images/disclosureTriangleSmallDownBlack.png);
+    background-position-x: 1px;
+    background-position-y: 3px;
+    background-repeat: no-repeat;
+}
+
 .timeline-tree-item .type {
     padding-left: 14px;
 }
 
+.timeline-tree-item .count {
+    font-family: Helvetica, Arial, sans-serif;
+    font-weight: bold;
+}
+
 .timeline-tree-item .timeline-tree-icon {
     background-image: url(Images/timelineDots.png);
     margin-top: 2px;
@@ -3299,7 +3475,7 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     position: absolute;
 }
 
-.timeline-tree-item:nth-of-type(2n) {
+.timeline-tree-item.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
 
@@ -3307,14 +3483,12 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     color: rgba(0, 0, 0, 0.7);
 }
 
-.timeline-category-loading, .timeline-category-scripting, .timeline-category-rendering {
-    display: none;
-}
-
-.filter-all .timeline-category-loading, .filter-loading .timeline-category-loading,
-.filter-all .timeline-category-scripting, .filter-scripting .timeline-category-scripting,
-.filter-all .timeline-category-rendering, .filter-rendering .timeline-category-rendering {
-    display: list-item;
+#timeline-overview-graphs {
+    position: absolute;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    top: 20px;
 }
 
 #timeline-graphs {
@@ -3333,29 +3507,42 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     margin-top: 0px;
     border-top: 1px solid transparent;
     overflow: hidden;
+    pointer-events: none;
+}
+
+.timeline-overview-graph-side {
+    height: 20px;
+    z-index: 170;
+    pointer-events: none;
+}
+
+.timeline-overview-graph-side .timeline-graph-bar {
+    height: 13px;
 }
 
 .timeline-graph-bar-area {
     position: absolute;
     top: 0;
     bottom: 0;
-    right: 8px;
-    left: 9px;
+    right: 0;
+    left: 3px;
+    pointer-events: none;
 }
 
 .timeline-graph-bar {
     position: absolute;
     top: 0;
     bottom: 0;
-    margin: auto -5px;
+    margin: auto -2px;
     border-width: 4px 4px 5px;
     height: 9px;
-    min-width: 7px;
+    min-width: 5px;
     opacity: 0.8;
     -webkit-border-image: url(Images/timelineBarGray.png) 4 4 5 4;
+    pointer-events: none;
 }
 
-.timeline-graph-side:nth-of-type(2n) {
+.timeline-graph-side.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
 
diff --git a/WebCore/inspector/front-end/inspector.html b/WebCore/inspector/front-end/inspector.html
index 04ab07a..77c7760 100644
--- a/WebCore/inspector/front-end/inspector.html
+++ b/WebCore/inspector/front-end/inspector.html
@@ -34,8 +34,10 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
-    <script type="text/javascript" src="InspectorControllerStub.js"></script>
+    <script type="text/javascript" src="InspectorBackendStub.js"></script>
+    <script type="text/javascript" src="InspectorFrontendHostStub.js"></script>
     <script type="text/javascript" src="Object.js"></script>
+    <script type="text/javascript" src="ContextMenu.js"></script>
     <script type="text/javascript" src="KeyboardShortcut.js"></script>
     <script type="text/javascript" src="TextPrompt.js"></script>
     <script type="text/javascript" src="Popup.js"></script>
@@ -46,6 +48,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ChangesView.js"></script>
     <script type="text/javascript" src="ConsoleView.js"></script>
     <script type="text/javascript" src="Panel.js"></script>
+    <script type="text/javascript" src="TimelineGrid.js"></script>    
     <script type="text/javascript" src="AbstractTimelinePanel.js"></script>
     <script type="text/javascript" src="Resource.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
@@ -53,7 +56,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DOMStorage.js"></script>
     <script type="text/javascript" src="DOMStorageItemsView.js"></script>
     <script type="text/javascript" src="DataGrid.js"></script>
-    <script type="text/javascript" src="DOMStorageDataGrid.js"></script>
     <script type="text/javascript" src="CookieItemsView.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Breakpoint.js"></script>
@@ -80,6 +82,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ScriptsPanel.js"></script>
     <script type="text/javascript" src="StoragePanel.js"></script>
     <script type="text/javascript" src="ProfilesPanel.js"></script>
+    <script type="text/javascript" src="ConsolePanel.js"></script>
     <script type="text/javascript" src="ResourceView.js"></script>
     <script type="text/javascript" src="SourceFrame.js"></script>
     <script type="text/javascript" src="SourceView.js"></script>
@@ -97,6 +100,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="InjectedScriptAccess.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
     <script type="text/javascript" src="TimelinePanel.js"></script>
+    <script type="text/javascript" src="TimelineOverviewPane.js"></script>
     <script type="text/javascript" src="TestController.js"></script>
 </head>
 <body class="detached">
@@ -109,7 +113,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     </div>
     <div id="main">
         <div id="main-panels" tabindex="0" spellcheck="false"></div>
-        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item toggled"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="changes-status-bar-item" class="status-bar-item hidden"></button><div id="count-items"><div id="changes-count" class="hidden"></div><div id="error-warning-count" class="hidden"></div></div></div></div>
+        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="changes-status-bar-item" class="status-bar-item hidden"></button><div id="count-items"><div id="changes-count" class="hidden"></div><div id="error-warning-count" class="hidden"></div></div></div></div>
     </div>
     <div id="drawer">
         <div id="console-view"><div id="console-messages"><div id="console-prompt" spellcheck="false"><br></div></div></div>
diff --git a/WebCore/inspector/front-end/inspector.js b/WebCore/inspector/front-end/inspector.js
index c24d589..3f21f4f 100644
--- a/WebCore/inspector/front-end/inspector.js
+++ b/WebCore/inspector/front-end/inspector.js
@@ -46,10 +46,57 @@ var Preferences = {
     resourcesLargeRows: true
 }
 
+function preloadImages()
+{
+    (new Image()).src = "Images/clearConsoleButtonGlyph.png";
+    (new Image()).src = "Images/consoleButtonGlyph.png";
+    (new Image()).src = "Images/dockButtonGlyph.png";
+    (new Image()).src = "Images/enableOutlineButtonGlyph.png";
+    (new Image()).src = "Images/enableSolidButtonGlyph.png";
+    (new Image()).src = "Images/excludeButtonGlyph.png";
+    (new Image()).src = "Images/focusButtonGlyph.png";
+    (new Image()).src = "Images/largerResourcesButtonGlyph.png";
+    (new Image()).src = "Images/nodeSearchButtonGlyph.png";
+    (new Image()).src = "Images/pauseOnExceptionButtonGlyph.png";
+    (new Image()).src = "Images/percentButtonGlyph.png";
+    (new Image()).src = "Images/recordButtonGlyph.png";
+    (new Image()).src = "Images/recordToggledButtonGlyph.png";
+    (new Image()).src = "Images/reloadButtonGlyph.png";
+    (new Image()).src = "Images/undockButtonGlyph.png";
+}
+
+preloadImages();
+
 var WebInspector = {
     resources: {},
     resourceURLMap: {},
+    cookieDomains: {},
     missingLocalizedStrings: {},
+    pendingDispatches: 0,
+
+    // RegExp groups:
+    // 1 - scheme
+    // 2 - hostname
+    // 3 - ?port
+    // 4 - ?path
+    // 5 - ?fragment
+    URLRegExp: /^(http[s]?|file):\/\/([^\/:]+)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i,
+
+    get platform()
+    {
+        if (!("_platform" in this))
+            this._platform = InspectorFrontendHost.platform();
+
+        return this._platform;
+    },
+
+    get port()
+    {
+        if (!("_port" in this))
+            this._port = InspectorFrontendHost.port();
+
+        return this._port;
+    },
 
     get previousFocusElement()
     {
@@ -126,41 +173,43 @@ var WebInspector = {
 
         for (var panelName in WebInspector.panels) {
             if (WebInspector.panels[panelName] == x)
-                InspectorController.storeLastActivePanel(panelName);
+                InspectorBackend.storeLastActivePanel(panelName);
         }
     },
 
     _createPanels: function()
     {
-        var hiddenPanels = (InspectorController.hiddenPanels() || "").split(',');
+        var hiddenPanels = (InspectorFrontendHost.hiddenPanels() || "").split(',');
         if (hiddenPanels.indexOf("elements") === -1)
             this.panels.elements = new WebInspector.ElementsPanel();
         if (hiddenPanels.indexOf("resources") === -1)
             this.panels.resources = new WebInspector.ResourcesPanel();
         if (hiddenPanels.indexOf("scripts") === -1)
             this.panels.scripts = new WebInspector.ScriptsPanel();
+        if (hiddenPanels.indexOf("timeline") === -1)
+            this.panels.timeline = new WebInspector.TimelinePanel();
         if (hiddenPanels.indexOf("profiles") === -1) {
             this.panels.profiles = new WebInspector.ProfilesPanel();
             this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
         }
-        if (hiddenPanels.indexOf("timeline") === -1 && hiddenPanels.indexOf("timeline") === -1)
-            this.panels.timeline = new WebInspector.TimelinePanel();
 
         if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
             this.panels.storage = new WebInspector.StoragePanel();
+        if (hiddenPanels.indexOf("console") === -1)
+            this.panels.console = new WebInspector.ConsolePanel();
     },
 
     _loadPreferences: function()
     {
-        var colorFormat = InspectorController.setting("color-format");
+        var colorFormat = InspectorFrontendHost.setting("color-format");
         if (colorFormat)
             Preferences.colorFormat = colorFormat;
 
-        var eventListenersFilter = InspectorController.setting("event-listeners-filter");
+        var eventListenersFilter = InspectorFrontendHost.setting("event-listeners-filter");
         if (eventListenersFilter)
             Preferences.eventListenersFilter = eventListenersFilter;
 
-        var resourcesLargeRows = InspectorController.setting("resources-large-rows");
+        var resourcesLargeRows = InspectorFrontendHost.setting("resources-large-rows");
         if (typeof resourcesLargeRows !== "undefined")
             Preferences.resourcesLargeRows = resourcesLargeRows;
     },
@@ -183,12 +232,12 @@ var WebInspector = {
         var body = document.body;
 
         if (x) {
-            InspectorController.attach();
+            InspectorFrontendHost.attach();
             body.removeStyleClass("detached");
             body.addStyleClass("attached");
             dockToggleButton.title = WebInspector.UIString("Undock into separate window.");
         } else {
-            InspectorController.detach();
+            InspectorFrontendHost.detach();
             body.removeStyleClass("attached");
             body.addStyleClass("detached");
             dockToggleButton.title = WebInspector.UIString("Dock to main window.");
@@ -357,10 +406,10 @@ var WebInspector = {
         }
 
         if (this._hoveredDOMNode) {
-            InspectorController.highlightDOMNode(this._hoveredDOMNode.id);
+            InspectorBackend.highlightDOMNode(this._hoveredDOMNode.id);
             this.showingDOMNodeHighlight = true;
         } else {
-            InspectorController.hideDOMNodeHighlight();
+            InspectorBackend.hideDOMNodeHighlight();
             this.showingDOMNodeHighlight = false;
         }
     }
@@ -368,11 +417,12 @@ var WebInspector = {
 
 WebInspector.loaded = function()
 {
-    var platform = InspectorController.platform();
+    var platform = WebInspector.platform;
     document.body.addStyleClass("platform-" + platform);
+    var port = WebInspector.port;
+    document.body.addStyleClass("port-" + port);
 
     this._loadPreferences();
-    this.pendingDispatches = 0;
 
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
@@ -429,11 +479,9 @@ WebInspector.loaded = function()
     document.addEventListener("keyup", this.documentKeyUp.bind(this), true);
     document.addEventListener("beforecopy", this.documentCanCopy.bind(this), true);
     document.addEventListener("copy", this.documentCopy.bind(this), true);
-    document.addEventListener("contextmenu", this.contextMenu.bind(this), true);
+    document.addEventListener("contextmenu", this.contextMenuEventFired.bind(this), true);
 
     var mainPanelsElement = document.getElementById("main-panels");
-    mainPanelsElement.handleKeyEvent = this.mainKeyDown.bind(this);
-    mainPanelsElement.handleKeyUpEvent = this.mainKeyUp.bind(this);
     mainPanelsElement.handleCopyEvent = this.mainCopy.bind(this);
 
     // Focus the mainPanelsElement in a timeout so it happens after the initial focus,
@@ -461,23 +509,24 @@ WebInspector.loaded = function()
 
     var searchField = document.getElementById("search");
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
+    searchField.addEventListener("mousedown", this.searchFieldManualFocus.bind(this), false); // when the search field is manually selected
 
     toolbarElement.addEventListener("mousedown", this.toolbarDragStart, true);
     document.getElementById("close-button-left").addEventListener("click", this.close, true);
     document.getElementById("close-button-right").addEventListener("click", this.close, true);
 
-    InspectorController.loaded();
+    InspectorFrontendHost.loaded();
 }
 
 var windowLoaded = function()
 {
-    var localizedStringsURL = InspectorController.localizedStringsURL();
+    var localizedStringsURL = InspectorFrontendHost.localizedStringsURL();
     if (localizedStringsURL) {
         var localizedStringsScriptElement = document.createElement("script");
         localizedStringsScriptElement.addEventListener("load", WebInspector.loaded.bind(WebInspector), false);
         localizedStringsScriptElement.type = "text/javascript";
         localizedStringsScriptElement.src = localizedStringsURL;
-        document.getElementsByTagName("head").item(0).appendChild(localizedStringsScriptElement);
+        document.head.appendChild(localizedStringsScriptElement);
     } else
         WebInspector.loaded();
 
@@ -504,13 +553,14 @@ WebInspector.dispatch = function() {
 
 WebInspector.windowUnload = function(event)
 {
-    InspectorController.windowUnloading();
+    InspectorFrontendHost.windowUnloading();
 }
 
 WebInspector.windowResize = function(event)
 {
     if (this.currentPanel && this.currentPanel.resize)
         this.currentPanel.resize();
+    this.drawer.resize();
 }
 
 WebInspector.windowFocused = function(event)
@@ -543,7 +593,7 @@ WebInspector.setAttachedWindow = function(attached)
 
 WebInspector.close = function(event)
 {
-    InspectorController.closeWindow();
+    InspectorFrontendHost.closeWindow();
 }
 
 WebInspector.documentClick = function(event)
@@ -588,20 +638,28 @@ WebInspector.documentClick = function(event)
 
 WebInspector.documentKeyDown = function(event)
 {
-    if (!this.currentFocusElement)
-        return;
-    if (this.currentFocusElement.handleKeyEvent)
-        this.currentFocusElement.handleKeyEvent(event);
-    else if (this.currentFocusElement.id && this.currentFocusElement.id.length && WebInspector[this.currentFocusElement.id + "KeyDown"])
-        WebInspector[this.currentFocusElement.id + "KeyDown"](event);
+    if (this.currentFocusElement) {
+        if (this.currentFocusElement.handleKeyEvent)
+            this.currentFocusElement.handleKeyEvent(event);
+        else if (this.currentFocusElement.id && this.currentFocusElement.id.length && WebInspector[this.currentFocusElement.id + "KeyDown"])
+            WebInspector[this.currentFocusElement.id + "KeyDown"](event);
+        if (event.handled)
+            return;
+    }
+
+    if (this.currentPanel && this.currentPanel.handleKeyEvent)
+        this.currentPanel.handleKeyEvent(event);
 
     if (!event.handled) {
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var isMac = WebInspector.isMac();
 
         switch (event.keyIdentifier) {
             case "U+001B": // Escape key
-                this.drawer.visible = !this.drawer.visible;
                 event.preventDefault();
+                if (this.drawer.fullPanel)
+                    return;
+
+                this.drawer.visible = !this.drawer.visible;
                 break;
 
             case "U+0046": // F key
@@ -675,9 +733,15 @@ WebInspector.documentKeyDown = function(event)
 
 WebInspector.documentKeyUp = function(event)
 {
-    if (!this.currentFocusElement || !this.currentFocusElement.handleKeyUpEvent)
-        return;
-    this.currentFocusElement.handleKeyUpEvent(event);
+    if (this.currentFocusElement) {
+        if (this.currentFocusElement.handleKeyUpEvent)
+            this.currentFocusElement.handleKeyUpEvent(event);
+        if (event.handled)
+            return;
+    }
+
+    if (this.currentPanel && this.currentPanel.handleKeyUpEvent)
+        this.currentPanel.handleKeyUpEvent(event);
 }
 
 WebInspector.documentCanCopy = function(event)
@@ -701,53 +765,43 @@ WebInspector.documentCopy = function(event)
         WebInspector[this.currentFocusElement.id + "Copy"](event);
 }
 
-WebInspector.contextMenu = function(event)
+WebInspector.contextMenuEventFired = function(event)
 {
     if (event.handled || event.target.hasStyleClass("popup-glasspane"))
         event.preventDefault();
 }
 
-WebInspector.mainKeyDown = function(event)
-{
-    if (this.currentPanel && this.currentPanel.handleKeyEvent)
-        this.currentPanel.handleKeyEvent(event);
-}
-
-WebInspector.mainKeyUp = function(event)
-{
-    if (this.currentPanel && this.currentPanel.handleKeyUpEvent)
-        this.currentPanel.handleKeyUpEvent(event);
-}
-
 WebInspector.mainCopy = function(event)
 {
     if (this.currentPanel && this.currentPanel.handleCopyEvent)
         this.currentPanel.handleCopyEvent(event);
 }
 
-WebInspector.animateStyle = function(animations, duration, callback, complete)
+WebInspector.animateStyle = function(animations, duration, callback)
 {
-    if (complete === undefined)
-        complete = 0;
-    var slice = (1000 / 30); // 30 frames per second
+    var interval;
+    var complete = 0;
+
+    const intervalDuration = (1000 / 30); // 30 frames per second.
+    const animationsLength = animations.length;
+    const propertyUnit = {opacity: ""};
+    const defaultUnit = "px";
 
-    var defaultUnit = "px";
-    var propertyUnit = {opacity: ""};
+    function cubicInOut(t, b, c, d)
+    {
+        if ((t/=d/2) < 1) return c/2*t*t*t + b;
+        return c/2*((t-=2)*t*t + 2) + b;
+    }
 
-    for (var i = 0; i < animations.length; ++i) {
+    // Pre-process animations.
+    for (var i = 0; i < animationsLength; ++i) {
         var animation = animations[i];
-        var element = null;
-        var start = null;
-        var current = null;
-        var end = null;
-        var key = null;
+        var element = null, start = null, end = null, key = null;
         for (key in animation) {
             if (key === "element")
                 element = animation[key];
             else if (key === "start")
                 start = animation[key];
-            else if (key === "current")
-                current = animation[key];
             else if (key === "end")
                 end = animation[key];
         }
@@ -755,49 +809,54 @@ WebInspector.animateStyle = function(animations, duration, callback, complete)
         if (!element || !end)
             continue;
 
-        var computedStyle = element.ownerDocument.defaultView.getComputedStyle(element);
         if (!start) {
+            var computedStyle = element.ownerDocument.defaultView.getComputedStyle(element);
             start = {};
             for (key in end)
                 start[key] = parseInt(computedStyle.getPropertyValue(key));
             animation.start = start;
-        } else if (complete == 0)
+        } else
             for (key in start)
                 element.style.setProperty(key, start[key] + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
+    }
 
-        if (!current) {
-            current = {};
-            for (key in start)
-                current[key] = start[key];
-            animation.current = current;
-        }
-
-        function cubicInOut(t, b, c, d)
-        {
-            if ((t/=d/2) < 1) return c/2*t*t*t + b;
-            return c/2*((t-=2)*t*t + 2) + b;
+    function animateLoop()
+    {
+        // Advance forward.
+        complete += intervalDuration;
+        var next = complete + intervalDuration;
+
+        // Make style changes.
+        for (var i = 0; i < animationsLength; ++i) {
+            var animation = animations[i];
+            var element = animation.element;
+            var start = animation.start;
+            var end = animation.end;
+            if (!element || !end)
+                continue;
+
+            var style = element.style;
+            for (key in end) {
+                var endValue = end[key];
+                if (next < duration) {
+                    var startValue = start[key];
+                    var newValue = cubicInOut(complete, startValue, endValue - startValue, duration);
+                    style.setProperty(key, newValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
+                } else
+                    style.setProperty(key, endValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
+            }
         }
 
-        var style = element.style;
-        for (key in end) {
-            var startValue = start[key];
-            var currentValue = current[key];
-            var endValue = end[key];
-            if ((complete + slice) < duration) {
-                var delta = (endValue - startValue) / (duration / slice);
-                var newValue = cubicInOut(complete, startValue, endValue - startValue, duration);
-                style.setProperty(key, newValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
-                current[key] = newValue;
-            } else {
-                style.setProperty(key, endValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
-            }
+        // End condition.
+        if (complete >= duration) {
+            clearInterval(interval);
+            if (callback)
+                callback();
         }
     }
 
-    if (complete < duration)
-        setTimeout(WebInspector.animateStyle, slice, animations, duration, callback, complete + slice);
-    else if (callback)
-        callback();
+    interval = setInterval(animateLoop, intervalDuration);
+    return interval;
 }
 
 WebInspector.updateSearchLabel = function()
@@ -817,11 +876,12 @@ WebInspector.updateSearchLabel = function()
 WebInspector.toggleAttach = function()
 {
     this.attached = !this.attached;
+    this.drawer.resize();
 }
 
 WebInspector.toolbarDragStart = function(event)
 {
-    if ((!WebInspector.attached && InspectorController.platform() !== "mac-leopard") || InspectorController.platform() == "qt")
+    if ((!WebInspector.attached && WebInspector.platform !== "mac-leopard") || WebInspector.port == "qt")
         return;
 
     var target = event.target;
@@ -855,14 +915,14 @@ WebInspector.toolbarDrag = function(event)
     if (WebInspector.attached) {
         var height = window.innerHeight - (event.screenY - toolbar.lastScreenY);
 
-        InspectorController.setAttachedWindowHeight(height);
+        InspectorFrontendHost.setAttachedWindowHeight(height);
     } else {
         var x = event.screenX - toolbar.lastScreenX;
         var y = event.screenY - toolbar.lastScreenY;
 
         // We cannot call window.moveBy here because it restricts the movement
         // of the window at the edges.
-        InspectorController.moveByUnrestricted(x, y);
+        InspectorFrontendHost.moveWindowBy(x, y);
     }
 
     toolbar.lastScreenX = event.screenX;
@@ -925,6 +985,11 @@ WebInspector.showScriptsPanel = function()
     this.currentPanel = this.panels.scripts;
 }
 
+WebInspector.showTimelinePanel = function()
+{
+    this.currentPanel = this.panels.timeline;
+}
+
 WebInspector.showProfilesPanel = function()
 {
     this.currentPanel = this.panels.profiles;
@@ -935,11 +1000,17 @@ WebInspector.showStoragePanel = function()
     this.currentPanel = this.panels.storage;
 }
 
+WebInspector.showConsolePanel = function()
+{
+    this.currentPanel = this.panels.console;
+}
+
 WebInspector.addResource = function(identifier, payload)
 {
     var resource = new WebInspector.Resource(
         payload.requestHeaders,
         payload.requestURL,
+        payload.documentURL,
         payload.host,
         payload.path,
         payload.lastPathComponent,
@@ -956,6 +1027,10 @@ WebInspector.addResource = function(identifier, payload)
 
     if (this.panels.resources)
         this.panels.resources.addResource(resource);
+
+    var match = payload.documentURL.match(/^(http[s]?|file):\/\/([\/]*[^\/]+)/i);
+    if (match)
+        this.addCookieDomain(match[1].toLowerCase() === "file" ? "" : match[2]);
 }
 
 WebInspector.clearConsoleMessages = function()
@@ -1021,7 +1096,7 @@ WebInspector.updateResource = function(identifier, payload)
             resource.responseReceivedTime = payload.responseReceivedTime;
         if (payload.endTime)
             resource.endTime = payload.endTime;
-        
+
         if (payload.loadEventTime) {
             // This loadEventTime is for the main resource, and we want to show it
             // for all resources on this page. This means we want to set it as a member
@@ -1029,7 +1104,7 @@ WebInspector.updateResource = function(identifier, payload)
             if (this.panels.resources)
                 this.panels.resources.mainResourceLoadTime = payload.loadEventTime;
         }
-        
+
         if (payload.domContentEventTime) {
             // This domContentEventTime is for the main resource, so it should go in
             // the resources panel for the same reasons as above.
@@ -1055,6 +1130,8 @@ WebInspector.removeResource = function(identifier)
 
 WebInspector.addDatabase = function(payload)
 {
+    if (!this.panels.storage)
+        return;
     var database = new WebInspector.Database(
         payload.id,
         payload.domain,
@@ -1065,12 +1142,20 @@ WebInspector.addDatabase = function(payload)
 
 WebInspector.addCookieDomain = function(domain)
 {
-    if (this.panels.storage)
-        this.panels.storage.addCookieDomain(domain);
+    // Eliminate duplicate domains from the list.
+    if (domain in this.cookieDomains)
+        return;
+    this.cookieDomains[domain] = true;
+
+    if (!this.panels.storage)
+        return;
+    this.panels.storage.addCookieDomain(domain);
 }
 
 WebInspector.addDOMStorage = function(payload)
 {
+    if (!this.panels.storage)
+        return;
     var domStorage = new WebInspector.DOMStorage(
         payload.id,
         payload.host,
@@ -1080,6 +1165,8 @@ WebInspector.addDOMStorage = function(payload)
 
 WebInspector.updateDOMStorage = function(storageId)
 {
+    if (!this.panels.storage)
+        return;
     this.panels.storage.updateDOMStorage(storageId);
 }
 
@@ -1160,6 +1247,7 @@ WebInspector.reset = function()
 
     this.resources = {};
     this.resourceURLMap = {};
+    this.cookieDomains = {};
     this.hoveredDOMNode = null;
 
     delete this.mainResource;
@@ -1202,23 +1290,23 @@ WebInspector.log = function(message)
 {
     // remember 'this' for setInterval() callback
     var self = this;
-    
+
     // return indication if we can actually log a message
     function isLogAvailable()
     {
         return WebInspector.ConsoleMessage && WebInspector.ObjectProxy && self.console;
     }
-    
+
     // flush the queue of pending messages
     function flushQueue()
     {
         var queued = WebInspector.log.queued;
-        if (!queued) 
+        if (!queued)
             return;
-            
+
         for (var i = 0; i < queued.length; ++i)
             logMessage(queued[i]);
-        
+
         delete WebInspector.log.queued;
     }
 
@@ -1228,26 +1316,26 @@ WebInspector.log = function(message)
     {
         if (!isLogAvailable())
             return;
-            
+
         clearInterval(WebInspector.log.interval);
         delete WebInspector.log.interval;
-        
+
         flushQueue();
     }
-    
+
     // actually log the message
     function logMessage(message)
     {
         var repeatCount = 1;
         if (message == WebInspector.log.lastMessage)
             repeatCount = WebInspector.log.repeatCount + 1;
-    
+
         WebInspector.log.lastMessage = message;
         WebInspector.log.repeatCount = repeatCount;
-        
+
         // ConsoleMessage expects a proxy object
         message = new WebInspector.ObjectProxy(null, [], 0, message, false);
-        
+
         // post the message
         var msg = new WebInspector.ConsoleMessage(
             WebInspector.ConsoleMessage.MessageSource.Other,
@@ -1258,20 +1346,20 @@ WebInspector.log = function(message)
             null,
             repeatCount,
             message);
-    
+
         self.console.addMessage(msg);
     }
-    
+
     // if we can't log the message, queue it
     if (!isLogAvailable()) {
         if (!WebInspector.log.queued)
             WebInspector.log.queued = [];
-            
+
         WebInspector.log.queued.push(message);
-        
+
         if (!WebInspector.log.interval)
             WebInspector.log.interval = setInterval(flushQueueIfAvailable, 1000);
-        
+
         return;
     }
 
@@ -1284,7 +1372,7 @@ WebInspector.log = function(message)
 
 WebInspector.addProfileHeader = function(profile)
 {
-    this.panels.profiles.addProfileHeader(WebInspector.CPUProfileType.TypeId, new WebInspector.CPUProfile(profile));
+    this.panels.profiles.addProfileHeader(profile);
 }
 
 WebInspector.setRecordingProfile = function(isProfiling)
@@ -1383,7 +1471,7 @@ WebInspector.showResourceForURL = function(url, line, preferredPanel)
 WebInspector.linkifyStringAsFragment = function(string)
 {
     var container = document.createDocumentFragment();
-    var linkStringRegEx = new RegExp("(?:[a-zA-Z][a-zA-Z0-9+.-]{2,}://|www\\.)[\\w$\\-_+*'=\\|/\\\\(){}[\\]%@&#~,:;.!?]{2,}[\\w$\\-_+*=\\|/\\\\({%@&#~]");
+    var linkStringRegEx = /(?:[a-zA-Z][a-zA-Z0-9+.-]{2,}:\/\/|www\.)[\w$\-_+*'=\|\/\\(){}[\]%@&#~,:;.!?]{2,}[\w$\-_+*=\|\/\\({%@&#~]/;
 
     while (string) {
         var linkString = linkStringRegEx.exec(string);
@@ -1411,12 +1499,13 @@ WebInspector.linkifyStringAsFragment = function(string)
     return container;
 }
 
-WebInspector.showProfileForURL = function(url) {
+WebInspector.showProfileForURL = function(url)
+{
     WebInspector.showProfilesPanel();
     WebInspector.panels.profiles.showProfileForURL(url);
 }
 
-WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
+WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal, tooltipText)
 {
     if (!linkText)
         linkText = url;
@@ -1426,18 +1515,18 @@ WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
     var a = document.createElement("a");
     a.href = url;
     a.className = classes;
-    a.title = url;
+    a.title = tooltipText || url;
     a.target = "_blank";
     a.textContent = linkText;
 
     return a;
 }
 
-WebInspector.linkifyURL = function(url, linkText, classes, isExternal)
+WebInspector.linkifyURL = function(url, linkText, classes, isExternal, tooltipText)
 {
     // Use the DOM version of this function so as to avoid needing to escape attributes.
     // FIXME:  Get rid of linkifyURL entirely.
-    return WebInspector.linkifyURLAsNode(url, linkText, classes, isExternal).outerHTML;
+    return WebInspector.linkifyURLAsNode(url, linkText, classes, isExternal, tooltipText).outerHTML;
 }
 
 WebInspector.addMainEventListeners = function(doc)
@@ -1447,8 +1536,33 @@ WebInspector.addMainEventListeners = function(doc)
     doc.addEventListener("click", this.documentClick.bind(this), true);
 }
 
+WebInspector.searchFieldManualFocus = function(event)
+{
+    this.currentFocusElement = event.target;
+    this._previousFocusElement = event.target;
+}
+
 WebInspector.searchKeyDown = function(event)
 {
+    // Escape Key will clear the field and clear the search results
+    if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Esc) {
+        event.preventDefault();
+        // When search was selected manually and is currently blank, we'd like Esc stay unhandled
+        // and hit console drawer handler.
+        event.handled = !(this.previousFocusElement === event.target && event.target.value === "");
+        event.target.value = "";
+
+        this.performSearch(event);
+        this.currentFocusElement = this.previousFocusElement;
+        if (this.currentFocusElement === event.target)
+            this.currentFocusElement.select();
+        return false;
+    } else if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Backspace ||
+               event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Delete) {
+        event.handled = true;
+        return false;
+    }
+
     if (!isEnterKey(event))
         return false;
 
@@ -1558,7 +1672,7 @@ WebInspector.UIString = function(string)
         string = window.localizedStrings[string];
     else {
         if (!(string in this.missingLocalizedStrings)) {
-            if (!WebInspector.InspectorControllerStub)
+            if (!WebInspector.InspectorBackendStub)
                 console.error("Localized string \"" + string + "\" not found.");
             this.missingLocalizedStrings[string] = true;
         }
@@ -1570,6 +1684,14 @@ WebInspector.UIString = function(string)
     return String.vsprintf(string, Array.prototype.slice.call(arguments, 1));
 }
 
+WebInspector.isMac = function()
+{
+    if (!("_isMac" in this))
+        this._isMac = WebInspector.platform.indexOf("mac-") === 0;
+
+    return this._isMac;
+}
+
 WebInspector.isBeingEdited = function(element)
 {
     return element.__editing;
@@ -1645,6 +1767,8 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         if (isEnterKey(event)) {
             editingCommitted.call(element);
             event.preventDefault();
+            event.stopPropagation();
+            event.handled = true;
         } else if (event.keyCode === 27) { // Escape key
             editingCancelled.call(element);
             event.preventDefault();
diff --git a/WebCore/inspector/front-end/inspectorSyntaxHighlight.css b/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
index 2cbb3c5..e3e3074 100644
--- a/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
+++ b/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
@@ -26,33 +26,29 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-.webkit-css-comment { 
-    color: rgb(0, 116, 0);
-}
+ .webkit-css-comment { 
+     color: rgb(0, 116, 0);
+ }
 
-.webkit-css-string, .webkit-css-keyword, .webkit-css-unit {
-    color: rgb(7, 144, 154);
-}
+ .webkit-css-url, .webkit-css-color, .webkit-css-string, .webkit-css-keyword {
+     color: rgb(7, 144, 154);
+ }
 
-.webkit-css-number {
-    color: rgb(50, 0, 255);
-}
+ .webkit-css-number {
+     color: rgb(50, 0, 255);
+ }
 
-.webkit-css-property, .webkit-css-at-rule {
-    color: rgb(200, 0, 0);
-}
+ .webkit-css-property, .webkit-css-at-rule {
+     color: rgb(200, 0, 0);
+ }
 
-.webkit-css-url {
-    color: rgb(0, 0, 0);
-}
-
-.webkit-css-selector {
-    color: rgb(0, 0, 0);
-}
+ .webkit-css-selector {
+     rgb(0, 0, 0);
+ }
 
-.webkit-css-pseudo-class {
-    color: rgb(128, 128, 128);
-}
+ .webkit-css-important {
+     color: rgb(200, 0, 180);
+ }
 
 .webkit-javascript-comment {
     color: rgb(0, 116, 0);
diff --git a/WebCore/inspector/front-end/treeoutline.js b/WebCore/inspector/front-end/treeoutline.js
index ecc322b..2cde151 100644
--- a/WebCore/inspector/front-end/treeoutline.js
+++ b/WebCore/inspector/front-end/treeoutline.js
@@ -624,7 +624,7 @@ TreeElement.treeElementDoubleClicked = function(event)
         return;
 
     if (element.treeElement.ondblclick)
-        element.treeElement.ondblclick(element.treeElement, event);
+        element.treeElement.ondblclick.call(element.treeElement, event);
     else if (element.treeElement.hasChildren && !element.treeElement.expanded)
         element.treeElement.expand();
 }
diff --git a/WebCore/inspector/front-end/utilities.js b/WebCore/inspector/front-end/utilities.js
index e9d185f..04c9032 100644
--- a/WebCore/inspector/front-end/utilities.js
+++ b/WebCore/inspector/front-end/utilities.js
@@ -147,13 +147,18 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
 
 Element.prototype.removeStyleClass = function(className) 
 {
-    // Test for the simple case before using a RegExp.
+    // Test for the simple case first.
     if (this.className === className) {
         this.className = "";
         return;
     }
 
-    this.removeMatchingStyleClasses(className.escapeForRegExp());
+    var index = this.className.indexOf(className);
+    if (index === -1)
+        return;
+
+    var newClassName = " " + this.className + " ";
+    this.className = newClassName.replace(" " + className + " ", " ");
 }
 
 Element.prototype.removeMatchingStyleClasses = function(classNameRegex)
@@ -173,11 +178,15 @@ Element.prototype.hasStyleClass = function(className)
 {
     if (!className)
         return false;
-    // Test for the simple case before using a RegExp.
+    // Test for the simple case
     if (this.className === className)
         return true;
-    var regex = new RegExp("(^|\\s)" + className.escapeForRegExp() + "($|\\s)");
-    return regex.test(this.className);
+
+    var index = this.className.indexOf(className);
+    if (index === -1)
+        return false;
+    var toTest = " " + this.className + " ";
+    return toTest.indexOf(" " + className + " ", index) !== -1;
 }
 
 Element.prototype.positionAt = function(x, y)
@@ -222,8 +231,7 @@ Element.prototype.query = function(query)
 
 Element.prototype.removeChildren = function()
 {
-    while (this.firstChild) 
-        this.removeChild(this.firstChild);        
+    this.innerHTML = "";
 }
 
 Element.prototype.isInsertionCaretInside = function()
@@ -342,7 +350,7 @@ String.prototype.trimWhitespace = function()
 
 String.prototype.trimURL = function(baseURLDomain)
 {
-    var result = this.replace(new RegExp("^http[s]?:\/\/", "i"), "");
+    var result = this.replace(/^https?:\/\//i, "");
     if (baseURLDomain)
         result = result.replace(new RegExp("^" + baseURLDomain.escapeForRegExp(), "i"), "");
     return result;
@@ -542,6 +550,9 @@ Number.secondsToString = function(seconds, formatterFunction, higherResolution)
     if (!formatterFunction)
         formatterFunction = String.sprintf;
 
+    if (seconds === 0)
+        return "0";
+
     var ms = seconds * 1000;
     if (higherResolution && ms < 1000)
         return formatterFunction("%.3fms", ms);
@@ -822,3 +833,7 @@ function isEnterKey(event) {
     // Check if in IME.
     return event.keyCode !== 229 && event.keyIdentifier === "Enter";
 }
+
+function isFnKey(event) {
+    return event.keyCode >= 112 && event.keyCode <= 123;
+}
diff --git a/WebCore/loader/CachedResource.h b/WebCore/loader/CachedResource.h
index 05d24fc..66ca1b1 100644
--- a/WebCore/loader/CachedResource.h
+++ b/WebCore/loader/CachedResource.h
@@ -46,7 +46,7 @@ class PurgeableBuffer;
 // A resource that is held in the cache. Classes who want to use this object should derive
 // from CachedResourceClient, to get the function calls in case the requested data has arrived.
 // This class also does the actual communication with the loader to obtain the resource from the network.
-class CachedResource {
+class CachedResource : public Noncopyable {
     friend class Cache;
     friend class InspectorResource;
     
diff --git a/WebCore/loader/CrossOriginAccessControl.cpp b/WebCore/loader/CrossOriginAccessControl.cpp
index f0f8b6a..7a21280 100644
--- a/WebCore/loader/CrossOriginAccessControl.cpp
+++ b/WebCore/loader/CrossOriginAccessControl.cpp
@@ -100,6 +100,10 @@ bool passesAccessControlCheck(const ResourceResponse& response, bool includeCred
     if (accessControlOriginString == "*" && !includeCredentials)
         return true;
 
+    // A sandboxed frame has a unique origin (for same-origin purposes).
+    if (securityOrigin->isSandboxed(SandboxOrigin))
+        return false;
+
     RefPtr<SecurityOrigin> accessControlOrigin = SecurityOrigin::createFromString(accessControlOriginString);
     if (!accessControlOrigin->isSameSchemeHostPort(securityOrigin))
         return false;
diff --git a/WebCore/loader/DocLoader.h b/WebCore/loader/DocLoader.h
index fdc1776..06d8a47 100644
--- a/WebCore/loader/DocLoader.h
+++ b/WebCore/loader/DocLoader.h
@@ -47,7 +47,7 @@ class ImageLoader;
 class KURL;
 
 // The DocLoader manages the loading of scripts/images/stylesheets for a single document.
-class DocLoader
+class DocLoader : public Noncopyable
 {
 friend class Cache;
 friend class ImageLoader;
diff --git a/WebCore/loader/DocumentLoader.cpp b/WebCore/loader/DocumentLoader.cpp
index 5ca6e58..e8c3652 100644
--- a/WebCore/loader/DocumentLoader.cpp
+++ b/WebCore/loader/DocumentLoader.cpp
@@ -203,7 +203,7 @@ const KURL& DocumentLoader::url() const
     return request().url();
 }
 
-void DocumentLoader::replaceRequestURLForAnchorScroll(const KURL& url)
+void DocumentLoader::replaceRequestURLForSameDocumentNavigation(const KURL& url)
 {
     m_originalRequestCopy.setURL(url);
     m_request.setURL(url);
diff --git a/WebCore/loader/DocumentLoader.h b/WebCore/loader/DocumentLoader.h
index 1fa2b65..b8e659c 100644
--- a/WebCore/loader/DocumentLoader.h
+++ b/WebCore/loader/DocumentLoader.h
@@ -90,7 +90,7 @@ namespace WebCore {
         const KURL& responseURL() const;
         const String& responseMIMEType() const;
         
-        void replaceRequestURLForAnchorScroll(const KURL&);
+        void replaceRequestURLForSameDocumentNavigation(const KURL&);
         bool isStopping() const { return m_isStopping; }
         void stopLoading(DatabasePolicy = DatabasePolicyStop);
         void setCommitted(bool committed) { m_committed = committed; }
diff --git a/WebCore/loader/DocumentThreadableLoader.h b/WebCore/loader/DocumentThreadableLoader.h
index 64b1a22..7eb7f1c 100644
--- a/WebCore/loader/DocumentThreadableLoader.h
+++ b/WebCore/loader/DocumentThreadableLoader.h
@@ -41,7 +41,7 @@
 namespace WebCore {
     class Document;
     class KURL;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ThreadableLoaderClient;
 
     class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
diff --git a/WebCore/loader/EmptyClients.h b/WebCore/loader/EmptyClients.h
index 5fcd4cd..c6ae799 100644
--- a/WebCore/loader/EmptyClients.h
+++ b/WebCore/loader/EmptyClients.h
@@ -80,6 +80,8 @@ public:
     virtual bool canTakeFocus(FocusDirection) { return false; }
     virtual void takeFocus(FocusDirection) { }
 
+    virtual void focusedNodeChanged(Node*) { }
+
     virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&) { return 0; }
     virtual void show() { }
 
@@ -204,6 +206,9 @@ public:
     virtual void dispatchDidCancelClientRedirect() { }
     virtual void dispatchWillPerformClientRedirect(const KURL&, double, double) { }
     virtual void dispatchDidChangeLocationWithinPage() { }
+    virtual void dispatchDidPushStateWithinPage() { }
+    virtual void dispatchDidReplaceStateWithinPage() { }
+    virtual void dispatchDidPopStateWithinPage() { }
     virtual void dispatchWillClose() { }
     virtual void dispatchDidReceiveIcon() { }
     virtual void dispatchDidStartProvisionalLoad() { }
@@ -283,8 +288,13 @@ public:
     virtual void updateGlobalHistory() { }
     virtual void updateGlobalHistoryRedirectLinks() { }
     virtual bool shouldGoToHistoryItem(HistoryItem*) const { return false; }
+<<<<<<< HEAD:WebCore/loader/EmptyClients.h
     virtual void dispatchDidAddBackForwardItem(HistoryItem*) const  { }
     virtual void dispatchDidRemoveBackForwardItem(HistoryItem*) const { }
+=======
+    virtual void dispatchDidAddBackForwardItem(HistoryItem*) const { }
+    virtual void dispatchDidRemoveBackForwardItem(HistoryItem*) const { };
+>>>>>>> webkit.org at r51976:WebCore/loader/EmptyClients.h
     virtual void dispatchDidChangeBackForwardIndex() const { }
     virtual void saveViewStateToItem(HistoryItem*) { }
     virtual bool canCachePage() const { return false; }
@@ -298,7 +308,7 @@ public:
     virtual String overrideMediaType() const { return String(); }
 
     virtual void redirectDataToPlugin(Widget*) { }
-    virtual void windowObjectCleared() { }
+    virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*) { }
     virtual void documentElementAvailable() { }
     virtual void didPerformFirstNavigation() const { }
 
@@ -484,20 +494,12 @@ public:
     virtual void hideHighlight() { }
     virtual void inspectedURLChanged(const String&) { }
 
-    virtual void populateSetting(const String&, InspectorController::Setting&) { }
-    virtual void storeSetting(const String&, const InspectorController::Setting&) { }
-    virtual void removeSetting(const String&) { }
+    virtual void populateSetting(const String&, String*) { }
+    virtual void storeSetting(const String&, const String&) { }
 
     virtual void inspectorWindowObjectCleared() { }
 };
 
-class EmptyPluginHalterClient : public PluginHalterClient
-{
-public:
-    virtual bool shouldHaltPlugin(Node*) const { return false; }
-    virtual bool enabled() const { return false; }
-};
-
 }
 
 #endif // EmptyClients_h
diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index 98b8e61..22399b0 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -203,6 +203,7 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_didPerformFirstNavigation(false)
     , m_loadingFromCachedPage(false)
     , m_suppressOpenerInNewFrame(false)
+    , m_sandboxFlags(SandboxAll)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
@@ -235,6 +236,9 @@ void FrameLoader::init()
     m_frame->document()->cancelParsing();
     m_creatingInitialEmptyDocument = false;
     m_didCallImplicitClose = true;
+
+    // Propagate sandbox attributes to this Frameloader and its descendants.
+    updateSandboxFlags();
 }
 
 void FrameLoader::setDefersLoading(bool defers)
@@ -452,6 +456,9 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     if (u.isEmpty())
         return;
 
+    if (isSandboxed(SandboxForms))
+        return;
+
     if (protocolIsJavaScript(u)) {
         m_isExecutingJavaScriptFormAction = true;
         m_frame->script()->executeIfJavaScriptURL(u, false, false);
@@ -530,7 +537,10 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
                 if (m_frame->domWindow()) {
                     if (unloadEventPolicy == UnloadEventPolicyUnloadAndPageHide)
                         m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(eventNames().pagehideEvent, m_frame->document()->inPageCache()), m_frame->document());
+<<<<<<< HEAD:WebCore/loader/FrameLoader.cpp
 #ifndef ANDROID_PAGE_CACHE_UNLOAD
+=======
+>>>>>>> webkit.org at r51976:WebCore/loader/FrameLoader.cpp
                     if (!m_frame->document()->inPageCache())
 #endif
                         m_frame->domWindow()->dispatchEvent(Event::create(eventNames().unloadEvent, false, false), m_frame->domWindow()->document());
@@ -624,8 +634,8 @@ KURL FrameLoader::iconURL()
     KURL url;
     url.setProtocol(m_URL.protocol());
     url.setHost(m_URL.host());
-    if (int port = m_URL.port())
-        url.setPort(port);
+    if (m_URL.hasPort())
+        url.setPort(m_URL.port());
     url.setPath("/favicon.ico");
     return url;
 }
@@ -759,7 +769,7 @@ void FrameLoader::receivedFirstData()
     begin(m_workingURL, false);
 
     dispatchDidCommitLoad();
-    dispatchWindowObjectAvailable();
+    dispatchDidClearWindowObjectsInAllWorlds();
     
     if (m_documentLoader) {
         String ptitle = m_documentLoader->title();
@@ -848,7 +858,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
     if (dispatch)
-        dispatchWindowObjectAvailable();
+        dispatchDidClearWindowObjectsInAllWorlds();
     
     updateFirstPartyForCookies();
 
@@ -1285,14 +1295,18 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
         if (!settings || !settings->arePluginsEnabled() || 
             (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
             return false;
+        if (isSandboxed(SandboxPlugins))
+            return false;
         return loadPlugin(renderer, completedURL, mimeType, paramNames, paramValues, useFallback);
     }
 
     ASSERT(renderer->node()->hasTagName(objectTag) || renderer->node()->hasTagName(embedTag));
     HTMLPlugInElement* element = static_cast<HTMLPlugInElement*>(renderer->node());
-    
-    // FIXME: OK to always make a new frame? When does the old frame get removed?
-    return loadSubframe(element, completedURL, frameName, m_outgoingReferrer);
+
+    // If the plug-in element already contains a subframe, requestFrame will re-use it. Otherwise,
+    // it will create a new frame and set it as the RenderPart's widget, causing what was previously 
+    // in the widget to be torn down.
+    return requestFrame(element, completedURL, frameName);
 }
 
 bool FrameLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool hasFallback, bool& useFallback)
@@ -1730,52 +1744,70 @@ void FrameLoader::setFirstPartyForCookies(const KURL& url)
         child->loader()->setFirstPartyForCookies(url);
 }
 
-class HashChangeEventTask : public ScriptExecutionContext::Task {
-public:
-    static PassRefPtr<HashChangeEventTask> create(PassRefPtr<Document> document)
-    {
-        return adoptRef(new HashChangeEventTask(document));
-    }
-    
-    virtual void performTask(ScriptExecutionContext* context)
-    {
-        ASSERT_UNUSED(context, context->isDocument());
-        m_document->dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
-    }
-    
-private:
-    HashChangeEventTask(PassRefPtr<Document> document)
-        : m_document(document)
-    {
-        ASSERT(m_document);
-    }
-    
-    RefPtr<Document> m_document;
-};
-
 // This does the same kind of work that didOpenURL does, except it relies on the fact
 // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
-void FrameLoader::scrollToAnchor(const KURL& url)
-{
-    ASSERT(equalIgnoringFragmentIdentifier(url, m_URL));
-    if (equalIgnoringFragmentIdentifier(url, m_URL) && !equalIgnoringNullity(url.fragmentIdentifier(), m_URL.fragmentIdentifier())) {
-        Document* currentDocument = frame()->document();
-        currentDocument->postTask(HashChangeEventTask::create(currentDocument));
+void FrameLoader::loadInSameDocument(const KURL& url, SerializedScriptValue* stateObject, bool isNewNavigation)
+{
+    // If we have a state object, we cannot also be a new navigation.
+    ASSERT(!stateObject || (stateObject && !isNewNavigation));
+
+    // Update the data source's request with the new URL to fake the URL change
+    m_frame->document()->setURL(url);
+    documentLoader()->replaceRequestURLForSameDocumentNavigation(url);
+    if (isNewNavigation && !shouldTreatURLAsSameAsCurrent(url) && !stateObject) {
+        // NB: must happen after replaceRequestURLForSameDocumentNavigation(), since we add 
+        // based on the current request. Must also happen before we openURL and displace the 
+        // scroll position, since adding the BF item will save away scroll state.
+        
+        // NB2:  If we were loading a long, slow doc, and the user anchor nav'ed before
+        // it was done, currItem is now set the that slow doc, and prevItem is whatever was
+        // before it.  Adding the b/f item will bump the slow doc down to prevItem, even
+        // though its load is not yet done.  I think this all works out OK, for one because
+        // we have already saved away the scroll and doc state for the long slow load,
+        // but it's not an obvious case.
+
+        history()->updateBackForwardListForFragmentScroll();
     }
     
+    bool hashChange = equalIgnoringFragmentIdentifier(url, m_URL) && url.fragmentIdentifier() != m_URL.fragmentIdentifier();
     m_URL = url;
-    history()->updateForAnchorScroll();
+    history()->updateForSameDocumentNavigation();
 
     // If we were in the autoscroll/panScroll mode we want to stop it before following the link to the anchor
-    m_frame->eventHandler()->stopAutoscrollTimer();
-    started();
-    if (FrameView* view = m_frame->view())
-        view->scrollToFragment(m_URL);
-
+    if (hashChange)
+        m_frame->eventHandler()->stopAutoscrollTimer();
+    
     // It's important to model this as a load that starts and immediately finishes.
     // Otherwise, the parent frame may think we never finished loading.
+    started();
+    
+    if (hashChange) {
+        if (FrameView* view = m_frame->view())
+            view->scrollToFragment(m_URL);
+    }
+    
     m_isComplete = false;
     checkCompleted();
+
+    if (isNewNavigation) {
+        // This will clear previousItem from the rest of the frame tree that didn't
+        // doing any loading. We need to make a pass on this now, since for anchor nav
+        // we'll not go through a real load and reach Completed state.
+        checkLoadComplete();
+    }
+
+    if (stateObject) {
+        m_frame->document()->statePopped(stateObject);
+        m_client->dispatchDidPopStateWithinPage();
+    }
+    
+    if (hashChange) {
+        m_frame->document()->dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
+        m_client->dispatchDidChangeLocationWithinPage();
+    }
+    
+    // FrameLoaderClient::didFinishLoad() tells the internal load delegate the load finished with no error
+    m_client->didFinishLoad();
 }
 
 bool FrameLoader::isComplete() const
@@ -2256,6 +2288,10 @@ bool FrameLoader::shouldAllowNavigation(Frame* targetFrame) const
     if (m_frame == targetFrame)
         return true;
 
+    // A sandboxed frame can only navigate itself and its descendants.
+    if (isSandboxed(SandboxNavigation) && !targetFrame->tree()->isDescendantOf(m_frame))
+        return false;
+
     // Let a frame navigate the top-level window that contains it.  This is
     // important to allow because it lets a site "frame-bust" (escape from a
     // frame created by another web site).
@@ -2957,8 +2993,8 @@ void FrameLoader::checkLoadCompleteForThisFrame()
                 // delegate callback.
                 if (pdl == m_provisionalDocumentLoader)
                     clearProvisionalLoad();
-                else if (m_provisionalDocumentLoader) {
-                    KURL unreachableURL = m_provisionalDocumentLoader->unreachableURL();
+                else if (activeDocumentLoader()) {
+                    KURL unreachableURL = activeDocumentLoader()->unreachableURL();
                     if (!unreachableURL.isEmpty() && unreachableURL == pdl->request().url())
                         shouldReset = false;
                 }
@@ -3339,10 +3375,16 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
     ResourceRequest initialRequest = request;
     initialRequest.setTimeoutInterval(10);
     
+    // Use the original request's cache policy for two reasons:
+    // 1. For POST requests, we mutate the cache policy for the main resource,
+    //    but we do not want this to apply to subresources
+    // 2. Delegates that modify the cache policy using willSendRequest: should
+    //    not affect any other resources. Such changes need to be done
+    //    per request.
     if (initialRequest.isConditional())
         initialRequest.setCachePolicy(ReloadIgnoringCacheData);
     else
-        initialRequest.setCachePolicy(documentLoader()->request().cachePolicy());
+        initialRequest.setCachePolicy(originalRequest().cachePolicy());
     
     if (!referrer.isEmpty())
         initialRequest.setHTTPReferrer(referrer);
@@ -3423,12 +3465,12 @@ void FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void* argument
 
 void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
-    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;
     m_quickRedirectComing = false;
 
     if (!shouldContinue)
         return;
 
+<<<<<<< HEAD:WebCore/loader/FrameLoader.cpp
     KURL url = request.url();
     
     m_documentLoader->replaceRequestURLForAnchorScroll(url);
@@ -3464,6 +3506,10 @@ void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequ
  
     m_client->dispatchDidChangeLocationWithinPage();
     m_client->didFinishLoad();
+=======
+    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;    
+    loadInSameDocument(request.url(), 0, !isRedirect);
+>>>>>>> webkit.org at r51976:WebCore/loader/FrameLoader.cpp
 }
 
 bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType loadType, const KURL& url)
@@ -3738,14 +3784,51 @@ Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
     return frame;
 }
 
-// Loads content into this frame, as specified by history item
+void FrameLoader::navigateWithinDocument(HistoryItem* item)
+{
+    ASSERT(!item->document() || item->document() == m_frame->document());
+
+    // Save user view state to the current history item here since we don't do a normal load.
+    // FIXME: Does form state need to be saved here too?
+    history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
+    if (FrameView* view = m_frame->view())
+        view->setWasScrolledByUser(false);
+
+    history()->setCurrentItem(item);
+        
+    // loadInSameDocument() actually changes the URL and notifies load delegates of a "fake" load
+    loadInSameDocument(item->url(), item->stateObject(), false);
+
+    // Restore user view state from the current history item here since we don't do a normal load.
+    // Even though we just manually set the current history item, this ASSERT verifies nothing 
+    // inside of loadInSameDocument() caused it to change.
+    ASSERT(history()->currentItem() == item);
+    history()->restoreScrollPositionAndViewState();
+}
+
 // FIXME: This function should really be split into a couple pieces, some of
 // which should be methods of HistoryController and some of which should be
 // methods of FrameLoader.
-void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
+void FrameLoader::navigateToDifferentDocument(HistoryItem* item, FrameLoadType loadType)
 {
-    if (!m_frame->page())
-        return;
+    // Remember this item so we can traverse any child items as child frames load
+    history()->setProvisionalItem(item);
+    
+    // Check if we'll be using the page cache.  We only use the page cache
+    // if one exists and it is less than _backForwardCacheExpirationInterval
+    // seconds old.  If the cache is expired it gets flushed here.
+    if (RefPtr<CachedPage> cachedPage = pageCache()->get(item)) {
+        // FIXME: 1800 should not be hardcoded, it should come from
+        // WebKitBackForwardCacheExpirationIntervalKey in WebKit.
+        // Or we should remove WebKitBackForwardCacheExpirationIntervalKey.
+        if (currentTime() - cachedPage->timeStamp() <= 1800) {
+            loadWithDocumentLoader(cachedPage->documentLoader(), loadType, 0);   
+            return;
+        }
+        
+        LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", history()->provisionalItem()->url().string().ascii().data());
+        pageCache()->remove(item);
+    }
 
     KURL itemURL = item->url();
     KURL itemOriginalURL = item->originalURL();
@@ -3754,138 +3837,96 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
         currentURL = documentLoader()->url();
     RefPtr<FormData> formData = item->formData();
 
-    // Are we navigating to an anchor within the page?
-    // Note if we have child frames we do a real reload, since the child frames might not
-    // match our current frame structure, or they might not have the right content.  We could
-    // check for all that as an additional optimization.
-    // We also do not do anchor-style navigation if we're posting a form or navigating from
-    // a page that was resulted from a form post.
-    bool shouldScroll = !formData && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item);
+    bool addedExtraFields = false;
+    ResourceRequest request(itemURL);
 
-#if ENABLE(WML)
-    // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
-    if (frameContainsWMLContent(m_frame))
-        shouldScroll = false;
-#endif
-
-    if (shouldScroll) {
-        // Must do this maintenance here, since we don't go through a real page reload
-        history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
-
-        if (FrameView* view = m_frame->view())
-            view->setWasScrolledByUser(false);
-
-        history()->setCurrentItem(item);
-
-        // FIXME: Form state might need to be saved here too.
-
-        // We always call scrollToAnchor here, even if the URL doesn't have an
-        // anchor fragment. This is so we'll keep the WebCore Frame's URL up-to-date.
-        scrollToAnchor(item->url());
+    if (!item->referrer().isNull())
+        request.setHTTPReferrer(item->referrer());
     
-        // must do this maintenance here, since we don't go through a real page reload
-        history()->restoreScrollPositionAndViewState();
+    // If this was a repost that failed the page cache, we might try to repost the form.
+    NavigationAction action;
+    if (formData) {
+        formData->generateFiles(m_frame->page()->chrome()->client());
+
+        request.setHTTPMethod("POST");
+        request.setHTTPBody(formData);
+        request.setHTTPContentType(item->formContentType());
+        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->referrer());
+        addHTTPOriginIfNeeded(request, securityOrigin->toString());
+
+        // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
+        // See https://bugs.webkit.org/show_bug.cgi?id=22194 for more discussion.
+        addExtraFieldsToRequest(request, m_loadType, true, formData);
+        addedExtraFields = true;
         
-        // Fake the URL change by updating the data source's request.  This will no longer
-        // be necessary if we do the better fix described above.
-        documentLoader()->replaceRequestURLForAnchorScroll(itemURL);
-
-        m_client->dispatchDidChangeLocationWithinPage();
+        // FIXME: Slight hack to test if the NSURL cache contains the page we're going to.
+        // We want to know this before talking to the policy delegate, since it affects whether 
+        // we show the DoYouReallyWantToRepost nag.
+        //
+        // This trick has a small bug (3123893) where we might find a cache hit, but then
+        // have the item vanish when we try to use it in the ensuing nav.  This should be
+        // extremely rare, but in that case the user will get an error on the navigation.
         
-        // FrameLoaderClient::didFinishLoad() tells the internal load delegate the load finished with no error
-        m_client->didFinishLoad();
+        if (ResourceHandle::willLoadFromCache(request, m_frame))
+            action = NavigationAction(itemURL, loadType, false);
+        else {
+            request.setCachePolicy(ReloadIgnoringCacheData);
+            action = NavigationAction(itemURL, NavigationTypeFormResubmitted);
+        }
     } else {
-        // Remember this item so we can traverse any child items as child frames load
-        history()->setProvisionalItem(item);
-
-        bool inPageCache = false;
-        
-        // Check if we'll be using the page cache.  We only use the page cache
-        // if one exists and it is less than _backForwardCacheExpirationInterval
-        // seconds old.  If the cache is expired it gets flushed here.
-        if (RefPtr<CachedPage> cachedPage = pageCache()->get(item)) {
-            double interval = currentTime() - cachedPage->timeStamp();
-            
-            // FIXME: 1800 should not be hardcoded, it should come from
-            // WebKitBackForwardCacheExpirationIntervalKey in WebKit.
-            // Or we should remove WebKitBackForwardCacheExpirationIntervalKey.
-            if (interval <= 1800) {
-                loadWithDocumentLoader(cachedPage->documentLoader(), loadType, 0);   
-                inPageCache = true;
-            } else {
-                LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", history()->provisionalItem()->url().string().ascii().data());
-                pageCache()->remove(item);
-            }
+        switch (loadType) {
+            case FrameLoadTypeReload:
+            case FrameLoadTypeReloadFromOrigin:
+                request.setCachePolicy(ReloadIgnoringCacheData);
+                break;
+            case FrameLoadTypeBack:
+            case FrameLoadTypeBackWMLDeckNotAccessible:
+            case FrameLoadTypeForward:
+            case FrameLoadTypeIndexedBackForward:
+                if (!itemURL.protocolIs("https"))
+                    request.setCachePolicy(ReturnCacheDataElseLoad);
+                break;
+            case FrameLoadTypeStandard:
+            case FrameLoadTypeRedirectWithLockedBackForwardList:
+                break;
+            case FrameLoadTypeSame:
+            default:
+                ASSERT_NOT_REACHED();
         }
-        
-        if (!inPageCache) {
-            bool addedExtraFields = false;
-            ResourceRequest request(itemURL);
 
-            if (!item->referrer().isNull())
-                request.setHTTPReferrer(item->referrer());
-            
-            // If this was a repost that failed the page cache, we might try to repost the form.
-            NavigationAction action;
-            if (formData) {
-                
-                formData->generateFiles(m_frame->page()->chrome()->client());
+        action = NavigationAction(itemOriginalURL, loadType, false);
+    }
+    
+    if (!addedExtraFields)
+        addExtraFieldsToRequest(request, m_loadType, true, formData);
 
-                request.setHTTPMethod("POST");
-                request.setHTTPBody(formData);
-                request.setHTTPContentType(item->formContentType());
-                RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->referrer());
-                addHTTPOriginIfNeeded(request, securityOrigin->toString());
-        
-                // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
-                // See https://bugs.webkit.org/show_bug.cgi?id=22194 for more discussion.
-                addExtraFieldsToRequest(request, m_loadType, true, formData);
-                addedExtraFields = true;
-                
-                // FIXME: Slight hack to test if the NSURL cache contains the page we're going to.
-                // We want to know this before talking to the policy delegate, since it affects whether 
-                // we show the DoYouReallyWantToRepost nag.
-                //
-                // This trick has a small bug (3123893) where we might find a cache hit, but then
-                // have the item vanish when we try to use it in the ensuing nav.  This should be
-                // extremely rare, but in that case the user will get an error on the navigation.
-                
-                if (ResourceHandle::willLoadFromCache(request, m_frame))
-                    action = NavigationAction(itemURL, loadType, false);
-                else {
-                    request.setCachePolicy(ReloadIgnoringCacheData);
-                    action = NavigationAction(itemURL, NavigationTypeFormResubmitted);
-                }
-            } else {
-                switch (loadType) {
-                    case FrameLoadTypeReload:
-                    case FrameLoadTypeReloadFromOrigin:
-                        request.setCachePolicy(ReloadIgnoringCacheData);
-                        break;
-                    case FrameLoadTypeBack:
-                    case FrameLoadTypeBackWMLDeckNotAccessible:
-                    case FrameLoadTypeForward:
-                    case FrameLoadTypeIndexedBackForward:
-                        if (itemURL.protocol() != "https")
-                            request.setCachePolicy(ReturnCacheDataElseLoad);
-                        break;
-                    case FrameLoadTypeStandard:
-                    case FrameLoadTypeRedirectWithLockedBackForwardList:
-                        break;
-                    case FrameLoadTypeSame:
-                    default:
-                        ASSERT_NOT_REACHED();
-                }
+    loadWithNavigationAction(request, action, false, loadType, 0);
+}
 
-                action = NavigationAction(itemOriginalURL, loadType, false);
-            }
-            
-            if (!addedExtraFields)
-                addExtraFieldsToRequest(request, m_loadType, true, formData);
+// Loads content into this frame, as specified by history item
+void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
+{
+    // We do same-document navigation in the following cases:
+    // - The HistoryItem has a history state object
+    // - Navigating to an anchor within the page, with no form data stored on the target item or the current history entry,
+    //   and the URLs in the frame tree match the history item for fragment scrolling.
+    bool sameDocumentNavigation = (!item->formData() && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item)) || item->document() == m_frame->document();
 
-            loadWithNavigationAction(request, action, false, loadType, 0);
-        }
-    }
+#if ENABLE(WML)
+    // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
+    // FIXME: Why do WML decks have this different behavior?
+    // Are WML decks incompatible with HTML5 pushState/replaceState which require inter-document history navigations?
+    // Should this new API be disabled for WML pages, or does WML need to update their mechanism to act like normal loads?
+    // If scroll-to-anchor navigations were broken for WML and required them to have different loading behavior, then  
+    // state object loads are certainly also broken for them.
+    if (frameContainsWMLContent(m_frame))
+        sameDocumentNavigation = false;
+#endif
+
+    if (sameDocumentNavigation)
+        navigateWithinDocument(item);
+    else
+        navigateToDifferentDocument(item, loadType);
 }
 
 void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError& error)
@@ -3955,15 +3996,28 @@ void FrameLoader::dispatchDocumentElementAvailable()
     m_client->documentElementAvailable();
 }
 
-void FrameLoader::dispatchWindowObjectAvailable()
+void FrameLoader::dispatchDidClearWindowObjectsInAllWorlds()
 {
-    // FIXME: should this be isolated-worlds-aware?
-    if (!m_frame->script()->isEnabled() || !m_frame->script()->existingWindowShell(mainThreadNormalWorld()))
+    if (!m_frame->script()->isEnabled())
         return;
 
-    m_client->windowObjectCleared();
+    Vector<DOMWrapperWorld*> worlds;
+    ScriptController::getAllWorlds(worlds);
+    for (size_t i = 0; i < worlds.size(); ++i)
+        dispatchDidClearWindowObjectInWorld(worlds[i]);
+}
+
+void FrameLoader::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
+{
+    if (!m_frame->script()->isEnabled() || !m_frame->script()->existingWindowShell(world))
+        return;
+
+    m_client->dispatchDidClearWindowObjectInWorld(world);
 
 #if ENABLE(INSPECTOR)
+    if (world != mainThreadNormalWorld())
+        return;
+
     if (Page* page = m_frame->page()) {
         if (InspectorController* inspector = page->inspectorController())
             inspector->inspectedWindowScriptObjectCleared(m_frame);
@@ -3973,6 +4027,25 @@ void FrameLoader::dispatchWindowObjectAvailable()
 #endif
 }
 
+void FrameLoader::updateSandboxFlags()
+{
+    SandboxFlags flags = SandboxNone;
+    if (Frame* parentFrame = m_frame->tree()->parent())
+        flags |= parentFrame->loader()->sandboxFlags();
+    if (HTMLFrameOwnerElement* ownerElement = m_frame->ownerElement())
+        flags |= ownerElement->sandboxFlags();
+
+    if (m_sandboxFlags == flags)
+        return;
+        
+    m_sandboxFlags = flags;
+
+    m_frame->document()->updateSandboxFlags();
+
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        child->loader()->updateSandboxFlags();
+ }
+
 PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
 {
     String baseURLString;
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index 31351a3..875736f 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -52,6 +52,7 @@ class AuthenticationChallenge;
 class CachedFrameBase;
 class CachedPage;
 class CachedResource;
+class DOMWrapperWorld;
 class Document;
 class DocumentLoader;
 class Event;
@@ -74,6 +75,7 @@ class ScriptSourceCode;
 class ScriptString;
 class ScriptValue;
 class SecurityOrigin;
+class SerializedScriptValue;
 class SharedBuffer;
 class SubstituteData;
 class TextResourceDecoder;
@@ -250,9 +252,15 @@ public:
 
     PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
 
-    void dispatchWindowObjectAvailable();
+    void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
+    void dispatchDidClearWindowObjectsInAllWorlds();
     void dispatchDocumentElementAvailable();
 
+    void ownerElementSandboxFlagsChanged() { updateSandboxFlags(); }
+    
+    bool isSandboxed(SandboxFlags mask) const { return m_sandboxFlags & mask; }
+    SandboxFlags sandboxFlags() const { return m_sandboxFlags; }
+
     // Mixed content related functions.
     static bool isMixedContent(SecurityOrigin* context, const KURL&);
     void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
@@ -347,6 +355,9 @@ private:
     bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
     const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
     
+    void navigateWithinDocument(HistoryItem*);
+    void navigateToDifferentDocument(HistoryItem*, FrameLoadType);
+    
     bool loadProvisionalItemFromCachedPage();
     void cachePageForHistoryItem(HistoryItem*);
     void pageHidden();
@@ -428,7 +439,7 @@ private:
 
     Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
 
-    void scrollToAnchor(const KURL&);
+    void loadInSameDocument(const KURL&, SerializedScriptValue* stateObject, bool isNewNavigation);
 
     void provisionalLoadStarted();
 
@@ -444,6 +455,8 @@ private:
 
     bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
 
+    void updateSandboxFlags();
+    
     Frame* m_frame;
     FrameLoaderClient* m_client;
 
@@ -515,6 +528,8 @@ private:
     bool m_loadingFromCachedPage;
     bool m_suppressOpenerInNewFrame;
     
+    SandboxFlags m_sandboxFlags;
+
 #ifndef NDEBUG
     bool m_didDispatchDidCommitLoad;
 #endif
diff --git a/WebCore/loader/FrameLoaderClient.h b/WebCore/loader/FrameLoaderClient.h
index 7d988f1..434e163 100644
--- a/WebCore/loader/FrameLoaderClient.h
+++ b/WebCore/loader/FrameLoaderClient.h
@@ -47,6 +47,7 @@ namespace WebCore {
     class AuthenticationChallenge;
     class CachedFrame;
     class Color;
+    class DOMWrapperWorld;
     class DocumentLoader;
     class Element;
     class FormState;
@@ -64,7 +65,7 @@ namespace WebCore {
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class ScriptString;
     class SecurityOrigin;
@@ -116,6 +117,9 @@ namespace WebCore {
         virtual void dispatchDidCancelClientRedirect() = 0;
         virtual void dispatchWillPerformClientRedirect(const KURL&, double interval, double fireDate) = 0;
         virtual void dispatchDidChangeLocationWithinPage() = 0;
+        virtual void dispatchDidPushStateWithinPage() = 0;
+        virtual void dispatchDidReplaceStateWithinPage() = 0;
+        virtual void dispatchDidPopStateWithinPage() = 0;
         virtual void dispatchWillClose() = 0;
         virtual void dispatchDidReceiveIcon() = 0;
         virtual void dispatchDidStartProvisionalLoad() = 0;
@@ -225,7 +229,7 @@ namespace WebCore {
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType) = 0;
         virtual String overrideMediaType() const = 0;
 
-        virtual void windowObjectCleared() = 0;
+        virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*) = 0;
         virtual void documentElementAvailable() = 0;
         virtual void didPerformFirstNavigation() const = 0; // "Navigation" here means a transition from one page to another that ends up in the back/forward list.
 
@@ -252,6 +256,10 @@ namespace WebCore {
 
         virtual bool shouldUsePluginDocument(const String& /*mimeType*/) const { return false; }
         virtual bool shouldLoadMediaElementURL(const KURL&) const { return true; }
+
+        virtual void didChangeScrollOffset() { }
+
+        virtual bool allowJavaScript(bool enabledPerSettings) { return enabledPerSettings; }
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/FrameLoaderTypes.h b/WebCore/loader/FrameLoaderTypes.h
index e7d51c7..af3dde4 100644
--- a/WebCore/loader/FrameLoaderTypes.h
+++ b/WebCore/loader/FrameLoaderTypes.h
@@ -92,6 +92,18 @@ namespace WebCore {
         SendReferrer,
         NoReferrer
     };
+    
+    enum SandboxFlag {
+        SandboxNone = 0,
+        SandboxNavigation = 1,
+        SandboxPlugins = 1 << 1,
+        SandboxOrigin = 1 << 2,
+        SandboxForms = 1 << 3,
+        SandboxScripts = 1 << 4,
+        SandboxAll = -1 // Mask with all bits set to 1.
+    };
+
+    typedef int SandboxFlags;
 }
 
 #endif
diff --git a/WebCore/loader/HistoryController.cpp b/WebCore/loader/HistoryController.cpp
index 501640a..d30b231 100644
--- a/WebCore/loader/HistoryController.cpp
+++ b/WebCore/loader/HistoryController.cpp
@@ -402,7 +402,7 @@ void HistoryController::updateForCommit()
     }
 }
 
-void HistoryController::updateForAnchorScroll()
+void HistoryController::updateForSameDocumentNavigation()
 {
     if (m_frame->loader()->url().isEmpty())
         return;
@@ -624,4 +624,39 @@ void HistoryController::updateBackForwardListClippedAtTarget(bool doClip)
     page->backForwardList()->addItem(item);
 }
 
+void HistoryController::pushState(PassRefPtr<SerializedScriptValue> stateObject, const String& title, const String& urlString)
+{
+    Page* page = m_frame->page();
+    ASSERT(page);
+
+    // Get a HistoryItem tree for the current frame tree.
+    RefPtr<HistoryItem> item = createItemTree(m_frame, false);
+    
+    // Override data in the target item to reflect the pushState() arguments.
+    HistoryItem* targetItem = item->targetItem();
+    ASSERT(targetItem->isTargetItem());
+    targetItem->setDocument(m_frame->document());
+    targetItem->setTitle(title);
+    targetItem->setStateObject(stateObject);
+    targetItem->setURLString(urlString);
+    
+    page->backForwardList()->pushStateItem(item.release());
+}
+
+void HistoryController::replaceState(PassRefPtr<SerializedScriptValue> stateObject, const String& title, const String& urlString)
+{
+    Page* page = m_frame->page();
+    ASSERT(page);
+    HistoryItem* current = page->backForwardList()->currentItem();
+    ASSERT(current);
+    
+    ASSERT(!current->document() || current->document() == m_frame->document());
+    current->setDocument(m_frame->document());
+    
+    if (!urlString.isEmpty())
+        current->setURLString(urlString);
+    current->setTitle(title);
+    current->setStateObject(stateObject);
+}
+
 } // namespace WebCore
diff --git a/WebCore/loader/HistoryController.h b/WebCore/loader/HistoryController.h
index 4ecae69..7c4a1ac 100644
--- a/WebCore/loader/HistoryController.h
+++ b/WebCore/loader/HistoryController.h
@@ -39,6 +39,7 @@ namespace WebCore {
 
 class Frame;
 class HistoryItem;
+class SerializedScriptValue;
 
 class HistoryController : public Noncopyable {
 public:
@@ -65,7 +66,7 @@ public:
     void updateForRedirectWithLockedBackForwardList();
     void updateForClientRedirect();
     void updateForCommit();
-    void updateForAnchorScroll();
+    void updateForSameDocumentNavigation();
     void updateForFrameLoadCompleted();
 
     HistoryItem* currentItem() const { return m_currentItem.get(); }
@@ -75,6 +76,9 @@ public:
     HistoryItem* provisionalItem() const { return m_provisionalItem.get(); }
     void setProvisionalItem(HistoryItem*);
 
+    void pushState(PassRefPtr<SerializedScriptValue>, const String& title, const String& url);
+    void replaceState(PassRefPtr<SerializedScriptValue>, const String& title, const String& url);
+
 private:
     PassRefPtr<HistoryItem> createItem(bool useOriginal);
     PassRefPtr<HistoryItem> createItemTree(Frame* targetFrame, bool clipAtTarget);
diff --git a/WebCore/loader/ImageLoader.cpp b/WebCore/loader/ImageLoader.cpp
index cdc31bc..e09d574 100644
--- a/WebCore/loader/ImageLoader.cpp
+++ b/WebCore/loader/ImageLoader.cpp
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-class ImageEventSender {
+class ImageEventSender : public Noncopyable {
 public:
     ImageEventSender(const AtomicString& eventType);
 
diff --git a/WebCore/loader/MainResourceLoader.h b/WebCore/loader/MainResourceLoader.h
index d3f411b..1d5be45 100644
--- a/WebCore/loader/MainResourceLoader.h
+++ b/WebCore/loader/MainResourceLoader.h
@@ -40,7 +40,7 @@
 namespace WebCore {
 
     class FormState;
-    struct ResourceRequest;
+    class ResourceRequest;
 
     class MainResourceLoader : public ResourceLoader {
     public:
diff --git a/WebCore/loader/ProgressTracker.cpp b/WebCore/loader/ProgressTracker.cpp
index e682b9b..0c9f2fb 100644
--- a/WebCore/loader/ProgressTracker.cpp
+++ b/WebCore/loader/ProgressTracker.cpp
@@ -47,7 +47,7 @@ static const double finalProgressValue = 0.9; // 1.0 - initialProgressValue
 
 static const int progressItemDefaultEstimatedLength = 1024 * 16;
 
-struct ProgressItem {
+struct ProgressItem : Noncopyable {
     ProgressItem(long long length) 
         : bytesReceived(0)
         , estimatedLength(length) { }
@@ -176,8 +176,10 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
     // FIXME: Can this ever happen?
     if (!item)
         return;
+
+    RefPtr<Frame> frame = m_originatingProgressFrame;
     
-    m_originatingProgressFrame->loader()->client()->willChangeEstimatedProgress();
+    frame->loader()->client()->willChangeEstimatedProgress();
     
     unsigned bytesReceived = length;
     double increment, percentOfRemainingBytes;
@@ -189,7 +191,7 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
         item->estimatedLength = item->bytesReceived * 2;
     }
     
-    int numPendingOrLoadingRequests = m_originatingProgressFrame->loader()->numPendingOrLoadingRequests(true);
+    int numPendingOrLoadingRequests = frame->loader()->numPendingOrLoadingRequests(true);
     estimatedBytesForPendingRequests = progressItemDefaultEstimatedLength * numPendingOrLoadingRequests;
     remainingBytes = ((m_totalPageAndResourceBytesToLoad + estimatedBytesForPendingRequests) - m_totalBytesReceived);
     if (remainingBytes > 0)  // Prevent divide by 0.
@@ -199,8 +201,8 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
     
     // For documents that use WebCore's layout system, treat first layout as the half-way point.
     // FIXME: The hasHTMLView function is a sort of roundabout way of asking "do you use WebCore's layout system".
-    bool useClampedMaxProgress = m_originatingProgressFrame->loader()->client()->hasHTMLView()
-        && !m_originatingProgressFrame->loader()->firstLayoutDone();
+    bool useClampedMaxProgress = frame->loader()->client()->hasHTMLView()
+        && !frame->loader()->firstLayoutDone();
     double maxProgressValue = useClampedMaxProgress ? 0.5 : finalProgressValue;
     increment = (maxProgressValue - m_progressValue) * percentOfRemainingBytes;
     m_progressValue += increment;
@@ -221,14 +223,14 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
             if (m_progressValue == 1)
                 m_finalProgressChangedSent = true;
             
-            m_originatingProgressFrame->loader()->client()->postProgressEstimateChangedNotification();
+            frame->loader()->client()->postProgressEstimateChangedNotification();
 
             m_lastNotifiedProgressValue = m_progressValue;
             m_lastNotifiedProgressTime = now;
         }
     }
     
-    m_originatingProgressFrame->loader()->client()->didChangeEstimatedProgress();
+    frame->loader()->client()->didChangeEstimatedProgress();
 }
 
 void ProgressTracker::completeProgress(unsigned long identifier)
diff --git a/WebCore/loader/RedirectScheduler.cpp b/WebCore/loader/RedirectScheduler.cpp
index c0d78ae..f2202cc 100644
--- a/WebCore/loader/RedirectScheduler.cpp
+++ b/WebCore/loader/RedirectScheduler.cpp
@@ -39,11 +39,12 @@
 #include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "HTMLFormElement.h"
+#include "Page.h"
 #include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
-struct ScheduledRedirection {
+struct ScheduledRedirection : Noncopyable {
     enum Type { redirection, locationChange, historyNavigation, formSubmission };
 
     const Type type;
@@ -171,7 +172,7 @@ bool RedirectScheduler::mustLockBackForwardList(Frame* targetFrame)
     
     for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
         Document* document = ancestor->document();
-        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
+        if (!ancestor->loader()->isComplete() || (document && document->processingLoadEvent()))
             return true;
     }
     return false;
diff --git a/WebCore/loader/Request.h b/WebCore/loader/Request.h
index 07d1b82..1e02d77 100644
--- a/WebCore/loader/Request.h
+++ b/WebCore/loader/Request.h
@@ -30,7 +30,7 @@ namespace WebCore {
     class CachedResource;
     class DocLoader;
 
-    class Request {
+    class Request : public Noncopyable {
     public:
         Request(DocLoader*, CachedResource*, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks);
         ~Request();
diff --git a/WebCore/loader/ResourceLoadNotifier.cpp b/WebCore/loader/ResourceLoadNotifier.cpp
index 4cddd01..9280434 100644
--- a/WebCore/loader/ResourceLoadNotifier.cpp
+++ b/WebCore/loader/ResourceLoadNotifier.cpp
@@ -96,6 +96,11 @@ void ResourceLoadNotifier::didFailToLoad(ResourceLoader* loader, const ResourceE
 
     if (!error.isNull())
         m_frame->loader()->client()->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didFailLoading(loader->identifier(), error);
+#endif
 }
 
 void ResourceLoadNotifier::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
@@ -126,7 +131,7 @@ void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsig
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
+        page->inspectorController()->willSendRequest(identifier, request, redirectResponse);
 #endif
 }
 
@@ -136,7 +141,7 @@ void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, un
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveResponse(loader, identifier, r);
+        page->inspectorController()->didReceiveResponse(identifier, r);
 #endif
 }
 
@@ -146,7 +151,7 @@ void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loade
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveContentLength(loader, identifier, length);
+        page->inspectorController()->didReceiveContentLength(identifier, length);
 #endif
 }
 
@@ -156,7 +161,7 @@ void ResourceLoadNotifier::dispatchDidFinishLoading(DocumentLoader* loader, unsi
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didFinishLoading(loader, identifier);
+        page->inspectorController()->didFinishLoading(identifier);
 #endif
 }
 
diff --git a/WebCore/loader/ResourceLoadNotifier.h b/WebCore/loader/ResourceLoadNotifier.h
index b09d7be..23e4246 100644
--- a/WebCore/loader/ResourceLoadNotifier.h
+++ b/WebCore/loader/ResourceLoadNotifier.h
@@ -41,7 +41,7 @@ class ResourceError;
 class ResourceLoader;
 class ResourceResponse;
 class ScriptString;
-struct ResourceRequest;
+class ResourceRequest;
 
 class ResourceLoadNotifier : public Noncopyable {
 public:
diff --git a/WebCore/loader/SubresourceLoader.h b/WebCore/loader/SubresourceLoader.h
index 0fce930..1a94c73 100644
--- a/WebCore/loader/SubresourceLoader.h
+++ b/WebCore/loader/SubresourceLoader.h
@@ -33,7 +33,7 @@
  
 namespace WebCore {
 
-    struct ResourceRequest;
+    class ResourceRequest;
     class SubresourceLoaderClient;
     
     class SubresourceLoader : public ResourceLoader {
diff --git a/WebCore/loader/SubresourceLoaderClient.h b/WebCore/loader/SubresourceLoaderClient.h
index acf8e6a..76fde47 100644
--- a/WebCore/loader/SubresourceLoaderClient.h
+++ b/WebCore/loader/SubresourceLoaderClient.h
@@ -33,7 +33,7 @@ namespace WebCore {
 
 class AuthenticationChallenge;
 class ResourceError;
-struct ResourceRequest;
+class ResourceRequest;
 class ResourceResponse;
 class SubresourceLoader;
     
diff --git a/WebCore/loader/ThreadableLoader.h b/WebCore/loader/ThreadableLoader.h
index a52bfad..f41a774 100644
--- a/WebCore/loader/ThreadableLoader.h
+++ b/WebCore/loader/ThreadableLoader.h
@@ -38,7 +38,7 @@
 namespace WebCore {
 
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class ScriptExecutionContext;
     class ThreadableLoaderClient;
diff --git a/WebCore/loader/ThreadableLoaderClient.h b/WebCore/loader/ThreadableLoaderClient.h
index 93a8e86..b8a6584 100644
--- a/WebCore/loader/ThreadableLoaderClient.h
+++ b/WebCore/loader/ThreadableLoaderClient.h
@@ -36,7 +36,7 @@ namespace WebCore {
     class ResourceError;
     class ResourceResponse;
 
-    class ThreadableLoaderClient {
+    class ThreadableLoaderClient : public Noncopyable {
     public:
         virtual void didSendData(unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/) { }
 
diff --git a/WebCore/loader/WorkerThreadableLoader.h b/WebCore/loader/WorkerThreadableLoader.h
index 230c77d..86083f5 100644
--- a/WebCore/loader/WorkerThreadableLoader.h
+++ b/WebCore/loader/WorkerThreadableLoader.h
@@ -47,7 +47,7 @@
 namespace WebCore {
 
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class WorkerContext;
     class WorkerLoaderProxy;
     struct CrossThreadResourceResponseData;
@@ -94,7 +94,7 @@ namespace WebCore {
         //    thread do "ThreadableLoaderClientWrapper::ref" (automatically inside of the cross thread copy
         //    done in createCallbackTask), so the ThreadableLoaderClientWrapper instance is there until all
         //    tasks are executed.
-        class MainThreadBridge : ThreadableLoaderClient {
+        class MainThreadBridge : public ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
             MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
diff --git a/WebCore/loader/appcache/ApplicationCache.h b/WebCore/loader/appcache/ApplicationCache.h
index d1444c0..08e2dd3 100644
--- a/WebCore/loader/appcache/ApplicationCache.h
+++ b/WebCore/loader/appcache/ApplicationCache.h
@@ -42,7 +42,7 @@ class ApplicationCacheResource;
 class DocumentLoader;
 class KURL;
 
-struct ResourceRequest;
+class ResourceRequest;
 
 typedef Vector<std::pair<KURL, KURL> > FallbackURLVector;
 
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 1a223ce..7398ef4 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -622,7 +622,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
         ASSERT(newestManifest);
     
         if (!m_manifestResource || // The resource will be null if HTTP response was 304 Not Modified.
-            newestManifest->data()->size() == m_manifestResource->data()->size() && !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size())) {
+            (newestManifest->data()->size() == m_manifestResource->data()->size() && !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size()))) {
 
             m_completionType = NoUpdate;
             m_manifestResource = 0;
@@ -947,9 +947,9 @@ void ApplicationCacheGroup::scheduleReachedMaxAppCacheSizeCallback()
 
 class CallCacheListenerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<CallCacheListenerTask> create(PassRefPtr<DocumentLoader> loader, ApplicationCacheHost::EventID eventID)
+    static PassOwnPtr<CallCacheListenerTask> create(PassRefPtr<DocumentLoader> loader, ApplicationCacheHost::EventID eventID)
     {
-        return adoptRef(new CallCacheListenerTask(loader, eventID));
+        return new CallCacheListenerTask(loader, eventID);
     }
 
     virtual void performTask(ScriptExecutionContext* context)
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.h b/WebCore/loader/appcache/ApplicationCacheHost.h
index 236013d..9c355de 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -45,7 +45,7 @@ namespace WebCore {
     class KURL;
     class ResourceLoader;
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class SubstituteData;
 #if PLATFORM(CHROMIUM)
@@ -57,7 +57,7 @@ namespace WebCore {
     class ApplicationCacheStorage;
 #endif
 
-    class ApplicationCacheHost {
+    class ApplicationCacheHost : public Noncopyable {
     public:
         // The Status numeric values are specified in the HTML5 spec.
         enum Status {
diff --git a/WebCore/loader/appcache/ApplicationCacheStorage.h b/WebCore/loader/appcache/ApplicationCacheStorage.h
index 1348aa9..aaa5c9c 100644
--- a/WebCore/loader/appcache/ApplicationCacheStorage.h
+++ b/WebCore/loader/appcache/ApplicationCacheStorage.h
@@ -44,7 +44,7 @@ class KURL;
 template <class T>
 class StorageIDJournal;
 
-class ApplicationCacheStorage {
+class ApplicationCacheStorage : public Noncopyable {
 public:
     void setCacheDirectory(const String&);
     const String& cacheDirectory() const;
diff --git a/WebCore/loader/archive/ArchiveFactory.cpp b/WebCore/loader/archive/ArchiveFactory.cpp
index 1322dbb..d09b064 100644
--- a/WebCore/loader/archive/ArchiveFactory.cpp
+++ b/WebCore/loader/archive/ArchiveFactory.cpp
@@ -29,12 +29,13 @@
 #include "config.h"
 #include "ArchiveFactory.h"
 
-#if PLATFORM(CF)
-#include "LegacyWebArchive.h"
-#endif
 #include "MIMETypeRegistry.h"
 #include "PlatformString.h"
 
+#if PLATFORM(CF) && !PLATFORM(QT)
+#include "LegacyWebArchive.h"
+#endif
+
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
@@ -55,14 +56,14 @@ static ArchiveMIMETypesMap& archiveMIMETypes()
 {
     DEFINE_STATIC_LOCAL(ArchiveMIMETypesMap, mimeTypes, ());
     static bool initialized = false;
-    
+
     if (initialized)
         return mimeTypes;
-    
-#if PLATFORM(CF)
+
+#if PLATFORM(CF) && !PLATFORM(QT)
     mimeTypes.set("application/x-webarchive", archiveFactoryCreate<LegacyWebArchive>);
 #endif
-        
+
     initialized = true;
     return mimeTypes;
 }
diff --git a/WebCore/loader/loader.cpp b/WebCore/loader/loader.cpp
index eb606d8..c98a2f0 100644
--- a/WebCore/loader/loader.cpp
+++ b/WebCore/loader/loader.cpp
@@ -71,6 +71,27 @@ Loader::~Loader()
     ASSERT_NOT_REACHED();
 }
     
+static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource::Type type)
+{
+    switch (type) {
+    case CachedResource::CSSStyleSheet:
+#if ENABLE(XSLT)
+    case CachedResource::XSLStyleSheet:
+#endif
+#if ENABLE(XBL)
+    case CachedResource::XBL:
+#endif
+        return ResourceRequest::TargetIsStyleSheet;
+    case CachedResource::Script: 
+        return ResourceRequest::TargetIsScript;
+    case CachedResource::FontResource:
+        return ResourceRequest::TargetIsFontResource;
+    case CachedResource::ImageResource:
+        return ResourceRequest::TargetIsImage;
+    }
+    return ResourceRequest::TargetIsSubresource;
+}
+
 Loader::Priority Loader::determinePriority(const CachedResource* resource) const
 {
 #if REQUEST_MANAGEMENT_ENABLED
@@ -301,6 +322,7 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         requestsPending.removeFirst();
         
         ResourceRequest resourceRequest(request->cachedResource()->url());
+        resourceRequest.setTargetType(cachedResourceTypeToTargetType(request->cachedResource()->type()));
         
         if (!request->cachedResource()->accept().isEmpty())
             resourceRequest.setHTTPAccept(request->cachedResource()->accept());
@@ -377,7 +399,7 @@ void Loader::Host::didFinishLoading(SubresourceLoader* loader)
     docLoader->checkForPendingPreloads();
 
 #if REQUEST_DEBUG
-    KURL u(resource->url());
+    KURL u(ParsedURLString, resource->url());
     printf("HOST %s COUNT %d RECEIVED %s\n", u.host().latin1().data(), m_requestsLoading.size(), resource->url().latin1().data());
 #endif
     servePendingRequests();
diff --git a/WebCore/manual-tests/autocompletion-fire-onchange.html b/WebCore/manual-tests/autocompletion-fire-onchange.html
new file mode 100644
index 0000000..c6ba288
--- /dev/null
+++ b/WebCore/manual-tests/autocompletion-fire-onchange.html
@@ -0,0 +1,40 @@
+<html>
+<head>
+<script>
+// This test case is based on the test case http://data.ici-bas.fr/chromiumissue10879/.
+window.changed = false;
+function checkForChange()
+{
+    if (!location.search)
+        return true;
+        
+    if (!window.changed && document.getElementById("field").value != "")
+        log("FAIL");
+    else
+        log("PASS");
+    return false;
+}
+
+function log(msg)
+{
+    document.getElementById("log").appendChild(document.createTextNode(msg + "\n"));
+}
+</script>
+</head>
+<body>
+<p id="description">This test verifies that on autocompletion the 'onchange' event is fired.</p>
+<p>Steps to reproduce:</p>
+<ol>
+  <li>In the input field, type the word &quot;apple&quot; (without quotes). Then click the button Submit or hit the return/enter 
+  key on your keyboard</li>
+  <li>Once the page reloads, in the input field, type &quot;ap&quot; (without quotes) and let the browser autocomplete the word (or select 
+  &quot;apple&quot; from the autocompletion drop-down list contextual menu). Then click the button Submit or hit the return/enter 
+  key on your keyboard.</li>
+</ol>
+<form method="get" onsubmit="return checkForChange()">
+    <p><input type="text" name="field" id="field" value="" onchange="window.changed = true"/></p>
+    <p><input type="submit" value="Submit"/></p>
+</form>
+<pre id="log"></pre>
+</body>
+</html>
diff --git a/WebCore/manual-tests/inspector/bp-in-named-eval-after-reload.html b/WebCore/manual-tests/inspector/bp-in-named-eval-after-reload.html
new file mode 100644
index 0000000..4612cd6
--- /dev/null
+++ b/WebCore/manual-tests/inspector/bp-in-named-eval-after-reload.html
@@ -0,0 +1,65 @@
+<style>code{background-color: #ffc;}</style>
+<p><b>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=31375">Bug 31375</a> - Web Inspector: breakpoints in named evals are not restored after a reload</b>
+
+<ul>
+<li><p>open this page with Web Inspector
+<li><p>switch to the Scripts panel, enabling debug if required
+<li><p>the available scripts in the select element should be:
+<ul>
+<li>(program): f1.js
+<li>(program): f2.js
+<li>bp-in-named-eval-after-reload.html
+</ul>
+<li><p>In <code>(program) f1.js</code>, set a breakpoint on the first
+executable line of the function <code>f1()</code>, the invocation of <code>doNothing()</code>.
+<li><p>In <code>(program) f2.js</code>, set a breakpoint on the first
+executable line of the function <code>f2()</code>, the invocation of <code>doNothing()</code>.
+<li><p>click this button: <input id=button type=button value="click me">
+<li><p>debugger should stop in the <code>f1()</code> function.
+<li><p>resume the debugger
+<li><p>debugger should stop in the <code>f2()</code> function (the function in <code>(program) f2.js</code>)
+<li><p>resume the debugger
+<li><p>switch to the web page, reload the web page, switch back to web inspector
+<li><p>in the breakpoints sidebar panel, click on the two breakpoints listed
+and the source for those functions should be shown in the source panel, and
+the previous breakpoint markers should be visible
+<li><p>click the "click me" button above, again
+<li><p>debugger should stop in the <code>f1()</code> function.
+<li><p>resume the debugger
+<li><p>debugger should stop in the <code>f2()</code> function.
+<li><p>resume the debugger
+</ul>
+
+<p>Note that without the fix in <a href="https://bugs.webkit.org/show_bug.cgi?id=31375">Bug 31375</a>,
+the breakpoints won't work after reloading the page.
+
+<script>
+
+function doNothing() { /* allows multi-line functions, easier to debug */ };
+
+eval([
+    "function f1() {",
+    "   doNothing();",
+    "   console.log(new Date() + ':  f1() called');",
+    "}",
+    "//@sourceURL=f1.js"
+].join("\n"));
+
+f2 = Function([
+    "",
+    "   doNothing();",
+    "   console.log(new Date() + ':  f2() called');",
+    "//@sourceURL=f2.js"
+].join("\n"));
+
+var button = document.getElementById("button");
+
+button.addEventListener("click", clickHandler, false);
+
+function clickHandler() {
+    f1();
+    f2();
+}
+
+</script>
+<!-- End -->
diff --git a/WebCore/manual-tests/inspector/debugger-shortcuts-with-console-opened.html b/WebCore/manual-tests/inspector/debugger-shortcuts-with-console-opened.html
new file mode 100644
index 0000000..df089d5
--- /dev/null
+++ b/WebCore/manual-tests/inspector/debugger-shortcuts-with-console-opened.html
@@ -0,0 +1,16 @@
+<script>
+function testFunction()
+{
+    showAlert();
+}
+
+function showAlert()
+{
+    alert("Test completed.");
+}
+</script>
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=31252">Bug 31252: Web Inspector: Debugger shortcuts (F8, F10, F11) have no effect if the Console view is open</a>.</p>
+<p>To test, open the Inspector and start a debugging session. Open the Console view (press Esc or click the "Show console" button in the status bar) and make sure it is focused (the cursor is blinking in the text prompt.)
+Set a breakpoint inside testFunction() (on the showAlert() call) and press F8. Now click the Test button in the page. The execution should stop on an HTML line containing <b>onclick="testFunction()"</b>. Press F8. The execution should stop on the breakpoint.
+Press F11, F10, F11 sequentially. You should see the "Test completed." alert dialog ONLY after the last keypress.</p>
+<button onclick="testFunction()">Test</button><br><br>
diff --git a/WebCore/manual-tests/inspector/hidden-evals.html b/WebCore/manual-tests/inspector/hidden-evals.html
new file mode 100644
index 0000000..c507bcd
--- /dev/null
+++ b/WebCore/manual-tests/inspector/hidden-evals.html
@@ -0,0 +1,118 @@
+
+<p><b>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=30212">Bug 30212</a> - Each JS execution in console adds extra item into "scripts" combo</b>
+
+<p>The following manual test creates functions via <tt>eval()</tt> and the 
+<tt>Function()</tt> constructor, some functions are named using the 
+<code>//@sourceURL=</code> directive, some aren't.  Some contain
+<tt>debugger</tt> commands, some don't.
+
+<p>The functions named <tt>f_named_X</tt> are 'named' via the 
+<code>//@sourceURL=</code> directive, the ones named <tt>f_unnamed_X</tt>
+are not.  The 'named' functions should show up in the Scripts select element used 
+to select a resource/script to view, the 'unnamed' ones should not.
+
+<ul>
+<li><p>open this page with Web Inspector
+<li><p>switch to the Scripts panel, enabling debug if required
+<li><p>the available scripts in the select element should be:
+<ul>
+<li>(program): f_named_1.eval
+<li>(program): f_named_2.eval
+<li>(program): f_named_3.eval
+<li>hidden-evals.html
+</ul>
+<li><p>click this button: <input id=button type=button value="click me">
+<li><p>debugger should stop in the <code>clickHandler</code> function
+<li><p>at this point, start stepping <b>into</b> the code
+<li><p>you should be able to step into functions <code>f_unnamed_1()</code>
+and <code>f_unnamed_2()</code>.  There are no resource/scripts in the 
+select element that contain these functions, until you actually are paused 
+in them.  At that point, entries for these functions will be in the select element,
+named: "(program)".  After pausing in both functions, there will be two "(program)"
+entries.
+<li><p>you should be able to use the next/prev buttons (to the left of the select element)
+to switch to other resources/scripts that have been opened, including the ones
+containing these functions
+<li><p>you should be able to click on the functions that exist in the 'hidden'
+resources from the Call Stack, and be shown the source; click around the
+stack trace entries to verify
+<li><p>rather than stepping into the <code>f_named_3()</code> call, press the
+resume button
+<li><p>the debugger should stop in <code>f_named_3()</code> because of the
+<code>debugger</code> command
+<li><p>rather than stepping into the <code>f_unnamed_3()</code> call, press the
+resume button
+<li><p>the debugger should stop in <code>f_unnamed_3()</code> because of the
+<code>debugger</code> command.  At this point, a third "(program)" entry for
+this function is added to the select element.
+</ul>
+
+<script>
+
+function doNothing() { /* allows multi-line functions, easier to debug */ };
+
+eval([
+    "function f_named_1() {",
+    "   doNothing();",
+    "   return 'named_1';",
+    "}",
+    "//@sourceURL=f_named_1.eval"
+].join("\n"));
+
+eval([
+    "function f_unnamed_1() {",
+    "   doNothing();",
+    "   return 'unnamed_1';",
+    "}"
+].join("\n"));
+
+f_named_2 = Function([
+    "",
+    "   doNothing();",
+    "   return 'named_2';",
+    "//@sourceURL=f_named_2.eval"
+].join("\n"));
+
+f_unnamed_2 = Function([
+    "",
+    "   doNothing();",
+    "   return 'unnamed_2';"
+].join("\n"));
+
+f_named_3 = Function([
+    "",
+    "   debugger;",
+    "   doNothing();",
+    "   return 'named_3';",
+    "//@sourceURL=f_named_3.eval"
+].join("\n"));
+
+f_unnamed_3 = Function([
+    "",
+    "   debugger;",
+    "   doNothing();",
+    "   return 'unnamed_3';"
+].join("\n"));
+
+var button = document.getElementById("button");
+
+button.addEventListener("click", clickHandler, false);
+
+function clickHandler() {
+    debugger;
+    f_named_1();
+    f_unnamed_1();
+    f_named_2();
+    f_unnamed_2();
+    
+    // press "resume" at this point
+    console.log("press resume before calling f_named_3()");
+    f_named_3();
+    
+    // press "resume" at this point
+    console.log("press resume before calling f_unnamed_3()");
+    f_unnamed_3();
+}
+
+</script>
+<!-- End -->
diff --git a/WebCore/manual-tests/inspector/remember-last-script.html b/WebCore/manual-tests/inspector/remember-last-script.html
new file mode 100644
index 0000000..52e7f02
--- /dev/null
+++ b/WebCore/manual-tests/inspector/remember-last-script.html
@@ -0,0 +1,42 @@
+<style>code{background-color: #ffc;}</style>
+<p><b>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=27552">Bug 27552</a> - remember last script displayed in Scripts panel</b>
+
+<ul>
+<li><p>open this page with Web Inspector, switch to the <b>Scripts</b> panel, enabling debug if required
+<li><p>the available scripts in the select element should be:
+    <ul>
+        <li><b>(program): f1.js</b>
+        <li><b>remember-last-script.html</b>
+    </ul>
+<li><p>select <b>(program): f1.js</b> so the source is available
+<li><p>switch to the <b>Resources</b> panel
+<li><p>close Web Inspector
+<li><p>Repeat the following several times.  Each time, <b>(program): f1.js</b>
+should be the selected script:
+    <ul>
+    <li>open Web Inspector, switch to the <b>Scripts</b> panel, then close Web Inspector
+    </ul>
+<li><p>open Web Inspector, switch to the <b>Scripts</b> panel
+<li><p>select <b>remember-last-script.html</b> so the source is available
+<li><p>Repeat the following several times.  Each time, <b>remember-last-script.html</b>
+should be the selected script:
+    <ul>
+    <li>open Web Inspector, switch to the <b>Scripts</b> panel, then close Web Inspector
+    </ul>
+</ul>    
+
+<script>
+
+f1 = Function([
+    "",
+    "   doNothing();",
+    "//@sourceURL=f1.js"
+].join("\n"));
+
+function doNothing() { /* allows multi-line functions, easier to debug */ };
+
+doNothing();
+f1();
+
+</script>
+<!-- End -->
diff --git a/WebCore/manual-tests/plugins/windowed.html b/WebCore/manual-tests/plugins/windowed.html
index 4020408..808a0ad 100644
--- a/WebCore/manual-tests/plugins/windowed.html
+++ b/WebCore/manual-tests/plugins/windowed.html
@@ -22,6 +22,15 @@
     }
 </style>
 <script>
+    function testVisibility() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        if (flashPlugin.style.display == 'none') {
+            flashPlugin.style.display = 'block';
+        } else {
+            flashPlugin.style.display = 'none';
+        }
+    }
+
     function testResize() {
         var flashPlugin = document.getElementById('flashPlugin');
         flashPlugin.width = flashPlugin.width == "200" ? "100" : "200";
@@ -66,6 +75,9 @@
 
     <div style="clear:both"/>
 
+    <input type="checkbox" name="visibilityCheckBox"> Verify if the flash toggles visibility
+            <input type="button" id="visibilityButton" value="Test Visibility" onClick="testVisibility()"/><br/>
+
     <input type="checkbox" name="resizeCheckBox"> Verify if the flash resizes when element is resized
             <input type="button" id="resizeButton" value="Test Resize" onClick="testResize()"/><br/>
 
diff --git a/WebCore/manual-tests/plugins/windowless.html b/WebCore/manual-tests/plugins/windowless.html
index b553526..1020abb 100644
--- a/WebCore/manual-tests/plugins/windowless.html
+++ b/WebCore/manual-tests/plugins/windowless.html
@@ -22,6 +22,15 @@
     }
 </style>
 <script>
+    function testVisibility() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        if (flashPlugin.style.display == 'none') {
+            flashPlugin.style.display = 'block';
+        } else {
+            flashPlugin.style.display = 'none';
+        }
+    }
+
     function testResize() {
         var flashPlugin = document.getElementById('flashPlugin');
         flashPlugin.width = flashPlugin.width == "200" ? "100" : "200";
@@ -67,6 +76,9 @@
 
     <div style="clear:both"/>
 
+    <input type="checkbox" name="visibilityCheckBox"> Verify if the flash toggles visibility
+            <input type="button" id="visibilityButton" value="Test Visibility" onClick="testVisibility()"/><br/>
+
     <input type="checkbox" name="resizeCheckBox"> Verify if the flash resizes when element is resized
             <input type="button" id="resizeButton" value="Test Resize" onClick="testResize()"/><br/>
 
diff --git a/WebCore/manual-tests/qt/qtplugin.html b/WebCore/manual-tests/qt/qtplugin.html
index b2dbf3c..631ce63 100644
--- a/WebCore/manual-tests/qt/qtplugin.html
+++ b/WebCore/manual-tests/qt/qtplugin.html
@@ -1,14 +1,24 @@
 <html>
 <body>
 Image:<br/>
- <img src="http://labs.trolltech.com/skins/trolltech_labs/categories/internet.png" width="80" height="80"/>
+ <img src="qrc:/webkit/inspector/Images/largerResourcesButtonGlyph.png" width="80" height="80"/>
  <br/>
+
+<!-- visible progressbar -->
+<div>
 QT progress bar:
-<br/>
-<object type="application/x-qt-plugin" classid="QProgressBar" name="progressbar" height=30></object>
+<object type="application/x-qt-plugin" classid="QProgressBar" name="progressbar1" height=30></object>
+</div>
+
+<!-- should not be visible -->
+<div style="visibility: hidden;">
+You should not see this:
+<object type="application/x-qt-plugin" classid="QProgressBar" name="progressbar2" height=30></object>
+</div>
+
 <script>
 function display(){
- if (++document.progressbar.value != 100)
+ if (++document.progressbar1.value != 100)
 setTimeout("display()", 50)
 }
 display();
diff --git a/WebCore/manual-tests/user-drag-with-decorations.html b/WebCore/manual-tests/user-drag-with-decorations.html
new file mode 100644
index 0000000..1878d11
--- /dev/null
+++ b/WebCore/manual-tests/user-drag-with-decorations.html
@@ -0,0 +1,7 @@
+This tests that we don't include overflow decorations from our ancestor nodes in the drag image for -webkit-user-drag: element.  To perform this test drag the green square below.  The drag image should not contain any parts of the scrollbar graphics visible on the page.
+
+<div style="height:100px; width:100px;overflow:scroll;">
+    <div style="-webkit-user-drag:element;position:absolute; background: rgba(0,128,0,0.5); height:100px; width:100px;">
+        Drag me!
+    </div>
+</div>
\ No newline at end of file
diff --git a/WebCore/manual-tests/webgl/SpinningBox.html b/WebCore/manual-tests/webgl/SpinningBox.html
index 203d7bd..e68711c 100644
--- a/WebCore/manual-tests/webgl/SpinningBox.html
+++ b/WebCore/manual-tests/webgl/SpinningBox.html
@@ -45,7 +45,7 @@
             gl.box = makeBox(gl);
 
             // color array
-            var colors = new CanvasUnsignedByteArray(
+            var colors = new WebGLUnsignedByteArray(
                 [  0, 0, 1, 1,   0, 0, 1, 1,   0, 0, 1, 1,   0, 0, 1, 1,     // v0-v1-v2-v3 front
                    1, 0, 0, 1,   1, 0, 0, 1,   1, 0, 0, 1,   1, 0, 0, 1,     // v0-v3-v4-v5 right
                    0, 1, 0, 1,   0, 1, 0, 1,   0, 1, 0, 1,   0, 1, 0, 1,     // v0-v5-v6-v1 top
diff --git a/WebCore/manual-tests/webgl/resources/CanvasMatrix.js b/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
index f35727f..90fcb3f 100644
--- a/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
+++ b/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
@@ -33,7 +33,7 @@
         void load(in CanvasMatrix4 matrix);                 // copy the values from the passed matrix
         void load(in sequence<float> array);                // copy 16 floats into the matrix
         sequence<float> getAsArray();                       // return the matrix as an array of 16 floats
-        CanvasFloatArray getAsCanvasFloatArray();           // return the matrix as a CanvasFloatArray with 16 values
+        WebGLFloatArray getAsCanvasFloatArray();           // return the matrix as a WebGLFloatArray with 16 values
         void makeIdentity();                                // replace the matrix with identity
         void transpose();                                   // replace the matrix with its transpose
         void invert();                                      // replace the matrix with its inverse
@@ -141,7 +141,7 @@ CanvasMatrix4.prototype.getAsArray = function()
 
 CanvasMatrix4.prototype.getAsCanvasFloatArray = function()
 {
-    return new CanvasFloatArray(this.getAsArray());
+    return new WebGLFloatArray(this.getAsArray());
 }
 
 CanvasMatrix4.prototype.makeIdentity = function()
diff --git a/WebCore/manual-tests/webgl/resources/utils3d.js b/WebCore/manual-tests/webgl/resources/utils3d.js
index 0ffd7c4..58f520f 100644
--- a/WebCore/manual-tests/webgl/resources/utils3d.js
+++ b/WebCore/manual-tests/webgl/resources/utils3d.js
@@ -2,7 +2,7 @@
 // initWebGL
 //
 // Initialize the Canvas element with the passed name as a WebGL object and return the
-// CanvasRenderingContext3D. 
+// WebGLRenderingContext. 
 //
 // Load shaders with the passed names and create a program with them. Return this program 
 // in the 'program' property of the returned context.
@@ -43,7 +43,7 @@ function initWebGL(canvasName, vshader, fshader, attribs, clearColor, clearDepth
     gl.linkProgram(gl.program);
 
     // Check the link status
-    var linked = gl.getProgrami(gl.program, gl.LINK_STATUS);
+    var linked = gl.getProgramParameter(gl.program, gl.LINK_STATUS);
     if (!linked) {
         // something went wrong with the link
         var error = gl.getProgramInfoLog (gl.program);
@@ -72,7 +72,7 @@ function initWebGL(canvasName, vshader, fshader, attribs, clearColor, clearDepth
 // loadShader
 //
 // 'shaderId' is the id of a <script> element containing the shader source string.
-// Load this shader and return the CanvasShader object corresponding to it.
+// Load this shader and return the WebGLShader object corresponding to it.
 //
 function loadShader(ctx, shaderId)
 {
@@ -105,7 +105,7 @@ function loadShader(ctx, shaderId)
     ctx.compileShader(shader);
 
     // Check the compile status
-    var compiled = ctx.getShaderi(shader, ctx.COMPILE_STATUS);
+    var compiled = ctx.getShaderParameter(shader, ctx.COMPILE_STATUS);
     if (!compiled) {
         // Something went wrong during compilation; get the error
         var error = ctx.getShaderInfoLog(shader);
@@ -123,10 +123,10 @@ function loadShader(ctx, shaderId)
 // Create a box with vertices, normals and texCoords. Create VBOs for each as well as the index array.
 // Return an object with the following properties:
 //
-//  normalObject        CanvasBuffer object for normals
-//  texCoordObject      CanvasBuffer object for texCoords
-//  vertexObject        CanvasBuffer object for vertices
-//  indexObject         CanvasBuffer object for indices
+//  normalObject        WebGLBuffer object for normals
+//  texCoordObject      WebGLBuffer object for texCoords
+//  vertexObject        WebGLBuffer object for vertices
+//  indexObject         WebGLBuffer object for indices
 //  numIndices          The number of indices in the indexObject
 // 
 function makeBox(ctx)
@@ -141,7 +141,7 @@ function makeBox(ctx)
     //  v2------v3
     //
     // vertex coords array
-    var vertices = new CanvasFloatArray(
+    var vertices = new WebGLFloatArray(
         [  1, 1, 1,  -1, 1, 1,  -1,-1, 1,   1,-1, 1,    // v0-v1-v2-v3 front
            1, 1, 1,   1,-1, 1,   1,-1,-1,   1, 1,-1,    // v0-v3-v4-v5 right
            1, 1, 1,   1, 1,-1,  -1, 1,-1,  -1, 1, 1,    // v0-v5-v6-v1 top
@@ -151,7 +151,7 @@ function makeBox(ctx)
     );
 
     // normal array
-    var normals = new CanvasFloatArray(
+    var normals = new WebGLFloatArray(
         [  0, 0, 1,   0, 0, 1,   0, 0, 1,   0, 0, 1,     // v0-v1-v2-v3 front
            1, 0, 0,   1, 0, 0,   1, 0, 0,   1, 0, 0,     // v0-v3-v4-v5 right
            0, 1, 0,   0, 1, 0,   0, 1, 0,   0, 1, 0,     // v0-v5-v6-v1 top
@@ -162,7 +162,7 @@ function makeBox(ctx)
 
 
     // texCoord array
-    var texCoords = new CanvasFloatArray(
+    var texCoords = new WebGLFloatArray(
         [  1, 1,   0, 1,   0, 0,   1, 0,    // v0-v1-v2-v3 front
            0, 1,   0, 0,   1, 0,   1, 1,    // v0-v3-v4-v5 right
            1, 0,   1, 1,   0, 1,   0, 0,    // v0-v5-v6-v1 top
@@ -172,7 +172,7 @@ function makeBox(ctx)
        );
 
     // index array
-    var indices = new CanvasUnsignedByteArray(
+    var indices = new WebGLUnsignedByteArray(
         [  0, 1, 2,   0, 2, 3,    // front
            4, 5, 6,   4, 6, 7,    // right
            8, 9,10,   8,10,11,    // top
@@ -214,10 +214,10 @@ function makeBox(ctx)
 // Sphere has vertices, normals and texCoords. Create VBOs for each as well as the index array.
 // Return an object with the following properties:
 //
-//  normalObject        CanvasBuffer object for normals
-//  texCoordObject      CanvasBuffer object for texCoords
-//  vertexObject        CanvasBuffer object for vertices
-//  indexObject         CanvasBuffer object for indices
+//  normalObject        WebGLBuffer object for normals
+//  texCoordObject      WebGLBuffer object for texCoords
+//  vertexObject        WebGLBuffer object for vertices
+//  indexObject         WebGLBuffer object for indices
 //  numIndices          The number of indices in the indexObject
 // 
 function makeSphere(ctx, radius, lats, longs)
@@ -272,20 +272,20 @@ function makeSphere(ctx, radius, lats, longs)
     
     retval.normalObject = ctx.createBuffer();
     ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.normalObject);
-    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(normalData), ctx.STATIC_DRAW);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new WebGLFloatArray(normalData), ctx.STATIC_DRAW);
 
     retval.texCoordObject = ctx.createBuffer();
     ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.texCoordObject);
-    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(texCoordData), ctx.STATIC_DRAW);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new WebGLFloatArray(texCoordData), ctx.STATIC_DRAW);
 
     retval.vertexObject = ctx.createBuffer();
     ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.vertexObject);
-    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(geometryData), ctx.STATIC_DRAW);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new WebGLFloatArray(geometryData), ctx.STATIC_DRAW);
     
     retval.numIndices = indexData.length;
     retval.indexObject = ctx.createBuffer();
     ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, retval.indexObject);
-    ctx.bufferData(ctx.ELEMENT_ARRAY_BUFFER, new CanvasUnsignedShortArray(indexData), ctx.STREAM_DRAW);
+    ctx.bufferData(ctx.ELEMENT_ARRAY_BUFFER, new WebGLUnsignedShortArray(indexData), ctx.STREAM_DRAW);
     
     return retval;
 }
@@ -297,10 +297,10 @@ function makeSphere(ctx, radius, lats, longs)
 // When the object load is complete, the 'loaded' property becomes true and the following 
 // properties are set:
 //
-//  normalObject        CanvasBuffer object for normals
-//  texCoordObject      CanvasBuffer object for texCoords
-//  vertexObject        CanvasBuffer object for vertices
-//  indexObject         CanvasBuffer object for indices
+//  normalObject        WebGLBuffer object for normals
+//  texCoordObject      WebGLBuffer object for texCoords
+//  vertexObject        WebGLBuffer object for vertices
+//  indexObject         WebGLBuffer object for indices
 //  numIndices          The number of indices in the indexObject
 //  
 function loadObj(ctx, url)
@@ -438,20 +438,20 @@ function doLoadObj(obj, text)
     // set the VBOs
     obj.normalObject = obj.ctx.createBuffer();
     obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.normalObject);
-    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(normalArray), obj.ctx.STATIC_DRAW);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new WebGLFloatArray(normalArray), obj.ctx.STATIC_DRAW);
 
     obj.texCoordObject = obj.ctx.createBuffer();
     obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.texCoordObject);
-    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(textureArray), obj.ctx.STATIC_DRAW);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new WebGLFloatArray(textureArray), obj.ctx.STATIC_DRAW);
 
     obj.vertexObject = obj.ctx.createBuffer();
     obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.vertexObject);
-    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(vertexArray), obj.ctx.STATIC_DRAW);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new WebGLFloatArray(vertexArray), obj.ctx.STATIC_DRAW);
     
     obj.numIndices = indexArray.length;
     obj.indexObject = obj.ctx.createBuffer();
     obj.ctx.bindBuffer(obj.ctx.ELEMENT_ARRAY_BUFFER, obj.indexObject);
-    obj.ctx.bufferData(obj.ctx.ELEMENT_ARRAY_BUFFER, new CanvasUnsignedShortArray(indexArray), obj.ctx.STREAM_DRAW);
+    obj.ctx.bufferData(obj.ctx.ELEMENT_ARRAY_BUFFER, new WebGLUnsignedShortArray(indexArray), obj.ctx.STREAM_DRAW);
     
     obj.loaded = true;
 }
@@ -459,7 +459,7 @@ function doLoadObj(obj, text)
 //
 // loadImageTexture
 //
-// Load the image at the passed url, place it in a new CanvasTexture object and return the CanvasTexture.
+// Load the image at the passed url, place it in a new WebGLTexture object and return the WebGLTexture.
 //
 function loadImageTexture(ctx, url)
 {
@@ -528,4 +528,3 @@ Framerate.prototype.snapshot = function()
         this.renderTime = newTime;
     }
 }
-
diff --git a/WebCore/notifications/Notification.cpp b/WebCore/notifications/Notification.cpp
index 8dd168f..ecb5799 100644
--- a/WebCore/notifications/Notification.cpp
+++ b/WebCore/notifications/Notification.cpp
@@ -48,6 +48,7 @@ Notification::Notification(const String& url, ScriptExecutionContext* context, E
     , m_isShowing(false)
     , m_presenter(provider)
 {
+    ASSERT(m_presenter);
     if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
@@ -67,6 +68,7 @@ Notification::Notification(const NotificationContents& contents, ScriptExecution
     , m_isShowing(false)
     , m_presenter(provider)
 {
+    ASSERT(m_presenter);
     if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
diff --git a/WebCore/notifications/NotificationCenter.cpp b/WebCore/notifications/NotificationCenter.cpp
index 69b0075..45d29cf 100644
--- a/WebCore/notifications/NotificationCenter.cpp
+++ b/WebCore/notifications/NotificationCenter.cpp
@@ -40,20 +40,6 @@
 
 namespace WebCore {
 
-#if USE(V8)
-static bool notificationCenterAvailable = false;
-
-void NotificationCenter::setIsAvailable(bool available)
-{
-    notificationCenterAvailable = available;
-}
-
-bool NotificationCenter::isAvailable()
-{
-    return notificationCenterAvailable;
-}
-#endif
-
 NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter) 
     : ActiveDOMObject(context, this)
     , m_scriptExecutionContext(context)
@@ -61,11 +47,15 @@ NotificationCenter::NotificationCenter(ScriptExecutionContext* context, Notifica
 
 int NotificationCenter::checkPermission() 
 {
+    if (!presenter())
+        return NotificationPresenter::PermissionDenied;
     return m_notificationPresenter->checkPermission(m_scriptExecutionContext->securityOrigin());
 }
 
 void NotificationCenter::requestPermission(PassRefPtr<VoidCallback> callback)
 {
+    if (!presenter())
+        return;
     m_notificationPresenter->requestPermission(m_scriptExecutionContext->securityOrigin(), callback);
 }
 
diff --git a/WebCore/notifications/NotificationCenter.h b/WebCore/notifications/NotificationCenter.h
index 1084442..ae3dc02 100644
--- a/WebCore/notifications/NotificationCenter.h
+++ b/WebCore/notifications/NotificationCenter.h
@@ -47,19 +47,23 @@ namespace WebCore {
 
     class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject { 
     public:
-#if USE(V8)
-        static void setIsAvailable(bool);
-        static bool isAvailable();
-#endif
         static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
 
         Notification* createHTMLNotification(const String& URI, ExceptionCode& ec)
         {
+            if (!presenter()) {
+                ec = INVALID_STATE_ERR;
+                return 0;
+            }
             return Notification::create(KURL(ParsedURLString, URI), context(), ec, presenter());
         }
 
         Notification* createNotification(const String& iconURI, const String& title, const String& body, ExceptionCode& ec)
         {
+            if (!presenter()) {
+                ec = INVALID_STATE_ERR;
+                return 0;
+            }
             NotificationContents contents(iconURI, title, body);
             return Notification::create(contents, context(), ec, presenter());
         }
@@ -70,6 +74,8 @@ namespace WebCore {
         int checkPermission();
         void requestPermission(PassRefPtr<VoidCallback> callback);
 
+        void disconnectFrame() { m_notificationPresenter = 0; }
+
     private:
         NotificationCenter(ScriptExecutionContext*, NotificationPresenter*);
 
diff --git a/WebCore/page/Chrome.cpp b/WebCore/page/Chrome.cpp
index 7e14b3e..0b85535 100644
--- a/WebCore/page/Chrome.cpp
+++ b/WebCore/page/Chrome.cpp
@@ -154,6 +154,11 @@ void Chrome::takeFocus(FocusDirection direction) const
     m_client->takeFocus(direction);
 }
 
+void Chrome::focusedNodeChanged(Node* node) const
+{
+    m_client->focusedNodeChanged(node);
+}
+
 Page* Chrome::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features) const
 {
     Page* newPage = m_client->createWindow(frame, request, features);
@@ -309,6 +314,16 @@ bool Chrome::shouldInterruptJavaScript()
     return m_client->shouldInterruptJavaScript();
 }
 
+void Chrome::registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title)
+{
+    m_client->registerProtocolHandler(scheme, baseURL, url, title);
+}
+
+void Chrome::registerContentHandler(const String& mimeType, const String& baseURL, const String& url, const String& title)
+{
+    m_client->registerContentHandler(mimeType,  baseURL, url,  title);
+}
+
 IntRect Chrome::windowResizerRect() const
 {
     return m_client->windowResizerRect();
@@ -399,11 +414,6 @@ void Chrome::print(Frame* frame)
 
 void Chrome::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
-    // Defer loads in case the client method runs a new event loop that would
-    // otherwise cause the load to continue while we're in the middle of executing JavaScript.
-    PageGroupLoadDeferrer deferrer(m_page, true);
-
-    ASSERT(frame);
     m_client->requestGeolocationPermissionForFrame(frame, geolocation);
 }
 
diff --git a/WebCore/page/Chrome.h b/WebCore/page/Chrome.h
index c562f33..398548f 100644
--- a/WebCore/page/Chrome.h
+++ b/WebCore/page/Chrome.h
@@ -42,6 +42,7 @@ namespace WebCore {
     class Geolocation;
     class HitTestResult;
     class IntRect;
+    class Node;
     class Page;
     class String;
 #if ENABLE(NOTIFICATIONS)
@@ -86,6 +87,8 @@ namespace WebCore {
         bool canTakeFocus(FocusDirection) const;
         void takeFocus(FocusDirection) const;
 
+        void focusedNodeChanged(Node*) const;
+
         Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&) const;
         void show() const;
 
@@ -118,6 +121,9 @@ namespace WebCore {
         void setStatusbarText(Frame*, const String&);
         bool shouldInterruptJavaScript();
 
+        void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
+        void registerContentHandler(const String& mimeType, const String& baseURL, const String& url, const String& title);
+
         IntRect windowResizerRect() const;
 
         void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
@@ -132,7 +138,7 @@ namespace WebCore {
 
         bool setCursor(PlatformCursorHandle);
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
         void focusNSView(NSView*);
 #endif
 
diff --git a/WebCore/page/ChromeClient.h b/WebCore/page/ChromeClient.h
index 194f855..117953c 100644
--- a/WebCore/page/ChromeClient.h
+++ b/WebCore/page/ChromeClient.h
@@ -87,6 +87,8 @@ namespace WebCore {
         virtual bool canTakeFocus(FocusDirection) = 0;
         virtual void takeFocus(FocusDirection) = 0;
 
+        virtual void focusedNodeChanged(Node*) = 0;
+
         // The Frame pointer provides the ChromeClient with context about which
         // Frame wants to create the new Page.  Also, the newly created window
         // should not be shown to the user until the ChromeClient of the newly
@@ -125,6 +127,9 @@ namespace WebCore {
         virtual bool shouldInterruptJavaScript() = 0;
         virtual bool tabsToLinks() const = 0;
 
+        virtual void registerProtocolHandler(const String&, const String&, const String&, const String&) { }
+        virtual void registerContentHandler(const String&, const String&, const String&, const String&) { }
+
         virtual IntRect windowResizerRect() const = 0;
 
         // Methods used by HostWindow.
diff --git a/WebCore/page/Console.cpp b/WebCore/page/Console.cpp
index 7d0f697..b1b091a 100644
--- a/WebCore/page/Console.cpp
+++ b/WebCore/page/Console.cpp
@@ -191,7 +191,7 @@ void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack*
 
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i) {
         String argAsString;
-        if (lastCaller.argumentAt(i).getString(argAsString))
+        if (lastCaller.argumentAt(i).getString(callStack->state(), argAsString))
             printf(" %s", argAsString.utf8().data());
     }
     printf("\n");
@@ -270,6 +270,23 @@ void Console::count(ScriptCallStack* callStack)
 #endif
 }
 
+void Console::markTimeline(ScriptCallStack* callStack)
+{
+#if ENABLE(INSPECTOR)
+    Page* page = this->page();
+    if (!page)
+        return;
+
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+    String message;
+    getFirstArgumentAsString(callStack->state(), lastCaller, message);
+
+    page->inspectorController()->markTimeline(message);
+#else
+    UNUSED_PARAM(callStack);
+#endif
+}
+
 #if ENABLE(WML)
 String Console::lastWMLErrorMessage() const
 {
diff --git a/WebCore/page/Console.h b/WebCore/page/Console.h
index 1b93a4a..ea3a161 100644
--- a/WebCore/page/Console.h
+++ b/WebCore/page/Console.h
@@ -95,6 +95,7 @@ namespace WebCore {
         void trace(ScriptCallStack*);
         void assertCondition(bool condition, ScriptCallStack*);
         void count(ScriptCallStack*);
+        void markTimeline(ScriptCallStack*);
 #if ENABLE(WML)
         String lastWMLErrorMessage() const;
 #endif
diff --git a/WebCore/page/Console.idl b/WebCore/page/Console.idl
index 0e9f3dc..a31b605 100644
--- a/WebCore/page/Console.idl
+++ b/WebCore/page/Console.idl
@@ -44,14 +44,15 @@ module window {
         [CustomArgumentHandling] void trace();
         [CustomArgumentHandling, ImplementationFunction=assertCondition] void assert(in boolean condition);
         [CustomArgumentHandling] void count();
+        [CustomArgumentHandling] void markTimeline();
 
 #if defined(ENABLE_WML) && ENABLE_WML
         [DontEnum] DOMString lastWMLErrorMessage();
 #endif
 
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-        [CustomArgumentHandling] void profile(in [ConvertUndefinedOrNullToNullString] DOMString title);
-        [CustomArgumentHandling] void profileEnd(in [ConvertUndefinedOrNullToNullString] DOMString title);
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER || defined(V8_BINDING) && V8_BINDING
+        [Custom] void profile(in [ConvertUndefinedOrNullToNullString] DOMString title);
+        [Custom] void profileEnd(in [ConvertUndefinedOrNullToNullString] DOMString title);
 #endif
 
         void time(in [ConvertUndefinedOrNullToNullString] DOMString title);
diff --git a/WebCore/page/ContextMenuController.cpp b/WebCore/page/ContextMenuController.cpp
index 7d773ca..726dee9 100644
--- a/WebCore/page/ContextMenuController.cpp
+++ b/WebCore/page/ContextMenuController.cpp
@@ -31,6 +31,7 @@
 #include "Chrome.h"
 #include "ContextMenu.h"
 #include "ContextMenuClient.h"
+#include "ContextMenuSelectionHandler.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "DocumentLoader.h"
@@ -66,6 +67,7 @@ ContextMenuController::ContextMenuController(Page* page, ContextMenuClient* clie
     : m_page(page)
     , m_client(client)
     , m_contextMenu(0)
+    , m_selectionHandler(0)
 {
     ASSERT_ARG(page, page);
     ASSERT_ARG(client, client);
@@ -79,13 +81,40 @@ ContextMenuController::~ContextMenuController()
 void ContextMenuController::clearContextMenu()
 {
     m_contextMenu.set(0);
+    if (m_selectionHandler)
+        m_selectionHandler->contextMenuCleared();
+    m_selectionHandler = 0;
 }
 
 void ContextMenuController::handleContextMenuEvent(Event* event)
 {
-    ASSERT(event->type() == eventNames().contextmenuEvent);
-    if (!event->isMouseEvent())
+    m_contextMenu.set(createContextMenu(event));
+    if (!m_contextMenu)
         return;
+    m_contextMenu->populate();
+    showContextMenu(event);
+}
+
+void ContextMenuController::showContextMenu(Event* event, Vector<ContextMenuItem>& items, PassRefPtr<ContextMenuSelectionHandler> selectionHandler)
+{
+    m_selectionHandler = selectionHandler;
+
+    m_contextMenu.set(createContextMenu(event));
+    if (!m_contextMenu) {
+        clearContextMenu();
+        return;
+    }
+    for (size_t i = 0; i < items.size(); ++i) {
+        ContextMenuItem& item = items[i];
+        m_contextMenu->appendItem(item);
+    }
+    showContextMenu(event);
+}
+
+ContextMenu* ContextMenuController::createContextMenu(Event* event)
+{
+   if (!event->isMouseEvent())
+        return 0;
     MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
     HitTestResult result(mouseEvent->absoluteLocation());
 
@@ -93,18 +122,18 @@ void ContextMenuController::handleContextMenuEvent(Event* event)
         result = frame->eventHandler()->hitTestResultAtPoint(mouseEvent->absoluteLocation(), false);
 
     if (!result.innerNonSharedNode())
-        return;
+        return 0;
+    return new ContextMenu(result);
+}
 
-    m_contextMenu.set(new ContextMenu(result));
-    m_contextMenu->populate();
+void ContextMenuController::showContextMenu(Event* event)
+{
 #if ENABLE(INSPECTOR)
     if (m_page->inspectorController()->enabled())
         m_contextMenu->addInspectElementItem();
 #endif
-
     PlatformMenuDescription customMenu = m_client->getCustomMenuFromDefaultItems(m_contextMenu.get());
     m_contextMenu->setPlatformDescription(customMenu);
-
     event->setDefaultHandled();
 }
 
@@ -126,6 +155,12 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         return;
     }
 
+    if (item->action() >= ContextMenuItemBaseCustomTag) {
+        ASSERT(m_selectionHandler);
+        m_selectionHandler->contextMenuItemSelected(item);
+        return;
+    }
+
     HitTestResult result = m_contextMenu->hitTestResult();
     Frame* frame = result.innerNonSharedNode()->document()->frame();
     if (!frame)
diff --git a/WebCore/page/ContextMenuController.h b/WebCore/page/ContextMenuController.h
index 38095f6..d51bc70 100644
--- a/WebCore/page/ContextMenuController.h
+++ b/WebCore/page/ContextMenuController.h
@@ -28,12 +28,16 @@
 
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
     class ContextMenu;
     class ContextMenuClient;
     class ContextMenuItem;
+    class ContextMenuSelectionHandler;
     class Event;
     class Page;
 
@@ -48,12 +52,18 @@ namespace WebCore {
         void clearContextMenu();
 
         void handleContextMenuEvent(Event*);
+        void showContextMenu(Event*, Vector<ContextMenuItem>&, PassRefPtr<ContextMenuSelectionHandler>);
+
         void contextMenuItemSelected(ContextMenuItem*);
 
     private:
+        ContextMenu* createContextMenu(Event*);
+        void showContextMenu(Event*);
+
         Page* m_page;
         ContextMenuClient* m_client;
         OwnPtr<ContextMenu> m_contextMenu;
+        RefPtr<ContextMenuSelectionHandler> m_selectionHandler;
     };
 
 }
diff --git a/WebCore/page/ContextMenuSelectionHandler.h b/WebCore/page/ContextMenuSelectionHandler.h
new file mode 100644
index 0000000..d5a6631
--- /dev/null
+++ b/WebCore/page/ContextMenuSelectionHandler.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ContextMenuSelectionHandler_h
+#define ContextMenuSelectionHandler_h
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class ContextMenuItem;
+
+    class ContextMenuSelectionHandler : public RefCounted<ContextMenuSelectionHandler> {
+    public:
+        ContextMenuSelectionHandler() { }
+        virtual ~ContextMenuSelectionHandler() { };
+
+        virtual void contextMenuItemSelected(ContextMenuItem*) = 0;
+        virtual void contextMenuCleared() = 0;
+    };
+
+}
+
+#endif // ContextMenuSelectionHandler_h
diff --git a/WebCore/page/DOMTimer.cpp b/WebCore/page/DOMTimer.cpp
index 83bcb02..8971bb7 100644
--- a/WebCore/page/DOMTimer.cpp
+++ b/WebCore/page/DOMTimer.cpp
@@ -119,8 +119,7 @@ void DOMTimer::fired()
     timerNestingLevel = m_nestingLevel;
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context);
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
         timelineAgent->willFireTimer(m_timeoutId);
 #endif
 
@@ -135,7 +134,7 @@ void DOMTimer::fired()
         // No access to member variables after this point, it can delete the timer.
         m_action->execute(context);
 #if ENABLE(INSPECTOR)
-        if (timelineAgent)
+        if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
             timelineAgent->didFireTimer();
 #endif
         return;
@@ -149,7 +148,7 @@ void DOMTimer::fired()
 
     action->execute(context);
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
         timelineAgent->didFireTimer();
 #endif
     delete action;
diff --git a/WebCore/page/DOMWindow.cpp b/WebCore/page/DOMWindow.cpp
index 8452e55..757e32f 100644
--- a/WebCore/page/DOMWindow.cpp
+++ b/WebCore/page/DOMWindow.cpp
@@ -53,6 +53,7 @@
 #include "HTMLFrameOwnerElement.h"
 #include "History.h"
 #include "InspectorController.h"
+#include "InspectorTimelineAgent.h"
 #include "Location.h"
 #include "Media.h"
 #include "MessageEvent.h"
@@ -459,6 +460,8 @@ void DOMWindow::clear()
 #endif
 
 #if ENABLE(NOTIFICATIONS)
+    if (m_notifications)
+        m_notifications->disconnectFrame();
     m_notifications = 0;
 #endif
 }
@@ -568,14 +571,14 @@ Storage* DOMWindow::sessionStorage() const
     Document* document = this->document();
     if (!document)
         return 0;
+    
+    if (!document->securityOrigin()->canAccessStorage())
+        return 0;
 
     Page* page = document->page();
     if (!page)
         return 0;
 
-    if (!page->settings()->sessionStorageEnabled())
-        return 0;
-
     RefPtr<StorageArea> storageArea = page->sessionStorage()->storageArea(document->securityOrigin());
 #if ENABLE(INSPECTOR)
     page->inspectorController()->didUseDOMStorage(storageArea.get(), false, m_frame);
@@ -593,6 +596,9 @@ Storage* DOMWindow::localStorage() const
     Document* document = this->document();
     if (!document)
         return 0;
+    
+    if (!document->securityOrigin()->canAccessStorage())
+        return 0;
         
     Page* page = document->page();
     if (!page)
@@ -625,9 +631,6 @@ NotificationCenter* DOMWindow::webkitNotifications() const
     if (!page)
         return 0;
 
-    if (!page->settings()->experimentalNotificationsEnabled())
-        return 0;
-
     NotificationPresenter* provider = page->chrome()->notificationPresenter();
     if (provider) 
         m_notifications = NotificationCenter::create(document, provider);    
@@ -1112,13 +1115,15 @@ PassRefPtr<Database> DOMWindow::openDatabase(const String& name, const String& v
     if (!m_frame)
         return 0;
 
-    Document* doc = m_frame->document();
+    Document* document = m_frame->document();
+    if (!document->securityOrigin()->canAccessDatabase())
+        return 0;
 
     Settings* settings = m_frame->settings();
     if (!settings || !settings->databasesEnabled())
         return 0;
 
-    return Database::openDatabase(doc, name, version, displayName, estimatedSize, ec);
+    return Database::openDatabase(document, name, version, displayName, estimatedSize, ec);
 }
 #endif
 
@@ -1304,6 +1309,15 @@ void DOMWindow::dispatchLoadEvent()
 #endif
 }
 
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* DOMWindow::inspectorTimelineAgent() 
+{
+    if (frame() && frame()->page())
+        return frame()->page()->inspectorTimelineAgent();
+    return 0;
+}
+#endif
+
 bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
 {
     RefPtr<EventTarget> protect = this;
@@ -1313,7 +1327,24 @@ bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget
     event->setCurrentTarget(this);
     event->setEventPhase(Event::AT_TARGET);
 
-    return fireEventListeners(event.get());
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    bool timelineAgentIsActive = timelineAgent && hasEventListeners(event->type());
+    if (timelineAgentIsActive)
+        timelineAgent->willDispatchEvent(*event);
+#endif
+
+    bool result = fireEventListeners(event.get());
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgentIsActive) {
+      timelineAgent = inspectorTimelineAgent();
+      if (timelineAgent)
+            timelineAgent->didDispatchEvent();
+    }
+#endif
+
+    return result;
 }
 
 void DOMWindow::removeAllEventListeners()
diff --git a/WebCore/page/DOMWindow.h b/WebCore/page/DOMWindow.h
index 235c9a0..5e2d990 100644
--- a/WebCore/page/DOMWindow.h
+++ b/WebCore/page/DOMWindow.h
@@ -52,6 +52,7 @@ namespace WebCore {
     class FloatRect;
     class Frame;
     class History;
+    class InspectorTimelineAgent;
     class Location;
     class Media;
     class Navigator;
@@ -247,9 +248,13 @@ namespace WebCore {
         void dispatchLoadEvent();
 
         DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
@@ -258,13 +263,22 @@ namespace WebCore {
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(hashchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
@@ -275,39 +289,30 @@ namespace WebCore {
         DEFINE_ATTRIBUTE_EVENT_LISTENER(online);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(pagehide);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(pageshow);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(popstate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(resize);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(storage);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(timeupdate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(volumechange);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(waiting);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitbeginfullscreen);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitendfullscreen);
+
 #if ENABLE(ORIENTATION_EVENTS)
         DEFINE_ATTRIBUTE_EVENT_LISTENER(orientationchange);
 #endif
@@ -359,6 +364,7 @@ namespace WebCore {
         virtual void derefEventTarget() { deref(); }
         virtual EventTargetData* eventTargetData();
         virtual EventTargetData* ensureEventTargetData();
+        InspectorTimelineAgent* inspectorTimelineAgent();
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index c7bcf82..c4b08c6 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -31,7 +31,6 @@ module window {
         CustomDefineSetter,
         CustomDeleteProperty,
         CustomGetOwnPropertySlot,
-        CustomGetPropertyAttributes,
         CustomGetPropertyNames,
         CustomLookupGetter,
         CustomLookupSetter,
@@ -157,7 +156,7 @@ module window {
         WebKitPoint webkitConvertPointFromNodeToPage(in Node node, in WebKitPoint p);
 
 #if defined(ENABLE_OFFLINE_WEB_APPLICATIONS) && ENABLE_OFFLINE_WEB_APPLICATIONS
-        readonly attribute DOMApplicationCache applicationCache;
+        readonly attribute [EnabledAtRuntime] DOMApplicationCache applicationCache;
 #endif    
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
         [EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
@@ -259,6 +258,7 @@ module window {
         attribute EventListener onpause;
         attribute EventListener onplay;
         attribute EventListener onplaying;
+        attribute EventListener onpopstate;
         attribute EventListener onprogress;
         attribute EventListener onratechange;
         attribute EventListener onresize;
@@ -439,17 +439,17 @@ module window {
         attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
 
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
-        attribute [Conditional=3D_CANVAS] CanvasRenderingContext3DConstructor CanvasRenderingContext3D;
+        attribute [Conditional=3D_CANVAS] WebGLRenderingContextConstructor WebGLRenderingContext;
         attribute TextMetricsConstructor TextMetrics;
 
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLArrayBufferConstructor WebGLArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLByteArrayConstructor WebGLByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLUnsignedByteArrayConstructor WebGLUnsignedByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLShortArrayConstructor WebGLShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLUnsignedShortArrayConstructor WebGLUnsignedShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLIntArrayConstructor WebGLIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLUnsignedIntArrayConstructor WebGLUnsignedIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLFloatArrayConstructor WebGLFloatArray; // Usable with new operator
 
         attribute EventConstructor Event;
         attribute BeforeLoadEventConstructor BeforeLoadEvent;
diff --git a/WebCore/page/DragController.h b/WebCore/page/DragController.h
index 9472589..3d59ebf 100644
--- a/WebCore/page/DragController.h
+++ b/WebCore/page/DragController.h
@@ -47,7 +47,7 @@ namespace WebCore {
     class Range;
     class SelectionController;
     
-    class DragController {
+    class DragController : public Noncopyable {
     public:
         DragController(Page*, DragClient*);
         ~DragController();
diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index 6a92aa8..8b6b602 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -213,6 +213,7 @@ void EventHandler::clear()
     m_frameSetBeingResized = 0;
 #if ENABLE(DRAG_SUPPORT)
     m_dragTarget = 0;
+    m_shouldOnlyFireDragOverEvent = false;
 #endif
     m_currentMousePosition = IntPoint();
     m_mousePressNode = 0;
@@ -1520,6 +1521,35 @@ bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTa
     return me->defaultPrevented();
 }
 
+bool EventHandler::canHandleDragAndDropForTarget(DragAndDropHandleType type, Node* target, const PlatformMouseEvent& event, Clipboard* clipboard, bool* accepted)
+{
+    bool canHandle = false;
+    bool wasAccepted = false;
+
+    if (target->hasTagName(frameTag) || target->hasTagName(iframeTag)) {
+        Frame* frame = static_cast<HTMLFrameElementBase*>(target)->contentFrame();
+        if (frame) {
+            switch (type) {
+                case UpdateDragAndDrop:
+                    wasAccepted = frame->eventHandler()->updateDragAndDrop(event, clipboard);
+                    break;
+                case CancelDragAndDrop:
+                    frame->eventHandler()->cancelDragAndDrop(event, clipboard);
+                    break;
+                case PerformDragAndDrop:
+                    wasAccepted = frame->eventHandler()->performDragAndDrop(event, clipboard);
+                    break;
+            }
+        }
+    } else
+        canHandle = true;
+
+    if (accepted)
+        *accepted = wasAccepted;
+
+    return canHandle;
+}
+
 bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     bool accept = false;
@@ -1541,28 +1571,34 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         // FIXME: this ordering was explicitly chosen to match WinIE. However,
         // it is sometimes incorrect when dragging within subframes, as seen with
         // LayoutTests/fast/events/drag-in-frames.html.
-        if (newTarget) {
-            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
-            if (frame)
-                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
-            else
-                accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
+        //
+        // Moreover, this ordering conforms to section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>.
+        if (newTarget && canHandleDragAndDropForTarget(UpdateDragAndDrop, newTarget, event, clipboard, &accept)) {
+            // As per section 7.9.4 of the HTML 5 spec., we must always fire a drag event before firing a dragenter, dragleave, or dragover event.
+            if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML) {
+                // for now we don't care if event handler cancels default behavior, since there is none
+                dispatchDragSrcEvent(eventNames().dragEvent, event);
+            }
+            accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
         }
 
-        if (m_dragTarget) {
-            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
-            if (frame)
-                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
-            else
-                dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
+        if (m_dragTarget && canHandleDragAndDropForTarget(UpdateDragAndDrop, m_dragTarget.get(), event, clipboard, &accept))
+            dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
+        
+        if (newTarget) {
+            // We do not explicitly call dispatchDragEvent here because it could ultimately result in the appearance that
+            // two dragover events fired. So, we mark that we should only fire a dragover event on the next call to this function.
+            m_shouldOnlyFireDragOverEvent = true;
         }
     } else {
-        if (newTarget) {
-            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
-            if (frame)
-                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
-            else
-                accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+        if (newTarget && canHandleDragAndDropForTarget(UpdateDragAndDrop, newTarget, event, clipboard, &accept)) {
+            // Note, when dealing with sub-frames, we may need to fire only a dragover event as a drag event may have been fired earlier.
+            if (!m_shouldOnlyFireDragOverEvent && dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML) {
+                // for now we don't care if event handler cancels default behavior, since there is none
+                dispatchDragSrcEvent(eventNames().dragEvent, event);
+            }
+            accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+            m_shouldOnlyFireDragOverEvent = false;
         }
     }
     m_dragTarget = newTarget;
@@ -1572,13 +1608,10 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
 
 void EventHandler::cancelDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
-    if (m_dragTarget) {
-        Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                        ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
-        if (frame)
-            frame->eventHandler()->cancelDragAndDrop(event, clipboard);
-        else
-            dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
+    if (m_dragTarget && canHandleDragAndDropForTarget(CancelDragAndDrop, m_dragTarget.get(), event, clipboard)) {
+        if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML)
+            dispatchDragSrcEvent(eventNames().dragEvent, event);
+        dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
     }
     clearDragState();
 }
@@ -1586,14 +1619,8 @@ void EventHandler::cancelDragAndDrop(const PlatformMouseEvent& event, Clipboard*
 bool EventHandler::performDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     bool accept = false;
-    if (m_dragTarget) {
-        Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                        ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
-        if (frame)
-            accept = frame->eventHandler()->performDragAndDrop(event, clipboard);
-        else
-            accept = dispatchDragEvent(eventNames().dropEvent, m_dragTarget.get(), event, clipboard);
-    }
+    if (m_dragTarget && canHandleDragAndDropForTarget(PerformDragAndDrop, m_dragTarget.get(), event, clipboard, &accept))
+        dispatchDragEvent(eventNames().dropEvent, m_dragTarget.get(), event, clipboard);
     clearDragState();
     return accept;
 }
@@ -1602,6 +1629,7 @@ void EventHandler::clearDragState()
 {
     m_dragTarget = 0;
     m_capturingMouseEventsNode = 0;
+    m_shouldOnlyFireDragOverEvent = false;
 #if PLATFORM(MAC)
     m_sendingEventToSubview = false;
 #endif
@@ -1775,7 +1803,7 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
     return swallowEvent;
 }
 
-#if !PLATFORM(GTK)
+#if !PLATFORM(GTK) && !(PLATFORM(CHROMIUM) && PLATFORM(LINUX))
 bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult&) const
 {
     return false;
@@ -2205,14 +2233,7 @@ bool EventHandler::shouldDragAutoNode(Node* node, const IntPoint& point) const
     Page* page = m_frame->page();
     return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
 }
-    
-void EventHandler::dragSourceMovedTo(const PlatformMouseEvent& event)
-{
-    if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML)
-        // for now we don't care if event handler cancels default behavior, since there is none
-        dispatchDragSrcEvent(eventNames().dragEvent, event);
-}
-    
+
 void EventHandler::dragSourceEndedAt(const PlatformMouseEvent& event, DragOperation operation)
 {
     if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML) {
@@ -2338,9 +2359,10 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
             // gather values from DHTML element, if it set any
             dragState().m_dragClipboard->sourceOperation(srcOp);
             
-            // Yuck, dragSourceMovedTo() can be called as a result of kicking off the drag with
-            // dragImage!  Because of that dumb reentrancy, we may think we've not started the
-            // drag when that happens.  So we have to assume it's started before we kick it off.
+            // Yuck, a draggedImage:moveTo: message can be fired as a result of kicking off the
+            // drag with dragImage!  Because of that dumb reentrancy, we may think we've not
+            // started the drag when that happens.  So we have to assume it's started before we
+            // kick it off.
             dragState().m_dragClipboard->setDragHasStarted();
         }
     }
diff --git a/WebCore/page/EventHandler.h b/WebCore/page/EventHandler.h
index d8cd3a2..0da44f2 100644
--- a/WebCore/page/EventHandler.h
+++ b/WebCore/page/EventHandler.h
@@ -33,7 +33,7 @@
 #include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
 
-#if PLATFORM(MAC) && !defined(__OBJC__)
+#if PLATFORM(MAC) && !defined(__OBJC__) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 class NSView;
 #endif
 
@@ -176,7 +176,6 @@ public:
 #if ENABLE(DRAG_SUPPORT)
     bool eventMayStartDrag(const PlatformMouseEvent&) const;
     
-    void dragSourceMovedTo(const PlatformMouseEvent&);
     void dragSourceEndedAt(const PlatformMouseEvent&, DragOperation);
 #endif
 
@@ -187,7 +186,7 @@ public:
     void sendResizeEvent();
     void sendScrollEvent();
     
-#if PLATFORM(MAC) && defined(__OBJC__)
+#if PLATFORM(MAC) && defined(__OBJC__) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     PassRefPtr<KeyboardEvent> currentKeyboardEvent() const;
 
     void mouseDown(NSEvent *);
@@ -211,7 +210,13 @@ public:
 
 private:
 #if ENABLE(DRAG_SUPPORT)
-    struct EventHandlerDragState {
+    enum DragAndDropHandleType {
+        UpdateDragAndDrop,
+        CancelDragAndDrop,
+        PerformDragAndDrop
+    };
+
+    struct EventHandlerDragState : Noncopyable {
         RefPtr<Node> m_dragSrc; // element that may be a drag source, for the current mouse gesture
         bool m_dragSrcIsLink;
         bool m_dragSrcIsImage;
@@ -223,6 +228,8 @@ private:
     };
     static EventHandlerDragState& dragState();
     static const double TextDragDelay;
+
+    bool canHandleDragAndDropForTarget(DragAndDropHandleType, Node* target, const PlatformMouseEvent&, Clipboard*, bool* accepted = 0);
     
     PassRefPtr<Clipboard> createDraggingClipboard() const;
 #endif // ENABLE(DRAG_SUPPORT)
@@ -328,7 +335,7 @@ private:
 
     bool capturesDragging() const { return m_capturesDragging; }
 
-#if PLATFORM(MAC) && defined(__OBJC__)
+#if PLATFORM(MAC) && defined(__OBJC__) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     NSView *mouseDownViewIfStillGood();
 
     PlatformMouseEvent currentPlatformMouseEvent() const;
@@ -388,6 +395,7 @@ private:
 
 #if ENABLE(DRAG_SUPPORT)
     RefPtr<Node> m_dragTarget;
+    bool m_shouldOnlyFireDragOverEvent;
 #endif
     
     RefPtr<HTMLFrameSetElement> m_frameSetBeingResized;
@@ -405,7 +413,7 @@ private:
 
     RefPtr<Node> m_previousWheelScrolledNode;
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
     int m_activationEventNumber;
diff --git a/WebCore/page/EventSource.h b/WebCore/page/EventSource.h
index 5b037a4..c7ff2c9 100644
--- a/WebCore/page/EventSource.h
+++ b/WebCore/page/EventSource.h
@@ -36,7 +36,6 @@
 
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
-#include "EventListener.h"
 #include "EventNames.h"
 #include "EventTarget.h"
 #include "KURL.h"
diff --git a/WebCore/page/FocusController.h b/WebCore/page/FocusController.h
index 33debf1..d86408a 100644
--- a/WebCore/page/FocusController.h
+++ b/WebCore/page/FocusController.h
@@ -28,6 +28,7 @@
 
 #include "FocusDirection.h"
 #include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -37,7 +38,7 @@ namespace WebCore {
     class Node;
     class Page;
 
-    class FocusController {
+    class FocusController : public Noncopyable {
     public:
         FocusController(Page*);
 
diff --git a/WebCore/page/Frame.cpp b/WebCore/page/Frame.cpp
index b9bf94e..7e81b3d 100644
--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -82,6 +82,10 @@
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/StdLibExtras.h>
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+#import <Carbon/Carbon.h>
+#endif
+
 #if USE(JSC)
 #include "JSDOMWindowShell.h"
 #include "runtime_root.h"
@@ -874,10 +878,10 @@ void Frame::injectUserScripts(UserScriptInjectionTime injectionTime)
         return;
     UserScriptMap::const_iterator end = userScripts->end();
     for (UserScriptMap::const_iterator it = userScripts->begin(); it != end; ++it)
-        injectUserScriptsForWorld(it->first, *it->second, injectionTime);
+        injectUserScriptsForWorld(it->first.get(), *it->second, injectionTime);
 }
 
-void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector& userScripts, UserScriptInjectionTime injectionTime)
+void Frame::injectUserScriptsForWorld(DOMWrapperWorld* world, const UserScriptVector& userScripts, UserScriptInjectionTime injectionTime)
 {
     if (userScripts.isEmpty())
         return;
@@ -891,9 +895,8 @@ void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&
     for (unsigned i = 0; i < count; ++i) {
         UserScript* script = userScripts[i].get();
         if (script->injectionTime() == injectionTime && UserContentURLPattern::matchesPatterns(doc->url(), script->whitelist(), script->blacklist()))
-            sourceCode.append(ScriptSourceCode(script->source(), script->url()));
+            m_script.evaluateInWorld(ScriptSourceCode(script->source(), script->url()), world);
     }
-    script()->evaluateInIsolatedWorld(worldID, sourceCode);
 }
 
 bool Frame::shouldChangeSelection(const VisibleSelection& newSelection) const
@@ -919,13 +922,36 @@ bool Frame::isContentEditable() const
     return m_doc->inDesignMode();
 }
 
-#if !PLATFORM(MAC)
-
-void Frame::setUseSecureKeyboardEntry(bool)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+const short enableRomanKeyboardsOnly = -23;
+#endif
+void Frame::setUseSecureKeyboardEntry(bool enable)
 {
-}
-
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+    if (enable == IsSecureEventInputEnabled())
+        return;
+    if (enable) {
+        EnableSecureEventInput();
+#ifdef BUILDING_ON_TIGER
+        KeyScript(enableRomanKeyboardsOnly);
+#else
+        // WebKit substitutes nil for input context when in password field, which corresponds to null TSMDocument. So, there is
+        // no need to call TSMGetActiveDocument(), which may return an incorrect result when selection hasn't been yet updated
+        // after focusing a node.
+        CFArrayRef inputSources = TISCreateASCIICapableInputSourceList();
+        TSMSetDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag, sizeof(CFArrayRef), &inputSources);
+        CFRelease(inputSources);
+#endif
+    } else {
+        DisableSecureEventInput();
+#ifdef BUILDING_ON_TIGER
+        KeyScript(smKeyEnableKybds);
+#else
+        TSMRemoveDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag);
+#endif
+    }
 #endif
+}
 
 void Frame::updateSecureKeyboardEntryIfActive()
 {
@@ -1244,7 +1270,7 @@ FloatRect Frame::selectionBounds(bool clipToVisibleContent) const
     return clipToVisibleContent ? intersection(selectionRect, view->visibleContentRect()) : selectionRect;
 }
 
-void Frame::selectionTextRects(Vector<FloatRect>& rects, bool clipToVisibleContent) const
+void Frame::selectionTextRects(Vector<FloatRect>& rects, SelectionRectRespectTransforms respectTransforms, bool clipToVisibleContent) const
 {
     RenderView* root = contentRenderer();
     if (!root)
@@ -1252,19 +1278,36 @@ void Frame::selectionTextRects(Vector<FloatRect>& rects, bool clipToVisibleConte
 
     RefPtr<Range> selectedRange = selection()->toNormalizedRange();
 
-    Vector<IntRect> intRects;
-    selectedRange->textRects(intRects, true);
-
-    unsigned size = intRects.size();
     FloatRect visibleContentRect = m_view->visibleContentRect();
-    for (unsigned i = 0; i < size; ++i)
-        if (clipToVisibleContent)
-            rects.append(intersection(intRects[i], visibleContentRect));
-        else
-            rects.append(intRects[i]);
+    
+    // FIMXE: we are appending empty rects to the list for those that fall outside visibleContentRect.
+    // We may not want to do that.
+    if (respectTransforms) {
+        Vector<FloatQuad> quads;
+        selectedRange->textQuads(quads, true);
+
+        unsigned size = quads.size();
+        for (unsigned i = 0; i < size; ++i) {
+            IntRect currRect = quads[i].enclosingBoundingBox();
+            if (clipToVisibleContent)
+                rects.append(intersection(currRect, visibleContentRect));
+            else
+                rects.append(currRect);
+        }
+    } else {
+        Vector<IntRect> intRects;
+        selectedRange->textRects(intRects, true);
+
+        unsigned size = intRects.size();
+        for (unsigned i = 0; i < size; ++i) {
+            if (clipToVisibleContent)
+                rects.append(intersection(intRects[i], visibleContentRect));
+            else
+                rects.append(intRects[i]);
+        }
+    }
 }
 
-
 // Scans logically forward from "start", including any child frames
 static HTMLFormElement *scanForForm(Node *start)
 {
diff --git a/WebCore/page/Frame.h b/WebCore/page/Frame.h
index 6208bbd..ca9a6d4 100644
--- a/WebCore/page/Frame.h
+++ b/WebCore/page/Frame.h
@@ -131,7 +131,7 @@ namespace WebCore {
         void injectUserScripts(UserScriptInjectionTime);
 
     private:
-        void injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&, UserScriptInjectionTime);
+        void injectUserScriptsForWorld(DOMWrapperWorld*, const UserScriptVector&, UserScriptInjectionTime);
 
     private:
         Frame(Page*, HTMLFrameOwnerElement*, FrameLoaderClient*);
@@ -274,7 +274,8 @@ namespace WebCore {
         void clearTypingStyle();
 
         FloatRect selectionBounds(bool clipToVisibleContent = true) const;
-        void selectionTextRects(Vector<FloatRect>&, bool clipToVisibleContent = true) const;
+        enum SelectionRectRespectTransforms { RespectTransforms = true, IgnoreTransforms = false };
+        void selectionTextRects(Vector<FloatRect>&, SelectionRectRespectTransforms respectTransforms, bool clipToVisibleContent = true) const;
 
         HTMLFormElement* currentForm() const;
 
diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index 944f215..87d2d6c 100644
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -107,13 +107,14 @@ static const double deferredRepaintDelayIncrementDuringLoading = 0;
 // The maximum number of updateWidgets iterations that should be done before returning.
 static const unsigned maxUpdateWidgetsIterations = 2;
 
-struct ScheduledEvent {
+struct ScheduledEvent : Noncopyable {
     RefPtr<Event> m_event;
     RefPtr<Node> m_eventTarget;
 };
 
 FrameView::FrameView(Frame* frame)
     : m_frame(frame)
+    , m_canHaveScrollbars(true)
     , m_slowRepaintObjectCount(0)
     , m_layoutTimer(this, &FrameView::layoutTimerFired)
     , m_layoutRoot(0)
@@ -206,7 +207,7 @@ void FrameView::reset()
     m_deferredRepaintDelay = initialDeferredRepaintDelayDuringLoading;
     m_deferredRepaintTimer.stop();
     m_lastPaintTime = 0;
-    m_paintRestriction = PaintRestrictionNone;
+    m_paintBehavior = PaintBehaviorNormal;
     m_isPainting = false;
     m_isVisuallyNonEmpty = false;
     m_firstVisuallyNonEmptyLayoutCallbackPending = true;
@@ -228,7 +229,10 @@ void FrameView::resetScrollbars()
     // Reset the document's scrollbars back to our defaults before we yield the floor.
     m_firstLayout = true;
     setScrollbarsSuppressed(true);
-    setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
+    if (m_canHaveScrollbars)
+        setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
+    else
+        setScrollbarModes(ScrollbarAlwaysOff, ScrollbarAlwaysOff);
     setScrollbarsSuppressed(false);
 }
 
@@ -325,6 +329,23 @@ void FrameView::setMarginHeight(int h)
     m_margins.setHeight(h);
 }
 
+void FrameView::setCanHaveScrollbars(bool canHaveScrollbars)
+{
+    m_canHaveScrollbars = canHaveScrollbars;
+    ScrollView::setCanHaveScrollbars(canHaveScrollbars);
+}
+
+void FrameView::updateCanHaveScrollbars()
+{
+    ScrollbarMode hMode;
+    ScrollbarMode vMode;
+    scrollbarModes(hMode, vMode);
+    if (hMode == ScrollbarAlwaysOff && vMode == ScrollbarAlwaysOff)
+        m_canHaveScrollbars = false;
+    else
+        m_canHaveScrollbars = true;
+}
+
 PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
 {
     // FIXME: We need to update the scrollbar dynamically as documents change (or as doc elements and bodies get discovered that have custom styles).
@@ -351,6 +372,9 @@ PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientatio
 
 void FrameView::setContentsSize(const IntSize& size)
 {
+    if (size == contentsSize())
+        return;
+
     m_deferSetNeedsLayouts++;
 
     ScrollView::setContentsSize(size);
@@ -423,7 +447,7 @@ void FrameView::updateCompositingLayers()
         return;
 
     // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
-    view->compositor()->cacheAcceleratedCompositingEnabledFlag();
+    view->compositor()->cacheAcceleratedCompositingFlags();
     
     if (!view->usesCompositing())
         return;
@@ -466,8 +490,9 @@ bool FrameView::syncCompositingStateRecursive()
         }
     }
     return allSubframesSynced;
-#endif // USE(ACCELERATED_COMPOSITING)
+#else // USE(ACCELERATED_COMPOSITING)
     return true;
+#endif
 }
 
 void FrameView::didMoveOnscreen()
@@ -513,9 +538,8 @@ void FrameView::layout(bool allowSubtree)
     if (isPainting())
         return;
 
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
+#if ENABLE(INSPECTOR)    
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->willLayout();
 #endif
 
@@ -577,7 +601,13 @@ void FrameView::layout(bool allowSubtree)
 
     ScrollbarMode hMode;
     ScrollbarMode vMode;
-    scrollbarModes(hMode, vMode);
+    if (m_canHaveScrollbars) {
+        hMode = ScrollbarAuto;
+        vMode = ScrollbarAuto;
+    } else {
+        hMode = ScrollbarAlwaysOff;
+        vMode = ScrollbarAlwaysOff;
+    }
 
     if (!subtree) {
         RenderObject* rootRenderer = document->documentElement() ? document->documentElement()->renderer() : 0;
@@ -714,7 +744,7 @@ void FrameView::layout(bool allowSubtree)
     }
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didLayout();
 #endif
 
@@ -756,6 +786,11 @@ bool FrameView::useSlowRepaints() const
     return m_useSlowRepaints || m_slowRepaintObjectCount > 0 || m_isOverlapped || !m_contentIsOpaque;
 }
 
+bool FrameView::useSlowRepaintsIfNotOverlapped() const
+{
+    return m_useSlowRepaints || m_slowRepaintObjectCount > 0 || !m_contentIsOpaque;
+}
+
 void FrameView::setUseSlowRepaints()
 {
     m_useSlowRepaints = true;
@@ -939,6 +974,7 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
 
     double delay = adjustedDeferredRepaintDelay();
     if ((m_deferringRepaints || m_deferredRepaintTimer.isActive() || delay) && !immediate) {
+<<<<<<< HEAD:WebCore/page/FrameView.cpp
         IntRect visibleContent = visibleContentRect();
 #ifdef ANDROID_CAPTURE_OFFSCREEN_PAINTS
         IntRect fullVis = visibleContent;
@@ -949,6 +985,12 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
             ScrollView::platformOffscreenContentRectangle(fullVis, r);
 #endif
         if (visibleContent.isEmpty())
+=======
+        IntRect paintRect = r;
+        if (!paintsEntireContents())
+            paintRect.intersect(visibleContentRect());
+        if (paintRect.isEmpty())
+>>>>>>> webkit.org at r51976:WebCore/page/FrameView.cpp
             return;
         if (m_repaintCount == cRepaintRectUnionThreshold) {
             IntRect unionedRect;
@@ -958,9 +1000,9 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
             m_repaintRects.append(unionedRect);
         }
         if (m_repaintCount < cRepaintRectUnionThreshold)
-            m_repaintRects.append(visibleContent);
+            m_repaintRects.append(paintRect);
         else
-            m_repaintRects[0].unite(visibleContent);
+            m_repaintRects[0].unite(paintRect);
         m_repaintCount++;
     
         if (!m_deferringRepaints && !m_deferredRepaintTimer.isActive())
@@ -1491,6 +1533,7 @@ void FrameView::valueChanged(Scrollbar* bar)
     ScrollView::valueChanged(bar);
     if (offset != scrollOffset())
         frame()->eventHandler()->sendScrollEvent();
+    frame()->loader()->client()->didChangeScrollOffset();
 }
 
 void FrameView::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
@@ -1655,9 +1698,8 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         return;
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willPaint();
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
+        timelineAgent->willPaint(rect);
 #endif
 
     Document* document = frame()->document();
@@ -1670,7 +1712,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         fillWithRed = false; // Subframe, don't fill with red.
     else if (isTransparent())
         fillWithRed = false; // Transparent, don't fill with red.
-    else if (m_paintRestriction == PaintRestrictionSelectionOnly || m_paintRestriction == PaintRestrictionSelectionOnlyBlackText)
+    else if (m_paintBehavior & PaintBehaviorSelectionOnly)
         fillWithRed = false; // Selections are transparent, don't fill with red.
     else if (m_nodeToDraw)
         fillWithRed = false; // Element images are transparent, don't fill with red.
@@ -1678,7 +1720,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         fillWithRed = true;
     
     if (fillWithRed)
-        p->fillRect(rect, Color(0xFF, 0, 0));
+        p->fillRect(rect, Color(0xFF, 0, 0), DeviceColorSpace);
 #endif
 
     bool isTopLevelPainter = !sCurrentPaintTimeStamp;
@@ -1708,9 +1750,15 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         
     // m_nodeToDraw is used to draw only one element (and its descendants)
     RenderObject* eltRenderer = m_nodeToDraw ? m_nodeToDraw->renderer() : 0;
-    if (m_paintRestriction == PaintRestrictionNone)
+
+    PaintBehavior paintBehavior = m_paintBehavior;
+    if (paintBehavior == PaintBehaviorNormal)
         document->invalidateRenderedRectsForMarkersInRect(rect);
-    contentRenderer->layer()->paint(p, rect, m_paintRestriction, eltRenderer);
+
+    if (document->printing())
+        paintBehavior |= PaintBehaviorFlattenCompositingLayers;
+
+    contentRenderer->layer()->paint(p, rect, paintBehavior, eltRenderer);
     
     m_isPainting = false;
     m_lastPaintTime = currentTime();
@@ -1725,14 +1773,14 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         sCurrentPaintTimeStamp = 0;
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didPaint();
 #endif
 }
 
-void FrameView::setPaintRestriction(PaintRestriction pr)
+void FrameView::setPaintBehavior(PaintBehavior behavior)
 {
-    m_paintRestriction = pr;
+    m_paintBehavior = behavior;
 }
     
 bool FrameView::isPainting() const
diff --git a/WebCore/page/FrameView.h b/WebCore/page/FrameView.h
index 3d17d2c..11f8843 100644
--- a/WebCore/page/FrameView.h
+++ b/WebCore/page/FrameView.h
@@ -72,6 +72,9 @@ public:
     void setMarginWidth(int);
     void setMarginHeight(int);
 
+    virtual void setCanHaveScrollbars(bool);
+    void updateCanHaveScrollbars();
+
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
 
     virtual void setContentsSize(const IntSize&);
@@ -167,7 +170,8 @@ public:
     void removeWidgetToUpdate(RenderPartObject*);
 
     virtual void paintContents(GraphicsContext*, const IntRect& damageRect);
-    void setPaintRestriction(PaintRestriction);
+    void setPaintBehavior(PaintBehavior);
+    PaintBehavior paintBehavior() const { return m_paintBehavior; }
     bool isPainting() const;
     void setNodeToDraw(Node*);
 
@@ -206,6 +210,7 @@ private:
 
     friend class RenderWidget;
     bool useSlowRepaints() const;
+    bool useSlowRepaintsIfNotOverlapped() const;
 
     void applyOverflowToViewport(RenderObject*, ScrollbarMode& hMode, ScrollbarMode& vMode);
 
@@ -257,6 +262,7 @@ private:
 
     bool m_doFullRepaint;
     
+    bool m_canHaveScrollbars;
     bool m_useSlowRepaints;
     bool m_isOverlapped;
     bool m_contentIsOpaque;
@@ -307,7 +313,7 @@ private:
     bool m_setNeedsLayoutWasDeferred;
 
     RefPtr<Node> m_nodeToDraw;
-    PaintRestriction m_paintRestriction;
+    PaintBehavior m_paintBehavior;
     bool m_isPainting;
 
     bool m_isVisuallyNonEmpty;
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index 604802f..561d19c 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -87,8 +87,13 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 {
     m_timer.stop();
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     // Cache our pointer to the Geolocation object, as this object could be
     // deleted by a call to clearWatch in a callback.
+=======
+    // Cache our pointer to the Geolocation object, as this GeoNotifier object
+    // could be deleted by a call to clearWatch in a callback.
+>>>>>>> webkit.org at r51976:WebCore/page/Geolocation.cpp
     Geolocation* geolocation = m_geolocation;
 
     if (m_fatalError) {
@@ -96,12 +101,15 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
             m_errorCallback->handleEvent(m_fatalError.get());
         // This will cause this notifier to be deleted.
         geolocation->fatalErrorOccurred(this);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         return;
     }
 
     if (m_cachedPosition) {
         m_successCallback->handleEvent(m_cachedPosition.get());
         geolocation->requestReturnedCachedPosition(this);
+=======
+>>>>>>> webkit.org at r51976:WebCore/page/Geolocation.cpp
         return;
     }
 
@@ -112,10 +120,12 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
     geolocation->requestTimedOut(this);
 }
 
-void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> notifier)
+void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> prpNotifier)
 {
-    m_idToNotifierMap.set(id, notifier);
-    m_notifierToIdMap.set(notifier, id);
+    RefPtr<GeoNotifier> notifier = prpNotifier;
+
+    m_idToNotifierMap.set(id, notifier.get());
+    m_notifierToIdMap.set(notifier.release(), id);
 }
 
 void Geolocation::Watchers::remove(int id)
@@ -360,6 +370,7 @@ PassRefPtr<Geolocation::GeoNotifier> Geolocation::startRequest(PassRefPtr<Positi
     if (isDenied())
         notifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
     else {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         if (haveSuitableCachedPosition(notifier->m_options.get())) {
             ASSERT(m_cachedPositionManager->cachedPosition());
             if (isAllowed())
@@ -374,6 +385,12 @@ PassRefPtr<Geolocation::GeoNotifier> Geolocation::startRequest(PassRefPtr<Positi
             else
                 notifier->setFatalError(PositionError::create(PositionError::UNKNOWN_ERROR, "Failed to start Geolocation service"));
         }
+=======
+        if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+            notifier->startTimerIfNeeded();
+        else
+            notifier->setFatalError(PositionError::create(PositionError::POSITION_UNAVAILABLE, "Failed to start Geolocation service"));
+>>>>>>> webkit.org at r51976:WebCore/page/Geolocation.cpp
     }
 
     return notifier.release();
diff --git a/WebCore/page/HaltablePlugin.h b/WebCore/page/HaltablePlugin.h
index a5fe0f4..0f4aa41 100644
--- a/WebCore/page/HaltablePlugin.h
+++ b/WebCore/page/HaltablePlugin.h
@@ -37,6 +37,8 @@ public:
     virtual void halt() = 0;
     virtual void restart() = 0;
     virtual Node* node() const = 0;
+    virtual bool isWindowed() const = 0;
+    virtual String pluginName() const = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/History.cpp b/WebCore/page/History.cpp
index 9a27f1c..ea9819e 100644
--- a/WebCore/page/History.cpp
+++ b/WebCore/page/History.cpp
@@ -26,8 +26,12 @@
 #include "config.h"
 #include "History.h"
 
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "HistoryItem.h"
+#include "Page.h"
 
 namespace WebCore {
 
@@ -76,4 +80,46 @@ void History::go(int distance)
     m_frame->redirectScheduler()->scheduleHistoryNavigation(distance);
 }
 
+KURL History::urlForState(const String& urlString)
+{
+    KURL baseURL = m_frame->loader()->baseURL();
+    if (urlString.isEmpty())
+        return baseURL;
+        
+    KURL absoluteURL(baseURL, urlString);
+    if (!absoluteURL.isValid())
+        return KURL();
+    
+    if (absoluteURL.string().left(absoluteURL.pathStart()) != baseURL.string().left(baseURL.pathStart()))
+        return KURL();
+    
+    return absoluteURL;
+}
+
+void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const String& title, const String& urlString, StateObjectType stateObjectType, ExceptionCode& ec)
+{
+    if (!m_frame)
+        return;
+    ASSERT(m_frame->page());
+    
+    KURL fullURL = urlForState(urlString);
+    if (!fullURL.isValid()) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    if (stateObjectType == StateObjectPush)
+        m_frame->loader()->history()->pushState(data, title, fullURL.string());
+    else if (stateObjectType == StateObjectReplace)
+        m_frame->loader()->history()->replaceState(data, title, fullURL.string());
+            
+    if (!urlString.isEmpty()) {
+        m_frame->document()->updateURLForPushOrReplaceState(fullURL);
+        if (stateObjectType == StateObjectPush)
+            m_frame->loader()->client()->dispatchDidPushStateWithinPage();
+        else if (stateObjectType == StateObjectReplace)
+            m_frame->loader()->client()->dispatchDidReplaceStateWithinPage();
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/History.h b/WebCore/page/History.h
index f0df2de..66a6a03 100644
--- a/WebCore/page/History.h
+++ b/WebCore/page/History.h
@@ -26,30 +26,42 @@
 #ifndef History_h
 #define History_h
 
+#include "KURL.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-    class Frame;
+class Frame;
+class SerializedScriptValue;
+class String;
+typedef int ExceptionCode;
 
-    class History : public RefCounted<History> {
-    public:
-        static PassRefPtr<History> create(Frame* frame) { return adoptRef(new History(frame)); }
-        
-        Frame* frame() const;
-        void disconnectFrame();
+class History : public RefCounted<History> {
+public:
+    static PassRefPtr<History> create(Frame* frame) { return adoptRef(new History(frame)); }
+    
+    Frame* frame() const;
+    void disconnectFrame();
 
-        unsigned length() const;
-        void back();
-        void forward();
-        void go(int distance);
+    unsigned length() const;
+    void back();
+    void forward();
+    void go(int distance);
 
-    private:
-        History(Frame*);
-
-        Frame* m_frame;
+    enum StateObjectType {
+        StateObjectPush,
+        StateObjectReplace
     };
+    void stateObjectAdded(PassRefPtr<SerializedScriptValue>, const String& title, const String& url, StateObjectType, ExceptionCode&);
+
+private:
+    History(Frame*);
+
+    KURL urlForState(const String& url);
+
+    Frame* m_frame;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/page/History.idl b/WebCore/page/History.idl
index 914d441..3790552 100644
--- a/WebCore/page/History.idl
+++ b/WebCore/page/History.idl
@@ -39,6 +39,11 @@ module window {
         [DoNotCheckDomainSecurity] void back();
         [DoNotCheckDomainSecurity] void forward();
         [DoNotCheckDomainSecurity] void go(in long distance);
+        
+        [Custom] void pushState(in any data, in DOMString title, in optional DOMString url)
+            raises(DOMException);
+        [Custom] void replaceState(in any data, in DOMString title, in optional DOMString url)
+            raises(DOMException);
     };
 
 }
diff --git a/WebCore/page/MouseEventWithHitTestResults.h b/WebCore/page/MouseEventWithHitTestResults.h
index 7330d93..8c28574 100644
--- a/WebCore/page/MouseEventWithHitTestResults.h
+++ b/WebCore/page/MouseEventWithHitTestResults.h
@@ -1,4 +1,4 @@
-/* This file is part of the KDE project
+/* 
    Copyright (C) 2000 Simon Hausmann <hausmann@kde.org>
    Copyright (C) 2006 Apple Computer, Inc.
 
diff --git a/WebCore/page/Navigator.cpp b/WebCore/page/Navigator.cpp
index 4922860..a4193fc 100644
--- a/WebCore/page/Navigator.cpp
+++ b/WebCore/page/Navigator.cpp
@@ -24,10 +24,12 @@
 #include "Navigator.h"
 
 #include "CookieJar.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "Geolocation.h"
+#include "KURL.h"
 #include "Language.h"
 #include "MimeTypeArray.h"
 #include "Page.h"
@@ -169,4 +171,93 @@ void Navigator::getStorageUpdates()
 }
 #endif
 
+static bool verifyCustomHandlerURL(const String& baseURL, const String& url, ExceptionCode& ec)
+{
+    // The specification requires that it is a SYNTAX_ERR if the the "%s" token is not present.
+    static const char token[] = "%s";
+    int index = url.find(token);
+    if (-1 == index) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // It is also a SYNTAX_ERR if the custom handler URL, as created by removing
+    // the "%s" token and prepending the base url, does not resolve.
+    String newURL = url;
+    newURL.remove(index, sizeof(token) / sizeof(token[0]));
+
+    KURL base(ParsedURLString, baseURL);
+    KURL kurl(base, newURL);
+
+    if (kurl.isEmpty() || !kurl.isValid()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    return true;
+}
+
+static bool verifyProtocolHandlerScheme(const String& scheme, ExceptionCode& ec)
+{
+    // It is a SECURITY_ERR for these schemes to be handled by a custom handler.
+    if (equalIgnoringCase(scheme, "http") || equalIgnoringCase(scheme, "https") || equalIgnoringCase(scheme, "file")) {
+        ec = SECURITY_ERR;
+        return false;
+    }
+    return true;
+}
+
+void Navigator::registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!verifyProtocolHandlerScheme(scheme, ec))
+        return;
+
+    if (!m_frame)
+        return;
+
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    if (Page* page = m_frame->page())
+        page->chrome()->registerProtocolHandler(scheme, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
+}
+
+static bool verifyProtocolHandlerMimeType(const String& type, ExceptionCode& ec)
+{
+    // It is a SECURITY_ERR for these mime types to be assigned to a custom
+    // handler.
+    if (equalIgnoringCase(type, "text/html") || equalIgnoringCase(type, "text/css") || equalIgnoringCase(type, "application/x-javascript")) {
+        ec = SECURITY_ERR;
+        return false;
+    }
+    return true;
+}
+
+void Navigator::registerContentHandler(const String& mimeType, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!verifyProtocolHandlerMimeType(mimeType, ec))
+        return;
+
+    if (!m_frame)
+        return;
+
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    if (Page* page = m_frame->page())
+        page->chrome()->registerContentHandler(mimeType, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/Navigator.h b/WebCore/page/Navigator.h
index 4adebe1..107082b 100644
--- a/WebCore/page/Navigator.h
+++ b/WebCore/page/Navigator.h
@@ -34,6 +34,8 @@ namespace WebCore {
     class PluginArray;
     class String;
 
+    typedef int ExceptionCode;
+
     class Navigator : public NavigatorBase, public RefCounted<Navigator> {
     public:
         static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
@@ -60,6 +62,9 @@ namespace WebCore {
         void getStorageUpdates();
 #endif
 
+        void registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec);
+        void registerContentHandler(const String& mimeType, const String& url, const String& title, ExceptionCode& ec);
+
     private:
         Navigator(Frame*);
         Frame* m_frame;
diff --git a/WebCore/page/Navigator.idl b/WebCore/page/Navigator.idl
index 80ef4fb..99b22af 100644
--- a/WebCore/page/Navigator.idl
+++ b/WebCore/page/Navigator.idl
@@ -46,6 +46,11 @@ module window {
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         void getStorageUpdates();
 #endif
+
+        void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
+            raises(DomException);
+        void registerContentHandler(in DOMString mimeType, in DOMString url, in DOMString title)
+            raises(DomException);
     };
 
 }
diff --git a/WebCore/page/Page.cpp b/WebCore/page/Page.cpp
index 8a685f4..c4f33d6 100644
--- a/WebCore/page/Page.cpp
+++ b/WebCore/page/Page.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "Page.h"
 
+#include "BackForwardList.h"
 #include "Base64.h"
 #include "CSSStyleSelector.h"
 #include "Chrome.h"
@@ -277,20 +278,30 @@ void Page::goBackOrForward(int distance)
 
 void Page::goToItem(HistoryItem* item, FrameLoadType type)
 {
-    // Abort any current load if we're going to a history item
+#if !ASSERT_DISABLED
+    // If we're navigating to an item with history state for a Document other than the
+    // current Document, the new Document had better be in the page cache.
+    if (item->stateObject() && item->document() != m_mainFrame->document())
+        ASSERT(item->document()->inPageCache());
+#endif
 
-    // Define what to do with any open database connections. By default we stop them and terminate the database thread.
-    DatabasePolicy databasePolicy = DatabasePolicyStop;
+    // Abort any current load unless we're navigating the current document to a new state object
+    if (!item->stateObject() || item->document() != m_mainFrame->document()) {
+        // Define what to do with any open database connections. By default we stop them and terminate the database thread.
+        DatabasePolicy databasePolicy = DatabasePolicyStop;
 
 #if ENABLE(DATABASE)
-    // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
-    const KURL& currentURL = m_mainFrame->loader()->url();
-    const KURL& newURL = item->url();
-
-    if (newURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(currentURL, newURL))
-        databasePolicy = DatabasePolicyContinue;
+        // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
+        const KURL& currentURL = m_mainFrame->loader()->url();
+        const KURL& newURL = item->url();
+    
+        if (newURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(currentURL, newURL))
+            databasePolicy = DatabasePolicyContinue;
 #endif
-    m_mainFrame->loader()->stopAllLoaders(databasePolicy);
+
+        m_mainFrame->loader()->stopAllLoaders(databasePolicy);
+    }
+        
     m_mainFrame->loader()->history()->goToItem(item, type);
 }
 
@@ -542,7 +553,7 @@ void Page::userStyleSheetLocationChanged()
 
         Vector<char> styleSheetAsUTF8;
         if (base64Decode(encodedData, styleSheetAsUTF8))
-            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data());
+            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data(), styleSheetAsUTF8.size());
     }
     
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
diff --git a/WebCore/page/PageGroup.cpp b/WebCore/page/PageGroup.cpp
index 427c240..558c5cb 100644
--- a/WebCore/page/PageGroup.cpp
+++ b/WebCore/page/PageGroup.cpp
@@ -200,29 +200,29 @@ StorageNamespace* PageGroup::localStorage()
 }
 #endif
 
-void PageGroup::addUserScriptToWorld(unsigned worldID, const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
+void PageGroup::addUserScriptToWorld(DOMWrapperWorld* world, const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
                                      PassOwnPtr<Vector<String> > blacklist, UserScriptInjectionTime injectionTime)
 {
-    if (worldID == UINT_MAX)
-        return;
-    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, worldID, injectionTime));
+    ASSERT_ARG(world, world);
+
+    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, injectionTime));
     if (!m_userScripts)
         m_userScripts.set(new UserScriptMap);
-    UserScriptVector*& scriptsInWorld = m_userScripts->add(worldID, 0).first->second;
+    UserScriptVector*& scriptsInWorld = m_userScripts->add(world, 0).first->second;
     if (!scriptsInWorld)
         scriptsInWorld = new UserScriptVector;
     scriptsInWorld->append(userScript.release());
 }
 
-void PageGroup::addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
+void PageGroup::addUserStyleSheetToWorld(DOMWrapperWorld* world, const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
                                          PassOwnPtr<Vector<String> > blacklist)
 {
-    if (worldID == UINT_MAX)
-        return;
-    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist, worldID));
+    ASSERT_ARG(world, world);
+
+    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist));
     if (!m_userStyleSheets)
         m_userStyleSheets.set(new UserStyleSheetMap);
-    UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(worldID, 0).first->second;
+    UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(world, 0).first->second;
     if (!styleSheetsInWorld)
         styleSheetsInWorld = new UserStyleSheetVector;
     styleSheetsInWorld->append(userStyleSheet.release());
@@ -235,12 +235,14 @@ void PageGroup::addUserStyleSheetToWorld(unsigned worldID, const String& source,
     }
 }
 
-void PageGroup::removeUserScriptFromWorld(unsigned worldID, const KURL& url)
+void PageGroup::removeUserScriptFromWorld(DOMWrapperWorld* world, const KURL& url)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userScripts)
         return;
 
-    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    UserScriptMap::iterator it = m_userScripts->find(world);
     if (it == m_userScripts->end())
         return;
     
@@ -257,12 +259,14 @@ void PageGroup::removeUserScriptFromWorld(unsigned worldID, const KURL& url)
     m_userScripts->remove(it);
 }
 
-void PageGroup::removeUserStyleSheetFromWorld(unsigned worldID, const KURL& url)
+void PageGroup::removeUserStyleSheetFromWorld(DOMWrapperWorld* world, const KURL& url)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userStyleSheets)
         return;
 
-    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(world);
     bool sheetsChanged = false;
     if (it == m_userStyleSheets->end())
         return;
@@ -291,12 +295,14 @@ void PageGroup::removeUserStyleSheetFromWorld(unsigned worldID, const KURL& url)
     }
 }
 
-void PageGroup::removeUserScriptsFromWorld(unsigned worldID)
+void PageGroup::removeUserScriptsFromWorld(DOMWrapperWorld* world)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userScripts)
         return;
 
-    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    UserScriptMap::iterator it = m_userScripts->find(world);
     if (it == m_userScripts->end())
         return;
        
@@ -304,12 +310,14 @@ void PageGroup::removeUserScriptsFromWorld(unsigned worldID)
     m_userScripts->remove(it);
 }
 
-void PageGroup::removeUserStyleSheetsFromWorld(unsigned worldID)
+void PageGroup::removeUserStyleSheetsFromWorld(DOMWrapperWorld* world)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userStyleSheets)
         return;
     
-    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(world);
     if (it == m_userStyleSheets->end())
         return;
     
diff --git a/WebCore/page/PageGroup.h b/WebCore/page/PageGroup.h
index c233cd1..446f0c7 100644
--- a/WebCore/page/PageGroup.h
+++ b/WebCore/page/PageGroup.h
@@ -70,17 +70,17 @@ namespace WebCore {
         bool hasLocalStorage() { return m_localStorage; }
 #endif
 
-        void addUserScriptToWorld(unsigned worldID, const String& source, const KURL&, 
+        void addUserScriptToWorld(DOMWrapperWorld*, const String& source, const KURL&, 
                                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
                                   UserScriptInjectionTime);
-        void addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL&,
+        void addUserStyleSheetToWorld(DOMWrapperWorld*, const String& source, const KURL&,
                                PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist);
         
-        void removeUserScriptFromWorld(unsigned, const KURL&);
-        void removeUserStyleSheetFromWorld(unsigned, const KURL&);
+        void removeUserScriptFromWorld(DOMWrapperWorld*, const KURL&);
+        void removeUserStyleSheetFromWorld(DOMWrapperWorld*, const KURL&);
         
-        void removeUserScriptsFromWorld(unsigned);
-        void removeUserStyleSheetsFromWorld(unsigned);
+        void removeUserScriptsFromWorld(DOMWrapperWorld*);
+        void removeUserStyleSheetsFromWorld(DOMWrapperWorld*);
     
         void removeAllUserContent();
         
diff --git a/WebCore/page/PluginHalter.cpp b/WebCore/page/PluginHalter.cpp
index 63f5469..c0a6452 100644
--- a/WebCore/page/PluginHalter.cpp
+++ b/WebCore/page/PluginHalter.cpp
@@ -28,6 +28,7 @@
 #include "PluginHalter.h"
 
 #include "HaltablePlugin.h"
+#include "PlatformString.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/Vector.h>
 
@@ -93,7 +94,7 @@ void PluginHalter::timerFired(Timer<PluginHalter>*)
             continue;
         }
 
-        if (m_client->shouldHaltPlugin(plugins[i]->node()))
+        if (m_client->shouldHaltPlugin(plugins[i]->node(), plugins[i]->isWindowed(), plugins[i]->pluginName()))
             plugins[i]->halt();
 
         m_plugins.remove(plugins[i]);
diff --git a/WebCore/page/PluginHalter.h b/WebCore/page/PluginHalter.h
index eddce34..af8b31e 100644
--- a/WebCore/page/PluginHalter.h
+++ b/WebCore/page/PluginHalter.h
@@ -35,7 +35,7 @@ namespace WebCore {
 
 class HaltablePlugin;
 
-class PluginHalter {
+class PluginHalter : public Noncopyable {
 public:
     PluginHalter(PluginHalterClient*);
 
diff --git a/WebCore/page/PluginHalterClient.h b/WebCore/page/PluginHalterClient.h
index f77091f..0251547 100644
--- a/WebCore/page/PluginHalterClient.h
+++ b/WebCore/page/PluginHalterClient.h
@@ -29,12 +29,13 @@
 namespace WebCore {
 
 class Node;
+class String;
 
 class PluginHalterClient {
 public:
     virtual ~PluginHalterClient() { }
 
-    virtual bool shouldHaltPlugin(Node*) const = 0;
+    virtual bool shouldHaltPlugin(Node*, bool isWindowed, const String& pluginName) const = 0;
     virtual bool enabled() const = 0;
 };
 
diff --git a/WebCore/page/PositionError.h b/WebCore/page/PositionError.h
index f6f56f0..1467170 100644
--- a/WebCore/page/PositionError.h
+++ b/WebCore/page/PositionError.h
@@ -35,7 +35,6 @@ namespace WebCore {
 class PositionError : public RefCounted<PositionError> {
 public:
     enum ErrorCode {
-        UNKNOWN_ERROR = 0,
         PERMISSION_DENIED = 1,
         POSITION_UNAVAILABLE = 2,
         TIMEOUT = 3
diff --git a/WebCore/page/PositionError.idl b/WebCore/page/PositionError.idl
index cb2ef5e..91027df 100644
--- a/WebCore/page/PositionError.idl
+++ b/WebCore/page/PositionError.idl
@@ -31,7 +31,6 @@ module core {
         readonly attribute unsigned short code;
         readonly attribute DOMString message;
 
-        const unsigned short UNKNOWN_ERROR = 0;
         const unsigned short PERMISSION_DENIED = 1;
         const unsigned short POSITION_UNAVAILABLE = 2;
         const unsigned short TIMEOUT = 3;
diff --git a/WebCore/page/PrintContext.cpp b/WebCore/page/PrintContext.cpp
index bba678a..4d3a839 100644
--- a/WebCore/page/PrintContext.cpp
+++ b/WebCore/page/PrintContext.cpp
@@ -25,7 +25,6 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "RenderView.h"
-#include "Settings.h"
 
 using namespace WebCore;
 
@@ -96,23 +95,18 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
 void PrintContext::begin(float width)
 {
-    float PrintingMinimumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMinimumShrinkFactor() : 0.0f;
-    float PrintingMaximumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMaximumShrinkFactor() : 0.0f;
-
-    if (PrintingMaximumShrinkFactor < PrintingMinimumShrinkFactor || PrintingMinimumShrinkFactor <= 0.0f) {
-        // By imaging to a width a little wider than the available pixels,
-        // thin pages will be scaled down a little, matching the way they
-        // print in IE and Camino. This lets them use fewer sheets than they
-        // would otherwise, which is presumably why other browsers do this.
-        // Wide pages will be scaled down more than this.
-        PrintingMinimumShrinkFactor = 1.25f;
-
-        // This number determines how small we are willing to reduce the page content
-        // in order to accommodate the widest line. If the page would have to be
-        // reduced smaller to make the widest line fit, we just clip instead (this
-        // behavior matches MacIE and Mozilla, at least)
-        PrintingMaximumShrinkFactor = 2.0f;
-    }
+    // By imaging to a width a little wider than the available pixels,
+    // thin pages will be scaled down a little, matching the way they
+    // print in IE and Camino. This lets them use fewer sheets than they
+    // would otherwise, which is presumably why other browsers do this.
+    // Wide pages will be scaled down more than this.
+    const float PrintingMinimumShrinkFactor = 1.25f;
+
+    // This number determines how small we are willing to reduce the page content
+    // in order to accommodate the widest line. If the page would have to be
+    // reduced smaller to make the widest line fit, we just clip instead (this
+    // behavior matches MacIE and Mozilla, at least)
+    const float PrintingMaximumShrinkFactor = 2.0f;
 
     float minLayoutWidth = width * PrintingMinimumShrinkFactor;
     float maxLayoutWidth = width * PrintingMaximumShrinkFactor;
diff --git a/WebCore/page/SecurityOrigin.cpp b/WebCore/page/SecurityOrigin.cpp
index 338bf9f..f53dbf1 100644
--- a/WebCore/page/SecurityOrigin.cpp
+++ b/WebCore/page/SecurityOrigin.cpp
@@ -75,26 +75,11 @@ static URLSchemesMap& noAccessSchemes()
     return noAccessSchemes;
 }
 
-bool SecurityOrigin::isDefaultPortForProtocol(unsigned short port, const String& protocol)
-{
-    if (protocol.isEmpty())
-        return false;
-
-    typedef HashMap<String, unsigned> DefaultPortsMap;
-    DEFINE_STATIC_LOCAL(DefaultPortsMap, defaultPorts, ());
-    if (defaultPorts.isEmpty()) {
-        defaultPorts.set("http", 80);
-        defaultPorts.set("https", 443);
-        defaultPorts.set("ftp", 21);
-        defaultPorts.set("ftps", 990);
-    }
-    return defaultPorts.get(protocol) == port;
-}
-
 SecurityOrigin::SecurityOrigin(const KURL& url)
     : m_protocol(url.protocol().isNull() ? "" : url.protocol().lower())
     , m_host(url.host().isNull() ? "" : url.host().lower())
     , m_port(url.port())
+    , m_sandboxFlags(SandboxNone)
     , m_noAccess(false)
     , m_universalAccess(false)
     , m_domainWasSetInDOM(false)
@@ -112,6 +97,11 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
 
     // By default, only local SecurityOrigins can load local resources.
     m_canLoadLocalResources = isLocal();
+    if (m_canLoadLocalResources) {
+        // Directories should never be readable.
+        if (!url.hasPath() || url.path().endsWith("/"))
+            m_noAccess = true;
+    }
 
     if (isDefaultPortForProtocol(m_port, m_protocol))
         m_port = 0;
@@ -122,6 +112,7 @@ SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
     , m_host(other->m_host.threadsafeCopy())
     , m_domain(other->m_domain.threadsafeCopy())
     , m_port(other->m_port)
+    , m_sandboxFlags(other->m_sandboxFlags)
     , m_noAccess(other->m_noAccess)
     , m_universalAccess(other->m_universalAccess)
     , m_domainWasSetInDOM(other->m_domainWasSetInDOM)
@@ -162,7 +153,7 @@ bool SecurityOrigin::canAccess(const SecurityOrigin* other) const
     if (m_universalAccess)
         return true;
 
-    if (m_noAccess || other->m_noAccess)
+    if (m_noAccess || other->m_noAccess || isSandboxed(SandboxOrigin) || other->isSandboxed(SandboxOrigin))
         return false;
 
     // Here are two cases where we should permit access:
@@ -203,10 +194,12 @@ bool SecurityOrigin::canRequest(const KURL& url) const
     if (m_universalAccess)
         return true;
 
-    if (m_noAccess)
+    if (m_noAccess || isSandboxed(SandboxOrigin))
         return false;
 
     RefPtr<SecurityOrigin> targetOrigin = SecurityOrigin::create(url);
+    if (targetOrigin->m_noAccess)
+        return false;
 
     // We call isSameSchemeHostPort here instead of canAccess because we want
     // to ignore document.domain effects.
@@ -289,7 +282,7 @@ String SecurityOrigin::toString() const
     if (isEmpty())
         return "null";
 
-    if (m_noAccess)
+    if (m_noAccess || isSandboxed(SandboxOrigin))
         return "null";
 
     if (m_protocol == "file")
@@ -399,14 +392,10 @@ void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
     if (scheme == "applewebdata")
         return;
 #endif
-#if PLATFORM(QT)
-    if (scheme == "qrc")
-        return;
-#endif
     localSchemes().remove(scheme);
 }
 
-const URLSchemesMap&  SecurityOrigin::localURLSchemes()
+const URLSchemesMap& SecurityOrigin::localURLSchemes()
 {
     return localSchemes();
 }
diff --git a/WebCore/page/SecurityOrigin.h b/WebCore/page/SecurityOrigin.h
index 6d4ce1f..af83f02 100644
--- a/WebCore/page/SecurityOrigin.h
+++ b/WebCore/page/SecurityOrigin.h
@@ -34,6 +34,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
+#include "FrameLoaderTypes.h"
 #include "PlatformString.h"
 #include "StringHash.h"
 
@@ -110,6 +111,13 @@ namespace WebCore {
         // WARNING: This is an extremely powerful ability.  Use with caution!
         void grantUniversalAccess();
 
+        // Sandboxing status as determined by the frame.
+        void setSandboxFlags(SandboxFlags flags) { m_sandboxFlags = flags; }
+        bool isSandboxed(SandboxFlags mask) const { return m_sandboxFlags & mask; }
+
+        bool canAccessDatabase() const { return !isSandboxed(SandboxOrigin); }
+        bool canAccessStorage() const { return !isSandboxed(SandboxOrigin); }
+
         bool isSecureTransitionTo(const KURL&) const;
 
         // The local SecurityOrigin is the most privileged SecurityOrigin.
@@ -123,8 +131,14 @@ namespace WebCore {
         // Convert this SecurityOrigin into a string.  The string
         // representation of a SecurityOrigin is similar to a URL, except it
         // lacks a path component.  The string representation does not encode
-        // the value of the SecurityOrigin's domain property.  The empty
-        // SecurityOrigin is represented with the string "null".
+        // the value of the SecurityOrigin's domain property.
+        //
+        // When using the string value, it's important to remember that it
+        // might be "null".  This happens when this SecurityOrigin has
+        // noAccess to other SecurityOrigins.  For example, this SecurityOrigin
+        // might have come from a data URL, the SecurityOrigin might be empty,
+        // or we might have explicitly decided that we
+        // shouldTreatURLSchemeAsNoAccess.
         String toString() const;
 
         // Serialize the security origin to a string that could be used as part of
@@ -165,8 +179,6 @@ namespace WebCore {
         static void whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains);
         static void resetOriginAccessWhiteLists();
 
-        static bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
-
     private:
         explicit SecurityOrigin(const KURL&);
         explicit SecurityOrigin(const SecurityOrigin*);
@@ -175,6 +187,7 @@ namespace WebCore {
         String m_host;
         String m_domain;
         unsigned short m_port;
+        SandboxFlags m_sandboxFlags;
         bool m_noAccess;
         bool m_universalAccess;
         bool m_domainWasSetInDOM;
diff --git a/WebCore/page/Settings.cpp b/WebCore/page/Settings.cpp
index 3964d74..b250e4d 100644
--- a/WebCore/page/Settings.cpp
+++ b/WebCore/page/Settings.cpp
@@ -75,8 +75,6 @@ Settings::Settings(Page* page)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
     , m_localStorageQuota(5 * 1024 * 1024)  // Suggested by the HTML5 spec.
     , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
-    , m_printingMinimumShrinkFactor(0.0f)
-    , m_printingMaximumShrinkFactor(0.0f)
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
@@ -84,7 +82,6 @@ Settings::Settings(Page* page)
     , m_arePluginsEnabled(false)
     , m_databasesEnabled(false)
     , m_localStorageEnabled(false)
-    , m_sessionStorageEnabled(true)
     , m_isJavaScriptEnabled(false)
     , m_isWebSecurityEnabled(true)
     , m_allowUniversalAccessFromFileURLs(true)
@@ -130,8 +127,11 @@ Settings::Settings(Page* page)
     , m_downloadableBinaryFontsEnabled(true)
     , m_xssAuditorEnabled(false)
     , m_acceleratedCompositingEnabled(true)
+    , m_showDebugBorders(false)
+    , m_showRepaintCounter(false)
     , m_experimentalNotificationsEnabled(false)
     , m_webGLEnabled(false)
+    , m_geolocationEnabled(true)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -278,11 +278,6 @@ void Settings::setLocalStorageEnabled(bool localStorageEnabled)
     m_localStorageEnabled = localStorageEnabled;
 }
 
-void Settings::setSessionStorageEnabled(bool sessionStorageEnabled)
-{
-    m_sessionStorageEnabled = sessionStorageEnabled;
-}
-
 void Settings::setLocalStorageQuota(unsigned localStorageQuota)
 {
     m_localStorageQuota = localStorageQuota;
@@ -703,6 +698,24 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
     setNeedsReapplyStylesInAllFrames(m_page);
 }
 
+void Settings::setShowDebugBorders(bool enabled)
+{
+    if (m_showDebugBorders == enabled)
+        return;
+        
+    m_showDebugBorders = enabled;
+    setNeedsReapplyStylesInAllFrames(m_page);
+}
+
+void Settings::setShowRepaintCounter(bool enabled)
+{
+    if (m_showRepaintCounter == enabled)
+        return;
+        
+    m_showRepaintCounter = enabled;
+    setNeedsReapplyStylesInAllFrames(m_page);
+}
+
 void Settings::setExperimentalNotificationsEnabled(bool enabled)
 {
     m_experimentalNotificationsEnabled = enabled;
@@ -726,14 +739,9 @@ void Settings::setWebGLEnabled(bool enabled)
     m_webGLEnabled = enabled;
 }
 
-void Settings::setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor)
-{
-    m_printingMinimumShrinkFactor = printingMinimumShrinkFactor;
-}    
-
-void Settings::setPrintingMaximumShrinkFactor(float printingMaximumShrinkFactor)
+void Settings::setGeolocationEnabled(bool enabled)
 {
-    m_printingMaximumShrinkFactor = printingMaximumShrinkFactor;
-}    
+    m_geolocationEnabled = enabled;
+}
 
 } // namespace WebCore
diff --git a/WebCore/page/Settings.h b/WebCore/page/Settings.h
index de1030d..fbb70b0 100644
--- a/WebCore/page/Settings.h
+++ b/WebCore/page/Settings.h
@@ -64,7 +64,7 @@ namespace WebCore {
     // if possible in the future.
     enum EditingBehavior { EditingMacBehavior, EditingWindowsBehavior };
 
-    class Settings {
+    class Settings : public Noncopyable {
     public:
         Settings(Page*);
 
@@ -148,9 +148,6 @@ namespace WebCore {
         void setLocalStorageEnabled(bool);
         bool localStorageEnabled() const { return m_localStorageEnabled; }
 
-        void setSessionStorageEnabled(bool);
-        bool sessionStorageEnabled() const { return m_sessionStorageEnabled; }
-
         void setLocalStorageQuota(unsigned);
         unsigned localStorageQuota() const { return m_localStorageQuota; }
 
@@ -317,6 +314,12 @@ namespace WebCore {
         void setAcceleratedCompositingEnabled(bool);
         bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
 
+        void setShowDebugBorders(bool);
+        bool showDebugBorders() const { return m_showDebugBorders; }
+
+        void setShowRepaintCounter(bool);
+        bool showRepaintCounter() const { return m_showRepaintCounter; }
+
         void setExperimentalNotificationsEnabled(bool);
         bool experimentalNotificationsEnabled() const { return m_experimentalNotificationsEnabled; }
 
@@ -331,11 +334,8 @@ namespace WebCore {
         void setWebGLEnabled(bool);
         bool webGLEnabled() const { return m_webGLEnabled; }
 
-        void setPrintingMinimumShrinkFactor(float);
-        float printingMinimumShrinkFactor() const { return m_printingMinimumShrinkFactor; }
-
-        void setPrintingMaximumShrinkFactor(float);
-        float printingMaximumShrinkFactor() const { return m_printingMaximumShrinkFactor; }
+        void setGeolocationEnabled(bool);
+        bool geolocationEnabled() const { return m_geolocationEnabled; }
 
     private:
         Page* m_page;
@@ -396,8 +396,6 @@ namespace WebCore {
         size_t m_maximumDecodedImageSize;
         unsigned m_localStorageQuota;
         unsigned m_pluginAllowedRunTime;
-        float m_printingMinimumShrinkFactor;
-        float m_printingMaximumShrinkFactor;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
@@ -405,7 +403,6 @@ namespace WebCore {
         bool m_arePluginsEnabled : 1;
         bool m_databasesEnabled : 1;
         bool m_localStorageEnabled : 1;
-        bool m_sessionStorageEnabled : 1;
         bool m_isJavaScriptEnabled : 1;
         bool m_isWebSecurityEnabled : 1;
         bool m_allowUniversalAccessFromFileURLs: 1;
@@ -442,8 +439,11 @@ namespace WebCore {
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
+        bool m_showDebugBorders : 1;
+        bool m_showRepaintCounter : 1;
         bool m_experimentalNotificationsEnabled : 1;
         bool m_webGLEnabled : 1;
+        bool m_geolocationEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/WebCore/page/UserScript.h b/WebCore/page/UserScript.h
index dbbb879..8b3703f 100644
--- a/WebCore/page/UserScript.h
+++ b/WebCore/page/UserScript.h
@@ -34,16 +34,15 @@
 
 namespace WebCore {
 
-class UserScript {
+class UserScript : public Noncopyable {
 public:
     UserScript(const String& source, const KURL& url,
                PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-               unsigned worldID, UserScriptInjectionTime injectionTime)
+               UserScriptInjectionTime injectionTime)
         : m_source(source)
         , m_url(url)
         , m_whitelist(whitelist)
         , m_blacklist(blacklist)
-        , m_worldID(worldID)
         , m_injectionTime(injectionTime)
     {
     }
@@ -52,7 +51,6 @@ public:
     const KURL& url() const { return m_url; }
     const Vector<String>* whitelist() const { return m_whitelist.get(); }
     const Vector<String>* blacklist() const { return m_blacklist.get(); }
-    unsigned worldID() const { return m_worldID; }
     UserScriptInjectionTime injectionTime() const { return m_injectionTime; }
     
 private:
@@ -60,7 +58,6 @@ private:
     KURL m_url;
     OwnPtr<Vector<String> > m_whitelist;
     OwnPtr<Vector<String> > m_blacklist;
-    unsigned m_worldID;
     UserScriptInjectionTime m_injectionTime;
 };
 
diff --git a/WebCore/page/UserScriptTypes.h b/WebCore/page/UserScriptTypes.h
index ac37662..ad27e79 100644
--- a/WebCore/page/UserScriptTypes.h
+++ b/WebCore/page/UserScriptTypes.h
@@ -33,10 +33,11 @@ namespace WebCore {
 
 enum UserScriptInjectionTime { InjectAtDocumentStart, InjectAtDocumentEnd };
 
+class DOMWrapperWorld;
 class UserScript;
 
 typedef Vector<OwnPtr<UserScript> > UserScriptVector;
-typedef HashMap<unsigned, UserScriptVector*> UserScriptMap;
+typedef HashMap<RefPtr<DOMWrapperWorld>, UserScriptVector*> UserScriptMap;
 
 } // namespace WebCore
  
diff --git a/WebCore/page/UserStyleSheet.h b/WebCore/page/UserStyleSheet.h
index 56bec40..610778f 100644
--- a/WebCore/page/UserStyleSheet.h
+++ b/WebCore/page/UserStyleSheet.h
@@ -34,16 +34,14 @@
 
 namespace WebCore {
 
-class UserStyleSheet {
+class UserStyleSheet : public Noncopyable {
 public:
     UserStyleSheet(const String& source, const KURL& url,
-                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-                   unsigned worldID)
+                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist)
         : m_source(source)
         , m_url(url)
         , m_whitelist(whitelist)
         , m_blacklist(blacklist)
-        , m_worldID(worldID)
     {
     }
 
@@ -51,14 +49,12 @@ public:
     const KURL& url() const { return m_url; }
     const Vector<String>* whitelist() const { return m_whitelist.get(); }
     const Vector<String>* blacklist() const { return m_blacklist.get(); }
-    unsigned worldID() const { return m_worldID; }
 
 private:
     String m_source;
     KURL m_url;
     OwnPtr<Vector<String> > m_whitelist;
     OwnPtr<Vector<String> > m_blacklist;
-    unsigned m_worldID;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/UserStyleSheetTypes.h b/WebCore/page/UserStyleSheetTypes.h
index 094b2cf..ef662f2 100644
--- a/WebCore/page/UserStyleSheetTypes.h
+++ b/WebCore/page/UserStyleSheetTypes.h
@@ -31,10 +31,11 @@
 
 namespace WebCore {
 
+class DOMWrapperWorld;
 class UserStyleSheet;
 
 typedef Vector<OwnPtr<UserStyleSheet> > UserStyleSheetVector;
-typedef HashMap<unsigned, UserStyleSheetVector*> UserStyleSheetMap;
+typedef HashMap<RefPtr<DOMWrapperWorld>, UserStyleSheetVector*> UserStyleSheetMap;
 
 } // namespace WebCore
  
diff --git a/WebCore/page/XSSAuditor.cpp b/WebCore/page/XSSAuditor.cpp
index 890c3fa..72c2591 100644
--- a/WebCore/page/XSSAuditor.cpp
+++ b/WebCore/page/XSSAuditor.cpp
@@ -144,14 +144,7 @@ bool XSSAuditor::canLoadExternalScriptFromSrc(const String& context, const Strin
     if (!isEnabled())
         return true;
 
-    // If the script is loaded from the same URL as the enclosing page, it's
-    // probably not an XSS attack, so we reduce false positives by allowing the
-    // script. If the script has a query string, we're more suspicious,
-    // however, because that's pretty rare and the attacker might be able to
-    // trick a server-side script into doing something dangerous with the query
-    // string.
-    KURL scriptURL(m_frame->document()->url(), url);
-    if (m_frame->document()->url().host() == scriptURL.host() && scriptURL.query().isEmpty())
+    if (isSameOriginResource(url))
         return true;
 
     if (findInRequest(context + url)) {
@@ -167,8 +160,11 @@ bool XSSAuditor::canLoadObject(const String& url) const
     if (!isEnabled())
         return true;
 
+    if (isSameOriginResource(url))
+        return true;
+
     if (findInRequest(url)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
+        String consoleMessage = String::format("Refused to load an object. URL found within request: \"%s\".\n", url.utf8().data());
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
@@ -179,10 +175,12 @@ bool XSSAuditor::canSetBaseElementURL(const String& url) const
 {
     if (!isEnabled())
         return true;
-    
-    KURL baseElementURL(m_frame->document()->url(), url);
-    if (m_frame->document()->url().host() != baseElementURL.host() && findInRequest(url)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
+
+    if (isSameOriginResource(url))
+        return true;
+
+    if (findInRequest(url)) {
+        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to load from document base URL. URL found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
@@ -255,6 +253,18 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
     return String::adopt(result);
 }
 
+bool XSSAuditor::isSameOriginResource(const String& url) const
+{
+    // If the resource is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // request. If the resource has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL resourceURL(m_frame->document()->url(), url);
+    return (m_frame->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
+}
+
 bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
                                bool decodeURLEscapeSequencesTwice) const
 {
diff --git a/WebCore/page/XSSAuditor.h b/WebCore/page/XSSAuditor.h
index adfa5c7..b64665b 100644
--- a/WebCore/page/XSSAuditor.h
+++ b/WebCore/page/XSSAuditor.h
@@ -42,14 +42,14 @@ namespace WebCore {
     // a script is to be allowed or denied based on the content of any
     // user-submitted data, including:
     //
-    // * the query string of the URL.
+    // * the URL.
     // * the HTTP-POST data.
     //
     // If the source code of a script resembles any user-submitted data then it
     // is denied execution.
     //
-    // When you instantiate the XSSAuditor you must specify the {@link Frame}
-    // of the page that you wish to audit.
+    // When you instantiate the XSSAuditor you must specify the Frame of the
+    // page that you wish to audit.
     //
     // Bindings
     //
@@ -59,11 +59,14 @@ namespace WebCore {
     // JavaScript script is safe to execute before executing it. The following
     // methods call into XSSAuditor:
     //
-    // * ScriptController::evaluate - used to evaluate JavaScript scripts.
-    // * ScriptController::createInlineEventListener - used to create JavaScript event handlers.
-    // * HTMLTokenizer::scriptHandler - used to load external JavaScript scripts.
+    // * ScriptController::evaluateInWorld - used to evaluate JavaScript scripts.
+    // * ScriptController::executeIfJavaScriptURL - used to evaluate JavaScript URLs.
+    // * ScriptEventListener::createAttributeEventListener - used to create JavaScript event handlers.
+    // * HTMLBaseElement::process - used to set the document base URL.
+    // * HTMLTokenizer::parseTag - used to load external JavaScript scripts.
+    // * FrameLoader::requestObject - used to load <object>/<embed> elements.
     //
-    class XSSAuditor {
+    class XSSAuditor : public Noncopyable {
     public:
         XSSAuditor(Frame*);
         ~XSSAuditor();
@@ -122,6 +125,7 @@ namespace WebCore {
                                 bool decodeURLEscapeSequencesTwice = false);
         static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
+        bool isSameOriginResource(const String& url) const;
         bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
                            bool decodeURLEscapeSequencesTwice = false) const;
         bool findInRequest(Frame*, const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
diff --git a/WebCore/page/animation/AnimationBase.cpp b/WebCore/page/animation/AnimationBase.cpp
index 59797da..f1ee750 100644
--- a/WebCore/page/animation/AnimationBase.cpp
+++ b/WebCore/page/animation/AnimationBase.cpp
@@ -190,7 +190,7 @@ class PropertyWrapperBase;
 static void addShorthandProperties();
 static PropertyWrapperBase* wrapperForProperty(int propertyID);
 
-class PropertyWrapperBase {
+class PropertyWrapperBase : public Noncopyable {
 public:
     PropertyWrapperBase(int prop)
         : m_prop(prop)
diff --git a/WebCore/page/animation/KeyframeAnimation.cpp b/WebCore/page/animation/KeyframeAnimation.cpp
index 7e37e5f..500bf6f 100644
--- a/WebCore/page/animation/KeyframeAnimation.cpp
+++ b/WebCore/page/animation/KeyframeAnimation.cpp
@@ -36,6 +36,7 @@
 #include "EventNames.h"
 #include "RenderLayer.h"
 #include "RenderLayerBacking.h"
+#include "RenderStyle.h"
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
diff --git a/WebCore/page/animation/KeyframeAnimation.h b/WebCore/page/animation/KeyframeAnimation.h
index 4905fc3..e3b8f53 100644
--- a/WebCore/page/animation/KeyframeAnimation.h
+++ b/WebCore/page/animation/KeyframeAnimation.h
@@ -32,10 +32,11 @@
 #include "AnimationBase.h"
 #include "Document.h"
 #include "KeyframeList.h"
-#include "RenderStyle.h"
 
 namespace WebCore {
 
+class RenderStyle;
+
 // A KeyframeAnimation tracks the state of an explicit animation
 // for a single RenderObject.
 class KeyframeAnimation : public AnimationBase {
diff --git a/WebCore/page/chromium/EventHandlerChromium.cpp b/WebCore/page/chromium/EventHandlerChromium.cpp
index 467f94e..ac76a29 100644
--- a/WebCore/page/chromium/EventHandlerChromium.cpp
+++ b/WebCore/page/chromium/EventHandlerChromium.cpp
@@ -154,4 +154,14 @@ unsigned EventHandler::accessKeyModifiers()
 #endif
 }
 
+#if PLATFORM(LINUX)
+// GTK+ must scroll horizontally if the mouse pointer is on top of the
+// horizontal scrollbar while scrolling with the wheel.
+// This code comes from gtk/EventHandlerGtk.cpp.
+bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult& result) const
+{
+    return result.scrollbar() && result.scrollbar()->orientation() == HorizontalScrollbar;
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/page/mac/ChromeMac.mm b/WebCore/page/mac/ChromeMac.mm
index aba3449..14c07de 100644
--- a/WebCore/page/mac/ChromeMac.mm
+++ b/WebCore/page/mac/ChromeMac.mm
@@ -25,6 +25,8 @@
 
 namespace WebCore {
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 void Chrome::focusNSView(NSView* view)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -48,4 +50,6 @@ void Chrome::focusNSView(NSView* view)
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/page/mac/DragControllerMac.mm b/WebCore/page/mac/DragControllerMac.mm
index 8a04809..adf89fa 100644
--- a/WebCore/page/mac/DragControllerMac.mm
+++ b/WebCore/page/mac/DragControllerMac.mm
@@ -42,6 +42,15 @@ const int DragController::DragIconBottomInset = 3;
 
 const float DragController::DragImageAlpha = 0.75f;
 
+#if ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
+DragOperation DragController::dragOperation(DragData*)
+{
+    return DragOperationNone;
+} 
+
+#else
+
 bool DragController::isCopyKeyDown()
 {
     return [[NSApp currentEvent] modifierFlags] & NSAlternateKeyMask;
@@ -58,7 +67,9 @@ DragOperation DragController::dragOperation(DragData* dragData)
         return DragOperationCopy;
 
     return DragOperationNone;
-} 
+}
+
+#endif
 
 const IntSize& DragController::maxDragImageSize()
 {
diff --git a/WebCore/page/mac/EventHandlerMac.mm b/WebCore/page/mac/EventHandlerMac.mm
index 7da1d36..92895d9 100644
--- a/WebCore/page/mac/EventHandlerMac.mm
+++ b/WebCore/page/mac/EventHandlerMac.mm
@@ -64,6 +64,8 @@ namespace WebCore {
 const double EventHandler::TextDragDelay = 0.15;
 #endif
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 static RetainPtr<NSEvent>& currentNSEventSlot()
 {
     DEFINE_STATIC_LOCAL(RetainPtr<NSEvent>, event, ());
@@ -136,65 +138,6 @@ PassRefPtr<KeyboardEvent> EventHandler::currentKeyboardEvent() const
     }
 }
 
-static inline bool isKeyboardOptionTab(KeyboardEvent* event)
-{
-    return event
-        && (event->type() == eventNames().keydownEvent || event->type() == eventNames().keypressEvent)
-        && event->altKey()
-        && event->keyIdentifier() == "U+0009";    
-}
-
-bool EventHandler::invertSenseOfTabsToLinks(KeyboardEvent* event) const
-{
-    return isKeyboardOptionTab(event);
-}
-
-bool EventHandler::tabsToAllControls(KeyboardEvent* event) const
-{
-    Page* page = m_frame->page();
-    if (!page)
-        return false;
-
-    KeyboardUIMode keyboardUIMode = page->chrome()->client()->keyboardUIMode();
-    bool handlingOptionTab = isKeyboardOptionTab(event);
-
-    // If tab-to-links is off, option-tab always highlights all controls
-    if ((keyboardUIMode & KeyboardAccessTabsToLinks) == 0 && handlingOptionTab)
-        return true;
-    
-    // If system preferences say to include all controls, we always include all controls
-    if (keyboardUIMode & KeyboardAccessFull)
-        return true;
-    
-    // Otherwise tab-to-links includes all controls, unless the sense is flipped via option-tab.
-    if (keyboardUIMode & KeyboardAccessTabsToLinks)
-        return !handlingOptionTab;
-    
-    return handlingOptionTab;
-}
-
-bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
-{
-    Document* document = m_frame->document();
-
-    // RSS view needs arrow key keypress events.
-    if (applicationIsSafari() && document->url().protocolIs("feed") || document->url().protocolIs("feeds"))
-        return true;
-    Settings* settings = m_frame->settings();
-    if (!settings)
-        return false;
-
-#if ENABLE(DASHBOARD_SUPPORT)
-    if (settings->usesDashboardBackwardCompatibilityMode())
-        return true;
-#endif
-        
-    if (settings->needsKeyboardEventDisambiguationQuirks())
-        return true;
-
-    return false;
-}
-
 bool EventHandler::keyEvent(NSEvent *event)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -369,11 +312,6 @@ NSView *EventHandler::mouseDownViewIfStillGood()
     return mouseDownView;
 }
 
-bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
-{
-    return m_activationEventNumber == event.eventNumber();
-}
-
 #if ENABLE(DRAG_SUPPORT)
 bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
 {
@@ -393,15 +331,6 @@ bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResult
     
     return true;
 }
-    
-PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const 
-{
-    NSPasteboard *pasteboard = [NSPasteboard pasteboardWithName:NSDragPboard];
-    // Must be done before ondragstart adds types and data to the pboard,
-    // also done for security, as it erases data from the last drag
-    [pasteboard declareTypes:[NSArray array] owner:nil];
-    return ClipboardMac::create(true, pasteboard, ClipboardWritable, m_frame);
-}
 #endif // ENABLE(DRAG_SUPPORT)
     
 bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResults&)
@@ -697,17 +626,6 @@ bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults&
     return passSubframeEventToSubframe(mev, subframe);
 }
 
-unsigned EventHandler::accessKeyModifiers()
-{
-    // Control+Option key combinations are usually unused on Mac OS X, but not when VoiceOver is enabled.
-    // So, we use Control in this case, even though it conflicts with Emacs-style key bindings.
-    // See <https://bugs.webkit.org/show_bug.cgi?id=21107> for more detail.
-    if (AXObjectCache::accessibilityEnhancedUserInterfaceEnabled())
-        return PlatformKeyboardEvent::CtrlKey;
-
-    return PlatformKeyboardEvent::CtrlKey | PlatformKeyboardEvent::AltKey;
-}
-
 PlatformMouseEvent EventHandler::currentPlatformMouseEvent() const
 {
     NSView *windowView = nil;
@@ -736,4 +654,144 @@ bool EventHandler::eventMayStartDrag(NSEvent *event)
 }
 #endif // ENABLE(DRAG_SUPPORT)
 
+bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
+{
+    return m_activationEventNumber == event.eventNumber();
+}
+
+#else // ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
+bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
+{
+    subframe->eventHandler()->handleMousePressEvent(mev.event());
+    return true;
+}
+
+bool EventHandler::passMouseMoveEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe, HitTestResult* hoveredNode)
+{
+    if (m_mouseDownMayStartDrag && !m_mouseDownWasInSubframe)
+        return false;
+    subframe->eventHandler()->handleMouseMoveEvent(mev.event(), hoveredNode);
+    return true;
+}
+
+bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
+{
+    subframe->eventHandler()->handleMouseReleaseEvent(mev.event());
+    return true;
+}
+
+bool EventHandler::passWheelEventToWidget(PlatformWheelEvent& wheelEvent, Widget* widget)
+{
+    if (!widget->isFrameView())
+        return false;
+
+    return static_cast<FrameView*>(widget)->frame()->eventHandler()->handleWheelEvent(wheelEvent);
+}
+
+void EventHandler::focusDocumentView()
+{
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+    page->focusController()->setFocusedFrame(m_frame);
+}
+
+bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults&)
+{
+    notImplemented();
+    return false;
+}
+
+bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
+{
+    notImplemented();
+    return false;
+}
+
+#endif
+
+#if ENABLE(DRAG_SUPPORT)
+
+PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
+{
+    NSPasteboard *pasteboard = [NSPasteboard pasteboardWithName:NSDragPboard];
+    // Must be done before ondragstart adds types and data to the pboard,
+    // also done for security, as it erases data from the last drag
+    [pasteboard declareTypes:[NSArray array] owner:nil];
+    return ClipboardMac::create(true, pasteboard, ClipboardWritable, m_frame);
+}
+
+#endif
+
+static inline bool isKeyboardOptionTab(KeyboardEvent* event)
+{
+    return event
+        && (event->type() == eventNames().keydownEvent || event->type() == eventNames().keypressEvent)
+        && event->altKey()
+        && event->keyIdentifier() == "U+0009";    
+}
+
+bool EventHandler::invertSenseOfTabsToLinks(KeyboardEvent* event) const
+{
+    return isKeyboardOptionTab(event);
+}
+
+bool EventHandler::tabsToAllControls(KeyboardEvent* event) const
+{
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
+
+    KeyboardUIMode keyboardUIMode = page->chrome()->client()->keyboardUIMode();
+    bool handlingOptionTab = isKeyboardOptionTab(event);
+
+    // If tab-to-links is off, option-tab always highlights all controls
+    if ((keyboardUIMode & KeyboardAccessTabsToLinks) == 0 && handlingOptionTab)
+        return true;
+    
+    // If system preferences say to include all controls, we always include all controls
+    if (keyboardUIMode & KeyboardAccessFull)
+        return true;
+    
+    // Otherwise tab-to-links includes all controls, unless the sense is flipped via option-tab.
+    if (keyboardUIMode & KeyboardAccessTabsToLinks)
+        return !handlingOptionTab;
+    
+    return handlingOptionTab;
+}
+
+bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
+{
+    Document* document = m_frame->document();
+
+    // RSS view needs arrow key keypress events.
+    if (applicationIsSafari() && document->url().protocolIs("feed") || document->url().protocolIs("feeds"))
+        return true;
+    Settings* settings = m_frame->settings();
+    if (!settings)
+        return false;
+
+#if ENABLE(DASHBOARD_SUPPORT)
+    if (settings->usesDashboardBackwardCompatibilityMode())
+        return true;
+#endif
+        
+    if (settings->needsKeyboardEventDisambiguationQuirks())
+        return true;
+
+    return false;
+}
+
+unsigned EventHandler::accessKeyModifiers()
+{
+    // Control+Option key combinations are usually unused on Mac OS X, but not when VoiceOver is enabled.
+    // So, we use Control in this case, even though it conflicts with Emacs-style key bindings.
+    // See <https://bugs.webkit.org/show_bug.cgi?id=21107> for more detail.
+    if (AXObjectCache::accessibilityEnhancedUserInterfaceEnabled())
+        return PlatformKeyboardEvent::CtrlKey;
+
+    return PlatformKeyboardEvent::CtrlKey | PlatformKeyboardEvent::AltKey;
+}
+
 }
diff --git a/WebCore/page/mac/FrameMac.mm b/WebCore/page/mac/FrameMac.mm
index d9faa8b..fce5704 100644
--- a/WebCore/page/mac/FrameMac.mm
+++ b/WebCore/page/mac/FrameMac.mm
@@ -271,7 +271,9 @@ NSImage* Frame::imageFromRect(NSRect rect) const
     if (![view respondsToSelector:@selector(drawSingleRect:)])
         return nil;
     
-    NSImage* resultImage;
+    PaintBehavior oldPaintBehavior = m_view->paintBehavior();
+    m_view->setPaintBehavior(oldPaintBehavior | PaintBehaviorFlattenCompositingLayers);
+
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
     
     NSRect bounds = [view bounds];
@@ -282,7 +284,7 @@ NSImage* Frame::imageFromRect(NSRect rect) const
     rect.size.width = roundf(rect.size.width);
     rect = [view convertRect:rect fromView:nil];
     
-    resultImage = [[[NSImage alloc] initWithSize:rect.size] autorelease];
+    NSImage* resultImage = [[[NSImage alloc] initWithSize:rect.size] autorelease];
 
     if (rect.size.width != 0 && rect.size.height != 0) {
         [resultImage setFlipped:YES];
@@ -301,19 +303,21 @@ NSImage* Frame::imageFromRect(NSRect rect) const
         [resultImage setFlipped:NO];
     }
 
+    m_view->setPaintBehavior(oldPaintBehavior);
     return resultImage;
 
     END_BLOCK_OBJC_EXCEPTIONS;
     
+    m_view->setPaintBehavior(oldPaintBehavior);
     return nil;
 }
 
 NSImage* Frame::selectionImage(bool forceBlackText) const
 {
-    m_view->setPaintRestriction(forceBlackText ? PaintRestrictionSelectionOnlyBlackText : PaintRestrictionSelectionOnly);
+    m_view->setPaintBehavior(PaintBehaviorSelectionOnly | (forceBlackText ? PaintBehaviorForceBlackText : 0));
     m_doc->updateLayout();
     NSImage* result = imageFromRect(selectionBounds());
-    m_view->setPaintRestriction(PaintRestrictionNone);
+    m_view->setPaintBehavior(PaintBehaviorNormal);
     return result;
 }
 
@@ -459,33 +463,6 @@ NSWritingDirection Frame::baseWritingDirectionForSelectionStart() const
     return result;
 }
 
-const short enableRomanKeyboardsOnly = -23;
-void Frame::setUseSecureKeyboardEntry(bool enable)
-{
-    if (enable == IsSecureEventInputEnabled())
-        return;
-    if (enable) {
-        EnableSecureEventInput();
-#ifdef BUILDING_ON_TIGER
-        KeyScript(enableRomanKeyboardsOnly);
-#else
-        // WebKit substitutes nil for input context when in password field, which corresponds to null TSMDocument. So, there is
-        // no need to call TSMGetActiveDocument(), which may return an incorrect result when selection hasn't been yet updated
-        // after focusing a node.
-        CFArrayRef inputSources = TISCreateASCIICapableInputSourceList();
-        TSMSetDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag, sizeof(CFArrayRef), &inputSources);
-        CFRelease(inputSources);
-#endif
-    } else {
-        DisableSecureEventInput();
-#ifdef BUILDING_ON_TIGER
-        KeyScript(smKeyEnableKybds);
-#else
-        TSMRemoveDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag);
-#endif
-    }
-}
-
 #if ENABLE(DASHBOARD_SUPPORT)
 NSMutableDictionary* Frame::dashboardRegionsDictionary()
 {
diff --git a/WebCore/page/mac/WebCoreViewFactory.h b/WebCore/page/mac/WebCoreViewFactory.h
index 249d696..43f3f0a 100644
--- a/WebCore/page/mac/WebCoreViewFactory.h
+++ b/WebCore/page/mac/WebCoreViewFactory.h
@@ -150,6 +150,13 @@
 - (NSString*)localizedMediaControlElementHelpText:(NSString*)name;
 - (NSString*)localizedMediaTimeDescription:(float)time;
 
+- (NSString *)validationMessageValueMissingText;
+- (NSString *)validationMessageTypeMismatchText;
+- (NSString *)validationMessagePatternMismatchText;
+- (NSString *)validationMessageTooLongText;
+- (NSString *)validationMessageRangeUnderflowText;
+- (NSString *)validationMessageRangeOverflowText;
+- (NSString *)validationMessageStepMismatchText;
 
 @end
 
diff --git a/WebCore/page/win/FrameCGWin.cpp b/WebCore/page/win/FrameCGWin.cpp
index 7483627..d9e577b 100644
--- a/WebCore/page/win/FrameCGWin.cpp
+++ b/WebCore/page/win/FrameCGWin.cpp
@@ -52,6 +52,9 @@ static void drawRectIntoContext(IntRect rect, FrameView* view, GraphicsContext*
 
 static HBITMAP imageFromRect(const Frame* frame, IntRect& ir)
 {
+    PaintBehavior oldPaintBehavior = frame->view()->paintBehavior();
+    frame->view()->setPaintBehavior(oldPaintBehavior | PaintBehaviorFlattenCompositingLayers);
+
     void* bits;
     HDC hdc = CreateCompatibleDC(0);
     int w = ir.width();
@@ -74,6 +77,8 @@ static HBITMAP imageFromRect(const Frame* frame, IntRect& ir)
     SelectObject(hdc, hbmpOld);
     DeleteDC(hdc);
 
+    frame->view()->setPaintBehavior(oldPaintBehavior);
+
     return hbmp;
 }
 
@@ -81,12 +86,12 @@ HBITMAP imageFromSelection(Frame* frame, bool forceBlackText)
 {
     frame->document()->updateLayout();
 
-    frame->view()->setPaintRestriction(forceBlackText ? PaintRestrictionSelectionOnlyBlackText : PaintRestrictionSelectionOnly);
+    frame->view()->setPaintBehavior(PaintBehaviorSelectionOnly | (forceBlackText ? PaintBehaviorForceBlackText : 0));
     FloatRect fr = frame->selectionBounds();
     IntRect ir(static_cast<int>(fr.x()), static_cast<int>(fr.y()),
                static_cast<int>(fr.width()), static_cast<int>(fr.height()));
     HBITMAP image = imageFromRect(frame, ir);
-    frame->view()->setPaintRestriction(PaintRestrictionNone);
+    frame->view()->setPaintBehavior(PaintBehaviorNormal);
     return image;
 }
 
diff --git a/WebCore/platform/ContextMenu.cpp b/WebCore/platform/ContextMenu.cpp
index ee6aa4e..771798a 100644
--- a/WebCore/platform/ContextMenu.cpp
+++ b/WebCore/platform/ContextMenu.cpp
@@ -40,6 +40,7 @@
 #include "Editor.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "InspectorController.h"
 #include "KURL.h"
 #include "LocalizedStrings.h"
 #include "Node.h"
@@ -779,6 +780,7 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 #if ENABLE(INSPECTOR)
         case ContextMenuItemTagInspectElement:
 #endif
+        case ContextMenuItemBaseCustomTag:
         case ContextMenuItemBaseApplicationTag:
             break;
     }
diff --git a/WebCore/platform/ContextMenu.h b/WebCore/platform/ContextMenu.h
index dc484b2..77843dc 100644
--- a/WebCore/platform/ContextMenu.h
+++ b/WebCore/platform/ContextMenu.h
@@ -78,6 +78,8 @@ namespace WebCore {
         RetainPtr<NSMutableArray> m_platformDescription;
 #elif PLATFORM(QT)
         QList<ContextMenuItem> m_items;
+#elif PLATFORM(CHROMIUM)
+        Vector<ContextMenuItem> m_items;
 #else
         PlatformMenuDescription m_platformDescription;
 #endif
diff --git a/WebCore/platform/ContextMenuItem.h b/WebCore/platform/ContextMenuItem.h
index 6b9d0a9..b4c97a5 100644
--- a/WebCore/platform/ContextMenuItem.h
+++ b/WebCore/platform/ContextMenuItem.h
@@ -143,6 +143,7 @@ namespace WebCore {
         ContextMenuItemTagCapitalize,
         ContextMenuItemTagChangeBack,
 #endif
+        ContextMenuItemBaseCustomTag = 5000,
         ContextMenuItemBaseApplicationTag = 10000
     };
 
@@ -210,11 +211,24 @@ namespace WebCore {
     };
 #elif PLATFORM(HAIKU)
     typedef BMenuItem* PlatformMenuItemDescription;
+#elif PLATFORM(CHROMIUM)
+    struct PlatformMenuItemDescription {
+        PlatformMenuItemDescription()
+            : type(ActionType)
+            , action(ContextMenuItemTagNoAction)
+            , checked(false)
+            , enabled(true) { }
+        ContextMenuItemType type;
+        ContextMenuAction action;
+        String title;
+        bool checked;
+        bool enabled;
+    };
 #else
     typedef void* PlatformMenuItemDescription;
 #endif
 
-    class ContextMenuItem {
+    class ContextMenuItem : public FastAllocBase {
     public:
         ContextMenuItem(PlatformMenuItemDescription);
         ContextMenuItem(ContextMenu* subMenu = 0);
@@ -239,7 +253,8 @@ namespace WebCore {
         void setSubMenu(ContextMenu*);
 
         void setChecked(bool = true);
-        
+        bool checked() const;
+
         void setEnabled(bool = true);
         bool enabled() const;
 
diff --git a/WebCore/platform/CrossThreadCopier.h b/WebCore/platform/CrossThreadCopier.h
index 178e056..2bdf57d 100644
--- a/WebCore/platform/CrossThreadCopier.h
+++ b/WebCore/platform/CrossThreadCopier.h
@@ -41,7 +41,7 @@
 namespace WebCore {
 
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class String;
     struct CrossThreadResourceResponseData;
diff --git a/WebCore/platform/DeprecatedPtrList.h b/WebCore/platform/DeprecatedPtrList.h
index 67161af..47cd538 100644
--- a/WebCore/platform/DeprecatedPtrList.h
+++ b/WebCore/platform/DeprecatedPtrList.h
@@ -27,12 +27,13 @@
 #define DeprecatedPtrList_h
 
 #include "DeprecatedPtrListImpl.h"
+#include <wtf/FastAllocBase.h>
 
 namespace WebCore {
 
 template <class T> class DeprecatedPtrListIterator;
 
-template <class T> class DeprecatedPtrList {
+template <class T> class DeprecatedPtrList : public FastAllocBase {
 public:
     DeprecatedPtrList() : impl(deleteFunc), del_item(false) { }
     ~DeprecatedPtrList() { impl.clear(del_item); }
diff --git a/WebCore/platform/DeprecatedPtrListImpl.cpp b/WebCore/platform/DeprecatedPtrListImpl.cpp
index 6d6112e..96fd513 100644
--- a/WebCore/platform/DeprecatedPtrListImpl.cpp
+++ b/WebCore/platform/DeprecatedPtrListImpl.cpp
@@ -29,10 +29,11 @@
 #include <cstddef>
 #include <algorithm>
 #include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
-class DeprecatedListNode
+class DeprecatedListNode : public Noncopyable
 {
 public:
     DeprecatedListNode(void *d) : data(d), next(0), prev(0) { }
diff --git a/WebCore/platform/FileChooser.cpp b/WebCore/platform/FileChooser.cpp
index 739181d..9fad392 100644
--- a/WebCore/platform/FileChooser.cpp
+++ b/WebCore/platform/FileChooser.cpp
@@ -37,16 +37,16 @@ FileChooserClient::~FileChooserClient()
 {
 }
 
-inline FileChooser::FileChooser(FileChooserClient* client, const String& filename)
+inline FileChooser::FileChooser(FileChooserClient* client, const Vector<String>& initialFilenames)
     : m_client(client)
-    , m_icon(chooseIcon(filename))
+    , m_icon(Icon::createIconForFiles(initialFilenames))
 {
-    m_filenames.append(filename);
+    m_filenames = initialFilenames;
 }
 
-PassRefPtr<FileChooser> FileChooser::create(FileChooserClient* client, const String& filename)
+PassRefPtr<FileChooser> FileChooser::create(FileChooserClient* client, const Vector<String>& initialFilenames)
 {
-    return adoptRef(new FileChooser(client, filename));
+    return adoptRef(new FileChooser(client, initialFilenames));
 }
 
 FileChooser::~FileChooser()
@@ -61,13 +61,9 @@ void FileChooser::clear()
 
 void FileChooser::chooseFile(const String& filename)
 {
-    if (m_filenames.size() == 1 && m_filenames[0] == filename)
-        return;
-    m_filenames.clear();
-    m_filenames.append(filename);
-    m_icon = chooseIcon(filename);
-    if (m_client)
-        m_client->valueChanged();
+    Vector<String> filenames;
+    filenames.append(filename);
+    chooseFiles(filenames);
 }
 
 void FileChooser::chooseFiles(const Vector<String>& filenames)
@@ -75,23 +71,9 @@ void FileChooser::chooseFiles(const Vector<String>& filenames)
     if (m_filenames == filenames)
         return;
     m_filenames = filenames;
-    m_icon = chooseIcon(filenames);
+    m_icon = Icon::createIconForFiles(filenames);
     if (m_client)
         m_client->valueChanged();
 }
 
-PassRefPtr<Icon> FileChooser::chooseIcon(const String& filename)
-{
-    return Icon::createIconForFile(filename);
-}
-
-PassRefPtr<Icon> FileChooser::chooseIcon(Vector<String> filenames)
-{
-    if (filenames.isEmpty())
-        return 0;
-    if (filenames.size() == 1)
-        return Icon::createIconForFile(filenames[0]);
-    return Icon::createIconForFiles(filenames);
-}
-
 }
diff --git a/WebCore/platform/FileChooser.h b/WebCore/platform/FileChooser.h
index 8192fe8..1d4e970 100644
--- a/WebCore/platform/FileChooser.h
+++ b/WebCore/platform/FileChooser.h
@@ -47,7 +47,7 @@ public:
 
 class FileChooser : public RefCounted<FileChooser> {
 public:
-    static PassRefPtr<FileChooser> create(FileChooserClient*, const String& initialFilename);
+    static PassRefPtr<FileChooser> create(FileChooserClient*, const Vector<String>& initialFilenames);
     ~FileChooser();
 
     void disconnectClient() { m_client = 0; }
@@ -66,9 +66,7 @@ public:
     bool allowsMultipleFiles() const { return m_client ? m_client->allowsMultipleFiles() : false; }
 
 private:
-    FileChooser(FileChooserClient*, const String& initialfilename);
-    static PassRefPtr<Icon> chooseIcon(const String& filename);
-    static PassRefPtr<Icon> chooseIcon(Vector<String> filenames);
+    FileChooser(FileChooserClient*, const Vector<String>& initialFilenames);
 
     FileChooserClient* m_client;
     Vector<String> m_filenames;
diff --git a/WebCore/platform/FileSystem.h b/WebCore/platform/FileSystem.h
index 9952b39..3220d51 100644
--- a/WebCore/platform/FileSystem.h
+++ b/WebCore/platform/FileSystem.h
@@ -39,9 +39,10 @@
 #if defined(Q_OS_WIN32)
 #include <windows.h>
 #endif
-#if defined(Q_WS_MAC)
-#include <CoreFoundation/CFBundle.h>
 #endif
+
+#if PLATFORM(CF) || (PLATFORM(QT) && defined(Q_WS_MAC))
+#include <CoreFoundation/CFBundle.h>
 #endif
 
 #include <time.h>
@@ -76,6 +77,8 @@ typedef QLibrary* PlatformModule;
 #endif // defined(Q_WS_MAC)
 #elif PLATFORM(GTK)
 typedef GModule* PlatformModule;
+#elif PLATFORM(CF)
+typedef CFBundleRef PlatformModule;
 #else
 typedef void* PlatformModule;
 #endif
diff --git a/WebCore/platform/KURL.cpp b/WebCore/platform/KURL.cpp
index ffacc19..a8f7969 100644
--- a/WebCore/platform/KURL.cpp
+++ b/WebCore/platform/KURL.cpp
@@ -30,7 +30,7 @@
 #include "KURL.h"
 
 #include "CString.h"
-#include "PlatformString.h"
+#include "StringHash.h"
 #include "TextEncoding.h"
 #include <wtf/StdLibExtras.h>
 
@@ -102,7 +102,7 @@ static const unsigned char characterClassTable[256] = {
     /* 42  * */ UserInfoChar,    /* 43  + */ SchemeChar | UserInfoChar,
     /* 44  , */ UserInfoChar,
     /* 45  - */ SchemeChar | UserInfoChar | HostnameChar,
-    /* 46  . */ SchemeChar | UserInfoChar | HostnameChar,
+    /* 46  . */ SchemeChar | UserInfoChar | HostnameChar | IPv6Char,
     /* 47  / */ PathSegmentEndChar,
     /* 48  0 */ SchemeChar | UserInfoChar | HostnameChar | IPv6Char, 
     /* 49  1 */ SchemeChar | UserInfoChar | HostnameChar | IPv6Char,    
@@ -633,7 +633,7 @@ bool KURL::protocolIs(const char* protocol) const
 
     // JavaScript URLs are "valid" and should be executed even if KURL decides they are invalid.
     // The free function protocolIsJavaScript() should be used instead. 
-    ASSERT(strcmp(protocol, "javascript") != 0);
+    ASSERT(!equalIgnoringCase(protocol, String("javascript")));
 
     if (!m_isValid)
         return false;
@@ -685,18 +685,22 @@ void KURL::setHost(const String& s)
     parse(m_string.left(hostStart()) + (slashSlashNeeded ? "//" : "") + s + m_string.substring(m_hostEnd));
 }
 
+void KURL::removePort()
+{
+    if (m_hostEnd == m_portEnd)
+        return;
+    parse(m_string.left(m_hostEnd) + m_string.substring(m_portEnd));
+}
+
 void KURL::setPort(unsigned short i)
 {
     if (!m_isValid)
         return;
 
-    if (i) {
-        bool colonNeeded = m_portEnd == m_hostEnd;
-        int portStart = (colonNeeded ? m_hostEnd : m_hostEnd + 1);
+    bool colonNeeded = m_portEnd == m_hostEnd;
+    int portStart = (colonNeeded ? m_hostEnd : m_hostEnd + 1);
 
-        parse(m_string.left(portStart) + (colonNeeded ? ":" : "") + String::number(i) + m_string.substring(m_portEnd));
-    } else
-        parse(m_string.left(m_hostEnd) + m_string.substring(m_portEnd));
+    parse(m_string.left(portStart) + (colonNeeded ? ":" : "") + String::number(i) + m_string.substring(m_portEnd));
 }
 
 void KURL::setHostAndPort(const String& hostAndPort)
@@ -819,7 +823,7 @@ String KURL::prettyURL() const
             authority.append('@');
         }
         append(authority, host());
-        if (port() != 0) {
+        if (hasPort()) {
             authority.append(':');
             append(authority, String::number(port()));
         }
@@ -1269,8 +1273,8 @@ void KURL::parse(const char* url, const String* originalString)
         m_userStart = m_userEnd = m_passwordEnd = m_hostEnd = m_portEnd = p - buffer.data();
 
     // For canonicalization, ensure we have a '/' for no path.
-    // Only do this for http and https.
-    if (m_protocolInHTTPFamily && pathEnd - pathStart == 0)
+    // Do this only for hierarchical URL with protocol http or https.
+    if (m_protocolInHTTPFamily && hierarchical && pathEnd == pathStart)
         *p++ = '/';
 
     // add path, escaping bad characters
@@ -1624,6 +1628,132 @@ bool protocolIsJavaScript(const String& url)
     return protocolIs(url, "javascript");
 }
 
+bool isValidProtocol(const String& protocol)
+{
+    if (!isSchemeFirstChar(protocol[0]))
+        return false;
+    unsigned protocolLength = protocol.length();
+    for (unsigned i = 1; i < protocolLength; i++) {
+        if (!isSchemeChar(protocol[i]))
+            return false;
+    }
+    return true;
+}
+
+bool isDefaultPortForProtocol(unsigned short port, const String& protocol)
+{
+    if (protocol.isEmpty())
+        return false;
+
+    typedef HashMap<String, unsigned, CaseFoldingHash> DefaultPortsMap;
+    DEFINE_STATIC_LOCAL(DefaultPortsMap, defaultPorts, ());
+    if (defaultPorts.isEmpty()) {
+        defaultPorts.set("http", 80);
+        defaultPorts.set("https", 443);
+        defaultPorts.set("ftp", 21);
+        defaultPorts.set("ftps", 990);
+    }
+    return defaultPorts.get(protocol) == port;
+}
+
+bool portAllowed(const KURL& url)
+{
+    unsigned short port = url.port();
+
+    // Since most URLs don't have a port, return early for the "no port" case.
+    if (!port)
+        return true;
+
+    // This blocked port list matches the port blocking that Mozilla implements.
+    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
+    static const unsigned short blockedPortList[] = {
+        1,    // tcpmux
+        7,    // echo
+        9,    // discard
+        11,   // systat
+        13,   // daytime
+        15,   // netstat
+        17,   // qotd
+        19,   // chargen
+        20,   // FTP-data
+        21,   // FTP-control
+        22,   // SSH
+        23,   // telnet
+        25,   // SMTP
+        37,   // time
+        42,   // name
+        43,   // nicname
+        53,   // domain
+        77,   // priv-rjs
+        79,   // finger
+        87,   // ttylink
+        95,   // supdup
+        101,  // hostriame
+        102,  // iso-tsap
+        103,  // gppitnp
+        104,  // acr-nema
+        109,  // POP2
+        110,  // POP3
+        111,  // sunrpc
+        113,  // auth
+        115,  // SFTP
+        117,  // uucp-path
+        119,  // nntp
+        123,  // NTP
+        135,  // loc-srv / epmap
+        139,  // netbios
+        143,  // IMAP2
+        179,  // BGP
+        389,  // LDAP
+        465,  // SMTP+SSL
+        512,  // print / exec
+        513,  // login
+        514,  // shell
+        515,  // printer
+        526,  // tempo
+        530,  // courier
+        531,  // Chat
+        532,  // netnews
+        540,  // UUCP
+        556,  // remotefs
+        563,  // NNTP+SSL
+        587,  // ESMTP
+        601,  // syslog-conn
+        636,  // LDAP+SSL
+        993,  // IMAP+SSL
+        995,  // POP3+SSL
+        2049, // NFS
+        3659, // apple-sasl / PasswordServer [Apple addition]
+        4045, // lockd
+        6000, // X11
+    };
+    const unsigned short* const blockedPortListEnd = blockedPortList + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
+
+#ifndef NDEBUG
+    // The port list must be sorted for binary_search to work.
+    static bool checkedPortList = false;
+    if (!checkedPortList) {
+        for (const unsigned short* p = blockedPortList; p != blockedPortListEnd - 1; ++p)
+            ASSERT(*p < *(p + 1));
+        checkedPortList = true;
+    }
+#endif
+
+    // If the port is not in the blocked port list, allow it.
+    if (!binary_search(blockedPortList, blockedPortListEnd, port))
+        return true;
+
+    // Allow ports 21 and 22 for FTP URLs, as Mozilla does.
+    if ((port == 21 || port == 22) && url.protocolIs("ftp"))
+        return true;
+
+    // Allow any port number in a file URL, since the port number is ignored.
+    if (url.protocolIs("file"))
+        return true;
+
+    return false;
+}
+
 String mimeTypeFromDataURL(const String& url)
 {
     ASSERT(protocolIs(url, "data"));
diff --git a/WebCore/platform/KURL.h b/WebCore/platform/KURL.h
index 73fadd1..647330d 100644
--- a/WebCore/platform/KURL.h
+++ b/WebCore/platform/KURL.h
@@ -78,6 +78,7 @@ public:
     KURL(const KURL& base, const String& relative);
     KURL(const KURL& base, const String& relative, const TextEncoding&);
 
+
 #if USE(GOOGLEURL)
     // For conversions for other structures that have already parsed and
     // canonicalized the URL. The input must be exactly what KURL would have
@@ -104,6 +105,12 @@ public:
     // non-hierarchical (like "javascript:") URLs will have no path.
     bool hasPath() const;
 
+    // Returns true if you can set the host and port for the URL.
+    // Non-hierarchical URLs don't have a host and port.
+    bool canSetHostOrPort() const { return isHierarchical(); }
+
+    bool canSetPathname() const { return isHierarchical(); }
+    
 #if USE(GOOGLEURL)
     const String& string() const { return m_url.string(); }
 #else
@@ -113,6 +120,7 @@ public:
     String protocol() const;
     String host() const;
     unsigned short port() const;
+    bool hasPort() const;
     String user() const;
     String pass() const;
     String path() const;
@@ -135,7 +143,7 @@ public:
     void setProtocol(const String&);
     void setHost(const String&);
 
-    // Setting the port to 0 will clear any port from the URL.
+    void removePort();
     void setPort(unsigned short);
 
     // Input is like "foo.com" or "foo.com:8000".
@@ -254,6 +262,10 @@ const KURL& blankURL();
 
 bool protocolIs(const String& url, const char* protocol);
 bool protocolIsJavaScript(const String& url);
+bool isValidProtocol(const String& protocol);
+
+bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
+bool portAllowed(const KURL&); // Blacklist ports that should never be used for Web resources.
 
 String mimeTypeFromDataURL(const String& url);
 
@@ -317,6 +329,11 @@ inline bool KURL::isValid() const
     return m_isValid;
 }
 
+inline bool KURL::hasPort() const
+{
+    return m_hostEnd < m_portEnd;
+}
+
 inline bool KURL::protocolInHTTPFamily() const
 {
     return m_protocolInHTTPFamily;
diff --git a/WebCore/platform/KURLGoogle.cpp b/WebCore/platform/KURLGoogle.cpp
index d0aae0c..76b5612 100644
--- a/WebCore/platform/KURLGoogle.cpp
+++ b/WebCore/platform/KURLGoogle.cpp
@@ -38,16 +38,21 @@
 #include <stdio.h>
 #endif
 
+#include <algorithm>
+
 #include "CString.h"
+#include "StringHash.h"
 #include "NotImplemented.h"
 #include "TextEncoding.h"
 #include <wtf/Vector.h>
+#include <wtf/StdLibExtras.h>
 
 #include <googleurl/src/url_canon_internal.h>
 #include <googleurl/src/url_util.h>
 
 using WTF::isASCIILower;
 using WTF::toASCIILower;
+using std::binary_search;
 
 namespace WebCore {
 
@@ -116,6 +121,16 @@ static bool lowerCaseEqualsASCII(const char* begin, const char* end, const char*
     return begin == end && !*str;
 }
 
+static inline bool isSchemeFirstChar(char c)
+{
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z');
+}
+
+static inline bool isSchemeChar(char c)
+{
+    return isSchemeFirstChar(c) || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '*';
+}
+
 
 // KURLGooglePrivate -----------------------------------------------------------
 
@@ -426,6 +441,11 @@ bool KURL::isValid() const
     return m_url.m_isValid;
 }
 
+bool KURL::hasPort() const
+{
+    return hostEnd() < pathStart();
+}
+
 bool KURL::protocolInHTTPFamily() const
 {
     return m_url.m_protocolInHTTPFamily;
@@ -537,7 +557,10 @@ String KURL::query() const
     // Bug: https://bugs.webkit.org/show_bug.cgi?id=21015 this function returns
     // an empty string when the query is empty rather than a null (not sure
     // which is right).
-    return String("", 0);
+    // Returns a null if the query is not specified, instead of empty.
+    if (m_url.m_parsed.query.is_valid())
+        return String("", 0);
+    return String();
 }
 
 String KURL::path() const
@@ -562,24 +585,36 @@ void KURL::setHost(const String& host)
     m_url.replaceComponents(replacements);
 }
 
-// This function is used only in the JSC build.
 void KURL::setHostAndPort(const String& s)
 {
-    String newhost = s.left(s.find(":"));
-    String newport = s.substring(s.find(":") + 1);
+    String host = s;
+    String port;
+    int hostEnd = s.find(":");
+    if (hostEnd != -1) {
+        host = s.left(hostEnd);
+        port = s.substring(hostEnd + 1);
+    }
 
     KURLGooglePrivate::Replacements replacements;
     // Host can't be removed, so we always set.
-    replacements.SetHost(CharactersOrEmpty(newhost),
-                         url_parse::Component(0, newhost.length()));
+    replacements.SetHost(CharactersOrEmpty(host),
+                         url_parse::Component(0, host.length()));
 
-    if (newport.isEmpty())  // Port may be removed, so we support clearing.
+    if (port.isEmpty())  // Port may be removed, so we support clearing.
         replacements.ClearPort();
     else
-        replacements.SetPort(CharactersOrEmpty(newport), url_parse::Component(0, newport.length()));
+        replacements.SetPort(CharactersOrEmpty(port), url_parse::Component(0, port.length()));
     m_url.replaceComponents(replacements);
 }
 
+void KURL::removePort()
+{
+    if (hasPort()) {
+        String urlWithoutPort = m_url.string().left(hostEnd()) + m_url.string().substring(pathStart());
+        m_url.setUtf8(urlWithoutPort.utf8());
+    }
+}
+
 void KURL::setPort(unsigned short i)
 {
     KURLGooglePrivate::Replacements replacements;
@@ -698,6 +733,142 @@ bool protocolIsJavaScript(const String& url)
     return protocolIs(url, "javascript");
 }
 
+bool isValidProtocol(const String& protocol)
+{
+    if (!isSchemeFirstChar(protocol[0]))
+        return false;
+    unsigned protocolLength = protocol.length();
+    for (unsigned i = 1; i < protocolLength; i++) {
+        if (!isSchemeChar(protocol[i]))
+            return false;
+    }
+    return true;
+}
+
+// We copied the KURL version here on Dec 4, 2009 while doing a WebKit
+// merge.
+//
+// FIXME Somehow share this with KURL? Like we'd theoretically merge with
+// decodeURLEscapeSequences below?
+bool isDefaultPortForProtocol(unsigned short port, const String& protocol)
+{
+    if (protocol.isEmpty())
+        return false;
+
+    typedef HashMap<String, unsigned, CaseFoldingHash> DefaultPortsMap;
+    DEFINE_STATIC_LOCAL(DefaultPortsMap, defaultPorts, ());
+    if (defaultPorts.isEmpty()) {
+        defaultPorts.set("http", 80);
+        defaultPorts.set("https", 443);
+        defaultPorts.set("ftp", 21);
+        defaultPorts.set("ftps", 990);
+    }
+    return defaultPorts.get(protocol) == port;
+}
+
+// We copied the KURL version here on Dec 4, 2009 while doing a WebKit
+// merge.
+//
+// FIXME Somehow share this with KURL? Like we'd theoretically merge with
+// decodeURLEscapeSequences below?
+bool portAllowed(const KURL& url)
+{
+    unsigned short port = url.port();
+
+    // Since most URLs don't have a port, return early for the "no port" case.
+    if (!port)
+        return true;
+
+    // This blocked port list matches the port blocking that Mozilla implements.
+    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
+    static const unsigned short blockedPortList[] = {
+        1,    // tcpmux
+        7,    // echo
+        9,    // discard
+        11,   // systat
+        13,   // daytime
+        15,   // netstat
+        17,   // qotd
+        19,   // chargen
+        20,   // FTP-data
+        21,   // FTP-control
+        22,   // SSH
+        23,   // telnet
+        25,   // SMTP
+        37,   // time
+        42,   // name
+        43,   // nicname
+        53,   // domain
+        77,   // priv-rjs
+        79,   // finger
+        87,   // ttylink
+        95,   // supdup
+        101,  // hostriame
+        102,  // iso-tsap
+        103,  // gppitnp
+        104,  // acr-nema
+        109,  // POP2
+        110,  // POP3
+        111,  // sunrpc
+        113,  // auth
+        115,  // SFTP
+        117,  // uucp-path
+        119,  // nntp
+        123,  // NTP
+        135,  // loc-srv / epmap
+        139,  // netbios
+        143,  // IMAP2
+        179,  // BGP
+        389,  // LDAP
+        465,  // SMTP+SSL
+        512,  // print / exec
+        513,  // login
+        514,  // shell
+        515,  // printer
+        526,  // tempo
+        530,  // courier
+        531,  // Chat
+        532,  // netnews
+        540,  // UUCP
+        556,  // remotefs
+        563,  // NNTP+SSL
+        587,  // ESMTP
+        601,  // syslog-conn
+        636,  // LDAP+SSL
+        993,  // IMAP+SSL
+        995,  // POP3+SSL
+        2049, // NFS
+        3659, // apple-sasl / PasswordServer [Apple addition]
+        4045, // lockd
+        6000, // X11
+    };
+    const unsigned short* const blockedPortListEnd = blockedPortList + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
+
+#ifndef NDEBUG
+    // The port list must be sorted for binary_search to work.
+    static bool checkedPortList = false;
+    if (!checkedPortList) {
+        for (const unsigned short* p = blockedPortList; p != blockedPortListEnd - 1; ++p)
+            ASSERT(*p < *(p + 1));
+        checkedPortList = true;
+    }
+#endif
+
+    // If the port is not in the blocked port list, allow it.
+    if (!binary_search(blockedPortList, blockedPortListEnd, port))
+        return true;
+
+    // Allow ports 21 and 22 for FTP URLs, as Mozilla does.
+    if ((port == 21 || port == 22) && url.protocolIs("ftp"))
+        return true;
+
+    // Allow any port number in a file URL, since the port number is ignored.
+    if (url.protocolIs("file"))
+        return true;
+
+    return false;
+}
+
 // We copied the KURL version here on Sept 12, 2008 while doing a WebKit
 // merge.
 // 
diff --git a/WebCore/platform/Length.h b/WebCore/platform/Length.h
index b4497b6..4f36577 100644
--- a/WebCore/platform/Length.h
+++ b/WebCore/platform/Length.h
@@ -22,6 +22,7 @@
 #define Length_h
 
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
@@ -33,7 +34,7 @@ const int percentScaleFactor = 128;
 
 enum LengthType { Auto, Relative, Percent, Fixed, Static, Intrinsic, MinIntrinsic };
 
-struct Length {
+struct Length : FastAllocBase {
     Length()
         : m_value(0)
     {
diff --git a/WebCore/platform/LocalizedStrings.h b/WebCore/platform/LocalizedStrings.h
index 0fa9f71..f7a6fa6 100644
--- a/WebCore/platform/LocalizedStrings.h
+++ b/WebCore/platform/LocalizedStrings.h
@@ -141,6 +141,15 @@ namespace WebCore {
     String localizedMediaControlElementString(const String&);
     String localizedMediaControlElementHelpText(const String&);
     String localizedMediaTimeDescription(float);
+
+    String validationMessageValueMissingText();
+    String validationMessageTypeMismatchText();
+    String validationMessagePatternMismatchText();
+    String validationMessageTooLongText();
+    String validationMessageRangeUnderflowText();
+    String validationMessageRangeOverflowText();
+    String validationMessageStepMismatchText();
+
 }
 
 #endif
diff --git a/WebCore/platform/MIMETypeRegistry.cpp b/WebCore/platform/MIMETypeRegistry.cpp
index 32dd3f6..978a611 100644
--- a/WebCore/platform/MIMETypeRegistry.cpp
+++ b/WebCore/platform/MIMETypeRegistry.cpp
@@ -261,8 +261,8 @@ static void initializeMediaTypeMaps()
     static const TypeExtensionPair pairs[] = {
     
         // Ogg
-        { "application/ogg", "ogg" },
         { "application/ogg", "ogx" },
+        { "audio/ogg", "ogg" },
         { "audio/ogg", "oga" },
         { "video/ogg", "ogv" },
 
diff --git a/WebCore/platform/PlatformKeyboardEvent.h b/WebCore/platform/PlatformKeyboardEvent.h
index b5c2e95..cbbb48d 100644
--- a/WebCore/platform/PlatformKeyboardEvent.h
+++ b/WebCore/platform/PlatformKeyboardEvent.h
@@ -65,7 +65,7 @@ class BMessage;
 
 namespace WebCore {
 
-    class PlatformKeyboardEvent {
+    class PlatformKeyboardEvent : public FastAllocBase {
     public:
         enum Type {
             // KeyDown is sent by platforms such as Mac OS X, gtk and Qt, and has information about both physical pressed key, and its translation.
diff --git a/WebCore/platform/ScrollView.cpp b/WebCore/platform/ScrollView.cpp
index 1c9b5ce..6df462a 100644
--- a/WebCore/platform/ScrollView.cpp
+++ b/WebCore/platform/ScrollView.cpp
@@ -50,6 +50,7 @@ ScrollView::ScrollView()
     , m_updateScrollbarsPass(0)
     , m_drawPanScrollIcon(false)
     , m_useFixedLayout(false)
+    , m_paintsEntireContents(false)
 {
     platformInit();
 }
@@ -169,6 +170,11 @@ bool ScrollView::canBlitOnScroll() const
     return m_canBlitOnScroll;
 }
 
+void ScrollView::setPaintsEntireContents(bool paintsEntireContents)
+{
+    m_paintsEntireContents = paintsEntireContents;
+}
+
 #if !PLATFORM(GTK)
 IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
 {
@@ -712,6 +718,7 @@ void ScrollView::frameRectsChanged()
 
 void ScrollView::repaintContentRectangle(const IntRect& rect, bool now)
 {
+<<<<<<< HEAD:WebCore/platform/ScrollView.cpp
     IntRect visibleContent = visibleContentRect();
 #ifdef ANDROID_CAPTURE_OFFSCREEN_PAINTS
     IntRect fullVis = visibleContent;
@@ -722,14 +729,20 @@ void ScrollView::repaintContentRectangle(const IntRect& rect, bool now)
         platformOffscreenContentRectangle(fullVis, rect);
 #endif
     if (visibleContent.isEmpty())
+=======
+    IntRect paintRect = rect;
+    if (!paintsEntireContents())
+        paintRect.intersect(visibleContentRect());
+    if (paintRect.isEmpty())
+>>>>>>> webkit.org at r51976:WebCore/platform/ScrollView.cpp
         return;
     if (platformWidget()) {
-        platformRepaintContentRectangle(visibleContent, now);
+        platformRepaintContentRectangle(paintRect, now);
         return;
     }
 
     if (hostWindow())
-        hostWindow()->repaint(contentsToWindow(visibleContent), true, now);
+        hostWindow()->repaint(contentsToWindow(paintRect), true, now);
 }
 
 IntRect ScrollView::scrollCornerRect() const
@@ -775,7 +788,7 @@ void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
 void ScrollView::paintPanScrollIcon(GraphicsContext* context)
 {
     DEFINE_STATIC_LOCAL(Image*, panScrollIcon, (Image::loadPlatformResource("panIcon").releaseRef()));
-    context->drawImage(panScrollIcon, m_panScrollIconPoint);
+    context->drawImage(panScrollIcon, DeviceColorSpace, m_panScrollIconPoint);
 }
 
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
@@ -970,7 +983,7 @@ void ScrollView::platformDestroy()
 
 #endif
 
-#if !PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(QT) && !PLATFORM(MAC)
+#if (!PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(QT) && !PLATFORM(MAC)) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 
 void ScrollView::platformAddChild(Widget*)
 {
@@ -982,7 +995,7 @@ void ScrollView::platformRemoveChild(Widget*)
 
 #endif
 
-#if !PLATFORM(MAC)
+#if !PLATFORM(MAC) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 
 void ScrollView::platformSetScrollbarsSuppressed(bool repaintOnUnsuppress)
 {
@@ -990,7 +1003,7 @@ void ScrollView::platformSetScrollbarsSuppressed(bool repaintOnUnsuppress)
 
 #endif
 
-#if !PLATFORM(MAC) && !PLATFORM(WX)
+#if (!PLATFORM(MAC) && !PLATFORM(WX)) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 
 void ScrollView::platformSetScrollbarModes()
 {
@@ -1052,8 +1065,12 @@ bool ScrollView::platformScroll(ScrollDirection, ScrollGranularity)
     return true;
 }
 
+<<<<<<< HEAD:WebCore/platform/ScrollView.cpp
 #if !PLATFORM(ANDROID)
 void ScrollView::platformRepaintContentRectangle(const IntRect&, bool now)
+=======
+void ScrollView::platformRepaintContentRectangle(const IntRect&, bool /*now*/)
+>>>>>>> webkit.org at r51976:WebCore/platform/ScrollView.cpp
 {
 }
 
diff --git a/WebCore/platform/ScrollView.h b/WebCore/platform/ScrollView.h
index 2844ace..ac0e42f 100644
--- a/WebCore/platform/ScrollView.h
+++ b/WebCore/platform/ScrollView.h
@@ -89,9 +89,14 @@ public:
     void scrollbarModes(ScrollbarMode& horizontalMode, ScrollbarMode& verticalMode) const;
     ScrollbarMode horizontalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return horizontal; }
     ScrollbarMode verticalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return vertical; }
-    void setCanHaveScrollbars(bool flag);
+    virtual void setCanHaveScrollbars(bool);
     bool canHaveScrollbars() const { return horizontalScrollbarMode() != ScrollbarAlwaysOff || verticalScrollbarMode() != ScrollbarAlwaysOff; }
 
+    // By default you only receive paint events for the area that is visible. In the case of using a
+    // tiled backing store, this method can be set, so that the view paints the entire contents.
+    bool paintsEntireContents() const { return m_paintsEntireContents; }
+    void setPaintsEntireContents(bool);
+
     // Overridden by FrameView to create custom CSS scrollbars if applicable.
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
 
@@ -272,6 +277,8 @@ private:
     bool m_drawPanScrollIcon;
     bool m_useFixedLayout;
 
+    bool m_paintsEntireContents;
+
     void init();
     void destroy();
 
diff --git a/WebCore/platform/ScrollbarTheme.h b/WebCore/platform/ScrollbarTheme.h
index 9327dc6..01229e1 100644
--- a/WebCore/platform/ScrollbarTheme.h
+++ b/WebCore/platform/ScrollbarTheme.h
@@ -36,7 +36,7 @@ class PlatformMouseEvent;
 class Scrollbar;
 class ScrollView;
 
-class ScrollbarTheme {
+class ScrollbarTheme : public Noncopyable {
 public:
     virtual ~ScrollbarTheme() {};
 
@@ -73,7 +73,7 @@ public:
 
     virtual void invalidatePart(Scrollbar*, ScrollbarPart) {}
 
-    virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white); }
+    virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white, DeviceColorSpace); }
 
     virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
     virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&) { return false; }
diff --git a/WebCore/platform/ScrollbarThemeComposite.cpp b/WebCore/platform/ScrollbarThemeComposite.cpp
index ab5e16b..74bfae3 100644
--- a/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -297,7 +297,7 @@ void ScrollbarThemeComposite::paintScrollCorner(ScrollView* view, GraphicsContex
     Page* page = frameView->frame() ? frameView->frame()->page() : 0;
     if (page && page->settings()->shouldPaintCustomScrollbars()) {
         if (!page->chrome()->client()->paintCustomScrollCorner(context, cornerRect))
-            context->fillRect(cornerRect, Color::white);
+            context->fillRect(cornerRect, Color::white, DeviceColorSpace);
     }
 }
 
diff --git a/WebCore/platform/SharedTimer.h b/WebCore/platform/SharedTimer.h
index a005add..5b5cd14 100644
--- a/WebCore/platform/SharedTimer.h
+++ b/WebCore/platform/SharedTimer.h
@@ -26,12 +26,14 @@
 #ifndef SharedTimer_h
 #define SharedTimer_h
 
+#include <wtf/Noncopyable.h>
+
 namespace WebCore {
 
     // Each thread has its own single instance of shared timer, which implements this interface.
     // This instance is shared by all timers in the thread.
     // Not intended to be used directly; use the Timer class instead.
-    class SharedTimer {
+    class SharedTimer : public Noncopyable {
     public:
         virtual ~SharedTimer() {}
         virtual void setFiredFunction(void (*)()) = 0;
diff --git a/WebCore/platform/StaticConstructors.h b/WebCore/platform/StaticConstructors.h
index 5bc792c..c0a9a53 100644
--- a/WebCore/platform/StaticConstructors.h
+++ b/WebCore/platform/StaticConstructors.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/platform/ThemeTypes.h b/WebCore/platform/ThemeTypes.h
index e132313..439a3b1 100644
--- a/WebCore/platform/ThemeTypes.h
+++ b/WebCore/platform/ThemeTypes.h
@@ -48,7 +48,7 @@ enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
     ButtonBevelPart, DefaultButtonPart, ListButtonPart, ListboxPart, ListItemPart,
     MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
-    MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart,
+    MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart, MediaToggleClosedCaptionsButtonPart,
     MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
     MediaControlsBackgroundPart, MediaCurrentTimePart, MediaTimeRemainingPart,
     MenulistPart, MenulistButtonPart, MenulistTextPart, MenulistTextFieldPart,
diff --git a/WebCore/platform/ThreadGlobalData.cpp b/WebCore/platform/ThreadGlobalData.cpp
index a43e9bd..26a9728 100644
--- a/WebCore/platform/ThreadGlobalData.cpp
+++ b/WebCore/platform/ThreadGlobalData.cpp
@@ -32,7 +32,7 @@
 #include "ThreadTimers.h"
 #include <wtf/UnusedParam.h>
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
 #include "TextCodecICU.h"
 #endif
 
@@ -75,7 +75,7 @@ ThreadGlobalData::ThreadGlobalData()
 #ifndef NDEBUG
     , m_isMainThread(isMainThread())
 #endif
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     , m_cachedConverterICU(new ICUConverterWrapper)
 #endif
 #if PLATFORM(MAC)
@@ -89,7 +89,7 @@ ThreadGlobalData::~ThreadGlobalData()
 #if PLATFORM(MAC)
     delete m_cachedConverterTEC;
 #endif
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     delete m_cachedConverterICU;
 #endif
 
diff --git a/WebCore/platform/TreeShared.h b/WebCore/platform/TreeShared.h
index 02728ff..a60ad0d 100644
--- a/WebCore/platform/TreeShared.h
+++ b/WebCore/platform/TreeShared.h
@@ -23,6 +23,9 @@
 
 #include <wtf/Assertions.h>
 #include <wtf/Noncopyable.h>
+#ifndef NDEBUG
+#include <wtf/Threading.h>
+#endif
 
 namespace WebCore {
 
@@ -32,6 +35,7 @@ public:
         : m_refCount(initialRefCount)
         , m_parent(0)
     {
+        ASSERT(isMainThread());
 #ifndef NDEBUG
         m_deletionHasBegun = false;
         m_inRemovedLastRefFunction = false;
@@ -39,11 +43,13 @@ public:
     }
     virtual ~TreeShared()
     {
+        ASSERT(isMainThread());
         ASSERT(m_deletionHasBegun);
     }
 
     void ref()
     {
+        ASSERT(isMainThread());
         ASSERT(!m_deletionHasBegun);
         ASSERT(!m_inRemovedLastRefFunction);
         ++m_refCount;
@@ -51,6 +57,7 @@ public:
 
     void deref()
     {
+        ASSERT(isMainThread());
         ASSERT(!m_deletionHasBegun);
         ASSERT(!m_inRemovedLastRefFunction);
         if (--m_refCount <= 0 && !m_parent) {
@@ -73,8 +80,17 @@ public:
         return m_refCount;
     }
 
-    void setParent(T* parent) { m_parent = parent; }
-    T* parent() const { return m_parent; }
+    void setParent(T* parent)
+    { 
+        ASSERT(isMainThread());
+        m_parent = parent; 
+    }
+
+    T* parent() const
+    {
+        ASSERT(isMainThread());
+        return m_parent;
+    }
 
 #ifndef NDEBUG
     bool m_deletionHasBegun;
diff --git a/WebCore/platform/Widget.cpp b/WebCore/platform/Widget.cpp
index 23e5de8..2213a11 100644
--- a/WebCore/platform/Widget.cpp
+++ b/WebCore/platform/Widget.cpp
@@ -105,7 +105,7 @@ IntPoint Widget::convertToContainingWindow(const IntPoint& localPoint) const
     return convertFromRootToContainingWindow(this, localPoint);
 }
 
-#if !PLATFORM(MAC)
+#if !PLATFORM(MAC) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 IntRect Widget::convertFromRootToContainingWindow(const Widget*, const IntRect& rect)
 {
     return rect;
@@ -127,7 +127,11 @@ IntPoint Widget::convertFromContainingWindowToRoot(const Widget*, const IntPoint
 }
 #endif
 
+<<<<<<< HEAD:WebCore/platform/Widget.cpp
 #if !PLATFORM(MAC) && !PLATFORM(GTK) && !PLATFORM(ANDROID)
+=======
+#if (!PLATFORM(MAC) && !PLATFORM(GTK)) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+>>>>>>> webkit.org at r51976:WebCore/platform/Widget.cpp
 void Widget::releasePlatformWidget()
 {
 }
diff --git a/WebCore/platform/Widget.h b/WebCore/platform/Widget.h
index cbbc427..a449d58 100644
--- a/WebCore/platform/Widget.h
+++ b/WebCore/platform/Widget.h
@@ -189,7 +189,7 @@ public:
 
     virtual void frameRectsChanged() {}
 
-#if PLATFORM(MAC)    
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     NSView* getOuterView() const;
     
     static void beforeMouseDown(NSView*, Widget*);
@@ -226,7 +226,7 @@ private:
     
     IntRect m_frame; // Not used when a native widget exists.
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     WidgetPrivate* m_data;
 #endif
 #if PLATFORM(ANDROID)
diff --git a/WebCore/platform/animation/AnimationList.h b/WebCore/platform/animation/AnimationList.h
index 9901424..afad422 100644
--- a/WebCore/platform/animation/AnimationList.h
+++ b/WebCore/platform/animation/AnimationList.h
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-class AnimationList {
+class AnimationList : public FastAllocBase {
 public:
     void fillUnsetProperties();
     bool operator==(const AnimationList& o) const;
diff --git a/WebCore/platform/cf/BinaryPropertyList.h b/WebCore/platform/cf/BinaryPropertyList.h
index 598aaa7..a930b43 100644
--- a/WebCore/platform/cf/BinaryPropertyList.h
+++ b/WebCore/platform/cf/BinaryPropertyList.h
@@ -26,6 +26,8 @@
 #ifndef BinaryPropertyList_h
 #define BinaryPropertyList_h
 
+#include <CoreFoundation/CoreFoundation.h>
+
 #include <wtf/Vector.h>
 
 namespace WebCore {
diff --git a/WebCore/platform/chromium/ChromiumBridge.h b/WebCore/platform/chromium/ChromiumBridge.h
index 0c80636..3709f7c 100644
--- a/WebCore/platform/chromium/ChromiumBridge.h
+++ b/WebCore/platform/chromium/ChromiumBridge.h
@@ -37,6 +37,8 @@
 #include "PassRefPtr.h"
 #include "PasteboardPrivate.h"
 
+#include <wtf/Vector.h>
+
 typedef struct NPObject NPObject;
 typedef struct _NPP NPP_t;
 typedef NPP_t* NPP;
@@ -58,6 +60,7 @@ namespace WebCore {
     class String;
     class Widget;
 
+    struct Cookie;
     struct PluginInfo;
 
     // An interface to the embedding layer, which has the ability to answer
@@ -82,6 +85,8 @@ namespace WebCore {
         // Cookies ------------------------------------------------------------
         static void setCookies(const KURL& url, const KURL& firstPartyForCookies, const String& value);
         static String cookies(const KURL& url, const KURL& firstPartyForCookies);
+        static bool rawCookies(const KURL& url, const KURL& firstPartyForCookies, Vector<Cookie>*);
+        static void deleteCookie(const KURL& url, const String& cookieName);
 
         // DNS ----------------------------------------------------------------
         static void prefetchDNS(const String& hostname);
@@ -113,13 +118,13 @@ namespace WebCore {
         // HTML5 DB -----------------------------------------------------------
 #if ENABLE(DATABASE)
         // Returns a handle to the DB file and ooptionally a handle to its containing directory
-        static PlatformFileHandle databaseOpenFile(const String& fileName, int desiredFlags, PlatformFileHandle* dirHandle = 0);
+        static PlatformFileHandle databaseOpenFile(const String& vfsFleName, int desiredFlags, PlatformFileHandle* dirHandle = 0);
         // Returns a SQLite code (SQLITE_OK = 0, on success)
-        static int databaseDeleteFile(const String& fileName, bool syncDir = false);
+        static int databaseDeleteFile(const String& vfsFileName, bool syncDir = false);
         // Returns the attributes of the DB file
-        static long databaseGetFileAttributes(const String& fileName);
+        static long databaseGetFileAttributes(const String& vfsFileName);
         // Returns the size of the DB file
-        static long long databaseGetFileSize(const String& fileName);
+        static long long databaseGetFileSize(const String& vfsFileName);
 #endif
 
         // JavaScript ---------------------------------------------------------
@@ -135,6 +140,11 @@ namespace WebCore {
         // LayoutTestMode -----------------------------------------------------
         static bool layoutTestMode();
 
+        // Memory -------------------------------------------------------------
+        // Returns the current space allocated for the pagefile, in MB.
+        // That is committed size for Windows and virtual memory size for POSIX
+        static int memoryUsageMB();
+
         // MimeType -----------------------------------------------------------
         static bool isSupportedImageMIMEType(const String& mimeType);
         static bool isSupportedJavaScriptMIMEType(const String& mimeType);
@@ -148,9 +158,6 @@ namespace WebCore {
         static NPObject* pluginScriptableObject(Widget*);
         static bool popupsAllowed(NPP);
 
-        // Protocol -----------------------------------------------------------
-        static String uiResourceProtocol();  // deprecated
-
         // Resources ----------------------------------------------------------
         static PassRefPtr<Image> loadPlatformImageResource(const char* name);
 
diff --git a/WebCore/platform/chromium/ClipboardChromium.cpp b/WebCore/platform/chromium/ClipboardChromium.cpp
index d330d3b..1a2caa4 100644
--- a/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -354,7 +354,7 @@ void ClipboardChromium::writeRange(Range* selectedRange, Frame* frame)
     m_dataObject->textHtml = createMarkup(selectedRange, 0,
         AnnotateForInterchange);
 #if PLATFORM(DARWIN)
-    m_dataObject->textHtml = String("<meta charset='utf-8'>") + m_dataObject->textHtml;
+    m_dataObject->textHtml = String("<meta charset='utf-8' id='webkit-interchange-charset'>") + m_dataObject->textHtml;
 #endif
     m_dataObject->htmlBaseUrl = frame->document()->url();
 
diff --git a/WebCore/platform/chromium/ContextMenuChromium.cpp b/WebCore/platform/chromium/ContextMenuChromium.cpp
index 0614e3e..93c0ec4 100644
--- a/WebCore/platform/chromium/ContextMenuChromium.cpp
+++ b/WebCore/platform/chromium/ContextMenuChromium.cpp
@@ -38,13 +38,11 @@ namespace WebCore {
 
 ContextMenu::ContextMenu(const HitTestResult& result)
     : m_hitTestResult(result)
-    , m_platformDescription(0)
 {
 }
 
 ContextMenu::ContextMenu(const HitTestResult& result, const PlatformMenuDescription menu)
     : m_hitTestResult(result)
-    , m_platformDescription(0)
 {
 }
 
@@ -54,25 +52,31 @@ ContextMenu::~ContextMenu()
 
 unsigned ContextMenu::itemCount() const
 {
-    return 0;
+    return m_items.size();
 }
 
 void ContextMenu::insertItem(unsigned position, ContextMenuItem& item)
 {
+    m_items.insert(position, item);
 }
 
 void ContextMenu::appendItem(ContextMenuItem& item)
 {
+    m_items.append(item);
 }
 
 ContextMenuItem* ContextMenu::itemWithAction(unsigned action)
 {
+    for (size_t i = 0; i < m_items.size(); ++i) {
+        if (m_items[i].action() == static_cast<ContextMenuAction>(action))
+            return &m_items[i];
+    }
     return 0;
 }
 
 ContextMenuItem* ContextMenu::itemAtIndex(unsigned index, const PlatformMenuDescription platformDescription)
 {
-    return 0;
+    return &m_items[index];
 }
 
 void ContextMenu::setPlatformDescription(PlatformMenuDescription menu)
@@ -81,7 +85,7 @@ void ContextMenu::setPlatformDescription(PlatformMenuDescription menu)
 
 PlatformMenuDescription ContextMenu::platformDescription() const
 {
-    return m_platformDescription;
+    return 0;
 }
 
 PlatformMenuDescription ContextMenu::releasePlatformDescription()
diff --git a/WebCore/platform/chromium/ContextMenuItemChromium.cpp b/WebCore/platform/chromium/ContextMenuItemChromium.cpp
index f34ea23..6a0d657 100644
--- a/WebCore/platform/chromium/ContextMenuItemChromium.cpp
+++ b/WebCore/platform/chromium/ContextMenuItemChromium.cpp
@@ -46,6 +46,9 @@ ContextMenuItem::ContextMenuItem(ContextMenu* subMenu)
 
 ContextMenuItem::ContextMenuItem(ContextMenuItemType type, ContextMenuAction action, const String& title, ContextMenu* subMenu)
 {
+    m_platformDescription.type = type;
+    m_platformDescription.action = action;
+    m_platformDescription.title = title;
 }
 
 ContextMenuItem::~ContextMenuItem()
@@ -54,22 +57,32 @@ ContextMenuItem::~ContextMenuItem()
 
 PlatformMenuItemDescription ContextMenuItem::releasePlatformDescription()
 {
-    return PlatformMenuItemDescription();
+    return m_platformDescription;
 }
 
 ContextMenuItemType ContextMenuItem::type() const
 {
-    return ContextMenuItemType();
+    return m_platformDescription.type;
 }
 
 ContextMenuAction ContextMenuItem::action() const
 { 
-    return ContextMenuAction();
+    return m_platformDescription.action;
 }
 
 String ContextMenuItem::title() const 
 {
-    return String();
+    return m_platformDescription.title;
+}
+
+bool ContextMenuItem::checked() const
+{
+    return m_platformDescription.checked;
+}
+
+bool ContextMenuItem::enabled() const
+{
+    return m_platformDescription.enabled;
 }
 
 PlatformMenuDescription ContextMenuItem::platformSubMenu() const
@@ -79,14 +92,17 @@ PlatformMenuDescription ContextMenuItem::platformSubMenu() const
 
 void ContextMenuItem::setType(ContextMenuItemType type)
 {
+    m_platformDescription.type = type;
 }
 
 void ContextMenuItem::setAction(ContextMenuAction action)
 {
+    m_platformDescription.action = action;
 }
 
 void ContextMenuItem::setTitle(const String& title)
 {
+    m_platformDescription.title = title;
 }
 
 void ContextMenuItem::setSubMenu(ContextMenu* subMenu)
@@ -95,15 +111,12 @@ void ContextMenuItem::setSubMenu(ContextMenu* subMenu)
 
 void ContextMenuItem::setChecked(bool checked)
 {
+    m_platformDescription.checked = checked;
 }
 
 void ContextMenuItem::setEnabled(bool enabled)
 {
-}
-
-bool ContextMenuItem::enabled() const
-{
-    return false;
+    m_platformDescription.enabled = enabled;
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/GeolocationServiceChromium.cpp b/WebCore/platform/chromium/GeolocationServiceChromium.cpp
new file mode 100644
index 0000000..65886b0
--- /dev/null
+++ b/WebCore/platform/chromium/GeolocationServiceChromium.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GeolocationService.h"
+
+namespace WebCore {
+
+class GeolocationServiceChromium : public GeolocationService {
+public:
+    GeolocationServiceChromium(GeolocationServiceClient* c)
+        : GeolocationService(c)
+    {
+    }
+    // FIXME: Implement. https://bugs.webkit.org/show_bug.cgi?id=32068
+};
+
+// This guard is the counterpart of the one in WebCore/platform/GeolocationService.cpp
+#if ENABLE(GEOLOCATION)
+static GeolocationService* createGeolocationService(GeolocationServiceClient* c)
+{
+    return new GeolocationServiceChromium(c);
+}
+
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &createGeolocationService;
+#endif
+
+} // namespace WebCore
diff --git a/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp b/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
index 51bff80..ff0be82 100644
--- a/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
+++ b/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
@@ -34,6 +34,7 @@
 #include "ChromiumBridge.h"
 #include "CString.h"
 #include "MediaPlayer.h"
+#include "PluginDataChromium.h"
 
 // NOTE: Unlike other ports, we don't use the shared implementation bits in
 // MIMETypeRegistry.cpp.  Instead, we need to route most functions via the
@@ -41,11 +42,6 @@
 
 namespace WebCore {
 
-// Checks if any of the plugins handle this extension, and if so returns the
-// plugin's mime type for this extension.  Otherwise returns an empty string.
-// See PluginsChromium.cpp for the implementation of this function.
-String getPluginMimeTypeFromExtension(const String& extension);
-
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
     return ChromiumBridge::mimeTypeForExtension(ext);
diff --git a/WebCore/platform/chromium/PasteboardChromium.cpp b/WebCore/platform/chromium/PasteboardChromium.cpp
index 4929eb8..ce06e55 100644
--- a/WebCore/platform/chromium/PasteboardChromium.cpp
+++ b/WebCore/platform/chromium/PasteboardChromium.cpp
@@ -83,7 +83,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
 {
     String html = createMarkup(selectedRange, 0, AnnotateForInterchange);
 #if PLATFORM(DARWIN)
-    html = String("<meta charset='utf-8'>") + html;
+    html = String("<meta charset='utf-8' id='webkit-interchange-charset'>") + html;
 #endif
     ExceptionCode ec = 0;
     KURL url = selectedRange->startContainer(ec)->document()->url();
@@ -170,6 +170,11 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
         String markup;
         KURL srcURL;
         ChromiumBridge::clipboardReadHTML(buffer, &markup, &srcURL);
+#if PLATFORM(DARWIN)
+        DEFINE_STATIC_LOCAL(const String, forceUtf8String, ("<meta charset='utf-8' id='webkit-interchange-charset'>"));
+        if (markup.startsWith(forceUtf8String))
+            markup = markup.substring(forceUtf8String.length());
+#endif
 
         RefPtr<DocumentFragment> fragment =
             createFragmentFromMarkup(frame->document(), markup, srcURL);
diff --git a/WebCore/platform/chromium/PopupMenuChromium.cpp b/WebCore/platform/chromium/PopupMenuChromium.cpp
index d6f895d..5abd364 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.cpp
+++ b/WebCore/platform/chromium/PopupMenuChromium.cpp
@@ -370,6 +370,12 @@ void PopupContainer::showExternal(const IntRect& rect, FrameView* v, int index)
     ChromeClientChromium* client = static_cast<ChromeClientChromium*>(
          v->frame()->page()->chrome()->client());
     client->popupOpened(this, popupRect, true, true);
+
+    // The popup sends its "closed" notification through its parent. Set the
+    // parent, even though external popups have no real on-screen widget but a
+    // native menu (see |PopupListBox::hidePopup()|);
+    if (!m_listBox->parent())
+        addChild(m_listBox.get());
 }
 
 void PopupContainer::hidePopup()
@@ -446,7 +452,7 @@ void PopupContainer::paintBorder(GraphicsContext* gc, const IntRect& rect)
     Color borderColor(127, 157, 185);
 
     gc->setStrokeStyle(NoStroke);
-    gc->setFillColor(borderColor);
+    gc->setFillColor(borderColor, DeviceColorSpace);
 
     int tx = x();
     int ty = y();
@@ -772,7 +778,7 @@ void PopupListBox::paint(GraphicsContext* gc, const IntRect& rect)
 
     // Special case for an empty popup.
     if (numItems() == 0)
-        gc->fillRect(r, Color::white);
+        gc->fillRect(r, Color::white, DeviceColorSpace);
 
     gc->restore();
 
@@ -805,23 +811,23 @@ void PopupListBox::paintRow(GraphicsContext* gc, const IntRect& rect, int rowInd
     // If we have a transparent background, make sure it has a color to blend
     // against.
     if (backColor.hasAlpha())
-        gc->fillRect(rowRect, Color::white);
+        gc->fillRect(rowRect, Color::white, DeviceColorSpace);
 
-    gc->fillRect(rowRect, backColor);
+    gc->fillRect(rowRect, backColor, DeviceColorSpace);
     
     if (m_popupClient->itemIsSeparator(rowIndex)) {
         IntRect separatorRect(
             rowRect.x() + separatorPadding,
             rowRect.y() + (rowRect.height() - separatorHeight) / 2,
             rowRect.width() - 2 * separatorPadding, separatorHeight);
-        gc->fillRect(separatorRect, textColor);
+        gc->fillRect(separatorRect, textColor, DeviceColorSpace);
         return;
     }
     
     if (!style.isVisible())
         return;
 
-    gc->setFillColor(textColor);
+    gc->setFillColor(textColor, DeviceColorSpace);
 
     Font itemFont = getRowFont(rowIndex);
     // FIXME: http://crbug.com/19872 We should get the padding of individual option
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index 725de10..a6720a1 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -113,7 +113,7 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, Scrollbar*
         const int yPos = rect.topLeft().y() + (rect.height() * percent);
 
         IntPoint tick(scrollbar->x(), yPos);
-        context->drawImage(dash.get(), tick);
+        context->drawImage(dash.get(), DeviceColorSpace, tick);
     }
 
     context->restore();
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
index 64f58c4..3a1a652 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
@@ -33,6 +33,8 @@
 
 #include "PlatformContextSkia.h"
 #include "PlatformMouseEvent.h"
+#include "RenderTheme.h"
+#include "RenderThemeChromiumLinux.h"
 #include "Scrollbar.h"
 #include "TransformationMatrix.h"
 
@@ -73,6 +75,60 @@ static void drawBox(SkCanvas* canvas, const IntRect& rect, const SkPaint& paint)
     drawVertLine(canvas, rect.x(), rect.y(), bottom, paint);
 }
 
+static SkScalar clamp(SkScalar value, SkScalar min, SkScalar max)
+{
+    return std::min(std::max(value, min), max);
+}
+
+static SkColor saturateAndBrighten(SkScalar* hsv,
+                                   SkScalar saturateAmount,
+                                   SkScalar brightenAmount)
+{
+    SkScalar color[3];
+    color[0] = hsv[0];
+    color[1] = clamp(hsv[1] + saturateAmount, 0.0, 1.0);
+    color[2] = clamp(hsv[2] + brightenAmount, 0.0, 1.0);
+    return SkHSVToColor(color);
+}
+
+static SkColor outlineColor(SkScalar* hsv1, SkScalar* hsv2)
+{
+    // GTK Theme engines have way too much control over the layout of
+    // the scrollbar. We might be able to more closely approximate its
+    // look-and-feel, if we sent whole images instead of just colors
+    // from the browser to the renderer. But even then, some themes
+    // would just break.
+    //
+    // So, instead, we don't even try to 100% replicate the look of
+    // the native scrollbar. We render our own version, but we make
+    // sure to pick colors that blend in nicely with the system GTK
+    // theme. In most cases, we can just sample a couple of pixels
+    // from the system scrollbar and use those colors to draw our
+    // scrollbar.
+    //
+    // This works fine for the track color and the overall thumb
+    // color. But it fails spectacularly for the outline color used
+    // around the thumb piece.  Not all themes have a clearly defined
+    // outline. For some of them it is partially transparent, and for
+    // others the thickness is very unpredictable.
+    //
+    // So, instead of trying to approximate the system theme, we
+    // instead try to compute a reasonable looking choice based on the
+    // known color of the track and the thumb piece. This is difficult
+    // when trying to deal both with high- and low-contrast themes,
+    // and both with positive and inverted themes.
+    //
+    // The following code has been tested to look OK with all of the
+    // default GTK themes.
+    SkScalar minDiff = clamp((hsv1[1] + hsv2[1]) * 1.2, 0.2, 0.5);
+    SkScalar diff = clamp(fabs(hsv1[2] - hsv2[2]) / 2, minDiff, 0.5);
+
+    if (hsv1[2] + hsv2[2] > 1.0)
+        diff = -diff;
+
+    return saturateAndBrighten(hsv2, -0.2, diff);
+}
+
 IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
 {
     IntSize bs = buttonSize(scrollbar);
@@ -89,10 +145,16 @@ void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar
     SkIRect skrect;
 
     skrect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
-    paint.setARGB(0xff, 0xe3, 0xdd, 0xd8);
+    SkScalar track_hsv[3];
+    SkColorToHSV(RenderThemeChromiumLinux::trackColor(), track_hsv);
+    paint.setColor(saturateAndBrighten(track_hsv, 0, 0));
     canvas->drawIRect(skrect, paint);
 
-    paint.setARGB(0xff, 0xc5, 0xba, 0xb0);
+    SkScalar thumb_hsv[3];
+    SkColorToHSV(RenderThemeChromiumLinux::thumbInactiveColor(),
+                 thumb_hsv);
+
+    paint.setColor(outlineColor(track_hsv, thumb_hsv));
     drawBox(canvas, rect, paint);
 }
 
@@ -109,11 +171,14 @@ void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scr
     const bool vertical = scrollbar->orientation() == VerticalScrollbar;
     SkCanvas* const canvas = gc->platformContext()->canvas();
 
+    SkScalar thumb[3];
+    SkColorToHSV(hovered
+                 ? RenderThemeChromiumLinux::thumbActiveColor()
+                 : RenderThemeChromiumLinux::thumbInactiveColor(),
+                 thumb);
+
     SkPaint paint;
-    if (hovered)
-        paint.setARGB(0xff, 0xff, 0xff, 0xff);
-    else
-        paint.setARGB(0xff, 0xf4, 0xf2, 0xef);
+    paint.setColor(saturateAndBrighten(thumb, 0, 0.02));
 
     SkIRect skrect;
     if (vertical)
@@ -123,10 +188,7 @@ void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scr
 
     canvas->drawIRect(skrect, paint);
 
-    if (hovered)
-        paint.setARGB(0xff, 0xf4, 0xf2, 0xef);
-    else
-        paint.setARGB(0xff, 0xea, 0xe5, 0xe0);
+    paint.setColor(saturateAndBrighten(thumb, 0, -0.02));
 
     if (vertical)
         skrect.set(midx + 1, rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
@@ -135,11 +197,12 @@ void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scr
 
     canvas->drawIRect(skrect, paint);
 
-    paint.setARGB(0xff, 0x9d, 0x96, 0x8e);
+    SkScalar track[3];
+    SkColorToHSV(RenderThemeChromiumLinux::trackColor(), track);
+    paint.setColor(outlineColor(track, thumb));
     drawBox(canvas, rect, paint);
 
     if (rect.height() > 10 && rect.width() > 10) {
-        paint.setARGB(0xff, 0x9d, 0x96, 0x8e);
         const int grippyHalfWidth = 2;
         const int interGrippyOffset = 3;
         if (vertical) {
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
new file mode 100644
index 0000000..1ab2f18
--- /dev/null
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScrollbarThemeChromiumMac_h
+#define ScrollbarThemeChromiumMac_h
+
+#include "ScrollbarThemeComposite.h"
+
+// This file (and its associated .mm file) is a clone of ScrollbarThemeMac.h.
+// See the .mm file for details.
+
+namespace WebCore {
+
+class ScrollbarThemeChromiumMac : public ScrollbarThemeComposite {
+public:
+    ScrollbarThemeChromiumMac();
+    virtual ~ScrollbarThemeChromiumMac();
+
+    virtual bool paint(Scrollbar*, GraphicsContext* context, const IntRect& damageRect);
+
+    virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
+
+    virtual bool supportsControlTints() const { return true; }
+
+    virtual double initialAutoscrollTimerDelay();
+    virtual double autoscrollTimerDelay();
+
+    virtual ScrollbarButtonsPlacement buttonsPlacement() const;
+
+    virtual void registerScrollbar(Scrollbar*);
+    virtual void unregisterScrollbar(Scrollbar*);
+
+protected:
+    virtual bool hasButtons(Scrollbar*);
+    virtual bool hasThumb(Scrollbar*);
+
+    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+
+    virtual int minimumThumbLength(Scrollbar*);
+
+    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
+
+public:
+    void preferencesChanged();
+};
+
+}
+
+#endif // ScrollbarThemeChromiumMac_h
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
new file mode 100644
index 0000000..b4ebaf6
--- /dev/null
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
@@ -0,0 +1,463 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScrollbarThemeChromiumMac.h"
+
+#include "ImageBuffer.h"
+#include "PlatformMouseEvent.h"
+#include "ScrollView.h"
+#include <Carbon/Carbon.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
+
+// FIXME: There are repainting problems due to Aqua scroll bar buttons' visual overflow.
+
+using namespace std;
+using namespace WebCore;
+
+// This file (and its associated .h file) is a clone of ScrollbarThemeMac.mm.
+// Because we want to draw tickmarks in the scrollbar, we must maintain a fork.
+// Please maintain this file by performing parallel changes to it.
+//
+// The only changes from ScrollbarThemeMac should be:
+// - The classname change from ScrollbarThemeMac to ScrollbarThemeChromiumMac.
+// - In paint() the code to paint the track, tickmarks, and thumb separately.
+//
+// For all other differences, if it was introduced in this file, then the
+// maintainer forgot to include it in the list; otherwise it is an update that
+// should have been applied to this file but was not.
+
+static HashSet<Scrollbar*>* gScrollbars;
+
+@interface ScrollbarPrefsObserver : NSObject
+{
+
+}
+
++ (void)registerAsObserver;
++ (void)appearancePrefsChanged:(NSNotification*)theNotification;
++ (void)behaviorPrefsChanged:(NSNotification*)theNotification;
+
+@end
+
+@implementation ScrollbarPrefsObserver
+
++ (void)appearancePrefsChanged:(NSNotification*)unusedNotification
+{
+    UNUSED_PARAM(unusedNotification);
+
+    static_cast<ScrollbarThemeChromiumMac*>(ScrollbarTheme::nativeTheme())->preferencesChanged();
+    if (!gScrollbars)
+        return;
+    HashSet<Scrollbar*>::iterator end = gScrollbars->end();
+    for (HashSet<Scrollbar*>::iterator it = gScrollbars->begin(); it != end; ++it) {
+        (*it)->styleChanged();
+        (*it)->invalidate();
+    }
+}
+
++ (void)behaviorPrefsChanged:(NSNotification*)unusedNotification
+{
+    UNUSED_PARAM(unusedNotification);
+
+    static_cast<ScrollbarThemeChromiumMac*>(ScrollbarTheme::nativeTheme())->preferencesChanged();
+}
+
++ (void)registerAsObserver
+{
+    [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(appearancePrefsChanged:) name:@"AppleAquaScrollBarVariantChanged" object:nil suspensionBehavior:NSNotificationSuspensionBehaviorDeliverImmediately];
+    [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(behaviorPrefsChanged:) name:@"AppleNoRedisplayAppearancePreferenceChanged" object:nil suspensionBehavior:NSNotificationSuspensionBehaviorCoalesce];
+}
+
+@end
+
+namespace WebCore {
+
+ScrollbarTheme* ScrollbarTheme::nativeTheme()
+{
+    DEFINE_STATIC_LOCAL(ScrollbarThemeChromiumMac, theme, ());
+    return &theme;
+}
+
+// FIXME: Get these numbers from CoreUI.
+static int cScrollbarThickness[] = { 15, 11 };
+static int cRealButtonLength[] = { 28, 21 };
+static int cButtonInset[] = { 14, 11 };
+static int cButtonHitInset[] = { 3, 2 };
+// cRealButtonLength - cButtonInset
+static int cButtonLength[] = { 14, 10 };
+static int cThumbMinLength[] = { 26, 20 };
+
+static int cOuterButtonLength[] = { 16, 14 }; // The outer button in a double button pair is a bit bigger.
+static int cOuterButtonOverlap = 2;
+
+static float gInitialButtonDelay = 0.5f;
+static float gAutoscrollButtonDelay = 0.05f;
+static bool gJumpOnTrackClick = false;
+static ScrollbarButtonsPlacement gButtonPlacement = ScrollbarButtonsDoubleEnd;
+
+static void updateArrowPlacement()
+{
+    NSString *buttonPlacement = [[NSUserDefaults standardUserDefaults] objectForKey:@"AppleScrollBarVariant"];
+    if ([buttonPlacement isEqualToString:@"Single"])
+        gButtonPlacement = ScrollbarButtonsSingle;
+    else if ([buttonPlacement isEqualToString:@"DoubleMin"])
+        gButtonPlacement = ScrollbarButtonsDoubleStart;
+    else if ([buttonPlacement isEqualToString:@"DoubleBoth"])
+        gButtonPlacement = ScrollbarButtonsDoubleBoth;
+    else
+        gButtonPlacement = ScrollbarButtonsDoubleEnd; // The default is ScrollbarButtonsDoubleEnd.
+}
+
+void ScrollbarThemeChromiumMac::registerScrollbar(Scrollbar* scrollbar)
+{
+    if (!gScrollbars)
+        gScrollbars = new HashSet<Scrollbar*>;
+    gScrollbars->add(scrollbar);
+}
+
+void ScrollbarThemeChromiumMac::unregisterScrollbar(Scrollbar* scrollbar)
+{
+    gScrollbars->remove(scrollbar);
+    if (gScrollbars->isEmpty()) {
+        delete gScrollbars;
+        gScrollbars = 0;
+    }
+}
+
+ScrollbarThemeChromiumMac::ScrollbarThemeChromiumMac()
+{
+    static bool initialized;
+    if (!initialized) {
+        initialized = true;
+        [ScrollbarPrefsObserver registerAsObserver];
+        preferencesChanged();
+    }
+}
+
+ScrollbarThemeChromiumMac::~ScrollbarThemeChromiumMac()
+{
+}
+
+void ScrollbarThemeChromiumMac::preferencesChanged()
+{
+    NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
+    [defaults synchronize];
+    updateArrowPlacement();
+    gInitialButtonDelay = [defaults floatForKey:@"NSScrollerButtonDelay"];
+    gAutoscrollButtonDelay = [defaults floatForKey:@"NSScrollerButtonPeriod"];
+    gJumpOnTrackClick = [defaults boolForKey:@"AppleScrollerPagingBehavior"];
+}
+
+int ScrollbarThemeChromiumMac::scrollbarThickness(ScrollbarControlSize controlSize)
+{
+    return cScrollbarThickness[controlSize];
+}
+
+double ScrollbarThemeChromiumMac::initialAutoscrollTimerDelay()
+{
+    return gInitialButtonDelay;
+}
+
+double ScrollbarThemeChromiumMac::autoscrollTimerDelay()
+{
+    return gAutoscrollButtonDelay;
+}
+
+ScrollbarButtonsPlacement ScrollbarThemeChromiumMac::buttonsPlacement() const
+{
+    return gButtonPlacement;
+}
+
+bool ScrollbarThemeChromiumMac::hasButtons(Scrollbar* scrollbar)
+{
+    return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ?
+             scrollbar->width() :
+             scrollbar->height()) >= 2 * (cRealButtonLength[scrollbar->controlSize()] - cButtonHitInset[scrollbar->controlSize()]);
+}
+
+bool ScrollbarThemeChromiumMac::hasThumb(Scrollbar* scrollbar)
+{
+    return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ?
+             scrollbar->width() :
+             scrollbar->height()) >= 2 * cButtonInset[scrollbar->controlSize()] + cThumbMinLength[scrollbar->controlSize()] + 1;
+}
+
+static IntRect buttonRepaintRect(const IntRect& buttonRect, ScrollbarOrientation orientation, ScrollbarControlSize controlSize, bool start)
+{
+    IntRect paintRect(buttonRect);
+    if (orientation == HorizontalScrollbar) {
+        paintRect.setWidth(cRealButtonLength[controlSize]);
+        if (!start)
+            paintRect.setX(buttonRect.x() - (cRealButtonLength[controlSize] - buttonRect.width()));
+    } else {
+        paintRect.setHeight(cRealButtonLength[controlSize]);
+        if (!start)
+            paintRect.setY(buttonRect.y() - (cRealButtonLength[controlSize] - buttonRect.height()));
+    }
+
+    return paintRect;
+}
+
+IntRect ScrollbarThemeChromiumMac::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+{
+    IntRect result;
+
+    if (part == BackButtonStartPart && (buttonsPlacement() == ScrollbarButtonsNone || buttonsPlacement() == ScrollbarButtonsDoubleEnd))
+        return result;
+
+    if (part == BackButtonEndPart && (buttonsPlacement() == ScrollbarButtonsNone || buttonsPlacement() == ScrollbarButtonsDoubleStart || buttonsPlacement() == ScrollbarButtonsSingle))
+        return result;
+
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    bool outerButton = part == BackButtonStartPart && (buttonsPlacement() == ScrollbarButtonsDoubleStart || buttonsPlacement() == ScrollbarButtonsDoubleBoth);
+    if (outerButton) {
+        if (scrollbar->orientation() == HorizontalScrollbar)
+            result = IntRect(scrollbar->x(), scrollbar->y(), cOuterButtonLength[scrollbar->controlSize()] + painting ? cOuterButtonOverlap : 0, thickness);
+        else
+            result = IntRect(scrollbar->x(), scrollbar->y(), thickness, cOuterButtonLength[scrollbar->controlSize()] + painting ? cOuterButtonOverlap : 0);
+        return result;
+    }
+
+    // Our repaint rect is slightly larger, since we are a button that is adjacent to the track.
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        int start = part == BackButtonStartPart ? scrollbar->x() : scrollbar->x() + scrollbar->width() - cOuterButtonLength[scrollbar->controlSize()] - cButtonLength[scrollbar->controlSize()];
+        result = IntRect(start, scrollbar->y(), cButtonLength[scrollbar->controlSize()], thickness);
+    } else {
+        int start = part == BackButtonStartPart ? scrollbar->y() : scrollbar->y() + scrollbar->height() - cOuterButtonLength[scrollbar->controlSize()] - cButtonLength[scrollbar->controlSize()];
+        result = IntRect(scrollbar->x(), start, thickness, cButtonLength[scrollbar->controlSize()]);
+    }
+
+    if (painting)
+        return buttonRepaintRect(result, scrollbar->orientation(), scrollbar->controlSize(), part == BackButtonStartPart);
+    return result;
+}
+
+IntRect ScrollbarThemeChromiumMac::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+{
+    IntRect result;
+
+    if (part == ForwardButtonEndPart && (buttonsPlacement() == ScrollbarButtonsNone || buttonsPlacement() == ScrollbarButtonsDoubleStart))
+        return result;
+
+    if (part == ForwardButtonStartPart && (buttonsPlacement() == ScrollbarButtonsNone || buttonsPlacement() == ScrollbarButtonsDoubleEnd || buttonsPlacement() == ScrollbarButtonsSingle))
+        return result;
+
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    int outerButtonLength = cOuterButtonLength[scrollbar->controlSize()];
+    int buttonLength = cButtonLength[scrollbar->controlSize()];
+
+    bool outerButton = part == ForwardButtonEndPart && (buttonsPlacement() == ScrollbarButtonsDoubleEnd || buttonsPlacement() == ScrollbarButtonsDoubleBoth);
+    if (outerButton) {
+        if (scrollbar->orientation() == HorizontalScrollbar) {
+            result = IntRect(scrollbar->x() + scrollbar->width() - outerButtonLength, scrollbar->y(), outerButtonLength, thickness);
+            if (painting)
+                result.inflateX(cOuterButtonOverlap);
+        } else {
+            result = IntRect(scrollbar->x(), scrollbar->y() + scrollbar->height() - outerButtonLength, thickness, outerButtonLength);
+            if (painting)
+                result.inflateY(cOuterButtonOverlap);
+        }
+        return result;
+    }
+
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        int start = part == ForwardButtonEndPart ? scrollbar->x() + scrollbar->width() - buttonLength : scrollbar->x() + outerButtonLength;
+        result = IntRect(start, scrollbar->y(), buttonLength, thickness);
+    } else {
+        int start = part == ForwardButtonEndPart ? scrollbar->y() + scrollbar->height() - buttonLength : scrollbar->y() + outerButtonLength;
+        result = IntRect(scrollbar->x(), start, thickness, buttonLength);
+    }
+    if (painting)
+        return buttonRepaintRect(result, scrollbar->orientation(), scrollbar->controlSize(), part == ForwardButtonStartPart);
+    return result;
+}
+
+IntRect ScrollbarThemeChromiumMac::trackRect(Scrollbar* scrollbar, bool painting)
+{
+    if (painting || !hasButtons(scrollbar))
+        return scrollbar->frameRect();
+
+    IntRect result;
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    int startWidth = 0;
+    int endWidth = 0;
+    int outerButtonLength = cOuterButtonLength[scrollbar->controlSize()];
+    int buttonLength = cButtonLength[scrollbar->controlSize()];
+    int doubleButtonLength = outerButtonLength + buttonLength;
+    switch (buttonsPlacement()) {
+        case ScrollbarButtonsSingle:
+            startWidth = buttonLength;
+            endWidth = buttonLength;
+            break;
+        case ScrollbarButtonsDoubleStart:
+            startWidth = doubleButtonLength;
+            break;
+        case ScrollbarButtonsDoubleEnd:
+            endWidth = doubleButtonLength;
+            break;
+        case ScrollbarButtonsDoubleBoth:
+            startWidth = doubleButtonLength;
+            endWidth = doubleButtonLength;
+            break;
+        default:
+            break;
+    }
+
+    int totalWidth = startWidth + endWidth;
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        return IntRect(scrollbar->x() + startWidth, scrollbar->y(), scrollbar->width() - totalWidth, thickness);
+    return IntRect(scrollbar->x(), scrollbar->y() + startWidth, thickness, scrollbar->height() - totalWidth);
+}
+
+int ScrollbarThemeChromiumMac::minimumThumbLength(Scrollbar* scrollbar)
+{
+    return cThumbMinLength[scrollbar->controlSize()];
+}
+
+bool ScrollbarThemeChromiumMac::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+{
+    if (evt.button() != LeftButton)
+        return false;
+    if (gJumpOnTrackClick)
+        return !evt.altKey();
+    return evt.altKey();
+}
+
+static int scrollbarPartToHIPressedState(ScrollbarPart part)
+{
+    switch (part) {
+        case BackButtonStartPart:
+            return kThemeTopOutsideArrowPressed;
+        case BackButtonEndPart:
+            return kThemeTopOutsideArrowPressed; // This does not make much sense.  For some reason the outside constant is required.
+        case ForwardButtonStartPart:
+            return kThemeTopInsideArrowPressed;
+        case ForwardButtonEndPart:
+            return kThemeBottomOutsideArrowPressed;
+        case ThumbPart:
+            return kThemeThumbPressed;
+        default:
+            return 0;
+    }
+}
+
+bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& damageRect)
+{
+    HIThemeTrackDrawInfo trackInfo;
+    trackInfo.version = 0;
+    trackInfo.kind = scrollbar->controlSize() == RegularScrollbar ? kThemeMediumScrollBar : kThemeSmallScrollBar;
+    trackInfo.bounds = scrollbar->frameRect();
+    trackInfo.min = 0;
+    trackInfo.max = scrollbar->maximum();
+    trackInfo.value = scrollbar->currentPos();
+    trackInfo.trackInfo.scrollbar.viewsize = scrollbar->pageStep();
+    trackInfo.attributes = 0;
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        trackInfo.attributes |= kThemeTrackHorizontal;
+
+    if (!scrollbar->enabled())
+        trackInfo.enableState = kThemeTrackDisabled;
+    else
+        trackInfo.enableState = scrollbar->client()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+
+    if (!hasButtons(scrollbar))
+        trackInfo.enableState = kThemeTrackNothingToScroll;
+    trackInfo.trackInfo.scrollbar.pressState = scrollbarPartToHIPressedState(scrollbar->pressedPart());
+
+    CGAffineTransform currentCTM = CGContextGetCTM(context->platformContext());
+
+    // The Aqua scrollbar is buggy when rotated and scaled.  We will just draw into a bitmap if we detect a scale or rotation.
+    bool canDrawDirectly = currentCTM.a == 1.0f && currentCTM.b == 0.0f && currentCTM.c == 0.0f && (currentCTM.d == 1.0f || currentCTM.d == -1.0f);
+    GraphicsContext* drawingContext = context;
+    OwnPtr<ImageBuffer> imageBuffer;
+    if (!canDrawDirectly) {
+        trackInfo.bounds = IntRect(IntPoint(), scrollbar->frameRect().size());
+
+        IntRect bufferRect(scrollbar->frameRect());
+        bufferRect.intersect(damageRect);
+        bufferRect.move(-scrollbar->frameRect().x(), -scrollbar->frameRect().y());
+
+        imageBuffer = ImageBuffer::create(bufferRect.size());
+        if (!imageBuffer)
+            return true;
+
+        drawingContext = imageBuffer->context();
+    }
+
+    // Draw thumbless.
+    HIThemeDrawTrack(&trackInfo, 0, drawingContext->platformContext(), kHIThemeOrientationNormal);
+
+    Vector<IntRect> tickmarks;
+    scrollbar->client()->getTickmarks(tickmarks);
+    if (scrollbar->orientation() == VerticalScrollbar && tickmarks.size()) {
+        drawingContext->save();
+        drawingContext->setShouldAntialias(false);
+        drawingContext->setStrokeColor(Color(0xCC, 0xAA, 0x00, 0xFF), DeviceColorSpace);
+        drawingContext->setFillColor(Color(0xFF, 0xDD, 0x00, 0xFF), DeviceColorSpace);
+
+        IntRect thumbArea = trackRect(scrollbar, false);
+        if (!canDrawDirectly) {
+            thumbArea.setX(0);
+            thumbArea.setY(0);
+        }
+        // The ends are rounded and the thumb doesn't go there.
+        thumbArea.inflateY(-thumbArea.width());
+
+        for (Vector<IntRect>::const_iterator i = tickmarks.begin(); i != tickmarks.end(); ++i) {
+            // Calculate how far down (in %) the tick-mark should appear.
+            const float percent = static_cast<float>(i->y()) / scrollbar->totalSize();
+            if (percent < 0.0 || percent > 1.0)
+              continue;
+
+            // Calculate how far down (in pixels) the tick-mark should appear.
+            const int yPos = static_cast<int>((thumbArea.topLeft().y() + (thumbArea.height() * percent))) & ~1;
+
+            // Paint.
+            const int indent = 2;
+            FloatRect tickRect(thumbArea.topLeft().x() + indent, yPos, thumbArea.width() - 2 * indent - 1, 2);
+            drawingContext->fillRect(tickRect);
+            drawingContext->strokeRect(tickRect, 1);
+        }
+
+        drawingContext->restore();
+    }
+
+    if (hasThumb(scrollbar)) {
+        trackInfo.attributes |= (kThemeTrackShowThumb | kThemeTrackHideTrack);
+        HIThemeDrawTrack(&trackInfo, 0, drawingContext->platformContext(), kHIThemeOrientationNormal);
+    }
+
+    if (!canDrawDirectly) {
+        context->drawImage(imageBuffer->image(), DeviceColorSpace, scrollbar->frameRect().location());
+    }
+
+    return true;
+}
+
+}
+
diff --git a/WebCore/platform/graphics/BitmapImage.h b/WebCore/platform/graphics/BitmapImage.h
index 13641d2..a07daf2 100644
--- a/WebCore/platform/graphics/BitmapImage.h
+++ b/WebCore/platform/graphics/BitmapImage.h
@@ -140,8 +140,10 @@ public:
     virtual CGImageRef getCGImageRef();
 #endif
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) || (PLATFORM(QT) && PLATFORM(WIN_OS))
     static PassRefPtr<BitmapImage> create(HBITMAP);
+#endif
+#if PLATFORM(WIN)
     virtual bool getHBITMAP(HBITMAP);
     virtual bool getHBITMAPOfSize(HBITMAP, LPSIZE);
 #endif
@@ -167,13 +169,13 @@ protected:
     BitmapImage(ImageObserver* = 0);
 
 #if PLATFORM(WIN)
-    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator);
+    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator);
 #endif
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
 
 #if PLATFORM(WX) || (PLATFORM(WINCE) && !PLATFORM(QT))
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+                             const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator, const FloatRect& destRect);
 #endif
 
 #if PLATFORM(HAIKU)
diff --git a/WebCore/platform/graphics/Color.h b/WebCore/platform/graphics/Color.h
index 8e51b95..c348166 100644
--- a/WebCore/platform/graphics/Color.h
+++ b/WebCore/platform/graphics/Color.h
@@ -26,6 +26,7 @@
 #ifndef Color_h
 #define Color_h
 
+#include <wtf/FastAllocBase.h>
 #include <wtf/Platform.h>
 
 #if PLATFORM(CG)
@@ -68,7 +69,7 @@ RGBA32 makeRGBAFromCMYKA(float c, float m, float y, float k, float a);
 
 int differenceSquared(const Color&, const Color&);
 
-class Color {
+class Color : public FastAllocBase {
 public:
     Color() : m_color(0), m_valid(false) { }
     Color(RGBA32 col) : m_color(col), m_valid(true) { }
diff --git a/WebKit/mac/WebCoreSupport/WebGeolocationPrivate.h b/WebCore/platform/graphics/ColorSpace.h
index 5807f7c..1bad58c 100644
--- a/WebKit/mac/WebCoreSupport/WebGeolocationPrivate.h
+++ b/WebCore/platform/graphics/ColorSpace.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,15 +23,13 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import <Foundation/Foundation.h>
+#ifndef ColorSpace_h
+#define ColorSpace_h
 
-@class WebGeolocationPrivate;
+namespace WebCore {
 
-@interface WebGeolocation : NSObject {
-@private
-    WebGeolocationPrivate *_private;
-}
+    enum ColorSpace { DeviceColorSpace, sRGBColorSpace };
+    
+} // namespace WebCore
 
-- (BOOL)shouldClearCache;
-- (void)setIsAllowed:(BOOL)allowed;
-@end
+#endif // ColorSpace_h
diff --git a/WebCore/platform/graphics/FloatRect.cpp b/WebCore/platform/graphics/FloatRect.cpp
index 532f719..7a54f21 100644
--- a/WebCore/platform/graphics/FloatRect.cpp
+++ b/WebCore/platform/graphics/FloatRect.cpp
@@ -102,12 +102,12 @@ void FloatRect::unite(const FloatRect& other)
     m_size.setHeight(b - t);
 }
 
-void FloatRect::scale(float s)
+void FloatRect::scale(float sx, float sy)
 {
-    m_location.setX(x() * s);
-    m_location.setY(y() * s);
-    m_size.setWidth(width() * s);
-    m_size.setHeight(height() * s);
+    m_location.setX(x() * sx);
+    m_location.setY(y() * sy);
+    m_size.setWidth(width() * sx);
+    m_size.setHeight(height() * sy);
 }
 
 IntRect enclosingIntRect(const FloatRect& rect)
diff --git a/WebCore/platform/graphics/FloatRect.h b/WebCore/platform/graphics/FloatRect.h
index 50cb095..4b4694f 100644
--- a/WebCore/platform/graphics/FloatRect.h
+++ b/WebCore/platform/graphics/FloatRect.h
@@ -120,7 +120,8 @@ public:
         m_size.setHeight(m_size.height() + dy + dy);
     }
     void inflate(float d) { inflateX(d); inflateY(d); }
-    void scale(float s);
+    void scale(float s) { scale(s, s); }
+    void scale(float sx, float sy);
 
 #if PLATFORM(CG)
     FloatRect(const CGRect&);
diff --git a/WebCore/platform/graphics/FontCache.h b/WebCore/platform/graphics/FontCache.h
index b88305f..4a6222b 100644
--- a/WebCore/platform/graphics/FontCache.h
+++ b/WebCore/platform/graphics/FontCache.h
@@ -50,7 +50,7 @@ class FontDescription;
 class FontSelector;
 class SimpleFontData;
 
-class FontCache {
+class FontCache : public Noncopyable {
 public:
     friend FontCache* fontCache();
 
diff --git a/WebCore/platform/graphics/GeneratedImage.cpp b/WebCore/platform/graphics/GeneratedImage.cpp
index bac9da0..eec7ffb 100644
--- a/WebCore/platform/graphics/GeneratedImage.cpp
+++ b/WebCore/platform/graphics/GeneratedImage.cpp
@@ -34,7 +34,7 @@ using namespace std;
 
 namespace WebCore {
 
-void GeneratedImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+void GeneratedImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace, CompositeOperator compositeOp)
 {
     context->save();
     context->setCompositeOperation(compositeOp);
@@ -48,7 +48,7 @@ void GeneratedImage::draw(GraphicsContext* context, const FloatRect& dstRect, co
 }
 
 void GeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                                 const FloatPoint& phase, CompositeOperator compositeOp, const FloatRect& destRect)
+                                 const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator compositeOp, const FloatRect& destRect)
 {
     // Create a BitmapImage and call drawPattern on it.
     OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size);
@@ -62,7 +62,7 @@ void GeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcR
     Image* bitmap = imageBuffer->image();
     
     // Now just call drawTiled on that image.
-    bitmap->drawPattern(context, srcRect, patternTransform, phase, compositeOp, destRect);
+    bitmap->drawPattern(context, srcRect, patternTransform, phase, styleColorSpace, compositeOp, destRect);
 }
 
 }
diff --git a/WebCore/platform/graphics/GeneratedImage.h b/WebCore/platform/graphics/GeneratedImage.h
index dea0c54..a4583e3 100644
--- a/WebCore/platform/graphics/GeneratedImage.h
+++ b/WebCore/platform/graphics/GeneratedImage.h
@@ -57,9 +57,9 @@ public:
     virtual unsigned decodedSize() const { return 0; }
 
 protected:
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+                             const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator, const FloatRect& destRect);
     
     GeneratedImage(PassRefPtr<Generator> generator, const IntSize& size)
         : m_generator(generator)
diff --git a/WebCore/platform/graphics/GraphicsContext.cpp b/WebCore/platform/graphics/GraphicsContext.cpp
index ccdce08..fee05ee 100644
--- a/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/WebCore/platform/graphics/GraphicsContext.cpp
@@ -120,24 +120,21 @@ void GraphicsContext::setStrokeStyle(const StrokeStyle& style)
     setPlatformStrokeStyle(style);
 }
 
-void GraphicsContext::setStrokeColor(const Color& color)
+void GraphicsContext::setStrokeColor(const Color& color, ColorSpace colorSpace)
 {
-    m_common->state.strokeColorSpace = SolidColorSpace;
     m_common->state.strokeColor = color;
-    setPlatformStrokeColor(color);
+    m_common->state.strokeColorSpace = colorSpace;
+    m_common->state.strokeGradient.clear();
+    m_common->state.strokePattern.clear();
+    setPlatformStrokeColor(color, colorSpace);
 }
 
-ColorSpace GraphicsContext::strokeColorSpace() const
-{
-    return m_common->state.strokeColorSpace;
-}
-
-void GraphicsContext::setShadow(const IntSize& size, int blur, const Color& color)
+void GraphicsContext::setShadow(const IntSize& size, int blur, const Color& color, ColorSpace colorSpace)
 {
     m_common->state.shadowSize = size;
     m_common->state.shadowBlur = blur;
     m_common->state.shadowColor = color;
-    setPlatformShadow(size, blur, color);
+    setPlatformShadow(size, blur, color, colorSpace);
 }
 
 void GraphicsContext::clearShadow()
@@ -172,6 +169,11 @@ Color GraphicsContext::strokeColor() const
     return m_common->state.strokeColor;
 }
 
+ColorSpace GraphicsContext::strokeColorSpace() const
+{
+    return m_common->state.strokeColorSpace;
+}
+
 WindRule GraphicsContext::fillRule() const
 {
     return m_common->state.fillRule;
@@ -182,11 +184,13 @@ void GraphicsContext::setFillRule(WindRule fillRule)
     m_common->state.fillRule = fillRule;
 }
 
-void GraphicsContext::setFillColor(const Color& color)
+void GraphicsContext::setFillColor(const Color& color, ColorSpace colorSpace)
 {
-    m_common->state.fillColorSpace = SolidColorSpace;
     m_common->state.fillColor = color;
-    setPlatformFillColor(color);
+    m_common->state.fillColorSpace = colorSpace;
+    m_common->state.fillGradient.clear();
+    m_common->state.fillPattern.clear();
+    setPlatformFillColor(color, colorSpace);
 }
 
 Color GraphicsContext::fillColor() const
@@ -194,6 +198,11 @@ Color GraphicsContext::fillColor() const
     return m_common->state.fillColor;
 }
 
+ColorSpace GraphicsContext::fillColorSpace() const
+{
+    return m_common->state.fillColorSpace;
+}
+
 void GraphicsContext::setShouldAntialias(bool b)
 {
     m_common->state.shouldAntialias = b;
@@ -209,10 +218,10 @@ void GraphicsContext::setStrokePattern(PassRefPtr<Pattern> pattern)
 {
     ASSERT(pattern);
     if (!pattern) {
-        setStrokeColor(Color::black);
+        setStrokeColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.strokeColorSpace = PatternColorSpace;
+    m_common->state.strokeGradient.clear();
     m_common->state.strokePattern = pattern;
     setPlatformStrokePattern(m_common->state.strokePattern.get());
 }
@@ -221,10 +230,10 @@ void GraphicsContext::setFillPattern(PassRefPtr<Pattern> pattern)
 {
     ASSERT(pattern);
     if (!pattern) {
-        setFillColor(Color::black);
+        setFillColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.fillColorSpace = PatternColorSpace;
+    m_common->state.fillGradient.clear();
     m_common->state.fillPattern = pattern;
     setPlatformFillPattern(m_common->state.fillPattern.get());
 }
@@ -233,11 +242,11 @@ void GraphicsContext::setStrokeGradient(PassRefPtr<Gradient> gradient)
 {
     ASSERT(gradient);
     if (!gradient) {
-        setStrokeColor(Color::black);
+        setStrokeColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.strokeColorSpace = GradientColorSpace;
     m_common->state.strokeGradient = gradient;
+    m_common->state.strokePattern.clear();
     setPlatformStrokeGradient(m_common->state.strokeGradient.get());
 }
 
@@ -245,11 +254,11 @@ void GraphicsContext::setFillGradient(PassRefPtr<Gradient> gradient)
 {
     ASSERT(gradient);
     if (!gradient) {
-        setFillColor(Color::black);
+        setFillColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.fillColorSpace = GradientColorSpace;
     m_common->state.fillGradient = gradient;
+    m_common->state.fillPattern.clear();
     setPlatformFillGradient(m_common->state.fillGradient.get());
 }
 
@@ -258,11 +267,6 @@ Gradient* GraphicsContext::fillGradient() const
     return m_common->state.fillGradient.get();
 }
 
-ColorSpace GraphicsContext::fillColorSpace() const
-{
-    return m_common->state.fillColorSpace;
-}
-
 Gradient* GraphicsContext::strokeGradient() const
 {
     return m_common->state.strokeGradient.get();
@@ -304,24 +308,24 @@ bool GraphicsContext::paintingDisabled() const
     return m_common->state.paintingDisabled;
 }
 
-void GraphicsContext::drawImage(Image* image, const IntPoint& p, CompositeOperator op)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntPoint& p, CompositeOperator op)
 {
-    drawImage(image, p, IntRect(0, 0, -1, -1), op);
+    drawImage(image, styleColorSpace, p, IntRect(0, 0, -1, -1), op);
 }
 
-void GraphicsContext::drawImage(Image* image, const IntRect& r, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntRect& r, CompositeOperator op, bool useLowQualityScale)
 {
-    drawImage(image, r, IntRect(0, 0, -1, -1), op, useLowQualityScale);
+    drawImage(image, styleColorSpace, r, IntRect(0, 0, -1, -1), op, useLowQualityScale);
 }
 
-void GraphicsContext::drawImage(Image* image, const IntPoint& dest, const IntRect& srcRect, CompositeOperator op)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntPoint& dest, const IntRect& srcRect, CompositeOperator op)
 {
-    drawImage(image, IntRect(dest, srcRect.size()), srcRect, op);
+    drawImage(image, styleColorSpace, IntRect(dest, srcRect.size()), srcRect, op);
 }
 
-void GraphicsContext::drawImage(Image* image, const IntRect& dest, const IntRect& srcRect, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntRect& dest, const IntRect& srcRect, CompositeOperator op, bool useLowQualityScale)
 {
-    drawImage(image, FloatRect(dest), srcRect, op, useLowQualityScale);
+    drawImage(image, styleColorSpace, FloatRect(dest), srcRect, op, useLowQualityScale);
 }
 
 #if !PLATFORM(WINCE) || PLATFORM(QT)
@@ -370,12 +374,12 @@ void GraphicsContext::drawBidiText(const Font& font, const TextRun& run, const F
     bidiResolver.deleteRuns();
 }
 
-void GraphicsContext::drawHighlightForText(const Font& font, const TextRun& run, const IntPoint& point, int h, const Color& backgroundColor, int from, int to)
+void GraphicsContext::drawHighlightForText(const Font& font, const TextRun& run, const IntPoint& point, int h, const Color& backgroundColor, ColorSpace colorSpace, int from, int to)
 {
     if (paintingDisabled())
         return;
 
-    fillRect(font.selectionRectForText(run, point, h, from, to), backgroundColor);
+    fillRect(font.selectionRectForText(run, point, h, from, to), backgroundColor, colorSpace);
 }
 
 void GraphicsContext::initFocusRing(int width, int offset)
@@ -427,7 +431,7 @@ const Vector<IntRect>& GraphicsContext::focusRingRects() const
     return m_common->m_focusRingRects;
 }
 
-void GraphicsContext::drawImage(Image* image, const FloatRect& dest, const FloatRect& src, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const FloatRect& dest, const FloatRect& src, CompositeOperator op, bool useLowQualityScale)
 {
     if (paintingDisabled() || !image)
         return;
@@ -451,29 +455,29 @@ void GraphicsContext::drawImage(Image* image, const FloatRect& dest, const Float
         save();
         setImageInterpolationQuality(InterpolationNone);
     }
-    image->draw(this, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), op);
+    image->draw(this, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), styleColorSpace, op);
     if (useLowQualityScale)
         restore();
 }
 
-void GraphicsContext::drawTiledImage(Image* image, const IntRect& rect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op)
+void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& rect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op)
 {
     if (paintingDisabled() || !image)
         return;
 
-    image->drawTiled(this, rect, srcPoint, tileSize, op);
+    image->drawTiled(this, rect, srcPoint, tileSize, styleColorSpace, op);
 }
 
-void GraphicsContext::drawTiledImage(Image* image, const IntRect& dest, const IntRect& srcRect, Image::TileRule hRule, Image::TileRule vRule, CompositeOperator op)
+void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& dest, const IntRect& srcRect, Image::TileRule hRule, Image::TileRule vRule, CompositeOperator op)
 {
     if (paintingDisabled() || !image)
         return;
 
     if (hRule == Image::StretchTile && vRule == Image::StretchTile)
         // Just do a scale.
-        return drawImage(image, dest, srcRect, op);
+        return drawImage(image, styleColorSpace, dest, srcRect, op);
 
-    image->drawTiled(this, dest, srcRect, hRule, vRule, op);
+    image->drawTiled(this, dest, srcRect, hRule, vRule, styleColorSpace, op);
 }
 
 void GraphicsContext::addRoundedRectClip(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight,
diff --git a/WebCore/platform/graphics/GraphicsContext.h b/WebCore/platform/graphics/GraphicsContext.h
index 3ffc211..96a6221 100644
--- a/WebCore/platform/graphics/GraphicsContext.h
+++ b/WebCore/platform/graphics/GraphicsContext.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,6 +27,7 @@
 #ifndef GraphicsContext_h
 #define GraphicsContext_h
 
+#include "ColorSpace.h"
 #include "DashArray.h"
 #include "FloatRect.h"
 #include "Image.h"
@@ -111,17 +112,17 @@ namespace WebCore {
     const int cMisspellingLinePatternWidth = 4;
     const int cMisspellingLinePatternGapWidth = 1;
 
-    class TransformationMatrix;
     class Font;
     class Generator;
     class Gradient;
-    class GraphicsContextPrivate;
     class GraphicsContextPlatformPrivate;
+    class GraphicsContextPrivate;
     class ImageBuffer;
     class KURL;
     class Path;
     class Pattern;
     class TextRun;
+    class TransformationMatrix;
 
     // These bits can be ORed together for a total of 8 possible text drawing modes.
     const int cTextInvisible = 0;
@@ -136,18 +137,6 @@ namespace WebCore {
         DashedStroke
     };
 
-    // FIXME: This is a place-holder until we decide to add
-    // real color space support to WebCore.  At that time, ColorSpace will be a
-    // class and instances will be held  off of Colors.   There will be
-    // special singleton Gradient and Pattern color spaces to mark when
-    // a fill or stroke is using a gradient or pattern instead of a solid color.
-    // https://bugs.webkit.org/show_bug.cgi?id=20558
-    enum ColorSpace {
-        SolidColorSpace,
-        PatternColorSpace,
-        GradientColorSpace
-    };
-
     enum InterpolationQuality {
         InterpolationDefault,
         InterpolationNone,
@@ -170,9 +159,8 @@ namespace WebCore {
         StrokeStyle strokeStyle() const;
         void setStrokeStyle(const StrokeStyle& style);
         Color strokeColor() const;
-        void setStrokeColor(const Color&);
-
         ColorSpace strokeColorSpace() const;
+        void setStrokeColor(const Color&, ColorSpace);
 
         void setStrokePattern(PassRefPtr<Pattern>);
         Pattern* strokePattern() const;
@@ -183,7 +171,8 @@ namespace WebCore {
         WindRule fillRule() const;
         void setFillRule(WindRule);
         Color fillColor() const;
-        void setFillColor(const Color&);
+        ColorSpace fillColorSpace() const;
+        void setFillColor(const Color&, ColorSpace);
 
         void setFillPattern(PassRefPtr<Pattern>);
         Pattern* fillPattern() const;
@@ -191,8 +180,6 @@ namespace WebCore {
         void setFillGradient(PassRefPtr<Gradient>);
         Gradient* fillGradient() const;
 
-        ColorSpace fillColorSpace() const;
-
         void setShadowsIgnoreTransforms(bool);
 
         void setShouldAntialias(bool);
@@ -250,24 +237,24 @@ namespace WebCore {
         void strokeArc(const IntRect&, int startAngle, int angleSpan);
 
         void fillRect(const FloatRect&);
-        void fillRect(const FloatRect&, const Color&);
+        void fillRect(const FloatRect&, const Color&, ColorSpace);
         void fillRect(const FloatRect&, Generator&);
-        void fillRoundedRect(const IntRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color&);
+        void fillRoundedRect(const IntRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color&, ColorSpace);
 
         void clearRect(const FloatRect&);
 
         void strokeRect(const FloatRect&);
         void strokeRect(const FloatRect&, float lineWidth);
 
-        void drawImage(Image*, const IntPoint&, CompositeOperator = CompositeSourceOver);
-        void drawImage(Image*, const IntRect&, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
-        void drawImage(Image*, const IntPoint& destPoint, const IntRect& srcRect, CompositeOperator = CompositeSourceOver);
-        void drawImage(Image*, const IntRect& destRect, const IntRect& srcRect, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
-        void drawImage(Image*, const FloatRect& destRect, const FloatRect& srcRect = FloatRect(0, 0, -1, -1),
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntPoint&, CompositeOperator = CompositeSourceOver);
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntRect&, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntPoint& destPoint, const IntRect& srcRect, CompositeOperator = CompositeSourceOver);
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntRect& destRect, const IntRect& srcRect, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
+        void drawImage(Image*, ColorSpace styleColorSpace, const FloatRect& destRect, const FloatRect& srcRect = FloatRect(0, 0, -1, -1),
                        CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
-        void drawTiledImage(Image*, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize,
+        void drawTiledImage(Image*, ColorSpace styleColorSpace, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize,
                        CompositeOperator = CompositeSourceOver);
-        void drawTiledImage(Image*, const IntRect& destRect, const IntRect& srcRect,
+        void drawTiledImage(Image*, ColorSpace styleColorSpace, const IntRect& destRect, const IntRect& srcRect,
                             Image::TileRule hRule = Image::StretchTile, Image::TileRule vRule = Image::StretchTile,
                             CompositeOperator = CompositeSourceOver);
 
@@ -288,7 +275,7 @@ namespace WebCore {
 
         void drawText(const Font&, const TextRun&, const IntPoint&, int from = 0, int to = -1);
         void drawBidiText(const Font&, const TextRun&, const FloatPoint&);
-        void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, int from = 0, int to = -1);
+        void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, ColorSpace, int from = 0, int to = -1);
 
         FloatRect roundToDevicePixels(const FloatRect&);
 
@@ -304,7 +291,7 @@ namespace WebCore {
         void beginTransparencyLayer(float opacity);
         void endTransparencyLayer();
 
-        void setShadow(const IntSize&, int blur, const Color&);
+        void setShadow(const IntSize&, int blur, const Color&, ColorSpace);
         bool getShadow(IntSize&, int&, Color&) const;
         void clearShadow();
 
@@ -322,6 +309,8 @@ namespace WebCore {
         void setAlpha(float);
 #if PLATFORM(CAIRO)
         float getAlpha();
+        void createPlatformShadow(PassOwnPtr<ImageBuffer> buffer, const Color& shadowColor, const FloatRect& shadowRect, float kernelSize);
+        static void calculateShadowBufferDimensions(IntSize& shadowBufferSize, FloatRect& shadowRect, float& kernelSize, const FloatRect& sourceRect, const IntSize& shadowSize, int shadowBlur);
 #endif
 
         void setCompositeOperation(CompositeOperator);
@@ -405,12 +394,16 @@ namespace WebCore {
         void drawWindowsBitmap(WindowsBitmap*, const IntPoint&);
 #endif
 
-#if PLATFORM(QT) && defined(Q_WS_WIN)
+#if (PLATFORM(QT) && defined(Q_WS_WIN)) || (PLATFORM(WX) && PLATFORM(WIN_OS))
         HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         void releaseWindowsContext(HDC, const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         bool shouldIncludeChildWindows() const { return false; }
 #endif
 
+#if PLATFORM(WX)
+        bool inTransparencyLayer() const { return false; }
+#endif
+
 #if PLATFORM(QT)
         bool inTransparencyLayer() const;
         PlatformPath* currentPath();
@@ -434,19 +427,19 @@ namespace WebCore {
         void setPlatformTextDrawingMode(int);
         void setPlatformFont(const Font& font);
 
-        void setPlatformStrokeColor(const Color&);
+        void setPlatformStrokeColor(const Color&, ColorSpace);
         void setPlatformStrokeStyle(const StrokeStyle&);
         void setPlatformStrokeThickness(float);
         void setPlatformStrokeGradient(Gradient*);
         void setPlatformStrokePattern(Pattern*);
 
-        void setPlatformFillColor(const Color&);
+        void setPlatformFillColor(const Color&, ColorSpace);
         void setPlatformFillGradient(Gradient*);
         void setPlatformFillPattern(Pattern*);
 
         void setPlatformShouldAntialias(bool b);
 
-        void setPlatformShadow(const IntSize&, int blur, const Color&);
+        void setPlatformShadow(const IntSize&, int blur, const Color&, ColorSpace);
         void clearPlatformShadow();
 
         static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, const StrokeStyle&);
diff --git a/WebCore/platform/graphics/GraphicsContext3D.h b/WebCore/platform/graphics/GraphicsContext3D.h
index 07ec04d..aad8dd4 100644
--- a/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/WebCore/platform/graphics/GraphicsContext3D.h
@@ -28,9 +28,15 @@
 
 #include "PlatformString.h"
 
+#include <wtf/ListHashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 
+// FIXME: Find a better way to avoid the name confliction for NO_ERROR.
+#if PLATFORM(CHROMIUM) && PLATFORM(WIN_OS)
+#undef NO_ERROR
+#endif
+
 #if PLATFORM(MAC)
 #include <OpenGL/OpenGL.h>
 
@@ -46,20 +52,19 @@ const Platform3DObject NullPlatform3DObject = 0;
 #endif
 
 namespace WebCore {
-    class CanvasActiveInfo;
-    class CanvasArray;
-    class CanvasBuffer;
-    class CanvasUnsignedByteArray;
-    class CanvasFloatArray;
-    class CanvasFramebuffer;
-    class CanvasIntArray;
-    class CanvasProgram;
-    class CanvasRenderbuffer;
-    class CanvasRenderingContext3D;
-    class CanvasShader;
-    class CanvasTexture;
-    class HTMLCanvasElement;
-    class HTMLImageElement;
+    class WebGLActiveInfo;
+    class WebGLArray;
+    class WebGLBuffer;
+    class WebGLUnsignedByteArray;
+    class WebGLFloatArray;
+    class WebGLFramebuffer;
+    class WebGLIntArray;
+    class WebGLProgram;
+    class WebGLRenderbuffer;
+    class WebGLRenderingContext;
+    class WebGLShader;
+    class WebGLTexture;
+    class Image;
     class HTMLVideoElement;
     class ImageData;
     class WebKitCSSMatrix;
@@ -77,8 +82,309 @@ namespace WebCore {
 
     class GraphicsContext3D : public Noncopyable {
     public:
-        enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
-    
+        enum WebGLEnumType {
+            DEPTH_BUFFER_BIT = 0x00000100,
+            STENCIL_BUFFER_BIT = 0x00000400,
+            COLOR_BUFFER_BIT = 0x00004000,
+            POINTS = 0x0000,
+            LINES = 0x0001,
+            LINE_LOOP = 0x0002,
+            LINE_STRIP = 0x0003,
+            TRIANGLES = 0x0004,
+            TRIANGLE_STRIP = 0x0005,
+            TRIANGLE_FAN = 0x0006,
+            ZERO = 0,
+            ONE = 1,
+            SRC_COLOR = 0x0300,
+            ONE_MINUS_SRC_COLOR = 0x0301,
+            SRC_ALPHA = 0x0302,
+            ONE_MINUS_SRC_ALPHA = 0x0303,
+            DST_ALPHA = 0x0304,
+            ONE_MINUS_DST_ALPHA = 0x0305,
+            DST_COLOR = 0x0306,
+            ONE_MINUS_DST_COLOR = 0x0307,
+            SRC_ALPHA_SATURATE = 0x0308,
+            FUNC_ADD = 0x8006,
+            BLEND_EQUATION = 0x8009,
+            BLEND_EQUATION_RGB = 0x8009,
+            BLEND_EQUATION_ALPHA = 0x883D,
+            FUNC_SUBTRACT = 0x800A,
+            FUNC_REVERSE_SUBTRACT = 0x800B,
+            BLEND_DST_RGB = 0x80C8,
+            BLEND_SRC_RGB = 0x80C9,
+            BLEND_DST_ALPHA = 0x80CA,
+            BLEND_SRC_ALPHA = 0x80CB,
+            CONSTANT_COLOR = 0x8001,
+            ONE_MINUS_CONSTANT_COLOR = 0x8002,
+            CONSTANT_ALPHA = 0x8003,
+            ONE_MINUS_CONSTANT_ALPHA = 0x8004,
+            BLEND_COLOR = 0x8005,
+            ARRAY_BUFFER = 0x8892,
+            ELEMENT_ARRAY_BUFFER = 0x8893,
+            ARRAY_BUFFER_BINDING = 0x8894,
+            ELEMENT_ARRAY_BUFFER_BINDING = 0x8895,
+            STREAM_DRAW = 0x88E0,
+            STATIC_DRAW = 0x88E4,
+            DYNAMIC_DRAW = 0x88E8,
+            BUFFER_SIZE = 0x8764,
+            BUFFER_USAGE = 0x8765,
+            CURRENT_VERTEX_ATTRIB = 0x8626,
+            FRONT = 0x0404,
+            BACK = 0x0405,
+            FRONT_AND_BACK = 0x0408,
+            TEXTURE_2D = 0x0DE1,
+            CULL_FACE = 0x0B44,
+            BLEND = 0x0BE2,
+            DITHER = 0x0BD0,
+            STENCIL_TEST = 0x0B90,
+            DEPTH_TEST = 0x0B71,
+            SCISSOR_TEST = 0x0C11,
+            POLYGON_OFFSET_FILL = 0x8037,
+            SAMPLE_ALPHA_TO_COVERAGE = 0x809E,
+            SAMPLE_COVERAGE = 0x80A0,
+            NO_ERROR = 0,
+            INVALID_ENUM = 0x0500,
+            INVALID_VALUE = 0x0501,
+            INVALID_OPERATION = 0x0502,
+            OUT_OF_MEMORY = 0x0505,
+            CW = 0x0900,
+            CCW = 0x0901,
+            LINE_WIDTH = 0x0B21,
+            ALIASED_POINT_SIZE_RANGE = 0x846D,
+            ALIASED_LINE_WIDTH_RANGE = 0x846E,
+            CULL_FACE_MODE = 0x0B45,
+            FRONT_FACE = 0x0B46,
+            DEPTH_RANGE = 0x0B70,
+            DEPTH_WRITEMASK = 0x0B72,
+            DEPTH_CLEAR_VALUE = 0x0B73,
+            DEPTH_FUNC = 0x0B74,
+            STENCIL_CLEAR_VALUE = 0x0B91,
+            STENCIL_FUNC = 0x0B92,
+            STENCIL_FAIL = 0x0B94,
+            STENCIL_PASS_DEPTH_FAIL = 0x0B95,
+            STENCIL_PASS_DEPTH_PASS = 0x0B96,
+            STENCIL_REF = 0x0B97,
+            STENCIL_VALUE_MASK = 0x0B93,
+            STENCIL_WRITEMASK = 0x0B98,
+            STENCIL_BACK_FUNC = 0x8800,
+            STENCIL_BACK_FAIL = 0x8801,
+            STENCIL_BACK_PASS_DEPTH_FAIL = 0x8802,
+            STENCIL_BACK_PASS_DEPTH_PASS = 0x8803,
+            STENCIL_BACK_REF = 0x8CA3,
+            STENCIL_BACK_VALUE_MASK = 0x8CA4,
+            STENCIL_BACK_WRITEMASK = 0x8CA5,
+            VIEWPORT = 0x0BA2,
+            SCISSOR_BOX = 0x0C10,
+            COLOR_CLEAR_VALUE = 0x0C22,
+            COLOR_WRITEMASK = 0x0C23,
+            UNPACK_ALIGNMENT = 0x0CF5,
+            PACK_ALIGNMENT = 0x0D05,
+            MAX_TEXTURE_SIZE = 0x0D33,
+            MAX_VIEWPORT_DIMS = 0x0D3A,
+            SUBPIXEL_BITS = 0x0D50,
+            RED_BITS = 0x0D52,
+            GREEN_BITS = 0x0D53,
+            BLUE_BITS = 0x0D54,
+            ALPHA_BITS = 0x0D55,
+            DEPTH_BITS = 0x0D56,
+            STENCIL_BITS = 0x0D57,
+            POLYGON_OFFSET_UNITS = 0x2A00,
+            POLYGON_OFFSET_FACTOR = 0x8038,
+            TEXTURE_BINDING_2D = 0x8069,
+            SAMPLE_BUFFERS = 0x80A8,
+            SAMPLES = 0x80A9,
+            SAMPLE_COVERAGE_VALUE = 0x80AA,
+            SAMPLE_COVERAGE_INVERT = 0x80AB,
+            NUM_COMPRESSED_TEXTURE_FORMATS = 0x86A2,
+            COMPRESSED_TEXTURE_FORMATS = 0x86A3,
+            DONT_CARE = 0x1100,
+            FASTEST = 0x1101,
+            NICEST = 0x1102,
+            GENERATE_MIPMAP_HINT = 0x8192,
+            BYTE = 0x1400,
+            UNSIGNED_BYTE = 0x1401,
+            SHORT = 0x1402,
+            UNSIGNED_SHORT = 0x1403,
+            INT = 0x1404,
+            UNSIGNED_INT = 0x1405,
+            FLOAT = 0x1406,
+            FIXED = 0x140C,
+            DEPTH_COMPONENT = 0x1902,
+            ALPHA = 0x1906,
+            RGB = 0x1907,
+            RGBA = 0x1908,
+            LUMINANCE = 0x1909,
+            LUMINANCE_ALPHA = 0x190A,
+            UNSIGNED_SHORT_4_4_4_4 = 0x8033,
+            UNSIGNED_SHORT_5_5_5_1 = 0x8034,
+            UNSIGNED_SHORT_5_6_5 = 0x8363,
+            FRAGMENT_SHADER = 0x8B30,
+            VERTEX_SHADER = 0x8B31,
+            MAX_VERTEX_ATTRIBS = 0x8869,
+            MAX_VERTEX_UNIFORM_VECTORS = 0x8DFB,
+            MAX_VARYING_VECTORS = 0x8DFC,
+            MAX_COMBINED_TEXTURE_IMAGE_UNITS = 0x8B4D,
+            MAX_VERTEX_TEXTURE_IMAGE_UNITS = 0x8B4C,
+            MAX_TEXTURE_IMAGE_UNITS = 0x8872,
+            MAX_FRAGMENT_UNIFORM_VECTORS = 0x8DFD,
+            SHADER_TYPE = 0x8B4F,
+            DELETE_STATUS = 0x8B80,
+            LINK_STATUS = 0x8B82,
+            VALIDATE_STATUS = 0x8B83,
+            ATTACHED_SHADERS = 0x8B85,
+            ACTIVE_UNIFORMS = 0x8B86,
+            ACTIVE_UNIFORM_MAX_LENGTH = 0x8B87,
+            ACTIVE_ATTRIBUTES = 0x8B89,
+            ACTIVE_ATTRIBUTE_MAX_LENGTH = 0x8B8A,
+            SHADING_LANGUAGE_VERSION = 0x8B8C,
+            CURRENT_PROGRAM = 0x8B8D,
+            NEVER = 0x0200,
+            LESS = 0x0201,
+            EQUAL = 0x0202,
+            LEQUAL = 0x0203,
+            GREATER = 0x0204,
+            NOTEQUAL = 0x0205,
+            GEQUAL = 0x0206,
+            ALWAYS = 0x0207,
+            KEEP = 0x1E00,
+            REPLACE = 0x1E01,
+            INCR = 0x1E02,
+            DECR = 0x1E03,
+            INVERT = 0x150A,
+            INCR_WRAP = 0x8507,
+            DECR_WRAP = 0x8508,
+            VENDOR = 0x1F00,
+            RENDERER = 0x1F01,
+            VERSION = 0x1F02,
+            EXTENSIONS = 0x1F03,
+            NEAREST = 0x2600,
+            LINEAR = 0x2601,
+            NEAREST_MIPMAP_NEAREST = 0x2700,
+            LINEAR_MIPMAP_NEAREST = 0x2701,
+            NEAREST_MIPMAP_LINEAR = 0x2702,
+            LINEAR_MIPMAP_LINEAR = 0x2703,
+            TEXTURE_MAG_FILTER = 0x2800,
+            TEXTURE_MIN_FILTER = 0x2801,
+            TEXTURE_WRAP_S = 0x2802,
+            TEXTURE_WRAP_T = 0x2803,
+            TEXTURE = 0x1702,
+            TEXTURE_CUBE_MAP = 0x8513,
+            TEXTURE_BINDING_CUBE_MAP = 0x8514,
+            TEXTURE_CUBE_MAP_POSITIVE_X = 0x8515,
+            TEXTURE_CUBE_MAP_NEGATIVE_X = 0x8516,
+            TEXTURE_CUBE_MAP_POSITIVE_Y = 0x8517,
+            TEXTURE_CUBE_MAP_NEGATIVE_Y = 0x8518,
+            TEXTURE_CUBE_MAP_POSITIVE_Z = 0x8519,
+            TEXTURE_CUBE_MAP_NEGATIVE_Z = 0x851A,
+            MAX_CUBE_MAP_TEXTURE_SIZE = 0x851C,
+            TEXTURE0 = 0x84C0,
+            TEXTURE1 = 0x84C1,
+            TEXTURE2 = 0x84C2,
+            TEXTURE3 = 0x84C3,
+            TEXTURE4 = 0x84C4,
+            TEXTURE5 = 0x84C5,
+            TEXTURE6 = 0x84C6,
+            TEXTURE7 = 0x84C7,
+            TEXTURE8 = 0x84C8,
+            TEXTURE9 = 0x84C9,
+            TEXTURE10 = 0x84CA,
+            TEXTURE11 = 0x84CB,
+            TEXTURE12 = 0x84CC,
+            TEXTURE13 = 0x84CD,
+            TEXTURE14 = 0x84CE,
+            TEXTURE15 = 0x84CF,
+            TEXTURE16 = 0x84D0,
+            TEXTURE17 = 0x84D1,
+            TEXTURE18 = 0x84D2,
+            TEXTURE19 = 0x84D3,
+            TEXTURE20 = 0x84D4,
+            TEXTURE21 = 0x84D5,
+            TEXTURE22 = 0x84D6,
+            TEXTURE23 = 0x84D7,
+            TEXTURE24 = 0x84D8,
+            TEXTURE25 = 0x84D9,
+            TEXTURE26 = 0x84DA,
+            TEXTURE27 = 0x84DB,
+            TEXTURE28 = 0x84DC,
+            TEXTURE29 = 0x84DD,
+            TEXTURE30 = 0x84DE,
+            TEXTURE31 = 0x84DF,
+            ACTIVE_TEXTURE = 0x84E0,
+            REPEAT = 0x2901,
+            CLAMP_TO_EDGE = 0x812F,
+            MIRRORED_REPEAT = 0x8370,
+            FLOAT_VEC2 = 0x8B50,
+            FLOAT_VEC3 = 0x8B51,
+            FLOAT_VEC4 = 0x8B52,
+            INT_VEC2 = 0x8B53,
+            INT_VEC3 = 0x8B54,
+            INT_VEC4 = 0x8B55,
+            BOOL = 0x8B56,
+            BOOL_VEC2 = 0x8B57,
+            BOOL_VEC3 = 0x8B58,
+            BOOL_VEC4 = 0x8B59,
+            FLOAT_MAT2 = 0x8B5A,
+            FLOAT_MAT3 = 0x8B5B,
+            FLOAT_MAT4 = 0x8B5C,
+            SAMPLER_2D = 0x8B5E,
+            SAMPLER_CUBE = 0x8B60,
+            VERTEX_ATTRIB_ARRAY_ENABLED = 0x8622,
+            VERTEX_ATTRIB_ARRAY_SIZE = 0x8623,
+            VERTEX_ATTRIB_ARRAY_STRIDE = 0x8624,
+            VERTEX_ATTRIB_ARRAY_TYPE = 0x8625,
+            VERTEX_ATTRIB_ARRAY_NORMALIZED = 0x886A,
+            VERTEX_ATTRIB_ARRAY_POINTER = 0x8645,
+            VERTEX_ATTRIB_ARRAY_BUFFER_BINDING = 0x889F,
+            IMPLEMENTATION_COLOR_READ_TYPE = 0x8B9A,
+            IMPLEMENTATION_COLOR_READ_FORMAT = 0x8B9B,
+            COMPILE_STATUS = 0x8B81,
+            INFO_LOG_LENGTH = 0x8B84,
+            SHADER_SOURCE_LENGTH = 0x8B88,
+            SHADER_COMPILER = 0x8DFA,
+            SHADER_BINARY_FORMATS = 0x8DF8,
+            NUM_SHADER_BINARY_FORMATS = 0x8DF9,
+            LOW_FLOAT = 0x8DF0,
+            MEDIUM_FLOAT = 0x8DF1,
+            HIGH_FLOAT = 0x8DF2,
+            LOW_INT = 0x8DF3,
+            MEDIUM_INT = 0x8DF4,
+            HIGH_INT = 0x8DF5,
+            FRAMEBUFFER = 0x8D40,
+            RENDERBUFFER = 0x8D41,
+            RGBA4 = 0x8056,
+            RGB5_A1 = 0x8057,
+            RGB565 = 0x8D62,
+            DEPTH_COMPONENT16 = 0x81A5,
+            STENCIL_INDEX = 0x1901,
+            STENCIL_INDEX8 = 0x8D48,
+            RENDERBUFFER_WIDTH = 0x8D42,
+            RENDERBUFFER_HEIGHT = 0x8D43,
+            RENDERBUFFER_INTERNAL_FORMAT = 0x8D44,
+            RENDERBUFFER_RED_SIZE = 0x8D50,
+            RENDERBUFFER_GREEN_SIZE = 0x8D51,
+            RENDERBUFFER_BLUE_SIZE = 0x8D52,
+            RENDERBUFFER_ALPHA_SIZE = 0x8D53,
+            RENDERBUFFER_DEPTH_SIZE = 0x8D54,
+            RENDERBUFFER_STENCIL_SIZE = 0x8D55,
+            FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE = 0x8CD0,
+            FRAMEBUFFER_ATTACHMENT_OBJECT_NAME = 0x8CD1,
+            FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL = 0x8CD2,
+            FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE = 0x8CD3,
+            COLOR_ATTACHMENT0 = 0x8CE0,
+            DEPTH_ATTACHMENT = 0x8D00,
+            STENCIL_ATTACHMENT = 0x8D20,
+            NONE = 0,
+            FRAMEBUFFER_COMPLETE = 0x8CD5,
+            FRAMEBUFFER_INCOMPLETE_ATTACHMENT = 0x8CD6,
+            FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT = 0x8CD7,
+            FRAMEBUFFER_INCOMPLETE_DIMENSIONS = 0x8CD9,
+            FRAMEBUFFER_UNSUPPORTED = 0x8CDD,
+            FRAMEBUFFER_BINDING = 0x8CA6,
+            RENDERBUFFER_BINDING = 0x8CA7,
+            MAX_RENDERBUFFER_SIZE = 0x84E8,
+            INVALID_FRAMEBUFFER_OPERATION = 0x0506
+        };
+        
         static PassOwnPtr<GraphicsContext3D> create();
         virtual ~GraphicsContext3D();
 
@@ -92,7 +398,6 @@ namespace WebCore {
         PlatformGraphicsContext3D platformGraphicsContext3D() const { return NullPlatformGraphicsContext3D; }
         Platform3DObject platformTexture() const { return NullPlatform3DObject; }
 #endif
-        void checkError() const;
         void makeContextCurrent();
         
         // Helper to return the size in bytes of OpenGL data types
@@ -100,12 +405,12 @@ namespace WebCore {
         int sizeInBytes(int type);
 
         void activeTexture(unsigned long texture);
-        void attachShader(CanvasProgram* program, CanvasShader* shader);
-        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
-        void bindBuffer(unsigned long target, CanvasBuffer*);
-        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
-        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
-        void bindTexture(unsigned long target, CanvasTexture* texture);
+        void attachShader(WebGLProgram* program, WebGLShader* shader);
+        void bindAttribLocation(WebGLProgram*, unsigned long index, const String& name);
+        void bindBuffer(unsigned long target, WebGLBuffer*);
+        void bindFramebuffer(unsigned long target, WebGLFramebuffer*);
+        void bindRenderbuffer(unsigned long target, WebGLRenderbuffer*);
+        void bindTexture(unsigned long target, WebGLTexture* texture);
         void blendColor(double red, double green, double blue, double alpha);
         void blendEquation(unsigned long mode);
         void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
@@ -113,8 +418,8 @@ namespace WebCore {
         void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
 
         void bufferData(unsigned long target, int size, unsigned long usage);
-        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
-        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
+        void bufferData(unsigned long target, WebGLArray* data, unsigned long usage);
+        void bufferSubData(unsigned long target, long offset, WebGLArray* data);
 
         unsigned long checkFramebufferStatus(unsigned long target);
         void clear(unsigned long mask);
@@ -122,7 +427,7 @@ namespace WebCore {
         void clearDepth(double depth);
         void clearStencil(long s);
         void colorMask(bool red, bool green, bool blue, bool alpha);
-        void compileShader(CanvasShader*);
+        void compileShader(WebGLShader*);
         
         //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
         //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
@@ -133,7 +438,7 @@ namespace WebCore {
         void depthFunc(unsigned long func);
         void depthMask(bool flag);
         void depthRange(double zNear, double zFar);
-        void detachShader(CanvasProgram*, CanvasShader*);
+        void detachShader(WebGLProgram*, WebGLShader*);
         void disable(unsigned long cap);
         void disableVertexAttribArray(unsigned long index);
         void drawArrays(unsigned long mode, long first, long count);
@@ -143,84 +448,77 @@ namespace WebCore {
         void enableVertexAttribArray(unsigned long index);
         void finish();
         void flush();
-        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
-        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer*);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture*, long level);
         void frontFace(unsigned long mode);
         void generateMipmap(unsigned long target);
 
-        bool getActiveAttrib(CanvasProgram* program, unsigned long index, ActiveInfo&);
-        bool getActiveUniform(CanvasProgram* program, unsigned long index, ActiveInfo&);
+        bool getActiveAttrib(WebGLProgram* program, unsigned long index, ActiveInfo&);
+        bool getActiveUniform(WebGLProgram* program, unsigned long index, ActiveInfo&);
 
-        int  getAttribLocation(CanvasProgram*, const String& name);
+        int  getAttribLocation(WebGLProgram*, const String& name);
 
-        bool getBoolean(unsigned long pname);
-        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
-        int getBufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
+        void getBooleanv(unsigned long pname, unsigned char* value);
+
+        void getBufferParameteriv(unsigned long target, unsigned long pname, int* value);
 
         unsigned long getError();
 
-        float getFloat(unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
-        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
-        int getInteger(unsigned long pname);
-        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
-        int getProgrami(CanvasProgram*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
-        String getProgramInfoLog(CanvasProgram*);
-        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
-        int getShaderi(CanvasShader*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
-
-        String getShaderInfoLog(CanvasShader*);
+        void getFloatv(unsigned long pname, float* value);
+
+        void getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname, int* value);
+
+        void getIntegerv(unsigned long pname, int* value);
+
+        void getProgramiv(WebGLProgram* program, unsigned long pname, int* value);
+
+        String getProgramInfoLog(WebGLProgram*);
+
+        void getRenderbufferParameteriv(unsigned long target, unsigned long pname, int* value);
+
+        void getShaderiv(WebGLShader*, unsigned long pname, int* value);
+
+        String getShaderInfoLog(WebGLShader*);
 
         // TBD
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
-        String getShaderSource(CanvasShader*);
+        String getShaderSource(WebGLShader*);
         String getString(unsigned long name);
-        
-        float getTexParameterf(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
-        int getTexParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
-
-        float getUniformf(CanvasProgram* program, long location);
-        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
-        int getUniformi(CanvasProgram* program, long location);
-        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
-
-        long getUniformLocation(CanvasProgram*, const String& name);
-
-        float getVertexAttribf(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
-        int getVertexAttribi(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
-        
+
+        void getTexParameterfv(unsigned long target, unsigned long pname, float* value);
+        void getTexParameteriv(unsigned long target, unsigned long pname, int* value);
+
+        void getUniformfv(WebGLProgram* program, long location, float* value);
+        void getUniformiv(WebGLProgram* program, long location, int* value);
+
+        long getUniformLocation(WebGLProgram*, const String& name);
+
+        void getVertexAttribfv(unsigned long index, unsigned long pname, float* value);
+        void getVertexAttribiv(unsigned long index, unsigned long pname, int* value);
+
         long getVertexAttribOffset(unsigned long index, unsigned long pname);
 
         void hint(unsigned long target, unsigned long mode);
-        bool isBuffer(CanvasBuffer*);
+        bool isBuffer(WebGLBuffer*);
         bool isEnabled(unsigned long cap);
-        bool isFramebuffer(CanvasFramebuffer*);
-        bool isProgram(CanvasProgram*);
-        bool isRenderbuffer(CanvasRenderbuffer*);
-        bool isShader(CanvasShader*);
-        bool isTexture(CanvasTexture*);
+        bool isFramebuffer(WebGLFramebuffer*);
+        bool isProgram(WebGLProgram*);
+        bool isRenderbuffer(WebGLRenderbuffer*);
+        bool isShader(WebGLShader*);
+        bool isTexture(WebGLTexture*);
         void lineWidth(double);
-        void linkProgram(CanvasProgram*);
+        void linkProgram(WebGLProgram*);
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
-        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
+        PassRefPtr<WebGLArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
         
         void releaseShaderCompiler();
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
         void sampleCoverage(double value, bool invert);
         void scissor(long x, long y, unsigned long width, unsigned long height);
-        void shaderSource(CanvasShader*, const String& string);
+        void shaderSource(WebGLShader*, const String& string);
         void stencilFunc(unsigned long func, long ref, unsigned long mask);
         void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
         void stencilMask(unsigned long mask);
@@ -232,13 +530,11 @@ namespace WebCore {
         // Currently they return -1 on any error.
         int texImage2D(unsigned target, unsigned level, unsigned internalformat,
                        unsigned width, unsigned height, unsigned border,
-                       unsigned format, unsigned type, CanvasArray* pixels);
+                       unsigned format, unsigned type, WebGLArray* pixels);
         int texImage2D(unsigned target, unsigned level, unsigned internalformat,
                        unsigned width, unsigned height, unsigned border,
                        unsigned format, unsigned type, ImageData* pixels);
-        int texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
-                       bool flipY, bool premultiplyAlpha);
-        int texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+        int texImage2D(unsigned target, unsigned level, Image* image,
                        bool flipY, bool premultiplyAlpha);
         int texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
                        bool flipY, bool premultiplyAlpha);
@@ -248,15 +544,12 @@ namespace WebCore {
 
         int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
                           unsigned width, unsigned height,
-                          unsigned format, unsigned type, CanvasArray* pixels);
+                          unsigned format, unsigned type, WebGLArray* pixels);
         int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
                           unsigned width, unsigned height,
                           unsigned format, unsigned type, ImageData* pixels);
         int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                          unsigned width, unsigned height, HTMLImageElement* image,
-                          bool flipY, bool premultiplyAlpha);
-        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                          unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                          unsigned width, unsigned height, Image* image,
                           bool flipY, bool premultiplyAlpha);
         int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
                           unsigned width, unsigned height, HTMLVideoElement* video,
@@ -282,8 +575,8 @@ namespace WebCore {
         void uniformMatrix3fv(long location, bool transpose, float* value, int size);
         void uniformMatrix4fv(long location, bool transpose, float* value, int size);
 
-        void useProgram(CanvasProgram*);
-        void validateProgram(CanvasProgram*);
+        void useProgram(WebGLProgram*);
+        void validateProgram(WebGLProgram*);
 
         void vertexAttrib1f(unsigned long indx, float x);
         void vertexAttrib1fv(unsigned long indx, float* values);
@@ -301,7 +594,7 @@ namespace WebCore {
         void reshape(int width, int height);
         
         // Helpers for notification about paint events
-        void beginPaint(CanvasRenderingContext3D* context);
+        void beginPaint(WebGLRenderingContext* context);
         void endPaint();
 
         // Support for buffer creation and deletion
@@ -309,7 +602,7 @@ namespace WebCore {
         unsigned createFramebuffer();
         unsigned createProgram();
         unsigned createRenderbuffer();
-        unsigned createShader(ShaderType);
+        unsigned createShader(unsigned long);
         unsigned createTexture();
         
         void deleteBuffer(unsigned);
@@ -319,6 +612,16 @@ namespace WebCore {
         void deleteShader(unsigned);
         void deleteTexture(unsigned);        
         
+        // Synthesizes an OpenGL error which will be returned from a
+        // later call to getError. This is used to emulate OpenGL ES
+        // 2.0 behavior on the desktop and to enforce additional error
+        // checking mandated by WebGL.
+        //
+        // Per the behavior of glGetError, this stores at most one
+        // instance of any given error, and returns them from calls to
+        // getError in the order they were added.
+        void synthesizeGLError(unsigned long error);
+
     private:        
         GraphicsContext3D();
 
@@ -331,6 +634,8 @@ namespace WebCore {
         GLuint m_texture;
         GLuint m_fbo;
         GLuint m_depthBuffer;
+        // Errors raised by synthesizeGLError().
+        ListHashSet<unsigned long> m_syntheticErrors;
 #endif        
 
         // FIXME: ideally this would be used on all platforms.
@@ -343,4 +648,3 @@ namespace WebCore {
 } // namespace WebCore
 
 #endif // GraphicsContext3D_h
-
diff --git a/WebCore/platform/graphics/GraphicsContextPrivate.h b/WebCore/platform/graphics/GraphicsContextPrivate.h
index 98baab1..c532162 100644
--- a/WebCore/platform/graphics/GraphicsContextPrivate.h
+++ b/WebCore/platform/graphics/GraphicsContextPrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,10 @@
 #ifndef GraphicsContextPrivate_h
 #define GraphicsContextPrivate_h
 
-#include "TransformationMatrix.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
 #include "Pattern.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
@@ -38,18 +38,18 @@ namespace WebCore {
             : textDrawingMode(cTextFill)
             , strokeStyle(SolidStroke)
             , strokeThickness(0)
-#if PLATFORM(CAIRO)
-            , globalAlpha(1.0f)
-#endif
-            , strokeColorSpace(SolidColorSpace)
             , strokeColor(Color::black)
+            , strokeColorSpace(DeviceColorSpace)
             , fillRule(RULE_NONZERO)
-            , fillColorSpace(SolidColorSpace)
             , fillColor(Color::black)
+            , fillColorSpace(DeviceColorSpace)
             , shouldAntialias(true)
             , paintingDisabled(false)
             , shadowBlur(0)
             , shadowsIgnoreTransforms(false)
+#if PLATFORM(CAIRO)
+            , globalAlpha(1.0f)
+#endif
         {
         }
 
@@ -57,19 +57,14 @@ namespace WebCore {
         
         StrokeStyle strokeStyle;
         float strokeThickness;
-#if PLATFORM(CAIRO)
-        float globalAlpha;
-#elif PLATFORM(QT)
-        TransformationMatrix pathTransform;
-#endif
-        ColorSpace strokeColorSpace;
         Color strokeColor;
+        ColorSpace strokeColorSpace;
         RefPtr<Gradient> strokeGradient;
         RefPtr<Pattern> strokePattern;
         
         WindRule fillRule;
-        ColorSpace fillColorSpace;
         Color fillColor;
+        ColorSpace fillColorSpace;
         RefPtr<Gradient> fillGradient;
         RefPtr<Pattern> fillPattern;
 
@@ -82,9 +77,14 @@ namespace WebCore {
         Color shadowColor;
 
         bool shadowsIgnoreTransforms;
+#if PLATFORM(CAIRO)
+        float globalAlpha;
+#elif PLATFORM(QT)
+        TransformationMatrix pathTransform;
+#endif
     };
 
-    class GraphicsContextPrivate {
+    class GraphicsContextPrivate : public Noncopyable {
     public:
         GraphicsContextPrivate()
             : m_focusRingWidth(0)
diff --git a/WebCore/platform/graphics/GraphicsLayer.cpp b/WebCore/platform/graphics/GraphicsLayer.cpp
index c8582bb..e215097 100644
--- a/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -92,6 +92,21 @@ bool GraphicsLayer::hasAncestor(GraphicsLayer* ancestor) const
     return false;
 }
 
+bool GraphicsLayer::setChildren(const Vector<GraphicsLayer*>& newChildren)
+{
+    // If the contents of the arrays are the same, nothing to do.
+    if (newChildren == m_children)
+        return false;
+
+    removeAllChildren();
+    
+    size_t listSize = newChildren.size();
+    for (size_t i = 0; i < listSize; ++i)
+        addChild(newChildren[i]);
+    
+    return true;
+}
+
 void GraphicsLayer::addChild(GraphicsLayer* childLayer)
 {
     ASSERT(childLayer != this);
diff --git a/WebCore/platform/graphics/GraphicsLayer.h b/WebCore/platform/graphics/GraphicsLayer.h
index 85eace0..0456bad 100644
--- a/WebCore/platform/graphics/GraphicsLayer.h
+++ b/WebCore/platform/graphics/GraphicsLayer.h
@@ -53,6 +53,12 @@ typedef CALayer* NativeLayer;
 typedef void* PlatformLayer;
 typedef void* NativeLayer;
 #endif
+#elif PLATFORM(WIN)
+namespace WebCore {
+class WKCACFLayer;
+typedef WKCACFLayer PlatformLayer;
+typedef void* NativeLayer;
+}
 #else
 typedef void* PlatformLayer;
 typedef void* NativeLayer;
@@ -176,6 +182,8 @@ public:
     bool hasAncestor(GraphicsLayer*) const;
     
     const Vector<GraphicsLayer*>& children() const { return m_children; }
+    // Returns true if the child list changed.
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
 
     // Add child layers. If the child is already parented, it will be removed from its old parent.
     virtual void addChild(GraphicsLayer*);
@@ -292,8 +300,8 @@ public:
     virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation) { m_contentsOrientation = orientation; }
     CompositingCoordinatesOrientation contentsOrientation() const { return m_contentsOrientation; }
 
-    static bool showDebugBorders();
-    static bool showRepaintCounter();
+    bool showDebugBorders() { return m_client ? m_client->showDebugBorders() : false; }
+    bool showRepaintCounter() { return m_client ? m_client->showRepaintCounter() : false; }
     
     void updateDebugIndicators();
     
diff --git a/WebCore/platform/graphics/GraphicsLayerClient.h b/WebCore/platform/graphics/GraphicsLayerClient.h
index 5facc94..afb297d 100644
--- a/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -62,6 +62,9 @@ public:
     virtual void notifySyncRequired(const GraphicsLayer*) = 0;
     
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) = 0;
+    
+    virtual bool showDebugBorders() const = 0;
+    virtual bool showRepaintCounter() const = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/Icon.h b/WebCore/platform/graphics/Icon.h
index 444c67c..d7d694a 100644
--- a/WebCore/platform/graphics/Icon.h
+++ b/WebCore/platform/graphics/Icon.h
@@ -51,7 +51,6 @@ class String;
     
 class Icon : public RefCounted<Icon> {
 public:
-    static PassRefPtr<Icon> createIconForFile(const String& filename);
     static PassRefPtr<Icon> createIconForFiles(const Vector<String>& filenames);
 
     ~Icon();
diff --git a/WebCore/platform/graphics/Image.cpp b/WebCore/platform/graphics/Image.cpp
index 80b5457..611216a 100644
--- a/WebCore/platform/graphics/Image.cpp
+++ b/WebCore/platform/graphics/Image.cpp
@@ -75,14 +75,14 @@ bool Image::setData(PassRefPtr<SharedBuffer> data, bool allDataReceived)
     return dataChanged(allDataReceived);
 }
 
-void Image::fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, CompositeOperator op)
+void Image::fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, ColorSpace styleColorSpace, CompositeOperator op)
 {
     if (color.alpha() <= 0)
         return;
     
     ctxt->save();
     ctxt->setCompositeOperation(!color.hasAlpha() && op == CompositeSourceOver ? CompositeCopy : op);
-    ctxt->fillRect(dstRect, color);
+    ctxt->fillRect(dstRect, color, styleColorSpace);
     ctxt->restore();
 }
 
@@ -104,10 +104,10 @@ static inline FloatSize calculatePatternScale(const FloatRect& dstRect, const Fl
 }
 
 
-void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const FloatPoint& srcPoint, const FloatSize& scaledTileSize, CompositeOperator op)
+void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const FloatPoint& srcPoint, const FloatSize& scaledTileSize, ColorSpace styleColorSpace, CompositeOperator op)
 {    
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, destRect, solidColor(), op);
+        fillWithSolidColor(ctxt, destRect, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -132,22 +132,22 @@ void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const Fl
         visibleSrcRect.setY((destRect.y() - oneTileRect.y()) / scale.height());
         visibleSrcRect.setWidth(destRect.width() / scale.width());
         visibleSrcRect.setHeight(destRect.height() / scale.height());
-        draw(ctxt, destRect, visibleSrcRect, op);
+        draw(ctxt, destRect, visibleSrcRect, styleColorSpace, op);
         return;
     }
 
     TransformationMatrix patternTransform = TransformationMatrix().scaleNonUniform(scale.width(), scale.height());
     FloatRect tileRect(FloatPoint(), intrinsicTileSize);    
-    drawPattern(ctxt, tileRect, patternTransform, oneTileRect.location(), op, destRect);
+    drawPattern(ctxt, tileRect, patternTransform, oneTileRect.location(), styleColorSpace, op, destRect);
     
     startAnimation();
 }
 
 // FIXME: Merge with the other drawTiled eventually, since we need a combination of both for some things.
-void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, CompositeOperator op)
+void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, ColorSpace styleColorSpace, CompositeOperator op)
 {    
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dstRect, solidColor(), op);
+        fillWithSolidColor(ctxt, dstRect, solidColor(), styleColorSpace, op);
         return;
     }
     
@@ -170,7 +170,7 @@ void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const Flo
         vPhase -= fmodf(dstRect.height(), scale.height() * srcRect.height()) / 2.0f;
     FloatPoint patternPhase(dstRect.x() - hPhase, dstRect.y() - vPhase);
     
-    drawPattern(ctxt, srcRect, patternTransform, patternPhase, op, dstRect);
+    drawPattern(ctxt, srcRect, patternTransform, patternPhase, styleColorSpace, op, dstRect);
 
     startAnimation();
 }
diff --git a/WebCore/platform/graphics/Image.h b/WebCore/platform/graphics/Image.h
index 294ddf6..aef6577 100644
--- a/WebCore/platform/graphics/Image.h
+++ b/WebCore/platform/graphics/Image.h
@@ -28,6 +28,7 @@
 #define Image_h
 
 #include "Color.h"
+#include "ColorSpace.h"
 #include "GraphicsTypes.h"
 #include "ImageSource.h"
 #include "IntRect.h"
@@ -158,21 +159,22 @@ public:
 protected:
     Image(ImageObserver* = 0);
 
-    static void fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, CompositeOperator op);
+    static void fillWithSolidColor(GraphicsContext*, const FloatRect& dstRect, const Color&, ColorSpace styleColorSpace, CompositeOperator);
 
+    // The ColorSpace parameter will only be used for untagged images.
 #if PLATFORM(WIN)
-    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator) { }
+    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator) { }
 #endif
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator) = 0;
-    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatPoint& srcPoint, const FloatSize& tileSize, CompositeOperator);
-    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator) = 0;
+    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatPoint& srcPoint, const FloatSize& tileSize, ColorSpace styleColorSpace, CompositeOperator);
+    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, ColorSpace styleColorSpace, CompositeOperator);
 
     // Supporting tiled drawing
     virtual bool mayFillWithSolidColor() { return false; }
     virtual Color solidColor() const { return Color(); }
     
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+                             const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator, const FloatRect& destRect);
 
 private:
     RefPtr<SharedBuffer> m_data; // The encoded raw data for the image. 
diff --git a/WebCore/platform/graphics/MediaPlayer.cpp b/WebCore/platform/graphics/MediaPlayer.cpp
index b64f82b..4c66c50 100644
--- a/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/WebCore/platform/graphics/MediaPlayer.cpp
@@ -91,6 +91,9 @@ public:
 
     virtual void setVolume(float) { }
 
+    virtual bool hasClosedCaptions() const { return false; }
+    virtual void setClosedCaptionsVisible(bool) { };
+
     virtual MediaPlayer::NetworkState networkState() const { return MediaPlayer::Empty; }
     virtual MediaPlayer::ReadyState readyState() const { return MediaPlayer::HaveNothing; }
 
@@ -126,7 +129,7 @@ static MediaPlayerPrivateInterface* createNullMediaPlayer(MediaPlayer* player)
 
 // engine support
 
-struct MediaPlayerFactory {
+struct MediaPlayerFactory : Noncopyable {
     MediaPlayerFactory(CreateMediaEnginePlayer constructor, MediaEngineSupportedTypes getSupportedTypes, MediaEngineSupportsType supportsTypeAndCodecs) 
         : constructor(constructor)
         , getSupportedTypes(getSupportedTypes)
@@ -377,6 +380,16 @@ void MediaPlayer::setVolume(float volume)
     m_private->setVolume(volume);   
 }
 
+bool MediaPlayer::hasClosedCaptions() const
+{
+    return m_private->hasClosedCaptions();
+}
+
+void MediaPlayer::setClosedCaptionsVisible(bool closedCaptionsVisible)
+{
+    m_private->setClosedCaptionsVisible(closedCaptionsVisible);
+}
+
 float MediaPlayer::rate() const
 {
     return m_rate;
diff --git a/WebCore/platform/graphics/MediaPlayer.h b/WebCore/platform/graphics/MediaPlayer.h
index 4cc6476..ec8ac33 100644
--- a/WebCore/platform/graphics/MediaPlayer.h
+++ b/WebCore/platform/graphics/MediaPlayer.h
@@ -37,6 +37,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
 
 #ifdef __OBJC__
 @class QTMovie;
@@ -115,7 +116,11 @@ public:
 
 class MediaPlayer : public Noncopyable {
 public:
-    MediaPlayer(MediaPlayerClient*);
+
+    static PassOwnPtr<MediaPlayer> create(MediaPlayerClient* client)
+    {
+        return new MediaPlayer(client);
+    }
     virtual ~MediaPlayer();
 
     // media engine support
@@ -175,7 +180,10 @@ public:
     
     float volume() const;
     void setVolume(float);
-    
+
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool closedCaptionsVisible);
+
     int dataRate() const;
 
     bool autobuffer() const;    
@@ -223,6 +231,8 @@ public:
     bool hasSingleSecurityOrigin() const;
 
 private:
+    MediaPlayer(MediaPlayerClient*);
+
     static void initializeMediaEngines();
 
     MediaPlayerClient* m_mediaPlayerClient;
diff --git a/WebCore/platform/graphics/MediaPlayerPrivate.h b/WebCore/platform/graphics/MediaPlayerPrivate.h
index f5687b3..03906bd 100644
--- a/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -36,7 +36,7 @@ class IntRect;
 class IntSize;
 class String;
 
-class MediaPlayerPrivateInterface {
+class MediaPlayerPrivateInterface : public Noncopyable {
 public:
     virtual ~MediaPlayerPrivateInterface() { }
 
@@ -76,6 +76,9 @@ public:
 
     virtual void setVolume(float) = 0;
 
+    virtual bool hasClosedCaptions() const { return false; }    
+    virtual void setClosedCaptionsVisible(bool) { }
+
     virtual MediaPlayer::NetworkState networkState() const = 0;
     virtual MediaPlayer::ReadyState readyState() const = 0;
 
diff --git a/WebCore/platform/graphics/Path.h b/WebCore/platform/graphics/Path.h
index 6b617a0..fef5ad2 100644
--- a/WebCore/platform/graphics/Path.h
+++ b/WebCore/platform/graphics/Path.h
@@ -29,6 +29,7 @@
 #define Path_h
 
 #include <algorithm>
+#include <wtf/FastAllocBase.h>
 
 #if PLATFORM(CG)
 typedef struct CGPath PlatformPath;
@@ -93,7 +94,7 @@ namespace WebCore {
 
     typedef void (*PathApplierFunction)(void* info, const PathElement*);
 
-    class Path {
+    class Path : public FastAllocBase {
     public:
         Path();
         ~Path();
diff --git a/WebCore/platform/graphics/cairo/FontCairo.cpp b/WebCore/platform/graphics/cairo/FontCairo.cpp
index 1a951c2..3bfa8f3 100644
--- a/WebCore/platform/graphics/cairo/FontCairo.cpp
+++ b/WebCore/platform/graphics/cairo/FontCairo.cpp
@@ -32,6 +32,7 @@
 #include "GlyphBuffer.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
+#include "ImageBuffer.h"
 #include "Pattern.h"
 #include "SimpleFontData.h"
 #include "TransformationMatrix.h"
@@ -85,6 +86,34 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
         shadowFillColor.getRGBA(red, green, blue, alpha);
         cairo_set_source_rgba(cr, red, green, blue, alpha);
 
+#if ENABLE(FILTERS)
+        cairo_text_extents_t extents;
+        cairo_scaled_font_glyph_extents(font->platformData().scaledFont(), glyphs, numGlyphs, &extents);
+
+        FloatRect rect(FloatPoint(), FloatSize(extents.width, extents.height));
+        IntSize shadowBufferSize;
+        FloatRect shadowRect;
+        float kernelSize = 0.f;
+        GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, kernelSize, rect, shadowSize, shadowBlur);
+
+        // Draw shadow into a new ImageBuffer
+        OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
+        GraphicsContext* shadowContext = shadowBuffer->context();
+        cairo_t* shadowCr = shadowContext->platformContext();
+
+        cairo_translate(shadowCr, kernelSize, extents.height + kernelSize);
+
+        cairo_set_scaled_font(shadowCr, font->platformData().scaledFont());
+        cairo_show_glyphs(shadowCr, glyphs, numGlyphs);
+        if (font->syntheticBoldOffset()) {
+            cairo_save(shadowCr);
+            cairo_translate(shadowCr, font->syntheticBoldOffset(), 0);
+            cairo_show_glyphs(shadowCr, glyphs, numGlyphs);
+            cairo_restore(shadowCr);
+        }
+        cairo_translate(cr, 0.0, -extents.height);
+        context->createPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, kernelSize);
+#else
         cairo_translate(cr, shadowSize.width(), shadowSize.height());
         cairo_show_glyphs(cr, glyphs, numGlyphs);
         if (font->syntheticBoldOffset()) {
@@ -93,6 +122,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
             cairo_show_glyphs(cr, glyphs, numGlyphs);
             cairo_restore(cr);
         }
+#endif
 
         cairo_restore(cr);
     }
@@ -156,7 +186,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
 
     // Re-enable the platform shadow we disabled earlier
     if (hasShadow)
-        context->setShadow(shadowSize, shadowBlur, shadowColor);
+        context->setShadow(shadowSize, shadowBlur, shadowColor, DeviceColorSpace);
 
     cairo_restore(cr);
 }
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index 8741c5e..14034fd 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -1,8 +1,9 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
- * Copyright (C) 2008 Dirk Schulze <vbs85@gmx.de>
+ * Copyright (C) 2008, 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2008 Nuanti Ltd.
+ * Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,14 +33,17 @@
 #if PLATFORM(CAIRO)
 
 #include "CairoPath.h"
+#include "FEGaussianBlur.h"
 #include "FloatRect.h"
 #include "Font.h"
 #include "ImageBuffer.h"
+#include "ImageBufferFilter.h"
 #include "IntRect.h"
 #include "NotImplemented.h"
 #include "Path.h"
 #include "Pattern.h"
 #include "SimpleFontData.h"
+#include "SourceGraphic.h"
 #include "TransformationMatrix.h"
 
 #include <cairo.h>
@@ -69,6 +73,42 @@ static inline void setColor(cairo_t* cr, const Color& col)
     cairo_set_source_rgba(cr, red, green, blue, alpha);
 }
 
+static inline void setPlatformFill(GraphicsContext* context, cairo_t* cr, GraphicsContextPrivate* gcp)
+{
+    cairo_save(cr);
+    if (gcp->state.fillPattern) {
+        TransformationMatrix affine;
+        cairo_set_source(cr, gcp->state.fillPattern->createPlatformPattern(affine));
+    } else if (gcp->state.fillGradient)
+        cairo_set_source(cr, gcp->state.fillGradient->platformGradient());
+    else
+        setColor(cr, context->fillColor());
+    cairo_clip_preserve(cr);
+    cairo_paint_with_alpha(cr, gcp->state.globalAlpha);
+    cairo_restore(cr);
+}
+
+static inline void setPlatformStroke(GraphicsContext* context, cairo_t* cr, GraphicsContextPrivate* gcp)
+{
+    cairo_save(cr);
+    if (gcp->state.strokePattern) {
+        TransformationMatrix affine;
+        cairo_set_source(cr, gcp->state.strokePattern->createPlatformPattern(affine));
+    } else if (gcp->state.strokeGradient)
+        cairo_set_source(cr, gcp->state.strokeGradient->platformGradient());
+    else  {
+        Color strokeColor = colorWithOverrideAlpha(context->strokeColor().rgb(), context->strokeColor().alpha() / 255.f * gcp->state.globalAlpha);
+        setColor(cr, strokeColor);
+    }
+    if (gcp->state.globalAlpha < 1.0f && (gcp->state.strokePattern || gcp->state.strokeGradient)) {
+        cairo_push_group(cr);
+        cairo_paint_with_alpha(cr, gcp->state.globalAlpha);
+        cairo_pop_group_to_source(cr);
+    }
+    cairo_stroke_preserve(cr);
+    cairo_restore(cr);
+}
+
 // A fillRect helper
 static inline void fillRectSourceOver(cairo_t* cr, const FloatRect& rect, const Color& col)
 {
@@ -78,6 +118,81 @@ static inline void fillRectSourceOver(cairo_t* cr, const FloatRect& rect, const
     cairo_fill(cr);
 }
 
+static inline void copyContextProperties(cairo_t* srcCr, cairo_t* dstCr)
+{
+    cairo_set_antialias(dstCr, cairo_get_antialias(srcCr));
+
+    size_t dashCount = cairo_get_dash_count(srcCr);
+    Vector<double> dashes(dashCount);
+
+    double offset;
+    cairo_get_dash(srcCr, dashes.data(), &offset);
+    cairo_set_dash(dstCr, dashes.data(), dashCount, offset);
+    cairo_set_line_cap(dstCr, cairo_get_line_cap(srcCr));
+    cairo_set_line_join(dstCr, cairo_get_line_join(srcCr));
+    cairo_set_line_width(dstCr, cairo_get_line_width(srcCr));
+    cairo_set_miter_limit(dstCr, cairo_get_miter_limit(srcCr));
+    cairo_set_fill_rule(dstCr, cairo_get_fill_rule(srcCr));
+}
+
+void GraphicsContext::calculateShadowBufferDimensions(IntSize& shadowBufferSize, FloatRect& shadowRect, float& kernelSize, const FloatRect& sourceRect, const IntSize& shadowSize, int shadowBlur)
+{
+#if ENABLE(FILTERS)
+    // calculate the kernel size according to the HTML5 canvas shadow specification
+    kernelSize = (shadowBlur < 8 ? shadowBlur / 2.f : sqrt(shadowBlur * 2.f));
+    int blurRadius = ceil(kernelSize);
+
+    shadowBufferSize = IntSize(sourceRect.width() + blurRadius * 2, sourceRect.height() + blurRadius * 2);
+
+    // determine dimensions of shadow rect
+    shadowRect = FloatRect(sourceRect.location(), shadowBufferSize);
+    shadowRect.move(shadowSize.width() - kernelSize, shadowSize.height() - kernelSize);
+#endif
+}
+
+static inline void drawPathShadow(GraphicsContext* context, GraphicsContextPrivate* gcp, bool fillShadow, bool strokeShadow)
+{
+#if ENABLE(FILTERS)
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (!context->getShadow(shadowSize, shadowBlur, shadowColor))
+        return;
+    
+    // Calculate filter values to create appropriate shadow.
+    cairo_t* cr = context->platformContext();
+    cairo_path_t* path = cairo_copy_path(cr);
+    double x0, x1, y0, y1;
+    if (strokeShadow)
+        cairo_stroke_extents(cr, &x0, &y0, &x1, &y1);
+    else
+        cairo_fill_extents(cr, &x0, &y0, &x1, &y1);
+    FloatRect rect(x0, y0, x1 - x0, y1 - y0);
+
+    IntSize shadowBufferSize;
+    FloatRect shadowRect;
+    float kernelSize = 0;
+    GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, kernelSize, rect, shadowSize, shadowBlur);
+
+    // Create suitably-sized ImageBuffer to hold the shadow.
+    OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
+
+    // Draw shadow into a new ImageBuffer.
+    cairo_t* shadowContext = shadowBuffer->context()->platformContext();
+    copyContextProperties(cr, shadowContext);
+    cairo_translate(shadowContext, -rect.x() + kernelSize, -rect.y() + kernelSize);
+    cairo_new_path(shadowContext);
+    cairo_append_path(shadowContext, path);
+
+    if (fillShadow)
+        setPlatformFill(context, shadowContext, gcp);
+    if (strokeShadow)
+        setPlatformStroke(context, shadowContext, gcp);
+
+    context->createPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, kernelSize);
+#endif
+}
+
 GraphicsContext::GraphicsContext(PlatformGraphicsContext* cr)
     : m_common(createGraphicsContextPrivate())
     , m_data(new GraphicsContextPlatformPrivate)
@@ -387,30 +502,12 @@ void GraphicsContext::fillPath()
         return;
 
     cairo_t* cr = m_data->cr;
-    cairo_save(cr);
 
     cairo_set_fill_rule(cr, fillRule() == RULE_EVENODD ? CAIRO_FILL_RULE_EVEN_ODD : CAIRO_FILL_RULE_WINDING);
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        setColor(cr, fillColor());
-        cairo_clip(cr);
-        cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        cairo_set_source(cr, m_common->state.fillPattern->createPlatformPattern(affine));
-        cairo_clip(cr);
-        cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-        break;
-    }
-    case GradientColorSpace:
-        cairo_pattern_t* pattern = m_common->state.fillGradient->platformGradient();
-        cairo_set_source(cr, pattern);
-        cairo_clip(cr);
-        cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-        break;
-    }
-    cairo_restore(cr);
+    drawPathShadow(this, m_common, true, false);
+
+    setPlatformFill(this, cr, m_common);
+    cairo_new_path(cr);
 }
 
 void GraphicsContext::strokePath()
@@ -419,45 +516,26 @@ void GraphicsContext::strokePath()
         return;
 
     cairo_t* cr = m_data->cr;
-    cairo_save(cr);
-    switch (m_common->state.strokeColorSpace) {
-    case SolidColorSpace:
-        float red, green, blue, alpha;
-        strokeColor().getRGBA(red, green, blue, alpha);
-        if (m_common->state.globalAlpha < 1.0f)
-            alpha *= m_common->state.globalAlpha;
-        cairo_set_source_rgba(cr, red, green, blue, alpha);
-        cairo_stroke(cr);
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        cairo_set_source(cr, m_common->state.strokePattern->createPlatformPattern(affine));
-        if (m_common->state.globalAlpha < 1.0f) {
-            cairo_push_group(cr);
-            cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-            cairo_pop_group_to_source(cr);
-        }
-        cairo_stroke(cr);
-        break;
-    }
-    case GradientColorSpace:
-        cairo_pattern_t* pattern = m_common->state.strokeGradient->platformGradient();
-        cairo_set_source(cr, pattern);
-        if (m_common->state.globalAlpha < 1.0f) {
-            cairo_push_group(cr);
-            cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-            cairo_pop_group_to_source(cr);
-        }
-        cairo_stroke(cr);
-        break;
-    }
-    cairo_restore(cr);
+    drawPathShadow(this, m_common, false, true);
+
+    setPlatformStroke(this, cr, m_common);
+    cairo_new_path(cr);
+
 }
 
 void GraphicsContext::drawPath()
 {
-    fillPath();
-    strokePath();
+    if (paintingDisabled())
+        return;
+
+    cairo_t* cr = m_data->cr;
+
+    cairo_set_fill_rule(cr, fillRule() == RULE_EVENODD ? CAIRO_FILL_RULE_EVEN_ODD : CAIRO_FILL_RULE_WINDING);
+    drawPathShadow(this, m_common, true, true);
+
+    setPlatformFill(this, cr, m_common);
+    setPlatformStroke(this, cr, m_common);
+    cairo_new_path(cr);
 }
 
 void GraphicsContext::fillRect(const FloatRect& rect)
@@ -470,11 +548,36 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     fillPath();
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+static void drawBorderlessRectShadow(GraphicsContext* context, const FloatRect& rect, const Color& rectColor)
+{
+#if ENABLE(FILTERS)
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+
+    if (!context->getShadow(shadowSize, shadowBlur, shadowColor))
+        return;
+
+    IntSize shadowBufferSize;
+    FloatRect shadowRect;
+    float kernelSize = 0;
+    GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, kernelSize, rect, shadowSize, shadowBlur);
+
+    // Draw shadow into a new ImageBuffer
+    OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
+    GraphicsContext* shadowContext = shadowBuffer->context();
+    shadowContext->fillRect(FloatRect(FloatPoint(kernelSize, kernelSize), rect.size()), rectColor, DeviceColorSpace);
+
+    context->createPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, kernelSize);
+#endif
+}
+
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
 
+    drawBorderlessRectShadow(this, rect, color);
     if (color.alpha())
         fillRectSourceOver(m_data->cr, rect, color);
 }
@@ -634,13 +737,13 @@ IntPoint GraphicsContext::origin()
     return IntPoint(static_cast<int>(matrix.x0), static_cast<int>(matrix.y0));
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& col)
+void GraphicsContext::setPlatformFillColor(const Color& col, ColorSpace colorSpace)
 {
     // Cairo contexts can't hold separate fill and stroke colors
     // so we set them just before we actually fill or stroke
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& col)
+void GraphicsContext::setPlatformStrokeColor(const Color& col, ColorSpace colorSpace)
 {
     // Cairo contexts can't hold separate fill and stroke colors
     // so we set them just before we actually fill or stroke
@@ -726,9 +829,48 @@ void GraphicsContext::clipToImageBuffer(const FloatRect& rect, const ImageBuffer
     notImplemented();
 }
 
-void GraphicsContext::setPlatformShadow(IntSize const&, int, Color const&)
+void GraphicsContext::setPlatformShadow(IntSize const& size, int, Color const&, ColorSpace)
 {
-    notImplemented();
+    // Cairo doesn't support shadows natively, they are drawn manually in the draw*
+    // functions
+
+    if (m_common->state.shadowsIgnoreTransforms) {
+        // Meaning that this graphics context is associated with a CanvasRenderingContext
+        // We flip the height since CG and HTML5 Canvas have opposite Y axis
+        m_common->state.shadowSize = IntSize(size.width(), -size.height());
+    }
+}
+
+void GraphicsContext::createPlatformShadow(PassOwnPtr<ImageBuffer> buffer, const Color& shadowColor, const FloatRect& shadowRect, float kernelSize)
+{
+#if ENABLE(FILTERS)
+    cairo_t* cr = m_data->cr;
+
+    // draw the shadow without blurring, if kernelSize is zero
+    if (!kernelSize) {
+        setColor(cr, shadowColor);
+        cairo_mask_surface(cr, buffer->image()->nativeImageForCurrentFrame(), shadowRect.x(), shadowRect.y());
+        return;
+    }
+
+    // limit kernel size to 1000, this is what CG is doing.
+    kernelSize = std::min(1000.f, kernelSize);
+
+    // create filter
+    RefPtr<Filter> filter = ImageBufferFilter::create();
+    filter->setSourceImage(buffer.release());
+    RefPtr<FilterEffect> source = SourceGraphic::create();
+    source->setScaledSubRegion(FloatRect(FloatPoint(), shadowRect.size()));
+    source->setIsAlphaImage(true);
+    RefPtr<FilterEffect> blur = FEGaussianBlur::create(source.get(), kernelSize, kernelSize);
+    blur->setScaledSubRegion(FloatRect(FloatPoint(), shadowRect.size()));
+    blur->apply(filter.get());
+
+    // Mask the filter with the shadow color and draw it to the context.
+    // Masking makes it possible to just blur the alpha channel.
+    setColor(cr, shadowColor);
+    cairo_mask_surface(cr, blur->resultImage()->image()->nativeImageForCurrentFrame(), shadowRect.x(), shadowRect.y());
+#endif
 }
 
 void GraphicsContext::clearPlatformShadow()
@@ -941,7 +1083,6 @@ void GraphicsContext::clipOut(const Path& path)
     if (paintingDisabled())
         return;
 
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1,4,0)
     cairo_t* cr = m_data->cr;
     double x1, y1, x2, y2;
     cairo_clip_extents(cr, &x1, &y1, &x2, &y2);
@@ -952,9 +1093,6 @@ void GraphicsContext::clipOut(const Path& path)
     cairo_set_fill_rule(cr, CAIRO_FILL_RULE_EVEN_ODD);
     cairo_clip(cr);
     cairo_set_fill_rule(cr, savedFillRule);
-#else
-    notImplemented();
-#endif
 }
 
 void GraphicsContext::rotate(float radians)
@@ -980,19 +1118,15 @@ void GraphicsContext::clipOut(const IntRect& r)
     if (paintingDisabled())
         return;
 
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1,4,0)
     cairo_t* cr = m_data->cr;
     double x1, y1, x2, y2;
     cairo_clip_extents(cr, &x1, &y1, &x2, &y2);
-    cairo_rectangle(cr, x1, x2, x2 - x1, y2 - y1);
+    cairo_rectangle(cr, x1, y1, x2 - x1, y2 - y1);
     cairo_rectangle(cr, r.x(), r.y(), r.width(), r.height());
     cairo_fill_rule_t savedFillRule = cairo_get_fill_rule(cr);
     cairo_set_fill_rule(cr, CAIRO_FILL_RULE_EVEN_ODD);
     cairo_clip(cr);
     cairo_set_fill_rule(cr, savedFillRule);
-#else
-    notImplemented();
-#endif
 }
 
 void GraphicsContext::clipOutEllipseInRect(const IntRect& r)
@@ -1005,7 +1139,7 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& r)
     clipOut(p);
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& r, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& r, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -1015,6 +1149,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& r, const IntSize& topLeft,
     beginPath();
     addPath(Path::createRoundedRectangle(r, topLeft, topRight, bottomLeft, bottomRight));
     setColor(cr, color);
+    drawPathShadow(this, m_common, true, false);
     cairo_fill(cr);
     cairo_restore(cr);
 }
diff --git a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 0213944..d991c80 100644
--- a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -136,6 +136,7 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
             *pixel = premultipliedARGBFromColor(pixelColor);
         }
     }
+    cairo_surface_mark_dirty_rectangle (m_data.m_surface, 0, 0, m_size.width(), m_size.height());
 }
 
 template <Multiply multiplied>
@@ -260,6 +261,9 @@ void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint&
         }
         srcRows += srcBytesPerRow;
     }
+    cairo_surface_mark_dirty_rectangle (data.m_surface,
+                                        destx, desty,
+                                        numColumns, numRows);
 }
 
 void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
diff --git a/WebCore/platform/graphics/cairo/ImageCairo.cpp b/WebCore/platform/graphics/cairo/ImageCairo.cpp
index c8c992e..92e36fc 100644
--- a/WebCore/platform/graphics/cairo/ImageCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageCairo.cpp
@@ -89,7 +89,7 @@ BitmapImage::BitmapImage(cairo_surface_t* surface, ImageObserver* observer)
     checkForSolidColor();
 }
 
-void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const FloatRect& src, CompositeOperator op)
+void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
     FloatRect srcRect(src);
     FloatRect dstRect(dst);
@@ -105,7 +105,7 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(context, dstRect, solidColor(), op);
+        fillWithSolidColor(context, dstRect, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -125,17 +125,37 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
     // Test using example site at http://www.meyerweb.com/eric/css/edge/complexspiral/demo.html
     cairo_pattern_t* pattern = cairo_pattern_create_for_surface(image);
 
-    // To avoid the unwanted gradient effect (#14017) we use
-    // CAIRO_FILTER_NEAREST now, but the real fix will be to have
-    // CAIRO_EXTEND_PAD implemented for surfaces in Cairo allowing us to still
-    // use bilinear filtering
-    cairo_pattern_set_filter(pattern, CAIRO_FILTER_NEAREST);
+    cairo_pattern_set_extend(pattern, CAIRO_EXTEND_PAD);
 
     float scaleX = srcRect.width() / dstRect.width();
     float scaleY = srcRect.height() / dstRect.height();
     cairo_matrix_t matrix = { scaleX, 0, 0, scaleY, srcRect.x(), srcRect.y() };
     cairo_pattern_set_matrix(pattern, &matrix);
 
+    // Draw the shadow
+#if ENABLE(FILTERS)
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
+        IntSize shadowBufferSize;
+        FloatRect shadowRect;
+        float kernelSize (0.0);
+        GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, kernelSize, dstRect, shadowSize, shadowBlur);
+        shadowColor = colorWithOverrideAlpha(shadowColor.rgb(), (shadowColor.alpha() *  context->getAlpha()) / 255.f);
+
+        //draw shadow into a new ImageBuffer
+        OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
+        cairo_t* shadowContext = shadowBuffer->context()->platformContext();
+        cairo_set_source(shadowContext, pattern);
+        cairo_translate(shadowContext, -dstRect.x(), -dstRect.y());
+        cairo_rectangle(shadowContext, 0, 0, dstRect.width(), dstRect.height());
+        cairo_fill(shadowContext);
+
+        context->createPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, kernelSize);
+    }
+#endif
+
     // Draw the image.
     cairo_translate(cr, dstRect.x(), dstRect.y());
     cairo_set_source(cr, pattern);
@@ -151,7 +171,7 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
 }
 
 void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, const TransformationMatrix& patternTransform,
-                        const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect)
+                        const FloatPoint& phase, ColorSpace, CompositeOperator op, const FloatRect& destRect)
 {
     cairo_surface_t* image = nativeImageForCurrentFrame();
     if (!image) // If it's too early we won't have an image yet.
@@ -180,9 +200,6 @@ void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, con
     cairo_pattern_t* pattern = cairo_pattern_create_for_surface(image);
     cairo_pattern_set_extend(pattern, CAIRO_EXTEND_REPEAT);
 
-    // Workaround to avoid the unwanted gradient effect (#14017)
-    cairo_pattern_set_filter(pattern, CAIRO_FILTER_NEAREST);
-
     cairo_matrix_t pattern_matrix = cairo_matrix_t(patternTransform);
     cairo_matrix_t phase_matrix = {1, 0, 0, 1, phase.x() + tileRect.x() * patternTransform.a(), phase.y() + tileRect.y() * patternTransform.d()};
     cairo_matrix_t combined;
diff --git a/WebCore/platform/graphics/cairo/PathCairo.cpp b/WebCore/platform/graphics/cairo/PathCairo.cpp
index 75681bd..8bde57e 100644
--- a/WebCore/platform/graphics/cairo/PathCairo.cpp
+++ b/WebCore/platform/graphics/cairo/PathCairo.cpp
@@ -78,15 +78,7 @@ void Path::clear()
 
 bool Path::isEmpty() const
 {
-    cairo_t* cr = platformPath()->m_cr;
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1,5,10)
-    return !cairo_has_current_point(cr);
-#else
-    cairo_path_t* p = cairo_copy_path(cr);
-    bool hasData = p->num_data;
-    cairo_path_destroy(p);
-    return !hasData;
-#endif
+    return !cairo_has_current_point(platformPath()->m_cr);
 }
 
 bool Path::hasCurrentPoint() const
@@ -256,11 +248,7 @@ FloatRect Path::boundingRect() const
 {
     cairo_t* cr = platformPath()->m_cr;
     double x0, x1, y0, y1;
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1, 6, 0)
     cairo_path_extents(cr, &x0, &y0, &x1, &y1);
-#else
-    cairo_stroke_extents(cr, &x0, &y0, &x1, &y1);
-#endif
     return FloatRect(x0, y0, x1 - x0, y1 - y0);
 }
 
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 1350bd3..39f06a6 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -43,26 +43,78 @@
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/RetainPtr.h>
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+// Building on 10.6 or later: kCGInterpolationMedium is defined in the CGInterpolationQuality enum.
 #define HAVE_CG_INTERPOLATION_MEDIUM 1
 #endif
 
+#if !defined(TARGETING_TIGER) && !defined(TARGETING_LEOPARD)
+// Targeting 10.6 or later: use kCGInterpolationMedium.
+#define WTF_USE_CG_INTERPOLATION_MEDIUM 1
+#endif
+
+#endif
+
 using namespace std;
 
 namespace WebCore {
 
-static void setCGFillColor(CGContextRef context, const Color& color)
+static CGColorRef createCGColorWithColorSpace(const Color& color, ColorSpace colorSpace)
 {
-    CGFloat red, green, blue, alpha;
-    color.getRGBA(red, green, blue, alpha);
-    CGContextSetRGBFillColor(context, red, green, blue, alpha);
+    CGFloat components[4];
+    color.getRGBA(components[0], components[1], components[2], components[3]);
+
+    CGColorRef cgColor = 0;
+    if (colorSpace == sRGBColorSpace)
+        cgColor = CGColorCreate(sRGBColorSpaceRef(), components);
+    else
+        cgColor = CGColorCreate(deviceRGBColorSpaceRef(), components);
+
+    return cgColor;
 }
 
-static void setCGStrokeColor(CGContextRef context, const Color& color)
+static void setCGFillColor(CGContextRef context, const Color& color, ColorSpace colorSpace)
 {
-    CGFloat red, green, blue, alpha;
-    color.getRGBA(red, green, blue, alpha);
-    CGContextSetRGBStrokeColor(context, red, green, blue, alpha);
+    CGColorRef cgColor = createCGColorWithColorSpace(color, colorSpace);
+    CGContextSetFillColorWithColor(context, cgColor);
+    CFRelease(cgColor);
+}
+
+static void setCGStrokeColor(CGContextRef context, const Color& color, ColorSpace colorSpace)
+{
+    CGColorRef cgColor = createCGColorWithColorSpace(color, colorSpace);
+    CGContextSetStrokeColorWithColor(context, cgColor);
+    CFRelease(cgColor);
+}
+
+static void setCGFillColorSpace(CGContextRef context, ColorSpace colorSpace)
+{
+    switch (colorSpace) {
+    case DeviceColorSpace:
+        break;
+    case sRGBColorSpace:
+        CGContextSetFillColorSpace(context, sRGBColorSpaceRef());
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+static void setCGStrokeColorSpace(CGContextRef context, ColorSpace colorSpace)
+{
+    switch (colorSpace) {
+    case DeviceColorSpace:
+        break;
+    case sRGBColorSpace:
+        CGContextSetStrokeColorSpace(context, sRGBColorSpaceRef());
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
 }
 
 GraphicsContext::GraphicsContext(CGContextRef cgContext)
@@ -72,8 +124,8 @@ GraphicsContext::GraphicsContext(CGContextRef cgContext)
     setPaintingDisabled(!cgContext);
     if (cgContext) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), fillColorSpace());
+        setPlatformStrokeColor(strokeColor(), strokeColorSpace());
     }
 }
 
@@ -123,7 +175,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
         // We do a fill of four rects to simulate the stroke of a border.
         Color oldFillColor = fillColor();
         if (oldFillColor != strokeColor())
-            setCGFillColor(context, strokeColor());
+            setCGFillColor(context, strokeColor(), strokeColorSpace());
         CGRect rects[4] = {
             FloatRect(rect.x(), rect.y(), rect.width(), 1),
             FloatRect(rect.x(), rect.bottom() - 1, rect.width(), 1),
@@ -132,7 +184,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
         };
         CGContextFillRects(context, rects, 4);
         if (oldFillColor != strokeColor())
-            setCGFillColor(context, oldFillColor);
+            setCGFillColor(context, oldFillColor, fillColorSpace());
     }
 }
 
@@ -200,7 +252,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 
         // Do a rect fill of our endpoints.  This ensures we always have the
         // appearance of being a border.  We then draw the actual dotted/dashed line.
-        setCGFillColor(context, strokeColor());  // The save/restore make it safe to mutate the fill color here without setting it back to the old color.
+        setCGFillColor(context, strokeColor(), strokeColorSpace());  // The save/restore make it safe to mutate the fill color here without setting it back to the old color.
         if (isVerticalLine) {
             CGContextFillRect(context, FloatRect(p1.x() - width / 2, p1.y() - width, width, width));
             CGContextFillRect(context, FloatRect(p2.x() - width / 2, p2.y(), width, width));
@@ -392,7 +444,7 @@ void GraphicsContext::applyStrokePattern()
 {
     CGContextRef cgContext = platformContext();
 
-    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.strokePattern.get()->createPlatformPattern(getCTM()));
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.strokePattern->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
@@ -407,7 +459,7 @@ void GraphicsContext::applyFillPattern()
 {
     CGContextRef cgContext = platformContext();
 
-    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.fillPattern.get()->createPlatformPattern(getCTM()));
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.fillPattern->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
@@ -420,8 +472,8 @@ void GraphicsContext::applyFillPattern()
 
 static inline bool calculateDrawingMode(const GraphicsContextState& state, CGPathDrawingMode& mode)
 {
-    bool shouldFill = state.fillColorSpace == PatternColorSpace || state.fillColor.alpha();
-    bool shouldStroke = state.strokeColorSpace == PatternColorSpace || (state.strokeStyle != NoStroke && state.strokeColor.alpha());
+    bool shouldFill = state.fillPattern || state.fillColor.alpha();
+    bool shouldStroke = state.strokePattern || (state.strokeStyle != NoStroke && state.strokeColor.alpha());
     bool useEOFill = state.fillRule == RULE_EVENODD;
 
     if (shouldFill) {
@@ -453,16 +505,16 @@ void GraphicsContext::drawPath()
     CGContextRef context = platformContext();
     const GraphicsContextState& state = m_common->state;
 
-    if (state.fillColorSpace == GradientColorSpace || state.strokeColorSpace == GradientColorSpace) {
+    if (state.fillGradient || state.strokeGradient) {
         // We don't have any optimized way to fill & stroke a path using gradients
         fillPath();
         strokePath();
         return;
     }
 
-    if (state.fillColorSpace == PatternColorSpace)
+    if (state.fillPattern)
         applyFillPattern();
-    if (state.strokeColorSpace == PatternColorSpace)
+    if (state.strokePattern)
         applyStrokePattern();
 
     CGPathDrawingMode drawingMode;
@@ -484,15 +536,11 @@ void GraphicsContext::fillPath()
         return;
 
     CGContextRef context = platformContext();
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        fillPathWithFillRule(context, fillRule());
-        break;
-    case PatternColorSpace:
-        applyFillPattern();
-        fillPathWithFillRule(context, fillRule());
-        break;
-    case GradientColorSpace:
+
+    // FIXME: Is this helpful and correct in the fillPattern and fillGradient cases?
+    setCGFillColorSpace(context, m_common->state.fillColorSpace);
+
+    if (m_common->state.fillGradient) {
         CGContextSaveGState(context);
         if (fillRule() == RULE_EVENODD)
             CGContextEOClip(context);
@@ -501,8 +549,12 @@ void GraphicsContext::fillPath()
         CGContextConcatCTM(context, m_common->state.fillGradient->gradientSpaceTransform());
         CGContextDrawShading(context, m_common->state.fillGradient->platformGradient());
         CGContextRestoreGState(context);
-        break;
+        return;
     }
+
+    if (m_common->state.fillPattern)
+        applyFillPattern();
+    fillPathWithFillRule(context, fillRule());
 }
 
 void GraphicsContext::strokePath()
@@ -511,76 +563,83 @@ void GraphicsContext::strokePath()
         return;
 
     CGContextRef context = platformContext();
-    switch (m_common->state.strokeColorSpace) {
-    case SolidColorSpace:
-        CGContextStrokePath(context);
-        break;
-    case PatternColorSpace:
-        applyStrokePattern();
-        CGContextStrokePath(context);
-        break;
-    case GradientColorSpace:
+
+    // FIXME: Is this helpful and correct in the strokePattern and strokeGradient cases?
+    setCGStrokeColorSpace(context, m_common->state.strokeColorSpace);
+
+    if (m_common->state.strokeGradient) {
         CGContextSaveGState(context);
         CGContextReplacePathWithStrokedPath(context);
         CGContextClip(context);
         CGContextConcatCTM(context, m_common->state.strokeGradient->gradientSpaceTransform());
         CGContextDrawShading(context, m_common->state.strokeGradient->platformGradient());
         CGContextRestoreGState(context);
-        break;
+        return;
     }
+
+    if (m_common->state.strokePattern)
+        applyStrokePattern();
+    CGContextStrokePath(context);
 }
 
 void GraphicsContext::fillRect(const FloatRect& rect)
 {
     if (paintingDisabled())
         return;
+
     CGContextRef context = platformContext();
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        CGContextFillRect(context, rect);
-        break;
-    case PatternColorSpace:
-        applyFillPattern();
-        CGContextFillRect(context, rect);
-        break;
-    case GradientColorSpace:
+
+    // FIXME: Is this helpful and correct in the fillPattern and fillGradient cases?
+    setCGFillColorSpace(context, m_common->state.fillColorSpace);
+
+    if (m_common->state.fillGradient) {
         CGContextSaveGState(context);
         CGContextClipToRect(context, rect);
         CGContextConcatCTM(context, m_common->state.fillGradient->gradientSpaceTransform());
         CGContextDrawShading(context, m_common->state.fillGradient->platformGradient());
         CGContextRestoreGState(context);
-        break;
+        return;
     }
+
+    if (m_common->state.fillPattern)
+        applyFillPattern();
+    CGContextFillRect(context, rect);
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
     CGContextRef context = platformContext();
     Color oldFillColor = fillColor();
-    if (oldFillColor != color)
-      setCGFillColor(context, color);
+    ColorSpace oldColorSpace = fillColorSpace();
+
+    if (oldFillColor != color || oldColorSpace != colorSpace)
+      setCGFillColor(context, color, colorSpace);
+
     CGContextFillRect(context, rect);
-    if (oldFillColor != color)
-      setCGFillColor(context, oldFillColor);
+
+    if (oldFillColor != color || oldColorSpace != colorSpace)
+      setCGFillColor(context, oldFillColor, oldColorSpace);
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
 
     CGContextRef context = platformContext();
     Color oldFillColor = fillColor();
-    if (oldFillColor != color)
-        setCGFillColor(context, color);
+    ColorSpace oldColorSpace = fillColorSpace();
+
+    if (oldFillColor != color || oldColorSpace != colorSpace)
+        setCGFillColor(context, color, colorSpace);
 
     addPath(Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight));
     fillPath();
 
-    if (oldFillColor != color)
-        setCGFillColor(context, oldFillColor);
+    if (oldFillColor != color || oldColorSpace != colorSpace)
+        setCGFillColor(context, oldFillColor, oldColorSpace);
 }
 
 void GraphicsContext::clip(const FloatRect& rect)
@@ -680,7 +739,7 @@ void GraphicsContext::endTransparencyLayer()
     m_data->m_userToDeviceTransformKnownToBeIdentity = false;
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Color& color)
+void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -727,7 +786,7 @@ void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Col
     if (!color.isValid())
         CGContextSetShadow(context, CGSizeMake(width, height), blurRadius);
     else {
-        RetainPtr<CGColorRef> colorCG(AdoptCF, createCGColor(color));
+        RetainPtr<CGColorRef> colorCG(AdoptCF, createCGColorWithColorSpace(color, colorSpace));
         CGContextSetShadowWithColor(context,
                                     CGSizeMake(width, height),
                                     blurRadius,
@@ -769,15 +828,11 @@ void GraphicsContext::strokeRect(const FloatRect& r, float lineWidth)
         return;
 
     CGContextRef context = platformContext();
-    switch (m_common->state.strokeColorSpace) {
-    case SolidColorSpace:
-        CGContextStrokeRectWithWidth(context, r, lineWidth);
-        break;
-    case PatternColorSpace:
-        applyStrokePattern();
-        CGContextStrokeRectWithWidth(context, r, lineWidth);
-        break;
-    case GradientColorSpace:
+
+    // FIXME: Is this helpful and correct in the strokePattern and strokeGradient cases?
+    setCGStrokeColorSpace(context, m_common->state.strokeColorSpace);
+
+    if (m_common->state.strokeGradient) {
         CGContextSaveGState(context);
         setStrokeThickness(lineWidth);
         CGContextAddRect(context, r);
@@ -785,8 +840,12 @@ void GraphicsContext::strokeRect(const FloatRect& r, float lineWidth)
         CGContextClip(context);
         CGContextDrawShading(context, m_common->state.strokeGradient->platformGradient());
         CGContextRestoreGState(context);
-        break;
+        return;
     }
+
+    if (m_common->state.strokePattern)
+        applyStrokePattern();
+    CGContextStrokeRectWithWidth(context, r, lineWidth);
 }
 
 void GraphicsContext::setLineCap(LineCap cap)
@@ -986,10 +1045,10 @@ void GraphicsContext::drawLineForText(const IntPoint& point, int width, bool pri
     }
 
     if (fillColor() != strokeColor())
-        setCGFillColor(platformContext(), strokeColor());
+        setCGFillColor(platformContext(), strokeColor(), strokeColorSpace());
     CGContextFillRect(platformContext(), CGRectMake(x, y, lineLength, thickness));
     if (fillColor() != strokeColor())
-        setCGFillColor(platformContext(), fillColor());
+        setCGFillColor(platformContext(), fillColor(), fillColorSpace());
 
     if (restoreAntialiasMode)
         CGContextSetShouldAntialias(platformContext(), true);
@@ -1034,9 +1093,9 @@ void GraphicsContext::setImageInterpolationQuality(InterpolationQuality mode)
         quality = kCGInterpolationLow;
         break;
 
-    // Fall through to InterpolationHigh if kCGInterpolationMedium is not available
+    // Fall through to InterpolationHigh if kCGInterpolationMedium is not usable.
     case InterpolationMedium:
-#if HAVE(CG_INTERPOLATION_MEDIUM)
+#if USE(CG_INTERPOLATION_MEDIUM)
         quality = kCGInterpolationMedium;
         break;
 #endif
@@ -1061,9 +1120,15 @@ InterpolationQuality GraphicsContext::imageInterpolationQuality() const
     case kCGInterpolationLow:
         return InterpolationLow;
 #if HAVE(CG_INTERPOLATION_MEDIUM)
+    // kCGInterpolationMedium is known to be present in the CGInterpolationQuality enum.
     case kCGInterpolationMedium:
+#if USE(CG_INTERPOLATION_MEDIUM)
+        // Only map to InterpolationMedium if targeting a system that understands it.
         return InterpolationMedium;
-#endif
+#else
+        return InterpolationDefault;
+#endif  // USE(CG_INTERPOLATION_MEDIUM)
+#endif  // HAVE(CG_INTERPOLATION_MEDIUM)
     case kCGInterpolationHigh:
         return InterpolationHigh;
     }
@@ -1107,11 +1172,11 @@ void GraphicsContext::setPlatformTextDrawingMode(int mode)
     }
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& color)
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
-    setCGStrokeColor(platformContext(), color);
+    setCGStrokeColor(platformContext(), color, colorSpace);
 }
 
 void GraphicsContext::setPlatformStrokeThickness(float thickness)
@@ -1121,11 +1186,11 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
     CGContextSetLineWidth(platformContext(), thickness);
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
-    setCGFillColor(platformContext(), color);
+    setCGFillColor(platformContext(), color, colorSpace);
 }
 
 void GraphicsContext::setPlatformShouldAntialias(bool enable)
diff --git a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
index 38c5506..ff1816f 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
+++ b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
@@ -27,6 +27,25 @@
 
 namespace WebCore {
 
+// FIXME: This would be in GraphicsContextCG.h if that existed.
+inline CGColorSpaceRef deviceRGBColorSpaceRef()
+{
+    static CGColorSpaceRef deviceSpace = CGColorSpaceCreateDeviceRGB();
+    return deviceSpace;
+}
+
+// FIXME: This would be in GraphicsContextCG.h if that existed.
+inline CGColorSpaceRef sRGBColorSpaceRef()
+{
+    // FIXME: Windows should be able to use kCGColorSpaceSRGB, this is tracked by http://webkit.org/b/31363.
+#if PLATFORM(WIN) || defined(BUILDING_ON_TIGER)
+    return deviceRGBColorSpaceRef();
+#else
+    static CGColorSpaceRef sRGBSpace = CGColorSpaceCreateWithName(kCGColorSpaceSRGB);
+    return sRGBSpace;
+#endif
+}
+
 class GraphicsContextPlatformPrivate {
 public:
     GraphicsContextPlatformPrivate(CGContextRef cgContext)
diff --git a/WebCore/platform/graphics/cg/ImageCG.cpp b/WebCore/platform/graphics/cg/ImageCG.cpp
index 4da7018..2e372e2 100644
--- a/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -32,6 +32,7 @@
 #include "FloatConversion.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
+#include "GraphicsContextPlatformPrivateCG.h"
 #include "ImageObserver.h"
 #include "PDFDocumentImage.h"
 #include "PlatformString.h"
@@ -127,25 +128,46 @@ void BitmapImage::checkForSolidColor()
     }
 }
 
+static RetainPtr<CGImageRef> imageWithColorSpace(CGImageRef originalImage, ColorSpace colorSpace)
+{
+    CGColorSpaceRef originalColorSpace = CGImageGetColorSpace(originalImage);
+
+    // If the image already has a (non-device) color space, we don't want to
+    // override it, so return.
+    if (!originalColorSpace || !CFEqual(originalColorSpace, deviceRGBColorSpaceRef()))
+        return originalImage;
+
+    switch (colorSpace) {
+    case DeviceColorSpace:
+        return originalImage;
+    case sRGBColorSpace:
+        return RetainPtr<CGImageRef>(AdoptCF, CGImageCreateCopyWithColorSpace(originalImage, 
+            sRGBColorSpaceRef()));
+    }
+
+    ASSERT_NOT_REACHED();
+    return originalImage;
+}
+
 CGImageRef BitmapImage::getCGImageRef()
 {
     return frameAtIndex(0);
 }
 
-void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator compositeOp)
 {
     startAnimation();
 
-    CGImageRef image = frameAtIndex(m_currentFrame);
+    RetainPtr<CGImageRef> image = frameAtIndex(m_currentFrame);
     if (!image) // If it's too early we won't have an image yet.
         return;
     
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, destRect, solidColor(), compositeOp);
+        fillWithSolidColor(ctxt, destRect, solidColor(), styleColorSpace, compositeOp);
         return;
     }
 
-    float currHeight = CGImageGetHeight(image);
+    float currHeight = CGImageGetHeight(image.get());
     if (currHeight <= srcRect.y())
         return;
 
@@ -181,10 +203,10 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
             subimageRect.setHeight(ceilf(subimageRect.height() + topPadding));
             adjustedDestRect.setHeight(subimageRect.height() / yScale);
 
-            image = CGImageCreateWithImageInRect(image, subimageRect);
+            image.adoptCF(CGImageCreateWithImageInRect(image.get(), subimageRect));
             if (currHeight < srcRect.bottom()) {
-                ASSERT(CGImageGetHeight(image) == currHeight - CGRectIntegral(srcRect).origin.y);
-                adjustedDestRect.setHeight(CGImageGetHeight(image) / yScale);
+                ASSERT(CGImageGetHeight(image.get()) == currHeight - CGRectIntegral(srcRect).origin.y);
+                adjustedDestRect.setHeight(CGImageGetHeight(image.get()) / yScale);
             }
         } else {
             adjustedDestRect.setLocation(FloatPoint(destRect.x() - srcRect.x() / xScale, destRect.y() - srcRect.y() / yScale));
@@ -204,11 +226,11 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
     CGContextScaleCTM(context, 1, -1);
     adjustedDestRect.setY(-adjustedDestRect.bottom());
 
-    // Draw the image.
-    CGContextDrawImage(context, adjustedDestRect, image);
+    // Adjust the color space.
+    image = imageWithColorSpace(image.get(), styleColorSpace);
 
-    if (shouldUseSubimage)
-        CGImageRelease(image);
+    // Draw the image.
+    CGContextDrawImage(context, adjustedDestRect, image.get());
 
     ctxt->restore();
 
@@ -223,7 +245,7 @@ static void drawPatternCallback(void* info, CGContextRef context)
 }
 
 void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const TransformationMatrix& patternTransform,
-                        const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect)
+                        const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator op, const FloatRect& destRect)
 {
     if (!nativeImageForCurrentFrame())
         return;
@@ -260,6 +282,9 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
         ASSERT(h == height());
         subImage.adoptCF(CGImageCreateWithImageInRect(tileImage, tileRect));
     }
+
+    // Adjust the color space.
+    subImage = imageWithColorSpace(subImage.get(), styleColorSpace);
     
 #ifndef BUILDING_ON_TIGER
     // Leopard has an optimized call for the tiling of image patterns, but we can only use it if the image has been decoded enough that
diff --git a/WebCore/platform/graphics/cg/ImageSourceCG.cpp b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
index 66246fe..2b2c6b0 100644
--- a/WebCore/platform/graphics/cg/ImageSourceCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
@@ -35,12 +35,27 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include <wtf/UnusedParam.h>
 
+using namespace std;
+
 namespace WebCore {
 
 static const CFStringRef kCGImageSourceShouldPreferRGB32 = CFSTR("kCGImageSourceShouldPreferRGB32");
 
 #if !PLATFORM(MAC)
-static void sharedBufferDerefCallback(void*, void* info)
+size_t sharedBufferGetBytesAtPosition(void* info, void* buffer, off_t position, size_t count)
+{
+    SharedBuffer* sharedBuffer = static_cast<SharedBuffer*>(info);
+    size_t sourceSize = sharedBuffer->size();
+    if (position >= sourceSize)
+        return 0;
+
+    const char* source = sharedBuffer->data() + position;
+    size_t amount = min<size_t>(count, sourceSize - position);
+    memcpy(buffer, source, amount);
+    return amount;
+}
+
+void sharedBufferRelease(void* info)
 {
     SharedBuffer* sharedBuffer = static_cast<SharedBuffer*>(info);
     sharedBuffer->deref();
@@ -110,15 +125,17 @@ void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
     // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
     // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
     RetainPtr<CFDataRef> cfData(AdoptCF, data->createCFData());
+    CGImageSourceUpdateData(m_decoder, cfData.get(), allDataReceived);
 #else
-    // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
-    // scenes.  We use CFDataCreateWithBytesNoCopy in that case. Ensure that the SharedBuffer lives as long as the CFDataRef.
+    // Create a CGDataProvider to wrap the SharedBuffer.
     data->ref();
-    CFAllocatorContext context = {0, data, 0, 0, 0, 0, 0, &sharedBufferDerefCallback, 0};
-    RetainPtr<CFAllocatorRef> derefAllocator(AdoptCF, CFAllocatorCreate(kCFAllocatorDefault, &context));
-    RetainPtr<CFDataRef> cfData(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(data->data()), data->size(), derefAllocator.get()));
+    // We use the GetBytesAtPosition callback rather than the GetBytePointer one because SharedBuffer
+    // does not provide a way to lock down the byte pointer and guarantee that it won't move, which
+    // is a requirement for using the GetBytePointer callback.
+    CGDataProviderDirectCallbacks providerCallbacks = { 0, 0, 0, sharedBufferGetBytesAtPosition, sharedBufferRelease };
+    RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateDirect(data, data->size(), &providerCallbacks));
+    CGImageSourceUpdateDataProvider(m_decoder, dataProvider.get(), allDataReceived);
 #endif
-    CGImageSourceUpdateData(m_decoder, cfData.get(), allDataReceived);
 }
 
 String ImageSource::filenameExtension() const
diff --git a/WebCore/platform/graphics/cg/ImageSourceCG.h b/WebCore/platform/graphics/cg/ImageSourceCG.h
index d5b4b5a..76b4160 100644
--- a/WebCore/platform/graphics/cg/ImageSourceCG.h
+++ b/WebCore/platform/graphics/cg/ImageSourceCG.h
@@ -36,6 +36,10 @@ String preferredExtensionForImageSourceType(const String& type);
 
 String MIMETypeForImageSourceType(const String& type);
 
+#if !PLATFORM(MAC)
+size_t sharedBufferGetBytesAtPosition(void* info, void* buffer, off_t position, size_t count);
+#endif
+
 }
 
 #endif // ImageSourceCG_h
diff --git a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
index 2f5c15e..67333ae 100644
--- a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
+++ b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
@@ -33,6 +33,10 @@
 #include "ImageObserver.h"
 #include <wtf/MathExtras.h>
 
+#if !PLATFORM(MAC)
+#include "ImageSourceCG.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -69,12 +73,15 @@ bool PDFDocumentImage::dataChanged(bool allDataReceived)
         // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
         // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
         RetainPtr<CFDataRef> data(AdoptCF, this->data()->createCFData());
+        RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
 #else
-        // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
-        // scenes.  We use CFDataCreateWithBytesNoCopy in that case.
-        RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(this->data()->data()), this->data()->size(), kCFAllocatorNull));
+        // Create a CGDataProvider to wrap the SharedBuffer.
+        // We use the GetBytesAtPosition callback rather than the GetBytePointer one because SharedBuffer
+        // does not provide a way to lock down the byte pointer and guarantee that it won't move, which
+        // is a requirement for using the GetBytePointer callback.
+        CGDataProviderDirectCallbacks providerCallbacks = { 0, 0, 0, sharedBufferGetBytesAtPosition, 0 };
+        RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateDirect(this->data(), this->data()->size(), &providerCallbacks));
 #endif
-        RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
         m_document = CGPDFDocumentCreateWithProvider(dataProvider.get());
         setCurrentPage(0);
     }
@@ -139,7 +146,7 @@ int PDFDocumentImage::pageCount() const
     return m_document ? CGPDFDocumentGetNumberOfPages(m_document) : 0;
 }
 
-void PDFDocumentImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator op)
+void PDFDocumentImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace, CompositeOperator op)
 {
     if (!m_document || m_currentPage == -1)
         return;
diff --git a/WebCore/platform/graphics/cg/PDFDocumentImage.h b/WebCore/platform/graphics/cg/PDFDocumentImage.h
index 130c12c..12ab46c 100644
--- a/WebCore/platform/graphics/cg/PDFDocumentImage.h
+++ b/WebCore/platform/graphics/cg/PDFDocumentImage.h
@@ -58,7 +58,7 @@ namespace WebCore {
         virtual IntSize size() const;
 
         PDFDocumentImage();
-        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
         
         void setCurrentPage(int);
         int pageCount() const;
diff --git a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index 229188e..9f8f354 100644
--- a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -112,12 +112,16 @@ void TransparencyAwareFontPainter::init()
 
 void TransparencyAwareFontPainter::initializeForGDI()
 {
+    m_graphicsContext->save();
     SkColor color = m_platformContext->effectiveFillColor();
+    // Used only when m_createdTransparencyLayer is true.
+    float layerAlpha = 0.0f;
     if (SkColorGetA(color) != 0xFF) {
         // When the font has some transparency, apply it by creating a new
-        // transparency layer with that opacity applied.
+        // transparency layer with that opacity applied. We'll actually create
+        // a new transparency layer after we calculate the bounding box.
         m_createdTransparencyLayer = true;
-        m_graphicsContext->beginTransparencyLayer(SkColorGetA(color) / 255.0f);
+        layerAlpha = SkColorGetA(color) / 255.0f;
         // The color should be opaque now.
         color = SkColorSetRGB(SkColorGetR(color), SkColorGetG(color), SkColorGetB(color));
     }
@@ -131,16 +135,22 @@ void TransparencyAwareFontPainter::initializeForGDI()
         // and we could do ClearType in that case.
         layerMode = TransparencyWin::TextComposite;
         layerRect = estimateTextBounds();
+        m_graphicsContext->clip(layerRect);
+        if (m_createdTransparencyLayer)
+            m_graphicsContext->beginTransparencyLayer(layerAlpha);
 
         // The transparency helper requires that we draw text in black in
         // this mode and it will apply the color.
         m_transparency.setTextCompositeColor(color);
         color = SkColorSetRGB(0, 0, 0);
-    } else if (canvasHasMultipleLayers(m_platformContext->canvas())) {
+    } else if (m_createdTransparencyLayer || canvasHasMultipleLayers(m_platformContext->canvas())) {
         // When we're drawing a web page, we know the background is opaque,
         // but if we're drawing to a layer, we still need extra work.
         layerMode = TransparencyWin::OpaqueCompositeLayer;
         layerRect = estimateTextBounds();
+        m_graphicsContext->clip(layerRect);
+        if (m_createdTransparencyLayer)
+            m_graphicsContext->beginTransparencyLayer(layerAlpha);
     } else {
         // Common case of drawing onto the bottom layer of a web page: we
         // know everything is opaque so don't need to do anything special.
@@ -167,6 +177,7 @@ TransparencyAwareFontPainter::~TransparencyAwareFontPainter()
     m_transparency.composite();
     if (m_createdTransparencyLayer)
         m_graphicsContext->endTransparencyLayer();
+    m_graphicsContext->restore();
     m_platformContext->canvas()->endPlatformPaint();
 }
 
diff --git a/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp b/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
index 88035d5..6bd7d7c 100644
--- a/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
@@ -42,12 +42,11 @@
 
 #include "FontPlatformData.h"
 #include "NotImplemented.h"
+#include "OpenTypeSanitizer.h"
 #include "SharedBuffer.h"
 
 #if PLATFORM(WIN_OS)
 #include <objbase.h>
-#include <t2embapi.h>
-#pragma comment(lib, "t2embed")
 #elif PLATFORM(LINUX)
 #include <cstring>
 #endif
@@ -57,13 +56,8 @@ namespace WebCore {
 FontCustomPlatformData::~FontCustomPlatformData()
 {
 #if PLATFORM(WIN_OS)
-    if (m_fontReference) {
-        if (m_name.isNull()) {
-            ULONG status;
-            TTDeleteEmbeddedFont(m_fontReference, 0, &status);
-        } else
-            RemoveFontMemResourceEx(m_fontReference);
-    }
+    if (m_fontReference)
+        RemoveFontMemResourceEx(m_fontReference);
 #elif PLATFORM(LINUX)
     if (m_fontReference)
         m_fontReference->unref();
@@ -76,19 +70,15 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
     ASSERT(m_fontReference);
 
     LOGFONT logFont;
-    if (m_name.isNull())
-        TTGetNewFontName(&m_fontReference, logFont.lfFaceName, LF_FACESIZE, 0, 0);
-    else {
-        // m_name comes from createUniqueFontName, which, in turn, gets
-        // it from base64-encoded uuid (128-bit). So, m_name
-        // can never be longer than LF_FACESIZE (32).
-        if (m_name.length() + 1 >= LF_FACESIZE) {
-            ASSERT_NOT_REACHED();
-            return FontPlatformData();
-        }
-        memcpy(logFont.lfFaceName, m_name.charactersWithNullTermination(),
-               sizeof(logFont.lfFaceName[0]) * (1 + m_name.length()));
+    // m_name comes from createUniqueFontName, which, in turn, gets
+    // it from base64-encoded uuid (128-bit). So, m_name
+    // can never be longer than LF_FACESIZE (32).
+    if (m_name.length() + 1 >= LF_FACESIZE) {
+        ASSERT_NOT_REACHED();
+        return FontPlatformData();
     }
+    memcpy(logFont.lfFaceName, m_name.charactersWithNullTermination(),
+           sizeof(logFont.lfFaceName[0]) * (1 + m_name.length()));
 
     // FIXME: almost identical to FillLogFont in FontCacheWin.cpp.
     // Need to refactor. 
@@ -119,69 +109,6 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
 }
 
 #if PLATFORM(WIN_OS)
-// FIXME: EOTStream class and static functions in this #if block are
-// duplicated from platform/graphics/win/FontCustomPlatformData.cpp
-// and need to be shared.
-
-// Streams the concatenation of a header and font data.
-class EOTStream {
-public:
-    EOTStream(const EOTHeader& eotHeader, const SharedBuffer* fontData, size_t overlayDst, size_t overlaySrc, size_t overlayLength)
-        : m_eotHeader(eotHeader)
-        , m_fontData(fontData)
-        , m_overlayDst(overlayDst)
-        , m_overlaySrc(overlaySrc)
-        , m_overlayLength(overlayLength)
-        , m_offset(0)
-        , m_inHeader(true)
-    {
-    }
-
-    size_t read(void* buffer, size_t count);
-
-private:
-    const EOTHeader& m_eotHeader;
-    const SharedBuffer* m_fontData;
-    size_t m_overlayDst;
-    size_t m_overlaySrc;
-    size_t m_overlayLength;
-    size_t m_offset;
-    bool m_inHeader;
-};
-
-size_t EOTStream::read(void* buffer, size_t count)
-{
-    size_t bytesToRead = count;
-    if (m_inHeader) {
-        size_t bytesFromHeader = std::min(m_eotHeader.size() - m_offset, count);
-        memcpy(buffer, m_eotHeader.data() + m_offset, bytesFromHeader);
-        m_offset += bytesFromHeader;
-        bytesToRead -= bytesFromHeader;
-        if (m_offset == m_eotHeader.size()) {
-            m_inHeader = false;
-            m_offset = 0;
-        }
-    }
-    if (bytesToRead && !m_inHeader) {
-        size_t bytesFromData = std::min(m_fontData->size() - m_offset, bytesToRead);
-        memcpy(buffer, m_fontData->data() + m_offset, bytesFromData);
-        if (m_offset < m_overlayDst + m_overlayLength && m_offset + bytesFromData >= m_overlayDst) {
-            size_t dstOffset = std::max<int>(m_overlayDst - m_offset, 0);
-            size_t srcOffset = std::max<int>(0, m_offset - m_overlayDst);
-            size_t bytesToCopy = std::min(bytesFromData - dstOffset, m_overlayLength - srcOffset);
-            memcpy(reinterpret_cast<char*>(buffer) + dstOffset, m_fontData->data() + m_overlaySrc + srcOffset, bytesToCopy);
-        }
-        m_offset += bytesFromData;
-        bytesToRead -= bytesFromData;
-    }
-    return count - bytesToRead;
-}
-
-static unsigned long WINAPIV readEmbedProc(void* stream, void* buffer, unsigned long length)
-{
-    return static_cast<EOTStream*>(stream)->read(buffer, length);
-}
-
 // Creates a unique and unpredictable font name, in order to avoid collisions and to
 // not allow access from CSS.
 static String createUniqueFontName()
@@ -245,38 +172,22 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
 {
     ASSERT_ARG(buffer, buffer);
 
+#if ENABLE(OPENTYPE_SANITIZER)
+    OpenTypeSanitizer sanitizer(buffer);
+    RefPtr<SharedBuffer> transcodeBuffer = sanitizer.sanitize();
+    if (!transcodeBuffer)
+        return 0; // validation failed.
+    buffer = transcodeBuffer.get();
+#endif
+
 #if PLATFORM(WIN_OS)
-    // Introduce the font to GDI. AddFontMemResourceEx cannot be used, because it will pollute the process's
+    // Introduce the font to GDI. AddFontMemResourceEx should be used with care, because it will pollute the process's
     // font namespace (Windows has no API for creating an HFONT from data without exposing the font to the
-    // entire process first). TTLoadEmbeddedFont lets us override the font family name, so using a unique name
-    // we avoid namespace collisions.
-
+    // entire process first).
     String fontName = createUniqueFontName();
-
-    // TTLoadEmbeddedFont works only with Embedded OpenType (.eot) data,
-    // so we need to create an EOT header and prepend it to the font data.
-    EOTHeader eotHeader;
-    size_t overlayDst;
-    size_t overlaySrc;
-    size_t overlayLength;
-
-    if (!getEOTHeader(buffer, eotHeader, overlayDst, overlaySrc, overlayLength))
+    HANDLE fontReference = renameAndActivateFont(buffer, fontName);
+    if (!fontReference)
         return 0;
-
-    HANDLE fontReference;
-    ULONG privStatus;
-    ULONG status;
-    EOTStream eotStream(eotHeader, buffer, overlayDst, overlaySrc, overlayLength);
-
-    LONG loadEmbeddedFontResult = TTLoadEmbeddedFont(&fontReference, TTLOAD_PRIVATE, &privStatus, LICENSE_PREVIEWPRINT, &status, readEmbedProc, &eotStream, const_cast<LPWSTR>(fontName.charactersWithNullTermination()), 0, 0);
-    if (loadEmbeddedFontResult == E_NONE)
-        fontName = String();
-    else {
-        fontReference = renameAndActivateFont(buffer, fontName);
-        if (!fontReference)
-            return 0;
-    }
-
     return new FontCustomPlatformData(fontReference, fontName);
 #elif PLATFORM(LINUX)
     RemoteFontStream stream(buffer);
diff --git a/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp b/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp
index a5a6e1f..1386163 100644
--- a/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp
+++ b/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp
@@ -46,12 +46,6 @@ Icon::~Icon()
 {
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String&)
-{
-    notImplemented();
-    return 0;
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
 {
     notImplemented();
diff --git a/WebCore/platform/graphics/chromium/IconChromiumMac.cpp b/WebCore/platform/graphics/chromium/IconChromiumMac.cpp
index 93e36ba..23ca698 100644
--- a/WebCore/platform/graphics/chromium/IconChromiumMac.cpp
+++ b/WebCore/platform/graphics/chromium/IconChromiumMac.cpp
@@ -39,11 +39,6 @@
  
 namespace WebCore {
 
-PassRefPtr<Icon> Icon::createIconForFile(const String&)
-{
-    return 0;
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
 {
     return 0;
diff --git a/WebCore/platform/graphics/chromium/IconChromiumWin.cpp b/WebCore/platform/graphics/chromium/IconChromiumWin.cpp
index b419e6f..b0145f8 100644
--- a/WebCore/platform/graphics/chromium/IconChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/IconChromiumWin.cpp
@@ -52,26 +52,11 @@ Icon::~Icon()
         DestroyIcon(m_icon);
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
-{
-    SHFILEINFO sfi;
-    memset(&sfi, 0, sizeof(sfi));
-
-    String tmpFilename = filename;
-    if (!SHGetFileInfo(tmpFilename.charactersWithNullTermination(), 0, &sfi, sizeof(sfi), SHGFI_ICON | SHGFI_SHELLICONSIZE | SHGFI_SMALLICON))
-        return 0;
-
-    return adoptRef(new Icon(sfi.hIcon));
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    // FIXME: support multiple files.
+    // FIXME: We can't access icons directly from renderer processes.
     // http://code.google.com/p/chromium/issues/detail?id=4092
-    if (!filenames.size())
-        return 0;
-
-    return createIconForFile(filenames[0]);
+    return 0;
 }
 
 void Icon::paint(GraphicsContext* context, const IntRect& rect)
diff --git a/WebCore/platform/graphics/chromium/TransparencyWin.cpp b/WebCore/platform/graphics/chromium/TransparencyWin.cpp
index 7957d5a..6dcd595 100644
--- a/WebCore/platform/graphics/chromium/TransparencyWin.cpp
+++ b/WebCore/platform/graphics/chromium/TransparencyWin.cpp
@@ -275,7 +275,7 @@ void TransparencyWin::setupLayerForWhiteLayer()
     if (!m_validLayer)
         return;
 
-    m_drawContext->fillRect(IntRect(IntPoint(0, 0), m_layerSize), Color::white);
+    m_drawContext->fillRect(IntRect(IntPoint(0, 0), m_layerSize), Color::white, DeviceColorSpace);
     // Layer rect represents the part of the original layer.
 }
 
diff --git a/WebCore/platform/graphics/filters/FEBlend.cpp b/WebCore/platform/graphics/filters/FEBlend.cpp
index 2364cc4..f362148 100644
--- a/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -111,10 +111,10 @@ void FEBlend::apply(Filter* filter)
     if (!getEffectContext())
         return;
 
-    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
     RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
 
-    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->scaledSubRegion());
     RefPtr<CanvasPixelArray> srcPixelArrayB(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect)->data());
 
     IntRect imageRect(IntPoint(), resultImage()->size());
diff --git a/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index a2ed9bd..f422157 100644
--- a/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -164,7 +164,7 @@ void FEColorMatrix::apply(Filter* filter)
     if (!filterContext)
         return;
 
-    filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+    filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
 
     IntRect imageRect(IntPoint(), resultImage()->size());
     PassRefPtr<ImageData> imageData(resultImage()->getUnmultipliedImageData(imageRect));
diff --git a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 0d76d8d..1d9cfff 100644
--- a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -165,7 +165,7 @@ void FEComponentTransfer::apply(Filter* filter)
     for (unsigned channel = 0; channel < 4; channel++)
         (*callEffect[transferFunction[channel].type])(tables[channel], transferFunction[channel]);
 
-    IntRect drawingRect = calculateDrawingIntRect(m_in->subRegion());
+    IntRect drawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
     RefPtr<ImageData> imageData(m_in->resultImage()->getUnmultipliedImageData(drawingRect));
     CanvasPixelArray* srcPixelArray(imageData->data());
 
diff --git a/WebCore/platform/graphics/filters/FEComposite.cpp b/WebCore/platform/graphics/filters/FEComposite.cpp
index 1b41165..c540cb7 100644
--- a/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -133,32 +133,32 @@ void FEComposite::apply(Filter* filter)
     FloatRect srcRect = FloatRect(0.f, 0.f, -1.f, -1.f);
     switch (m_type) {
     case FECOMPOSITE_OPERATOR_OVER:
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
         break;
     case FECOMPOSITE_OPERATOR_IN:
         filterContext->save();
-        filterContext->clipToImageBuffer(calculateDrawingRect(m_in2->subRegion()), m_in2->resultImage());
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->clipToImageBuffer(calculateDrawingRect(m_in2->scaledSubRegion()), m_in2->resultImage());
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
         filterContext->restore();
         break;
     case FECOMPOSITE_OPERATOR_OUT:
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()), srcRect, CompositeDestinationOut);
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()), srcRect, CompositeDestinationOut);
         break;
     case FECOMPOSITE_OPERATOR_ATOP:
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeSourceAtop);
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()), srcRect, CompositeSourceAtop);
         break;
     case FECOMPOSITE_OPERATOR_XOR:
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeXOR);
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()), srcRect, CompositeXOR);
         break;
     case FECOMPOSITE_OPERATOR_ARITHMETIC: {
-        IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+        IntRect effectADrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
         RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
 
-        IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+        IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->scaledSubRegion());
         RefPtr<ImageData> imageData(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect));
         CanvasPixelArray* srcPixelArrayB(imageData->data());
 
diff --git a/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
index f480f10..0b97e39 100644
--- a/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
+++ b/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -32,6 +32,8 @@
 #include <math.h>
 #include <wtf/MathExtras.h>
 
+using std::max;
+
 namespace WebCore {
 
 FEGaussianBlur::FEGaussianBlur(FilterEffect* in, const float& x, const float& y)
@@ -111,10 +113,12 @@ void FEGaussianBlur::apply(Filter* filter)
     if (m_x == 0 || m_y == 0)
         return;
 
-    unsigned sdx = static_cast<unsigned>(floor(m_x * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
-    unsigned sdy = static_cast<unsigned>(floor(m_y * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    unsigned sdx = static_cast<unsigned>(floor(m_x * filter->filterResolution().width() * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    unsigned sdy = static_cast<unsigned>(floor(m_y * filter->filterResolution().height() * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    sdx = max(sdx, static_cast<unsigned>(1));
+    sdy = max(sdy, static_cast<unsigned>(1));
 
-    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
     RefPtr<ImageData> srcImageData(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect));
     CanvasPixelArray* srcPixelArray(srcImageData->data());
 
diff --git a/WebCore/platform/graphics/filters/Filter.h b/WebCore/platform/graphics/filters/Filter.h
index ee97afc..8924b94 100644
--- a/WebCore/platform/graphics/filters/Filter.h
+++ b/WebCore/platform/graphics/filters/Filter.h
@@ -22,6 +22,7 @@
 
 #if ENABLE(FILTERS)
 #include "FloatRect.h"
+#include "FloatSize.h"
 #include "ImageBuffer.h"
 #include "StringHash.h"
 
@@ -40,15 +41,21 @@ namespace WebCore {
         void setSourceImage(PassOwnPtr<ImageBuffer> sourceImage) { m_sourceImage = sourceImage; }
         ImageBuffer* sourceImage() { return m_sourceImage.get(); }
 
-        virtual FloatRect sourceImageRect() = 0;
-        virtual FloatRect filterRegion() = 0;
+        FloatSize filterResolution() const { return m_filterResolution; }
+        void setFilterResolution(const FloatSize& filterResolution) { m_filterResolution = filterResolution; }
+
+        virtual FloatRect sourceImageRect() const = 0;
+        virtual FloatRect filterRegion() const = 0;
 
         // SVG specific
-        virtual void calculateEffectSubRegion(FilterEffect*) = 0;
-        virtual bool effectBoundingBoxMode() = 0;
+        virtual void calculateEffectSubRegion(FilterEffect*) { }
+
+        virtual FloatSize maxImageSize() const = 0;
+        virtual bool effectBoundingBoxMode() const = 0;
 
     private:
         OwnPtr<ImageBuffer> m_sourceImage;
+        FloatSize m_filterResolution;
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/filters/FilterEffect.cpp b/WebCore/platform/graphics/filters/FilterEffect.cpp
index 68900b5..5583813 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -58,21 +58,21 @@ FloatRect FilterEffect::calculateEffectRect(Filter* filter)
 
 IntRect FilterEffect::calculateDrawingIntRect(const FloatRect& effectRect)
 {
-    IntPoint location = roundedIntPoint(FloatPoint(subRegion().x() - effectRect.x(),
-                                                   subRegion().y() - effectRect.y()));
+    IntPoint location = roundedIntPoint(FloatPoint(scaledSubRegion().x() - effectRect.x(),
+                                                   scaledSubRegion().y() - effectRect.y()));
     return IntRect(location, resultImage()->size());
 }
 
 FloatRect FilterEffect::calculateDrawingRect(const FloatRect& srcRect)
 {
-    FloatPoint startPoint = FloatPoint(srcRect.x() - subRegion().x(), srcRect.y() - subRegion().y());
+    FloatPoint startPoint = FloatPoint(srcRect.x() - scaledSubRegion().x(), srcRect.y() - scaledSubRegion().y());
     FloatRect drawingRect = FloatRect(startPoint, srcRect.size());
     return drawingRect;
 }
 
 GraphicsContext* FilterEffect::getEffectContext()
 {
-    IntRect bufferRect = enclosingIntRect(subRegion());
+    IntRect bufferRect = enclosingIntRect(scaledSubRegion());
     m_effectBuffer = ImageBuffer::create(bufferRect.size(), LinearRGB);
     return m_effectBuffer->context();
 }
diff --git a/WebCore/platform/graphics/filters/FilterEffect.h b/WebCore/platform/graphics/filters/FilterEffect.h
index b30e513..a46d795 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/WebCore/platform/graphics/filters/FilterEffect.h
@@ -44,6 +44,12 @@ namespace WebCore {
         FloatRect subRegion() const { return m_subRegion; }
         void setSubRegion(const FloatRect& subRegion) { m_subRegion = subRegion; }
 
+        FloatRect scaledSubRegion() const { return m_scaledSubRegion; }
+        void setScaledSubRegion(const FloatRect& scaledSubRegion) { m_scaledSubRegion = scaledSubRegion; }
+
+        FloatRect effectBoundaries() const { return m_effectBoundaries; }
+        void setEffectBoundaries(const FloatRect& effectBoundaries) { m_effectBoundaries = effectBoundaries; }
+
         bool hasX() { return m_hasX; }
         void setHasX(bool value) { m_hasX = value; }
 
@@ -96,7 +102,9 @@ namespace WebCore {
 
         bool m_alphaImage;
 
+        FloatRect m_effectBoundaries;
         FloatRect m_subRegion;
+        FloatRect m_scaledSubRegion;
         FloatRect m_unionOfChildEffectSubregions;
 
         mutable OwnPtr<ImageBuffer> m_effectBuffer;
diff --git a/WebCore/platform/graphics/filters/ImageBufferFilter.cpp b/WebCore/platform/graphics/filters/ImageBufferFilter.cpp
new file mode 100644
index 0000000..33953d6
--- /dev/null
+++ b/WebCore/platform/graphics/filters/ImageBufferFilter.cpp
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *  Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "ImageBufferFilter.h"
+
+#include "FloatSize.h"
+
+namespace WebCore {
+
+ImageBufferFilter::ImageBufferFilter()
+    : Filter()
+{
+    setFilterResolution(FloatSize(1.f, 1.f));
+}
+
+PassRefPtr<ImageBufferFilter> ImageBufferFilter::create()
+{
+    return adoptRef(new ImageBufferFilter());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/platform/graphics/filters/ImageBufferFilter.h b/WebCore/platform/graphics/filters/ImageBufferFilter.h
new file mode 100644
index 0000000..a2775ea
--- /dev/null
+++ b/WebCore/platform/graphics/filters/ImageBufferFilter.h
@@ -0,0 +1,57 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *  Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef ImageBufferFilter_h
+#define ImageBufferFilter_h
+
+#if ENABLE(FILTERS)
+#include "Filter.h"
+#include "FilterEffect.h"
+#include "FloatRect.h"
+#include "FloatSize.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class ImageBufferFilter : public Filter {
+public:
+    static PassRefPtr<ImageBufferFilter> create();
+
+    virtual FloatRect filterRegion() const { return FloatRect(); }
+    virtual FloatRect sourceImageRect() const { return FloatRect(); }
+
+    // SVG specific
+    virtual bool effectBoundingBoxMode() const { return false; }
+
+    virtual FloatSize maxImageSize() const { return FloatSize(); }
+    virtual void calculateEffectSubRegion(FilterEffect*) { }
+
+private:
+    ImageBufferFilter();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
+
+#endif // ImageBufferFilter_h
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.cpp b/WebCore/platform/graphics/filters/SourceAlpha.cpp
index 1b6309b..539bb44 100644
--- a/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -50,6 +50,8 @@ FloatRect SourceAlpha::calculateEffectRect(Filter* filter)
     if (filter->sourceImageRect().y() < filter->filterRegion().y())
         clippedSourceRect.setY(filter->filterRegion().y());
     setSubRegion(clippedSourceRect);
+    clippedSourceRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+    setScaledSubRegion(clippedSourceRect);
     return filter->filterRegion();
 }
 
@@ -64,7 +66,7 @@ void SourceAlpha::apply(Filter* filter)
     FloatRect imageRect(FloatPoint(), filter->sourceImage()->image()->size());
     filterContext->save();
     filterContext->clipToImageBuffer(imageRect, filter->sourceImage());
-    filterContext->fillRect(imageRect, Color::black);
+    filterContext->fillRect(imageRect, Color::black, DeviceColorSpace);
     filterContext->restore();
 }
 
diff --git a/WebCore/platform/graphics/filters/SourceGraphic.cpp b/WebCore/platform/graphics/filters/SourceGraphic.cpp
index 023eeac..cc55618 100644
--- a/WebCore/platform/graphics/filters/SourceGraphic.cpp
+++ b/WebCore/platform/graphics/filters/SourceGraphic.cpp
@@ -49,6 +49,8 @@ FloatRect SourceGraphic::calculateEffectRect(Filter* filter)
     if (filter->sourceImageRect().y() < filter->filterRegion().y())
         clippedSourceRect.setY(filter->filterRegion().y());
     setSubRegion(clippedSourceRect);
+    clippedSourceRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+    setScaledSubRegion(clippedSourceRect);
     return filter->filterRegion();
 }
 
@@ -58,7 +60,7 @@ void SourceGraphic::apply(Filter* filter)
     if (!filterContext)
         return;
 
-    filterContext->drawImage(filter->sourceImage()->image(), IntPoint());
+    filterContext->drawImage(filter->sourceImage()->image(), DeviceColorSpace, IntPoint());
 }
 
 void SourceGraphic::dump()
diff --git a/WebCore/platform/graphics/gtk/FontGtk.cpp b/WebCore/platform/graphics/gtk/FontGtk.cpp
index ee86f96..5c320e0 100644
--- a/WebCore/platform/graphics/gtk/FontGtk.cpp
+++ b/WebCore/platform/graphics/gtk/FontGtk.cpp
@@ -259,7 +259,7 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
 
     // Re-enable the platform shadow we disabled earlier
     if (hasShadow)
-        context->setShadow(shadowSize, shadowBlur, shadowColor);
+        context->setShadow(shadowSize, shadowBlur, shadowColor, DeviceColorSpace);
 
     // Pango sometimes leaves behind paths we don't want
     cairo_new_path(cr);
diff --git a/WebCore/platform/graphics/gtk/IconGtk.cpp b/WebCore/platform/graphics/gtk/IconGtk.cpp
index e08c1ab..3563a59 100644
--- a/WebCore/platform/graphics/gtk/IconGtk.cpp
+++ b/WebCore/platform/graphics/gtk/IconGtk.cpp
@@ -87,23 +87,25 @@ static String lookupIconName(String MIMEType)
     return GTK_STOCK_FILE;
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    if (!g_path_skip_root(filename.utf8().data()))
+    if (filenames.isEmpty())
         return 0;
 
-    String MIMEType = MIMETypeRegistry::getMIMETypeForPath(filename);
-    String iconName = lookupIconName(MIMEType);
+    if (filenames.size() == 1) {
+        if (!g_path_skip_root(filenames[0].utf8().data()))
+            return 0;
 
-    RefPtr<Icon> icon = adoptRef(new Icon);
-    icon->m_icon = gtk_icon_theme_load_icon(gtk_icon_theme_get_default(), iconName.utf8().data(), 16, GTK_ICON_LOOKUP_USE_BUILTIN, NULL);
-    if (!icon->m_icon)
-        return 0;
-    return icon.release();
-}
+        String MIMEType = MIMETypeRegistry::getMIMETypeForPath(filenames[0]);
+        String iconName = lookupIconName(MIMEType);
+
+        RefPtr<Icon> icon = adoptRef(new Icon);
+        icon->m_icon = gtk_icon_theme_load_icon(gtk_icon_theme_get_default(), iconName.utf8().data(), 16, GTK_ICON_LOOKUP_USE_BUILTIN, 0);
+        if (!icon->m_icon)
+            return 0;
+        return icon.release();
+    }
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
-{
     //FIXME: Implement this
     return 0;
 }
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
index 8d1d261..a023dae 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
@@ -46,7 +46,7 @@
 #include <gst/video/video.h>
 #include <limits>
 #include <math.h>
-#include <wtf/GOwnPtr.h>
+#include <wtf/gtk/GOwnPtr.h>
 
 using namespace std;
 
@@ -66,11 +66,15 @@ gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpo
         LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
 
         error = MediaPlayer::Empty;
-        if (err->domain == GST_CORE_ERROR || err->domain == GST_LIBRARY_ERROR)
-            error = MediaPlayer::DecodeError;
-        else if (err->domain == GST_RESOURCE_ERROR)
+        if (err->code == GST_STREAM_ERROR_CODEC_NOT_FOUND
+            || err->code == GST_STREAM_ERROR_WRONG_TYPE
+            || err->code == GST_STREAM_ERROR_FAILED
+            || err->code == GST_CORE_ERROR_MISSING_PLUGIN
+            || err->code == GST_RESOURCE_ERROR_NOT_FOUND)
             error = MediaPlayer::FormatError;
         else if (err->domain == GST_STREAM_ERROR)
+            error = MediaPlayer::DecodeError;
+        else if (err->domain == GST_RESOURCE_ERROR)
             error = MediaPlayer::NetworkError;
 
         if (mp)
@@ -95,6 +99,33 @@ gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpo
     return true;
 }
 
+static float playbackPosition(GstElement* playbin)
+{
+
+    float ret = 0.0;
+
+    GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
+    if (!gst_element_query(playbin, query)) {
+        LOG_VERBOSE(Media, "Position query failed...");
+        gst_query_unref(query);
+        return ret;
+    }
+
+    gint64 position;
+    gst_query_parse_position(query, 0, &position);
+
+    // Position is available only if the pipeline is not in NULL or
+    // READY state.
+    if (position !=  static_cast<gint64>(GST_CLOCK_TIME_NONE))
+        ret = static_cast<float>(position) / static_cast<float>(GST_SECOND);
+
+    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
+
+    gst_query_unref(query);
+
+    return ret;
+}
+
 void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, GstBuffer *buffer, MediaPlayerPrivate* playerPrivate)
 {
     g_return_if_fail(GST_IS_BUFFER(buffer));
@@ -115,16 +146,34 @@ void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
 
 static bool gstInitialized = false;
 
-static void do_gst_init()
+static bool do_gst_init()
 {
     // FIXME: We should pass the arguments from the command line
     if (!gstInitialized) {
-        gst_init(0, 0);
-        gstInitialized = true;
-        gst_element_register(0, "webkitmediasrc", GST_RANK_PRIMARY,
-                             WEBKIT_TYPE_DATA_SRC);
+        GOwnPtr<GError> error;
+        gstInitialized = gst_init_check(0, 0, &error.outPtr());
+        if (!gstInitialized)
+            LOG_VERBOSE(Media, "Could not initialize GStreamer: %s",
+                        error ? error->message : "unknown error occurred");
+        else
+            gst_element_register(0, "webkitmediasrc", GST_RANK_PRIMARY,
+                                 WEBKIT_TYPE_DATA_SRC);
 
     }
+    return gstInitialized;
+}
+
+bool MediaPlayerPrivate::isAvailable()
+{
+    if (!do_gst_init())
+        return false;
+
+    GstElementFactory* factory = gst_element_factory_find("playbin2");
+    if (factory) {
+        gst_object_unref(GST_OBJECT(factory));
+        return true;
+    }
+    return false;
 }
 
 MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
@@ -132,6 +181,8 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     , m_playBin(0)
     , m_videoSink(0)
     , m_source(0)
+    , m_seekTime(0)
+    , m_changingRate(false)
     , m_endTime(numeric_limits<float>::infinity())
     , m_networkState(MediaPlayer::Empty)
     , m_readyState(MediaPlayer::HaveNothing)
@@ -181,14 +232,26 @@ void MediaPlayerPrivate::load(const String& url)
 
 void MediaPlayerPrivate::play()
 {
-    LOG_VERBOSE(Media, "Play");
-    gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+    GstState state;
+    GstState pending;
+
+    gst_element_get_state(m_playBin, &state, &pending, 0);
+    if (state != GST_STATE_PLAYING && pending != GST_STATE_PLAYING) {
+        LOG_VERBOSE(Media, "Play");
+        gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+    }
 }
 
 void MediaPlayerPrivate::pause()
 {
-    LOG_VERBOSE(Media, "Pause");
-    gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+    GstState state;
+    GstState pending;
+
+    gst_element_get_state(m_playBin, &state, &pending, 0);
+    if (state != GST_STATE_PAUSED  && pending != GST_STATE_PAUSED) {
+        LOG_VERBOSE(Media, "Pause");
+        gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+    }
 }
 
 float MediaPlayerPrivate::duration() const
@@ -202,7 +265,7 @@ float MediaPlayerPrivate::duration() const
     GstFormat timeFormat = GST_FORMAT_TIME;
     gint64 timeLength = 0;
 
-    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || timeLength == GST_CLOCK_TIME_NONE) {
+    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE) {
         LOG_VERBOSE(Media, "Time duration query failed.");
         return numeric_limits<float>::infinity();
     }
@@ -221,23 +284,11 @@ float MediaPlayerPrivate::currentTime() const
     if (m_errorOccured)
         return 0;
 
-    float ret = 0.0;
+    if (m_seeking)
+        return m_seekTime;
 
-    GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
-    if (!gst_element_query(m_playBin, query)) {
-        LOG_VERBOSE(Media, "Position query failed...");
-        gst_query_unref(query);
-        return ret;
-    }
+    return playbackPosition(m_playBin);
 
-    gint64 position;
-    gst_query_parse_position(query, 0, &position);
-    ret = (float) (position / 1000000000.0);
-    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
-
-    gst_query_unref(query);
-
-    return ret;
 }
 
 void MediaPlayerPrivate::seek(float time)
@@ -260,8 +311,10 @@ void MediaPlayerPrivate::seek(float time)
             GST_SEEK_TYPE_SET, sec,
             GST_SEEK_TYPE_NONE, GST_CLOCK_TIME_NONE))
         LOG_VERBOSE(Media, "Seek to %f failed", time);
-    else
+    else {
         m_seeking = true;
+        m_seekTime = sec;
+    }
 }
 
 void MediaPlayerPrivate::setEndTime(float time)
@@ -310,10 +363,10 @@ IntSize MediaPlayerPrivate::naturalSize() const
         gfloat pixelAspectRatio;
         gint pixelAspectRatioNumerator, pixelAspectRatioDenominator;
 
-        if (!GST_IS_CAPS(caps) || !gst_caps_is_fixed(caps) ||
-            !gst_video_format_parse_caps(caps, NULL, &width, &height) ||
-            !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
-                                                           &pixelAspectRatioDenominator)) {
+        if (!GST_IS_CAPS(caps) || !gst_caps_is_fixed(caps)
+            || !gst_video_format_parse_caps(caps, 0, &width, &height)
+            || !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
+                                                        &pixelAspectRatioDenominator)) {
             gst_object_unref(GST_OBJECT(pad));
             return IntSize();
         }
@@ -353,16 +406,50 @@ void MediaPlayerPrivate::setVolume(float volume)
 
 void MediaPlayerPrivate::setRate(float rate)
 {
-    if (rate == 0.0) {
-        gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+    GstState state;
+    GstState pending;
+
+    gst_element_get_state(m_playBin, &state, &pending, 0);
+    if ((state != GST_STATE_PLAYING && state != GST_STATE_PAUSED)
+        || (pending == GST_STATE_PAUSED))
         return;
-    }
 
     if (m_isStreaming)
         return;
 
+    m_changingRate = true;
+    float currentPosition = playbackPosition(m_playBin) * GST_SECOND;
+    GstSeekFlags flags = (GstSeekFlags)(GST_SEEK_FLAG_FLUSH);
+    gint64 start, end;
+    bool mute = false;
+
     LOG_VERBOSE(Media, "Set Rate to %f", rate);
-    seek(currentTime());
+    if (rate >= 0) {
+        // Mute the sound if the playback rate is too extreme.
+        // TODO: in other cases we should perform pitch adjustments.
+        mute = (bool) (rate < 0.8 || rate > 2);
+        start = currentPosition;
+        end = GST_CLOCK_TIME_NONE;
+    } else {
+        start = 0;
+        mute = true;
+
+        // If we are at beginning of media, start from the end to
+        // avoid immediate EOS.
+        if (currentPosition <= 0)
+            end = duration() * GST_SECOND;
+        else
+            end = currentPosition;
+    }
+
+    LOG_VERBOSE(Media, "Need to mute audio: %d", (int) mute);
+
+    if (!gst_element_seek(m_playBin, rate, GST_FORMAT_TIME, flags,
+                          GST_SEEK_TYPE_SET, start,
+                          GST_SEEK_TYPE_SET, end))
+        LOG_VERBOSE(Media, "Set rate to %f failed", rate);
+    else
+        g_object_set(m_playBin, "mute", mute, NULL);
 }
 
 int MediaPlayerPrivate::dataRate() const
@@ -497,6 +584,11 @@ void MediaPlayerPrivate::updateStates()
         } else
             m_paused = true;
 
+        if (m_changingRate) {
+            m_player->rateChanged();
+            m_changingRate = false;
+        }
+
         if (m_seeking) {
             shouldUpdateAfterSeek = true;
             m_seeking = false;
@@ -560,11 +652,6 @@ void MediaPlayerPrivate::loadStateChanged()
     updateStates();
 }
 
-void MediaPlayerPrivate::rateChanged()
-{
-    updateStates();
-}
-
 void MediaPlayerPrivate::sizeChanged()
 {
     notImplemented();
@@ -624,54 +711,36 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
         return;
 
     int width = 0, height = 0;
-    int pixelAspectRatioNumerator = 0;
-    int pixelAspectRatioDenominator = 0;
-    double doublePixelAspectRatioNumerator = 0;
-    double doublePixelAspectRatioDenominator = 0;
-    double displayWidth;
-    double displayHeight;
-    double scale, gapHeight, gapWidth;
-
     GstCaps *caps = gst_buffer_get_caps(m_buffer);
+    GstVideoFormat format;
 
-    if (!gst_video_format_parse_caps(caps, NULL, &width, &height) ||
-        !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator, &pixelAspectRatioDenominator)) {
+    if (!gst_video_format_parse_caps(caps, &format, &width, &height)) {
       gst_caps_unref(caps);
       return;
     }
 
-    displayWidth = width;
-    displayHeight = height;
-    doublePixelAspectRatioNumerator = pixelAspectRatioNumerator;
-    doublePixelAspectRatioDenominator = pixelAspectRatioDenominator;
+    cairo_format_t cairoFormat;
+    if (format == GST_VIDEO_FORMAT_ARGB || format == GST_VIDEO_FORMAT_BGRA)
+        cairoFormat = CAIRO_FORMAT_ARGB32;
+    else
+        cairoFormat = CAIRO_FORMAT_RGB24;
 
     cairo_t* cr = context->platformContext();
     cairo_surface_t* src = cairo_image_surface_create_for_data(GST_BUFFER_DATA(m_buffer),
-                                                               CAIRO_FORMAT_RGB24,
+                                                               cairoFormat,
                                                                width, height,
                                                                4 * width);
 
     cairo_save(cr);
-    cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
-
-    displayWidth *= doublePixelAspectRatioNumerator / doublePixelAspectRatioDenominator;
-    displayHeight *= doublePixelAspectRatioDenominator / doublePixelAspectRatioNumerator;
 
-    scale = MIN (rect.width () / displayWidth, rect.height () / displayHeight);
-    displayWidth *= scale;
-    displayHeight *= scale;
+    // translate and scale the context to correct size
+    cairo_translate(cr, rect.x(), rect.y());
+    cairo_scale(cr, static_cast<double>(rect.width()) / width, static_cast<double>(rect.height()) / height);
 
-    // Calculate gap between border an picture
-    gapWidth = (rect.width() - displayWidth) / 2.0;
-    gapHeight = (rect.height() - displayHeight) / 2.0;
-
-    // paint the rectangle on the context and draw the surface inside.
-    cairo_translate(cr, rect.x() + gapWidth, rect.y() + gapHeight);
-    cairo_rectangle(cr, 0, 0, rect.width(), rect.height());
-    cairo_scale(cr, doublePixelAspectRatioNumerator / doublePixelAspectRatioDenominator,
-                doublePixelAspectRatioDenominator / doublePixelAspectRatioNumerator);
-    cairo_scale(cr, scale, scale);
+    // And paint it.
     cairo_set_source_surface(cr, src, 0, 0);
+    cairo_pattern_set_extend(cairo_get_source(cr), CAIRO_EXTEND_PAD);
+    cairo_rectangle(cr, 0, 0, width, height);
     cairo_fill(cr);
     cairo_restore(cr);
 
@@ -688,76 +757,91 @@ static HashSet<String> mimeTypeCache()
     static bool typeListInitialized = false;
 
     if (!typeListInitialized) {
-        // These subtypes are already beeing supported by WebKit itself
-        HashSet<String> ignoredApplicationSubtypes;
-        ignoredApplicationSubtypes.add(String("javascript"));
-        ignoredApplicationSubtypes.add(String("ecmascript"));
-        ignoredApplicationSubtypes.add(String("x-javascript"));
-        ignoredApplicationSubtypes.add(String("xml"));
-        ignoredApplicationSubtypes.add(String("xhtml+xml"));
-        ignoredApplicationSubtypes.add(String("rss+xml"));
-        ignoredApplicationSubtypes.add(String("atom+xml"));
-        ignoredApplicationSubtypes.add(String("x-ftp-directory"));
-        ignoredApplicationSubtypes.add(String("x-java-applet"));
-        ignoredApplicationSubtypes.add(String("x-java-bean"));
-        ignoredApplicationSubtypes.add(String("x-java-vm"));
-        ignoredApplicationSubtypes.add(String("x-shockwave-flash"));
+        // Build a whitelist of mime-types known to be supported by
+        // GStreamer.
+        HashSet<String> handledApplicationSubtypes;
+        handledApplicationSubtypes.add(String("ogg"));
+        handledApplicationSubtypes.add(String("x-3gp"));
+        handledApplicationSubtypes.add(String("vnd.rn-realmedia"));
+        handledApplicationSubtypes.add(String("x-pn-realaudio"));
 
         GList* factories = gst_type_find_factory_get_list();
         for (GList* iterator = factories; iterator; iterator = iterator->next) {
             GstTypeFindFactory* factory = GST_TYPE_FIND_FACTORY(iterator->data);
             GstCaps* caps = gst_type_find_factory_get_caps(factory);
 
-            // Splitting the capability by comma and taking the first part
-            // as capability can be something like "audio/x-wavpack, framed=(boolean)false"
-            GOwnPtr<gchar> capabilityString(gst_caps_to_string(caps));
-            gchar** capability = g_strsplit(capabilityString.get(), ",", 2);
-            gchar** mimetype = g_strsplit(capability[0], "/", 2);
-
-            // GStreamer plugins can be capable of supporting types which WebKit supports
-            // by default. In that case, we should not consider these types supportable by GStreamer.
-            // Examples of what GStreamer can support but should not be added:
-            // text/plain, text/html, image/jpeg, application/xml
-            if (g_str_equal(mimetype[0], "audio") ||
-                    g_str_equal(mimetype[0], "video") ||
-                    (g_str_equal(mimetype[0], "application") &&
-                        !ignoredApplicationSubtypes.contains(String(mimetype[1])))) {
-                cache.add(String(capability[0]));
-
-                // These formats are supported by GStreamer, but not correctly advertised
-                if (g_str_equal(capability[0], "video/x-h264") ||
-                    g_str_equal(capability[0], "audio/x-m4a")) {
+            if (!caps)
+                continue;
+
+            for (guint structureIndex = 0; structureIndex < gst_caps_get_size(caps); structureIndex++) {
+                GstStructure* structure = gst_caps_get_structure(caps, structureIndex);
+                const gchar* name = gst_structure_get_name(structure);
+                bool cached = false;
+
+                // These formats are supported by GStreamer, but not
+                // correctly advertised.
+                if (g_str_equal(name, "video/x-h264")
+                    || g_str_equal(name, "audio/x-m4a")) {
                     cache.add(String("video/mp4"));
                     cache.add(String("audio/aac"));
+                    cached = true;
                 }
 
-                if (g_str_equal(capability[0], "video/x-theora"))
+                if (g_str_equal(name, "video/x-theora")) {
                     cache.add(String("video/ogg"));
+                    cached = true;
+                }
 
-                if (g_str_equal(capability[0], "audio/x-wav"))
-                    cache.add(String("audio/wav"));
+                if (g_str_equal(name, "audio/x-vorbis")) {
+                    cache.add(String("audio/ogg"));
+                    cached = true;
+                }
 
-                if (g_str_equal(capability[0], "audio/mpeg")) {
-                    // This is what we are handling: mpegversion=(int)1, layer=(int)[ 1, 3 ]
-                    gchar** versionAndLayer = g_strsplit(capability[1], ",", 2);
+                if (g_str_equal(name, "audio/x-wav")) {
+                    cache.add(String("audio/wav"));
+                    cached = true;
+                }
 
-                    if (g_str_has_suffix (versionAndLayer[0], "(int)1")) {
-                        for (int i = 0; versionAndLayer[1][i] != '\0'; i++) {
-                            if (versionAndLayer[1][i] == '1')
+                if (g_str_equal(name, "audio/mpeg")) {
+                    cache.add(String(name));
+                    cached = true;
+
+                    // This is what we are handling:
+                    // mpegversion=(int)1, layer=(int)[ 1, 3 ]
+                    gint mpegVersion = 0;
+                    if (gst_structure_get_int(structure, "mpegversion", &mpegVersion) && (mpegVersion == 1)) {
+                        const GValue* layer = gst_structure_get_value(structure, "layer");
+                        if (G_VALUE_TYPE(layer) == GST_TYPE_INT_RANGE) {
+                            gint minLayer = gst_value_get_int_range_min(layer);
+                            gint maxLayer = gst_value_get_int_range_max(layer);
+                            if (minLayer <= 1 <= maxLayer)
                                 cache.add(String("audio/mp1"));
-                            else if (versionAndLayer[1][i] == '2')
+                            if (minLayer <= 2 <= maxLayer)
                                 cache.add(String("audio/mp2"));
-                            else if (versionAndLayer[1][i] == '3')
+                            if (minLayer <= 3 <= maxLayer)
                                 cache.add(String("audio/mp3"));
                         }
                     }
+                }
 
-                    g_strfreev(versionAndLayer);
+                if (!cached) {
+                    // GStreamer plugins can be capable of supporting
+                    // types which WebKit supports by default. In that
+                    // case, we should not consider these types
+                    // supportable by GStreamer.  Examples of what
+                    // GStreamer can support but should not be added:
+                    // text/plain, text/html, image/jpeg,
+                    // application/xml
+                    gchar** mimetype = g_strsplit(name, "/", 2);
+                    if (g_str_equal(mimetype[0], "audio")
+                        || g_str_equal(mimetype[0], "video")
+                        || (g_str_equal(mimetype[0], "application")
+                            && handledApplicationSubtypes.contains(String(mimetype[1]))))
+                        cache.add(String(name));
+
+                    g_strfreev(mimetype);
                 }
             }
-
-            g_strfreev(capability);
-            g_strfreev(mimetype);
         }
 
         gst_plugin_feature_list_free(factories);
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
index 54da420..6ab8edb 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
@@ -29,6 +29,7 @@
 
 #include <cairo.h>
 #include <glib.h>
+#include <gst/gst.h>
 
 typedef struct _WebKitVideoSink WebKitVideoSink;
 typedef struct _GstBuffer GstBuffer;
@@ -89,7 +90,6 @@ namespace WebCore {
             void setSize(const IntSize&);
 
             void loadStateChanged();
-            void rateChanged();
             void sizeChanged();
             void timeChanged();
             void volumeChanged();
@@ -109,7 +109,7 @@ namespace WebCore {
 
             static void getSupportedTypes(HashSet<String>&);
             static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
-            static bool isAvailable() { return true; }
+            static bool isAvailable();
 
             void updateStates();
             void cancelSeek();
@@ -124,6 +124,8 @@ namespace WebCore {
             GstElement* m_playBin;
             GstElement* m_videoSink;
             GstElement* m_source;
+            GstClockTime m_seekTime;
+            bool m_changingRate;
             float m_endTime;
             bool m_isEndReached;
             MediaPlayer::NetworkState m_networkState;
diff --git a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
index 9a616f4..df25393 100644
--- a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
+++ b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
@@ -39,8 +39,6 @@
 #include "FontDescription.h"
 #include "GlyphBuffer.h"
 #include <cairo.h>
-#include <unicode/uchar.h>
-#include <unicode/unorm.h>
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
diff --git a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
index b5e1a8b..5e0f8e2 100644
--- a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
@@ -37,21 +37,15 @@ static GstStaticPadTemplate sinktemplate = GST_STATIC_PAD_TEMPLATE("sink",
                                                                    GST_PAD_SINK, GST_PAD_ALWAYS,
 // CAIRO_FORMAT_RGB24 used to render the video buffers is little/big endian dependant.
 #if G_BYTE_ORDER == G_LITTLE_ENDIAN
-                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_BGRx)
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_BGRx ";" GST_VIDEO_CAPS_BGRA)
 #else
-                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_xRGB)
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_xRGB ";" GST_VIDEO_CAPS_ARGB)
 #endif
 );
 
 GST_DEBUG_CATEGORY_STATIC(webkit_video_sink_debug);
 #define GST_CAT_DEFAULT webkit_video_sink_debug
 
-static GstElementDetails webkit_video_sink_details =
-    GST_ELEMENT_DETAILS((gchar*) "WebKit video sink",
-                        (gchar*) "Sink/Video",
-                        (gchar*) "Sends video data from a GStreamer pipeline to a Cairo surface",
-                        (gchar*) "Alp Toker <alp@atoker.com>");
-
 enum {
     REPAINT_REQUESTED,
     LAST_SIGNAL
@@ -98,7 +92,9 @@ webkit_video_sink_base_init(gpointer g_class)
     GstElementClass* element_class = GST_ELEMENT_CLASS(g_class);
 
     gst_element_class_add_pad_template(element_class, gst_static_pad_template_get(&sinktemplate));
-    gst_element_class_set_details(element_class, &webkit_video_sink_details);
+    gst_element_class_set_details_simple(element_class, "WebKit video sink",
+            "Sink/Video", "Sends video data from a GStreamer pipeline to a Cairo surface",
+            "Alp Toker <alp@atoker.com>");
 }
 
 static void
@@ -129,11 +125,6 @@ webkit_video_sink_timeout_func(gpointer data)
         return FALSE;
     }
 
-    if (G_UNLIKELY(!GST_BUFFER_CAPS(buffer))) {
-        buffer = gst_buffer_make_metadata_writable(buffer);
-        gst_buffer_set_caps(buffer, GST_PAD_CAPS(GST_BASE_SINK_PAD(sink)));
-    }
-
     g_signal_emit(sink, webkit_video_sink_signals[REPAINT_REQUESTED], 0, buffer);
     gst_buffer_unref(buffer);
     g_cond_signal(priv->data_cond);
@@ -157,6 +148,71 @@ webkit_video_sink_render(GstBaseSink* bsink, GstBuffer* buffer)
 
     priv->buffer = gst_buffer_ref(buffer);
 
+    // For the unlikely case where the buffer has no caps, the caps
+    // are implicitely the caps of the pad. This shouldn't happen.
+    if (G_UNLIKELY(!GST_BUFFER_CAPS(buffer))) {
+        buffer = priv->buffer = gst_buffer_make_metadata_writable(priv->buffer);
+        gst_buffer_set_caps(priv->buffer, GST_PAD_CAPS(GST_BASE_SINK_PAD(bsink)));
+    }
+
+    GstCaps *caps = GST_BUFFER_CAPS(buffer);
+    GstVideoFormat format;
+    int width, height;
+    if (G_UNLIKELY(!gst_video_format_parse_caps(caps, &format, &width, &height))) {
+        gst_buffer_unref(buffer);
+        g_mutex_unlock(priv->buffer_mutex);
+        return GST_FLOW_ERROR;
+    }
+
+    // Cairo's ARGB has pre-multiplied alpha while GStreamer's doesn't.
+    // Here we convert to Cairo's ARGB.
+    if (format == GST_VIDEO_FORMAT_ARGB || format == GST_VIDEO_FORMAT_BGRA) {
+        // Because GstBaseSink::render() only owns the buffer reference in the
+        // method scope we can't use gst_buffer_make_writable() here. Also
+        // The buffer content should not be changed here because the same buffer
+        // could be passed multiple times to this method (in theory)
+        GstBuffer *newBuffer = gst_buffer_try_new_and_alloc(GST_BUFFER_SIZE(buffer));
+
+        // Check if allocation failed
+        if (G_UNLIKELY(!newBuffer)) {
+            gst_buffer_unref(buffer);
+            g_mutex_unlock(priv->buffer_mutex);
+            return GST_FLOW_ERROR;
+        }
+
+        gst_buffer_copy_metadata(newBuffer, buffer, (GstBufferCopyFlags) GST_BUFFER_COPY_ALL);
+
+        // We don't use Color::premultipliedARGBFromColor() here because
+        // one function call per video pixel is just too expensive:
+        // For 720p/PAL for example this means 1280*720*25=23040000
+        // function calls per second!
+        unsigned short alpha;
+        const guint8 *source = GST_BUFFER_DATA(buffer);
+        guint8 *destination = GST_BUFFER_DATA(newBuffer);
+
+        for (int x = 0; x < height; x++) {
+            for (int y = 0; y < width; y++) {
+#if G_BYTE_ORDER == G_LITTLE_ENDIAN
+                alpha = source[3];
+                destination[0] = (source[0] * alpha + 128) / 255;
+                destination[1] = (source[1] * alpha + 128) / 255;
+                destination[2] = (source[2] * alpha + 128) / 255;
+                destination[3] = alpha;
+#else
+                alpha = source[0];
+                destination[0] = alpha;
+                destination[1] = (source[1] * alpha + 128) / 255;
+                destination[2] = (source[2] * alpha + 128) / 255;
+                destination[3] = (source[3] * alpha + 128) / 255;
+#endif
+                source += 4;
+                destination += 4;
+            }
+        }
+        gst_buffer_unref(buffer);
+        buffer = priv->buffer = newBuffer;
+    }
+
     // Use HIGH_IDLE+20 priority, like Gtk+ for redrawing operations.
     priv->timeout_id = g_timeout_add_full(G_PRIORITY_HIGH_IDLE + 20, 0,
                                           webkit_video_sink_timeout_func,
diff --git a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
index c23b8a9..4728d56 100644
--- a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
@@ -152,7 +152,7 @@ void GraphicsContext::drawConvexPolygon(size_t pointsLength, const FloatPoint* p
         m_data->m_view->StrokePolygon(bPoints, pointsLength, true, getHaikuStrokeStyle());
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -169,7 +169,7 @@ void GraphicsContext::fillRect(const FloatRect& rect)
         return;
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled() || !color.alpha())
         return;
@@ -477,7 +477,7 @@ void GraphicsContext::setPlatformFont(const Font& font)
     m_data->m_view->SetFont(font.primaryFont()->platformData().font());
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& color)
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -519,7 +519,7 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
     m_data->m_view->SetPenSize(thickness);
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -532,7 +532,7 @@ void GraphicsContext::clearPlatformShadow()
     notImplemented();
 }
 
-void GraphicsContext::setPlatformShadow(IntSize const&, int, Color const&)
+void GraphicsContext::setPlatformShadow(IntSize const&, int, Color const&, ColorSpace)
 {
     notImplemented();
 }
diff --git a/WebCore/platform/graphics/haiku/IconHaiku.cpp b/WebCore/platform/graphics/haiku/IconHaiku.cpp
index dccac4a..3663ee2 100644
--- a/WebCore/platform/graphics/haiku/IconHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/IconHaiku.cpp
@@ -36,12 +36,6 @@ Icon::~Icon()
     notImplemented();
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
-{
-    notImplemented();
-    return 0;
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
     notImplemented();
diff --git a/WebCore/platform/graphics/haiku/ImageHaiku.cpp b/WebCore/platform/graphics/haiku/ImageHaiku.cpp
index 323d6ab..df08822 100644
--- a/WebCore/platform/graphics/haiku/ImageHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/ImageHaiku.cpp
@@ -83,7 +83,7 @@ void BitmapImage::invalidatePlatformData()
 }
 
 // Drawing Routines
-void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, CompositeOperator op)
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
     startAnimation();
 
@@ -92,7 +92,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatR
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dst, solidColor(), op);
+        fillWithSolidColor(ctxt, dst, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -109,7 +109,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatR
     ctxt->restore();
 }
 
-void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, const TransformationMatrix& patternTransform, const FloatPoint& srcPoint, CompositeOperator op, const FloatRect& dstRect)
+void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, const TransformationMatrix& patternTransform, const FloatPoint& srcPoint, ColorSpace, CompositeOperator op, const FloatRect& dstRect)
 {
     // FIXME: finish this to support also phased position (srcPoint)
     startAnimation();
diff --git a/WebCore/platform/graphics/mac/CoreTextController.cpp b/WebCore/platform/graphics/mac/ComplexTextController.cpp
index b2682e4..265b2c3 100644
--- a/WebCore/platform/graphics/mac/CoreTextController.cpp
+++ b/WebCore/platform/graphics/mac/ComplexTextController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,30 +10,24 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
-#include "CoreTextController.h"
-
-#if USE(CORE_TEXT)
+#include "ComplexTextController.h"
 
 #include "CharacterNames.h"
 #include "Font.h"
-#include "FontCache.h"
-#include "SimpleFontData.h"
 #include "TextBreakIterator.h"
-#include <wtf/MathExtras.h>
 
 using namespace std;
 
@@ -53,54 +47,7 @@ static inline CGFloat ceilCGFloat(CGFloat f)
     return static_cast<CGFloat>(ceil(f));
 }
 
-CoreTextController::CoreTextRun::CoreTextRun(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength)
-    : m_CTRun(ctRun)
-    , m_fontData(fontData)
-    , m_characters(characters)
-    , m_stringLocation(stringLocation)
-    , m_stringLength(stringLength)
-{
-    m_glyphCount = CTRunGetGlyphCount(ctRun);
-    m_indices = CTRunGetStringIndicesPtr(ctRun);
-    if (!m_indices) {
-        m_indicesData.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, m_glyphCount * sizeof(CFIndex)));
-        CFDataIncreaseLength(m_indicesData.get(), m_glyphCount * sizeof(CFIndex));
-        m_indices = reinterpret_cast<const CFIndex*>(CFDataGetMutableBytePtr(m_indicesData.get()));
-        CTRunGetStringIndices(ctRun, CFRangeMake(0, 0), const_cast<CFIndex*>(m_indices));
-    }
-}
-
-// Missing glyphs run constructor. Core Text will not generate a run of missing glyphs, instead falling back on
-// glyphs from LastResort. We want to use the primary font's missing glyph in order to match the fast text code path.
-CoreTextController::CoreTextRun::CoreTextRun(const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr)
-    : m_fontData(fontData)
-    , m_characters(characters)
-    , m_stringLocation(stringLocation)
-    , m_stringLength(stringLength)
-{
-    Vector<CFIndex, 16> indices;
-    unsigned r = 0;
-    while (r < stringLength) {
-        indices.append(r);
-        if (U_IS_SURROGATE(characters[r])) {
-            ASSERT(r + 1 < stringLength);
-            ASSERT(U_IS_SURROGATE_LEAD(characters[r]));
-            ASSERT(U_IS_TRAIL(characters[r + 1]));
-            r += 2;
-        } else
-            r++;
-    }
-    m_glyphCount = indices.size();
-    if (!ltr) {
-        for (unsigned r = 0, end = m_glyphCount - 1; r < m_glyphCount / 2; ++r, --end)
-            std::swap(indices[r], indices[end]);
-    }
-    m_indicesData.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, m_glyphCount * sizeof(CFIndex)));
-    CFDataAppendBytes(m_indicesData.get(), reinterpret_cast<const UInt8*>(indices.data()), m_glyphCount * sizeof(CFIndex));
-    m_indices = reinterpret_cast<const CFIndex*>(CFDataGetBytePtr(m_indicesData.get()));
-}
-
-CoreTextController::CoreTextController(const Font* font, const TextRun& run, bool mayUseNaturalWritingDirection, HashSet<const SimpleFontData*>* fallbackFonts)
+ComplexTextController::ComplexTextController(const Font* font, const TextRun& run, bool mayUseNaturalWritingDirection, HashSet<const SimpleFontData*>* fallbackFonts)
     : m_font(*font)
     , m_run(run)
     , m_mayUseNaturalWritingDirection(mayUseNaturalWritingDirection)
@@ -111,6 +58,7 @@ CoreTextController::CoreTextController(const Font* font, const TextRun& run, boo
     , m_numGlyphsSoFar(0)
     , m_currentRun(0)
     , m_glyphInCurrentRun(0)
+    , m_characterInCurrentGlyph(0)
     , m_finalRoundingWidth(0)
     , m_fallbackFonts(fallbackFonts)
     , m_lastRoundingGlyph(0)
@@ -130,16 +78,12 @@ CoreTextController::CoreTextController(const Font* font, const TextRun& run, boo
             m_padPerSpace = ceilf(m_run.padding() / numSpaces);
     }
 
-    collectCoreTextRuns();
+    collectComplexTextRuns();
     adjustGlyphsAndAdvances();
 }
 
-int CoreTextController::offsetForPosition(int h, bool includePartialGlyphs)
+int ComplexTextController::offsetForPosition(int h, bool includePartialGlyphs)
 {
-    // FIXME: For positions occurring within a ligature, we should return the closest "ligature caret" or
-    // approximate it by dividing the width of the ligature by the number of characters it encompasses.
-    // However, Core Text does not expose a low-level API for directly finding
-    // out how many characters a ligature encompasses (the "attachment count").
     if (h >= m_totalWidth)
         return m_run.ltr() ? m_end : 0;
     if (h < 0)
@@ -147,17 +91,27 @@ int CoreTextController::offsetForPosition(int h, bool includePartialGlyphs)
 
     CGFloat x = h;
 
-    size_t runCount = m_coreTextRuns.size();
+    size_t runCount = m_complexTextRuns.size();
     size_t offsetIntoAdjustedGlyphs = 0;
 
     for (size_t r = 0; r < runCount; ++r) {
-        const CoreTextRun& coreTextRun = m_coreTextRuns[r];
-        for (unsigned j = 0; j < coreTextRun.glyphCount(); ++j) {
+        const ComplexTextRun& complexTextRun = *m_complexTextRuns[r];
+        for (unsigned j = 0; j < complexTextRun.glyphCount(); ++j) {
             CGFloat adjustedAdvance = m_adjustedAdvances[offsetIntoAdjustedGlyphs + j].width;
-            if (x <= adjustedAdvance) {
-                CFIndex hitIndex = coreTextRun.indexAt(j);
-                int stringLength = coreTextRun.stringLength();
-                TextBreakIterator* cursorPositionIterator = cursorMovementIterator(coreTextRun.characters(), stringLength);
+            if (x < adjustedAdvance) {
+                CFIndex hitGlyphStart = complexTextRun.indexAt(j);
+                CFIndex hitGlyphEnd;
+                if (m_run.ltr())
+                    hitGlyphEnd = max<CFIndex>(hitGlyphStart, j + 1 < complexTextRun.glyphCount() ? complexTextRun.indexAt(j + 1) : complexTextRun.stringLength());
+                else
+                    hitGlyphEnd = max<CFIndex>(hitGlyphStart, j > 0 ? complexTextRun.indexAt(j - 1) : complexTextRun.stringLength());
+
+                // FIXME: Instead of dividing the glyph's advance equially between the characters, this
+                // could use the glyph's "ligature carets". However, there is no Core Text API to get the
+                // ligature carets.
+                CFIndex hitIndex = hitGlyphStart + (hitGlyphEnd - hitGlyphStart) * (m_run.ltr() ? x / adjustedAdvance : 1 - x / adjustedAdvance);
+                int stringLength = complexTextRun.stringLength();
+                TextBreakIterator* cursorPositionIterator = cursorMovementIterator(complexTextRun.characters(), stringLength);
                 int clusterStart;
                 if (isTextBreak(cursorPositionIterator, hitIndex))
                     clusterStart = hitIndex;
@@ -168,45 +122,49 @@ int CoreTextController::offsetForPosition(int h, bool includePartialGlyphs)
                 }
 
                 if (!includePartialGlyphs)
-                    return coreTextRun.stringLocation() + clusterStart;
+                    return complexTextRun.stringLocation() + clusterStart;
 
                 int clusterEnd = textBreakFollowing(cursorPositionIterator, hitIndex);
                 if (clusterEnd == TextBreakDone)
                     clusterEnd = stringLength;
 
-                CGFloat clusterWidth = adjustedAdvance;
-                // FIXME: The search stops at the boundaries of coreTextRun. In theory, it should go on into neighboring CoreTextRuns
+                CGFloat clusterWidth;
+                // FIXME: The search stops at the boundaries of complexTextRun. In theory, it should go on into neighboring ComplexTextRuns
                 // derived from the same CTLine. In practice, we do not expect there to be more than one CTRun in a CTLine, as no
                 // reordering and on font fallback should occur within a CTLine.
                 if (clusterEnd - clusterStart > 1) {
+                    clusterWidth = adjustedAdvance;
                     int firstGlyphBeforeCluster = j - 1;
-                    while (firstGlyphBeforeCluster >= 0 && coreTextRun.indexAt(firstGlyphBeforeCluster) >= clusterStart && coreTextRun.indexAt(firstGlyphBeforeCluster) < clusterEnd) {
+                    while (firstGlyphBeforeCluster >= 0 && complexTextRun.indexAt(firstGlyphBeforeCluster) >= clusterStart && complexTextRun.indexAt(firstGlyphBeforeCluster) < clusterEnd) {
                         CGFloat width = m_adjustedAdvances[offsetIntoAdjustedGlyphs + firstGlyphBeforeCluster].width;
                         clusterWidth += width;
                         x += width;
                         firstGlyphBeforeCluster--;
                     }
                     unsigned firstGlyphAfterCluster = j + 1;
-                    while (firstGlyphAfterCluster < coreTextRun.glyphCount() && coreTextRun.indexAt(firstGlyphAfterCluster) >= clusterStart && coreTextRun.indexAt(firstGlyphAfterCluster) < clusterEnd) {
+                    while (firstGlyphAfterCluster < complexTextRun.glyphCount() && complexTextRun.indexAt(firstGlyphAfterCluster) >= clusterStart && complexTextRun.indexAt(firstGlyphAfterCluster) < clusterEnd) {
                         clusterWidth += m_adjustedAdvances[offsetIntoAdjustedGlyphs + firstGlyphAfterCluster].width;
                         firstGlyphAfterCluster++;
                     }
+                } else {
+                    clusterWidth = adjustedAdvance / (hitGlyphEnd - hitGlyphStart);
+                    x -=  clusterWidth * (m_run.ltr() ? hitIndex - hitGlyphStart : hitGlyphEnd - hitIndex - 1);
                 }
                 if (x <= clusterWidth / 2)
-                    return coreTextRun.stringLocation() + (m_run.ltr() ? clusterStart : clusterEnd);
+                    return complexTextRun.stringLocation() + (m_run.ltr() ? clusterStart : clusterEnd);
                 else
-                    return coreTextRun.stringLocation() + (m_run.ltr() ? clusterEnd : clusterStart);
+                    return complexTextRun.stringLocation() + (m_run.ltr() ? clusterEnd : clusterStart);
             }
             x -= adjustedAdvance;
         }
-        offsetIntoAdjustedGlyphs += coreTextRun.glyphCount();
+        offsetIntoAdjustedGlyphs += complexTextRun.glyphCount();
     }
 
     ASSERT_NOT_REACHED();
     return 0;
 }
 
-void CoreTextController::collectCoreTextRuns()
+void ComplexTextController::collectComplexTextRuns()
 {
     if (!m_end)
         return;
@@ -227,7 +185,7 @@ void CoreTextController::collectCoreTextRuns()
     static const UChar hyphen = '-';
 
     if (hasTrailingSoftHyphen && m_run.rtl()) {
-        collectCoreTextRunsForCharacters(&hyphen, 1, m_end - 1, m_font.glyphDataForCharacter(hyphen, false).fontData);
+        collectComplexTextRunsForCharacters(&hyphen, 1, m_end - 1, m_font.glyphDataForCharacter(hyphen, false).fontData);
         indexOfFontTransition--;
         curr--;
     }
@@ -290,7 +248,7 @@ void CoreTextController::collectCoreTextRuns()
         if (nextGlyphData.fontData != glyphData.fontData || nextIsSmallCaps != isSmallCaps || !nextGlyphData.glyph != !glyphData.glyph) {
             int itemStart = m_run.rtl() ? index + 1 : indexOfFontTransition;
             int itemLength = m_run.rtl() ? indexOfFontTransition - index : index - indexOfFontTransition;
-            collectCoreTextRunsForCharacters((isSmallCaps ? m_smallCapsBuffer.data() : cp) + itemStart, itemLength, itemStart, glyphData.glyph ? glyphData.fontData : 0);
+            collectComplexTextRunsForCharacters((isSmallCaps ? m_smallCapsBuffer.data() : cp) + itemStart, itemLength, itemStart, glyphData.glyph ? glyphData.fontData : 0);
             indexOfFontTransition = index;
         }
     }
@@ -298,19 +256,15 @@ void CoreTextController::collectCoreTextRuns()
     int itemLength = m_run.rtl() ? indexOfFontTransition + 1 : m_end - indexOfFontTransition - (hasTrailingSoftHyphen ? 1 : 0);
     if (itemLength) {
         int itemStart = m_run.rtl() ? 0 : indexOfFontTransition;
-        collectCoreTextRunsForCharacters((nextIsSmallCaps ? m_smallCapsBuffer.data() : cp) + itemStart, itemLength, itemStart, nextGlyphData.glyph ? nextGlyphData.fontData : 0);
+        collectComplexTextRunsForCharacters((nextIsSmallCaps ? m_smallCapsBuffer.data() : cp) + itemStart, itemLength, itemStart, nextGlyphData.glyph ? nextGlyphData.fontData : 0);
     }
 
     if (hasTrailingSoftHyphen && m_run.ltr())
-        collectCoreTextRunsForCharacters(&hyphen, 1, m_end - 1, m_font.glyphDataForCharacter(hyphen, false).fontData);
+        collectComplexTextRunsForCharacters(&hyphen, 1, m_end - 1, m_font.glyphDataForCharacter(hyphen, false).fontData);
 }
 
-void CoreTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
+void ComplexTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
 {
-    // FIXME: For offsets falling inside a ligature, we should advance only as far as the appropriate "ligature caret"
-    // or divide the width of the ligature by the number of offsets it encompasses and make an advance proportional
-    // to the offsets into the ligature. However, Core Text does not expose a low-level API for
-    // directly finding out how many characters a ligature encompasses (the "attachment count").
     if (static_cast<int>(offset) > m_end)
         offset = m_end;
 
@@ -319,24 +273,44 @@ void CoreTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
 
     m_currentCharacter = offset;
 
-    size_t runCount = m_coreTextRuns.size();
+    size_t runCount = m_complexTextRuns.size();
 
     bool ltr = m_run.ltr();
 
     unsigned k = ltr ? m_numGlyphsSoFar : m_adjustedGlyphs.size() - 1 - m_numGlyphsSoFar;
     while (m_currentRun < runCount) {
-        const CoreTextRun& coreTextRun = m_coreTextRuns[ltr ? m_currentRun : runCount - 1 - m_currentRun];
-        size_t glyphCount = coreTextRun.glyphCount();
+        const ComplexTextRun& complexTextRun = *m_complexTextRuns[ltr ? m_currentRun : runCount - 1 - m_currentRun];
+        size_t glyphCount = complexTextRun.glyphCount();
         unsigned g = ltr ? m_glyphInCurrentRun : glyphCount - 1 - m_glyphInCurrentRun;
         while (m_glyphInCurrentRun < glyphCount) {
-            if (coreTextRun.indexAt(g) + coreTextRun.stringLocation() >= m_currentCharacter)
-                return;
+            unsigned glyphStartOffset = complexTextRun.indexAt(g);
+            unsigned glyphEndOffset;
+            if (ltr)
+                glyphEndOffset = max<unsigned>(glyphStartOffset, g + 1 < glyphCount ? complexTextRun.indexAt(g + 1) : complexTextRun.stringLength());
+            else
+                glyphEndOffset = max<unsigned>(glyphStartOffset, g > 0 ? complexTextRun.indexAt(g - 1) : complexTextRun.stringLength());
+
             CGSize adjustedAdvance = m_adjustedAdvances[k];
-            if (glyphBuffer)
-                glyphBuffer->add(m_adjustedGlyphs[k], coreTextRun.fontData(), adjustedAdvance);
-            m_runWidthSoFar += adjustedAdvance.width;
+
+            if (glyphStartOffset + complexTextRun.stringLocation() >= m_currentCharacter)
+                return;
+
+            if (glyphBuffer && !m_characterInCurrentGlyph)
+                glyphBuffer->add(m_adjustedGlyphs[k], complexTextRun.fontData(), adjustedAdvance);
+
+            unsigned oldCharacterInCurrentGlyph = m_characterInCurrentGlyph;
+            m_characterInCurrentGlyph = min(m_currentCharacter - complexTextRun.stringLocation(), glyphEndOffset) - glyphStartOffset;
+            // FIXME: Instead of dividing the glyph's advance equially between the characters, this
+            // could use the glyph's "ligature carets". However, there is no Core Text API to get the
+            // ligature carets.
+            m_runWidthSoFar += adjustedAdvance.width * (m_characterInCurrentGlyph - oldCharacterInCurrentGlyph) / (glyphEndOffset - glyphStartOffset);
+
+            if (glyphEndOffset + complexTextRun.stringLocation() > m_currentCharacter)
+                return;
+
             m_numGlyphsSoFar++;
             m_glyphInCurrentRun++;
+            m_characterInCurrentGlyph = 0;
             if (ltr) {
                 g++;
                 k++;
@@ -352,100 +326,35 @@ void CoreTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
         m_runWidthSoFar += m_finalRoundingWidth;
 }
 
-void CoreTextController::collectCoreTextRunsForCharacters(const UChar* cp, unsigned length, unsigned stringLocation, const SimpleFontData* fontData)
-{
-    if (!fontData) {
-        // Create a run of missing glyphs from the primary font.
-        m_coreTextRuns.append(CoreTextRun(m_font.primaryFont(), cp, stringLocation, length, m_run.ltr()));
-        return;
-    }
-
-    if (m_fallbackFonts && fontData != m_font.primaryFont())
-        m_fallbackFonts->add(fontData);
-
-    RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(NULL, cp, length, kCFAllocatorNull));
-
-    RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(NULL, string.get(), fontData->getCFStringAttributes(m_font.fontDescription().textRenderingMode())));
-
-    RetainPtr<CTTypesetterRef> typesetter;
-
-    if (!m_mayUseNaturalWritingDirection || m_run.directionalOverride()) {
-        static const void* optionKeys[] = { kCTTypesetterOptionForcedEmbeddingLevel };
-        static const void* ltrOptionValues[] = { kCFBooleanFalse };
-        static const void* rtlOptionValues[] = { kCFBooleanTrue };
-        static CFDictionaryRef ltrTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, ltrOptionValues, sizeof(optionKeys) / sizeof(*optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
-        static CFDictionaryRef rtlTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, rtlOptionValues, sizeof(optionKeys) / sizeof(*optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
-        typesetter.adoptCF(CTTypesetterCreateWithAttributedStringAndOptions(attributedString.get(), m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
-    } else
-        typesetter.adoptCF(CTTypesetterCreateWithAttributedString(attributedString.get()));
-
-    RetainPtr<CTLineRef> line(AdoptCF, CTTypesetterCreateLine(typesetter.get(), CFRangeMake(0, 0)));
-
-    CFArrayRef runArray = CTLineGetGlyphRuns(line.get());
-
-    CFIndex runCount = CFArrayGetCount(runArray);
-
-    for (CFIndex r = 0; r < runCount; r++) {
-        CTRunRef ctRun = static_cast<CTRunRef>(CFArrayGetValueAtIndex(runArray, r));
-        ASSERT(CFGetTypeID(ctRun) == CTRunGetTypeID());
-        m_coreTextRuns.append(CoreTextRun(ctRun, fontData, cp, stringLocation, length));
-    }
-}
-
-void CoreTextController::adjustGlyphsAndAdvances()
+void ComplexTextController::adjustGlyphsAndAdvances()
 {
-    size_t runCount = m_coreTextRuns.size();
+    size_t runCount = m_complexTextRuns.size();
     for (size_t r = 0; r < runCount; ++r) {
-        const CoreTextRun& coreTextRun = m_coreTextRuns[r];
-        unsigned glyphCount = coreTextRun.glyphCount();
-        const SimpleFontData* fontData = coreTextRun.fontData();
-
-        Vector<CGGlyph, 256> glyphsVector;
-        const CGGlyph* glyphs;
-
-        Vector<CGSize, 256> advancesVector;
-        const CGSize* advances;
-
-        if (coreTextRun.ctRun()) {
-            glyphs = CTRunGetGlyphsPtr(coreTextRun.ctRun());
-            if (!glyphs) {
-                glyphsVector.grow(glyphCount);
-                CTRunGetGlyphs(coreTextRun.ctRun(), CFRangeMake(0, 0), glyphsVector.data());
-                glyphs = glyphsVector.data();
-            }
+        const ComplexTextRun& complexTextRun = *m_complexTextRuns[r];
+        unsigned glyphCount = complexTextRun.glyphCount();
+        const SimpleFontData* fontData = complexTextRun.fontData();
 
-            advances = CTRunGetAdvancesPtr(coreTextRun.ctRun());
-            if (!advances) {
-                advancesVector.grow(glyphCount);
-                CTRunGetAdvances(coreTextRun.ctRun(), CFRangeMake(0, 0), advancesVector.data());
-                advances = advancesVector.data();
-            }
-        } else {
-            // Synthesize a run of missing glyphs.
-            glyphsVector.fill(0, glyphCount);
-            glyphs = glyphsVector.data();
-            advancesVector.fill(CGSizeMake(fontData->widthForGlyph(0), 0), glyphCount);
-            advances = advancesVector.data();
-        }
+        const CGGlyph* glyphs = complexTextRun.glyphs();
+        const CGSize* advances = complexTextRun.advances();
 
         bool lastRun = r + 1 == runCount;
-        const UChar* cp = coreTextRun.characters();
+        const UChar* cp = complexTextRun.characters();
         CGFloat roundedSpaceWidth = roundCGFloat(fontData->spaceWidth());
         bool roundsAdvances = !m_font.isPrinterFont() && fontData->platformData().roundsGlyphAdvances();
         bool hasExtraSpacing = (m_font.letterSpacing() || m_font.wordSpacing() || m_padding) && !m_run.spacingDisabled();
 
 
         for (unsigned i = 0; i < glyphCount; i++) {
-            CFIndex characterIndex = coreTextRun.indexAt(i);
+            CFIndex characterIndex = complexTextRun.indexAt(i);
             UChar ch = *(cp + characterIndex);
             bool lastGlyph = lastRun && i + 1 == glyphCount;
             UChar nextCh;
             if (lastGlyph)
                 nextCh = ' ';
             else if (i + 1 < glyphCount)
-                nextCh = *(cp + coreTextRun.indexAt(i + 1));
+                nextCh = *(cp + complexTextRun.indexAt(i + 1));
             else
-                nextCh = *(m_coreTextRuns[r + 1].characters() + m_coreTextRuns[r + 1].indexAt(0));
+                nextCh = *(m_complexTextRuns[r + 1]->characters() + m_complexTextRuns[r + 1]->indexAt(0));
 
             bool treatAsSpace = Font::treatAsSpace(ch);
             CGGlyph glyph = treatAsSpace ? fontData->spaceGlyph() : glyphs[i];
@@ -533,5 +442,3 @@ void CoreTextController::adjustGlyphsAndAdvances()
 }
 
 } // namespace WebCore
-
-#endif // USE(CORE_TEXT)
diff --git a/WebCore/platform/graphics/mac/ComplexTextController.h b/WebCore/platform/graphics/mac/ComplexTextController.h
new file mode 100644
index 0000000..7a915e2
--- /dev/null
+++ b/WebCore/platform/graphics/mac/ComplexTextController.h
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ComplexTextController_h
+#define ComplexTextController_h
+
+#include "GlyphBuffer.h"
+#include <wtf/HashSet.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
+
+namespace WebCore {
+
+class Font;
+class SimpleFontData;
+class TextRun;
+
+class ComplexTextController {
+public:
+    ComplexTextController(const Font*, const TextRun&, bool mayUseNaturalWritingDirection = false, HashSet<const SimpleFontData*>* fallbackFonts = 0);
+
+    // Advance and emit glyphs up to the specified character.
+    void advance(unsigned to, GlyphBuffer* = 0);
+
+    // Compute the character offset for a given x coordinate.
+    int offsetForPosition(int x, bool includePartialGlyphs);
+
+    // Returns the width of everything we've consumed so far.
+    float runWidthSoFar() const { return m_runWidthSoFar; }
+
+    float totalWidth() const { return m_totalWidth; }
+
+    // Extra width to the left of the leftmost glyph.
+    float finalRoundingWidth() const { return m_finalRoundingWidth; }
+
+private:
+    class ComplexTextRun : public RefCounted<ComplexTextRun> {
+    public:
+#if USE(CORE_TEXT)
+        static PassRefPtr<ComplexTextRun> create(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength)
+        {
+            return adoptRef(new ComplexTextRun(ctRun, fontData, characters, stringLocation, stringLength));
+        }
+#elif USE(ATSUI)
+        static PassRefPtr<ComplexTextRun> create(ATSUTextLayout atsuTextLayout, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr, bool directionalOverride)
+        {
+            return adoptRef(new ComplexTextRun(atsuTextLayout, fontData, characters, stringLocation, stringLength, ltr, directionalOverride));
+        }
+#endif
+        static PassRefPtr<ComplexTextRun> create(const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr)
+        {
+            return adoptRef(new ComplexTextRun(fontData, characters, stringLocation, stringLength, ltr));
+        }
+
+        unsigned glyphCount() const { return m_glyphCount; }
+        const SimpleFontData* fontData() const { return m_fontData; }
+        const UChar* characters() const { return m_characters; }
+        unsigned stringLocation() const { return m_stringLocation; }
+        size_t stringLength() const { return m_stringLength; }
+        CFIndex indexAt(size_t i) const { return m_indices[i]; }
+        const CGGlyph* glyphs() const { return m_glyphs; }
+        const CGSize* advances() const { return m_advances; }
+
+    private:
+#if USE(CORE_TEXT)
+        ComplexTextRun(CTRunRef, const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength);
+#elif USE(ATSUI)
+        ComplexTextRun(ATSUTextLayout, const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr, bool directionalOverride);
+#endif
+        ComplexTextRun(const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr);
+
+#if USE(ATSUI)
+#ifdef BUILDING_ON_TIGER
+        typedef UInt32 URefCon;
+#endif
+        static OSStatus overrideLayoutOperation(ATSULayoutOperationSelector, ATSULineRef, URefCon, void*, ATSULayoutOperationCallbackStatus*);
+#endif
+
+#if USE(CORE_TEXT)
+        RetainPtr<CTRunRef> m_CTRun;
+#endif
+        unsigned m_glyphCount;
+        const SimpleFontData* m_fontData;
+        const UChar* m_characters;
+        unsigned m_stringLocation;
+        size_t m_stringLength;
+#if USE(CORE_TEXT)
+        RetainPtr<CFMutableDataRef> m_indicesData;
+        const CFIndex* m_indices;
+#elif USE(ATSUI)
+        Vector<CFIndex, 64> m_indices;
+#endif
+        Vector<CGGlyph, 64> m_glyphsVector;
+        const CGGlyph* m_glyphs;
+        Vector<CGSize, 64> m_advancesVector;
+        const CGSize* m_advances;
+#if USE(ATSUI)
+        bool m_ltr;
+        bool m_directionalOverride;
+#endif
+    };
+
+    void collectComplexTextRuns();
+    void collectComplexTextRunsForCharacters(const UChar*, unsigned length, unsigned stringLocation, const SimpleFontData*);
+    void adjustGlyphsAndAdvances();
+
+    const Font& m_font;
+    const TextRun& m_run;
+    bool m_mayUseNaturalWritingDirection;
+
+    Vector<UChar, 256> m_smallCapsBuffer;
+
+    Vector<RefPtr<ComplexTextRun>, 16> m_complexTextRuns;
+    Vector<CGSize, 256> m_adjustedAdvances;
+    Vector<CGGlyph, 256> m_adjustedGlyphs;
+ 
+    unsigned m_currentCharacter;
+    int m_end;
+
+    CGFloat m_totalWidth;
+
+    float m_runWidthSoFar;
+    unsigned m_numGlyphsSoFar;
+    size_t m_currentRun;
+    unsigned m_glyphInCurrentRun;
+    unsigned m_characterInCurrentGlyph;
+    float m_finalRoundingWidth;
+    float m_padding;
+    float m_padPerSpace;
+
+    HashSet<const SimpleFontData*>* m_fallbackFonts;
+
+    unsigned m_lastRoundingGlyph;
+};
+
+} // namespace WebCore
+
+#endif // ComplexTextController_h
diff --git a/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp b/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
new file mode 100644
index 0000000..78c588f
--- /dev/null
+++ b/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
@@ -0,0 +1,341 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2000 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "ComplexTextController.h"
+
+#if USE(ATSUI)
+
+#include "CharacterNames.h"
+#include "Font.h"
+#include "ShapeArabic.h"
+
+#ifdef __LP64__
+// ATSUTextInserted() is SPI in 64-bit.
+extern "C" {
+OSStatus ATSUTextInserted(ATSUTextLayout iTextLayout,  UniCharArrayOffset iInsertionLocation, UniCharCount iInsertionLength);
+}
+#endif
+
+using namespace WTF::Unicode;
+
+namespace WebCore {
+
+OSStatus ComplexTextController::ComplexTextRun::overrideLayoutOperation(ATSULayoutOperationSelector, ATSULineRef atsuLineRef, URefCon refCon, void*, ATSULayoutOperationCallbackStatus* callbackStatus)
+{
+    ComplexTextRun* complexTextRun = reinterpret_cast<ComplexTextRun*>(refCon);
+    OSStatus status;
+    ItemCount count;
+    ATSLayoutRecord *layoutRecords;
+
+    status = ATSUDirectGetLayoutDataArrayPtrFromLineRef(atsuLineRef, kATSUDirectDataLayoutRecordATSLayoutRecordCurrent, true, reinterpret_cast<void**>(&layoutRecords), &count);
+    if (status != noErr) {
+        *callbackStatus = kATSULayoutOperationCallbackStatusContinue;
+        return status;
+    }
+
+    count--;
+    ItemCount j = 0;
+    CFIndex indexOffset = 0;
+
+    if (complexTextRun->m_directionalOverride) {
+        j++;
+        count -= 2;
+        indexOffset = -1;
+    }
+
+    complexTextRun->m_glyphCount = count;
+    complexTextRun->m_glyphsVector.reserveCapacity(count);
+    complexTextRun->m_advancesVector.reserveCapacity(count);
+    complexTextRun->m_indices.reserveCapacity(count);
+
+    bool atBeginning = true;
+    CGFloat lastX = 0;
+
+    for (ItemCount i = 0; i < count; ++i, ++j) {
+        if (layoutRecords[j].glyphID == kATSDeletedGlyphcode) {
+            complexTextRun->m_glyphCount--;
+            continue;
+        }
+        complexTextRun->m_glyphsVector.uncheckedAppend(layoutRecords[j].glyphID);
+        complexTextRun->m_indices.uncheckedAppend(layoutRecords[j].originalOffset / 2 + indexOffset);
+        CGFloat x = FixedToFloat(layoutRecords[j].realPos);
+        if (!atBeginning)
+            complexTextRun->m_advancesVector.uncheckedAppend(CGSizeMake(x - lastX, 0));
+        lastX = x;
+        atBeginning = false;
+    }
+
+    complexTextRun->m_advancesVector.uncheckedAppend(CGSizeMake(FixedToFloat(layoutRecords[j].realPos) - lastX, 0));
+
+    complexTextRun->m_glyphs = complexTextRun->m_glyphsVector.data();
+    complexTextRun->m_advances = complexTextRun->m_advancesVector.data();
+
+    status = ATSUDirectReleaseLayoutDataArrayPtr(atsuLineRef, kATSUDirectDataLayoutRecordATSLayoutRecordCurrent, reinterpret_cast<void**>(&layoutRecords));
+    *callbackStatus = kATSULayoutOperationCallbackStatusContinue;
+    return noErr;
+}
+
+static inline bool isArabicLamWithAlefLigature(UChar c)
+{
+    return c >= 0xfef5 && c <= 0xfefc;
+}
+
+static void shapeArabic(const UChar* source, UChar* dest, unsigned totalLength)
+{
+    unsigned shapingStart = 0;
+    while (shapingStart < totalLength) {
+        unsigned shapingEnd;
+        // We do not want to pass a Lam with Alef ligature followed by a space to the shaper,
+        // since we want to be able to identify this sequence as the result of shaping a Lam
+        // followed by an Alef and padding with a space.
+        bool foundLigatureSpace = false;
+        for (shapingEnd = shapingStart; !foundLigatureSpace && shapingEnd < totalLength - 1; ++shapingEnd)
+            foundLigatureSpace = isArabicLamWithAlefLigature(source[shapingEnd]) && source[shapingEnd + 1] == ' ';
+        shapingEnd++;
+
+        UErrorCode shapingError = U_ZERO_ERROR;
+        unsigned charsWritten = shapeArabic(source + shapingStart, shapingEnd - shapingStart, dest + shapingStart, shapingEnd - shapingStart, U_SHAPE_LETTERS_SHAPE | U_SHAPE_LENGTH_FIXED_SPACES_NEAR, &shapingError);
+
+        if (U_SUCCESS(shapingError) && charsWritten == shapingEnd - shapingStart) {
+            for (unsigned j = shapingStart; j < shapingEnd - 1; ++j) {
+                if (isArabicLamWithAlefLigature(dest[j]) && dest[j + 1] == ' ')
+                    dest[++j] = zeroWidthSpace;
+            }
+            if (foundLigatureSpace) {
+                dest[shapingEnd] = ' ';
+                shapingEnd++;
+            } else if (isArabicLamWithAlefLigature(dest[shapingEnd - 1])) {
+                // u_shapeArabic quirk: if the last two characters in the source string are a Lam and an Alef,
+                // the space is put at the beginning of the string, despite U_SHAPE_LENGTH_FIXED_SPACES_NEAR.
+                ASSERT(dest[shapingStart] == ' ');
+                dest[shapingStart] = zeroWidthSpace;
+            }
+        } else {
+            // Something went wrong. Abandon shaping and just copy the rest of the buffer.
+            LOG_ERROR("u_shapeArabic failed(%d)", shapingError);
+            shapingEnd = totalLength;
+            memcpy(dest + shapingStart, source + shapingStart, (shapingEnd - shapingStart) * sizeof(UChar));
+        }
+        shapingStart = shapingEnd;
+    }
+}
+
+ComplexTextController::ComplexTextRun::ComplexTextRun(ATSUTextLayout atsuTextLayout, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr, bool directionalOverride)
+    : m_fontData(fontData)
+    , m_characters(characters)
+    , m_stringLocation(stringLocation)
+    , m_stringLength(stringLength)
+    , m_ltr(ltr)
+    , m_directionalOverride(directionalOverride)
+{
+    OSStatus status;
+
+    status = ATSUSetTextLayoutRefCon(atsuTextLayout, reinterpret_cast<URefCon>(this));
+
+    ATSLineLayoutOptions lineLayoutOptions = kATSLineKeepSpacesOutOfMargin | kATSLineHasNoHangers;
+
+    Boolean rtl = !ltr;
+
+    Vector<UChar, 256> substituteCharacters;
+    bool shouldCheckForMirroring = !ltr && !fontData->m_ATSUMirrors;
+    bool shouldCheckForArabic = !fontData->shapesArabic();
+    bool shouldShapeArabic = false;
+
+    bool mirrored = false;
+    for (size_t i = 0; i < stringLength; ++i) {
+        if (shouldCheckForMirroring) {
+            UChar mirroredChar = u_charMirror(characters[i]);
+            if (mirroredChar != characters[i]) {
+                if (!mirrored) {
+                    mirrored = true;
+                    substituteCharacters.grow(stringLength);
+                    memcpy(substituteCharacters.data(), characters, stringLength * sizeof(UChar));
+                    ATSUTextMoved(atsuTextLayout, substituteCharacters.data());
+                }
+                substituteCharacters[i] = mirroredChar;
+            }
+        }
+        if (shouldCheckForArabic && isArabicChar(characters[i])) {
+            shouldCheckForArabic = false;
+            shouldShapeArabic = true;
+        }
+    }
+
+    if (shouldShapeArabic) {
+        Vector<UChar, 256> shapedArabic(stringLength);
+        shapeArabic(substituteCharacters.isEmpty() ? characters : substituteCharacters.data(), shapedArabic.data(), stringLength);
+        substituteCharacters.swap(shapedArabic);
+        ATSUTextMoved(atsuTextLayout, substituteCharacters.data());
+    }
+
+    if (directionalOverride) {
+        UChar override = ltr ? leftToRightOverride : rightToLeftOverride;
+        if (substituteCharacters.isEmpty()) {
+            substituteCharacters.grow(stringLength + 2);
+            substituteCharacters[0] = override;
+            memcpy(substituteCharacters.data() + 1, characters, stringLength * sizeof(UChar));
+            substituteCharacters[stringLength + 1] = popDirectionalFormatting;
+            ATSUTextMoved(atsuTextLayout, substituteCharacters.data());
+        } else {
+            substituteCharacters.prepend(override);
+            substituteCharacters.append(popDirectionalFormatting);
+        }
+        ATSUTextInserted(atsuTextLayout, 0, 2);
+    }
+
+    ATSULayoutOperationOverrideSpecifier overrideSpecifier;
+    overrideSpecifier.operationSelector = kATSULayoutOperationPostLayoutAdjustment;
+    overrideSpecifier.overrideUPP = overrideLayoutOperation;
+
+    ATSUAttributeTag tags[] = { kATSULineLayoutOptionsTag, kATSULineDirectionTag, kATSULayoutOperationOverrideTag };
+    ByteCount sizes[] = { sizeof(ATSLineLayoutOptions), sizeof(Boolean), sizeof(ATSULayoutOperationOverrideSpecifier) };
+    ATSUAttributeValuePtr values[] = { &lineLayoutOptions, &rtl, &overrideSpecifier };
+
+    status = ATSUSetLayoutControls(atsuTextLayout, 3, tags, sizes, values);
+
+    ItemCount boundsCount;
+    status = ATSUGetGlyphBounds(atsuTextLayout, 0, 0, 0, m_stringLength, kATSUseFractionalOrigins, 0, 0, &boundsCount);
+
+    status = ATSUDisposeTextLayout(atsuTextLayout);
+}
+
+ComplexTextController::ComplexTextRun::ComplexTextRun(const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr)
+    : m_fontData(fontData)
+    , m_characters(characters)
+    , m_stringLocation(stringLocation)
+    , m_stringLength(stringLength)
+{
+    m_indices.reserveCapacity(stringLength);
+    unsigned r = 0;
+    while (r < stringLength) {
+        m_indices.uncheckedAppend(r);
+        if (U_IS_SURROGATE(characters[r])) {
+            ASSERT(r + 1 < stringLength);
+            ASSERT(U_IS_SURROGATE_LEAD(characters[r]));
+            ASSERT(U_IS_TRAIL(characters[r + 1]));
+            r += 2;
+        } else
+            r++;
+    }
+    m_glyphCount = m_indices.size();
+    if (!ltr) {
+        for (unsigned r = 0, end = m_glyphCount - 1; r < m_glyphCount / 2; ++r, --end)
+            std::swap(m_indices[r], m_indices[end]);
+    }
+
+    m_glyphsVector.fill(0, m_glyphCount);
+    m_glyphs = m_glyphsVector.data();
+    m_advancesVector.fill(CGSizeMake(fontData->widthForGlyph(0), 0), m_glyphCount);
+    m_advances = m_advancesVector.data();
+}
+
+static bool fontHasMirroringInfo(ATSUFontID fontID)
+{
+    ByteCount propTableSize;
+    OSStatus status = ATSFontGetTable(fontID, 'prop', 0, 0, 0, &propTableSize);
+    if (status == noErr)    // naively assume that if a 'prop' table exists then it contains mirroring info
+        return true;
+    else if (status != kATSInvalidFontTableAccess) // anything other than a missing table is logged as an error
+        LOG_ERROR("ATSFontGetTable failed (%d)", static_cast<int>(status));
+
+    return false;
+}
+
+static void disableLigatures(const SimpleFontData* fontData, TextRenderingMode textMode)
+{
+    // Don't be too aggressive: if the font doesn't contain 'a', then assume that any ligatures it contains are
+    // in characters that always go through ATSUI, and therefore allow them. Geeza Pro is an example.
+    // See bugzilla 5166.
+    if (textMode == OptimizeLegibility || textMode == GeometricPrecision || fontData->platformData().allowsLigatures())
+        return;
+
+    ATSUFontFeatureType featureTypes[] = { kLigaturesType };
+    ATSUFontFeatureSelector featureSelectors[] = { kCommonLigaturesOffSelector };
+    OSStatus status = ATSUSetFontFeatures(fontData->m_ATSUStyle, 1, featureTypes, featureSelectors);
+    if (status != noErr)
+        LOG_ERROR("ATSUSetFontFeatures failed (%d) -- ligatures remain enabled", static_cast<int>(status));
+}
+
+static void initializeATSUStyle(const SimpleFontData* fontData, TextRenderingMode textMode)
+{
+    if (fontData->m_ATSUStyleInitialized)
+        return;
+
+    ATSUFontID fontID = fontData->platformData().m_atsuFontID;
+    if (!fontID) {
+        LOG_ERROR("unable to get ATSUFontID for %p", fontData->platformData().font());
+        return;
+    }
+
+    OSStatus status = ATSUCreateStyle(&fontData->m_ATSUStyle);
+    if (status != noErr)
+        LOG_ERROR("ATSUCreateStyle failed (%d)", static_cast<int>(status));
+
+    Fixed fontSize = FloatToFixed(fontData->platformData().m_size);
+    Fract kerningInhibitFactor = FloatToFract(1);
+    static CGAffineTransform verticalFlip = CGAffineTransformMakeScale(1, -1);
+
+    ByteCount styleSizes[4] = { sizeof(fontSize), sizeof(fontID), sizeof(verticalFlip), sizeof(kerningInhibitFactor) };
+    ATSUAttributeTag styleTags[4] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag, kATSUKerningInhibitFactorTag };
+    ATSUAttributeValuePtr styleValues[4] = { &fontSize, &fontID, &verticalFlip, &kerningInhibitFactor };
+
+    bool allowKerning = textMode == OptimizeLegibility || textMode == GeometricPrecision;
+    status = ATSUSetAttributes(fontData->m_ATSUStyle, allowKerning ? 3 : 4, styleTags, styleSizes, styleValues);
+    if (status != noErr)
+        LOG_ERROR("ATSUSetAttributes failed (%d)", static_cast<int>(status));
+
+    fontData->m_ATSUMirrors = fontHasMirroringInfo(fontID);
+
+    disableLigatures(fontData, textMode);
+
+    fontData->m_ATSUStyleInitialized = true;
+}
+
+void ComplexTextController::collectComplexTextRunsForCharacters(const UChar* cp, unsigned length, unsigned stringLocation, const SimpleFontData* fontData)
+{
+    if (!fontData) {
+        // Create a run of missing glyphs from the primary font.
+        m_complexTextRuns.append(ComplexTextRun::create(m_font.primaryFont(), cp, stringLocation, length, m_run.ltr()));
+        return;
+    }
+
+    if (m_fallbackFonts && fontData != m_font.primaryFont())
+        m_fallbackFonts->add(fontData);
+
+    initializeATSUStyle(fontData, m_font.fontDescription().textRenderingMode());
+
+    OSStatus status;
+    ATSUTextLayout atsuTextLayout;
+    UniCharCount runLength = length;
+
+    status = ATSUCreateTextLayoutWithTextPtr(cp, 0, length, length, 1, &runLength, &fontData->m_ATSUStyle, &atsuTextLayout);
+    if (status != noErr) {
+        LOG_ERROR("ATSUCreateTextLayoutWithTextPtr failed with error %d", static_cast<int>(status));
+        return;
+    }
+    m_complexTextRuns.append(ComplexTextRun::create(atsuTextLayout, fontData, cp, stringLocation, length, m_run.ltr(), m_run.directionalOverride()));
+}
+
+} // namespace WebCore
+
+#endif // USE(ATSUI)
diff --git a/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp b/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
new file mode 100644
index 0000000..c9daf84
--- /dev/null
+++ b/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ComplexTextController.h"
+
+#if USE(CORE_TEXT)
+
+#include "Font.h"
+
+namespace WebCore {
+
+ComplexTextController::ComplexTextRun::ComplexTextRun(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength)
+    : m_CTRun(ctRun)
+    , m_fontData(fontData)
+    , m_characters(characters)
+    , m_stringLocation(stringLocation)
+    , m_stringLength(stringLength)
+{
+    m_glyphCount = CTRunGetGlyphCount(m_CTRun.get());
+    m_indices = CTRunGetStringIndicesPtr(m_CTRun.get());
+    if (!m_indices) {
+        m_indicesData.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, m_glyphCount * sizeof(CFIndex)));
+        CFDataIncreaseLength(m_indicesData.get(), m_glyphCount * sizeof(CFIndex));
+        m_indices = reinterpret_cast<const CFIndex*>(CFDataGetMutableBytePtr(m_indicesData.get()));
+        CTRunGetStringIndices(m_CTRun.get(), CFRangeMake(0, 0), const_cast<CFIndex*>(m_indices));
+    }
+
+    m_glyphs = CTRunGetGlyphsPtr(m_CTRun.get());
+    if (!m_glyphs) {
+        m_glyphsVector.grow(m_glyphCount);
+        CTRunGetGlyphs(m_CTRun.get(), CFRangeMake(0, 0), m_glyphsVector.data());
+        m_glyphs = m_glyphsVector.data();
+    }
+
+    m_advances = CTRunGetAdvancesPtr(m_CTRun.get());
+    if (!m_advances) {
+        m_advancesVector.grow(m_glyphCount);
+        CTRunGetAdvances(m_CTRun.get(), CFRangeMake(0, 0), m_advancesVector.data());
+        m_advances = m_advancesVector.data();
+    }
+
+}
+
+// Missing glyphs run constructor. Core Text will not generate a run of missing glyphs, instead falling back on
+// glyphs from LastResort. We want to use the primary font's missing glyph in order to match the fast text code path.
+ComplexTextController::ComplexTextRun::ComplexTextRun(const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr)
+    : m_fontData(fontData)
+    , m_characters(characters)
+    , m_stringLocation(stringLocation)
+    , m_stringLength(stringLength)
+{
+    Vector<CFIndex, 16> indices;
+    unsigned r = 0;
+    while (r < stringLength) {
+        indices.append(r);
+        if (U_IS_SURROGATE(characters[r])) {
+            ASSERT(r + 1 < stringLength);
+            ASSERT(U_IS_SURROGATE_LEAD(characters[r]));
+            ASSERT(U_IS_TRAIL(characters[r + 1]));
+            r += 2;
+        } else
+            r++;
+    }
+    m_glyphCount = indices.size();
+    if (!ltr) {
+        for (unsigned r = 0, end = m_glyphCount - 1; r < m_glyphCount / 2; ++r, --end)
+            std::swap(indices[r], indices[end]);
+    }
+    m_indicesData.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, m_glyphCount * sizeof(CFIndex)));
+    CFDataAppendBytes(m_indicesData.get(), reinterpret_cast<const UInt8*>(indices.data()), m_glyphCount * sizeof(CFIndex));
+    m_indices = reinterpret_cast<const CFIndex*>(CFDataGetBytePtr(m_indicesData.get()));
+
+    // Synthesize a run of missing glyphs.
+    m_glyphsVector.fill(0, m_glyphCount);
+    m_glyphs = m_glyphsVector.data();
+    m_advancesVector.fill(CGSizeMake(m_fontData->widthForGlyph(0), 0), m_glyphCount);
+    m_advances = m_advancesVector.data();
+}
+
+void ComplexTextController::collectComplexTextRunsForCharacters(const UChar* cp, unsigned length, unsigned stringLocation, const SimpleFontData* fontData)
+{
+    if (!fontData) {
+        // Create a run of missing glyphs from the primary font.
+        m_complexTextRuns.append(ComplexTextRun::create(m_font.primaryFont(), cp, stringLocation, length, m_run.ltr()));
+        return;
+    }
+
+    if (m_fallbackFonts && fontData != m_font.primaryFont())
+        m_fallbackFonts->add(fontData);
+
+    RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(NULL, cp, length, kCFAllocatorNull));
+
+    RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(NULL, string.get(), fontData->getCFStringAttributes(m_font.fontDescription().textRenderingMode())));
+
+    RetainPtr<CTTypesetterRef> typesetter;
+
+    if (!m_mayUseNaturalWritingDirection || m_run.directionalOverride()) {
+        static const void* optionKeys[] = { kCTTypesetterOptionForcedEmbeddingLevel };
+        static const void* ltrOptionValues[] = { kCFBooleanFalse };
+        static const void* rtlOptionValues[] = { kCFBooleanTrue };
+        static CFDictionaryRef ltrTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, ltrOptionValues, sizeof(optionKeys) / sizeof(*optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+        static CFDictionaryRef rtlTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, rtlOptionValues, sizeof(optionKeys) / sizeof(*optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+        typesetter.adoptCF(CTTypesetterCreateWithAttributedStringAndOptions(attributedString.get(), m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
+    } else
+        typesetter.adoptCF(CTTypesetterCreateWithAttributedString(attributedString.get()));
+
+    RetainPtr<CTLineRef> line(AdoptCF, CTTypesetterCreateLine(typesetter.get(), CFRangeMake(0, 0)));
+
+    CFArrayRef runArray = CTLineGetGlyphRuns(line.get());
+
+    CFIndex runCount = CFArrayGetCount(runArray);
+
+    for (CFIndex r = 0; r < runCount; r++) {
+        CTRunRef ctRun = static_cast<CTRunRef>(CFArrayGetValueAtIndex(runArray, r));
+        ASSERT(CFGetTypeID(ctRun) == CTRunGetTypeID());
+        m_complexTextRuns.append(ComplexTextRun::create(ctRun, fontData, cp, stringLocation, length));
+    }
+}
+
+} // namespace WebCore
+
+#endif // USE(CORE_TEXT)
diff --git a/WebCore/platform/graphics/mac/CoreTextController.h b/WebCore/platform/graphics/mac/CoreTextController.h
deleted file mode 100644
index 4dd6f93..0000000
--- a/WebCore/platform/graphics/mac/CoreTextController.h
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CoreTextController_h
-#define CoreTextController_h
-
-#if USE(CORE_TEXT)
-
-#include "Font.h"
-#include "GlyphBuffer.h"
-#include <wtf/RetainPtr.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-class CoreTextController {
-public:
-    CoreTextController(const Font*, const TextRun&, bool mayUseNaturalWritingDirection = false, HashSet<const SimpleFontData*>* fallbackFonts = 0);
-
-    // Advance and emit glyphs up to the specified character.
-    void advance(unsigned to, GlyphBuffer* = 0);
-
-    // Compute the character offset for a given x coordinate.
-    int offsetForPosition(int x, bool includePartialGlyphs);
-
-    // Returns the width of everything we've consumed so far.
-    float runWidthSoFar() const { return m_runWidthSoFar; }
-
-    float totalWidth() const { return m_totalWidth; }
-
-    // Extra width to the left of the leftmost glyph.
-    float finalRoundingWidth() const { return m_finalRoundingWidth; }
-
-private:
-    class CoreTextRun {
-    public:
-        CoreTextRun(CTRunRef, const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength);
-        CoreTextRun(const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr);
-
-        CTRunRef ctRun() const { return m_CTRun.get(); }
-        unsigned glyphCount() const { return m_glyphCount; }
-        const SimpleFontData* fontData() const { return m_fontData; }
-        const UChar* characters() const { return m_characters; }
-        unsigned stringLocation() const { return m_stringLocation; }
-        size_t stringLength() const { return m_stringLength; }
-        CFIndex indexAt(size_t i) const { return m_indices[i]; }
-
-    private:
-        RetainPtr<CTRunRef> m_CTRun;
-        unsigned m_glyphCount;
-        const SimpleFontData* m_fontData;
-        const UChar* m_characters;
-        unsigned m_stringLocation;
-        size_t m_stringLength;
-        const CFIndex* m_indices;
-        // Used only if CTRunGet*Ptr fails or if this is a missing glyphs run.
-        RetainPtr<CFMutableDataRef> m_indicesData;
-    };
-
-    void collectCoreTextRuns();
-    void collectCoreTextRunsForCharacters(const UChar*, unsigned length, unsigned stringLocation, const SimpleFontData*);
-    void adjustGlyphsAndAdvances();
-
-    const Font& m_font;
-    const TextRun& m_run;
-    bool m_mayUseNaturalWritingDirection;
-
-    Vector<UChar, 256> m_smallCapsBuffer;
-
-    Vector<CoreTextRun, 16> m_coreTextRuns;
-    Vector<CGSize, 256> m_adjustedAdvances;
-    Vector<CGGlyph, 256> m_adjustedGlyphs;
- 
-    unsigned m_currentCharacter;
-    int m_end;
-
-    CGFloat m_totalWidth;
-
-    float m_runWidthSoFar;
-    unsigned m_numGlyphsSoFar;
-    size_t m_currentRun;
-    unsigned m_glyphInCurrentRun;
-    float m_finalRoundingWidth;
-    float m_padding;
-    float m_padPerSpace;
-
-    HashSet<const SimpleFontData*>* m_fallbackFonts;
-
-    unsigned m_lastRoundingGlyph;
-};
-
-} // namespace WebCore
-#endif // USE(CORE_TEXT)
-#endif // CoreTextController_h
diff --git a/WebCore/platform/graphics/mac/FontMacCoreText.cpp b/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
index 9dffc7a..0db2601 100644
--- a/WebCore/platform/graphics/mac/FontMacCoreText.cpp
+++ b/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,25 +10,22 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "Font.h"
 
-#if USE(CORE_TEXT)
-
-#include "CoreTextController.h"
+#include "ComplexTextController.h"
 #include "FontFallbackList.h"
 #include "GlyphBuffer.h"
 #include "GraphicsContext.h"
@@ -41,7 +38,7 @@ namespace WebCore {
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& point, int h,
                                             int from, int to) const
 {
-    CoreTextController controller(this, run);
+    ComplexTextController controller(this, run);
     controller.advance(from);
     float beforeWidth = controller.runWidthSoFar();
     controller.advance(to);
@@ -63,7 +60,7 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
     GlyphBuffer glyphBuffer;
 
     float startX = point.x();
-    CoreTextController controller(this, run);
+    ComplexTextController controller(this, run);
     controller.advance(from);
     float beforeWidth = controller.runWidthSoFar();
     controller.advance(to, &glyphBuffer);
@@ -88,15 +85,14 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
 
 float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
-    CoreTextController controller(this, run, true, fallbackFonts);
+    ComplexTextController controller(this, run, true, fallbackFonts);
     return controller.totalWidth();
 }
 
 int Font::offsetForPositionForComplexText(const TextRun& run, int x, bool includePartialGlyphs) const
 {
-    CoreTextController controller(this, run);
+    ComplexTextController controller(this, run);
     return controller.offsetForPosition(x, includePartialGlyphs);
 }
 
-}
-#endif // USE(CORE_TEXT)
+} // namespace WebCore
diff --git a/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp b/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
index 5e72101..256b5a4 100644
--- a/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
@@ -24,6 +24,7 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include "SharedBuffer.h"
 #include "FontPlatformData.h"
+#include "OpenTypeSanitizer.h"
 
 namespace WebCore {
 
@@ -43,6 +44,14 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
 {
     ASSERT_ARG(buffer, buffer);
 
+#if ENABLE(OPENTYPE_SANITIZER)
+    OpenTypeSanitizer sanitizer(buffer);
+    RefPtr<SharedBuffer> transcodeBuffer = sanitizer.sanitize();
+    if (!transcodeBuffer)
+        return 0; // validation failed.
+    buffer = transcodeBuffer.get();
+#endif
+
     ATSFontContainerRef containerRef = 0;
     ATSFontRef fontRef = 0;
 
diff --git a/WebCore/platform/graphics/mac/FontMac.mm b/WebCore/platform/graphics/mac/FontMac.mm
index b2b9a5c..bb9561e 100644
--- a/WebCore/platform/graphics/mac/FontMac.mm
+++ b/WebCore/platform/graphics/mac/FontMac.mm
@@ -115,6 +115,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
     IntSize shadowSize;
     int shadowBlur;
     Color shadowColor;
+    ColorSpace fillColorSpace = context->fillColorSpace();
     context->getShadow(shadowSize, shadowBlur, shadowColor);
 
     bool hasSimpleShadow = context->textDrawingMode() == cTextFill && shadowColor.isValid() && !shadowBlur;
@@ -123,14 +124,14 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
         context->clearShadow();
         Color fillColor = context->fillColor();
         Color shadowFillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), shadowColor.alpha() * fillColor.alpha() / 255);
-        context->setFillColor(shadowFillColor);
+        context->setFillColor(shadowFillColor, fillColorSpace);
         CGContextSetTextPosition(cgContext, point.x() + shadowSize.width(), point.y() + shadowSize.height());
         CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         if (font->syntheticBoldOffset()) {
             CGContextSetTextPosition(cgContext, point.x() + shadowSize.width() + font->syntheticBoldOffset(), point.y() + shadowSize.height());
             CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         }
-        context->setFillColor(fillColor);
+        context->setFillColor(fillColor, fillColorSpace);
     }
 
     CGContextSetTextPosition(cgContext, point.x(), point.y());
@@ -141,7 +142,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
     }
 
     if (hasSimpleShadow)
-        context->setShadow(shadowSize, shadowBlur, shadowColor);
+        context->setShadow(shadowSize, shadowBlur, shadowColor, fillColorSpace);
 
     if (originalShouldUseFontSmoothing != newShouldUseFontSmoothing)
         CGContextSetShouldSmoothFonts(cgContext, originalShouldUseFontSmoothing);
diff --git a/WebCore/platform/graphics/mac/FontMacATSUI.mm b/WebCore/platform/graphics/mac/FontMacATSUI.mm
deleted file mode 100644
index 409bda4..0000000
--- a/WebCore/platform/graphics/mac/FontMacATSUI.mm
+++ /dev/null
@@ -1,635 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#import "config.h"
-#import "Font.h"
-
-#if USE(ATSUI)
-
-#import "CharacterNames.h"
-#import "GraphicsContext.h"
-#import "Logging.h"
-#import "ShapeArabic.h"
-#import "SimpleFontData.h"
-#import <AppKit/NSGraphicsContext.h>
-#import <wtf/OwnArrayPtr.h>
-
-#define SYNTHETIC_OBLIQUE_ANGLE 14
-
-#ifdef __LP64__
-#define URefCon void*
-#else
-#define URefCon UInt32
-#endif
-
-using namespace std;
-
-namespace WebCore {
-
-struct ATSULayoutParameters : Noncopyable
-{
-    ATSULayoutParameters(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts = 0)
-        : m_run(run)
-        , m_font(0)
-        , m_hasSyntheticBold(false)
-        , m_syntheticBoldPass(false)
-        , m_padPerSpace(0)
-        , m_fallbackFonts(fallbackFonts)
-    {
-    }
-
-    ~ATSULayoutParameters()
-    {
-        ATSUDisposeTextLayout(m_layout);
-    }
-
-    void initialize(const Font*, const GraphicsContext* = 0);
-
-    const TextRun& m_run;
-    
-    const Font* m_font;
-    
-    ATSUTextLayout m_layout;
-    OwnArrayPtr<const SimpleFontData*> m_fonts;
-    
-    OwnArrayPtr<UChar> m_charBuffer;
-    bool m_hasSyntheticBold;
-    bool m_syntheticBoldPass;
-    float m_padPerSpace;
-    HashSet<const SimpleFontData*>* m_fallbackFonts;
-};
-
-static TextRun copyRunForDirectionalOverrideIfNecessary(const TextRun& run, OwnArrayPtr<UChar>& charactersWithOverride)
-{
-    if (!run.directionalOverride())
-        return run;
-
-    charactersWithOverride.set(new UChar[run.length() + 2]);
-    charactersWithOverride[0] = run.rtl() ? rightToLeftOverride : leftToRightOverride;
-    memcpy(&charactersWithOverride[1], run.data(0), sizeof(UChar) * run.length());
-    charactersWithOverride[run.length() + 1] = popDirectionalFormatting;
-
-    TextRun result = run;
-    result.setText(charactersWithOverride.get(), run.length() + 2);
-    return result;
-}
-
-static bool fontHasMirroringInfo(ATSUFontID fontID)
-{
-    ByteCount propTableSize;
-    OSStatus status = ATSFontGetTable(fontID, 'prop', 0, 0, 0, &propTableSize);
-    if (status == noErr)    // naively assume that if a 'prop' table exists then it contains mirroring info
-        return true;
-    else if (status != kATSInvalidFontTableAccess) // anything other than a missing table is logged as an error
-        LOG_ERROR("ATSFontGetTable failed (%d)", status);
-
-    return false;
-}
-
-static void disableLigatures(const SimpleFontData* fontData, TextRenderingMode textMode)
-{
-    // Don't be too aggressive: if the font doesn't contain 'a', then assume that any ligatures it contains are
-    // in characters that always go through ATSUI, and therefore allow them. Geeza Pro is an example.
-    // See bugzilla 5166.
-    if (textMode == OptimizeLegibility || textMode == GeometricPrecision || fontData->platformData().allowsLigatures())
-        return;
-
-    ATSUFontFeatureType featureTypes[] = { kLigaturesType };
-    ATSUFontFeatureSelector featureSelectors[] = { kCommonLigaturesOffSelector };
-    OSStatus status = ATSUSetFontFeatures(fontData->m_ATSUStyle, 1, featureTypes, featureSelectors);
-    if (status != noErr)
-        LOG_ERROR("ATSUSetFontFeatures failed (%d) -- ligatures remain enabled", status);
-}
-
-static void initializeATSUStyle(const SimpleFontData* fontData, TextRenderingMode textMode)
-{
-    if (fontData->m_ATSUStyleInitialized)
-        return;
-
-    ATSUFontID fontID = fontData->platformData().m_atsuFontID;
-    if (!fontID) {
-        LOG_ERROR("unable to get ATSUFontID for %@", fontData->platformData().font());
-        return;
-    }
-
-    OSStatus status = ATSUCreateStyle(&fontData->m_ATSUStyle);
-    if (status != noErr)
-        // Who knows how many ATSU functions will crash when passed a NULL style...
-        LOG_ERROR("ATSUCreateStyle failed (%d)", status);
-
-    CGAffineTransform transform = CGAffineTransformMakeScale(1, -1);
-    if (fontData->platformData().m_syntheticOblique)
-        transform = CGAffineTransformConcat(transform, CGAffineTransformMake(1, 0, -tanf(SYNTHETIC_OBLIQUE_ANGLE * acosf(0) / 90), 1, 0, 0));
-    Fixed fontSize = FloatToFixed(fontData->platformData().m_size);
-    ByteCount styleSizes[4] = { sizeof(Fixed), sizeof(ATSUFontID), sizeof(CGAffineTransform), sizeof(Fract) };
-    
-    bool allowKerning = textMode == OptimizeLegibility || textMode == GeometricPrecision;
-    if (!allowKerning) {
-        // Turn off automatic kerning until it is supported in the CG code path (bug 6136)
-        Fract kerningInhibitFactor = FloatToFract(1.0);
-        ATSUAttributeTag styleTags[4] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag, kATSUKerningInhibitFactorTag };
-        ATSUAttributeValuePtr styleValues[4] = { &fontSize, &fontID, &transform, &kerningInhibitFactor };
-        status = ATSUSetAttributes(fontData->m_ATSUStyle, 4, styleTags, styleSizes, styleValues);
-        if (status != noErr)
-            LOG_ERROR("ATSUSetAttributes failed (%d)", status);
-    } else {
-        ATSUAttributeTag styleTags[3] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag };
-        ATSUAttributeValuePtr styleValues[3] = { &fontSize, &fontID, &transform, };
-        status = ATSUSetAttributes(fontData->m_ATSUStyle, 3, styleTags, styleSizes, styleValues);
-        if (status != noErr)
-            LOG_ERROR("ATSUSetAttributes failed (%d)", status);
-    }
-
-    fontData->m_ATSUMirrors = fontHasMirroringInfo(fontID);
-
-    // Turn off ligatures such as 'fi' to match the CG code path's behavior, until bug 6135 is fixed.
-    disableLigatures(fontData, textMode);
-
-    fontData->m_ATSUStyleInitialized = true;
-}
-
-static OSStatus overrideLayoutOperation(ATSULayoutOperationSelector, ATSULineRef iLineRef, URefCon iRefCon, void*, ATSULayoutOperationCallbackStatus* oCallbackStatus)
-{
-    ATSULayoutParameters* params = reinterpret_cast<ATSULayoutParameters*>(iRefCon);
-    OSStatus status;
-    ItemCount count;
-    ATSLayoutRecord *layoutRecords;
-
-    if (params->m_run.applyWordRounding()) {
-        status = ATSUDirectGetLayoutDataArrayPtrFromLineRef(iLineRef, kATSUDirectDataLayoutRecordATSLayoutRecordCurrent, true, (void **)&layoutRecords, &count);
-        if (status != noErr) {
-            *oCallbackStatus = kATSULayoutOperationCallbackStatusContinue;
-            return status;
-        }
-        
-        Fixed lastNativePos = 0;
-        float lastAdjustedPos = 0;
-        const UChar* characters = params->m_charBuffer ? params->m_charBuffer.get() : params->m_run.characters();
-        const SimpleFontData** renderers = params->m_fonts.get();
-        const SimpleFontData* renderer;
-        const SimpleFontData* lastRenderer = 0;
-        ByteCount offset = layoutRecords[0].originalOffset;
-        UChar nextCh = *(UChar *)(((char *)characters)+offset);
-        bool shouldRound = false;
-        bool syntheticBoldPass = params->m_syntheticBoldPass;
-        Fixed syntheticBoldOffset = 0;
-        bool hasExtraSpacing = (params->m_font->letterSpacing() || params->m_font->wordSpacing() || params->m_run.padding()) && !params->m_run.spacingDisabled();
-        float padding = params->m_run.padding();
-        // In the CoreGraphics code path, the rounding hack is applied in logical order.
-        // Here it is applied in visual left-to-right order, which may be better.
-        ItemCount lastRoundingChar = 0;
-        ItemCount i;
-        for (i = 1; i < count; i++) {
-            bool isLastChar = i == count - 1;
-            renderer = renderers[offset / 2];
-            float width;
-            if (nextCh == zeroWidthSpace || Font::treatAsZeroWidthSpace(nextCh) && !Font::treatAsSpace(nextCh)) {
-                width = 0;
-                layoutRecords[i-1].glyphID = renderer->spaceGlyph();
-            } else {
-                width = FixedToFloat(layoutRecords[i].realPos - lastNativePos);
-                if (renderer != lastRenderer && width) {
-                    lastRenderer = renderer;
-                    // The CoreGraphics interpretation of NSFontAntialiasedIntegerAdvancementsRenderingMode seems
-                    // to be "round each glyph's width to the nearest integer". This is not the same as ATSUI
-                    // does in any of its device-metrics modes.
-                    shouldRound = renderer->platformData().roundsGlyphAdvances();
-                    if (syntheticBoldPass)
-                        syntheticBoldOffset = FloatToFixed(renderer->syntheticBoldOffset());
-                    if (params->m_fallbackFonts && renderer != params->m_font->primaryFont())
-                        params->m_fallbackFonts->add(renderer);
-                }
-                if (shouldRound)
-                    width = roundf(width);
-                width += renderer->syntheticBoldOffset();
-                if (renderer->pitch() == FixedPitch ? width == renderer->spaceWidth() : (layoutRecords[i-1].flags & kATSGlyphInfoIsWhiteSpace))
-                    width = renderer->adjustedSpaceWidth();
-            }
-            lastNativePos = layoutRecords[i].realPos;
-
-            if (hasExtraSpacing) {
-                if (width && params->m_font->letterSpacing())
-                    width +=params->m_font->letterSpacing();
-                if (Font::treatAsSpace(nextCh)) {
-                    if (params->m_run.padding()) {
-                        if (padding < params->m_padPerSpace) {
-                            width += padding;
-                            padding = 0;
-                        } else {
-                            width += params->m_padPerSpace;
-                            padding -= params->m_padPerSpace;
-                        }
-                    }
-                    if (offset != 0 && !Font::treatAsSpace(*((UChar *)(((char *)characters)+offset) - 1)) && params->m_font->wordSpacing())
-                        width += params->m_font->wordSpacing();
-                }
-            }
-
-            UChar ch = nextCh;
-            offset = layoutRecords[i].originalOffset;
-            // Use space for nextCh at the end of the loop so that we get inside the rounding hack code.
-            // We won't actually round unless the other conditions are satisfied.
-            nextCh = isLastChar ? ' ' : *(UChar *)(((char *)characters)+offset);
-
-            if (Font::isRoundingHackCharacter(ch))
-                width = ceilf(width);
-            lastAdjustedPos = lastAdjustedPos + width;
-            if (Font::isRoundingHackCharacter(nextCh) && (!isLastChar || params->m_run.applyRunRounding())){
-                if (params->m_run.ltr())
-                    lastAdjustedPos = ceilf(lastAdjustedPos);
-                else {
-                    float roundingWidth = ceilf(lastAdjustedPos) - lastAdjustedPos;
-                    Fixed rw = FloatToFixed(roundingWidth);
-                    ItemCount j;
-                    for (j = lastRoundingChar; j < i; j++)
-                        layoutRecords[j].realPos += rw;
-                    lastRoundingChar = i;
-                    lastAdjustedPos += roundingWidth;
-                }
-            }
-            if (syntheticBoldPass) {
-                if (syntheticBoldOffset)
-                    layoutRecords[i-1].realPos += syntheticBoldOffset;
-                else
-                    layoutRecords[i-1].glyphID = renderer->spaceGlyph();
-            }
-            layoutRecords[i].realPos = FloatToFixed(lastAdjustedPos);
-        }
-        
-        status = ATSUDirectReleaseLayoutDataArrayPtr(iLineRef, kATSUDirectDataLayoutRecordATSLayoutRecordCurrent, (void **)&layoutRecords);
-    }
-    *oCallbackStatus = kATSULayoutOperationCallbackStatusHandled;
-    return noErr;
-}
-
-static inline bool isArabicLamWithAlefLigature(UChar c)
-{
-    return c >= 0xfef5 && c <= 0xfefc;
-}
-
-static void shapeArabic(const UChar* source, UChar* dest, unsigned totalLength, unsigned shapingStart)
-{
-    while (shapingStart < totalLength) {
-        unsigned shapingEnd;
-        // We do not want to pass a Lam with Alef ligature followed by a space to the shaper,
-        // since we want to be able to identify this sequence as the result of shaping a Lam
-        // followed by an Alef and padding with a space.
-        bool foundLigatureSpace = false;
-        for (shapingEnd = shapingStart; !foundLigatureSpace && shapingEnd < totalLength - 1; ++shapingEnd)
-            foundLigatureSpace = isArabicLamWithAlefLigature(source[shapingEnd]) && source[shapingEnd + 1] == ' ';
-        shapingEnd++;
-
-        UErrorCode shapingError = U_ZERO_ERROR;
-        unsigned charsWritten = shapeArabic(source + shapingStart, shapingEnd - shapingStart, dest + shapingStart, shapingEnd - shapingStart, U_SHAPE_LETTERS_SHAPE | U_SHAPE_LENGTH_FIXED_SPACES_NEAR, &shapingError);
-
-        if (U_SUCCESS(shapingError) && charsWritten == shapingEnd - shapingStart) {
-            for (unsigned j = shapingStart; j < shapingEnd - 1; ++j) {
-                if (isArabicLamWithAlefLigature(dest[j]) && dest[j + 1] == ' ')
-                    dest[++j] = zeroWidthSpace;
-            }
-            if (foundLigatureSpace) {
-                dest[shapingEnd] = ' ';
-                shapingEnd++;
-            } else if (isArabicLamWithAlefLigature(dest[shapingEnd - 1])) {
-                // u_shapeArabic quirk: if the last two characters in the source string are a Lam and an Alef,
-                // the space is put at the beginning of the string, despite U_SHAPE_LENGTH_FIXED_SPACES_NEAR.
-                ASSERT(dest[shapingStart] == ' ');
-                dest[shapingStart] = zeroWidthSpace;
-            }
-        } else {
-            // Something went wrong. Abandon shaping and just copy the rest of the buffer.
-            LOG_ERROR("u_shapeArabic failed(%d)", shapingError);
-            shapingEnd = totalLength;
-            memcpy(dest + shapingStart, source + shapingStart, (shapingEnd - shapingStart) * sizeof(UChar));
-        }
-        shapingStart = shapingEnd;
-    }
-}
-
-void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* graphicsContext)
-{
-    m_font = font;
-    
-    const SimpleFontData* fontData = font->primaryFont();
-    m_fonts.set(new const SimpleFontData*[m_run.length()]);
-    if (font->isSmallCaps())
-        m_charBuffer.set(new UChar[m_run.length()]);
-    
-    ATSUTextLayout layout;
-    OSStatus status;
-    ATSULayoutOperationOverrideSpecifier overrideSpecifier;
-    
-    initializeATSUStyle(fontData, m_font->fontDescription().textRenderingMode());
-    
-    // FIXME: This is currently missing the following required features that the CoreGraphics code path has:
-    // - \n, \t, and nonbreaking space render as a space.
-
-    UniCharCount runLength = m_run.length();
-
-    if (m_charBuffer)
-        memcpy(m_charBuffer.get(), m_run.characters(), runLength * sizeof(UChar));
-    
-    status = ATSUCreateTextLayoutWithTextPtr(
-            (m_charBuffer ? m_charBuffer.get() : m_run.characters()),
-            0,        // offset
-            runLength,      // length
-            runLength,    // total length
-            1,              // styleRunCount
-            &runLength,     // length of style run
-            &fontData->m_ATSUStyle, 
-            &layout);
-    if (status != noErr)
-        LOG_ERROR("ATSUCreateTextLayoutWithTextPtr failed(%d)", status);
-    m_layout = layout;
-    ATSUSetTextLayoutRefCon(m_layout, (URefCon)this);
-
-    // FIXME: There are certain times when this method is called, when we don't have access to a GraphicsContext
-    // measuring text runs with floatWidthForComplexText is one example.
-    // ATSUI requires that we pass a valid CGContextRef to it when specifying kATSUCGContextTag (crashes when passed 0)
-    // ATSUI disables sub-pixel rendering if kATSUCGContextTag is not specified!  So we're in a bind.
-    // Sometimes [[NSGraphicsContext currentContext] graphicsPort] may return the wrong (or no!) context.  Nothing we can do about it (yet).
-    CGContextRef cgContext = graphicsContext ? graphicsContext->platformContext() : (CGContextRef)[[NSGraphicsContext currentContext] graphicsPort];
-    
-    ATSLineLayoutOptions lineLayoutOptions = kATSLineKeepSpacesOutOfMargin | kATSLineHasNoHangers;
-    Boolean rtl = m_run.rtl();
-    overrideSpecifier.operationSelector = kATSULayoutOperationPostLayoutAdjustment;
-    overrideSpecifier.overrideUPP = overrideLayoutOperation;
-    ATSUAttributeTag tags[] = { kATSUCGContextTag, kATSULineLayoutOptionsTag, kATSULineDirectionTag, kATSULayoutOperationOverrideTag };
-    ByteCount sizes[] = { sizeof(CGContextRef), sizeof(ATSLineLayoutOptions), sizeof(Boolean), sizeof(ATSULayoutOperationOverrideSpecifier) };
-    ATSUAttributeValuePtr values[] = { &cgContext, &lineLayoutOptions, &rtl, &overrideSpecifier };
-    
-    status = ATSUSetLayoutControls(layout, (m_run.applyWordRounding() ? 4 : 3), tags, sizes, values);
-    if (status != noErr)
-        LOG_ERROR("ATSUSetLayoutControls failed(%d)", status);
-
-    status = ATSUSetTransientFontMatching(layout, YES);
-    if (status != noErr)
-        LOG_ERROR("ATSUSetTransientFontMatching failed(%d)", status);
-
-    m_hasSyntheticBold = false;
-    ATSUFontID ATSUSubstituteFont;
-    UniCharArrayOffset substituteOffset = 0;
-    UniCharCount substituteLength;
-    UniCharArrayOffset lastOffset;
-    const SimpleFontData* substituteFontData = 0;
-
-    while (substituteOffset < runLength) {
-        // FIXME: Using ATSUMatchFontsToText() here results in several problems: the CSS font family list is not necessarily followed for the 2nd
-        // and onwards unmatched characters; segmented fonts do not work correctly; behavior does not match the simple text and Uniscribe code
-        // paths. Change this function to use Font::glyphDataForCharacter() for each character instead. 
-        lastOffset = substituteOffset;
-        status = ATSUMatchFontsToText(layout, substituteOffset, kATSUToTextEnd, &ATSUSubstituteFont, &substituteOffset, &substituteLength);
-        if (status == kATSUFontsMatched || status == kATSUFontsNotMatched) {
-            const FontData* fallbackFontData = m_font->fontDataForCharacters(m_run.characters() + substituteOffset, substituteLength);
-            substituteFontData = fallbackFontData ? fallbackFontData->fontDataForCharacter(m_run[0]) : 0;
-            if (substituteFontData) {
-                initializeATSUStyle(substituteFontData, m_font->fontDescription().textRenderingMode());
-                if (substituteFontData->m_ATSUStyle)
-                    ATSUSetRunStyle(layout, substituteFontData->m_ATSUStyle, substituteOffset, substituteLength);
-            } else
-                substituteFontData = fontData;
-        } else {
-            substituteOffset = runLength;
-            substituteLength = 0;
-        }
-
-        bool shapedArabic = false;
-        bool isSmallCap = false;
-        UniCharArrayOffset firstSmallCap = 0;
-        const SimpleFontData *r = fontData;
-        UniCharArrayOffset i;
-        for (i = lastOffset;  ; i++) {
-            if (i == substituteOffset || i == substituteOffset + substituteLength) {
-                if (isSmallCap) {
-                    isSmallCap = false;
-                    initializeATSUStyle(r->smallCapsFontData(m_font->fontDescription()), m_font->fontDescription().textRenderingMode());
-                    ATSUSetRunStyle(layout, r->smallCapsFontData(m_font->fontDescription())->m_ATSUStyle, firstSmallCap, i - firstSmallCap);
-                }
-                if (i == substituteOffset && substituteLength > 0)
-                    r = substituteFontData;
-                else
-                    break;
-            }
-            if (!shapedArabic && WTF::Unicode::isArabicChar(m_run[i]) && !r->shapesArabic()) {
-                shapedArabic = true;
-                if (!m_charBuffer) {
-                    m_charBuffer.set(new UChar[runLength]);
-                    memcpy(m_charBuffer.get(), m_run.characters(), i * sizeof(UChar));
-                    ATSUTextMoved(layout, m_charBuffer.get());
-                }
-                shapeArabic(m_run.characters(), m_charBuffer.get(), runLength, i);
-            }
-            if (m_run.rtl() && !r->m_ATSUMirrors) {
-                UChar mirroredChar = u_charMirror(m_run[i]);
-                if (mirroredChar != m_run[i]) {
-                    if (!m_charBuffer) {
-                        m_charBuffer.set(new UChar[runLength]);
-                        memcpy(m_charBuffer.get(), m_run.characters(), runLength * sizeof(UChar));
-                        ATSUTextMoved(layout, m_charBuffer.get());
-                    }
-                    m_charBuffer[i] = mirroredChar;
-                }
-            }
-            if (m_font->isSmallCaps()) {
-                const SimpleFontData* smallCapsData = r->smallCapsFontData(m_font->fontDescription());
-                UChar c = m_charBuffer[i];
-                UChar newC;
-                if (U_GET_GC_MASK(c) & U_GC_M_MASK)
-                    m_fonts[i] = isSmallCap ? smallCapsData : r;
-                else if (!u_isUUppercase(c) && (newC = u_toupper(c)) != c) {
-                    m_charBuffer[i] = newC;
-                    if (!isSmallCap) {
-                        isSmallCap = true;
-                        firstSmallCap = i;
-                    }
-                    m_fonts[i] = smallCapsData;
-                } else {
-                    if (isSmallCap) {
-                        isSmallCap = false;
-                        initializeATSUStyle(smallCapsData, m_font->fontDescription().textRenderingMode());
-                        ATSUSetRunStyle(layout, smallCapsData->m_ATSUStyle, firstSmallCap, i - firstSmallCap);
-                    }
-                    m_fonts[i] = r;
-                }
-            } else
-                m_fonts[i] = r;
-            if (m_fonts[i]->syntheticBoldOffset())
-                m_hasSyntheticBold = true;
-        }
-        substituteOffset += substituteLength;
-    }
-    if (m_run.padding()) {
-        float numSpaces = 0;
-        unsigned k;
-        for (k = 0; k < runLength; k++)
-            if (Font::treatAsSpace(m_run[k]))
-                numSpaces++;
-
-        if (numSpaces == 0)
-            m_padPerSpace = 0;
-        else
-            m_padPerSpace = ceilf(m_run.padding() / numSpaces);
-    } else
-        m_padPerSpace = 0;
-}
-
-FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& point, int h, int from, int to) const
-{
-    OwnArrayPtr<UChar> charactersWithOverride;
-    TextRun adjustedRun = copyRunForDirectionalOverrideIfNecessary(run, charactersWithOverride);
-    if (run.directionalOverride()) {
-        from++;
-        to++;
-    }
-
-    ATSULayoutParameters params(adjustedRun);
-    params.initialize(this);
-
-    ATSTrapezoid firstGlyphBounds;
-    ItemCount actualNumBounds;
-    
-    OSStatus status = ATSUGetGlyphBounds(params.m_layout, 0, 0, from, to - from, kATSUseFractionalOrigins, 1, &firstGlyphBounds, &actualNumBounds);
-    if (status != noErr || actualNumBounds != 1) {
-        static ATSTrapezoid zeroTrapezoid = { {0, 0}, {0, 0}, {0, 0}, {0, 0} };
-        firstGlyphBounds = zeroTrapezoid;
-    }
-    
-    float beforeWidth = min(FixedToFloat(firstGlyphBounds.lowerLeft.x), FixedToFloat(firstGlyphBounds.upperLeft.x));
-    float afterWidth = max(FixedToFloat(firstGlyphBounds.lowerRight.x), FixedToFloat(firstGlyphBounds.upperRight.x));
-    
-    FloatRect rect(point.x() + floorf(beforeWidth), point.y(), roundf(afterWidth) - floorf(beforeWidth), h);
-
-    return rect;
-}
-
-void Font::drawComplexText(GraphicsContext* graphicsContext, const TextRun& run, const FloatPoint& point, int from, int to) const
-{
-    OSStatus status;
-    
-    int drawPortionLength = to - from;
-    OwnArrayPtr<UChar> charactersWithOverride;
-    TextRun adjustedRun = copyRunForDirectionalOverrideIfNecessary(run, charactersWithOverride);
-    if (run.directionalOverride())
-        from++;
-
-    ATSULayoutParameters params(adjustedRun);
-    params.initialize(this, graphicsContext);
-    
-    // ATSUI can't draw beyond -32768 to +32767 so we translate the CTM and tell ATSUI to draw at (0, 0).
-    CGContextRef context = graphicsContext->platformContext();
-    CGContextTranslateCTM(context, point.x(), point.y());
-
-    IntSize shadowSize;
-    int shadowBlur;
-    Color shadowColor;
-    graphicsContext->getShadow(shadowSize, shadowBlur, shadowColor);
-
-    bool hasSimpleShadow = graphicsContext->textDrawingMode() == cTextFill && shadowColor.isValid() && !shadowBlur;
-    if (hasSimpleShadow) {
-        // Paint simple shadows ourselves instead of relying on CG shadows, to avoid losing subpixel antialiasing.
-        graphicsContext->clearShadow();
-        Color fillColor = graphicsContext->fillColor();
-        Color shadowFillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), shadowColor.alpha() * fillColor.alpha() / 255);
-        graphicsContext->setFillColor(shadowFillColor);
-        CGContextTranslateCTM(context, shadowSize.width(), shadowSize.height());
-        status = ATSUDrawText(params.m_layout, from, drawPortionLength, 0, 0);
-        if (status == noErr && params.m_hasSyntheticBold) {
-            // Force relayout for the bold pass
-            ATSUClearLayoutCache(params.m_layout, 0);
-            params.m_syntheticBoldPass = true;
-            status = ATSUDrawText(params.m_layout, from, drawPortionLength, 0, 0);
-            // Force relayout for the next pass
-            ATSUClearLayoutCache(params.m_layout, 0);
-            params.m_syntheticBoldPass = false;
-        }
-        CGContextTranslateCTM(context, -shadowSize.width(), -shadowSize.height());
-        graphicsContext->setFillColor(fillColor);
-    }
-
-    status = ATSUDrawText(params.m_layout, from, drawPortionLength, 0, 0);
-    if (status == noErr && params.m_hasSyntheticBold) {
-        // Force relayout for the bold pass
-        ATSUClearLayoutCache(params.m_layout, 0);
-        params.m_syntheticBoldPass = true;
-        status = ATSUDrawText(params.m_layout, from, drawPortionLength, 0, 0);
-    }
-    CGContextTranslateCTM(context, -point.x(), -point.y());
-
-    if (status != noErr)
-        // Nothing to do but report the error (dev build only).
-        LOG_ERROR("ATSUDrawText() failed(%d)", status);
-
-    if (hasSimpleShadow)
-        graphicsContext->setShadow(shadowSize, shadowBlur, shadowColor);
-}
-
-float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
-{
-    if (run.length() == 0)
-        return 0;
-
-    ATSULayoutParameters params(run, fallbackFonts);
-    params.initialize(this);
-    
-    OSStatus status;
-    
-    ATSTrapezoid firstGlyphBounds;
-    ItemCount actualNumBounds;
-    status = ATSUGetGlyphBounds(params.m_layout, 0, 0, 0, run.length(), kATSUseFractionalOrigins, 1, &firstGlyphBounds, &actualNumBounds);    
-    if (status != noErr)
-        LOG_ERROR("ATSUGetGlyphBounds() failed(%d)", status);
-    if (actualNumBounds != 1)
-        LOG_ERROR("unexpected result from ATSUGetGlyphBounds(): actualNumBounds(%d) != 1", actualNumBounds);
-
-    return max(FixedToFloat(firstGlyphBounds.upperRight.x), FixedToFloat(firstGlyphBounds.lowerRight.x)) -
-           min(FixedToFloat(firstGlyphBounds.upperLeft.x), FixedToFloat(firstGlyphBounds.lowerLeft.x));
-}
-
-int Font::offsetForPositionForComplexText(const TextRun& run, int x, bool /*includePartialGlyphs*/) const
-{
-    OwnArrayPtr<UChar> charactersWithOverride;
-    TextRun adjustedRun = copyRunForDirectionalOverrideIfNecessary(run, charactersWithOverride);
-
-    ATSULayoutParameters params(adjustedRun);
-    params.initialize(this);
-
-    UniCharArrayOffset primaryOffset = 0;
-    
-    // FIXME: No idea how to avoid including partial glyphs.
-    // Not even sure if that's the behavior this yields now.
-    Boolean isLeading;
-    UniCharArrayOffset secondaryOffset = 0;
-    OSStatus status = ATSUPositionToOffset(params.m_layout, FloatToFixed(x), FloatToFixed(-1), &primaryOffset, &isLeading, &secondaryOffset);
-    unsigned offset;
-    if (status == noErr) {
-        offset = (unsigned)primaryOffset;
-        if (run.directionalOverride() && offset > 0)
-            offset--;
-    } else
-        // Failed to find offset!  Return 0 offset.
-        offset = 0;
-
-    return offset;
-}
-
-}
-#endif // USE(ATSUI)
diff --git a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
index 47617d8..41f63a9 100644
--- a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
+++ b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
@@ -30,18 +30,18 @@
 #include "GraphicsContext3D.h"
 
 #include "CachedImage.h"
-#include "CanvasActiveInfo.h"
-#include "CanvasArray.h"
-#include "CanvasBuffer.h"
-#include "CanvasFramebuffer.h"
-#include "CanvasFloatArray.h"
-#include "CanvasIntArray.h"
+#include "WebGLActiveInfo.h"
+#include "WebGLArray.h"
+#include "WebGLBuffer.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLIntArray.h"
 #include "CanvasObject.h"
-#include "CanvasProgram.h"
-#include "CanvasRenderbuffer.h"
-#include "CanvasShader.h"
-#include "CanvasTexture.h"
-#include "CanvasUnsignedByteArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLShader.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
 #include "CString.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
@@ -175,21 +175,12 @@ GraphicsContext3D::~GraphicsContext3D()
     }
 }
 
-void GraphicsContext3D::checkError() const
-{
-    // FIXME: This needs to only be done in the debug context. It will probably throw an exception
-    // on error and print the error message to the debug console
-    GLenum error = ::glGetError();
-    if (error != GL_NO_ERROR)
-        notImplemented();
-}
-
 void GraphicsContext3D::makeContextCurrent()
 {
     CGLSetCurrentContext(m_contextObj);
 }
 
-void GraphicsContext3D::beginPaint(CanvasRenderingContext3D* context)
+void GraphicsContext3D::beginPaint(WebGLRenderingContext* context)
 {
     UNUSED_PARAM(context);
 }
@@ -246,43 +237,42 @@ void GraphicsContext3D::activeTexture(unsigned long texture)
     ::glActiveTexture(texture);
 }
 
-void GraphicsContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
+void GraphicsContext3D::attachShader(WebGLProgram* program, WebGLShader* shader)
 {
-    if (!program || !shader)
-        return;
+    ASSERT(program);
+    ASSERT(shader);
     ensureContext(m_contextObj);
     ::glAttachShader((GLuint) program->object(), (GLuint) shader->object());
 }
 
-void GraphicsContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
+void GraphicsContext3D::bindAttribLocation(WebGLProgram* program, unsigned long index, const String& name)
 {
-    if (!program)
-        return;
+    ASSERT(program);
     ensureContext(m_contextObj);
     ::glBindAttribLocation((GLuint) program->object(), index, name.utf8().data());
 }
 
-void GraphicsContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
+void GraphicsContext3D::bindBuffer(unsigned long target, WebGLBuffer* buffer)
 {
     ensureContext(m_contextObj);
     ::glBindBuffer(target, buffer ? (GLuint) buffer->object() : 0);
 }
 
 
-void GraphicsContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
+void GraphicsContext3D::bindFramebuffer(unsigned long target, WebGLFramebuffer* buffer)
 {
     ensureContext(m_contextObj);
     ::glBindFramebufferEXT(target, buffer ? (GLuint) buffer->object() : m_fbo);
 }
 
-void GraphicsContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
+void GraphicsContext3D::bindRenderbuffer(unsigned long target, WebGLRenderbuffer* renderbuffer)
 {
     ensureContext(m_contextObj);
-    ::glBindBuffer(target, renderbuffer ? (GLuint) renderbuffer->object() : 0);
+    ::glBindRenderbufferEXT(target, renderbuffer ? (GLuint) renderbuffer->object() : 0);
 }
 
 
-void GraphicsContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
+void GraphicsContext3D::bindTexture(unsigned long target, WebGLTexture* texture)
 {
     ensureContext(m_contextObj);
     ::glBindTexture(target, texture ? (GLuint) texture->object() : 0);
@@ -324,22 +314,22 @@ void GraphicsContext3D::bufferData(unsigned long target, int size, unsigned long
     ensureContext(m_contextObj);
     ::glBufferData(target, size, 0, usage);
 }
-void GraphicsContext3D::bufferData(unsigned long target, CanvasArray* array, unsigned long usage)
+void GraphicsContext3D::bufferData(unsigned long target, WebGLArray* array, unsigned long usage)
 {
     if (!array || !array->length())
         return;
     
     ensureContext(m_contextObj);
-    ::glBufferData(target, array->sizeInBytes(), array->baseAddress(), usage);
+    ::glBufferData(target, array->byteLength(), array->baseAddress(), usage);
 }
 
-void GraphicsContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* array)
+void GraphicsContext3D::bufferSubData(unsigned long target, long offset, WebGLArray* array)
 {
     if (!array || !array->length())
         return;
     
     ensureContext(m_contextObj);
-    ::glBufferSubData(target, offset, array->sizeInBytes(), array->baseAddress());
+    ::glBufferSubData(target, offset, array->byteLength(), array->baseAddress());
 }
 
 unsigned long GraphicsContext3D::checkFramebufferStatus(unsigned long target)
@@ -378,11 +368,9 @@ void GraphicsContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
     ::glColorMask(red, green, blue, alpha);
 }
 
-void GraphicsContext3D::compileShader(CanvasShader* shader)
+void GraphicsContext3D::compileShader(WebGLShader* shader)
 {
-    if (!shader)
-        return;
-    
+    ASSERT(shader);
     ensureContext(m_contextObj);
     ::glCompileShader((GLuint) shader->object());
 }
@@ -423,11 +411,10 @@ void GraphicsContext3D::depthRange(double zNear, double zFar)
     ::glDepthRange(zNear, zFar);
 }
 
-void GraphicsContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
+void GraphicsContext3D::detachShader(WebGLProgram* program, WebGLShader* shader)
 {
-    if (!program || !shader)
-        return;
-    
+    ASSERT(program);
+    ASSERT(shader);
     ensureContext(m_contextObj);
     ::glDetachShader((GLuint) program->object(), (GLuint) shader->object());
 }
@@ -480,22 +467,16 @@ void GraphicsContext3D::flush()
     ::glFlush();
 }
 
-void GraphicsContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
+void GraphicsContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer* buffer)
 {
-    if (!buffer)
-        return;
-    
     ensureContext(m_contextObj);
-    ::glFramebufferRenderbufferEXT(target, attachment, renderbuffertarget, (GLuint) buffer->object());
+    ::glFramebufferRenderbufferEXT(target, attachment, renderbuffertarget, buffer ? (GLuint) buffer->object() : 0);
 }
 
-void GraphicsContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
+void GraphicsContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture* texture, long level)
 {
-    if (!texture)
-        return;
-    
     ensureContext(m_contextObj);
-    ::glFramebufferTexture2DEXT(target, attachment, textarget, (GLuint) texture->object(), level);
+    ::glFramebufferTexture2DEXT(target, attachment, textarget, texture ? (GLuint) texture->object() : 0, level);
 }
 
 void GraphicsContext3D::frontFace(unsigned long mode)
@@ -510,10 +491,12 @@ void GraphicsContext3D::generateMipmap(unsigned long target)
     ::glGenerateMipmapEXT(target);
 }
 
-bool GraphicsContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ActiveInfo& info)
+bool GraphicsContext3D::getActiveAttrib(WebGLProgram* program, unsigned long index, ActiveInfo& info)
 {
-    if (!program->object())
+    if (!program->object()) {
+        synthesizeGLError(INVALID_VALUE);
         return false;
+    }
     ensureContext(m_contextObj);
     GLint maxAttributeSize = 0;
     ::glGetProgramiv(static_cast<GLuint>(program->object()), GL_ACTIVE_ATTRIBUTE_MAX_LENGTH, &maxAttributeSize);
@@ -530,10 +513,12 @@ bool GraphicsContext3D::getActiveAttrib(CanvasProgram* program, unsigned long in
     return true;
 }
     
-bool GraphicsContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ActiveInfo& info)
+bool GraphicsContext3D::getActiveUniform(WebGLProgram* program, unsigned long index, ActiveInfo& info)
 {
-    if (!program->object())
+    if (!program->object()) {
+        synthesizeGLError(INVALID_VALUE);
         return false;
+    }
     ensureContext(m_contextObj);
     GLint maxUniformSize = 0;
     ::glGetProgramiv(static_cast<GLuint>(program->object()), GL_ACTIVE_UNIFORM_MAX_LENGTH, &maxUniformSize);
@@ -550,7 +535,7 @@ bool GraphicsContext3D::getActiveUniform(CanvasProgram* program, unsigned long i
     return true;
 }
 
-int GraphicsContext3D::getAttribLocation(CanvasProgram* program, const String& name)
+int GraphicsContext3D::getAttribLocation(WebGLProgram* program, const String& name)
 {
     if (!program)
         return -1;
@@ -561,6 +546,13 @@ int GraphicsContext3D::getAttribLocation(CanvasProgram* program, const String& n
 
 unsigned long GraphicsContext3D::getError()
 {
+    if (m_syntheticErrors.size() > 0) {
+        ListHashSet<unsigned long>::iterator iter = m_syntheticErrors.begin();
+        unsigned long err = *iter;
+        m_syntheticErrors.remove(iter);
+        return err;
+    }
+
     ensureContext(m_contextObj);
     return ::glGetError();
 }
@@ -577,7 +569,7 @@ void GraphicsContext3D::hint(unsigned long target, unsigned long mode)
     ::glHint(target, mode);
 }
 
-bool GraphicsContext3D::isBuffer(CanvasBuffer* buffer)
+bool GraphicsContext3D::isBuffer(WebGLBuffer* buffer)
 {
     if (!buffer)
         return false;
@@ -592,7 +584,7 @@ bool GraphicsContext3D::isEnabled(unsigned long cap)
     return ::glIsEnabled(cap);
 }
 
-bool GraphicsContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
+bool GraphicsContext3D::isFramebuffer(WebGLFramebuffer* framebuffer)
 {
     if (!framebuffer)
         return false;
@@ -601,7 +593,7 @@ bool GraphicsContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
     return ::glIsFramebufferEXT((GLuint) framebuffer->object());
 }
 
-bool GraphicsContext3D::isProgram(CanvasProgram* program)
+bool GraphicsContext3D::isProgram(WebGLProgram* program)
 {
     if (!program)
         return false;
@@ -610,7 +602,7 @@ bool GraphicsContext3D::isProgram(CanvasProgram* program)
     return ::glIsProgram((GLuint) program->object());
 }
 
-bool GraphicsContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
+bool GraphicsContext3D::isRenderbuffer(WebGLRenderbuffer* renderbuffer)
 {
     if (!renderbuffer)
         return false;
@@ -619,7 +611,7 @@ bool GraphicsContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
     return ::glIsRenderbufferEXT((GLuint) renderbuffer->object());
 }
 
-bool GraphicsContext3D::isShader(CanvasShader* shader)
+bool GraphicsContext3D::isShader(WebGLShader* shader)
 {
     if (!shader)
         return false;
@@ -628,7 +620,7 @@ bool GraphicsContext3D::isShader(CanvasShader* shader)
     return ::glIsShader((GLuint) shader->object());
 }
 
-bool GraphicsContext3D::isTexture(CanvasTexture* texture)
+bool GraphicsContext3D::isTexture(WebGLTexture* texture)
 {
     if (!texture)
         return false;
@@ -643,11 +635,9 @@ void GraphicsContext3D::lineWidth(double width)
     ::glLineWidth(static_cast<float>(width));
 }
 
-void GraphicsContext3D::linkProgram(CanvasProgram* program)
+void GraphicsContext3D::linkProgram(WebGLProgram* program)
 {
-    if (!program)
-        return;
-    
+    ASSERT(program);
     ensureContext(m_contextObj);
     ::glLinkProgram((GLuint) program->object());
 }
@@ -664,7 +654,7 @@ void GraphicsContext3D::polygonOffset(double factor, double units)
     ::glPolygonOffset(static_cast<float>(factor), static_cast<float>(units));
 }
 
-PassRefPtr<CanvasArray> GraphicsContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+PassRefPtr<WebGLArray> GraphicsContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
 {
     ensureContext(m_contextObj);
     
@@ -675,7 +665,7 @@ PassRefPtr<CanvasArray> GraphicsContext3D::readPixels(long x, long y, unsigned l
     if (type != GL_UNSIGNED_BYTE || format != GL_RGBA)
         return 0;
         
-    RefPtr<CanvasUnsignedByteArray> array = CanvasUnsignedByteArray::create(width * height * 4);
+    RefPtr<WebGLUnsignedByteArray> array = WebGLUnsignedByteArray::create(width * height * 4);
     ::glReadPixels(x, y, width, height, format, type, (GLvoid*) array->data());
     return array;    
 }
@@ -705,10 +695,9 @@ void GraphicsContext3D::scissor(long x, long y, unsigned long width, unsigned lo
     ::glScissor(x, y, width, height);
 }
 
-void GraphicsContext3D::shaderSource(CanvasShader* shader, const String& string)
+void GraphicsContext3D::shaderSource(WebGLShader* shader, const String& string)
 {
-    if (!shader)
-        return;
+    ASSERT(shader);
     
     ensureContext(m_contextObj);
     const CString& cs = string.utf8();
@@ -889,19 +878,17 @@ void GraphicsContext3D::uniformMatrix4fv(long location, bool transpose, float* a
     ::glUniformMatrix4fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::useProgram(CanvasProgram* program)
+void GraphicsContext3D::useProgram(WebGLProgram* program)
 {
-    if (!program)
-        return;
+    ASSERT(program);
     
     ensureContext(m_contextObj);
     ::glUseProgram((GLuint) program->object());
 }
 
-void GraphicsContext3D::validateProgram(CanvasProgram* program)
+void GraphicsContext3D::validateProgram(WebGLProgram* program)
 {
-    if (!program)
-        return;
+    ASSERT(program);
     
     ensureContext(m_contextObj);
     ::glValidateProgram((GLuint) program->object());
@@ -967,567 +954,156 @@ void GraphicsContext3D::viewport(long x, long y, unsigned long width, unsigned l
     ::glViewport(static_cast<GLint>(x), static_cast<GLint>(y), static_cast<GLsizei>(width), static_cast<GLsizei>(height));
 }
 
-static int sizeForGetParam(unsigned long pname)
-{
-    switch(pname) {
-        case GL_ACTIVE_TEXTURE:                  return 1;
-        case GL_ALIASED_LINE_WIDTH_RANGE:        return 2;
-        case GL_ALIASED_POINT_SIZE_RANGE:        return 2;
-        case GL_ALPHA_BITS:                      return 1;
-        case GL_ARRAY_BUFFER_BINDING:            return 1; // (* actually a CanvasBuffer*)
-        case GL_BLEND:                           return 1;
-        case GL_BLEND_COLOR:                     return 4;
-        case GL_BLEND_DST_ALPHA:                 return 1;
-        case GL_BLEND_DST_RGB:                   return 1;
-        case GL_BLEND_EQUATION_ALPHA:            return 1;
-        case GL_BLEND_EQUATION_RGB:              return 1;
-        case GL_BLEND_SRC_ALPHA:                 return 1;
-        case GL_BLEND_SRC_RGB:                   return 1;
-        case GL_BLUE_BITS:                       return 1;
-        case GL_COLOR_CLEAR_VALUE:               return 4;
-        case GL_COLOR_WRITEMASK:                 return 4;
-        case GL_COMPRESSED_TEXTURE_FORMATS:      return GL_NUM_COMPRESSED_TEXTURE_FORMATS;
-        case GL_CULL_FACE:                       return 1;
-        case GL_CULL_FACE_MODE:                  return 1;
-        case GL_CURRENT_PROGRAM:                 return 1; // (* actually a CanvasProgram*)
-        case GL_DEPTH_BITS:                      return 1;
-        case GL_DEPTH_CLEAR_VALUE:               return 1;
-        case GL_DEPTH_FUNC:                      return 1;
-        case GL_DEPTH_RANGE:                     return 2;
-        case GL_DEPTH_TEST:                      return 1;
-        case GL_DEPTH_WRITEMASK:                 return 1;
-        case GL_DITHER:                          return 1;
-        case GL_ELEMENT_ARRAY_BUFFER_BINDING:    return 1; // (* actually a CanvasBuffer*)
-        case GL_FRAMEBUFFER_BINDING_EXT:         return 1; // (* actually a CanvasFramebuffer*)
-        case GL_FRONT_FACE:                      return 1;
-        case GL_GENERATE_MIPMAP_HINT:            return 1;
-        case GL_GREEN_BITS:                      return 1;
-            //case GL_IMPLEMENTATION_COLOR_READ_FORMAT:return 1;
-            //case GL_IMPLEMENTATION_COLOR_READ_TYPE:  return 1;
-        case GL_LINE_WIDTH:                      return 1;
-        case GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS:return 1;
-        case GL_MAX_CUBE_MAP_TEXTURE_SIZE:       return 1;
-            //case GL_MAX_FRAGMENT_UNIFORM_VECTORS:    return 1;
-        case GL_MAX_RENDERBUFFER_SIZE_EXT:       return 1;
-        case GL_MAX_TEXTURE_IMAGE_UNITS:         return 1;
-        case GL_MAX_TEXTURE_SIZE:                return 1;
-            //case GL_MAX_VARYING_VECTORS:             return 1;
-        case GL_MAX_VERTEX_ATTRIBS:              return 1;
-        case GL_MAX_VERTEX_TEXTURE_IMAGE_UNITS:  return 1;
-            //case GL_MAX_VERTEX_UNIFORM_VECTORS:      return 1;
-        case GL_MAX_VIEWPORT_DIMS:               return 2;
-        case GL_NUM_COMPRESSED_TEXTURE_FORMATS:  return 1;
-            //case GL_NUM_SHADER_BINARY_FORMATS:       return 1;
-        case GL_PACK_ALIGNMENT:                  return 1;
-        case GL_POLYGON_OFFSET_FACTOR:           return 1;
-        case GL_POLYGON_OFFSET_FILL:             return 1;
-        case GL_POLYGON_OFFSET_UNITS:            return 1;
-        case GL_RED_BITS:                        return 1;
-        case GL_RENDERBUFFER_BINDING_EXT:        return 1; // (* actually a CanvasRenderbuffer*)
-        case GL_SAMPLE_BUFFERS:                  return 1;
-        case GL_SAMPLE_COVERAGE_INVERT:          return 1;
-        case GL_SAMPLE_COVERAGE_VALUE:           return 1;
-        case GL_SAMPLES:                         return 1;
-        case GL_SCISSOR_BOX:                     return 4;
-        case GL_SCISSOR_TEST:                    return 1;
-            //case GL_SHADER_BINARY_FORMATS:           return GL_NUM_SHADER_BINARY_FORMATS;
-            //case GL_SHADER_COMPILER:                 return 1;
-        case GL_STENCIL_BACK_FAIL:               return 1;
-        case GL_STENCIL_BACK_FUNC:               return 1;
-        case GL_STENCIL_BACK_PASS_DEPTH_FAIL:    return 1;
-        case GL_STENCIL_BACK_PASS_DEPTH_PASS:    return 1;
-        case GL_STENCIL_BACK_REF:                return 1;
-        case GL_STENCIL_BACK_VALUE_MASK:         return 1;
-        case GL_STENCIL_BACK_WRITEMASK:          return 1;
-        case GL_STENCIL_BITS:                    return 1;
-        case GL_STENCIL_CLEAR_VALUE:             return 1;
-        case GL_STENCIL_FAIL:                    return 1;
-        case GL_STENCIL_FUNC:                    return 1;
-        case GL_STENCIL_PASS_DEPTH_FAIL:         return 1;
-        case GL_STENCIL_PASS_DEPTH_PASS:         return 1;
-        case GL_STENCIL_REF:                     return 1;
-        case GL_STENCIL_TEST:                    return 1;
-        case GL_STENCIL_VALUE_MASK:              return 1;
-        case GL_STENCIL_WRITEMASK:               return 1;
-        case GL_SUBPIXEL_BITS:                   return 1;
-        case GL_TEXTURE_BINDING_2D:              return 1; // (* actually a CanvasTexture*)
-        case GL_TEXTURE_BINDING_CUBE_MAP:        return 1; // (* actually a CanvasTexture*)
-        case GL_UNPACK_ALIGNMENT:                return 1;
-        case GL_VIEWPORT:                        return 4;
-    }
-    
-    return -1;
-}
-
-bool GraphicsContext3D::getBoolean(unsigned long pname)
-{
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
-    ensureContext(m_contextObj);
-    
-    bool isAlloced = false;
-    GLboolean buf[4];
-    GLboolean* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLboolean*) malloc(size * sizeof(GLboolean));
-        isAlloced = true;
-    }
-            
-    ::glGetBooleanv(pname, pbuf);
-    
-    bool value = pbuf[0];
-
-    if (isAlloced)
-        free(pbuf);
-    
-    return value;
-}
-
-PassRefPtr<CanvasUnsignedByteArray> GraphicsContext3D::getBooleanv(unsigned long pname)
-{
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
-    ensureContext(m_contextObj);
-    
-    RefPtr<CanvasUnsignedByteArray> array = CanvasUnsignedByteArray::create(size);
-    bool isAlloced = false;
-    GLboolean buf[4];
-    GLboolean* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLboolean*) malloc(size * sizeof(GLboolean));
-        isAlloced = true;
-    }
-            
-    ::glGetBooleanv(pname, pbuf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<unsigned char>(pbuf[i]));
-            
-    if (isAlloced)
-        free(pbuf);
-    
-    return array;
-}
-
-float GraphicsContext3D::getFloat(unsigned long pname)
+void GraphicsContext3D::getBooleanv(unsigned long pname, unsigned char* value)
 {
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    bool isAlloced = false;
-    GLfloat buf[4];
-    GLfloat* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLfloat*) malloc(size * sizeof(GLfloat));
-        isAlloced = true;
-    }
-            
-    ::glGetFloatv(pname, pbuf);
-    
-    float value = pbuf[0];
-
-    if (isAlloced)
-        free(pbuf);
-    
-    return value;
+    ::glGetBooleanv(pname, value);
 }
 
-PassRefPtr<CanvasFloatArray> GraphicsContext3D::getFloatv(unsigned long pname)
+void GraphicsContext3D::getBufferParameteriv(unsigned long target, unsigned long pname, int* value)
 {
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(size);
-    bool isAlloced = false;
-    GLfloat buf[4];
-    GLfloat* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLfloat*) malloc(size * sizeof(GLfloat));
-        isAlloced = true;
-    }
-            
-    ::glGetFloatv(pname, pbuf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<float>(pbuf[i]));
-            
-    if (isAlloced)
-        free(pbuf);
-    
-    return array;
+    ::glGetBufferParameteriv(target, pname, value);
 }
 
-int GraphicsContext3D::getInteger(unsigned long pname)
+void GraphicsContext3D::getFloatv(unsigned long pname, float* value)
 {
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    bool isAlloced = false;
-    GLint buf[4];
-    GLint* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLint*) malloc(size * sizeof(GLint));
-        isAlloced = true;
-    }
-            
-    ::glGetIntegerv(pname, pbuf);
-    
-    int value = pbuf[0];
-
-    if (isAlloced)
-        free(pbuf);
-    
-    return value;
+    ::glGetFloatv(pname, value);
 }
 
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getIntegerv(unsigned long pname)
+void GraphicsContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname, int* value)
 {
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(size);
-    bool isAlloced = false;
-    GLint buf[4];
-    GLint* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLint*) malloc(size * sizeof(GLint));
-        isAlloced = true;
-    }
-            
-    ::glGetIntegerv(pname, pbuf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<int>(pbuf[i]));
-            
-    if (isAlloced)
-        free(pbuf);
-    
-    return array;
+    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, value);
 }
 
-int GraphicsContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getIntegerv(unsigned long pname, int* value)
 {
     ensureContext(m_contextObj);
-    GLint data;
-    ::glGetBufferParameteriv(target, pname, &data);
-    return data;
+    ::glGetIntegerv(pname, value);
 }
 
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getProgramiv(WebGLProgram* program, unsigned long pname, int* value)
 {
     ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetBufferParameteriv(target, pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
+    ::glGetProgramiv((GLuint) program->object(), pname, value);
 }
 
-int GraphicsContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
+String GraphicsContext3D::getProgramInfoLog(WebGLProgram* program)
 {
-    ensureContext(m_contextObj);
-    GLint data;
-    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, &data);
-    return data;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
-}
-
-int GraphicsContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    GLint data;
-    ::glGetProgramiv((GLuint) program->object(), pname, &data);
-    return data;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetProgramiv((GLuint) program->object(), pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
-}
-
-String GraphicsContext3D::getProgramInfoLog(CanvasProgram* program)
-{
-    if (!program)
-        return String();
+    ASSERT(program);
     
     ensureContext(m_contextObj);
     GLint length;
     ::glGetProgramiv((GLuint) program->object(), GL_INFO_LOG_LENGTH, &length);
     
     GLsizei size;
-    GLchar* info = (GLchar*) malloc(length);
+    GLchar* info = (GLchar*) fastMalloc(length);
+    if (!info)
+        return "";
+
     ::glGetProgramInfoLog((GLuint) program->object(), length, &size, info);
     String s(info);
-    free(info);
+    fastFree(info);
     return s;
 }
 
-int GraphicsContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    GLint data;
-    ::glGetBufferParameteriv(target, pname, &data);
-    return data;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname, int* value)
 {
     ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetBufferParameteriv(target, pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
+    ::glGetRenderbufferParameterivEXT(target, pname, value);
 }
 
-int GraphicsContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
+void GraphicsContext3D::getShaderiv(WebGLShader* shader, unsigned long pname, int* value)
 {
-    if (!shader)
-        return 0;
-    
-    ensureContext(m_contextObj);
-    GLint data;
-    ::glGetShaderiv((GLuint) shader->object(), pname, &data);
-    return data;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
-{
-    if (!shader)
-        return 0;
+    ASSERT(shader);
     
     ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetShaderiv((GLuint) shader->object(), pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
+    ::glGetShaderiv((GLuint) shader->object(), pname, value);
 }
 
-String GraphicsContext3D::getShaderInfoLog(CanvasShader* shader)
+String GraphicsContext3D::getShaderInfoLog(WebGLShader* shader)
 {
-    if (!shader)
-        return String();
+    ASSERT(shader);
     
     ensureContext(m_contextObj);
     GLint length;
     ::glGetShaderiv((GLuint) shader->object(), GL_INFO_LOG_LENGTH, &length);
     
     GLsizei size;
-    GLchar* info = (GLchar*) malloc(length);
+    GLchar* info = (GLchar*) fastMalloc(length);
+    if (!info)
+        return "";
+        
     ::glGetShaderInfoLog((GLuint) shader->object(), length, &size, info);
     String s(info);
-    free(info);
+    fastFree(info);
     return s;
 }
 
-String GraphicsContext3D::getShaderSource(CanvasShader* shader)
+String GraphicsContext3D::getShaderSource(WebGLShader* shader)
 {
-    if (!shader)
-        return String();
-    
+    ASSERT(shader);
+
     ensureContext(m_contextObj);
     GLint length;
     ::glGetShaderiv((GLuint) shader->object(), GL_SHADER_SOURCE_LENGTH, &length);
     
     GLsizei size;
-    GLchar* info = (GLchar*) malloc(length);
+    GLchar* info = (GLchar*) fastMalloc(length);
+    if (!info)
+        return "";
+        
     ::glGetShaderSource((GLuint) shader->object(), length, &size, info);
     String s(info);
-    free(info);
+    fastFree(info);
     return s;
 }
 
 
-float GraphicsContext3D::getTexParameterf(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getTexParameterfv(unsigned long target, unsigned long pname, float* value)
 {
     ensureContext(m_contextObj);
-    GLfloat data;
-    ::glGetTexParameterfv(target, pname, &data);
-    return data;
+    ::glGetTexParameterfv(target, pname, value);
 }
 
-PassRefPtr<CanvasFloatArray> GraphicsContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getTexParameteriv(unsigned long target, unsigned long pname, int* value)
 {
     ensureContext(m_contextObj);
-    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(1);
-    GLfloat data;
-    ::glGetTexParameterfv(target, pname, &data);
-    array->set(0, static_cast<float>(data));
-    
-    return array;
+    ::glGetTexParameteriv(target, pname, value);
 }
 
-int GraphicsContext3D::getTexParameteri(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getUniformfv(WebGLProgram* program, long location, float* value)
 {
     ensureContext(m_contextObj);
-    GLint data;
-    ::glGetTexParameteriv(target, pname, &data);
-    return data;
+    ::glGetUniformfv((GLuint) program->object(), location, value);
 }
 
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getUniformiv(WebGLProgram* program, long location, int* value)
 {
     ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetTexParameteriv(target, pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
-}
-
-float GraphicsContext3D::getUniformf(CanvasProgram* program, long location)
-{
-    // FIXME: We need to query glGetUniformLocation to determine the size needed
-    UNUSED_PARAM(program);
-    UNUSED_PARAM(location);
-    notImplemented();
-    return 0;
+    ::glGetUniformiv((GLuint) program->object(), location, value);
 }
 
-PassRefPtr<CanvasFloatArray> GraphicsContext3D::getUniformfv(CanvasProgram* program, long location)
+long GraphicsContext3D::getUniformLocation(WebGLProgram* program, const String& name)
 {
-    // FIXME: We need to query glGetUniformLocation to determine the size needed
-    UNUSED_PARAM(program);
-    UNUSED_PARAM(location);
-    notImplemented();
-    return 0;
-}
-
-int GraphicsContext3D::getUniformi(CanvasProgram* program, long location)
-{
-    // FIXME: We need to query glGetUniformLocation to determine the size needed
-    UNUSED_PARAM(program);
-    UNUSED_PARAM(location);
-    notImplemented();
-    return 0;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getUniformiv(CanvasProgram* program, long location)
-{
-    // FIXME: We need to query glGetUniformLocation to determine the size needed
-    UNUSED_PARAM(program);
-    UNUSED_PARAM(location);
-    notImplemented();
-    return 0;
-}
-
-long GraphicsContext3D::getUniformLocation(CanvasProgram* program, const String& name)
-{
-    if (!program)
-        return -1;
+    ASSERT(program);
     
     ensureContext(m_contextObj);
     return ::glGetUniformLocation((GLuint) program->object(), name.utf8().data());
 }
 
-static int sizeForGetVertexAttribParam(unsigned long pname)
-{
-    switch(pname) {
-        case GL_VERTEX_ATTRIB_ARRAY_BUFFER_BINDING:     return 1; // (* actually a CanvasBuffer*)
-        case GL_VERTEX_ATTRIB_ARRAY_ENABLED:            return 1;
-        case GL_VERTEX_ATTRIB_ARRAY_SIZE:               return 1;
-        case GL_VERTEX_ATTRIB_ARRAY_STRIDE:             return 1;
-        case GL_VERTEX_ATTRIB_ARRAY_TYPE:               return 1;
-        case GL_VERTEX_ATTRIB_ARRAY_NORMALIZED:         return 1;
-        case GL_CURRENT_VERTEX_ATTRIB:                  return 4;
-    }
-    
-    return -1;
-}
-
-float GraphicsContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    GLfloat buf[4];
-    ::glGetVertexAttribfv(index, pname, buf);
-    return buf[0];
-}
-
-PassRefPtr<CanvasFloatArray> GraphicsContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
-{
-    int size = sizeForGetVertexAttribParam(pname);
-    if (size < 1) 
-        return 0;
-    
-    ensureContext(m_contextObj);
-    
-    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(size);
-    GLfloat buf[4];
-    ::glGetVertexAttribfv(index, pname, buf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<float>(buf[i]));
-    
-    return array;
-}
-
-int GraphicsContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
+void GraphicsContext3D::getVertexAttribfv(unsigned long index, unsigned long pname, float* value)
 {
     ensureContext(m_contextObj);
-    GLint buf[4];
-    ::glGetVertexAttribiv(index, pname, buf);
-    return buf[0];
+    ::glGetVertexAttribfv(index, pname, value);
 }
 
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
+void GraphicsContext3D::getVertexAttribiv(unsigned long index, unsigned long pname, int* value)
 {
-    int size = sizeForGetVertexAttribParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(size);
-    GLint buf[4];
-    ::glGetVertexAttribiv(index, pname, buf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<int>(buf[i]));
-    
-    return array;
+    ::glGetVertexAttribiv(index, pname, value);
 }
 
 long GraphicsContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
@@ -1552,18 +1128,21 @@ static void imageToTexture(Image* image, unsigned target, unsigned level)
     size_t textureWidth = CGImageGetWidth(textureImage);
     size_t textureHeight = CGImageGetHeight(textureImage);
     
-    GLubyte* textureData = (GLubyte*) malloc(textureWidth * textureHeight * 4);
+    GLubyte* textureData = (GLubyte*) fastMalloc(textureWidth * textureHeight * 4);
+    if (!textureData)
+        return;
+        
     CGContextRef textureContext = CGBitmapContextCreate(textureData, textureWidth, textureHeight, 8, textureWidth * 4, 
                                                         CGImageGetColorSpace(textureImage), kCGImageAlphaPremultipliedLast);
-    
+    CGContextSetBlendMode(textureContext, kCGBlendModeCopy);
     CGContextDrawImage(textureContext, CGRectMake(0, 0, (CGFloat)textureWidth, (CGFloat)textureHeight), textureImage);
     CGContextRelease(textureContext);
     
     ::glTexImage2D(target, level, GL_RGBA, textureWidth, textureHeight, 0, GL_RGBA, GL_UNSIGNED_BYTE, textureData);
-    free(textureData);
+    fastFree(textureData);
 }
 
-int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, CanvasArray* pixels)
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, WebGLArray* pixels)
 {
     // FIXME: Need to do bounds checking on the buffer here.
     ::glTexImage2D(target, level, internalformat, width, height, border, format, type, pixels->baseAddress());
@@ -1585,39 +1164,15 @@ int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned inte
     return -1;
 }
 
-int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image, bool flipY, bool premultiplyAlpha)
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, Image* image, bool flipY, bool premultiplyAlpha)
 {
     // FIXME: need to support flipY and premultiplyAlpha
     UNUSED_PARAM(flipY);
     UNUSED_PARAM(premultiplyAlpha);
-    
-    if (!image)
-        return -1;
+    ASSERT(image);
     
     ensureContext(m_contextObj);
-    CachedImage* cachedImage = image->cachedImage();
-    if (!cachedImage)
-        return -1;
-    
-    imageToTexture(cachedImage->image(), target, level);
-    return 0;
-}
-
-int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha)
-{
-    // FIXME: need to support flipY and premultiplyAlpha
-    UNUSED_PARAM(flipY);
-    UNUSED_PARAM(premultiplyAlpha);
-    
-    if (!canvas)
-        return -1;
-    
-    ensureContext(m_contextObj);
-    ImageBuffer* buffer = canvas->buffer();
-    if (!buffer)
-        return -1;
-    
-    imageToTexture(buffer->image(), target, level);
+    imageToTexture(image, target, level);
     return 0;
 }
 
@@ -1634,7 +1189,7 @@ int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElem
     return -1;
 }
 
-int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, unsigned format, unsigned type, CanvasArray* pixels)
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, unsigned format, unsigned type, WebGLArray* pixels)
 {
     // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
     UNUSED_PARAM(target);
@@ -1664,7 +1219,7 @@ int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned x
     return -1;
 }
 
-int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLImageElement* image, bool flipY, bool premultiplyAlpha)
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, Image* image, bool flipY, bool premultiplyAlpha)
 {
     // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
     UNUSED_PARAM(target);
@@ -1681,23 +1236,6 @@ int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned x
     return -1;
 }
 
-int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha)
-{
-    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
-    UNUSED_PARAM(target);
-    UNUSED_PARAM(level);
-    UNUSED_PARAM(xoff);
-    UNUSED_PARAM(yoff);
-    UNUSED_PARAM(width);
-    UNUSED_PARAM(height);
-    UNUSED_PARAM(canvas);
-
-    // FIXME: need to support flipY and premultiplyAlpha    
-    UNUSED_PARAM(flipY);
-    UNUSED_PARAM(premultiplyAlpha);
-    return -1;
-}
-
 int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLVideoElement* video, bool flipY, bool premultiplyAlpha)
 {
     // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
@@ -1745,7 +1283,7 @@ unsigned GraphicsContext3D::createRenderbuffer()
     return o;
 }
 
-unsigned GraphicsContext3D::createShader(ShaderType type)
+unsigned GraphicsContext3D::createShader(unsigned long type)
 {
     ensureContext(m_contextObj);
     return glCreateShader((type == FRAGMENT_SHADER) ? GL_FRAGMENT_SHADER : GL_VERTEX_SHADER);
@@ -1817,6 +1355,11 @@ int GraphicsContext3D::sizeInBytes(int type)
     }
 }
 
+void GraphicsContext3D::synthesizeGLError(unsigned long error)
+{
+    m_syntheticErrors.add(error);
+}
+
 }
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.h b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
index 8cf51b4..8024091 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.h
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
@@ -54,6 +54,7 @@ public:
     // for hosting this GraphicsLayer in a native layer hierarchy
     virtual NativeLayer nativeLayer() const;
 
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
     virtual void addChild(GraphicsLayer*);
     virtual void addChildAtIndex(GraphicsLayer*, int index);
     virtual void addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling);
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
index b351956..dea6bfc 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
@@ -47,6 +47,7 @@
 #import "WebLayer.h"
 #import "WebTiledLayer.h"
 #import <limits.h>
+#import <objc/objc-auto.h>
 #import <wtf/CurrentTime.h>
 #import <wtf/UnusedParam.h>
 #import <wtf/RetainPtr.h>
@@ -298,6 +299,18 @@ static void clearLayerBackgroundColor(PlatformLayer* layer)
     [layer setBackgroundColor:0];
 }
 
+static void safeSetSublayers(CALayer* layer, NSArray* sublayers)
+{
+    // Workaround for <rdar://problem/7390716>: -[CALayer setSublayers:] crashes if sublayers is an empty array, or nil, under GC.
+    if (objc_collectingEnabled() && ![sublayers count]) {
+        while ([[layer sublayers] count])
+            [[[layer sublayers] objectAtIndex:0] removeFromSuperlayer];
+        return;
+    }
+    
+    [layer setSublayers:sublayers];
+}
+
 static bool caValueFunctionSupported()
 {
     static bool sHaveValueFunction = [CAPropertyAnimation instancesRespondToSelector:@selector(setValueFunction:)];
@@ -315,18 +328,6 @@ GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayer::compositingCoord
     return CompositingCoordinatesBottomUp;
 }
 
-bool GraphicsLayer::showDebugBorders()
-{
-    static bool showDebugBorders = [[NSUserDefaults standardUserDefaults] boolForKey:@"WebCoreLayerBorders"];
-    return showDebugBorders;
-}
-
-bool GraphicsLayer::showRepaintCounter()
-{
-    static bool showRepaintCounter = [[NSUserDefaults standardUserDefaults] boolForKey:@"WebCoreLayerRepaintCounter"];
-    return showRepaintCounter;
-}
-
 static NSDictionary* nullActionsDictionary()
 {
     NSNull* nullValue = [NSNull null];
@@ -352,13 +353,13 @@ PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
 }
 
 GraphicsLayerCA::GraphicsLayerCA(GraphicsLayerClient* client)
-: GraphicsLayer(client)
-, m_contentsLayerPurpose(NoContentsLayer)
-, m_contentsLayerHasBackgroundColor(false)
-, m_uncommittedChanges(NoChange)
+    : GraphicsLayer(client)
+    , m_contentsLayerPurpose(NoContentsLayer)
+    , m_contentsLayerHasBackgroundColor(false)
+    , m_uncommittedChanges(NoChange)
 #if ENABLE(3D_CANVAS)
-, m_platformGraphicsContext3D(NullPlatformGraphicsContext3D)
-, m_platformTexture(NullPlatform3DObject)
+    , m_platformGraphicsContext3D(NullPlatformGraphicsContext3D)
+    , m_platformTexture(NullPlatform3DObject)
 #endif
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS
@@ -409,6 +410,15 @@ NativeLayer GraphicsLayerCA::nativeLayer() const
     return m_layer.get();
 }
 
+bool GraphicsLayerCA::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    bool childrenChanged = GraphicsLayer::setChildren(children);
+    if (childrenChanged)
+        noteLayerPropertyChanged(ChildrenChanged);
+    
+    return childrenChanged;
+}
+
 void GraphicsLayerCA::addChild(GraphicsLayer* childLayer)
 {
     GraphicsLayer::addChild(childLayer);
@@ -882,17 +892,16 @@ void GraphicsLayerCA::updateSublayerList()
     [newSublayers makeObjectsPerformSelector:@selector(removeFromSuperlayer)];
 
     if (m_transformLayer) {
-        [m_transformLayer.get() setSublayers:newSublayers];
+        safeSetSublayers(m_transformLayer.get(), newSublayers);
 
         if (m_contentsLayer) {
             // If we have a transform layer, then the contents layer is parented in the 
             // primary layer (which is itself a child of the transform layer).
-            [m_layer.get() setSublayers:nil];
+            safeSetSublayers(m_layer.get(), nil);
             [m_layer.get() addSublayer:m_contentsLayer.get()];
         }
-    } else {
-        [m_layer.get() setSublayers:newSublayers];
-    }
+    } else
+        safeSetSublayers(m_layer.get(), newSublayers);
 
     [newSublayers release];
 }
@@ -1757,7 +1766,7 @@ void GraphicsLayerCA::swapFromOrToTiledLayer(bool useTiledLayer)
     }
     
     [m_layer.get() setLayerOwner:this];
-    [m_layer.get() setSublayers:[oldLayer.get() sublayers]];
+    safeSetSublayers(m_layer.get(), [oldLayer.get() sublayers]);
     
     [[oldLayer.get() superlayer] replaceSublayer:oldLayer.get() with:m_layer.get()];
 
diff --git a/WebCore/platform/graphics/mac/IconMac.mm b/WebCore/platform/graphics/mac/IconMac.mm
index 63abe59..aee7234 100644
--- a/WebCore/platform/graphics/mac/IconMac.mm
+++ b/WebCore/platform/graphics/mac/IconMac.mm
@@ -39,27 +39,32 @@ Icon::~Icon()
 {
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    // Don't pass relative filenames -- we don't want a result that depends on the current directory.
-    // Need 0U here to disambiguate String::operator[] from operator(NSString*, int)[]
-    if (filename.isEmpty() || filename[0U] != '/')
+    if (filenames.isEmpty())
         return 0;
 
-    NSImage* image = [[NSWorkspace sharedWorkspace] iconForFile:filename];
-    if (!image)
-        return 0;
+    bool useIconFromFirstFile;
+#ifdef BUILDING_ON_TIGER
+    // FIXME: find a better image for multiple files to use on Tiger.
+    useIconFromFirstFile = true;
+#else
+    useIconFromFirstFile = filenames.size() == 1;
+#endif
+    if (useIconFromFirstFile) {
+        // Don't pass relative filenames -- we don't want a result that depends on the current directory.
+        // Need 0U here to disambiguate String::operator[] from operator(NSString*, int)[]
+        if (filenames[0].isEmpty() || filenames[0][0U] != '/')
+            return 0;
 
-    return adoptRef(new Icon(image));
-}
+        NSImage* image = [[NSWorkspace sharedWorkspace] iconForFile:filenames[0]];
+        if (!image)
+            return 0;
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
-{
-    if (filenames.isEmpty())
-        return 0;
+        return adoptRef(new Icon(image));
+    }
 #ifdef BUILDING_ON_TIGER
-    // FIXME: find a better image to use on Tiger.
-    return createIconForFile(filenames[0]);
+    return 0;
 #else
     NSImage* image = [NSImage imageNamed:NSImageNameMultipleDocuments];
     if (!image)
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
index 0a63626..7aaf95d 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
@@ -101,6 +101,9 @@ private:
     void setVolume(float);
     void setPreservesPitch(bool);
 
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool);
+
     void setEndTime(float time);
 
     int dataRate() const;
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index 30d0c82..dfb5958 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -736,8 +736,13 @@ bool MediaPlayerPrivate::hasAudio() const
 }
 
 bool MediaPlayerPrivate::supportsFullscreen() const
-{   
+{
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     return true;
+#else
+    // See <rdar://problem/7389945>
+    return false;
+#endif
 }
 
 void MediaPlayerPrivate::setVolume(float volume)
@@ -746,6 +751,27 @@ void MediaPlayerPrivate::setVolume(float volume)
         [m_qtMovie.get() setVolume:volume];  
 }
 
+bool MediaPlayerPrivate::hasClosedCaptions() const
+{
+    if (!metaDataAvailable())
+        return false;
+    return wkQTMovieHasClosedCaptions(m_qtMovie.get());  
+}
+
+void MediaPlayerPrivate::setClosedCaptionsVisible(bool closedCaptionsVisible)
+{
+    if (metaDataAvailable()) {
+        wkQTMovieSetShowClosedCaptions(m_qtMovie.get(), closedCaptionsVisible);
+
+#if USE(ACCELERATED_COMPOSITING) && (!defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD))
+    if (closedCaptionsVisible && m_qtVideoLayer) {
+        // Captions will be rendered upsided down unless we flag the movie as flipped (again). See <rdar://7408440>.
+        [m_qtVideoLayer.get() setGeometryFlipped:YES];
+    }
+#endif
+    }
+}
+
 void MediaPlayerPrivate::setRate(float rate)
 {
     if (m_qtMovie)
@@ -1158,10 +1184,10 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& r)
             TextRun textRun(text.characters(), text.length());
             const Color color(255, 0, 0);
             context->scale(FloatSize(1.0f, -1.0f));    
-            context->setStrokeColor(color);
+            context->setStrokeColor(color, styleToUse->colorSpace());
             context->setStrokeStyle(SolidStroke);
             context->setStrokeThickness(1.0f);
-            context->setFillColor(color);
+            context->setFillColor(color, styleToUse->colorSpace());
             context->drawText(styleToUse->font(), textRun, IntPoint(2, -3));
         }
     }
diff --git a/WebCore/platform/graphics/opentype/OpenTypeSanitizer.cpp b/WebCore/platform/graphics/opentype/OpenTypeSanitizer.cpp
new file mode 100644
index 0000000..b4cdb09
--- /dev/null
+++ b/WebCore/platform/graphics/opentype/OpenTypeSanitizer.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(OPENTYPE_SANITIZER)
+#include "OpenTypeSanitizer.h"
+
+#include "SharedBuffer.h"
+#include "opentype-sanitiser.h"
+#include "ots-memory-stream.h"
+#include <wtf/OwnArrayPtr.h>
+
+namespace WebCore {
+
+PassRefPtr<SharedBuffer> OpenTypeSanitizer::sanitize()
+{
+    if (!m_buffer)
+        return 0;
+
+    // This is the largest web font size which we'll try to transcode.
+    static const size_t maxWebFontSize = 30 * 1024 * 1024; // 30 MB
+    if (m_buffer->size() > maxWebFontSize)
+        return 0;
+
+    // A transcoded font is usually smaller than an original font.
+    // However, it can be slightly bigger than the original one due to
+    // name table replacement and/or padding for glyf table.
+    static const size_t padLen = 20 * 1024; // 20 kB
+
+    OwnArrayPtr<unsigned char> transcodeRawBuffer(new unsigned char[m_buffer->size() + padLen]);
+    ots::MemoryStream output(transcodeRawBuffer.get(), m_buffer->size() + padLen);
+    if (!ots::Process(&output, reinterpret_cast<const uint8_t*>(m_buffer->data()), m_buffer->size()))
+        return 0;
+
+    const size_t transcodeLen = output.Tell();
+    return SharedBuffer::create(transcodeRawBuffer.get(), transcodeLen);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(OPENTYPE_SANITIZER)
diff --git a/WebCore/platform/graphics/opentype/OpenTypeSanitizer.h b/WebCore/platform/graphics/opentype/OpenTypeSanitizer.h
new file mode 100644
index 0000000..3f93448
--- /dev/null
+++ b/WebCore/platform/graphics/opentype/OpenTypeSanitizer.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef OpenTypeSanitizer_h
+#define OpenTypeSanitizer_h
+
+#if ENABLE(OPENTYPE_SANITIZER)
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class SharedBuffer;
+
+class OpenTypeSanitizer {
+public:
+    explicit OpenTypeSanitizer(SharedBuffer* buffer)
+        : m_buffer(buffer)
+    {
+    }
+
+    PassRefPtr<SharedBuffer> sanitize();
+
+private:
+    SharedBuffer* const m_buffer;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(OPENTYPE_SANITIZER)
+#endif // OpenTypeSanitizer_h
diff --git a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
index b2e3d92..3a60160 100644
--- a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
+++ b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
@@ -435,7 +435,7 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
     DWORD numFonts = 0;
     HANDLE fontHandle = AddFontMemResourceEx(rewrittenFontData.data(), fontData->size() + nameTableSize, 0, &numFonts);
 
-    if (fontHandle && numFonts != 1) {
+    if (fontHandle && numFonts < 1) {
         RemoveFontMemResourceEx(fontHandle);
         return 0;
     }
diff --git a/WebCore/platform/graphics/qt/FontCacheQt.cpp b/WebCore/platform/graphics/qt/FontCacheQt.cpp
index 1113eae..82fb709 100644
--- a/WebCore/platform/graphics/qt/FontCacheQt.cpp
+++ b/WebCore/platform/graphics/qt/FontCacheQt.cpp
@@ -34,260 +34,39 @@
 #include <wtf/ListHashSet.h>
 #include <wtf/StdLibExtras.h>
 
+#include <QFont>
+
 using namespace WTF;
 
 namespace WebCore {
 
-FontCache* fontCache()
+void FontCache::platformInit()
 {
-    DEFINE_STATIC_LOCAL(FontCache, globalFontCache, ());
-    return &globalFontCache;
 }
 
-FontCache::FontCache()
-{
-}
-
-void FontCache::getTraitsInFamily(const AtomicString&, Vector<unsigned>&)
-{
-}
-
-// This type must be consistent with FontPlatformData's ctor - the one which
-// gets FontDescription as it's parameter.
-class FontPlatformDataCacheKey {
-public:
-    FontPlatformDataCacheKey(const FontDescription& description)
-        : m_familyName()
-        , m_size(description.computedPixelSize())
-        , m_bold(false)
-        , m_italic(description.italic())
-        , m_smallCaps(description.smallCaps())
-        , m_hash(0)
-    {
-        // FIXME: Map all FontWeight values to QFont weights in FontPlatformData's ctor and follow it here
-        if (FontPlatformData::toQFontWeight(description.weight()) > QFont::Normal)
-            m_bold = true;
-
-        const FontFamily* family = &description.family();
-        while (family) {
-            m_familyName.append(family->family());
-            family = family->next();
-            if (family)
-                m_familyName.append(',');
-        }
-
-        computeHash();
-    }
-
-    FontPlatformDataCacheKey(const FontPlatformData& fontData)
-        : m_familyName(static_cast<String>(fontData.family()))
-        , m_size(fontData.pixelSize())
-        , m_bold(fontData.bold())
-        , m_italic(fontData.italic())
-        , m_smallCaps(fontData.smallCaps())
-        , m_hash(0)
-    {
-        computeHash();
-    }
-
-    FontPlatformDataCacheKey(HashTableDeletedValueType) : m_size(hashTableDeletedSize()) { }
-    bool isHashTableDeletedValue() const { return m_size == hashTableDeletedSize(); }
-
-    enum HashTableEmptyValueType { HashTableEmptyValue };
-
-    FontPlatformDataCacheKey(HashTableEmptyValueType)
-        : m_familyName()
-        , m_size(0)
-        , m_bold(false)
-        , m_italic(false)
-        , m_smallCaps(false)
-        , m_hash(0)
-    {
-    }
-
-    bool operator==(const FontPlatformDataCacheKey& other) const
-    {
-        if (m_hash != other.m_hash)
-            return false;
-
-        return equalIgnoringCase(m_familyName, other.m_familyName) && m_size == other.m_size &&
-            m_bold == other.m_bold && m_italic == other.m_italic && m_smallCaps == other.m_smallCaps;
-    }
-
-    unsigned hash() const
-    {
-        return m_hash;
-    }
-
-    void computeHash()
-    {
-        unsigned hashCodes[] = {
-            CaseFoldingHash::hash(m_familyName),
-            m_size | static_cast<unsigned>(m_bold << sizeof(unsigned) * 8 - 1)
-                | static_cast<unsigned>(m_italic) << sizeof(unsigned) *8 - 2
-                | static_cast<unsigned>(m_smallCaps) << sizeof(unsigned) * 8 - 3
-        };
-        m_hash = StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
-    }
-
-private:
-    String m_familyName;
-    int m_size;
-    bool m_bold;
-    bool m_italic;
-    bool m_smallCaps;
-    unsigned m_hash;
-
-    static unsigned hashTableDeletedSize() { return 0xFFFFFFFFU; }
-};
-
-struct FontPlatformDataCacheKeyHash {
-    static unsigned hash(const FontPlatformDataCacheKey& key)
-    {
-        return key.hash();
-    }
-
-    static bool equal(const FontPlatformDataCacheKey& a, const FontPlatformDataCacheKey& b)
-    {
-        return a == b;
-    }
-
-    static const bool safeToCompareToEmptyOrDeleted = true;
-};
-
-struct FontPlatformDataCacheKeyTraits : WTF::GenericHashTraits<FontPlatformDataCacheKey> {
-    static const bool needsDestruction = true;
-    static const FontPlatformDataCacheKey& emptyValue()
-    {
-        DEFINE_STATIC_LOCAL(FontPlatformDataCacheKey, key, (FontPlatformDataCacheKey::HashTableEmptyValue));
-        return key;
-    }
-    static void constructDeletedValue(FontPlatformDataCacheKey& slot)
-    {
-        new (&slot) FontPlatformDataCacheKey(HashTableDeletedValue);
-    }
-    static bool isDeletedValue(const FontPlatformDataCacheKey& value)
-    {
-        return value.isHashTableDeletedValue();
-    }
-};
-
-typedef HashMap<FontPlatformDataCacheKey, FontPlatformData*, FontPlatformDataCacheKeyHash, FontPlatformDataCacheKeyTraits> FontPlatformDataCache;
-
-// using Q_GLOBAL_STATIC leads to crash. TODO investigate the way to fix this.
-static FontPlatformDataCache* gFontPlatformDataCache = 0;
-
-FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& description, const AtomicString&, bool)
-{
-    if (!gFontPlatformDataCache)
-        gFontPlatformDataCache = new FontPlatformDataCache;
-
-    FontPlatformDataCacheKey key(description);
-    FontPlatformData* platformData = gFontPlatformDataCache->get(key);
-    if (!platformData) {
-        platformData = new FontPlatformData(description);
-        gFontPlatformDataCache->add(key, platformData);
-    }
-    return platformData;
-}
-
-typedef HashMap<FontPlatformDataCacheKey, std::pair<SimpleFontData*, unsigned>, FontPlatformDataCacheKeyHash, FontPlatformDataCacheKeyTraits> FontDataCache;
-
-static FontDataCache* gFontDataCache = 0;
-
-static const int cMaxInactiveFontData = 40;
-static const int cTargetInactiveFontData = 32;
-
-static ListHashSet<const SimpleFontData*>* gInactiveFontDataSet = 0;
-
-SimpleFontData* FontCache::getCachedFontData(const FontPlatformData* fontPlatformData)
-{
-    if (!gFontDataCache) {
-        gFontDataCache = new FontDataCache;
-        gInactiveFontDataSet = new ListHashSet<const SimpleFontData*>;
-    }
-
-    FontPlatformDataCacheKey key(*fontPlatformData);
-    FontDataCache::iterator it = gFontDataCache->find(key);
-    if (it == gFontDataCache->end()) {
-        SimpleFontData* fontData = new SimpleFontData(*fontPlatformData);
-        gFontDataCache->add(key, std::pair<SimpleFontData*, unsigned>(fontData, 1));
-        return fontData;
-    }
-    if (!it->second.second++) {
-        ASSERT(gInactiveFontDataSet->contains(it->second.first));
-        gInactiveFontDataSet->remove(it->second.first);
-    }
-    return it->second.first;
-}
-
-FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription&)
+const SimpleFontData* FontCache::getFontDataForCharacters(const Font&, const UChar*, int)
 {
     return 0;
 }
 
-void FontCache::releaseFontData(const WebCore::SimpleFontData* fontData)
+FontPlatformData* FontCache::getSimilarFontPlatformData(const Font& font)
 {
-    ASSERT(gFontDataCache);
-    ASSERT(!fontData->isCustomFont());
-
-    FontPlatformDataCacheKey key(fontData->platformData());
-    FontDataCache::iterator it = gFontDataCache->find(key);
-    ASSERT(it != gFontDataCache->end());
-    if (!--it->second.second) {
-        gInactiveFontDataSet->add(it->second.first);
-        if (gInactiveFontDataSet->size() > cMaxInactiveFontData)
-            purgeInactiveFontData(gInactiveFontDataSet->size() - cTargetInactiveFontData);
-    }
-}
-
-void FontCache::purgeInactiveFontData(int count)
-{
-    static bool isPurging;  // Guard against reentry when e.g. a deleted FontData releases its small caps FontData.
-    if (isPurging)
-        return;
-
-    isPurging = true;
-
-    ListHashSet<const SimpleFontData*>::iterator it = gInactiveFontDataSet->begin();
-    ListHashSet<const SimpleFontData*>::iterator end = gInactiveFontDataSet->end();
-    for (int i = 0; i < count && it != end; ++i, ++it) {
-        FontPlatformDataCacheKey key = (*it)->platformData();
-        pair<SimpleFontData*, unsigned> fontDataPair = gFontDataCache->take(key);
-        ASSERT(fontDataPair.first != 0);
-        ASSERT(!fontDataPair.second);
-        delete fontDataPair.first;
-
-        FontPlatformData* platformData = gFontPlatformDataCache->take(key);
-        if (platformData)
-            delete platformData;
-    }
-
-    if (it == end) {
-        // Removed everything
-        gInactiveFontDataSet->clear();
-    } else {
-        for (int i = 0; i < count; ++i)
-            gInactiveFontDataSet->remove(gInactiveFontDataSet->begin());
-    }
-
-    isPurging = false;
+    return 0;
 }
 
-void FontCache::addClient(FontSelector*)
+FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription& fontDescription)
 {
+    const AtomicString fallbackFamily = QFont(fontDescription.family().family()).lastResortFont();
+    return new FontPlatformData(fontDescription, fallbackFamily);
 }
 
-void FontCache::removeClient(FontSelector*)
+void FontCache::getTraitsInFamily(const AtomicString&, Vector<unsigned>&)
 {
 }
 
-void FontCache::invalidate()
+FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontDescription, const AtomicString& familyName)
 {
-    if (!gFontPlatformDataCache || !gFontDataCache)
-        return;
-
-    purgeInactiveFontData();
+    return new FontPlatformData(fontDescription, familyName);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp b/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp
index a19464e..6e9d053 100644
--- a/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp
@@ -43,7 +43,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
         font.setWeight(QFont::Bold);
     font.setItalic(italic);
 
-    return FontPlatformData(font, bold);
+    return FontPlatformData(font);
 }
 
 FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
diff --git a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp b/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
deleted file mode 100644
index 8e1e4f6..0000000
--- a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
-    Copyright (C) 2008 Holger Hans Peter Freyther
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-
-    Replacement of the stock FontFallbackList as Qt is going to find us a
-    replacement font, will do caching and the other stuff we implement in
-    WebKit.
-*/
-
-#include "config.h"
-#include "FontFallbackList.h"
-
-#include "Font.h"
-#include "FontCache.h"
-#include "SegmentedFontData.h"
-
-#include <QDebug>
-
-namespace WebCore {
-
-FontFallbackList::FontFallbackList()
-    : m_pageZero(0)
-    , m_cachedPrimarySimpleFontData(0)
-    , m_fontSelector(0)
-    , m_familyIndex(0)
-    , m_pitch(UnknownPitch)
-    , m_loadingCustomFonts(false)
-    , m_generation(0)
-{
-}
-
-void FontFallbackList::invalidate(WTF::PassRefPtr<WebCore::FontSelector> fontSelector)
-{
-    releaseFontData();
-    m_fontList.clear();
-    m_pageZero = 0;
-    m_pages.clear();
-    m_cachedPrimarySimpleFontData = 0;
-    m_familyIndex = 0;
-    m_pitch = UnknownPitch;
-    m_loadingCustomFonts = false;
-    m_fontSelector = fontSelector;
-    m_generation = 0;
-}
-
-void FontFallbackList::releaseFontData()
-{
-    unsigned numFonts = m_fontList.size();
-    for (unsigned i = 0; i < numFonts; ++i) {
-        if (m_fontList[i].second)
-            delete m_fontList[i].first;
-        else {
-            ASSERT(!m_fontList[i].first->isSegmented());
-            fontCache()->releaseFontData(static_cast<const SimpleFontData*>(m_fontList[i].first));
-        }
-    }
-}
-
-void FontFallbackList::determinePitch(const WebCore::Font* font) const
-{
-    const FontData* fontData = primaryFontData(font);
-    if (!fontData->isSegmented())
-        m_pitch = static_cast<const SimpleFontData*>(fontData)->pitch();
-    else {
-        const SegmentedFontData* segmentedFontData = static_cast<const SegmentedFontData*>(fontData);
-        unsigned numRanges = segmentedFontData->numRanges();
-        if (numRanges == 1)
-            m_pitch = segmentedFontData->rangeAt(0).fontData()->pitch();
-        else
-            m_pitch = VariablePitch;
-    }
-}
-
-const FontData* FontFallbackList::fontDataAt(const WebCore::Font* _font, unsigned index) const
-{
-    if (index != 0)
-        return 0;
-
-    // Search for the WebCore font that is already in the list
-    for (int i = m_fontList.size() - 1; i >= 0; --i) {
-        pair<const FontData*, bool> item = m_fontList[i];
-        // item.second means that the item was created locally or not
-        if (!item.second)
-            return item.first;
-    }
-
-    // Use the FontSelector to get a WebCore font and then fallback to Qt
-    const FontDescription& description = _font->fontDescription();
-    const FontFamily* family = &description.family();
-    while (family) {
-        if (m_fontSelector) {
-            FontData* data = m_fontSelector->getFontData(description, family->family());
-            if (data) {
-                if (data->isLoading())
-                    m_loadingCustomFonts = true;
-                if (!data->isCustomFont()) {
-                    // Custom fonts can be freed anytime so we must not hold them
-                    m_fontList.append(pair<const FontData*, bool>(data, false));
-                }
-                return data;
-            }
-        }
-        family = family->next();
-    }
-
-    if (m_fontList.size())
-        return m_fontList[0].first;
-
-    const FontData* result = new SimpleFontData(FontPlatformData(description, _font->wordSpacing(), _font->letterSpacing()), true);
-    m_fontList.append(pair<const FontData*, bool>(result, true));
-    return result;
-}
-
-const FontData* FontFallbackList::fontDataForCharacters(const WebCore::Font* font, const UChar*, int) const
-{
-    return primaryFontData(font);
-}
-
-void FontFallbackList::setPlatformFont(const WebCore::FontPlatformData&)
-{
-    m_familyIndex = cAllFamiliesScanned;
-}
-
-}
diff --git a/WebCore/platform/graphics/qt/FontPlatformData.h b/WebCore/platform/graphics/qt/FontPlatformData.h
index 92219fd..4a3f8bc 100644
--- a/WebCore/platform/graphics/qt/FontPlatformData.h
+++ b/WebCore/platform/graphics/qt/FontPlatformData.h
@@ -26,20 +26,62 @@
 
 #include "FontDescription.h"
 #include <QFont>
+#include <QHash>
 
 namespace WebCore {
 
 class String;
+class FontPlatformDataPrivate {
+public:
+    FontPlatformDataPrivate()
+        : refCount(1)
+        , size(font.pointSizeF())
+        , bold(font.bold())
+        , oblique(false)
+    {}
+    FontPlatformDataPrivate(const float size, const bool bold, const bool oblique)
+        : refCount(1)
+        , size(size)
+        , bold(bold)
+        , oblique(oblique)
+    {}
+    FontPlatformDataPrivate(const QFont& font)
+        : refCount(1)
+        , font(font)
+        , size(font.pointSizeF())
+        , bold(font.bold())
+        , oblique(false)
+    {}
+    unsigned refCount;
+    QFont font;
+    float size;
+    bool bold : 1;
+    bool oblique : 1;
+};
+
+
 
-class FontPlatformData
-{
+class FontPlatformData : public FastAllocBase {
 public:
-#if ENABLE(SVG_FONTS)
     FontPlatformData(float size, bool bold, bool oblique);
-#endif
-    FontPlatformData();
-    FontPlatformData(const FontDescription&, int wordSpacing = 0, int letterSpacing = 0);
-    FontPlatformData(const QFont&, bool bold);
+    FontPlatformData(const FontPlatformData &);
+    FontPlatformData(const FontDescription&, const AtomicString& familyName, int wordSpacing = 0, int letterSpacing = 0);
+    FontPlatformData(const QFont& font)
+        : m_data(new FontPlatformDataPrivate(font))
+    {}
+    FontPlatformData(WTF::HashTableDeletedValueType)
+        : m_data(reinterpret_cast<FontPlatformDataPrivate*>(-1))
+    {}
+
+    ~FontPlatformData();
+
+    FontPlatformData& operator=(const FontPlatformData&);
+    bool operator==(const FontPlatformData&) const;
+
+    bool isHashTableDeletedValue() const
+    {
+        return m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1);
+    }
 
     static inline QFont::Weight toQFontWeight(FontWeight fontWeight)
     {
@@ -62,22 +104,62 @@ public:
         }
     }
 
-    QFont font() const { return m_font; }
-    float size() const { return m_size; }
-    QString family() const { return m_font.family(); }
-    bool bold() const { return m_bold; }
-    bool italic() const { return m_font.italic(); }
-    bool smallCaps() const { return m_font.capitalization() == QFont::SmallCaps; }
-    int pixelSize() const { return m_font.pixelSize(); }
+    QFont font() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font;
+        return QFont();
+    }
+    float size() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->size;
+        return 0.0f;
+    }
+    QString family() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.family();
+        return QString();
+    }
+    bool bold() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->bold;
+        return false;
+    }
+    bool italic() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.italic();
+        return false;
+    }
+    bool smallCaps() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.capitalization() == QFont::SmallCaps;
+        return false;
+    }
+    int pixelSize() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.pixelSize();
+        return 0;
+    }
+    unsigned hash() const;
 
 #ifndef NDEBUG
     String description() const;
 #endif
-
-    float m_size;
-    bool m_bold;
-    bool m_oblique;
-    QFont m_font;
+private:
+    FontPlatformDataPrivate* m_data;
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp b/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
index 7709be6..2cc2fc6 100644
--- a/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
+++ b/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
@@ -26,56 +26,104 @@
 
 namespace WebCore {
 
-FontPlatformData::FontPlatformData(const FontDescription& description, int wordSpacing, int letterSpacing)
-    : m_size(0.0f)
-    , m_bold(false)
-    , m_oblique(false)
+static inline bool isEmtpyValue(const float size, const bool bold, const bool oblique)
 {
-    QString familyName;
+     // this is the empty value by definition of the trait FontDataCacheKeyTraits
+    return !bold && !oblique && size == 0.f;
+}
+
+FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
+{
+    if (isEmtpyValue(size, bold, oblique))
+        m_data = 0;
+    else
+        m_data = new FontPlatformDataPrivate(size, bold, oblique);
+}
+
+FontPlatformData::FontPlatformData(const FontPlatformData &other) : m_data(other.m_data)
+{
+    if (m_data && m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        ++m_data->refCount;
+}
+
+FontPlatformData::FontPlatformData(const FontDescription& description, const AtomicString& familyName, int wordSpacing, int letterSpacing)
+    : m_data(new FontPlatformDataPrivate())
+{
+    QString familyNames(familyName);
+    if (!familyName.isEmpty())
+        familyNames += QLatin1Char(',');
+
     const FontFamily* family = &description.family();
     while (family) {
-        familyName += family->family();
+        familyNames += family->family();
         family = family->next();
         if (family)
-            familyName += QLatin1Char(',');
+            familyNames += QLatin1Char(',');
     }
+    QFont& font = m_data->font;
+    font.setFamily(familyName);
+    font.setPixelSize(qRound(description.computedSize()));
+    font.setItalic(description.italic());
+    font.setWeight(toQFontWeight(description.weight()));
+    font.setWordSpacing(wordSpacing);
+    font.setLetterSpacing(QFont::AbsoluteSpacing, letterSpacing);
+    const bool smallCaps = description.smallCaps();
+    font.setCapitalization(smallCaps ? QFont::SmallCaps : QFont::MixedCase);
+
+    m_data->bold = font.bold();
+    m_data->size = font.pointSizeF();
+}
 
-    m_font.setFamily(familyName);
-    m_font.setPixelSize(qRound(description.computedSize()));
-    m_font.setItalic(description.italic());
-
-    m_font.setWeight(toQFontWeight(description.weight()));
-    m_bold = m_font.bold();
-
-    bool smallCaps = description.smallCaps();
-    m_font.setCapitalization(smallCaps ? QFont::SmallCaps : QFont::MixedCase);
-    m_font.setWordSpacing(wordSpacing);
-    m_font.setLetterSpacing(QFont::AbsoluteSpacing, letterSpacing);
-    m_size = m_font.pointSize();
+FontPlatformData::~FontPlatformData()
+{
+    if (!m_data || m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        return;
+    --m_data->refCount;
+    if (!m_data->refCount)
+        delete m_data;
 }
 
-FontPlatformData::FontPlatformData(const QFont& font, bool bold)
-    : m_size(font.pointSize())
-    , m_bold(bold)
-    , m_oblique(false)
-    , m_font(font)
+FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
 {
+    if (m_data == other.m_data)
+        return *this;
+    if (m_data && m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1)) {
+        --m_data->refCount;
+        if (!m_data->refCount)
+            delete m_data;
+    }
+    m_data = other.m_data;
+    if (m_data && m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        ++m_data->refCount;
+    return *this;
 }
 
-#if ENABLE(SVG_FONTS)
-FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
-    : m_size(size)
-    , m_bold(bold)
-    , m_oblique(oblique)
+bool FontPlatformData::operator==(const FontPlatformData& other) const
 {
+    if (m_data == other.m_data)
+        return true;
+
+    if (!m_data || !other.m_data
+        || m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1) || other.m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        return  false;
+
+    const bool equals = (m_data->size == other.m_data->size
+                         && m_data->bold == other.m_data->bold
+                         && m_data->oblique == other.m_data->oblique
+                         && m_data->font == other.m_data->font);
+    return equals;
 }
-#endif
 
-FontPlatformData::FontPlatformData()
-    : m_size(0.0f)
-    , m_bold(false)
-    , m_oblique(false)
+unsigned FontPlatformData::hash() const
 {
+    if (!m_data)
+        return 0;
+    if (m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        return 1;
+    return qHash(m_data->font.toString())
+           ^ qHash(*reinterpret_cast<quint32*>(&m_data->size))
+           ^ qHash(m_data->bold)
+           ^ qHash(m_data->oblique);
 }
 
 #ifndef NDEBUG
diff --git a/WebCore/platform/graphics/qt/FontQt.cpp b/WebCore/platform/graphics/qt/FontQt.cpp
index c5960ac..1e44626 100644
--- a/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/WebCore/platform/graphics/qt/FontQt.cpp
@@ -42,7 +42,6 @@
 
 #include <limits.h>
 
-#if QT_VERSION >= 0x040400
 namespace WebCore {
 
 static const QString qstring(const TextRun& run)
@@ -229,5 +228,3 @@ QFont Font::font() const
 
 }
 
-#endif
-
diff --git a/WebCore/platform/graphics/qt/FontQt43.cpp b/WebCore/platform/graphics/qt/FontQt43.cpp
deleted file mode 100644
index 45bf05d..0000000
--- a/WebCore/platform/graphics/qt/FontQt43.cpp
+++ /dev/null
@@ -1,354 +0,0 @@
-/*
-    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
-    Copyright (C) 2008 Holger Hans Peter Freyther
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "Font.h"
-#include "FontDescription.h"
-#include "FontFallbackList.h"
-#include "FontSelector.h"
-
-#include "GraphicsContext.h"
-#include <QTextLayout>
-#include <QPainter>
-#include <QFontMetrics>
-#include <QFontInfo>
-#include <qalgorithms.h>
-#include <qdebug.h>
-
-#include <limits.h>
-
-#if QT_VERSION < 0x040400
-
-namespace WebCore {
-
-struct TextRunComponent {
-    TextRunComponent() : font(0) {}
-    TextRunComponent(const UChar *start, int length, bool rtl, const QFont *font, int offset, bool sc = false);
-    TextRunComponent(int spaces, bool rtl, const QFont *font, int offset);
-
-    inline bool isSpace() const { return spaces != 0; }
-
-    QString string;
-    const QFont *font;
-    int width;
-    int offset;
-    int spaces;
-};
-
-TextRunComponent::TextRunComponent(const UChar *start, int length, bool rtl, const QFont *f, int o, bool sc)
-    : string(reinterpret_cast<const QChar*>(start), length)
-    , font(f)
-    , offset(o)
-    , spaces(0)
-{
-    if (sc)
-        string = string.toUpper();
-    string.prepend(rtl ? QChar(0x202e) : QChar(0x202d));
-    width = QFontMetrics(*font).width(string);
-}
-
-TextRunComponent::TextRunComponent(int s, bool rtl, const QFont *f, int o)
-    : string(s, QLatin1Char(' '))
-    , font(f)
-    , offset(o)
-    , spaces(s)
-{
-    string.prepend(rtl ? QChar(0x202e) : QChar(0x202d));
-    width = spaces * QFontMetrics(*font).width(QLatin1Char(' '));
-}
-
-
-static int generateComponents(Vector<TextRunComponent, 1024>* components, const Font &font, const TextRun &run)
-{
-//     qDebug() << "generateComponents" << QString((const QChar *)run.characters(), run.length());
-    int letterSpacing = font.letterSpacing();
-    int wordSpacing = font.wordSpacing();
-    bool smallCaps = font.fontDescription().smallCaps();
-    int padding = run.padding();
-    int numSpaces = 0;
-    if (padding) {
-        for (int i = 0; i < run.length(); i++)
-            if (Font::treatAsSpace(run[i]))
-                ++numSpaces;
-    }
-
-    int offset = 0;
-    const QFont *f = &font.font();
-    if (letterSpacing || smallCaps) {
-        // need to draw every letter on it's own
-        int start = 0;
-        if (Font::treatAsSpace(run[0])) {
-            int add = 0;
-            if (numSpaces) {
-                add = padding/numSpaces;
-                padding -= add;
-                --numSpaces;
-            }
-            components->append(TextRunComponent(1, run.rtl(), &font.font(), offset));
-            offset += add + letterSpacing + components->last().width;
-            start = 1;
-//         qDebug() << "space at 0" << offset;
-        } else if (smallCaps)
-            f = (QChar::category(run[0]) == QChar::Letter_Lowercase ? &font.scFont() : &font.font());
-
-        for (int i = 1; i < run.length(); ++i) {
-            uint ch = run[i];
-            if (QChar(ch).isHighSurrogate() && QChar(run[i-1]).isLowSurrogate())
-                ch = QChar::surrogateToUcs4(ch, run[i-1]);
-            if (QChar(ch).isLowSurrogate() || QChar::category(ch) == QChar::Mark_NonSpacing)
-                continue;
-            if (Font::treatAsSpace(run[i])) {
-                int add = 0;
-//                 qDebug() << "    treatAsSpace:" << i << start;
-                if (i - start > 0) {
-                    components->append(TextRunComponent(run.characters() + start, i - start,
-                                                        run.rtl(),
-                                                        f, offset, f == &font.scFont()));
-                    offset += components->last().width + letterSpacing;
-//                     qDebug() << "   appending(1) " << components->last().string << components->last().width;
-                }
-                if (numSpaces) {
-                    add = padding/numSpaces;
-                    padding -= add;
-                    --numSpaces;
-                }
-                components->append(TextRunComponent(1, run.rtl(), &font.font(), offset));
-                offset += wordSpacing + add + components->last().width + letterSpacing;
-                start = i + 1;
-                continue;
-            } else if (!letterSpacing) {
-//                 qDebug() << i << char(run[i]) << (QChar::category(ch) == QChar::Letter_Lowercase) <<
-//                     QFontInfo(*f).pointSizeF();
-                if (QChar::category(ch) == QChar::Letter_Lowercase) {
-                    if (f == &font.scFont())
-                        continue;
-                } else {
-                    if (f == &font.font())
-                        continue;
-                }
-            }
-            if (i - start > 0) {
-                components->append(TextRunComponent(run.characters() + start, i - start,
-                                                    run.rtl(),
-                                                    f, offset, f == &font.scFont()));
-                offset += components->last().width + letterSpacing;
-//                 qDebug() << "   appending(2) " << components->last().string << components->last().width;
-            }
-            if (smallCaps)
-                f = (QChar::category(ch) == QChar::Letter_Lowercase ? &font.scFont() : &font.font());
-            start = i;
-        }
-        if (run.length() - start > 0) {
-            components->append(TextRunComponent(run.characters() + start, run.length() - start,
-                                                run.rtl(),
-                                                f, offset, f == &font.scFont()));
-            offset += components->last().width;
-//             qDebug() << "   appending(3) " << components->last().string << components->last().width;
-        }
-        offset += letterSpacing;
-    } else {
-        int start = 0;
-        for (int i = 0; i < run.length(); ++i) {
-            if (Font::treatAsSpace(run[i])) {
-                if (i - start > 0) {
-                    components->append(TextRunComponent(run.characters() + start, i - start,
-                                                        run.rtl(),
-                                                        f, offset));
-                    offset += components->last().width;
-                }
-                int add = 0;
-                if (numSpaces) {
-                    add = padding/numSpaces;
-                    padding -= add;
-                    --numSpaces;
-                }
-                components->append(TextRunComponent(1, run.rtl(), &font.font(), offset));
-                offset += add + components->last().width;
-                if (i)
-                    offset += wordSpacing;
-                start = i + 1;
-            }
-        }
-        if (run.length() - start > 0) {
-            components->append(TextRunComponent(run.characters() + start, run.length() - start,
-                                                run.rtl(),
-                                                f, offset));
-            offset += components->last().width;
-        }
-    }
-    return offset;
-}
-
-void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const FloatPoint& point, int from, int to) const
-{
-    if (to < 0)
-        to = run.length();
-
-    QPainter *p = ctx->platformContext();
-    Color color = ctx->fillColor();
-    p->setPen(QColor(color));
-
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    if (from > 0 || to < run.length()) {
-        FloatRect clip = selectionRectForComplexText(run,
-                                              IntPoint(qRound(point.x()), qRound(point.y())),
-                                              QFontMetrics(font()).height(), from, to);
-        QRectF rect(clip.x(), clip.y() - ascent(), clip.width(), clip.height());
-        p->save();
-        p->setClipRect(rect.toRect());
-    }
-
-    if (run.rtl()) {
-        for (int i = 0; i < components.size(); ++i) {
-            if (!components.at(i).isSpace()) {
-                p->setFont(*components.at(i).font);
-                QPointF pt(point.x() + w - components.at(i).offset - components.at(i).width, point.y());
-                p->drawText(pt, components.at(i).string);
-            }
-        }
-    } else {
-        for (int i = 0; i < components.size(); ++i) {
-            if (!components.at(i).isSpace()) {
-                p->setFont(*components.at(i).font);
-                QPointF pt(point.x() + components.at(i).offset, point.y());
-                p->drawText(pt, components.at(i).string);
-            }
-        }
-    }
-    if (from > 0 || to < run.length())
-        p->restore();
-}
-
-float Font::floatWidthForComplexText(const TextRun& run) const
-{
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    return w;
-}
-
-int Font::offsetForPositionForComplexText(const TextRun& run, int position, bool includePartialGlyphs) const
-{
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    int offset = 0;
-    if (run.rtl()) {
-        for (int i = 0; i < components.size(); ++i) {
-            int xe = w - components.at(i).offset;
-            int xs = xe - components.at(i).width;
-            if (position >= xs) {
-                QTextLayout layout(components.at(i).string, *components.at(i).font);
-                layout.beginLayout();
-                QTextLine l = layout.createLine();
-                if (!l.isValid())
-                    return offset;
-
-                l.setLineWidth(INT_MAX / 256);
-                layout.endLayout();
-
-                if (position - xs >= l.width())
-                    return offset;
-                int cursor = l.xToCursor(position - xs);
-                if (cursor > 1)
-                    --cursor;
-                return offset + cursor;
-            } else
-                offset += components.at(i).string.length() - 1;
-        }
-    } else {
-        for (int i = 0; i < components.size(); ++i) {
-            int xs = components.at(i).offset;
-            int xe = xs + components.at(i).width;
-            if (position <= xe) {
-                QTextLayout layout(components.at(i).string, *components.at(i).font);
-                layout.beginLayout();
-                QTextLine l = layout.createLine();
-                if (!l.isValid())
-                    return offset;
-
-                l.setLineWidth(INT_MAX / 256);
-                layout.endLayout();
-
-                if (position - xs >= l.width())
-                    return offset + components.at(i).string.length() - 1;
-                int cursor = l.xToCursor(position - xs);
-                if (cursor > 1)
-                    --cursor;
-                return offset + cursor;
-            } else
-                offset += components.at(i).string.length() - 1;
-        }
-    }
-    return run.length();
-}
-
-static float cursorToX(const Vector<TextRunComponent, 1024>& components, int width, bool rtl, int cursor)
-{
-    int start = 0;
-    for (int i = 0; i < components.size(); ++i) {
-        if (start + components.at(i).string.length() - 1 < cursor) {
-            start += components.at(i).string.length() - 1;
-            continue;
-        }
-        int xs = components.at(i).offset;
-        if (rtl)
-            xs = width - xs - components.at(i).width;
-        QTextLayout layout(components.at(i).string, *components.at(i).font);
-        layout.beginLayout();
-        QTextLine l = layout.createLine();
-        if (!l.isValid())
-            return 0;
-
-        l.setLineWidth(INT_MAX / 256);
-        layout.endLayout();
-
-        return xs + l.cursorToX(cursor - start + 1);
-    }
-    return width;
-}
-
-FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& pt,
-                                     int h, int from, int to) const
-{
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    if (from == 0 && to == run.length())
-        return FloatRect(pt.x(), pt.y(), w, h);
-
-    float x1 = cursorToX(components, w, run.rtl(), from);
-    float x2 = cursorToX(components, w, run.rtl(), to);
-    if (x2 < x1)
-        qSwap(x1, x2);
-
-    return FloatRect(pt.x() + x1, pt.y(), x2 - x1, h);
-}
-
-int Font::lineGap() const
-{
-    return QFontMetrics(m_font).leading();
-}
-
-}
-
-#endif
diff --git a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 57a481a..a095476 100644
--- a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -256,8 +256,8 @@ GraphicsContext::GraphicsContext(PlatformGraphicsContext* context)
     setPaintingDisabled(!context);
     if (context) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), DeviceColorSpace);
+        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
     }
 }
 
@@ -639,24 +639,18 @@ void GraphicsContext::fillPath()
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    if ((m_common->state.fillColorSpace != SolidColorSpace)
-            || (fillColor().alpha())) {
+    if (m_common->state.fillPattern || m_common->state.fillGradient || fillColor().alpha()) {
         drawFilledShadowPath(this, p, &path);
-        switch (m_common->state.fillColorSpace) {
-        case SolidColorSpace:
-            if (fillColor().alpha())
-                p->fillPath(path, p->brush());
-            break;
-        case PatternColorSpace: {
+        if (m_common->state.fillPattern) {
             TransformationMatrix affine;
             p->fillPath(path, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-            break;
-        }
-        case GradientColorSpace:
+        } else if (m_common->state.fillGradient) {
             QBrush brush(*m_common->state.fillGradient->platformGradient());
             brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
             p->fillPath(path, brush);
-            break;
+        } else {
+            if (fillColor().alpha())
+                p->fillPath(path, p->brush());
         }
     }
     m_data->currentPath = QPainterPath();
@@ -672,8 +666,7 @@ void GraphicsContext::strokePath()
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    if ((m_common->state.strokeColorSpace != SolidColorSpace)
-            || (strokeColor().alpha())) {
+    if (m_common->state.strokePattern || m_common->state.strokeGradient || strokeColor().alpha()) {
         IntSize shadowSize;
         int shadowBlur;
         Color shadowColor;
@@ -685,26 +678,20 @@ void GraphicsContext::strokePath()
             p->strokePath(path, shadowPen);
             p->setWorldTransform(t);
         }
-        switch (m_common->state.strokeColorSpace) {
-        case SolidColorSpace:
-            if (strokeColor().alpha())
-                p->strokePath(path, pen);
-            break;
-        case PatternColorSpace: {
+        if (m_common->state.strokePattern) {
             TransformationMatrix affine;
             pen.setBrush(QBrush(m_common->state.strokePattern->createPlatformPattern(affine)));
             p->setPen(pen);
             p->strokePath(path, pen);
-            break;
-        }
-        case GradientColorSpace: {
+        } else if (m_common->state.strokeGradient) {
             QBrush brush(*m_common->state.strokeGradient->platformGradient());
             brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
             pen.setBrush(brush);
             p->setPen(pen);
             p->strokePath(path, pen);
-            break;
-        }
+        } else {
+            if (strokeColor().alpha())
+                p->strokePath(path, pen);
         }
     }
     m_data->currentPath = QPainterPath();
@@ -729,29 +716,23 @@ void GraphicsContext::fillRect(const FloatRect& rect)
 
     QPainter* p = m_data->p();
 
-    if ((m_common->state.fillColorSpace != SolidColorSpace)
-            || (fillColor().alpha())) {
+    if (m_common->state.fillPattern || m_common->state.fillGradient || fillColor().alpha()) {
         drawBorderlessRectShadow(this, p, rect);
-        switch (m_common->state.fillColorSpace) {
-        case SolidColorSpace:
-            if (fillColor().alpha())
-                p->fillRect(rect, p->brush());
-            break;
-        case PatternColorSpace: {
+        if (m_common->state.fillPattern) {
             TransformationMatrix affine;
             p->fillRect(rect, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-            break;
-        }
-        case GradientColorSpace:
+        } else if (m_common->state.fillGradient) {
             QBrush brush(*m_common->state.fillGradient->platformGradient());
             brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
             p->fillRect(rect, brush);
-            break;
+        } else {
+            if (fillColor().alpha())
+                p->fillRect(rect, p->brush());
         }
     }
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& c, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -762,7 +743,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
     p->fillRect(rect, m_data->solidColor);
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled() || !color.alpha())
         return;
@@ -886,7 +867,7 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
     return FloatRect(QRectF(result));
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize& size, int, const Color&)
+void GraphicsContext::setPlatformShadow(const IntSize& size, int, const Color&, ColorSpace)
 {
     // Qt doesn't support shadows natively, they are drawn manually in the draw*
     // functions
@@ -1225,7 +1206,7 @@ void GraphicsContext::setURLForRect(const KURL&, const IntRect&)
     notImplemented();
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& color)
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -1255,7 +1236,7 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
     p->setPen(newPen);
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
diff --git a/WebCore/platform/graphics/qt/IconQt.cpp b/WebCore/platform/graphics/qt/IconQt.cpp
index 98f4606..a9870fc 100644
--- a/WebCore/platform/graphics/qt/IconQt.cpp
+++ b/WebCore/platform/graphics/qt/IconQt.cpp
@@ -40,15 +40,17 @@ Icon::~Icon()
 {
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    RefPtr<Icon> i = adoptRef(new Icon);
-    i->m_icon = QIcon(filename);
-    return i.release();
-}
+    if (filenames.isEmpty())
+        return 0;
+
+    if (filenames.size() == 1) {
+        RefPtr<Icon> i = adoptRef(new Icon);
+        i->m_icon = QIcon(filenames[0]);
+        return i.release();
+    }
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
-{
     //FIXME: Implement this
     return 0;
 }
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index f8403b7..b6823dd 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -145,16 +145,8 @@ RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
     return &frame;
 }
 
-void ImageDecoderQt::clearFrameBufferCache(size_t index)
+void ImageDecoderQt::clearFrameBufferCache(size_t /*index*/)
 {
-    // Currently QImageReader will be asked to read everything. This
-    // might change when we read gif images on demand. For now we
-    // can have a rather simple implementation.
-    if (index > m_frameBufferCache.size())
-        return;
-
-    for (size_t i = 0; i < index; ++index)
-        m_frameBufferCache[index].clear();
 }
 
 void ImageDecoderQt::internalDecodeSize()
diff --git a/WebCore/platform/graphics/qt/ImageQt.cpp b/WebCore/platform/graphics/qt/ImageQt.cpp
index da6ddac..9a82911 100644
--- a/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -44,9 +44,7 @@
 #include <QPainter>
 #include <QImage>
 #include <QImageReader>
-#if QT_VERSION >= 0x040300
 #include <QTransform>
-#endif
 
 #include <QDebug>
 
@@ -64,6 +62,8 @@ static QPixmap loadResourcePixmap(const char *name)
         pixmap = QWebSettings::webGraphic(QWebSettings::DefaultFrameIconGraphic);
     else if (qstrcmp(name, "textAreaResizeCorner") == 0)
         pixmap = QWebSettings::webGraphic(QWebSettings::TextAreaSizeGripCornerGraphic);
+    else if (qstrcmp(name, "deleteButton") == 0)
+        pixmap = QWebSettings::webGraphic(QWebSettings::DeleteButtonGraphic);
 
     return pixmap;
 }
@@ -94,7 +94,7 @@ PassRefPtr<Image> Image::loadPlatformResource(const char* name)
 }
 
 void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const TransformationMatrix& patternTransform,
-                        const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect)
+                        const FloatPoint& phase, ColorSpace, CompositeOperator op, const FloatRect& destRect)
 {
     QPixmap* framePixmap = nativeImageForCurrentFrame();
     if (!framePixmap) // If it's too early we won't have an image yet.
@@ -120,6 +120,38 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
         imageObserver()->didDraw(this);
 }
 
+BitmapImage::BitmapImage(QPixmap* pixmap, ImageObserver* observer)
+    : Image(observer)
+    , m_currentFrame(0)
+    , m_frames(0)
+    , m_frameTimer(0)
+    , m_repetitionCount(cAnimationNone)
+    , m_repetitionCountStatus(Unknown)
+    , m_repetitionsComplete(0)
+    , m_isSolidColor(false)
+    , m_checkedForSolidColor(false)
+    , m_animationFinished(true)
+    , m_allDataReceived(true)
+    , m_haveSize(true)
+    , m_sizeAvailable(true)
+    , m_decodedSize(0)
+    , m_haveFrameCount(true)
+    , m_frameCount(1)
+{
+    initPlatformData();
+
+    int width = pixmap->width();
+    int height = pixmap->height();
+    m_decodedSize = width * height * 4;
+    m_size = IntSize(width, height);
+
+    m_frames.grow(1);
+    m_frames[0].m_frame = pixmap;
+    m_frames[0].m_hasAlpha = pixmap->hasAlpha();
+    m_frames[0].m_haveMetadata = true;
+    checkForSolidColor();
+}
+
 void BitmapImage::initPlatformData()
 {
 }
@@ -130,7 +162,7 @@ void BitmapImage::invalidatePlatformData()
 
 // Drawing Routines
 void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
-                       const FloatRect& src, CompositeOperator op)
+                       const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
     startAnimation();
 
@@ -139,7 +171,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dst, solidColor(), op);
+        fillWithSolidColor(ctxt, dst, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -181,6 +213,13 @@ void BitmapImage::checkForSolidColor()
     m_solidColor = QColor::fromRgba(framePixmap->toImage().pixel(0, 0));
 }
 
+#if PLATFORM(WIN_OS)
+PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
+{
+    return BitmapImage::create(new QPixmap(QPixmap::fromWinHBITMAP(hBitmap)));
+}
+#endif
+
 }
 
 
diff --git a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
index 7078d16..f446755 100644
--- a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+++ b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
@@ -101,15 +101,15 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     foreach (QWidget* widget, qFindChildren<QWidget*>(m_videoWidget))
         widget->installEventFilter(this);
 
-    connect(m_mediaObject, SIGNAL(stateChanged(Phonon::State, Phonon::State)),
-            this, SLOT(stateChanged(Phonon::State, Phonon::State)));
+    connect(m_mediaObject, SIGNAL(stateChanged(Phonon::State,Phonon::State)),
+            this, SLOT(stateChanged(Phonon::State,Phonon::State)));
     connect(m_mediaObject, SIGNAL(metaDataChanged()), this, SLOT(metaDataChanged()));
     connect(m_mediaObject, SIGNAL(seekableChanged(bool)), this, SLOT(seekableChanged(bool)));
     connect(m_mediaObject, SIGNAL(hasVideoChanged(bool)), this, SLOT(hasVideoChanged(bool)));
     connect(m_mediaObject, SIGNAL(bufferStatus(int)), this, SLOT(bufferStatus(int)));
     connect(m_mediaObject, SIGNAL(finished()), this, SLOT(finished()));
-    connect(m_mediaObject, SIGNAL(currentSourceChanged(const Phonon::MediaSource&)),
-            this, SLOT(currentSourceChanged(const Phonon::MediaSource&)));
+    connect(m_mediaObject, SIGNAL(currentSourceChanged(Phonon::MediaSource)),
+            this, SLOT(currentSourceChanged(Phonon::MediaSource)));
     connect(m_mediaObject, SIGNAL(aboutToFinish()), this, SLOT(aboutToFinish()));
     connect(m_mediaObject, SIGNAL(totalTimeChanged(qint64)), this, SLOT(totalTimeChanged(qint64)));
 }
diff --git a/WebCore/platform/graphics/qt/StillImageQt.cpp b/WebCore/platform/graphics/qt/StillImageQt.cpp
index 95b3bc8..1db04a7 100644
--- a/WebCore/platform/graphics/qt/StillImageQt.cpp
+++ b/WebCore/platform/graphics/qt/StillImageQt.cpp
@@ -50,7 +50,7 @@ NativeImagePtr StillImage::nativeImageForCurrentFrame()
 }
 
 void StillImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
-                      const FloatRect& src, CompositeOperator op)
+                      const FloatRect& src, ColorSpace, CompositeOperator op)
 {
     if (m_pixmap.isNull())
         return;
diff --git a/WebCore/platform/graphics/qt/StillImageQt.h b/WebCore/platform/graphics/qt/StillImageQt.h
index 6c417b1..7be9136 100644
--- a/WebCore/platform/graphics/qt/StillImageQt.h
+++ b/WebCore/platform/graphics/qt/StillImageQt.h
@@ -46,7 +46,7 @@ namespace WebCore {
 
         virtual IntSize size() const;
         virtual NativeImagePtr nativeImageForCurrentFrame();
-        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
 
     private:
         StillImage(const QPixmap& pixmap);
diff --git a/WebCore/platform/graphics/skia/BitmapImageSingleFrameSkia.h b/WebCore/platform/graphics/skia/BitmapImageSingleFrameSkia.h
index 5d85652..9fb6a8b 100644
--- a/WebCore/platform/graphics/skia/BitmapImageSingleFrameSkia.h
+++ b/WebCore/platform/graphics/skia/BitmapImageSingleFrameSkia.h
@@ -72,7 +72,7 @@ public:
     }
 
 protected:
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
 
 private:
     NativeImageSkia m_nativeImage;
diff --git a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 889c41b..f1536a6 100644
--- a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -293,7 +293,10 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     path.addOval(r, SkPath::kCW_Direction);
     // only perform the inset if we won't invert r
     if (2 * thickness < rect.width() && 2 * thickness < rect.height()) {
-        r.inset(SkIntToScalar(thickness), SkIntToScalar(thickness));
+        // Adding one to the thickness doesn't make the border too thick as
+        // it's painted over afterwards. But without this adjustment the
+        // border appears a little anemic after anti-aliasing.
+        r.inset(SkIntToScalar(thickness + 1), SkIntToScalar(thickness + 1));
         path.addOval(r, SkPath::kCCW_Direction);
     }
     platformContext()->clipPathAntiAliased(path);
@@ -704,8 +707,6 @@ void GraphicsContext::fillPath()
       return;
 
     const GraphicsContextState& state = m_common->state;
-    ColorSpace colorSpace = state.fillColorSpace;
-
     path.setFillType(state.fillRule == RULE_EVENODD ?
         SkPath::kEvenOdd_FillType : SkPath::kWinding_FillType);
 
@@ -727,14 +728,13 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     }
 
     const GraphicsContextState& state = m_common->state;
-    ColorSpace colorSpace = state.fillColorSpace;
 
     SkPaint paint;
     platformContext()->setupPaintForFilling(&paint);
     platformContext()->canvas()->drawRect(r, paint);
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -765,7 +765,8 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect,
                                       const IntSize& topRight,
                                       const IntSize& bottomLeft,
                                       const IntSize& bottomRight,
-                                      const Color& color)
+                                      const Color& color,
+                                      ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -782,7 +783,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect,
         // Not all the radii fit, return a rect. This matches the behavior of
         // Path::createRoundedRectangle. Without this we attempt to draw a round
         // shadow for a square box.
-        fillRect(rect, color);
+        fillRect(rect, color, colorSpace);
         return;
     }
 
@@ -950,7 +951,7 @@ void GraphicsContext::setMiterLimit(float limit)
     platformContext()->setMiterLimit(limit);
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -977,7 +978,8 @@ void GraphicsContext::setPlatformFillPattern(Pattern* pattern)
 
 void GraphicsContext::setPlatformShadow(const IntSize& size,
                                         int blurInt,
-                                        const Color& color)
+                                        const Color& color,
+                                        ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -1019,7 +1021,7 @@ void GraphicsContext::setPlatformShadow(const IntSize& size,
     dl->unref();
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& strokecolor)
+void GraphicsContext::setPlatformStrokeColor(const Color& strokecolor, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -1118,7 +1120,6 @@ void GraphicsContext::strokePath()
         return;
 
     const GraphicsContextState& state = m_common->state;
-    ColorSpace colorSpace = state.strokeColorSpace;
 
     SkPaint paint;
     platformContext()->setupPaintForStroking(&paint, 0, 0);
@@ -1135,7 +1136,6 @@ void GraphicsContext::strokeRect(const FloatRect& rect, float lineWidth)
         return;
 
     const GraphicsContextState& state = m_common->state;
-    ColorSpace colorSpace = state.strokeColorSpace;
 
     SkPaint paint;
     platformContext()->setupPaintForStroking(&paint, 0, 0);
diff --git a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index a5c8926..c36f1ce 100644
--- a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -105,13 +105,16 @@ Image* ImageBuffer::image() const
 void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
 {
     const SkBitmap& bitmap = *context()->platformContext()->bitmap();
+    if (bitmap.isNull())
+        return;
+
     ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
     SkAutoLockPixels bitmapLock(bitmap);
     for (int y = 0; y < m_size.height(); ++y) {
         uint32_t* srcRow = bitmap.getAddr32(0, y);
         for (int x = 0; x < m_size.width(); ++x) {
             SkColor color = SkPMColorToColor(srcRow[x]);
-            srcRow[x] = SkPreMultiplyARGB(lookUpTable[SkColorGetA(color)],
+            srcRow[x] = SkPreMultiplyARGB(SkColorGetA(color),
                                           lookUpTable[SkColorGetR(color)],
                                           lookUpTable[SkColorGetG(color)],
                                           lookUpTable[SkColorGetB(color)]);
@@ -164,11 +167,12 @@ PassRefPtr<ImageData> getImageData(const IntRect& rect, const SkBitmap& bitmap,
         for (int x = 0; x < numColumns; ++x) {
             unsigned char* destPixel = &destRow[x * 4];
             if (multiplied == Unmultiplied) {
-                SkColor color = SkPMColorToColor(srcRow[x]);
-                destPixel[0] = SkColorGetR(color);
-                destPixel[1] = SkColorGetG(color);
-                destPixel[2] = SkColorGetB(color);
-                destPixel[3] = SkColorGetA(color);
+                SkColor color = srcRow[x];
+                unsigned a = SkColorGetA(color);
+                destPixel[0] = a ? SkColorGetR(color) * 255 / a : 0;
+                destPixel[1] = a ? SkColorGetG(color) * 255 / a : 0;
+                destPixel[2] = a ? SkColorGetB(color) * 255 / a : 0;
+                destPixel[3] = a;
             } else {
                 // Input and output are both pre-multiplied, we just need to re-arrange the
                 // bytes from the bitmap format to RGBA.
diff --git a/WebCore/platform/graphics/skia/ImageSkia.cpp b/WebCore/platform/graphics/skia/ImageSkia.cpp
index ecab364..6d8ed22 100644
--- a/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -302,6 +302,7 @@ void Image::drawPattern(GraphicsContext* context,
                         const FloatRect& floatSrcRect,
                         const TransformationMatrix& patternTransform,
                         const FloatPoint& phase,
+                        ColorSpace styleColorSpace,
                         CompositeOperator compositeOp,
                         const FloatRect& destRect)
 {
@@ -405,7 +406,7 @@ void BitmapImage::checkForSolidColor()
 }
 
 void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect,
-                       const FloatRect& srcRect, CompositeOperator compositeOp)
+                       const FloatRect& srcRect, ColorSpace, CompositeOperator compositeOp)
 {
     if (!m_source.initialized())
         return;
@@ -437,6 +438,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect,
 void BitmapImageSingleFrameSkia::draw(GraphicsContext* ctxt,
                                       const FloatRect& dstRect,
                                       const FloatRect& srcRect,
+                                      ColorSpace styleColorSpace,
                                       CompositeOperator compositeOp)
 {
     FloatRect normDstRect = normalizeRect(dstRect);
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index a079da0..dfffa0d 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -343,6 +343,15 @@ void PlatformContextSkia::setupPaintForFilling(SkPaint* paint) const
     paint->setShader(m_state->m_fillShader);
 }
 
+static SkScalar scalarBound(SkScalar v, SkScalar min, SkScalar max)
+{
+    if (v < min)
+        return min;
+    if (v > max)
+        return max;
+    return v;
+}
+
 float PlatformContextSkia::setupPaintForStroking(SkPaint* paint, SkRect* rect, int length) const
 {
     setupPaintCommon(paint);
@@ -351,10 +360,13 @@ float PlatformContextSkia::setupPaintForStroking(SkPaint* paint, SkRect* rect, i
     paint->setColor(m_state->applyAlpha(m_state->m_strokeColor));
     paint->setShader(m_state->m_strokeShader);
     paint->setStyle(SkPaint::kStroke_Style);
-    paint->setStrokeWidth(SkFloatToScalar(width));
+    // The limits here (512 and 256) were made up but are hopefully large
+    // enough to be reasonable. They are, empirically, small enough not to
+    // cause overflows in Skia.
+    paint->setStrokeWidth(scalarBound(SkFloatToScalar(width), 0, 512));
     paint->setStrokeCap(m_state->m_lineCap);
     paint->setStrokeJoin(m_state->m_lineJoin);
-    paint->setStrokeMiter(SkFloatToScalar(m_state->m_miterLimit));
+    paint->setStrokeMiter(scalarBound(SkFloatToScalar(m_state->m_miterLimit), 0, 256));
 
     if (m_state->m_dash)
         paint->setPathEffect(m_state->m_dash);
diff --git a/WebCore/platform/graphics/transforms/TransformOperations.h b/WebCore/platform/graphics/transforms/TransformOperations.h
index dd56408..08efd23 100644
--- a/WebCore/platform/graphics/transforms/TransformOperations.h
+++ b/WebCore/platform/graphics/transforms/TransformOperations.h
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-class TransformOperations {
+class TransformOperations : public FastAllocBase {
 public:
     TransformOperations(bool makeIdentity = false);
     
diff --git a/WebCore/platform/graphics/transforms/TransformationMatrix.h b/WebCore/platform/graphics/transforms/TransformationMatrix.h
index a7fbb3d..33f9afe 100644
--- a/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -29,6 +29,7 @@
 #include "FloatPoint.h"
 #include "IntPoint.h"
 #include <string.h> //for memcpy
+#include <wtf/FastAllocBase.h>
 
 #if PLATFORM(CG)
 #include <CoreGraphics/CGAffineTransform.h>
@@ -49,7 +50,7 @@ class FloatPoint3D;
 class FloatRect;
 class FloatQuad;
 
-class TransformationMatrix {
+class TransformationMatrix : public FastAllocBase {
 public:
     typedef double Matrix4[4][4];
 
diff --git a/WebCore/platform/graphics/win/FontCGWin.cpp b/WebCore/platform/graphics/win/FontCGWin.cpp
index e2ed130..e901669 100644
--- a/WebCore/platform/graphics/win/FontCGWin.cpp
+++ b/WebCore/platform/graphics/win/FontCGWin.cpp
@@ -362,14 +362,14 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* fo
         graphicsContext->clearShadow();
         Color fillColor = graphicsContext->fillColor();
         Color shadowFillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), shadowColor.alpha() * fillColor.alpha() / 255);
-        graphicsContext->setFillColor(shadowFillColor);
+        graphicsContext->setFillColor(shadowFillColor, DeviceColorSpace);
         CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowSize.width(), point.y() + translation.height() + shadowSize.height());
         CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         if (font->syntheticBoldOffset()) {
             CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowSize.width() + font->syntheticBoldOffset(), point.y() + translation.height() + shadowSize.height());
             CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         }
-        graphicsContext->setFillColor(fillColor);
+        graphicsContext->setFillColor(fillColor, DeviceColorSpace);
     }
 
     CGContextSetTextPosition(cgContext, point.x() + translation.width(), point.y() + translation.height());
@@ -380,7 +380,7 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* fo
     }
 
     if (hasSimpleShadow)
-        graphicsContext->setShadow(shadowSize, shadowBlur, shadowColor);
+        graphicsContext->setShadow(shadowSize, shadowBlur, shadowColor, DeviceColorSpace);
 
     wkRestoreFontSmoothingStyle(cgContext, oldFontSmoothingStyle);
 }
diff --git a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
index 1923ecc..137b914 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
@@ -70,8 +70,8 @@ GraphicsContext::GraphicsContext(HDC hdc, bool hasAlpha)
     setPaintingDisabled(!m_data->m_cgContext);
     if (m_data->m_cgContext) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), DeviceColorSpace);
+        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
     }
 }
 
diff --git a/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
index 2489e02..61ae76c 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
@@ -74,8 +74,8 @@ GraphicsContext::GraphicsContext(HDC dc, bool hasAlpha)
 
     if (m_data->cr) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), fillColorSpace());
+        setPlatformStrokeColor(strokeColor(), strokeColorSpace());
     }
 }
 
diff --git a/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp b/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp
new file mode 100644
index 0000000..22faeb8
--- /dev/null
+++ b/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp
@@ -0,0 +1,721 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayerCACF.h"
+
+#include "CString.h"
+#include "FloatConversion.h"
+#include "FloatRect.h"
+#include "Image.h"
+#include "PlatformString.h"
+#include "SystemTime.h"
+#include "WKCACFLayer.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/StringExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+static inline void copyTransform(CATransform3D& toT3D, const TransformationMatrix& t)
+{
+    toT3D.m11 = narrowPrecisionToFloat(t.m11());
+    toT3D.m12 = narrowPrecisionToFloat(t.m12());
+    toT3D.m13 = narrowPrecisionToFloat(t.m13());
+    toT3D.m14 = narrowPrecisionToFloat(t.m14());
+    toT3D.m21 = narrowPrecisionToFloat(t.m21());
+    toT3D.m22 = narrowPrecisionToFloat(t.m22());
+    toT3D.m23 = narrowPrecisionToFloat(t.m23());
+    toT3D.m24 = narrowPrecisionToFloat(t.m24());
+    toT3D.m31 = narrowPrecisionToFloat(t.m31());
+    toT3D.m32 = narrowPrecisionToFloat(t.m32());
+    toT3D.m33 = narrowPrecisionToFloat(t.m33());
+    toT3D.m34 = narrowPrecisionToFloat(t.m34());
+    toT3D.m41 = narrowPrecisionToFloat(t.m41());
+    toT3D.m42 = narrowPrecisionToFloat(t.m42());
+    toT3D.m43 = narrowPrecisionToFloat(t.m43());
+    toT3D.m44 = narrowPrecisionToFloat(t.m44());
+}
+
+TransformationMatrix CAToTransform3D(const CATransform3D& fromT3D)
+{
+    return TransformationMatrix(
+        fromT3D.m11,
+        fromT3D.m12,
+        fromT3D.m13,
+        fromT3D.m14,
+        fromT3D.m21,
+        fromT3D.m22,
+        fromT3D.m23,
+        fromT3D.m24,
+        fromT3D.m31,
+        fromT3D.m32,
+        fromT3D.m33,
+        fromT3D.m34,
+        fromT3D.m41,
+        fromT3D.m42,
+        fromT3D.m43,
+        fromT3D.m44);
+}
+
+static void setLayerBorderColor(WKCACFLayer* layer, const Color& color)
+{
+    CGColorRef borderColor = createCGColor(color);
+    layer->setBorderColor(borderColor);
+    CGColorRelease(borderColor);
+}
+
+static void clearBorderColor(WKCACFLayer* layer)
+{
+    layer->setBorderColor(0);
+}
+
+static void setLayerBackgroundColor(WKCACFLayer* layer, const Color& color)
+{
+    CGColorRef bgColor = createCGColor(color);
+    layer->setBackgroundColor(bgColor);
+    CGColorRelease(bgColor);
+}
+
+static void clearLayerBackgroundColor(WKCACFLayer* layer)
+{
+    layer->setBackgroundColor(0);
+}
+
+GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayer::compositingCoordinatesOrientation()
+{
+    return CompositingCoordinatesBottomUp;
+}
+
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
+{
+    return new GraphicsLayerCACF(client);
+}
+
+GraphicsLayerCACF::GraphicsLayerCACF(GraphicsLayerClient* client)
+    : GraphicsLayer(client)
+    , m_contentsLayerPurpose(NoContentsLayer)
+    , m_contentsLayerHasBackgroundColor(false)
+{
+    m_layer = WKCACFLayer::create(kCACFLayer, this);
+    
+    updateDebugIndicators();
+}
+
+GraphicsLayerCACF::~GraphicsLayerCACF()
+{
+    // clean up the WK layer
+    if (m_layer)
+        m_layer->removeFromSuperlayer();
+    
+    if (m_transformLayer)
+        m_transformLayer->removeFromSuperlayer();
+}
+
+void GraphicsLayerCACF::setName(const String& inName)
+{
+    String name = String::format("CALayer(%p) GraphicsLayer(%p) ", m_layer.get(), this) + inName;
+    GraphicsLayer::setName(name);
+    
+    m_layer->setName(inName);
+}
+
+NativeLayer GraphicsLayerCACF::nativeLayer() const
+{
+    return m_layer.get();
+}
+
+bool GraphicsLayerCACF::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    bool childrenChanged = GraphicsLayer::setChildren(children);
+    // FIXME: GraphicsLayer::setChildren calls addChild() for each sublayer, which
+    // will end up calling updateSublayerList() N times.
+    if (childrenChanged)
+        updateSublayerList();
+    
+    return childrenChanged;
+}
+
+void GraphicsLayerCACF::addChild(GraphicsLayer* childLayer)
+{
+    GraphicsLayer::addChild(childLayer);
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::addChildAtIndex(GraphicsLayer* childLayer, int index)
+{
+    GraphicsLayer::addChildAtIndex(childLayer, index);
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::addChildBelow(GraphicsLayer* childLayer, GraphicsLayer* sibling)
+{
+    GraphicsLayer::addChildBelow(childLayer, sibling);
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::addChildAbove(GraphicsLayer* childLayer, GraphicsLayer *sibling)
+{
+    GraphicsLayer::addChildAbove(childLayer, sibling);
+    updateSublayerList();
+}
+
+bool GraphicsLayerCACF::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
+{
+    if (GraphicsLayer::replaceChild(oldChild, newChild)) {
+        updateSublayerList();
+        return true;
+    }
+    return false;
+}
+
+void GraphicsLayerCACF::removeFromParent()
+{
+    GraphicsLayer::removeFromParent();
+    layerForSuperlayer()->removeFromSuperlayer();            
+}
+
+void GraphicsLayerCACF::setPosition(const FloatPoint& point)
+{
+    GraphicsLayer::setPosition(point);
+    updateLayerPosition();
+}
+
+void GraphicsLayerCACF::setAnchorPoint(const FloatPoint3D& point)
+{
+    if (point == m_anchorPoint)
+        return;
+
+    GraphicsLayer::setAnchorPoint(point);
+    updateAnchorPoint();
+}
+
+void GraphicsLayerCACF::setSize(const FloatSize& size)
+{
+    if (size == m_size)
+        return;
+
+    GraphicsLayer::setSize(size);
+    updateLayerSize();
+}
+
+void GraphicsLayerCACF::setTransform(const TransformationMatrix& t)
+{
+    if (t == m_transform)
+        return;
+
+    GraphicsLayer::setTransform(t);
+    updateTransform();
+}
+
+void GraphicsLayerCACF::setChildrenTransform(const TransformationMatrix& t)
+{
+    if (t == m_childrenTransform)
+        return;
+
+    GraphicsLayer::setChildrenTransform(t);
+    updateChildrenTransform();
+}
+
+void GraphicsLayerCACF::setPreserves3D(bool preserves3D)
+{
+    if (preserves3D == m_preserves3D)
+        return;
+
+    GraphicsLayer::setPreserves3D(preserves3D);
+    updateLayerPreserves3D();
+}
+
+void GraphicsLayerCACF::setMasksToBounds(bool masksToBounds)
+{
+    if (masksToBounds == m_masksToBounds)
+        return;
+
+    GraphicsLayer::setMasksToBounds(masksToBounds);
+    updateMasksToBounds();
+}
+
+void GraphicsLayerCACF::setDrawsContent(bool drawsContent)
+{
+    if (drawsContent == m_drawsContent)
+        return;
+
+    GraphicsLayer::setDrawsContent(drawsContent);
+    updateLayerDrawsContent();
+}
+
+void GraphicsLayerCACF::setBackgroundColor(const Color& color)
+{
+    if (m_backgroundColorSet && m_backgroundColor == color)
+        return;
+
+    GraphicsLayer::setBackgroundColor(color);
+
+    m_contentsLayerHasBackgroundColor = true;
+    updateLayerBackgroundColor();
+}
+
+void GraphicsLayerCACF::clearBackgroundColor()
+{
+    if (!m_backgroundColorSet)
+        return;
+
+    GraphicsLayer::clearBackgroundColor();
+    clearLayerBackgroundColor(m_contentsLayer.get());
+}
+
+void GraphicsLayerCACF::setContentsOpaque(bool opaque)
+{
+    if (m_contentsOpaque == opaque)
+        return;
+
+    GraphicsLayer::setContentsOpaque(opaque);
+    updateContentsOpaque();
+}
+
+void GraphicsLayerCACF::setBackfaceVisibility(bool visible)
+{
+    if (m_backfaceVisibility == visible)
+        return;
+    
+    GraphicsLayer::setBackfaceVisibility(visible);
+    updateBackfaceVisibility();
+}
+    
+void GraphicsLayerCACF::setOpacity(float opacity)
+{
+    float clampedOpacity = max(min(opacity, 1.0f), 0.0f);
+    
+    if (m_opacity == clampedOpacity)
+        return;
+    
+    GraphicsLayer::setOpacity(clampedOpacity);
+    primaryLayer()->setOpacity(opacity);
+}
+
+void GraphicsLayerCACF::setNeedsDisplay()
+{
+    if (drawsContent())
+        m_layer->setNeedsDisplay();
+}
+
+void GraphicsLayerCACF::setNeedsDisplayInRect(const FloatRect& rect)
+{
+    if (drawsContent())
+        m_layer->setNeedsDisplay(rect);
+}
+
+void GraphicsLayerCACF::setContentsRect(const IntRect& rect)
+{
+    if (rect == m_contentsRect)
+        return;
+
+    GraphicsLayer::setContentsRect(rect);
+    updateContentsRect();
+}
+
+void GraphicsLayerCACF::setContentsToImage(Image* image)
+{
+    bool childrenChanged = false;
+
+    if (image) {
+        m_pendingContentsImage = image->nativeImageForCurrentFrame();
+        m_contentsLayerPurpose = ContentsLayerForImage;
+        if (!m_contentsLayer)
+            childrenChanged = true;
+    } else {
+        m_pendingContentsImage = 0;
+        m_contentsLayerPurpose = NoContentsLayer;
+        if (m_contentsLayer)
+            childrenChanged = true;
+    }
+
+    updateContentsImage();
+
+    // This has to happen after updateContentsImage
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+void GraphicsLayerCACF::setContentsToVideo(PlatformLayer* videoLayer)
+{
+    bool childrenChanged = false;
+
+    if (videoLayer != m_contentsLayer.get())
+        childrenChanged = true;
+
+    m_contentsLayer = videoLayer;
+    m_contentsLayerPurpose = videoLayer ? ContentsLayerForVideo : NoContentsLayer;
+
+    updateContentsVideo();
+
+    // This has to happen after updateContentsVideo
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+void GraphicsLayerCACF::setGeometryOrientation(CompositingCoordinatesOrientation orientation)
+{
+    if (orientation == m_geometryOrientation)
+        return;
+
+    GraphicsLayer::setGeometryOrientation(orientation);
+    updateGeometryOrientation();
+}
+
+PlatformLayer* GraphicsLayerCACF::hostLayerForSublayers() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerCACF::layerForSuperlayer() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerCACF::platformLayer() const
+{
+    return primaryLayer();
+}
+
+void GraphicsLayerCACF::setDebugBackgroundColor(const Color& color)
+{
+    if (color.isValid())
+        setLayerBackgroundColor(m_layer.get(), color);
+    else
+        clearLayerBackgroundColor(m_layer.get());
+}
+
+void GraphicsLayerCACF::setDebugBorder(const Color& color, float borderWidth)
+{
+    if (color.isValid()) {
+        setLayerBorderColor(m_layer.get(), color);
+        m_layer->setBorderWidth(borderWidth);
+    } else {
+        clearBorderColor(m_layer.get());
+        m_layer->setBorderWidth(0);
+    }
+}
+
+GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayerCACF::defaultContentsOrientation() const
+{
+    return CompositingCoordinatesTopDown;
+}
+
+void GraphicsLayerCACF::updateSublayerList()
+{
+    Vector<RefPtr<WKCACFLayer> > newSublayers;
+
+    if (m_transformLayer) {
+        // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
+        newSublayers.append(m_layer.get());
+    } else if (m_contentsLayer) {
+        // FIXME: add the contents layer in the correct order with negative z-order children.
+        // This does not cause visible rendering issues because currently contents layers are only used
+        // for replaced elements that don't have children.
+        newSublayers.append(m_contentsLayer.get());
+    }
+    
+    const Vector<GraphicsLayer*>& childLayers = children();
+    size_t numChildren = childLayers.size();
+    for (size_t i = 0; i < numChildren; ++i) {
+        GraphicsLayerCACF* curChild = static_cast<GraphicsLayerCACF*>(childLayers[i]);
+     
+        WKCACFLayer* childLayer = curChild->layerForSuperlayer();
+        newSublayers.append(childLayer);
+    }
+
+    for (int i = 0; i < newSublayers.size(); ++i)
+        newSublayers[i]->removeFromSuperlayer();
+
+    if (m_transformLayer) {
+        m_transformLayer->setSublayers(newSublayers);
+
+        if (m_contentsLayer) {
+            // If we have a transform layer, then the contents layer is parented in the 
+            // primary layer (which is itself a child of the transform layer).
+            m_layer->removeAllSublayers();
+            m_layer->addSublayer(m_contentsLayer);
+        }
+    } else
+        m_layer->setSublayers(newSublayers);
+}
+
+void GraphicsLayerCACF::updateLayerPosition()
+{
+    // Position is offset on the layer by the layer anchor point.
+    CGPoint posPoint = CGPointMake(m_position.x() + m_anchorPoint.x() * m_size.width(),
+                                   m_position.y() + m_anchorPoint.y() * m_size.height());
+    
+    primaryLayer()->setPosition(posPoint);
+}
+
+void GraphicsLayerCACF::updateLayerSize()
+{
+    CGRect rect = CGRectMake(0, 0, m_size.width(), m_size.height());
+    if (m_transformLayer) {
+        m_transformLayer->setBounds(rect);
+        // The anchor of the contents layer is always at 0.5, 0.5, so the position is center-relative.
+        CGPoint centerPoint = CGPointMake(m_size.width() / 2.0f, m_size.height() / 2.0f);
+        m_layer->setPosition(centerPoint);
+    }
+    
+    m_layer->setBounds(rect);
+    
+    // Note that we don't resize m_contentsLayer. It's up the caller to do that.
+
+    // if we've changed the bounds, we need to recalculate the position
+    // of the layer, taking anchor point into account.
+    updateLayerPosition();
+}
+
+void GraphicsLayerCACF::updateAnchorPoint()
+{
+    primaryLayer()->setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
+    primaryLayer()->setAnchorPointZ(m_anchorPoint.z());
+    updateLayerPosition();
+}
+
+void GraphicsLayerCACF::updateTransform()
+{
+    CATransform3D transform;
+    copyTransform(transform, m_transform);
+    primaryLayer()->setTransform(transform);
+}
+
+void GraphicsLayerCACF::updateChildrenTransform()
+{
+    CATransform3D transform;
+    copyTransform(transform, m_childrenTransform);
+    primaryLayer()->setSublayerTransform(transform);
+}
+
+void GraphicsLayerCACF::updateMasksToBounds()
+{
+    m_layer->setMasksToBounds(m_masksToBounds);
+    updateDebugIndicators();
+}
+
+void GraphicsLayerCACF::updateContentsOpaque()
+{
+    m_layer->setOpaque(m_contentsOpaque);
+}
+
+void GraphicsLayerCACF::updateBackfaceVisibility()
+{
+    m_layer->setDoubleSided(m_backfaceVisibility);
+}
+
+void GraphicsLayerCACF::updateLayerPreserves3D()
+{
+    if (m_preserves3D && !m_transformLayer) {
+        // Create the transform layer.
+        m_transformLayer = WKCACFLayer::create(kCACFTransformLayer, this);
+
+#ifndef NDEBUG
+        m_transformLayer->setName(String().format("Transform Layer CATransformLayer(%p) GraphicsLayer(%p)", m_transformLayer.get(), this));
+#endif
+        // Copy the position from this layer.
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+        
+        CGPoint point = CGPointMake(m_size.width() / 2.0f, m_size.height() / 2.0f);
+        m_layer->setPosition(point);
+
+        m_layer->setAnchorPoint(CGPointMake(0.5f, 0.5f));
+        m_layer->setTransform(CATransform3DIdentity);
+        
+        // Set the old layer to opacity of 1. Further down we will set the opacity on the transform layer.
+        m_layer->setOpacity(1);
+
+        // Move this layer to be a child of the transform layer.
+        if (m_layer->superlayer())
+            m_layer->superlayer()->replaceSublayer(m_layer.get(), m_transformLayer.get());
+        m_transformLayer->addSublayer(m_layer.get());
+
+        updateSublayerList();
+    } else if (!m_preserves3D && m_transformLayer) {
+        // Relace the transformLayer in the parent with this layer.
+        m_layer->removeFromSuperlayer();
+        m_transformLayer->superlayer()->replaceSublayer(m_transformLayer.get(), m_layer.get());
+
+        // Release the transform layer.
+        m_transformLayer = 0;
+
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+
+        updateSublayerList();
+    }
+
+    updateOpacityOnLayer();
+}
+
+void GraphicsLayerCACF::updateLayerDrawsContent()
+{
+    if (m_drawsContent)
+        m_layer->setNeedsDisplay();
+    else
+        m_layer->setContents(nil);
+
+    updateDebugIndicators();
+}
+
+void GraphicsLayerCACF::updateLayerBackgroundColor()
+{
+    if (!m_contentsLayer)
+        return;
+
+    // We never create the contents layer just for background color yet.
+    if (m_backgroundColorSet)
+        setLayerBackgroundColor(m_contentsLayer.get(), m_backgroundColor);
+    else
+        clearLayerBackgroundColor(m_contentsLayer.get());
+}
+
+void GraphicsLayerCACF::updateContentsImage()
+{
+    if (m_pendingContentsImage) {
+        if (!m_contentsLayer.get()) {
+            RefPtr<WKCACFLayer> imageLayer = WKCACFLayer::create(kCACFLayer, this);
+#ifndef NDEBUG
+            imageLayer->setName("Image Layer");
+#endif
+            setupContentsLayer(imageLayer.get());
+            m_contentsLayer = imageLayer;
+            // m_contentsLayer will be parented by updateSublayerList
+        }
+
+        // FIXME: maybe only do trilinear if the image is being scaled down,
+        // but then what if the layer size changes?
+        m_contentsLayer->setMinificationFilter(kCACFFilterTrilinear);
+        m_contentsLayer->setContents(m_pendingContentsImage.get());
+        m_pendingContentsImage = 0;
+        
+        updateContentsRect();
+    } else {
+        // No image.
+        // m_contentsLayer will be removed via updateSublayerList.
+        m_contentsLayer = 0;
+    }
+}
+
+void GraphicsLayerCACF::updateContentsVideo()
+{
+    // Video layer was set as m_contentsLayer, and will get parented in updateSublayerList().
+    if (m_contentsLayer) {
+        setupContentsLayer(m_contentsLayer.get());
+        updateContentsRect();
+    }
+}
+
+void GraphicsLayerCACF::updateContentsRect()
+{
+    if (!m_contentsLayer)
+        return;
+        
+    CGPoint point = CGPointMake(m_contentsRect.x(),
+                                m_contentsRect.y());
+    CGRect rect = CGRectMake(0.0f,
+                             0.0f,
+                             m_contentsRect.width(),
+                             m_contentsRect.height());
+
+    m_contentsLayer->setPosition(point);
+    m_contentsLayer->setBounds(rect);
+}
+
+void GraphicsLayerCACF::updateGeometryOrientation()
+{
+    switch (geometryOrientation()) {
+        case CompositingCoordinatesTopDown:
+            m_layer->setGeometryFlipped(false);
+            break;
+        
+        case CompositingCoordinatesBottomUp:
+            m_layer->setGeometryFlipped(true);
+            break;
+    }
+    // Geometry orientation is mapped onto children transform in older QuartzCores,
+    // so is handled via setGeometryOrientation().
+}
+
+void GraphicsLayerCACF::setupContentsLayer(WKCACFLayer* contentsLayer)
+{
+    if (contentsLayer == m_contentsLayer)
+        return;
+
+    if (m_contentsLayer) {
+        m_contentsLayer->removeFromSuperlayer();
+        m_contentsLayer = 0;
+    }
+    
+    if (contentsLayer) {
+        m_contentsLayer = contentsLayer;
+
+        if (defaultContentsOrientation() == CompositingCoordinatesBottomUp) {
+            CATransform3D flipper = {
+                1.0f, 0.0f, 0.0f, 0.0f,
+                0.0f, -1.0f, 0.0f, 0.0f,
+                0.0f, 0.0f, 1.0f, 0.0f,
+                0.0f, 0.0f, 0.0f, 1.0f};
+            m_contentsLayer->setTransform(flipper);
+            m_contentsLayer->setAnchorPoint(CGPointMake(0.0f, 1.0f));
+        } else
+            m_contentsLayer->setAnchorPoint(CGPointMake(0.0f, 0.0f));
+
+        // Insert the content layer first. Video elements require this, because they have
+        // shadow content that must display in front of the video.
+        m_layer->insertSublayer(m_contentsLayer.get(), 0);
+
+        updateContentsRect();
+
+        if (showDebugBorders()) {
+            setLayerBorderColor(m_contentsLayer.get(), Color(0, 0, 128, 180));
+            m_contentsLayer->setBorderWidth(1.0f);
+        }
+    }
+    updateDebugIndicators();
+}
+
+// This function simply mimics the operation of GraphicsLayerCA
+void GraphicsLayerCACF::updateOpacityOnLayer()
+{
+    primaryLayer()->setOpacity(m_opacity);
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/win/GraphicsLayerCACF.h b/WebCore/platform/graphics/win/GraphicsLayerCACF.h
new file mode 100644
index 0000000..93ddf25
--- /dev/null
+++ b/WebCore/platform/graphics/win/GraphicsLayerCACF.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GraphicsLayerCACF_h_
+#define GraphicsLayerCACF_h_
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayer.h"
+#include "GraphicsContext.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+class WKCACFLayer;
+
+class GraphicsLayerCACF : public GraphicsLayer {
+public:
+
+    GraphicsLayerCACF(GraphicsLayerClient*);
+    virtual ~GraphicsLayerCACF();
+
+    virtual void setName(const String& inName);
+
+    // for hosting this GraphicsLayer in a native layer hierarchy
+    virtual NativeLayer nativeLayer() const;
+
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
+    virtual void addChild(GraphicsLayer *layer);
+    virtual void addChildAtIndex(GraphicsLayer *layer, int index);
+    virtual void addChildAbove(GraphicsLayer *layer, GraphicsLayer *sibling);
+    virtual void addChildBelow(GraphicsLayer *layer, GraphicsLayer *sibling);
+    virtual bool replaceChild(GraphicsLayer *oldChild, GraphicsLayer *newChild);
+
+    virtual void removeFromParent();
+
+    virtual void setPosition(const FloatPoint& inPoint);
+    virtual void setAnchorPoint(const FloatPoint3D& inPoint);
+    virtual void setSize(const FloatSize& inSize);
+
+    virtual void setTransform(const TransformationMatrix&);
+
+    virtual void setChildrenTransform(const TransformationMatrix&);
+
+    virtual void setPreserves3D(bool);
+    virtual void setMasksToBounds(bool);
+    virtual void setDrawsContent(bool);
+
+    virtual void setBackgroundColor(const Color&);
+    virtual void clearBackgroundColor();
+
+    virtual void setContentsOpaque(bool);
+    virtual void setBackfaceVisibility(bool);
+
+    virtual void setOpacity(float opacity);
+
+    virtual void setNeedsDisplay();
+    virtual void setNeedsDisplayInRect(const FloatRect&);
+
+    virtual void setContentsRect(const IntRect&);
+
+    virtual void setContentsToImage(Image*);
+    virtual void setContentsToVideo(PlatformLayer*);
+    
+    virtual PlatformLayer* platformLayer() const;
+
+    virtual void setDebugBackgroundColor(const Color&);
+    virtual void setDebugBorder(const Color&, float borderWidth);
+
+    virtual void setGeometryOrientation(CompositingCoordinatesOrientation);
+
+    void notifySyncRequired() { if (m_client) m_client->notifySyncRequired(this); }
+
+private:
+    void updateOpacityOnLayer();
+
+    WKCACFLayer* primaryLayer() const  { return m_transformLayer.get() ? m_transformLayer.get() : m_layer.get(); }
+    WKCACFLayer* hostLayerForSublayers() const;
+    WKCACFLayer* layerForSuperlayer() const;
+
+    CompositingCoordinatesOrientation defaultContentsOrientation() const;
+    void updateSublayerList();
+    void updateLayerPosition();
+    void updateLayerSize();
+    void updateAnchorPoint();
+    void updateTransform();
+    void updateChildrenTransform();
+    void updateMasksToBounds();
+    void updateContentsOpaque();
+    void updateBackfaceVisibility();
+    void updateLayerPreserves3D();
+    void updateLayerDrawsContent();
+    void updateLayerBackgroundColor();
+
+    void updateContentsImage();
+    void updateContentsVideo();
+    void updateContentsRect();
+    void updateGeometryOrientation();
+    
+    void setupContentsLayer(WKCACFLayer*);
+    WKCACFLayer* contentsLayer() const { return m_contentsLayer.get(); }
+    
+    RefPtr<WKCACFLayer> m_layer;
+    RefPtr<WKCACFLayer> m_transformLayer;
+    RefPtr<WKCACFLayer> m_contentsLayer;
+
+    enum ContentsLayerPurpose {
+        NoContentsLayer = 0,
+        ContentsLayerForImage,
+        ContentsLayerForVideo
+    };
+    
+    ContentsLayerPurpose m_contentsLayerPurpose;
+    bool m_contentsLayerHasBackgroundColor : 1;
+    RetainPtr<CGImageRef> m_pendingContentsImage;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // GraphicsLayerCACF_h_
diff --git a/WebCore/platform/graphics/win/IconWin.cpp b/WebCore/platform/graphics/win/IconWin.cpp
index 61f1fd3..d71ca00 100644
--- a/WebCore/platform/graphics/win/IconWin.cpp
+++ b/WebCore/platform/graphics/win/IconWin.cpp
@@ -47,20 +47,22 @@ Icon::~Icon()
     DestroyIcon(m_hIcon);
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    SHFILEINFO sfi;
-    memset(&sfi, 0, sizeof(sfi));
-
-    String tmpFilename = filename;
-    if (!SHGetFileInfo(tmpFilename.charactersWithNullTermination(), 0, &sfi, sizeof(sfi), SHGFI_ICON | SHGFI_SHELLICONSIZE | SHGFI_SMALLICON))
+    if (filenames.isEmpty())
         return 0;
 
-    return adoptRef(new Icon(sfi.hIcon));
-}
+    if (filenames.size() == 1) {
+        SHFILEINFO sfi;
+        memset(&sfi, 0, sizeof(sfi));
+
+        String tmpFilename = filenames[0];
+        if (!SHGetFileInfo(tmpFilename.charactersWithNullTermination(), 0, &sfi, sizeof(sfi), SHGFI_ICON | SHGFI_SHELLICONSIZE | SHGFI_SMALLICON))
+            return 0;
+
+        return adoptRef(new Icon(sfi.hIcon));
+    }
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
-{
 #if PLATFORM(WINCE)
     return 0;
 #else
diff --git a/WebCore/platform/graphics/win/ImageCGWin.cpp b/WebCore/platform/graphics/win/ImageCGWin.cpp
index 285fb71..2c6d41d 100644
--- a/WebCore/platform/graphics/win/ImageCGWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCGWin.cpp
@@ -77,9 +77,9 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 
     IntSize imageSize = BitmapImage::size();
     if (size)
-        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), CompositeCopy);
+        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), DeviceColorSpace, CompositeCopy);
     else
-        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), CompositeCopy);
+        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, CompositeCopy);
 
     // Do cleanup
     CGContextRelease(cgContext);
@@ -88,7 +88,7 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
     return true;
 }
 
-void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator compositeOp)
+void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator compositeOp)
 {
     size_t frames = frameCount();
     for (size_t i = 0; i < frames; ++i) {
@@ -96,7 +96,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
         if (CGImageGetHeight(image) == static_cast<size_t>(srcSize.height()) && CGImageGetWidth(image) == static_cast<size_t>(srcSize.width())) {
             size_t currentFrame = m_currentFrame;
             m_currentFrame = i;
-            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), compositeOp);
+            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), styleColorSpace, compositeOp);
             m_currentFrame = currentFrame;
             return;
         }
@@ -104,7 +104,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
 
     // No image of the correct size was found, fallback to drawing the current frame
     IntSize imageSize = BitmapImage::size();
-    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), compositeOp);
+    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), styleColorSpace, compositeOp);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/win/ImageCairoWin.cpp b/WebCore/platform/graphics/win/ImageCairoWin.cpp
index 0b27438..e3c5ea0 100644
--- a/WebCore/platform/graphics/win/ImageCairoWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCairoWin.cpp
@@ -82,9 +82,9 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 
     IntSize imageSize = BitmapImage::size();
     if (size)
-        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), CompositeCopy);
+        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), DeviceColorSpace, CompositeCopy);
     else
-        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), CompositeCopy);
+        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, CompositeCopy);
 
     // Do cleanup
     cairo_destroy(targetRef);
@@ -92,7 +92,7 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
     return true;
 }
 
-void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator compositeOp)
+void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator compositeOp)
 {
     size_t frames = frameCount();
     for (size_t i = 0; i < frames; ++i) {
@@ -100,7 +100,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
         if (cairo_image_surface_get_height(image) == static_cast<size_t>(srcSize.height()) && cairo_image_surface_get_width(image) == static_cast<size_t>(srcSize.width())) {
             size_t currentFrame = m_currentFrame;
             m_currentFrame = i;
-            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), compositeOp);
+            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), DeviceColorSpace, compositeOp);
             m_currentFrame = currentFrame;
             return;
         }
@@ -108,7 +108,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
 
     // No image of the correct size was found, fallback to drawing the current frame
     IntSize imageSize = BitmapImage::size();
-    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), compositeOp);
+    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, compositeOp);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/win/IntPointWin.cpp b/WebCore/platform/graphics/win/IntPointWin.cpp
index a6ce0bb..73db199 100644
--- a/WebCore/platform/graphics/win/IntPointWin.cpp
+++ b/WebCore/platform/graphics/win/IntPointWin.cpp
@@ -23,6 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "IntPoint.h"
 
 #include <windows.h>
diff --git a/WebCore/platform/graphics/win/IntRectWin.cpp b/WebCore/platform/graphics/win/IntRectWin.cpp
index 6228be8..fe25a7f 100644
--- a/WebCore/platform/graphics/win/IntRectWin.cpp
+++ b/WebCore/platform/graphics/win/IntRectWin.cpp
@@ -1,3 +1,4 @@
+
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  *
@@ -23,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "IntRect.h"
 
 #include <windows.h>
diff --git a/WebCore/platform/graphics/win/IntSizeWin.cpp b/WebCore/platform/graphics/win/IntSizeWin.cpp
index 8a27cdb..26e68da 100644
--- a/WebCore/platform/graphics/win/IntSizeWin.cpp
+++ b/WebCore/platform/graphics/win/IntSizeWin.cpp
@@ -23,6 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "IntSize.h"
 
 #include <windows.h>
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
index 15e1001..a5beea1 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
@@ -318,6 +318,20 @@ void MediaPlayerPrivate::setPreservesPitch(bool preservesPitch)
     m_qtMovie->setPreservesPitch(preservesPitch);
 }
 
+bool MediaPlayerPrivate::hasClosedCaptions() const
+{
+    if (!m_qtMovie)
+        return false;
+    return m_qtMovie->hasClosedCaptions();
+}
+
+void MediaPlayerPrivate::setClosedCaptionsVisible(bool visible)
+{
+    if (!m_qtMovie)
+        return;
+    m_qtMovie->setClosedCaptionsVisible(visible);
+}
+
 int MediaPlayerPrivate::dataRate() const
 {
     // This is not used at the moment
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
index 4a3a28e..2bccbbf 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
@@ -49,7 +49,10 @@ public:
     static void registerMediaEngine(MediaEngineRegistrar);
 
     ~MediaPlayerPrivate();
-    
+
+private:
+    MediaPlayerPrivate(MediaPlayer*);
+
     IntSize naturalSize() const;
     bool hasVideo() const;
     bool hasAudio() const;
@@ -93,8 +96,8 @@ public:
     
     bool hasSingleSecurityOrigin() const;
 
-private:
-    MediaPlayerPrivate(MediaPlayer*);
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool);
 
     void updateStates();
     void doSeek();
diff --git a/WebCore/platform/graphics/win/QTMovieWin.cpp b/WebCore/platform/graphics/win/QTMovieWin.cpp
index 56f3d0b..2d4c2ea 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.cpp
+++ b/WebCore/platform/graphics/win/QTMovieWin.cpp
@@ -45,6 +45,12 @@ using namespace std;
 
 static const long minimumQuickTimeVersion = 0x07300000; // 7.3
 
+static const long closedCaptionTrackType = 'clcp';
+static const long subTitleTrackType = 'sbtl';
+static const long mpeg4ObjectDescriptionTrackType = 'odsm';
+static const long mpeg4SceneDescriptionTrackType = 'sdsm';
+static const long closedCaptionDisplayPropertyID = 'disp';
+
 // Resizing GWorlds is slow, give them a minimum size so size of small 
 // videos can be animated smoothly
 static const int cGWorldMinWidth = 640;
@@ -757,10 +763,10 @@ void QTMovieWin::disableUnsupportedTracks(unsigned& enabledTrackCount, unsigned&
         allowedTrackTypes->add(SoundMediaType);
         allowedTrackTypes->add(TextMediaType);
         allowedTrackTypes->add(BaseMediaType);
-        allowedTrackTypes->add('clcp'); // Closed caption
-        allowedTrackTypes->add('sbtl'); // Subtitle
-        allowedTrackTypes->add('odsm'); // MPEG-4 object descriptor stream
-        allowedTrackTypes->add('sdsm'); // MPEG-4 scene description stream
+        allowedTrackTypes->add(closedCaptionTrackType);
+        allowedTrackTypes->add(subTitleTrackType);
+        allowedTrackTypes->add(mpeg4ObjectDescriptionTrackType);
+        allowedTrackTypes->add(mpeg4SceneDescriptionTrackType);
         allowedTrackTypes->add(TimeCodeMediaType);
         allowedTrackTypes->add(TimeCode64MediaType);
     }
@@ -877,6 +883,27 @@ bool QTMovieWin::hasAudio() const
     return (GetMovieIndTrackType(m_private->m_movie, 1, AudioMediaCharacteristic, movieTrackCharacteristic | movieTrackEnabledOnly));
 }
 
+
+bool QTMovieWin::hasClosedCaptions() const 
+{
+    if (!m_private->m_movie)
+        return false;
+    return GetMovieIndTrackType(m_private->m_movie, 1, closedCaptionTrackType, movieTrackMediaType);
+}
+
+void QTMovieWin::setClosedCaptionsVisible(bool visible)
+{
+    if (!m_private->m_movie)
+        return;
+
+    Track ccTrack = GetMovieIndTrackType(m_private->m_movie, 1, closedCaptionTrackType, movieTrackMediaType);
+    if (!ccTrack)
+        return;
+
+    Boolean doDisplay = visible;
+    QTSetTrackProperty(ccTrack, closedCaptionTrackType, closedCaptionDisplayPropertyID, sizeof(doDisplay), &doDisplay);
+}
+
 pascal OSErr movieDrawingCompleteProc(Movie movie, long data)
 {
     UppParam param;
diff --git a/WebCore/platform/graphics/win/QTMovieWin.h b/WebCore/platform/graphics/win/QTMovieWin.h
index d178eb8..778f9aa 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.h
+++ b/WebCore/platform/graphics/win/QTMovieWin.h
@@ -98,6 +98,9 @@ public:
     bool hasVideo() const;
     bool hasAudio() const;
 
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool);
+
     static unsigned countSupportedTypes();
     static void getSupportedType(unsigned index, const UChar*& str, unsigned& len);
 
diff --git a/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp b/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp
new file mode 100644
index 0000000..e97b530
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "WKCACFContextFlusher.h"
+
+#include <wtf/StdLibExtras.h>
+#include <QuartzCore/CACFContext.h>
+
+namespace WebCore {
+
+WKCACFContextFlusher& WKCACFContextFlusher::shared()
+{
+    DEFINE_STATIC_LOCAL(WKCACFContextFlusher, flusher, ());
+    return flusher;
+}
+
+WKCACFContextFlusher::WKCACFContextFlusher()
+{
+}
+
+WKCACFContextFlusher::~WKCACFContextFlusher()
+{
+}
+
+void WKCACFContextFlusher::addContext(CACFContextRef context)
+{
+    ASSERT(context);
+
+    m_contexts.add(context);
+    CFRetain(context);
+}
+
+void WKCACFContextFlusher::removeContext(CACFContextRef context)
+{
+    ASSERT(context);
+
+    ContextSet::iterator found = m_contexts.find(context);
+    if (found == m_contexts.end())
+        return;
+
+    CFRelease(*found);
+    m_contexts.remove(found);
+}
+
+void WKCACFContextFlusher::flushAllContexts()
+{
+    // addContext might get called beneath CACFContextFlush, and we don't want m_contexts to change while
+    // we're iterating over it, so we move the contexts into a local ContextSet and iterate over that instead.
+    ContextSet contextsToFlush;
+    contextsToFlush.swap(m_contexts);
+
+    ContextSet::const_iterator end = contextsToFlush.end();
+    for (ContextSet::const_iterator it = contextsToFlush.begin(); it != end; ++it) {
+        CACFContextRef context = *it;
+        CACFContextFlush(context);
+        CFRelease(context);
+    }
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/WebCore/platform/graphics/win/WKCACFContextFlusher.h
index 21af0a6..9ce76aa 100644
--- a/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
+++ b/WebCore/platform/graphics/win/WKCACFContextFlusher.h
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
@@ -23,28 +23,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
+#ifndef WKCACFContextFlusher_h
+#define WKCACFContextFlusher_h
 
-#if ENABLE(3D_CANVAS)
+#if USE(ACCELERATED_COMPOSITING)
 
-#include "JSCanvasShortArray.h"
+#include <wtf/Noncopyable.h>
 
-#include "CanvasShortArray.h"
+#include <wtf/HashSet.h>
 
-using namespace JSC;
+typedef struct _CACFContext* CACFContextRef;
 
 namespace WebCore {
 
-void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
-}
+class WKCACFContextFlusher : public Noncopyable {
+public:
+    static WKCACFContextFlusher& shared();
+
+    void addContext(CACFContextRef);
+    void removeContext(CACFContextRef);
+
+    void flushAllContexts();
+
+private:
+    WKCACFContextFlusher();
+    ~WKCACFContextFlusher();
+
+    typedef HashSet<CACFContextRef> ContextSet;
+    ContextSet m_contexts;
+};
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
 }
 
-} // namespace WebCore
+#endif // USE(ACCELERATED_COMPOSITING)
 
-#endif // ENABLE(3D_CANVAS)
+#endif // WKCACFContextFlusher_h
diff --git a/WebCore/platform/graphics/win/WKCACFLayer.cpp b/WebCore/platform/graphics/win/WKCACFLayer.cpp
new file mode 100644
index 0000000..21e010d
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFLayer.cpp
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "WKCACFLayer.h"
+
+#include "WKCACFContextFlusher.h"
+
+#include <stdio.h>
+#include <QuartzCore/CACFContext.h>
+#include <QuartzCore/CARender.h>
+
+#pragma comment(lib, "QuartzCore")

+
+namespace WebCore {
+
+using namespace std;
+
+static void displayInContext(CACFLayerRef layer, CGContextRef context)
+{
+    ASSERT_ARG(layer, WKCACFLayer::layer(layer));
+    WKCACFLayer::layer(layer)->display(context);
+}
+
+// FIXME: It might be good to have a way of ensuring that all WKCACFLayers eventually
+// get destroyed in debug builds. A static counter could accomplish this pretty easily.
+
+WKCACFLayer::WKCACFLayer(CFStringRef className, GraphicsLayerCACF* owner)
+    : m_layer(AdoptCF, CACFLayerCreate(className))
+    , m_needsDisplayOnBoundsChange(false)
+    , m_owner(owner)
+{
+    CACFLayerSetUserData(layer(), this);
+    CACFLayerSetDisplayCallback(layer(), displayInContext);
+}
+
+WKCACFLayer::~WKCACFLayer()
+{
+    // Our superlayer should be holding a reference to us, so there should be no way for us to be destroyed while we still have a superlayer.
+    ASSERT(!superlayer());
+
+    CACFLayerSetUserData(layer(), 0);
+    CACFLayerSetDisplayCallback(layer(), 0);
+}
+
+void WKCACFLayer::display(PlatformGraphicsContext* context)
+{
+    if (!m_owner)
+        return;
+
+    CGContextSaveGState(context);
+
+    CGRect layerBounds = bounds();
+    if (m_owner->contentsOrientation() == WebCore::GraphicsLayer::CompositingCoordinatesTopDown) {
+        CGContextScaleCTM(context, 1, -1);
+        CGContextTranslateCTM(context, 0, -layerBounds.size.height);
+    }
+
+    if (m_owner->client()) {
+        GraphicsContext graphicsContext(context);
+
+        // It's important to get the clip from the context, because it may be significantly
+        // smaller than the layer bounds (e.g. tiled layers)
+        CGRect clipBounds = CGContextGetClipBoundingBox(context);
+        IntRect clip(enclosingIntRect(clipBounds));
+        m_owner->paintGraphicsLayerContents(graphicsContext, clip);
+    }
+#ifndef NDEBUG
+    else {
+        ASSERT_NOT_REACHED();
+
+        // FIXME: ideally we'd avoid calling -setNeedsDisplay on a layer that is a plain color,
+        // so CA never makes backing store for it (which is what -setNeedsDisplay will do above).
+        CGContextSetRGBFillColor(context, 0.0f, 1.0f, 0.0f, 1.0f);
+        CGContextFillRect(context, layerBounds);
+    }
+#endif
+
+    if (m_owner->showRepaintCounter()) {
+        char text[16]; // that's a lot of repaints
+        _snprintf(text, sizeof(text), "%d", m_owner->incrementRepaintCount());
+
+        CGContextSaveGState(context);
+        CGContextSetRGBFillColor(context, 1.0f, 0.0f, 0.0f, 0.8f);
+        
+        CGRect aBounds = layerBounds;
+
+        aBounds.size.width = 10 + 12 * strlen(text);
+        aBounds.size.height = 25;
+        CGContextFillRect(context, aBounds);
+        
+        CGContextSetRGBFillColor(context, 0.0f, 0.0f, 0.0f, 1.0f);
+
+        CGContextSetTextMatrix(context, CGAffineTransformMakeScale(1.0f, -1.0f));
+        CGContextSelectFont(context, "Helvetica", 25, kCGEncodingMacRoman);
+        CGContextShowTextAtPoint(context, aBounds.origin.x + 3.0f, aBounds.origin.y + 20.0f, text, strlen(text));
+        
+        CGContextRestoreGState(context);        
+    }
+
+    CGContextRestoreGState(context);
+}
+
+void WKCACFLayer::becomeRootLayerForContext(CACFContextRef context)
+{
+    CACFContextSetLayer(context, layer());
+    setNeedsCommit();
+}
+
+void WKCACFLayer::setNeedsCommit()
+{
+    CACFContextRef context = CACFLayerGetContext(rootLayer()->layer());
+
+    // The context might now be set yet. This happens if a property gets set
+    // before placing the layer in the tree. In this case we don't need to 
+    // worry about remembering the context because we will when the layer is
+    // added to the tree.
+    if (context)
+        WKCACFContextFlusher::shared().addContext(context);
+
+    // Call notifySyncRequired(), which in this implementation plumbs through to
+    // call setRootLayerNeedsDisplay() on the WebView, which causes the CACFRenderer
+    // to render a frame.
+    if (m_owner)
+        m_owner->notifySyncRequired();
+}
+
+void WKCACFLayer::addSublayer(PassRefPtr<WKCACFLayer> sublayer)
+{
+    insertSublayer(sublayer, numSublayers());
+}
+
+void WKCACFLayer::insertSublayer(PassRefPtr<WKCACFLayer> sublayer, size_t index)
+{
+    index = min(index, numSublayers());
+    CACFLayerInsertSublayer(layer(), sublayer->layer(), index);
+    setNeedsCommit();
+}
+
+void WKCACFLayer::insertSublayerAboveLayer(PassRefPtr<WKCACFLayer> sublayer, const WKCACFLayer* reference)
+{
+    if (!reference) {
+        insertSublayer(sublayer, 0);
+        return;
+    }
+
+    int referenceIndex = indexOfSublayer(reference);
+    if (referenceIndex == -1) {
+        addSublayer(sublayer);
+        return;
+    }
+
+    insertSublayer(sublayer, referenceIndex + 1);
+}
+
+void WKCACFLayer::insertSublayerBelowLayer(PassRefPtr<WKCACFLayer> sublayer, const WKCACFLayer* reference)
+{
+    if (!reference) {
+        insertSublayer(sublayer, 0);
+        return;
+    }
+
+    int referenceIndex = indexOfSublayer(reference);
+    if (referenceIndex == -1) {
+        addSublayer(sublayer);
+        return;
+    }
+
+    insertSublayer(sublayer, referenceIndex);
+}
+
+void WKCACFLayer::replaceSublayer(WKCACFLayer* reference, PassRefPtr<WKCACFLayer> newLayer)
+{
+    ASSERT_ARG(reference, reference);
+    ASSERT_ARG(reference, reference->superlayer() == this);
+
+    if (reference == newLayer)
+        return;
+
+    if (!newLayer) {
+        removeSublayer(reference);
+        return;
+    }
+
+    newLayer->removeFromSuperlayer();
+
+    int referenceIndex = indexOfSublayer(reference);
+    ASSERT(referenceIndex != -1);
+    if (referenceIndex == -1)
+        return;
+
+    // FIXME: Can we make this more efficient? The current CACF API doesn't seem to give us a way to do so.
+    reference->removeFromSuperlayer();
+    insertSublayer(newLayer, referenceIndex);
+}
+
+void WKCACFLayer::removeFromSuperlayer()
+{
+    WKCACFLayer* superlayer = this->superlayer();
+    if (!superlayer)
+        return;
+
+    superlayer->removeSublayer(this);
+    CACFLayerRemoveFromSuperlayer(layer());
+    superlayer->setNeedsCommit();
+}
+
+void WKCACFLayer::removeSublayer(const WKCACFLayer* sublayer)
+{
+    int foundIndex = indexOfSublayer(sublayer);
+    if (foundIndex == -1)
+        return;
+
+    CACFLayerRemoveFromSuperlayer(sublayer->layer());
+    setNeedsCommit();
+}
+
+int WKCACFLayer::indexOfSublayer(const WKCACFLayer* reference)
+{
+    CACFLayerRef ref = reference->layer();
+    if (!ref)
+        return -1;
+
+    CFArrayRef sublayers = CACFLayerGetSublayers(layer());
+    size_t n = CFArrayGetCount(sublayers);
+
+    for (size_t i = 0; i < n; ++i)
+        if (CFArrayGetValueAtIndex(sublayers, i) == ref)
+            return i;
+
+    return -1;
+}
+
+WKCACFLayer* WKCACFLayer::ancestorOrSelfWithSuperlayer(WKCACFLayer* superlayer) const
+{
+    WKCACFLayer* layer = const_cast<WKCACFLayer*>(this);
+    for (WKCACFLayer* ancestor = this->superlayer(); ancestor; layer = ancestor, ancestor = ancestor->superlayer()) {
+        if (ancestor == superlayer)
+            return layer;
+    }
+    return 0;
+}
+
+void WKCACFLayer::setBounds(const CGRect& rect)
+{
+    if (CGRectEqualToRect(rect, bounds()))
+        return;
+
+    CACFLayerSetBounds(layer(), rect);
+    setNeedsCommit();
+
+    if (m_needsDisplayOnBoundsChange)
+        setNeedsDisplay();
+}
+
+void WKCACFLayer::setFrame(const CGRect& rect)
+{
+    CGRect oldFrame = frame();
+    if (CGRectEqualToRect(rect, oldFrame))
+        return;
+
+    CACFLayerSetFrame(layer(), rect);
+    setNeedsCommit();
+
+    if (m_needsDisplayOnBoundsChange)
+        setNeedsDisplay();
+}
+
+WKCACFLayer* WKCACFLayer::rootLayer() const
+{
+    WKCACFLayer* layer = const_cast<WKCACFLayer*>(this);
+    for (WKCACFLayer* superlayer = layer->superlayer(); superlayer; layer = superlayer, superlayer = superlayer->superlayer()) { }
+    return layer;
+}
+
+void WKCACFLayer::removeAllSublayers()
+{
+    CACFLayerSetSublayers(layer(), 0);
+    setNeedsCommit();
+}
+
+void WKCACFLayer::setSublayers(const Vector<RefPtr<WKCACFLayer> >& sublayers)
+{
+    if (sublayers.isEmpty())
+        CACFLayerSetSublayers(layer(), 0);
+    else {
+        // Create a vector of CACFLayers.
+        Vector<const void*> layers;
+        for (size_t i = 0; i < sublayers.size(); i++)
+            layers.append(sublayers[i]->layer());
+    
+        RetainPtr<CFArrayRef> layersArray(AdoptCF, CFArrayCreate(0, layers.data(), layers.size(), 0));
+        CACFLayerSetSublayers(layer(), layersArray.get());
+    }
+    
+    setNeedsCommit();
+}
+
+void WKCACFLayer::moveSublayers(WKCACFLayer* fromLayer, WKCACFLayer* toLayer)
+{
+    if (!fromLayer || !toLayer)
+        return;
+
+    CACFLayerSetSublayers(toLayer->layer(), CACFLayerGetSublayers(fromLayer->layer()));
+    fromLayer->setNeedsCommit();
+    toLayer->setNeedsCommit();
+}
+
+WKCACFLayer* WKCACFLayer::superlayer() const
+{
+    CACFLayerRef super = CACFLayerGetSuperlayer(layer());
+    if (!super)
+        return 0;
+    return WKCACFLayer::layer(super);
+}
+
+void WKCACFLayer::setNeedsDisplay(const CGRect& dirtyRect)
+{
+    if (m_owner)
+        CACFLayerSetNeedsDisplay(layer(), &dirtyRect);
+    setNeedsCommit();
+}
+
+void WKCACFLayer::setNeedsDisplay()
+{
+    if (m_owner)
+        CACFLayerSetNeedsDisplay(layer(), 0);
+    setNeedsCommit();
+}
+
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/win/WKCACFLayer.h b/WebCore/platform/graphics/win/WKCACFLayer.h
new file mode 100644
index 0000000..6655f7a
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFLayer.h
@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WKCACFLayer_h
+#define WKCACFLayer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "StringHash.h"
+
+#include <wtf/RefCounted.h>
+
+#include <QuartzCore/CACFLayer.h>
+#include <QuartzCore/CACFVector.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+
+#include "GraphicsContext.h"
+#include "GraphicsLayerCACF.h"
+#include "PlatformString.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+
+class WKCACFAnimation;
+class WKCACFTimingFunction;
+
+class WKCACFLayer : public RefCounted<WKCACFLayer> {
+public:
+    static PassRefPtr<WKCACFLayer> create(CFStringRef className, GraphicsLayerCACF* owner = 0) { return adoptRef(new WKCACFLayer(className, owner)); }
+    static WKCACFLayer* layer(CACFLayerRef layer) { return static_cast<WKCACFLayer*>(CACFLayerGetUserData(layer)); }
+
+    ~WKCACFLayer();
+
+    // Makes this layer the root when the passed context is rendered
+    void becomeRootLayerForContext(CACFContextRef);
+
+    static RetainPtr<CFTypeRef> cfValue(float value) { return RetainPtr<CFTypeRef>(AdoptCF, CFNumberCreate(0, kCFNumberFloat32Type, &value)); }
+    static RetainPtr<CFTypeRef> cfValue(const TransformationMatrix& value)
+    {
+        CATransform3D t;
+        t.m11 = value.m11();
+        t.m12 = value.m12();
+        t.m13 = value.m13();
+        t.m14 = value.m14(); 
+        t.m21 = value.m21();
+        t.m22 = value.m22();
+        t.m23 = value.m23();
+        t.m24 = value.m24(); 
+        t.m31 = value.m31();
+        t.m32 = value.m32();
+        t.m33 = value.m33();
+        t.m34 = value.m34(); 
+        t.m41 = value.m41();
+        t.m42 = value.m42();
+        t.m43 = value.m43();
+        t.m44 = value.m44(); 
+        return RetainPtr<CFTypeRef>(AdoptCF, CACFVectorCreateTransform(t));
+    }
+    static RetainPtr<CFTypeRef> cfValue(const FloatPoint& value)
+    {
+        CGPoint p;
+        p.x = value.x(); p.y = value.y();
+        return RetainPtr<CFTypeRef>(AdoptCF, CACFVectorCreatePoint(p));
+    }
+    static RetainPtr<CFTypeRef> cfValue(const FloatRect& rect)
+    {
+        CGRect r;
+        r.origin.x = rect.x();
+        r.origin.y = rect.y();
+        r.size.width = rect.width();
+        r.size.height = rect.height();
+        CGFloat v[4] = { CGRectGetMinX(r), CGRectGetMinY(r), CGRectGetMaxX(r), CGRectGetMaxY(r) };
+        return RetainPtr<CFTypeRef>(AdoptCF, CACFVectorCreate(4, v));
+    }
+    static RetainPtr<CFTypeRef> cfValue(const Color& color)
+    {
+        return RetainPtr<CFTypeRef>(AdoptCF, CGColorCreateGenericRGB(color.red(), color.green(), color.blue(), color.alpha()));
+    }
+
+    void display(PlatformGraphicsContext*);
+
+    bool isTransformLayer() const { return CACFLayerGetClass(layer()) == kCACFTransformLayer; }
+
+    void addSublayer(PassRefPtr<WKCACFLayer> sublayer);
+    void insertSublayer(PassRefPtr<WKCACFLayer>, size_t index);
+    void insertSublayerAboveLayer(PassRefPtr<WKCACFLayer>, const WKCACFLayer* reference);
+    void insertSublayerBelowLayer(PassRefPtr<WKCACFLayer>, const WKCACFLayer* reference);
+    void replaceSublayer(WKCACFLayer* reference, PassRefPtr<WKCACFLayer>);
+    void removeFromSuperlayer();
+    static void moveSublayers(WKCACFLayer* fromLayer, WKCACFLayer* toLayer);
+
+    WKCACFLayer* ancestorOrSelfWithSuperlayer(WKCACFLayer*) const;
+    
+    void setAnchorPoint(const CGPoint& p) { CACFLayerSetAnchorPoint(layer(), p); setNeedsCommit(); }
+    CGPoint anchorPoint() const { return CACFLayerGetAnchorPoint(layer()); }
+
+    void setAnchorPointZ(CGFloat z) { CACFLayerSetAnchorPointZ(layer(), z); setNeedsCommit(); }
+    CGFloat anchorPointZ() const { return CACFLayerGetAnchorPointZ(layer()); }
+
+    void setBackgroundColor(CGColorRef color) { CACFLayerSetBackgroundColor(layer(), color); setNeedsCommit(); }
+    CGColorRef backgroundColor() const { return CACFLayerGetBackgroundColor(layer()); }
+
+    void setBorderColor(CGColorRef color) { CACFLayerSetBorderColor(layer(), color); setNeedsCommit(); }
+    CGColorRef borderColor() const { return CACFLayerGetBorderColor(layer()); }
+
+    void setBorderWidth(CGFloat width) { CACFLayerSetBorderWidth(layer(), width); setNeedsCommit(); }
+    CGFloat borderWidth() const { return CACFLayerGetBorderWidth(layer()); }
+
+    void setBounds(const CGRect&);
+    CGRect bounds() const { return CACFLayerGetBounds(layer()); }
+
+    void setClearsContext(bool clears) { CACFLayerSetClearsContext(layer(), clears); setNeedsCommit(); }
+    bool clearsContext() const { return CACFLayerGetClearsContext(layer()); }
+
+    void setContents(CGImageRef contents) { CACFLayerSetContents(layer(), contents); setNeedsCommit(); }
+    CGImageRef contents() const { return static_cast<CGImageRef>(const_cast<void*>(CACFLayerGetContents(layer()))); }
+
+    void setContentsRect(const CGRect& contentsRect) { CACFLayerSetContentsRect(layer(), contentsRect); setNeedsCommit(); }
+    CGRect contentsRect() const { return CACFLayerGetContentsRect(layer()); }
+
+    void setContentsGravity(CFStringRef str) { CACFLayerSetContentsGravity(layer(), str); setNeedsCommit(); }
+    CFStringRef contentsGravity() const { return CACFLayerGetContentsGravity(layer()); }
+        
+    void setDoubleSided(bool b) { CACFLayerSetDoubleSided(layer(), b); setNeedsCommit(); }
+    bool doubleSided() const { return CACFLayerIsDoubleSided(layer()); }
+
+    void setEdgeAntialiasingMask(uint32_t mask) { CACFLayerSetEdgeAntialiasingMask(layer(), mask); setNeedsCommit(); }
+    uint32_t edgeAntialiasingMask() const { return CACFLayerGetEdgeAntialiasingMask(layer()); }
+
+    void setFilters(CFArrayRef filters) { CACFLayerSetFilters(layer(), filters); setNeedsCommit(); }
+    CFArrayRef filters() const { return CACFLayerGetFilters(layer()); }
+
+    void setFrame(const CGRect&);
+    CGRect frame() const { return CACFLayerGetFrame(layer()); }
+
+    void setHidden(bool hidden) { CACFLayerSetHidden(layer(), hidden); setNeedsCommit(); }
+    bool isHidden() const { return CACFLayerIsHidden(layer()); }
+
+    void setMasksToBounds(bool b) { CACFLayerSetMasksToBounds(layer(), b); }
+    bool masksToBounds() const { return CACFLayerGetMasksToBounds(layer()); }
+
+    void setMagnificationFilter(const String& string) { CACFLayerSetMagnificationFilter(layer(), RetainPtr<CFStringRef>(AdoptCF, string.createCFString()).get()); }
+    String magnificationFilter() const { return CACFLayerGetMagnificationFilter(layer()); }
+
+    void setMinificationFilter(const String& string) { CACFLayerSetMinificationFilter(layer(), RetainPtr<CFStringRef>(AdoptCF, string.createCFString()).get()); }
+    String minificationFilter() const { return CACFLayerGetMinificationFilter(layer()); }
+
+    void setMinificationFilterBias(float bias) { CACFLayerSetMinificationFilterBias(layer(), bias); }
+    float minificationFilterBias() const { return CACFLayerGetMinificationFilterBias(layer()); }
+
+    void setName(const String& name) { CACFLayerSetName(layer(), RetainPtr<CFStringRef>(AdoptCF, name.createCFString()).get()); }
+    String name() const { return CACFLayerGetName(layer()); }
+
+    void setNeedsDisplay(const CGRect& dirtyRect);
+    void setNeedsDisplay();
+    
+    void setNeedsDisplayOnBoundsChange(bool needsDisplay) { m_needsDisplayOnBoundsChange = needsDisplay; }
+
+    void setOpacity(float opacity) { CACFLayerSetOpacity(layer(), opacity); setNeedsCommit(); }
+    float opacity() const { return CACFLayerGetOpacity(layer()); }
+
+    void setOpaque(bool b) { CACFLayerSetOpaque(layer(), b); setNeedsCommit(); }
+    bool opaque() const { return CACFLayerIsOpaque(layer()); }
+
+    void setPosition(const CGPoint& position) { CACFLayerSetPosition(layer(), position); setNeedsCommit(); }
+    CGPoint position() const { return CACFLayerGetPosition(layer()); }
+
+    void setZPosition(CGFloat position) { CACFLayerSetZPosition(layer(), position); setNeedsCommit(); }
+    CGFloat zPosition() const { return CACFLayerGetZPosition(layer()); }
+
+    void setSpeed(float speed) { CACFLayerSetSpeed(layer(), speed); }
+    CFTimeInterval speed() const { CACFLayerGetSpeed(layer()); }
+
+    void setTimeOffset(CFTimeInterval t) { CACFLayerSetTimeOffset(layer(), t); }
+    CFTimeInterval timeOffset() const { CACFLayerGetTimeOffset(layer()); }
+
+    WKCACFLayer* rootLayer() const;
+
+    void setSortsSublayers(bool sorts) { CACFLayerSetSortsSublayers(layer(), sorts); setNeedsCommit(); }
+    bool sortsSublayers() const { return CACFLayerGetSortsSublayers(layer()); }
+
+    void removeAllSublayers();
+    
+    void setSublayers(const Vector<RefPtr<WKCACFLayer> >&);
+
+    void setSublayerTransform(const CATransform3D& transform) { CACFLayerSetSublayerTransform(layer(), transform); setNeedsCommit(); }
+    CATransform3D sublayerTransform() const { return CACFLayerGetSublayerTransform(layer()); }
+
+    WKCACFLayer* superlayer() const;
+
+    void setTransform(const CATransform3D& transform) { CACFLayerSetTransform(layer(), transform); setNeedsCommit(); }
+    CATransform3D transform() const { return CACFLayerGetTransform(layer()); }
+
+    void setGeometryFlipped(bool flipped) { CACFLayerSetGeometryFlipped(layer(), flipped); setNeedsCommit(); }
+    bool geometryFlipped() const { return CACFLayerIsGeometryFlipped(layer()); }
+
+    WKCACFLayer(CFStringRef className, GraphicsLayerCACF* owner);
+
+private:
+    void setNeedsCommit();
+    CACFLayerRef layer() const { return m_layer.get(); }
+    size_t numSublayers() const
+    {
+        CFArrayRef sublayers = CACFLayerGetSublayers(layer());
+        return sublayers ? CFArrayGetCount(sublayers) : 0;
+    }
+    
+    // Returns the index of the passed layer in this layer's sublayers list
+    // or -1 if not found
+    int indexOfSublayer(const WKCACFLayer*);
+
+    // This should only be called from removeFromSuperlayer.
+    void removeSublayer(const WKCACFLayer*);
+
+    RetainPtr<CACFLayerRef> m_layer;
+    bool m_needsDisplayOnBoundsChange;
+    GraphicsLayerCACF* m_owner;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // WKCACFLayer_h
diff --git a/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp b/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp
new file mode 100644
index 0000000..9fbd0fc
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp
@@ -0,0 +1,449 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "WKCACFLayerRenderer.h"
+
+#include "WKCACFContextFlusher.h"
+#include "WKCACFLayer.h"
+#include <CoreGraphics/CGSRegion.h>
+#include <QuartzCore/CACFContext.h>
+#include <QuartzCore/CARenderOGL.h>
+#include <wtf/HashMap.h>
+#include <wtf/OwnArrayPtr.h>
+#include <d3d9.h>
+#include <d3dx9.h>
+#include <dxerr9.h>
+
+#pragma comment(lib, "d3d9")

+#pragma comment(lib, "d3dx9")

+#pragma comment(lib, "QuartzCore")

+
+static IDirect3D9* s_d3d = 0;
+static IDirect3D9* d3d()
+{
+    if (s_d3d)
+        return s_d3d;
+
+    if (!LoadLibrary(TEXT("d3d9.dll")))
+        return 0;
+
+    s_d3d = Direct3DCreate9(D3D_SDK_VERSION);
+
+    return s_d3d;
+}
+
+inline static CGRect winRectToCGRect(RECT rc)
+{
+    return CGRectMake(rc.left, rc.top, (rc.right - rc.left), (rc.bottom - rc.top));
+}
+
+inline static CGRect winRectToCGRect(RECT rc, RECT relativeToRect)
+{
+    return CGRectMake(rc.left, (relativeToRect.bottom-rc.bottom), (rc.right - rc.left), (rc.bottom - rc.top));
+}
+
+namespace WebCore {
+
+typedef HashMap<CACFContextRef, WKCACFLayerRenderer*> ContextToWindowMap;
+
+static ContextToWindowMap& windowsForContexts()
+{
+    DEFINE_STATIC_LOCAL(ContextToWindowMap, map, ());
+    return map;
+}
+
+static D3DPRESENT_PARAMETERS initialPresentationParameters()
+{
+    D3DPRESENT_PARAMETERS parameters = {0};
+    parameters.Windowed = TRUE;
+    parameters.SwapEffect = D3DSWAPEFFECT_COPY;
+    parameters.BackBufferCount = 1;
+    parameters.BackBufferFormat = D3DFMT_A8R8G8B8;
+    parameters.MultiSampleType = D3DMULTISAMPLE_NONE;
+
+    return parameters;
+}
+
+bool WKCACFLayerRenderer::acceleratedCompositingAvailable()

+{

+    static bool available;

+    static bool tested;

+

+    if (tested)

+        return available;

+

+    tested = true;

+    HMODULE library = LoadLibrary(TEXT("d3d9.dll"));

+    if (!library)

+        return false;

+

+    FreeLibrary(library);

+    library = LoadLibrary(TEXT("QuartzCore.dll"));

+    if (!library)

+        return false;

+

+    FreeLibrary(library);

+    available = true;

+    return available;

+}

+

+void WKCACFLayerRenderer::didFlushContext(CACFContextRef context)
+{
+    WKCACFLayerRenderer* window = windowsForContexts().get(context);
+    if (!window)
+        return;
+
+    window->renderSoon();
+}
+
+PassOwnPtr<WKCACFLayerRenderer> WKCACFLayerRenderer::create()
+{
+    if (!acceleratedCompositingAvailable())
+        return 0;
+    return new WKCACFLayerRenderer;
+}
+
+WKCACFLayerRenderer::WKCACFLayerRenderer()
+    : m_triedToCreateD3DRenderer(false)
+    , m_renderContext(0)
+    , m_renderer(0)
+    , m_hostWindow(0)
+    , m_renderTimer(this, &WKCACFLayerRenderer::renderTimerFired)
+    , m_scrollFrameWidth(1) // Default to 1 to avoid 0 size frames
+    , m_scrollFrameHeight(1) // Default to 1 to avoid 0 size frames
+{
+}
+
+WKCACFLayerRenderer::~WKCACFLayerRenderer()
+{
+    destroyRenderer();
+}
+
+void WKCACFLayerRenderer::setScrollFrame(int width, int height, int scrollX, int scrollY)
+{
+    m_scrollFrameWidth = width;
+    m_scrollFrameHeight = height;
+
+    CGRect contentsRect = CGRectMake(scrollX, scrollY, width, height);
+    m_scrollLayer->setFrame(contentsRect);
+
+    if (m_rootChildLayer) {
+        contentsRect.origin.x = 0;
+        contentsRect.origin.y = 0;
+        m_rootChildLayer->setFrame(contentsRect);
+    }
+}
+
+void WKCACFLayerRenderer::setRootContents(CGImageRef image)
+{
+    ASSERT(m_rootLayer);
+    m_rootLayer->setContents(image);
+    renderSoon();
+}
+
+void WKCACFLayerRenderer::setRootChildLayer(WebCore::PlatformLayer* layer)
+{
+    if (!m_scrollLayer)
+        return;
+
+    m_scrollLayer->removeAllSublayers();
+    if (layer) {
+        m_scrollLayer->addSublayer(layer);
+
+        // Set the frame
+        layer->setFrame(CGRectMake(0, 0, m_scrollFrameWidth, m_scrollFrameHeight));
+    }
+
+    m_rootChildLayer = layer;
+
+}
+   
+void WKCACFLayerRenderer::setNeedsDisplay()
+{
+    ASSERT(m_rootLayer);
+    m_rootLayer->setNeedsDisplay();
+    renderSoon();
+}
+
+void WKCACFLayerRenderer::createRenderer()
+{
+    if (m_triedToCreateD3DRenderer)
+        return;
+
+    m_triedToCreateD3DRenderer = true;
+    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
+
+    if (!d3d() || !::IsWindow(m_hostWindow))
+        return;
+
+    // D3D doesn't like to make back buffers for 0 size windows. We skirt this problem if we make the
+    // passed backbuffer width and height non-zero. The window will necessarily get set to a non-zero
+    // size eventually, and then the backbuffer size will get reset.
+    RECT rect;
+    GetClientRect(m_hostWindow, &rect);
+
+    if (rect.left-rect.right == 0 || rect.bottom-rect.top == 0) {
+        parameters.BackBufferWidth = 1;
+        parameters.BackBufferHeight = 1;
+    }
+
+    if (FAILED(d3d()->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, m_hostWindow, D3DCREATE_HARDWARE_VERTEXPROCESSING | D3DCREATE_FPU_PRESERVE, &parameters, &m_d3dDevice)))
+        return;
+
+    D3DXMATRIXA16 projection;
+    D3DXMatrixOrthoOffCenterRH(&projection, rect.left, rect.right, rect.top, rect.bottom, -1.0f, 1.0f);
+
+    m_d3dDevice->SetTransform(D3DTS_PROJECTION, &projection);
+
+    m_context.adoptCF(CACFContextCreate(0));
+    windowsForContexts().set(m_context.get(), this);
+
+    m_renderContext = static_cast<CARenderContext*>(CACFContextGetRenderContext(m_context.get()));
+    m_renderer = CARenderOGLNew(&kCARenderDX9Callbacks, m_d3dDevice.get(), 0);
+
+    // Create the root hierarchy
+    m_rootLayer = WKCACFLayer::create(kCACFLayer);
+    m_scrollLayer = WKCACFLayer::create(kCACFLayer);
+
+    m_rootLayer->addSublayer(m_scrollLayer);
+    m_scrollLayer->setMasksToBounds(true);
+
+#ifndef NDEBUG
+    CGColorRef debugColor = createCGColor(Color(255, 0, 0, 204));
+    m_rootLayer->setBackgroundColor(debugColor);
+    CGColorRelease(debugColor);
+#endif
+
+    if (IsWindow(m_hostWindow)) {
+        m_rootLayer->setFrame(bounds());
+
+        // For now this will include the scroll bars. Later in the setScrollFrame
+        // we will fix it
+        m_scrollLayer->setFrame(bounds());
+    }
+
+    if (m_context)
+        m_rootLayer->becomeRootLayerForContext(m_context.get());
+}
+
+void WKCACFLayerRenderer::destroyRenderer()
+{
+    if (m_context) {
+        windowsForContexts().remove(m_context.get());
+        WKCACFContextFlusher::shared().removeContext(m_context.get());
+    }
+
+    if (m_renderer)
+        CARenderOGLDestroy(m_renderer);
+    m_renderer = 0;
+    m_d3dDevice = 0;
+    if (s_d3d)
+        s_d3d->Release();
+
+    s_d3d = 0;
+    m_rootLayer = 0;
+    m_scrollLayer = 0;
+    m_rootChildLayer = 0;
+
+    m_triedToCreateD3DRenderer = false;
+}
+
+void WKCACFLayerRenderer::resize()
+{
+    if (!m_d3dDevice)
+        return;
+
+    resetDevice();
+
+    if (m_rootLayer) {
+        m_rootLayer->setFrame(bounds());
+        WKCACFContextFlusher::shared().flushAllContexts();
+    }
+}
+
+static void getDirtyRects(HWND window, Vector<CGRect>& outRects)
+{
+    ASSERT_ARG(outRects, outRects.isEmpty());
+
+    RECT clientRect;
+    if (!GetClientRect(window, &clientRect))
+        return;
+
+    HRGN region = CreateRectRgn(0, 0, 0, 0);
+    int regionType = GetUpdateRgn(window, region, false);
+    if (regionType != COMPLEXREGION) {
+        RECT dirtyRect;
+        if (GetUpdateRect(window, &dirtyRect, false))
+            outRects.append(winRectToCGRect(dirtyRect, clientRect));
+        return;
+    }
+
+    DWORD dataSize = GetRegionData(region, 0, 0);
+    OwnArrayPtr<unsigned char> regionDataBuffer(new unsigned char[dataSize]);
+    RGNDATA* regionData = reinterpret_cast<RGNDATA*>(regionDataBuffer.get());
+    if (!GetRegionData(region, dataSize, regionData))
+        return;
+
+    outRects.resize(regionData->rdh.nCount);
+
+    RECT* rect = reinterpret_cast<RECT*>(regionData->Buffer);
+    for (size_t i = 0; i < outRects.size(); ++i, ++rect)
+        outRects[i] = winRectToCGRect(*rect, clientRect);
+
+    DeleteObject(region);
+}
+
+void WKCACFLayerRenderer::renderTimerFired(Timer<WKCACFLayerRenderer>*)
+{
+    paint();
+}
+
+void WKCACFLayerRenderer::paint()
+{
+    if (!m_d3dDevice)
+        return;
+
+    Vector<CGRect> dirtyRects;
+    getDirtyRects(m_hostWindow, dirtyRects);
+    render(dirtyRects);
+}
+
+void WKCACFLayerRenderer::render(const Vector<CGRect>& dirtyRects)
+{
+    ASSERT(m_d3dDevice);
+
+    // Flush the root layer to the render tree.
+    WKCACFContextFlusher::shared().flushAllContexts();
+
+    CGRect bounds = this->bounds();
+
+    CFTimeInterval t = CACurrentMediaTime();
+
+    // Give the renderer some space to use. This needs to be valid until the
+    // CARenderUpdateFinish() call below.
+    char space[4096];
+    CARenderUpdate* u = CARenderUpdateBegin(space, sizeof(space), t, 0, 0, &bounds);
+    if (!u)
+        return;
+
+    CARenderContextLock(m_renderContext);
+    CARenderUpdateAddContext(u, m_renderContext);
+    CARenderContextUnlock(m_renderContext);
+
+    for (size_t i = 0; i < dirtyRects.size(); ++i)
+        CARenderUpdateAddRect(u, &dirtyRects[i]);
+
+    HRESULT err = S_OK;
+    do {
+        CGSRegionObj rgn = CARenderUpdateCopyRegion(u);
+
+        if (!rgn)
+            break;
+
+        // FIXME: don't need to clear dirty region if layer tree is opaque.
+
+        Vector<D3DRECT, 64> rects;
+        CGSRegionEnumeratorObj e = CGSRegionEnumerator(rgn);
+        for (const CGRect* r = CGSNextRect(e); r; r = CGSNextRect(e)) {
+            D3DRECT rect;
+            rect.x1 = r->origin.x;
+            rect.x2 = rect.x1 + r->size.width;
+            rect.y1 = bounds.origin.y + bounds.size.height - (r->origin.y + r->size.height);
+            rect.y2 = rect.y1 + r->size.height;
+
+            rects.append(rect);
+        }
+        CGSReleaseRegionEnumerator(e);
+        CGSReleaseRegion(rgn);
+
+        if (rects.isEmpty())
+            break;
+
+        m_d3dDevice->Clear(rects.size(), rects.data(), D3DCLEAR_TARGET, 0, 1.0f, 0);
+
+        m_d3dDevice->BeginScene();
+        CARenderOGLRender(m_renderer, u);
+        m_d3dDevice->EndScene();
+
+        err = m_d3dDevice->Present(0, 0, 0, 0);
+
+        if (err == D3DERR_DEVICELOST) {
+            // Lost device situation.
+            CARenderOGLPurge(m_renderer);
+            resetDevice();
+            CARenderUpdateAddRect(u, &bounds);
+        }
+    } while (err == D3DERR_DEVICELOST);
+
+    CARenderUpdateFinish(u);
+}
+
+void WKCACFLayerRenderer::renderSoon()
+{
+    if (!m_renderTimer.isActive())
+        m_renderTimer.startOneShot(0);
+}
+
+CGRect WKCACFLayerRenderer::bounds() const
+{
+    RECT clientRect;
+    GetClientRect(m_hostWindow, &clientRect);
+
+    return winRectToCGRect(clientRect);
+}
+
+void WKCACFLayerRenderer::initD3DGeometry()
+{
+    ASSERT(m_d3dDevice);
+
+    CGRect bounds = this->bounds();
+
+    float x0 = bounds.origin.x;
+    float y0 = bounds.origin.y;
+    float x1 = x0 + bounds.size.width;
+    float y1 = y0 + bounds.size.height;
+
+    D3DXMATRIXA16 projection;
+    D3DXMatrixOrthoOffCenterRH(&projection, x0, x1, y0, y1, -1.0f, 1.0f);
+
+    m_d3dDevice->SetTransform(D3DTS_PROJECTION, &projection);
+}
+
+void WKCACFLayerRenderer::resetDevice()
+{
+    ASSERT(m_d3dDevice);
+
+    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
+    m_d3dDevice->Reset(&parameters);
+    initD3DGeometry();
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/win/WKCACFLayerRenderer.h b/WebCore/platform/graphics/win/WKCACFLayerRenderer.h
new file mode 100644
index 0000000..12cde48
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFLayerRenderer.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WKCACFLayerRenderer_h
+#define WKCACFLayerRenderer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "COMPtr.h"
+#include "Timer.h"
+#include "WKCACFLayer.h"
+
+#include <wtf/Noncopyable.h>
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/RetainPtr.h>
+
+#include <CoreGraphics/CGGeometry.h>
+
+interface IDirect3DDevice9;
+typedef struct _CACFContext* CACFContextRef;
+typedef struct _CARenderContext CARenderContext;
+typedef struct _CARenderOGLContext CARenderOGLContext;
+
+namespace WebCore {
+
+// FIXME: Currently there is a WKCACFLayerRenderer for each WebView and each
+// has its own CARenderOGLContext and Direct3DDevice9, which is inefficient.
+// (https://bugs.webkit.org/show_bug.cgi?id=31855)
+class WKCACFLayerRenderer : public Noncopyable {
+public:
+    static PassOwnPtr<WKCACFLayerRenderer> create();
+    ~WKCACFLayerRenderer();
+
+    static bool acceleratedCompositingAvailable();
+    static void didFlushContext(CACFContextRef);
+
+    void setScrollFrame(int width, int height, int scrollX, int scrollY);
+    void setRootContents(CGImageRef);
+    void setRootChildLayer(WebCore::PlatformLayer* layer);
+    void setNeedsDisplay();
+    void setHostWindow(HWND window) { m_hostWindow = window; createRenderer(); }
+
+    void createRenderer();
+    void destroyRenderer();
+    void resize();
+    void renderSoon();
+
+protected:
+    WKCACFLayer* rootLayer() const { return m_rootLayer.get(); }
+
+private:
+    WKCACFLayerRenderer();
+
+    void renderTimerFired(Timer<WKCACFLayerRenderer>*);
+
+    CGRect bounds() const;
+
+    void initD3DGeometry();
+    void resetDevice();
+
+    void render(const Vector<CGRect>& dirtyRects = Vector<CGRect>());
+    void paint();
+
+    bool m_triedToCreateD3DRenderer;
+    COMPtr<IDirect3DDevice9> m_d3dDevice;
+    RefPtr<WKCACFLayer> m_rootLayer;
+    RefPtr<WKCACFLayer> m_viewLayer;
+    RefPtr<WKCACFLayer> m_scrollLayer;
+    RefPtr<WKCACFLayer> m_rootChildLayer;
+    RetainPtr<CACFContextRef> m_context;
+    CARenderContext* m_renderContext;
+    CARenderOGLContext* m_renderer;
+    HWND m_hostWindow;
+    Timer<WKCACFLayerRenderer> m_renderTimer;
+    int m_scrollFrameWidth, m_scrollFrameHeight;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // WKCACFLayerRenderer_h
diff --git a/WebCore/platform/graphics/wince/GraphicsContextWince.cpp b/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
index f308840..f22e6c9 100644
--- a/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
+++ b/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
@@ -947,7 +947,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     }
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled() || !m_data->m_opacity)
         return;
@@ -1051,12 +1051,12 @@ void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint&, int wi
     notImplemented();
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& col)
+void GraphicsContext::setPlatformFillColor(const Color& col, ColorSpace colorSpace)
 {
     notImplemented();
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& col)
+void GraphicsContext::setPlatformStrokeColor(const Color& col, ColorSpace colorSpace)
 {
     notImplemented();
 }
@@ -1088,7 +1088,7 @@ void GraphicsContext::clearRect(const FloatRect& rect)
         return;
     } 
 
-    fillRect(rect, Color(Color::white));
+    fillRect(rect, Color(Color::white), DeviceColorSpace);
 }
 
 void GraphicsContext::strokeRect(const FloatRect& rect, float width)
@@ -1238,7 +1238,7 @@ static inline IntPoint rectCenterPoint(const RECT& rect)
 {
     return IntPoint(rect.left + (rect.right - rect.left) / 2, rect.top + (rect.bottom - rect.top) / 2);
 }
-void GraphicsContext::fillRoundedRect(const IntRect& fillRect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& c)
+void GraphicsContext::fillRoundedRect(const IntRect& fillRect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& c, ColorSpace colorSpace)
 {
     ScopeDCProvider dcProvider(m_data);
     if (!m_data->m_dc)
@@ -1355,7 +1355,7 @@ Color gradientAverageColor(const Gradient* gradient)
 
 void GraphicsContext::fillPath()
 {
-    Color c = m_common->state.fillColorSpace == GradientColorSpace && m_common->state.fillGradient
+    Color c = m_common->state.fillGradient
         ? gradientAverageColor(m_common->state.fillGradient.get())
         : fillColor();
 
@@ -1449,7 +1449,7 @@ void GraphicsContext::fillRect(const FloatRect& r, const Gradient* gradient)
     if (numStops == 1) {
         const Gradient::ColorStop& stop = stops.first();
         Color color(stop.red, stop.green, stop.blue, stop.alpha);
-        fillRect(r, color);
+        fillRect(r, color, DeviceColorSpace);
         return;
     } 
     
@@ -1539,13 +1539,13 @@ void GraphicsContext::clipToImageBuffer(const FloatRect&, const ImageBuffer*)
 
 void GraphicsContext::fillRect(const FloatRect& rect)
 {
-    if (m_common->state.fillColorSpace == GradientColorSpace && m_common->state.fillGradient)
+    if (m_common->state.fillGradient)
         fillRect(rect, m_common->state.fillGradient.get());
     else
-        fillRect(rect, fillColor());
+        fillRect(rect, fillColor(), DeviceColorSpace);
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize&, int, const Color&)
+void GraphicsContext::setPlatformShadow(const IntSize&, int, const Color&, ColorSpace)
 {
     notImplemented();
 }
diff --git a/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp b/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
index de92fcd..fd3322f 100644
--- a/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
+++ b/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
@@ -111,7 +111,7 @@ unsigned FontPlatformData::computeHash() const {
         // a font whose properties are equal should generate the same hash
         uintptr_t hashCodes[6] = { thisFont->GetPointSize(), thisFont->GetFamily(), thisFont->GetStyle(), 
                                     thisFont->GetWeight(), thisFont->GetUnderlined(), 
-                                    StringImpl::computeHash(thisFont->GetFaceName().mb_str(wxConvUTF8)) };
+                                    StringImpl::computeHash(thisFont->GetFaceName().utf8_str()) };
         
         return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
 }
diff --git a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index 39f14f4..9c05ce5 100644
--- a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -119,8 +119,8 @@ GraphicsContext::GraphicsContext(PlatformGraphicsContext* context)
     setPaintingDisabled(!context);
     if (context) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), DeviceColorSpace);
+        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
     }
 #if USE(WXGC)
     m_data->context = (wxGCDC*)context;
@@ -252,7 +252,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     delete [] polygon;
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -262,7 +262,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
     m_data->context->DrawRectangle(rect.x(), rect.y(), rect.width(), rect.height());
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -438,7 +438,7 @@ void GraphicsContext::addPath(const Path& path)
     notImplemented();
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& color)
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -457,7 +457,7 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
 
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -511,7 +511,7 @@ void GraphicsContext::fillRect(const FloatRect& rect)
         return;
 }
 
-void GraphicsContext::setPlatformShadow(IntSize const&,int,Color const&) 
+void GraphicsContext::setPlatformShadow(IntSize const&,int,Color const&, ColorSpace) 
 { 
     notImplemented(); 
 }
@@ -566,4 +566,72 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     notImplemented();
 }
 
+#if PLATFORM(WIN_OS)
+HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
+{
+    if (dstRect.isEmpty())
+        return 0;
+
+    // Create a bitmap DC in which to draw.
+    BITMAPINFO bitmapInfo;
+    bitmapInfo.bmiHeader.biSize          = sizeof(BITMAPINFOHEADER);
+    bitmapInfo.bmiHeader.biWidth         = dstRect.width();
+    bitmapInfo.bmiHeader.biHeight        = dstRect.height();
+    bitmapInfo.bmiHeader.biPlanes        = 1;
+    bitmapInfo.bmiHeader.biBitCount      = 32;
+    bitmapInfo.bmiHeader.biCompression   = BI_RGB;
+    bitmapInfo.bmiHeader.biSizeImage     = 0;
+    bitmapInfo.bmiHeader.biXPelsPerMeter = 0;
+    bitmapInfo.bmiHeader.biYPelsPerMeter = 0;
+    bitmapInfo.bmiHeader.biClrUsed       = 0;
+    bitmapInfo.bmiHeader.biClrImportant  = 0;
+
+    void* pixels = 0;
+    HBITMAP bitmap = ::CreateDIBSection(0, &bitmapInfo, DIB_RGB_COLORS, &pixels, 0, 0);
+    if (!bitmap)
+        return 0;
+
+    HDC displayDC = ::GetDC(0);
+    HDC bitmapDC = ::CreateCompatibleDC(displayDC);
+    ::ReleaseDC(0, displayDC);
+
+    ::SelectObject(bitmapDC, bitmap);
+
+    // Fill our buffer with clear if we're going to alpha blend.
+    if (supportAlphaBlend) {
+        BITMAP bmpInfo;
+        GetObject(bitmap, sizeof(bmpInfo), &bmpInfo);
+        int bufferSize = bmpInfo.bmWidthBytes * bmpInfo.bmHeight;
+        memset(bmpInfo.bmBits, 0, bufferSize);
+    }
+    return bitmapDC;
+}
+
+void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
+{
+    if (hdc) {
+
+        if (!dstRect.isEmpty()) {
+
+            HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+            BITMAP info;
+            GetObject(bitmap, sizeof(info), &info);
+            ASSERT(info.bmBitsPixel == 32);
+
+            wxBitmap bmp;
+            bmp.SetHBITMAP(bitmap);
+#if !wxCHECK_VERSION(2,9,0)
+            if (supportAlphaBlend)
+                bmp.UseAlpha();
+#endif
+            m_data->context->DrawBitmap(bmp, dstRect.x(), dstRect.y(), supportAlphaBlend);
+
+            ::DeleteObject(bitmap);
+        }
+
+        ::DeleteDC(hdc);
+    }
+}
+#endif
+
 }
diff --git a/WebCore/platform/graphics/wx/IconWx.cpp b/WebCore/platform/graphics/wx/IconWx.cpp
index e82091e..d3cc961 100644
--- a/WebCore/platform/graphics/wx/IconWx.cpp
+++ b/WebCore/platform/graphics/wx/IconWx.cpp
@@ -32,12 +32,6 @@ Icon::~Icon()
 {
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
-{
-    notImplemented();
-    return 0;
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
     notImplemented();
diff --git a/WebCore/platform/graphics/wx/ImageWx.cpp b/WebCore/platform/graphics/wx/ImageWx.cpp
index bd129cf..ff60d6f 100644
--- a/WebCore/platform/graphics/wx/ImageWx.cpp
+++ b/WebCore/platform/graphics/wx/ImageWx.cpp
@@ -86,13 +86,13 @@ void BitmapImage::initPlatformData()
 
 // Drawing Routines
 
-void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, CompositeOperator op)
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
     if (!m_source.initialized())
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dst, solidColor(), op);
+        fillWithSolidColor(ctxt, dst, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -176,7 +176,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatR
         observer->didDraw(this);
 }
 
-void BitmapImage::drawPattern(GraphicsContext* ctxt, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, CompositeOperator, const FloatRect& dstRect)
+void BitmapImage::drawPattern(GraphicsContext* ctxt, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, ColorSpace, CompositeOperator, const FloatRect& dstRect)
 {
     if (!m_source.initialized())
         return;
@@ -261,7 +261,7 @@ void BitmapImage::invalidatePlatformData()
 
 }
 
-void Image::drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, CompositeOperator, const FloatRect& destRect)
+void Image::drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, ColorSpace, CompositeOperator, const FloatRect& destRect)
 {
     notImplemented();
 }
diff --git a/WebCore/platform/gtk/GeolocationServiceGtk.cpp b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
index cf35346..edb8d10 100644
--- a/WebCore/platform/gtk/GeolocationServiceGtk.cpp
+++ b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
@@ -86,7 +86,7 @@ bool GeolocationServiceGtk::startUpdating(PositionOptions* options)
     g_object_unref(master);
 
     if (!client) {
-        setError(PositionError::UNKNOWN_ERROR, "Could not connect to location provider.");
+        setError(PositionError::POSITION_UNAVAILABLE, "Could not connect to location provider.");
         return false;
     }
 
@@ -101,14 +101,14 @@ bool GeolocationServiceGtk::startUpdating(PositionOptions* options)
                                                              true, GEOCLUE_RESOURCE_ALL, &error.outPtr());
 
     if (!result) {
-        setError(PositionError::UNKNOWN_ERROR, error->message);
+        setError(PositionError::POSITION_UNAVAILABLE, error->message);
         g_object_unref(client);
         return false;
     }
 
     m_geocluePosition = geoclue_master_client_create_position(client, &error.outPtr());
     if (!m_geocluePosition) {
-        setError(PositionError::UNKNOWN_ERROR, error->message);
+        setError(PositionError::POSITION_UNAVAILABLE, error->message);
         g_object_unref(client);
         return false;
     }
diff --git a/WebCore/platform/gtk/KeyEventGtk.cpp b/WebCore/platform/gtk/KeyEventGtk.cpp
index 3931eff..11ea956 100644
--- a/WebCore/platform/gtk/KeyEventGtk.cpp
+++ b/WebCore/platform/gtk/KeyEventGtk.cpp
@@ -507,6 +507,8 @@ static String singleCharacterString(guint val)
             return String("\r");
         case GDK_BackSpace:
             return String("\x8");
+        case GDK_Tab:
+            return String("\t");
         default:
             gunichar c = gdk_keyval_to_unicode(val);
             glong nwc;
diff --git a/WebCore/platform/gtk/Language.cpp b/WebCore/platform/gtk/Language.cpp
index fea2df6..577d7d8 100644
--- a/WebCore/platform/gtk/Language.cpp
+++ b/WebCore/platform/gtk/Language.cpp
@@ -43,12 +43,12 @@ String defaultLanguage()
     GOwnPtr<gchar> normalizedDefault(g_ascii_strdown(localeDefault, -1));
     char* ptr = strchr(normalizedDefault.get(), '_');
 
-    if(ptr)
+    if (ptr)
         *ptr = '-';
 
     ptr = strchr(normalizedDefault.get(), '.');
 
-    if(ptr)
+    if (ptr)
         *ptr = '\0';
 
     return String(normalizedDefault.get());
diff --git a/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index 85e071b..5809e47 100644
--- a/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -392,6 +392,10 @@ String localizedMediaControlElementString(const String& name)
         return String::fromUTF8(_("fast forward"));
     if (name == "SeekBackButton")
         return String::fromUTF8(_("fast reverse"));
+    if (name == "ShowClosedCaptionsButton")
+        return String::fromUTF8(_("show closed captions"));
+    if (name == "HideClosedCaptionsButton")
+        return String::fromUTF8(_("hide closed captions"));
 
     ASSERT_NOT_REACHED();
     return String();
@@ -431,6 +435,10 @@ String localizedMediaControlElementHelpText(const String& name)
         return String::fromUTF8(_("seek quickly forward"));
     if (name == "FullscreenButton")
         return String::fromUTF8(_("Play movie in fullscreen mode"));
+    if (name == "ShowClosedCaptionsButton")
+        return String::fromUTF8(_("start displaying closed captions"));
+    if (name == "HideClosedCaptionsButton")
+        return String::fromUTF8(_("stop displaying closed captions"));
 
     ASSERT_NOT_REACHED();
     return String();
@@ -467,4 +475,40 @@ String localizedMediaTimeDescription(float time)
 }
 #endif  // ENABLE(VIDEO)
 
+String validationMessageValueMissingText()
+{
+    return String::fromUTF8(_("value missing"));
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String::fromUTF8(_("type mismatch"));
+}
+
+String validationMessagePatternMismatchText()
+{
+    return String::fromUTF8(_("pattern mismatch"));
+}
+
+String validationMessageTooLongText()
+{
+    return String::fromUTF8(_("too long"));
+}
+
+String validationMessageRangeUnderflowText()
+{
+    return String::fromUTF8(_("range underflow"));
+}
+
+String validationMessageRangeOverflowText()
+{
+    return String::fromUTF8(_("range overflow"));
+}
+
+String validationMessageStepMismatchText()
+{
+    return String::fromUTF8(_("step mismatch"));
+}
+
 }
diff --git a/WebCore/platform/gtk/PasteboardGtk.cpp b/WebCore/platform/gtk/PasteboardGtk.cpp
index 0ff26f7..ee95a38 100644
--- a/WebCore/platform/gtk/PasteboardGtk.cpp
+++ b/WebCore/platform/gtk/PasteboardGtk.cpp
@@ -102,7 +102,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     PasteboardSelectionData* data = new PasteboardSelectionData(text, markup);
 
     gint n_targets;
-    GtkTargetEntry* targets = gtk_target_table_new_from_list(m_helper->getCopyTargetList(frame), &n_targets);
+    GtkTargetEntry* targets = gtk_target_table_new_from_list(m_helper->targetList(), &n_targets);
     gtk_clipboard_set_with_data(clipboard, targets, n_targets,
                                 clipboard_get_contents_cb, clipboard_clear_contents_cb, data);
     gtk_target_table_free(targets, n_targets);
diff --git a/WebCore/platform/gtk/PasteboardHelper.h b/WebCore/platform/gtk/PasteboardHelper.h
index 8e67127..e589f24 100644
--- a/WebCore/platform/gtk/PasteboardHelper.h
+++ b/WebCore/platform/gtk/PasteboardHelper.h
@@ -41,8 +41,7 @@ public:
     virtual GtkClipboard* getCurrentTarget(Frame*) const = 0;
     virtual GtkClipboard* getClipboard(Frame*) const = 0;
     virtual GtkClipboard* getPrimary(Frame*) const = 0;
-    virtual GtkTargetList* getCopyTargetList(Frame*) const = 0;
-    virtual GtkTargetList* getPasteTargetList(Frame*) const = 0;
+    virtual GtkTargetList* targetList() const = 0;
     virtual gint getWebViewTargetInfoHtml() const = 0;
 };
 
diff --git a/WebCore/platform/gtk/RenderThemeGtk.cpp b/WebCore/platform/gtk/RenderThemeGtk.cpp
index fdef9c2..4842d68 100644
--- a/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -188,7 +188,6 @@ static bool paintMozWidget(RenderTheme* theme, GtkThemeWidgetType type, RenderOb
     GdkRectangle gdkRect = IntRect(pos.x(), pos.y(), rect.width(), rect.height());
     GtkTextDirection direction = gtkTextDirection(o->style()->direction());
 
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1,4,0)
     // Find the clip rectangle
     cairo_t *cr = i.context->platformContext();
     double clipX1, clipX2, clipY1, clipY2;
@@ -202,9 +201,6 @@ static bool paintMozWidget(RenderTheme* theme, GtkThemeWidgetType type, RenderOb
     gdkClipRect.y = clipPos.y();
 
     gdk_rectangle_intersect(&gdkRect, &gdkClipRect, &gdkClipRect);
-#else
-    GdkRectangle gdkClipRect = gdkRect;
-#endif
 
     return moz_gtk_widget_paint(type, i.context->gdkDrawable(), &gdkRect, &gdkClipRect, &mozState, flags, direction) != MOZ_GTK_SUCCESS;
 }
diff --git a/WebCore/platform/haiku/FileChooserHaiku.cpp b/WebCore/platform/haiku/FileChooserHaiku.cpp
index b0e42b6..f56e02b 100644
--- a/WebCore/platform/haiku/FileChooserHaiku.cpp
+++ b/WebCore/platform/haiku/FileChooserHaiku.cpp
@@ -28,14 +28,6 @@
 
 namespace WebCore {
 
-FileChooser::FileChooser(FileChooserClient* client, const String& filename)
-    : m_client(client)
-    , m_filenames()
-    , m_icon(chooseIcon(filename))
-{
-    m_filenames.append(filename);
-}
-
 String FileChooser::basenameForWidth(const Font&, int width) const
 {
     notImplemented();
diff --git a/WebCore/platform/haiku/LocalizedStringsHaiku.cpp b/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
index a37ffcc..9bb4c3e 100644
--- a/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
+++ b/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
@@ -342,5 +342,47 @@ String AXDefinitionListDefinitionText()
     return String();
 }
 
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
 } // namespace WebCore
 
diff --git a/WebCore/platform/image-decoders/ImageDecoder.h b/WebCore/platform/image-decoders/ImageDecoder.h
index 8c9b7f1..08f4aa2 100644
--- a/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/WebCore/platform/image-decoders/ImageDecoder.h
@@ -197,7 +197,7 @@ namespace WebCore {
     // The ImageDecoder class represents a base class for specific image format decoders
     // (e.g., GIF, JPG, PNG, ICO) to derive from.  All decoders decode into RGBA32 format
     // and the base class manages the RGBA32 frame cache.
-    class ImageDecoder {
+    class ImageDecoder : public Noncopyable {
     public:
         // ENABLE(IMAGE_DECODER_DOWN_SAMPLING) allows image decoders to write directly to
         // scaled output buffers by down sampling. Call setMaxNumPixels() to specify the
diff --git a/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp b/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
index da6ab38..5e9b527 100644
--- a/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
+++ b/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
@@ -34,9 +34,9 @@
 namespace WebCore {
 
 RGBA32Buffer::RGBA32Buffer()
-    : m_status(FrameEmpty)
-    , m_hasAlpha(false)
+    : m_hasAlpha(false) 
     , m_size()
+    , m_status(FrameEmpty)
     , m_duration(0)
     , m_disposalMethod(DisposeNotSpecified)
 {
diff --git a/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp b/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
index 3cadf1c..e6e45b7 100644
--- a/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
+++ b/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
@@ -40,35 +40,41 @@ namespace WebCore {
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
     wxBitmap* bmp = new wxBitmap(width(), height(), 32);
-    typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
-    WxPixelData data(*bmp);
-    
-    // NB: It appears that the data is in BGRA format instead of RGBA format.
-    // This code works properly on both ppc and intel, meaning the issue is
-    // likely not an issue of byte order getting mixed up on different archs. 
-    const unsigned char* bytes = (const unsigned char*)m_bytes.data();
-    int rowCounter = 0;
-    long pixelCounter = 0;
-    WxPixelData::Iterator p(data);
-    WxPixelData::Iterator rowStart = p; 
-    for (size_t i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
-        p.Red() = bytes[i+2];
-        p.Green() = bytes[i+1];
-        p.Blue() = bytes[i+0];
-        p.Alpha() = bytes[i+3];
+
+    {
+        typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
+        WxPixelData data(*bmp);
         
-        p++;
+        // NB: It appears that the data is in BGRA format instead of RGBA format.
+        // This code works properly on both ppc and intel, meaning the issue is
+        // likely not an issue of byte order getting mixed up on different archs. 
+        const unsigned char* bytes = (const unsigned char*)m_bytes.data();
+        int rowCounter = 0;
+        long pixelCounter = 0;
+        WxPixelData::Iterator p(data);
+        WxPixelData::Iterator rowStart = p; 
+        for (size_t i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
+                p.Red() = bytes[i + 2];
+                p.Green() = bytes[i + 1];
+                p.Blue() = bytes[i + 0];
+                p.Alpha() = bytes[i + 3];
+            
+            p++;
 
-        pixelCounter++;
-        if ((pixelCounter % width()) == 0) {
-            rowCounter++;
-            p = rowStart;
-            p.MoveTo(data, 0, rowCounter);
+            pixelCounter++;
+            if ((pixelCounter % width()) == 0) {
+                rowCounter++;
+                p = rowStart;
+                p.MoveTo(data, 0, rowCounter);
+            }
         }
-    }
 #if !wxCHECK_VERSION(2,9,0)
-    bmp->UseAlpha();
+        bmp->UseAlpha();
 #endif
+    } // ensure that WxPixelData is destroyed as it unlocks the bitmap data in
+      // its dtor and we can't access it (notably in CreateBitmap() below)
+      // before this is done
+
     ASSERT(bmp->IsOk());
 
 #if USE(WXGC)
diff --git a/WebCore/platform/mac/LocalizedStringsMac.mm b/WebCore/platform/mac/LocalizedStringsMac.mm
index 261347f..c438d6b 100644
--- a/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/WebCore/platform/mac/LocalizedStringsMac.mm
@@ -747,5 +747,60 @@ String localizedMediaTimeDescription(float time)
     return String();
 }
 
+String validationMessageValueMissingText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageValueMissingText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageTypeMismatchText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessagePatternMismatchText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageTooLongText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageRangeUnderflowText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageRangeOverflowText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageStepMismatchText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
 
 }
diff --git a/WebCore/platform/mac/ScrollViewMac.mm b/WebCore/platform/mac/ScrollViewMac.mm
index 202d49e..f31b301 100644
--- a/WebCore/platform/mac/ScrollViewMac.mm
+++ b/WebCore/platform/mac/ScrollViewMac.mm
@@ -57,6 +57,8 @@ NSView *ScrollView::documentView() const
     return nil;
 }
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 void ScrollView::platformAddChild(Widget* child)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -203,4 +205,6 @@ bool ScrollView::platformIsOffscreen() const
     return ![platformWidget() window] || ![[platformWidget() window] isVisible];
 }
 
-}
+#endif // !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
+} // namespace WebCore
diff --git a/WebCore/platform/mac/ScrollbarThemeMac.mm b/WebCore/platform/mac/ScrollbarThemeMac.mm
index 0a20e2f..b4b8f62 100644
--- a/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -396,7 +396,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
             return true;
         
         HIThemeDrawTrack(&trackInfo, 0, imageBuffer->context()->platformContext(), kHIThemeOrientationNormal);
-        context->drawImage(imageBuffer->image(), scrollbar->frameRect().location());
+        context->drawImage(imageBuffer->image(), DeviceColorSpace, scrollbar->frameRect().location());
     }
 
     return true;
diff --git a/WebCore/platform/mac/ThemeMac.mm b/WebCore/platform/mac/ThemeMac.mm
index fd2f944..a95fee4 100644
--- a/WebCore/platform/mac/ThemeMac.mm
+++ b/WebCore/platform/mac/ThemeMac.mm
@@ -173,9 +173,9 @@ static LengthSize checkboxSize(const Font& font, const LengthSize& zoomedSize, f
     return sizeFromFont(font, zoomedSize, zoomFactor, checkboxSizes());
 }
 
-static NSButtonCell* checkbox(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+static NSButtonCell *checkbox(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
 {
-    static NSButtonCell* checkboxCell;
+    static NSButtonCell *checkboxCell;
     if (!checkboxCell) {
         checkboxCell = [[NSButtonCell alloc] init];
         [checkboxCell setButtonType:NSSwitchButton];
@@ -199,7 +199,7 @@ static void paintCheckbox(ControlStates states, GraphicsContext* context, const
     BEGIN_BLOCK_OBJC_EXCEPTIONS
 
     // Determine the width and height needed for the control and prepare the cell for painting.
-    NSButtonCell* checkboxCell = checkbox(states, zoomedRect, zoomFactor);
+    NSButtonCell *checkboxCell = checkbox(states, zoomedRect, zoomFactor);
 
     context->save();
 
@@ -254,9 +254,9 @@ static LengthSize radioSize(const Font& font, const LengthSize& zoomedSize, floa
     return sizeFromFont(font, zoomedSize, zoomFactor, radioSizes());
 }
 
-static NSButtonCell* radio(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+static NSButtonCell *radio(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
 {
-    static NSButtonCell* radioCell;
+    static NSButtonCell *radioCell;
     if (!radioCell) {
         radioCell = [[NSButtonCell alloc] init];
         [radioCell setButtonType:NSRadioButton];
@@ -276,7 +276,7 @@ static NSButtonCell* radio(ControlStates states, const IntRect& zoomedRect, floa
 static void paintRadio(ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
 {
     // Determine the width and height needed for the control and prepare the cell for painting.
-    NSButtonCell* radioCell = radio(states, zoomedRect, zoomFactor);
+    NSButtonCell *radioCell = radio(states, zoomedRect, zoomFactor);
 
     context->save();
 
@@ -330,14 +330,14 @@ static const int* buttonMargins(NSControlSize controlSize)
     return margins[controlSize];
 }
 
-static NSButtonCell* button(ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+static void setupButtonCell(NSButtonCell *&buttonCell, ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
 {
-    static NSButtonCell *buttonCell;
-    static bool defaultButton;
     if (!buttonCell) {
         buttonCell = [[NSButtonCell alloc] init];
         [buttonCell setTitle:nil];
         [buttonCell setButtonType:NSMomentaryPushInButton];
+        if (states & DefaultState)
+            [buttonCell setKeyEquivalent:@"\r"];
     }
 
     // Set the control size based off the rectangle we're painting into.
@@ -357,15 +357,16 @@ static NSButtonCell* button(ControlPart part, ControlStates states, const IntRec
 
     setControlSize(buttonCell, buttonSizes(), zoomedRect.size(), zoomFactor);
 
-    if (defaultButton != (states & DefaultState)) {
-        defaultButton = !defaultButton;
-        [buttonCell setKeyEquivalent:(defaultButton ? @"\r" : @"")];
-    }
-
     // Update the various states we respond to.
     updateStates(buttonCell, states);
+}
     
-    return buttonCell;
+static NSButtonCell *button(ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+{
+    bool isDefault = states & DefaultState;
+    static NSButtonCell *cells[2];
+    setupButtonCell(cells[isDefault], part, states, zoomedRect, zoomFactor);    
+    return cells[isDefault];
 }
 
 static void paintButton(ControlPart part, ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
@@ -408,7 +409,7 @@ static void paintButton(ControlPart part, ControlStates states, GraphicsContext*
     NSWindow *window = [view window];
     NSButtonCell *previousDefaultButtonCell = [window defaultButtonCell];
 
-    if ((states & DefaultState) && [window isKeyWindow]) {
+    if (states & DefaultState) {
         [window setDefaultButtonCell:buttonCell];
         wkAdvanceDefaultButtonPulseAnimation(buttonCell);
     } else if ([previousDefaultButtonCell isEqual:buttonCell])
diff --git a/WebCore/platform/mac/WebCoreSystemInterface.h b/WebCore/platform/mac/WebCoreSystemInterface.h
index 768899e..917ab0b 100644
--- a/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -117,6 +117,7 @@ extern BOOL (*wkGetNSURLResponseMustRevalidate)(NSURLResponse *response);
 extern void (*wkGetWheelEventDeltas)(NSEvent*, float* deltaX, float* deltaY, BOOL* continuous);
 extern BOOL (*wkHitTestMediaUIPart)(int part, int themeStyle, CGRect bounds, CGPoint point);
 extern void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
+extern BOOL (*wkMediaControllerThemeAvailable)(int themeStyle);
 extern void (*wkPopupMenu)(NSMenu*, NSPoint location, float width, NSView*, int selectedItem, NSFont*);
 extern unsigned (*wkQTIncludeOnlyModernMediaFileTypes)(void);
 extern int (*wkQTMovieDataRate)(QTMovie*);
@@ -124,6 +125,8 @@ extern float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
 extern NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
 extern float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 extern int (*wkQTMovieGetType)(QTMovie* movie);
+extern BOOL (*wkQTMovieHasClosedCaptions)(QTMovie* movie);
+extern void (*wkQTMovieSetShowClosedCaptions)(QTMovie* movie, BOOL showClosedCaptions);
 extern void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 extern void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 extern void (*wkSetDragImage)(NSImage*, NSPoint offset);
@@ -136,6 +139,9 @@ extern void (*wkSignalCFReadStreamEnd)(CFReadStreamRef stream);
 extern void (*wkSignalCFReadStreamError)(CFReadStreamRef stream, CFStreamError *error);
 extern void (*wkSignalCFReadStreamHasBytes)(CFReadStreamRef stream);
 extern unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
+extern void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
+extern void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
+extern CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
 extern BOOL (*wkIsLatchingWheelEvent)(NSEvent *);
 
 #ifndef BUILDING_ON_TIGER
diff --git a/WebCore/platform/mac/WebCoreSystemInterface.mm b/WebCore/platform/mac/WebCoreSystemInterface.mm
index d0e276f..3a9c011 100644
--- a/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -44,6 +44,7 @@ void (*wkDrawMediaSliderTrack)(int themeStyle, CGContextRef context, CGRect rect
 BOOL (*wkHitTestMediaUIPart)(int part, int themeStyle, CGRect bounds, CGPoint point);
 void (*wkDrawMediaUIPart)(int part, int themeStyle, CGContextRef context, CGRect rect, unsigned state);
 void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
+BOOL (*wkMediaControllerThemeAvailable)(int themeStyle);
 NSString* (*wkGetPreferredExtensionForMIMEType)(NSString*);
 NSArray* (*wkGetExtensionsForMIMEType)(NSString*);
 NSString* (*wkGetMIMETypeForExtension)(NSString*);
@@ -58,6 +59,8 @@ float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
 NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
 float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 int (*wkQTMovieGetType)(QTMovie* movie);
+BOOL (*wkQTMovieHasClosedCaptions)(QTMovie* movie);
+void (*wkQTMovieSetShowClosedCaptions)(QTMovie* movie, BOOL showClosedCaptions);
 void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 void (*wkSetDragImage)(NSImage*, NSPoint offset);
@@ -80,6 +83,9 @@ void (*wkSetNSURLConnectionDefersCallbacks)(NSURLConnection *, BOOL);
 void (*wkSetNSURLRequestShouldContentSniff)(NSMutableURLRequest *, BOOL);
 id (*wkCreateNSURLConnectionDelegateProxy)(void);
 unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
+void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
+void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
+CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
 BOOL (*wkIsLatchingWheelEvent)(NSEvent *);
 
 #ifndef BUILDING_ON_TIGER
diff --git a/WebCore/platform/mac/WidgetMac.mm b/WebCore/platform/mac/WidgetMac.mm
index 8653a03..ebb47dc 100644
--- a/WebCore/platform/mac/WidgetMac.mm
+++ b/WebCore/platform/mac/WidgetMac.mm
@@ -44,6 +44,8 @@
 #import "WebCoreView.h"
 #import <wtf/RetainPtr.h>
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 @interface NSWindow (WebWindowDetails)
 - (BOOL)_needsToResetDragMargins;
 - (void)_setNeedsToResetDragMargins:(BOOL)needs;
@@ -54,8 +56,12 @@
 - (void)webPlugInSetIsSelected:(BOOL)isSelected;
 @end
 
+#endif
+
 namespace WebCore {
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 class WidgetPrivate {
 public:
     bool mustStayInWindow;
@@ -78,7 +84,7 @@ static void safeRemoveFromSuperview(NSView *view)
     [window _setNeedsToResetDragMargins:resetDragMargins];
 }
 
-Widget::Widget(NSView* view)
+Widget::Widget(NSView *view)
     : m_data(new WidgetPrivate)
 {
     init(view);
@@ -341,5 +347,54 @@ void Widget::retainPlatformWidget()
     HardRetain(m_widget);
 }
 
+#else // ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
+Widget::Widget(PlatformWidget widget)
+{
+    init(widget);
+}
+
+Widget::~Widget() 
+{
+    ASSERT(!parent());
+}
+
+void Widget::show()
+{
+}
+
+void Widget::hide()
+{
 }
 
+void Widget::setCursor(const Cursor&)
+{
+    notImplemented();
+}
+
+void Widget::paint(GraphicsContext*, const IntRect&)
+{
+}
+
+void Widget::setFocus()
+{
+}
+
+void Widget::setIsSelected(bool)
+{
+}
+
+IntRect Widget::frameRect() const
+{
+    return m_frame;
+}
+
+void Widget::setFrameRect(const IntRect& rect)
+{
+    m_frame = rect;
+}
+
+#endif
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/network/AuthenticationClient.h b/WebCore/platform/network/AuthenticationClient.h
new file mode 100644
index 0000000..1e17910
--- /dev/null
+++ b/WebCore/platform/network/AuthenticationClient.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AuthenticationClient_h
+#define AuthenticationClient_h
+
+namespace WebCore {
+
+class AuthenticationChallenge;
+class Credential;
+
+class AuthenticationClient {
+public:
+    virtual void receivedCredential(const AuthenticationChallenge&, const Credential&) = 0;
+    virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&) = 0;
+    virtual void receivedCancellation(const AuthenticationChallenge&) = 0;
+
+    void ref() { refAuthenticationClient(); }
+    void deref() { derefAuthenticationClient(); }
+
+protected:
+    virtual ~AuthenticationClient() { }
+
+private:
+    virtual void refAuthenticationClient() = 0;
+    virtual void derefAuthenticationClient() = 0;
+};
+
+}
+
+#endif
diff --git a/WebCore/platform/network/Credential.cpp b/WebCore/platform/network/Credential.cpp
index f905743..87cd7ff 100644
--- a/WebCore/platform/network/Credential.cpp
+++ b/WebCore/platform/network/Credential.cpp
@@ -33,6 +33,9 @@ Credential::Credential()
     : m_user("")
     , m_password("")
     , m_persistence(CredentialPersistenceNone)
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    , m_type(CredentialTypePassword)
+#endif    
 {
 }
    
@@ -42,11 +45,31 @@ Credential::Credential(const String& user, const String& password, CredentialPer
     : m_user(user.length() ? user : "")
     , m_password(password.length() ? password : "")
     , m_persistence(persistence)
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    , m_type(CredentialTypePassword)
+#endif
+{
+}
+    
+Credential::Credential(const Credential& original, CredentialPersistence persistence)
+    : m_user(original.user())
+    , m_password(original.password())
+    , m_persistence(persistence)
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    , m_identity(original.identity())
+    , m_certificates(original.certificates())
+    , m_type(original.type())
+#endif
 {
 }
 
 bool Credential::isEmpty() const
 {
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    if (m_type == CredentialTypeClientCertificate && (m_identity || m_certificates))
+        return false;
+#endif
+    
     return m_user.isEmpty() && m_password.isEmpty();
 }
     
@@ -69,15 +92,68 @@ CredentialPersistence Credential::persistence() const
 { 
     return m_persistence; 
 }
+    
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+Credential::Credential(SecIdentityRef identity, CFArrayRef certificates, CredentialPersistence persistence)
+    : m_user("")
+    , m_password("")
+    , m_persistence(persistence)
+    , m_identity(identity)
+    , m_certificates(certificates)
+    , m_type(CredentialTypeClientCertificate)
+{
+}
+    
+SecIdentityRef Credential::identity() const
+{
+    return m_identity.get();
+}
+    
+CFArrayRef Credential::certificates() const
+{
+    return m_certificates.get();
+}
+    
+const CredentialType Credential::type() const
+{
+    return m_type;
+}
+#endif
 
 bool operator==(const Credential& a, const Credential& b)
 {
+    // Check persistence first since all credential types
+    // have the persistence property.
+    if (a.persistence() != b.persistence())
+        return false;
+    
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    CredentialType aType = a.type();
+    if (aType != b.type())
+        return false;
+    
+    // Comparing identity and certificate chain pointers is valid only
+    // for client certificate type credentials.
+    //
+    // FIXME: Is pointer comparison of the identity and certificates properties sufficient?
+    if (aType == CredentialTypeClientCertificate) {
+        if (a.identity() != b.identity())
+            return false;
+        if (a.certificates() != b.certificates())
+            return false;
+        
+        // We only need to check identity and certificates to compare
+        // client certificate based credentials.
+        return true;
+    }
+    
+    ASSERT(a.type() == CredentialTypePassword && b.type() == CredentialTypePassword);
+#endif    
+    
     if (a.user() != b.user())
         return false;
     if (a.password() != b.password())
         return false;
-    if (a.persistence() != b.persistence())
-        return false;
         
     return true;
 }
diff --git a/WebCore/platform/network/Credential.h b/WebCore/platform/network/Credential.h
index 0471fbc..199817c 100644
--- a/WebCore/platform/network/Credential.h
+++ b/WebCore/platform/network/Credential.h
@@ -27,6 +27,13 @@
 
 #include "PlatformString.h"
 
+#define CERTIFICATE_CREDENTIALS_SUPPORTED ((PLATFORM(MAC) || PLATFORM(IPHONE)) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD))
+
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+#include <Security/SecBase.h>
+#include <wtf/RetainPtr.h>
+#endif
+
 namespace WebCore {
 
 enum CredentialPersistence {
@@ -34,12 +41,23 @@ enum CredentialPersistence {
     CredentialPersistenceForSession,
     CredentialPersistencePermanent
 };
-    
+
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+enum CredentialType {
+    CredentialTypePassword,
+    CredentialTypeClientCertificate
+};
+#endif
+
 class Credential {
 
 public:
     Credential();
     Credential(const String& user, const String& password, CredentialPersistence);
+    Credential(const Credential& original, CredentialPersistence);
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    Credential(SecIdentityRef identity, CFArrayRef certificates, CredentialPersistence);
+#endif
     
     bool isEmpty() const;
     
@@ -48,10 +66,21 @@ public:
     bool hasPassword() const;
     CredentialPersistence persistence() const;
     
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    SecIdentityRef identity() const;
+    CFArrayRef certificates() const;
+    const CredentialType type() const;
+#endif    
+    
 private:
     String m_user;
     String m_password;
     CredentialPersistence m_persistence;
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    RetainPtr<SecIdentityRef> m_identity;
+    RetainPtr<CFArrayRef> m_certificates;
+    CredentialType m_type;
+#endif
 };
 
 bool operator==(const Credential& a, const Credential& b);
diff --git a/WebCore/platform/network/CredentialStorage.cpp b/WebCore/platform/network/CredentialStorage.cpp
index ec78372..a401751 100644
--- a/WebCore/platform/network/CredentialStorage.cpp
+++ b/WebCore/platform/network/CredentialStorage.cpp
@@ -85,16 +85,18 @@ static String protectionSpaceMapKeyFromURL(const KURL& url)
 
 void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
 {
-    ASSERT(url.protocolInHTTPFamily());
-    ASSERT(url.isValid());
+    ASSERT(protectionSpace.isProxy() || url.protocolInHTTPFamily());
+    ASSERT(protectionSpace.isProxy() || url.isValid());
 
     protectionSpaceToCredentialMap().set(protectionSpace, credential);
-    originsWithCredentials().add(originStringFromURL(url));
-
-    ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
-    if (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault) {
-        // The map can contain both a path and its subpath - while redundant, this makes lookups faster.
-        pathToDefaultProtectionSpaceMap().set(protectionSpaceMapKeyFromURL(url), protectionSpace);
+    if (!protectionSpace.isProxy()) {
+        originsWithCredentials().add(originStringFromURL(url));
+
+        ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
+        if (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault) {
+            // The map can contain both a path and its subpath - while redundant, this makes lookups faster.
+            pathToDefaultProtectionSpaceMap().set(protectionSpaceMapKeyFromURL(url), protectionSpace);
+        }
     }
 }
 
diff --git a/WebCore/platform/network/CredentialStorage.h b/WebCore/platform/network/CredentialStorage.h
index 5086f69..21fcbad 100644
--- a/WebCore/platform/network/CredentialStorage.h
+++ b/WebCore/platform/network/CredentialStorage.h
@@ -34,9 +34,13 @@ class ProtectionSpace;
 
 class CredentialStorage {
 public:
+    // WebCore session credential storage.
     static void set(const Credential&, const ProtectionSpace&, const KURL&);
     static Credential get(const ProtectionSpace&);
 
+    // OS persistent storage.
+    static Credential getFromPersistentStorage(const ProtectionSpace&);
+
     // These methods work for authentication schemes that support sending credentials without waiting for a request. E.g., for HTTP Basic authentication scheme
     // a client should assume that all paths at or deeper than the depth of a known protected resource share are within the same protection space.
     static bool set(const Credential&, const KURL&); // Returns true if the URL corresponds to a known protection space, so credentials could be updated.
diff --git a/WebCore/platform/network/FormDataBuilder.cpp b/WebCore/platform/network/FormDataBuilder.cpp
index 04c7527..52f62f3 100644
--- a/WebCore/platform/network/FormDataBuilder.cpp
+++ b/WebCore/platform/network/FormDataBuilder.cpp
@@ -127,9 +127,6 @@ static void appendQuotedString(Vector<char>& buffer, const CString& string)
         case '"':
             append(buffer, "%22");
             break;
-        case '%':
-            append(buffer, "%25");
-            break;
         default:
             append(buffer, c);
         }
@@ -143,7 +140,10 @@ Vector<char> FormDataBuilder::generateUniqueBoundaryString()
     // The RFC 2046 spec says the alphanumeric characters plus the
     // following characters are legal for boundaries:  '()+_,-./:=?
     // However the following characters, though legal, cause some sites
-    // to fail: (),./:= (http://bugs.webkit.org/show_bug.cgi?id=13352)
+    // to fail: (),./:=+
+    // Note that our algorithm makes it twice as much likely for 'A' or 'B'
+    // to appear in the boundary string, because 0x41 and 0x42 are present in
+    // the below array twice.
     static const char alphaNumericEncodingMap[64] = {
         0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48,
         0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50,
@@ -152,18 +152,7 @@ Vector<char> FormDataBuilder::generateUniqueBoundaryString()
         0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E,
         0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76,
         0x77, 0x78, 0x79, 0x7A, 0x30, 0x31, 0x32, 0x33,
-        0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x2B, 0x41
-        // FIXME <rdar://problem/5252577> gmail does not accept legal characters in the form boundary
-        // As stated above, some legal characters cause, sites to fail. Specifically
-        // the / character which was the last character in the above array. I have
-        // replaced the last character with another character already in the array
-        // (notice the first and last values are both 0x41, A). Instead of picking
-        // another unique legal character for boundary strings that, because it has
-        // never been tested, may or may not break other sites, I simply
-        // replaced / with A.  This means A is twice as likely to occur in our boundary
-        // strings than any other character but I think this is fine for the time being.
-        // The FIXME here is about restoring the / character once the aforementioned
-        // radar has been resolved.
+        0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x41, 0x42
     };
 
     // Start with an informative prefix.
diff --git a/WebCore/platform/network/HTTPHeaderMap.cpp b/WebCore/platform/network/HTTPHeaderMap.cpp
index 07c66e8..413fb7b 100644
--- a/WebCore/platform/network/HTTPHeaderMap.cpp
+++ b/WebCore/platform/network/HTTPHeaderMap.cpp
@@ -59,5 +59,41 @@ void HTTPHeaderMap::adopt(auto_ptr<CrossThreadHTTPHeaderMapData> data)
         set(header.first, header.second);
     }
 }
+    
+// Adapter that allows the HashMap to take C strings as keys.
+struct CaseFoldingCStringTranslator {
+    static unsigned hash(const char* cString)
+    {
+        return CaseFoldingHash::hash(cString, strlen(cString));
+    }
+    
+    static bool equal(const AtomicString& key, const char* cString)
+    {
+        return equalIgnoringCase(key, cString);
+    }
+    
+    static void translate(AtomicString& location, const char* cString, unsigned /*hash*/)
+    {
+        location = AtomicString(cString);
+    }
+};
+
+String HTTPHeaderMap::get(const char* name) const
+{
+    const_iterator i = find<const char*, CaseFoldingCStringTranslator>(name);
+    if (i == end())
+        return String();
+    return i->second;
+}
+    
+bool HTTPHeaderMap::contains(const char* name) const
+{
+    return find<const char*, CaseFoldingCStringTranslator>(name) != end();
+}
+
+pair<HTTPHeaderMap::iterator, bool> HTTPHeaderMap::add(const char* name, const String& value)
+{
+    return HashMap<AtomicString, String, CaseFoldingHash>::add<const char*, CaseFoldingCStringTranslator>(name, value);
+}
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/HTTPHeaderMap.h b/WebCore/platform/network/HTTPHeaderMap.h
index 6da1b90..dfde974 100644
--- a/WebCore/platform/network/HTTPHeaderMap.h
+++ b/WebCore/platform/network/HTTPHeaderMap.h
@@ -45,6 +45,22 @@ namespace WebCore {
         std::auto_ptr<CrossThreadHTTPHeaderMapData> copyData() const;
 
         void adopt(std::auto_ptr<CrossThreadHTTPHeaderMapData>);
+        
+        String get(const AtomicString& name) const
+        {
+            return HashMap<AtomicString, String, CaseFoldingHash>::get(name);
+        }
+
+        pair<iterator, bool> add(const AtomicString& name, const String& value)
+        {
+            return HashMap<AtomicString, String, CaseFoldingHash>::add(name, value);
+        }
+
+        // Alternate accessors that are faster than converting the char* to AtomicString first.
+        bool contains(const char*) const;
+        String get(const char*) const;
+        pair<iterator, bool> add(const char* name, const String& value);
+        
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/NetworkStateNotifier.h b/WebCore/platform/network/NetworkStateNotifier.h
index f918be6..a630ccd 100644
--- a/WebCore/platform/network/NetworkStateNotifier.h
+++ b/WebCore/platform/network/NetworkStateNotifier.h
@@ -26,6 +26,8 @@
 #ifndef NetworkStateNotifier_h
 #define NetworkStateNotifier_h
 
+#include <wtf/Noncopyable.h>
+
 #if PLATFORM(MAC)
 
 #include <wtf/RetainPtr.h>
@@ -46,7 +48,7 @@ typedef const struct __SCDynamicStore * SCDynamicStoreRef;
 
 namespace WebCore {
 
-class NetworkStateNotifier {
+class NetworkStateNotifier : public Noncopyable {
 public:
     NetworkStateNotifier();
     void setNetworkStateChangedFunction(void (*)());
diff --git a/WebCore/platform/network/ProtectionSpace.cpp b/WebCore/platform/network/ProtectionSpace.cpp
index d04bcbe..26c258f 100644
--- a/WebCore/platform/network/ProtectionSpace.cpp
+++ b/WebCore/platform/network/ProtectionSpace.cpp
@@ -111,7 +111,8 @@ bool operator==(const ProtectionSpace& a, const ProtectionSpace& b)
         return false;
     if (a.serverType() != b.serverType())
         return false;
-    if (a.realm() != b.realm())
+    // Ignore realm for proxies
+    if (!a.isProxy() && a.realm() != b.realm())
         return false;
     if (a.authenticationScheme() != b.authenticationScheme())
         return false;
diff --git a/WebCore/platform/network/ProtectionSpaceHash.h b/WebCore/platform/network/ProtectionSpaceHash.h
index 6f68b5b..f8c84e8 100644
--- a/WebCore/platform/network/ProtectionSpaceHash.h
+++ b/WebCore/platform/network/ProtectionSpaceHash.h
@@ -37,11 +37,15 @@ struct ProtectionSpaceHash {
             protectionSpace.host().impl() ? protectionSpace.host().impl()->hash() : 0, 
             protectionSpace.port(), 
             protectionSpace.serverType(),
-            protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0,
-            protectionSpace.authenticationScheme()
+            protectionSpace.authenticationScheme(),
+            protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0
         };
 
-        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));    
+        unsigned codeCount = sizeof(hashCodes) / sizeof(UChar);
+        // Ignore realm for proxies.
+        if (protectionSpace.isProxy())
+            codeCount -= sizeof(hashCodes[0]) / sizeof(UChar);
+        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), codeCount);
     }
     
     static bool equal(const ProtectionSpace& a, const ProtectionSpace& b) { return a == b; }
diff --git a/WebCore/platform/network/ResourceHandle.cpp b/WebCore/platform/network/ResourceHandle.cpp
index 5a40b21..7c20561 100644
--- a/WebCore/platform/network/ResourceHandle.cpp
+++ b/WebCore/platform/network/ResourceHandle.cpp
@@ -36,8 +36,6 @@ namespace WebCore {
 
 static bool shouldForceContentSniffing;
 
-static bool portAllowed(const ResourceRequest&);
-
 ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading,
          bool shouldContentSniff, bool mightDownloadFromHandle)
     : d(new ResourceHandleInternal(this, request, client, defersLoading, shouldContentSniff, mightDownloadFromHandle))
@@ -57,7 +55,7 @@ PassRefPtr<ResourceHandle> ResourceHandle::create(const ResourceRequest& request
         return newHandle.release();
     }
 
-    if (!portAllowed(request)) {
+    if (!portAllowed(request.url())) {
         newHandle->scheduleFailure(BlockedFailure);
         return newHandle.release();
     }
@@ -110,100 +108,9 @@ void ResourceHandle::clearAuthentication()
 {
 #if PLATFORM(MAC)
     d->m_currentMacChallenge = nil;
-#elif USE(CFNETWORK)
-    d->m_currentCFChallenge = 0;
 #endif
     d->m_currentWebChallenge.nullify();
 }
-
-static bool portAllowed(const ResourceRequest& request)
-{
-    unsigned short port = request.url().port();
-
-    // Since most URLs don't have a port, return early for the "no port" case.
-    if (!port)
-        return true;
-
-    // This blocked port list matches the port blocking that Mozilla implements.
-    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
-    static const unsigned short blockedPortList[] = {
-        1,    // tcpmux
-        7,    // echo
-        9,    // discard
-        11,   // systat
-        13,   // daytime
-        15,   // netstat
-        17,   // qotd
-        19,   // chargen
-        20,   // FTP-data
-        21,   // FTP-control
-        22,   // SSH
-        23,   // telnet
-        25,   // SMTP
-        37,   // time
-        42,   // name
-        43,   // nicname
-        53,   // domain
-        77,   // priv-rjs
-        79,   // finger
-        87,   // ttylink
-        95,   // supdup
-        101,  // hostriame
-        102,  // iso-tsap
-        103,  // gppitnp
-        104,  // acr-nema
-        109,  // POP2
-        110,  // POP3
-        111,  // sunrpc
-        113,  // auth
-        115,  // SFTP
-        117,  // uucp-path
-        119,  // nntp
-        123,  // NTP
-        135,  // loc-srv / epmap
-        139,  // netbios
-        143,  // IMAP2
-        179,  // BGP
-        389,  // LDAP
-        465,  // SMTP+SSL
-        512,  // print / exec
-        513,  // login
-        514,  // shell
-        515,  // printer
-        526,  // tempo
-        530,  // courier
-        531,  // Chat
-        532,  // netnews
-        540,  // UUCP
-        556,  // remotefs
-        563,  // NNTP+SSL
-        587,  // ESMTP
-        601,  // syslog-conn
-        636,  // LDAP+SSL
-        993,  // IMAP+SSL
-        995,  // POP3+SSL
-        2049, // NFS
-        3659, // apple-sasl / PasswordServer [Apple addition]
-        4045, // lockd
-        6000, // X11
-    };
-    const unsigned short* const blockedPortListEnd = blockedPortList
-        + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
-
-    // If the port is not in the blocked port list, allow it.
-    if (!std::binary_search(blockedPortList, blockedPortListEnd, port))
-        return true;
-
-    // Allow ports 21 and 22 for FTP URLs, as Mozilla does.
-    if ((port == 21 || port == 22) && request.url().protocolIs("ftp"))
-        return true;
-
-    // Allow any port number in a file URL, since the port number is ignored.
-    if (request.url().protocolIs("file"))
-        return true;
-
-    return false;
-}
   
 bool ResourceHandle::shouldContentSniff() const
 {
diff --git a/WebCore/platform/network/ResourceHandle.h b/WebCore/platform/network/ResourceHandle.h
index e82e13b..e7f6092 100644
--- a/WebCore/platform/network/ResourceHandle.h
+++ b/WebCore/platform/network/ResourceHandle.h
@@ -27,6 +27,7 @@
 #define ResourceHandle_h
 
 #include "AuthenticationChallenge.h"
+#include "AuthenticationClient.h"
 #include "HTTPHeaderMap.h"
 #include "ThreadableLoader.h"
 #include <wtf/OwnPtr.h>
@@ -84,14 +85,18 @@ class KURL;
 class ResourceError;
 class ResourceHandleClient;
 class ResourceHandleInternal;
-struct ResourceRequest;
+class ResourceRequest;
 class ResourceResponse;
 class SchedulePair;
 class SharedBuffer;
 
 template <typename T> class Timer;
 
-class ResourceHandle : public RefCounted<ResourceHandle> {
+class ResourceHandle : public RefCounted<ResourceHandle>
+#if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
+    , public AuthenticationClient
+#endif
+    {
 private:
     ResourceHandle(const ResourceRequest&, ResourceHandleClient*, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle);
 
@@ -110,7 +115,7 @@ public:
     static bool didSendBodyDataDelegateExists();
 #endif
 
-    ~ResourceHandle();
+    virtual ~ResourceHandle();
 
 #if PLATFORM(MAC) || USE(CFNETWORK)
     void willSendRequest(ResourceRequest&, const ResourceResponse& redirectResponse);
@@ -118,9 +123,9 @@ public:
 #endif
 #if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
     void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
-    void receivedCredential(const AuthenticationChallenge&, const Credential&);
-    void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
-    void receivedCancellation(const AuthenticationChallenge&);
+    virtual void receivedCredential(const AuthenticationChallenge&, const Credential&);
+    virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+    virtual void receivedCancellation(const AuthenticationChallenge&);
 #endif
 
 #if PLATFORM(MAC)
@@ -133,7 +138,6 @@ public:
     void schedule(SchedulePair*);
     void unschedule(SchedulePair*);
 #elif USE(CFNETWORK)
-    static CFRunLoopRef loaderRunLoop();
     CFURLConnectionRef connection() const;
     CFURLConnectionRef releaseConnectionForDownload();
     static void setHostAllowsAnyHTTPSCertificate(const String&);
@@ -190,11 +194,17 @@ public:
 
     void fireFailure(Timer<ResourceHandle>*);
 
+    using RefCounted<ResourceHandle>::ref;
+    using RefCounted<ResourceHandle>::deref;
+
 private:
     void scheduleFailure(FailureType);
 
     bool start(Frame*);
 
+    virtual void refAuthenticationClient() { ref(); }
+    virtual void derefAuthenticationClient() { deref(); }
+
     friend class ResourceHandleInternal;
     OwnPtr<ResourceHandleInternal> d;
 };
diff --git a/WebCore/platform/network/ResourceHandleClient.h b/WebCore/platform/network/ResourceHandleClient.h
index c99be54..b5efaed 100644
--- a/WebCore/platform/network/ResourceHandleClient.h
+++ b/WebCore/platform/network/ResourceHandleClient.h
@@ -50,7 +50,7 @@ namespace WebCore {
     class KURL;
     class ResourceHandle;
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
 
     enum CacheStoragePolicy {
diff --git a/WebCore/platform/network/ResourceHandleInternal.h b/WebCore/platform/network/ResourceHandleInternal.h
index fa939db..8313560 100644
--- a/WebCore/platform/network/ResourceHandleInternal.h
+++ b/WebCore/platform/network/ResourceHandleInternal.h
@@ -132,8 +132,6 @@ namespace WebCore {
             , m_startWhenScheduled(false)
             , m_needsSiteSpecificQuirks(false)
             , m_currentMacChallenge(nil)
-#elif USE(CFNETWORK)
-            , m_currentCFChallenge(0)
 #endif
 #if PLATFORM(ANDROID)
             , m_loader(0)
@@ -211,24 +209,24 @@ namespace WebCore {
         Frame* m_frame;
 #endif
 #if PLATFORM(QT)
-#if QT_VERSION < 0x040400
-        QWebNetworkJob* m_job;
-#else
         QNetworkReplyHandler* m_job;
-#endif
         QWebFrame* m_frame;
 #endif
 
-        // FIXME: The platform challenge is almost identical to the one stored in m_currentWebChallenge, but it has a different sender. We only need to store a sender reference here.
 #if PLATFORM(MAC)
+        // We need to keep a reference to the original challenge to be able to cancel it.
+        // It is almost identical to m_currentWebChallenge.nsURLAuthenticationChallenge(), but has a different sender.
         NSURLAuthenticationChallenge *m_currentMacChallenge;
 #endif
+<<<<<<< HEAD:WebCore/platform/network/ResourceHandleInternal.h
 #if USE(CFNETWORK)
         CFURLAuthChallengeRef m_currentCFChallenge;
 #endif
 #if PLATFORM(ANDROID)
         RefPtr<ResourceLoaderAndroid> m_loader;
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/platform/network/ResourceHandleInternal.h
         AuthenticationChallenge m_currentWebChallenge;
 
         ResourceHandle::FailureType m_failureType;
diff --git a/WebCore/platform/network/ResourceRequestBase.cpp b/WebCore/platform/network/ResourceRequestBase.cpp
index 936f26b..41afb92 100644
--- a/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/WebCore/platform/network/ResourceRequestBase.cpp
@@ -208,6 +208,13 @@ String ResourceRequestBase::httpHeaderField(const AtomicString& name) const
     return m_httpHeaderFields.get(name);
 }
 
+String ResourceRequestBase::httpHeaderField(const char* name) const
+{
+    updateResourceRequest(); 
+    
+    return m_httpHeaderFields.get(name);
+}
+
 void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const String& value)
 {
     updateResourceRequest(); 
@@ -218,6 +225,11 @@ void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const Str
         m_platformRequestUpdated = false;
 }
 
+void ResourceRequestBase::setHTTPHeaderField(const char* name, const String& value)
+{
+    setHTTPHeaderField(AtomicString(name), value);
+}
+
 void ResourceRequestBase::clearHTTPReferrer()
 {
     updateResourceRequest(); 
diff --git a/WebCore/platform/network/ResourceRequestBase.h b/WebCore/platform/network/ResourceRequestBase.h
index 84a7bd0..931a9de 100644
--- a/WebCore/platform/network/ResourceRequestBase.h
+++ b/WebCore/platform/network/ResourceRequestBase.h
@@ -46,12 +46,25 @@ namespace WebCore {
 
     const int unspecifiedTimeoutInterval = INT_MAX;
 
-    struct ResourceRequest;
+    class ResourceRequest;
     struct CrossThreadResourceRequestData;
 
     // Do not use this type directly.  Use ResourceRequest instead.
     class ResourceRequestBase {
     public:
+        // The type of this ResourceRequest, based on how the resource will be used.
+        enum TargetType {
+            TargetIsMainFrame,
+            TargetIsSubframe,
+            TargetIsSubresource,  // Resource is a generic subresource.  (Generally a specific type should be specified)
+            TargetIsStyleSheet,
+            TargetIsScript,
+            TargetIsFontResource,
+            TargetIsImage,
+            TargetIsObject,
+            TargetIsMedia
+        };
+
         static std::auto_ptr<ResourceRequest> adopt(std::auto_ptr<CrossThreadResourceRequestData>);
 
         // Gets a copy of the data suitable for passing to another thread.
@@ -79,7 +92,9 @@ namespace WebCore {
         
         const HTTPHeaderMap& httpHeaderFields() const;
         String httpHeaderField(const AtomicString& name) const;
+        String httpHeaderField(const char* name) const;
         void setHTTPHeaderField(const AtomicString& name, const String& value);
+        void setHTTPHeaderField(const char* name, const String& value);
         void addHTTPHeaderField(const AtomicString& name, const String& value);
         void addHTTPHeaderFields(const HTTPHeaderMap& headerFields);
         
@@ -115,12 +130,17 @@ namespace WebCore {
         bool reportUploadProgress() const { return m_reportUploadProgress; }
         void setReportUploadProgress(bool reportUploadProgress) { m_reportUploadProgress = reportUploadProgress; }
 
+        // What this request is for.
+        TargetType targetType() const { return m_targetType; }
+        void setTargetType(TargetType type) { m_targetType = type; }
+
     protected:
         // Used when ResourceRequest is initialized from a platform representation of the request
         ResourceRequestBase()
             : m_resourceRequestUpdated(false)
             , m_platformRequestUpdated(true)
             , m_reportUploadProgress(false)
+            , m_targetType(TargetIsSubresource)
         {
         }
 
@@ -133,6 +153,7 @@ namespace WebCore {
             , m_resourceRequestUpdated(true)
             , m_platformRequestUpdated(false)
             , m_reportUploadProgress(false)
+            , m_targetType(TargetIsSubresource)
         {
         }
 
@@ -152,6 +173,7 @@ namespace WebCore {
         mutable bool m_resourceRequestUpdated;
         mutable bool m_platformRequestUpdated;
         bool m_reportUploadProgress;
+        TargetType m_targetType;
 
     private:
         const ResourceRequest& asResourceRequest() const;
@@ -162,7 +184,7 @@ namespace WebCore {
     bool operator==(const ResourceRequestBase&, const ResourceRequestBase&);
     inline bool operator!=(ResourceRequestBase& a, const ResourceRequestBase& b) { return !(a == b); }
 
-    struct CrossThreadResourceRequestData {
+    struct CrossThreadResourceRequestData : Noncopyable {
         KURL m_url;
 
         ResourceRequestCachePolicy m_cachePolicy;
diff --git a/WebCore/platform/network/ResourceResponseBase.cpp b/WebCore/platform/network/ResourceResponseBase.cpp
index fd44225..f9cd271 100644
--- a/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/WebCore/platform/network/ResourceResponseBase.cpp
@@ -239,6 +239,13 @@ String ResourceResponseBase::httpHeaderField(const AtomicString& name) const
     return m_httpHeaderFields.get(name); 
 }
 
+String ResourceResponseBase::httpHeaderField(const char* name) const
+{
+    lazyInit();
+
+    return m_httpHeaderFields.get(name); 
+}
+
 void ResourceResponseBase::setHTTPHeaderField(const AtomicString& name, const String& value)
 {
     lazyInit();
diff --git a/WebCore/platform/network/ResourceResponseBase.h b/WebCore/platform/network/ResourceResponseBase.h
index 7594c09..e06c6f8 100644
--- a/WebCore/platform/network/ResourceResponseBase.h
+++ b/WebCore/platform/network/ResourceResponseBase.h
@@ -71,6 +71,7 @@ public:
     void setHTTPStatusText(const String&);
     
     String httpHeaderField(const AtomicString& name) const;
+    String httpHeaderField(const char* name) const;
     void setHTTPHeaderField(const AtomicString& name, const String& value);
     const HTTPHeaderMap& httpHeaderFields() const;
 
diff --git a/WebCore/platform/network/SocketStreamHandleBase.cpp b/WebCore/platform/network/SocketStreamHandleBase.cpp
index 875c248..8472713 100644
--- a/WebCore/platform/network/SocketStreamHandleBase.cpp
+++ b/WebCore/platform/network/SocketStreamHandleBase.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "SocketStreamHandleBase.h"
 
+#include "SocketStreamHandle.h"
 #include "SocketStreamHandleClient.h"
 
 namespace WebCore {
@@ -64,7 +65,7 @@ bool SocketStreamHandleBase::send(const char* data, int length)
     int bytesWritten = 0;
     if (m_state == Open)
         bytesWritten = platformSend(data, length);
-    if (bytesWritten <= 0)
+    if (bytesWritten < 0)
         return false;
     if (m_buffer.size() + length - bytesWritten > bufferSize) {
         // FIXME: report error to indicate that buffer has no more space.
@@ -77,6 +78,8 @@ bool SocketStreamHandleBase::send(const char* data, int length)
 
 void SocketStreamHandleBase::close()
 {
+    RefPtr<SocketStreamHandle> protect(static_cast<SocketStreamHandle*>(this)); // platformClose calls the client, which may make the handle get deallocated immediately.
+
     platformClose();
     m_state = Closed;
 }
diff --git a/WebCore/platform/network/SocketStreamHandleClient.h b/WebCore/platform/network/SocketStreamHandleClient.h
index 04c744e..5d97ec0 100644
--- a/WebCore/platform/network/SocketStreamHandleClient.h
+++ b/WebCore/platform/network/SocketStreamHandleClient.h
@@ -43,18 +43,15 @@ namespace WebCore {
     public:
         virtual ~SocketStreamHandleClient() { }
 
-        virtual void willOpenStream(SocketStreamHandle*, const KURL&) { }
-        virtual void willSendData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
-
         virtual void didOpen(SocketStreamHandle*) { }
         virtual void didClose(SocketStreamHandle*) { }
         virtual void didReceiveData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
 
         virtual void didFail(SocketStreamHandle*, const SocketStreamError&) { }
 
+        // No authentication for streams per se, but proxy may ask for credentials.
         virtual void didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
         virtual void didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
-        virtual void receivedCancellation(SocketStreamHandle*, const AuthenticationChallenge&) { }
     };
 
 }  // namespace WebCore
diff --git a/WebCore/platform/network/cf/AuthenticationCF.cpp b/WebCore/platform/network/cf/AuthenticationCF.cpp
index bb05a39..93b62a8 100644
--- a/WebCore/platform/network/cf/AuthenticationCF.cpp
+++ b/WebCore/platform/network/cf/AuthenticationCF.cpp
@@ -27,9 +27,9 @@
 #include "AuthenticationCF.h"
 
 #include "AuthenticationChallenge.h"
+#include "AuthenticationClient.h"
 #include "Credential.h"
 #include "ProtectionSpace.h"
-#include "ResourceHandle.h"
 
 #include <CFNetwork/CFURLAuthChallengePriv.h>
 #include <CFNetwork/CFURLCredentialPriv.h>
@@ -51,20 +51,20 @@ AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protecti
 }
 
 AuthenticationChallenge::AuthenticationChallenge(CFURLAuthChallengeRef cfChallenge,
-                                                 ResourceHandle* sourceHandle)
+                                                 AuthenticationClient* authenticationClient)
     : AuthenticationChallengeBase(core(CFURLAuthChallengeGetProtectionSpace(cfChallenge)),
                                   core(CFURLAuthChallengeGetProposedCredential(cfChallenge)),
                                   CFURLAuthChallengeGetPreviousFailureCount(cfChallenge),
                                   (CFURLResponseRef)CFURLAuthChallengeGetFailureResponse(cfChallenge),
                                   CFURLAuthChallengeGetError(cfChallenge))
-    , m_sourceHandle(sourceHandle)
+    , m_authenticationClient(authenticationClient)
     , m_cfChallenge(cfChallenge)
 {
 }
 
 bool AuthenticationChallenge::platformCompare(const AuthenticationChallenge& a, const AuthenticationChallenge& b)
 {
-    if (a.sourceHandle() != b.sourceHandle())
+    if (a.authenticationClient() != b.authenticationClient())
         return false;
 
     if (a.cfURLAuthChallengeRef() != b.cfURLAuthChallengeRef())
diff --git a/WebCore/platform/network/cf/AuthenticationChallenge.h b/WebCore/platform/network/cf/AuthenticationChallenge.h
index 9697d7e..58fb836 100644
--- a/WebCore/platform/network/cf/AuthenticationChallenge.h
+++ b/WebCore/platform/network/cf/AuthenticationChallenge.h
@@ -26,29 +26,29 @@
 #define AuthenticationChallenge_h
 
 #include "AuthenticationChallengeBase.h"
-#include "ResourceHandle.h"
+#include "AuthenticationClient.h"
 #include <wtf/RefPtr.h>
 
 typedef struct _CFURLAuthChallenge* CFURLAuthChallengeRef;
 
 namespace WebCore {
 
-class ResourceHandle;
-
 class AuthenticationChallenge : public AuthenticationChallengeBase {
 public:
     AuthenticationChallenge() {}
     AuthenticationChallenge(const ProtectionSpace& protectionSpace, const Credential& proposedCredential, unsigned previousFailureCount, const ResourceResponse& response, const ResourceError& error);
-    AuthenticationChallenge(CFURLAuthChallengeRef, ResourceHandle* sourceHandle);
+    AuthenticationChallenge(CFURLAuthChallengeRef, AuthenticationClient*);
+
+    AuthenticationClient* authenticationClient() const { return m_authenticationClient.get(); }
+    void setAuthenticationClient(AuthenticationClient* client) { m_authenticationClient = client; }
 
-    ResourceHandle* sourceHandle() const { return m_sourceHandle.get(); }
     CFURLAuthChallengeRef cfURLAuthChallengeRef() const { return m_cfChallenge.get(); }
 
 private:
     friend class AuthenticationChallengeBase;
     static bool platformCompare(const AuthenticationChallenge& a, const AuthenticationChallenge& b);
 
-    RefPtr<ResourceHandle> m_sourceHandle;
+    RefPtr<AuthenticationClient> m_authenticationClient;
     RetainPtr<CFURLAuthChallengeRef> m_cfChallenge;
 };
 
diff --git a/WebCore/platform/network/cf/CredentialStorageCFNet.cpp b/WebCore/platform/network/cf/CredentialStorageCFNet.cpp
new file mode 100644
index 0000000..0a9e36f
--- /dev/null
+++ b/WebCore/platform/network/cf/CredentialStorageCFNet.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CredentialStorage.h"
+
+#include "AuthenticationCF.h"
+#include "Credential.h"
+#include "ProtectionSpace.h"
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+Credential CredentialStorage::getFromPersistentStorage(const ProtectionSpace& protectionSpace)
+{
+    RetainPtr<CFURLProtectionSpaceRef> protectionSpaceCF(AdoptCF, createCF(protectionSpace));
+    RetainPtr<CFURLCredentialRef> credentialCF(AdoptCF, wkCopyCredentialFromCFPersistentStorage(protectionSpaceCF.get()));
+    return core(credentialCF.get());
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/cf/DNSCFNet.cpp b/WebCore/platform/network/cf/DNSCFNet.cpp
index 381dff2..6311baf 100644
--- a/WebCore/platform/network/cf/DNSCFNet.cpp
+++ b/WebCore/platform/network/cf/DNSCFNet.cpp
@@ -33,7 +33,7 @@
 #include <wtf/StdLibExtras.h>
 
 #if PLATFORM(WIN)
-#include "ResourceHandle.h" // for loaderRunLoop()
+#include "LoaderRunLoopCF.h"
 #endif
 
 #ifdef BUILDING_ON_TIGER
@@ -137,7 +137,7 @@ void DNSResolveQueue::resolve(const String& hostname)
     CFHostScheduleWithRunLoop(host.get(), CFRunLoopGetMain(), kCFRunLoopCommonModes);
 #else
     // On Windows, we run a separate thread with CFRunLoop, which is where clientCallback will be called.
-    CFHostScheduleWithRunLoop(host.get(), ResourceHandle::loaderRunLoop(), kCFRunLoopDefaultMode);
+    CFHostScheduleWithRunLoop(host.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
 #endif
     CFHostStartInfoResolution(host.get(), kCFHostAddresses, 0);
     host.releaseRef(); // The host will be released from clientCallback().
diff --git a/WebCore/platform/network/cf/LoaderRunLoopCF.cpp b/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
new file mode 100644
index 0000000..aa68916
--- /dev/null
+++ b/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LoaderRunLoopCF.h"
+
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+static CFRunLoopRef loaderRunLoopObject = 0;
+
+static void emptyPerform(void*) 
+{
+}
+
+static void* runLoaderThread(void*)
+{
+    loaderRunLoopObject = CFRunLoopGetCurrent();
+
+    // Must add a source to the run loop to prevent CFRunLoopRun() from exiting.
+    CFRunLoopSourceContext ctxt = {0, (void*)1 /*must be non-NULL*/, 0, 0, 0, 0, 0, 0, 0, emptyPerform};
+    CFRunLoopSourceRef bogusSource = CFRunLoopSourceCreate(0, 0, &ctxt);
+    CFRunLoopAddSource(loaderRunLoopObject, bogusSource, kCFRunLoopDefaultMode);
+
+    CFRunLoopRun();
+
+    return 0;
+}
+
+CFRunLoopRef loaderRunLoop()
+{
+    ASSERT(isMainThread());
+    if (!loaderRunLoopObject) {
+        createThread(runLoaderThread, 0, "WebCore: CFNetwork Loader");
+        while (!loaderRunLoopObject) {
+            // FIXME: Sleep 10? that can't be right...
+            Sleep(10);
+        }
+    }
+    return loaderRunLoopObject;
+}
+
+}
diff --git a/WebCore/platform/network/cf/LoaderRunLoopCF.h b/WebCore/platform/network/cf/LoaderRunLoopCF.h
new file mode 100644
index 0000000..20e4c29
--- /dev/null
+++ b/WebCore/platform/network/cf/LoaderRunLoopCF.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LoaderRunLoopCF_h
+#define LoaderRunLoopCF_h
+
+#if !PLATFORM(WIN)
+#error This code is not needed on platforms other than Windows, because main thread's CFRunLoop can be used.
+#endif
+
+namespace WebCore {
+
+CFRunLoopRef loaderRunLoop();
+
+}
+
+#endif // LoaderRunLoop_h
diff --git a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index 38a9705..8cc5022 100644
--- a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -39,6 +39,7 @@
 #include "FormDataStreamCFNet.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "LoaderRunLoopCF.h"
 #include "Logging.h"
 #include "MIMETypeRegistry.h"
 #include "ResourceError.h"
@@ -322,37 +323,6 @@ CFArrayRef arrayFromFormData(const FormData& d)
     return a;
 }
 
-void emptyPerform(void* unused) 
-{
-}
-
-static CFRunLoopRef loaderRL = 0;
-void* runLoaderThread(void *unused)
-{
-    loaderRL = CFRunLoopGetCurrent();
-
-    // Must add a source to the run loop to prevent CFRunLoopRun() from exiting
-    CFRunLoopSourceContext ctxt = {0, (void *)1 /*must be non-NULL*/, 0, 0, 0, 0, 0, 0, 0, emptyPerform};
-    CFRunLoopSourceRef bogusSource = CFRunLoopSourceCreate(0, 0, &ctxt);
-    CFRunLoopAddSource(loaderRL, bogusSource,kCFRunLoopDefaultMode);
-
-    CFRunLoopRun();
-
-    return 0;
-}
-
-CFRunLoopRef ResourceHandle::loaderRunLoop()
-{
-    if (!loaderRL) {
-        createThread(runLoaderThread, 0, "WebCore: CFNetwork Loader");
-        while (loaderRL == 0) {
-            // FIXME: sleep 10? that can't be right...
-            Sleep(10);
-        }
-    }
-    return loaderRL;
-}
-
 static CFURLRequestRef makeFinalRequest(const ResourceRequest& request, bool shouldContentSniff)
 {
     CFMutableURLRequestRef newRequest = CFURLRequestCreateMutableCopy(kCFAllocatorDefault, request.cfURLRequest());
@@ -479,11 +449,11 @@ bool ResourceHandle::shouldUseCredentialStorage()
 void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)
 {
     LOG(Network, "CFNet - didReceiveAuthenticationChallenge()");
-    ASSERT(!d->m_currentCFChallenge);
     ASSERT(d->m_currentWebChallenge.isNull());
     // Since CFURLConnection networking relies on keeping a reference to the original CFURLAuthChallengeRef,
     // we make sure that is actually present
     ASSERT(challenge.cfURLAuthChallengeRef());
+    ASSERT(challenge.authenticationClient() == this); // Should be already set.
 
     if (!d->m_user.isNull() && !d->m_pass.isNull()) {
         RetainPtr<CFStringRef> user(AdoptCF, d->m_user.createCFString());
@@ -513,8 +483,7 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
         }
     }
 
-    d->m_currentCFChallenge = challenge.cfURLAuthChallengeRef();
-    d->m_currentWebChallenge = AuthenticationChallenge(d->m_currentCFChallenge, this);
+    d->m_currentWebChallenge = challenge;
     
     if (client())
         client()->didReceiveAuthenticationChallenge(this, d->m_currentWebChallenge);
diff --git a/WebCore/platform/network/cf/ResourceRequest.h b/WebCore/platform/network/cf/ResourceRequest.h
index 8ead412..e361af5 100644
--- a/WebCore/platform/network/cf/ResourceRequest.h
+++ b/WebCore/platform/network/cf/ResourceRequest.h
@@ -34,8 +34,8 @@ typedef const struct _CFURLRequest* CFURLRequestRef;
 
 namespace WebCore {
 
-    struct ResourceRequest : ResourceRequestBase {
-
+    class ResourceRequest : public ResourceRequestBase {
+    public:
         ResourceRequest(const String& url) 
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
@@ -64,7 +64,7 @@ namespace WebCore {
         CFURLRequestRef cfURLRequest() const;       
 
     private:
-        friend struct ResourceRequestBase;
+        friend class ResourceRequestBase;
 
         void doUpdatePlatformRequest();
         void doUpdateResourceRequest();
diff --git a/WebCore/platform/network/cf/ResourceRequestCFNet.h b/WebCore/platform/network/cf/ResourceRequestCFNet.h
index d26072d..e9ebe76 100644
--- a/WebCore/platform/network/cf/ResourceRequestCFNet.h
+++ b/WebCore/platform/network/cf/ResourceRequestCFNet.h
@@ -30,7 +30,7 @@ typedef const struct _CFURLRequest* CFURLRequestRef;
 
 namespace WebCore {
 
-    struct ResourceRequest;
+    class ResourceRequest;
 
     void getResourceRequest(ResourceRequest&, CFURLRequestRef);
     CFURLRequestRef cfURLRequest(const ResourceRequest&);
diff --git a/WebCore/platform/network/cf/SocketStreamHandle.h b/WebCore/platform/network/cf/SocketStreamHandle.h
index 64139e5..63bf9a7 100644
--- a/WebCore/platform/network/cf/SocketStreamHandle.h
+++ b/WebCore/platform/network/cf/SocketStreamHandle.h
@@ -32,10 +32,9 @@
 #ifndef SocketStreamHandle_h
 #define SocketStreamHandle_h
 
+#include "AuthenticationClient.h"
 #include "SocketStreamHandleBase.h"
-
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
+#include <wtf/RetainPtr.h>
 
 namespace WebCore {
 
@@ -43,24 +42,69 @@ namespace WebCore {
     class Credential;
     class SocketStreamHandleClient;
 
-    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase, public AuthenticationClient {
     public:
         static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
 
         virtual ~SocketStreamHandle();
 
-    protected:
+        using RefCounted<SocketStreamHandle>::ref;
+        using RefCounted<SocketStreamHandle>::deref;
+
+    private:
         virtual int platformSend(const char* data, int length);
         virtual void platformClose();
 
-    private:
         SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+        void createStreams();
+        void scheduleStreams();
+        void chooseProxy();
+#ifndef BUILDING_ON_TIGER
+        void chooseProxyFromArray(CFArrayRef);
+        void executePACFileURL(CFURLRef);
+        void removePACRunLoopSource();
+        RetainPtr<CFRunLoopSourceRef> m_pacRunLoopSource;
+        static void pacExecutionCallback(void* client, CFArrayRef proxyList, CFErrorRef error);
+        static void pacExecutionCallbackMainThread(void*);
+        static CFStringRef copyPACExecutionDescription(void*);
+#endif
+
+        bool shouldUseSSL() const { return m_url.protocolIs("wss"); }
+
+        void addCONNECTCredentials(CFHTTPMessageRef response);
+
+        static CFStringRef copyCFStreamDescription(void* );
+        static void readStreamCallback(CFReadStreamRef, CFStreamEventType, void*);
+        static void writeStreamCallback(CFWriteStreamRef, CFStreamEventType, void*);
+#if PLATFORM(WIN)
+        static void readStreamCallbackMainThread(void*);
+        static void writeStreamCallbackMainThread(void*);
+#endif
+        void readStreamCallback(CFStreamEventType);
+        void writeStreamCallback(CFStreamEventType);
 
         // No authentication for streams per se, but proxy may ask for credentials.
-        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
-        void receivedCredential(const AuthenticationChallenge&, const Credential&);
-        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
-        void receivedCancellation(const AuthenticationChallenge&);
+        virtual void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        virtual void receivedCancellation(const AuthenticationChallenge&);
+
+        virtual void refAuthenticationClient() { ref(); }
+        virtual void derefAuthenticationClient() { deref(); }
+
+        enum ConnectingSubstate { New, ExecutingPACFile, WaitingForCredentials, WaitingForConnect, Connected };
+        ConnectingSubstate m_connectingSubstate;
+
+        enum ConnectionType { Unknown, Direct, SOCKSProxy, CONNECTProxy };
+        ConnectionType m_connectionType;
+        RetainPtr<CFStringRef> m_proxyHost;
+        RetainPtr<CFNumberRef> m_proxyPort;
+
+        RetainPtr<CFHTTPMessageRef> m_proxyResponseMessage;
+        bool m_sentStoredCredentials;
+        RetainPtr<CFReadStreamRef> m_readStream;
+        RetainPtr<CFWriteStreamRef> m_writeStream;
+
+        RetainPtr<CFURLRef> m_httpsURL; // ws(s): replaced with https:
     };
 
 }  // namespace WebCore
diff --git a/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
index 6aa33fc..e7e64da 100644
--- a/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
+++ b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
  * Copyright (C) 2009 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -31,58 +32,608 @@
 #include "config.h"
 #include "SocketStreamHandle.h"
 
-#include "KURL.h"
+#include "Credential.h"
+#include "CredentialStorage.h"
 #include "Logging.h"
-#include "NotImplemented.h"
+#include "ProtectionSpace.h"
+#include "SocketStreamError.h"
 #include "SocketStreamHandleClient.h"
+#include <wtf/MainThread.h>
+
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
+#include <SystemConfiguration/SystemConfiguration.h>
+#endif
+
+#if PLATFORM(WIN)
+#include "LoaderRunLoopCF.h"
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#else
+#include "WebCoreSystemInterface.h"
+#endif
+
+#ifdef BUILDING_ON_TIGER
+#define CFN_EXPORT extern
+#endif
 
 namespace WebCore {
 
 SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
     : SocketStreamHandleBase(url, client)
+    , m_connectingSubstate(New)
+    , m_connectionType(Unknown)
+    , m_sentStoredCredentials(false)
 {
     LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
-    notImplemented();
+
+    ASSERT(url.protocolIs("ws") || url.protocolIs("wss"));
+
+    if (!m_url.port())
+        m_url.setPort(shouldUseSSL() ? 443 : 80);
+
+    KURL httpsURL(KURL(), "https://" + m_url.host());
+    m_httpsURL.adoptCF(httpsURL.createCFURL());
+
+    createStreams();
+    ASSERT(!m_readStream == !m_writeStream);
+    if (!m_readStream) // Doing asynchronous PAC file processing, streams will be created later.
+        return;
+
+    scheduleStreams();
+}
+
+void SocketStreamHandle::scheduleStreams()
+{
+    ASSERT(m_readStream);
+    ASSERT(m_writeStream);
+
+    CFStreamClientContext clientContext = { 0, this, 0, 0, copyCFStreamDescription };
+    // FIXME: Pass specific events we're interested in instead of -1.
+    CFReadStreamSetClient(m_readStream.get(), static_cast<CFOptionFlags>(-1), readStreamCallback, &clientContext);
+    CFWriteStreamSetClient(m_writeStream.get(), static_cast<CFOptionFlags>(-1), writeStreamCallback, &clientContext);
+
+#if PLATFORM(WIN)
+    CFReadStreamScheduleWithRunLoop(m_readStream.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
+    CFWriteStreamScheduleWithRunLoop(m_writeStream.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
+#else
+    CFReadStreamScheduleWithRunLoop(m_readStream.get(), CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
+    CFWriteStreamScheduleWithRunLoop(m_writeStream.get(), CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
+#endif
+
+    CFReadStreamOpen(m_readStream.get());
+    CFWriteStreamOpen(m_writeStream.get());
+
+#ifndef BUILDING_ON_TIGER
+    if (m_pacRunLoopSource)
+        removePACRunLoopSource();
+#endif
+
+    m_connectingSubstate = WaitingForConnect;
+}
+
+#ifndef BUILDING_ON_TIGER
+CFStringRef SocketStreamHandle::copyPACExecutionDescription(void*)
+{
+    return CFSTR("WebSocket proxy PAC file execution");
+}
+
+struct MainThreadPACCallbackInfo {
+    MainThreadPACCallbackInfo(SocketStreamHandle* handle, CFArrayRef proxyList) : handle(handle), proxyList(proxyList) { }
+    SocketStreamHandle* handle;
+    CFArrayRef proxyList;
+};
+
+void SocketStreamHandle::pacExecutionCallback(void* client, CFArrayRef proxyList, CFErrorRef)
+{
+    SocketStreamHandle* handle = static_cast<SocketStreamHandle*>(client);
+    MainThreadPACCallbackInfo info(handle, proxyList);
+    // If we're already on main thread (e.g. on Mac), callOnMainThreadAndWait() will be just a function call.
+    callOnMainThreadAndWait(pacExecutionCallbackMainThread, &info);
+}
+
+void SocketStreamHandle::pacExecutionCallbackMainThread(void* invocation)
+{
+    MainThreadPACCallbackInfo* info = static_cast<MainThreadPACCallbackInfo*>(invocation);
+    ASSERT(info->handle->m_connectingSubstate == ExecutingPACFile);
+    // This time, the array won't have PAC as a first entry.
+    info->handle->chooseProxyFromArray(info->proxyList);
+    info->handle->createStreams();
+    info->handle->scheduleStreams();
+}
+
+void SocketStreamHandle::executePACFileURL(CFURLRef pacFileURL)
+{
+    // CFNetwork returns an empty proxy array for WebScoket schemes, so use m_httpsURL.
+    CFStreamClientContext clientContext = { 0, this, 0, 0, copyPACExecutionDescription };
+    m_pacRunLoopSource.adoptCF(CFNetworkExecuteProxyAutoConfigurationURL(pacFileURL, m_httpsURL.get(), pacExecutionCallback, &clientContext));
+#if PLATFORM(WIN)
+    CFRunLoopAddSource(loaderRunLoop(), m_pacRunLoopSource.get(), kCFRunLoopDefaultMode);
+#else
+    CFRunLoopAddSource(CFRunLoopGetCurrent(), m_pacRunLoopSource.get(), kCFRunLoopCommonModes);
+#endif
+    m_connectingSubstate = ExecutingPACFile;
+}
+
+void SocketStreamHandle::removePACRunLoopSource()
+{
+    ASSERT(m_pacRunLoopSource);
+
+    CFRunLoopSourceInvalidate(m_pacRunLoopSource.get());
+#if PLATFORM(WIN)
+    CFRunLoopRemoveSource(loaderRunLoop(), m_pacRunLoopSource.get(), kCFRunLoopDefaultMode);
+#else
+    CFRunLoopRemoveSource(CFRunLoopGetCurrent(), m_pacRunLoopSource.get(), kCFRunLoopCommonModes);
+#endif
+    m_pacRunLoopSource = 0;
+}
+
+void SocketStreamHandle::chooseProxy()
+{
+#ifndef BUILDING_ON_LEOPARD
+    RetainPtr<CFDictionaryRef> proxyDictionary(AdoptCF, CFNetworkCopySystemProxySettings());
+#else
+    // We don't need proxy information often, so there is no need to set up a permanent dynamic store session.
+    RetainPtr<CFDictionaryRef> proxyDictionary(AdoptCF, SCDynamicStoreCopyProxies(0));
+#endif
+
+    // SOCKS or HTTPS (AKA CONNECT) proxies are supported.
+    // WebSocket protocol relies on handshake being transferred unchanged, so we need a proxy that will not modify headers.
+    // Since HTTP proxies must add Via headers, they are highly unlikely to work.
+    // Many CONNECT proxies limit connectivity to port 443, so we prefer SOCKS, if configured.
+
+    if (!proxyDictionary) {
+        m_connectionType = Direct;
+        return;
+    }
+
+    // CFNetworkCopyProxiesForURL doesn't know about WebSocket schemes, so pretend to use http.
+    // Always use "https" to get HTTPS proxies in result - we'll try to use those for ws:// even though many are configured to reject connections to ports other than 443.
+    RetainPtr<CFArrayRef> proxyArray(AdoptCF, CFNetworkCopyProxiesForURL(m_httpsURL.get(), proxyDictionary.get()));
+
+    chooseProxyFromArray(proxyArray.get());
+}
+
+void SocketStreamHandle::chooseProxyFromArray(CFArrayRef proxyArray)
+{
+    if (!proxyArray)
+        m_connectionType = Direct;
+
+    CFIndex proxyArrayCount = CFArrayGetCount(proxyArray);
+
+    // PAC is always the first entry, if present.
+    if (proxyArrayCount) {
+        CFDictionaryRef proxyInfo = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxyArray, 0));
+        CFTypeRef proxyType = CFDictionaryGetValue(proxyInfo, kCFProxyTypeKey);
+        if (proxyType && CFGetTypeID(proxyType) == CFStringGetTypeID()) {
+            if (CFEqual(proxyType, kCFProxyTypeAutoConfigurationURL)) {
+                CFTypeRef pacFileURL = CFDictionaryGetValue(proxyInfo, kCFProxyAutoConfigurationURLKey);
+                if (pacFileURL && CFGetTypeID(pacFileURL) == CFURLGetTypeID()) {
+                    executePACFileURL(static_cast<CFURLRef>(pacFileURL));
+                    return;
+                }
+            }
+        }
+    }
+
+    CFDictionaryRef chosenProxy = 0;
+    for (CFIndex i = 0; i < proxyArrayCount; ++i) {
+        CFDictionaryRef proxyInfo = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxyArray, i));
+        CFTypeRef proxyType = CFDictionaryGetValue(proxyInfo, kCFProxyTypeKey);
+        if (proxyType && CFGetTypeID(proxyType) == CFStringGetTypeID()) {
+            if (CFEqual(proxyType, kCFProxyTypeSOCKS)) {
+                m_connectionType = SOCKSProxy;
+                chosenProxy = proxyInfo;
+                break;
+            }
+            if (CFEqual(proxyType, kCFProxyTypeHTTPS)) {
+                m_connectionType = CONNECTProxy;
+                chosenProxy = proxyInfo;
+                // Keep looking for proxies, as a SOCKS one is preferable.
+            }
+        }
+    }
+
+    if (chosenProxy) {
+        ASSERT(m_connectionType != Unknown);
+        ASSERT(m_connectionType != Direct);
+
+        CFTypeRef proxyHost = CFDictionaryGetValue(chosenProxy, kCFProxyHostNameKey);
+        CFTypeRef proxyPort = CFDictionaryGetValue(chosenProxy, kCFProxyPortNumberKey);
+
+        if (proxyHost && CFGetTypeID(proxyHost) == CFStringGetTypeID() && proxyPort && CFGetTypeID(proxyPort) == CFNumberGetTypeID()) {
+            m_proxyHost = static_cast<CFStringRef>(proxyHost);
+            m_proxyPort = static_cast<CFNumberRef>(proxyPort);
+            return;
+        }
+    }
+
+    m_connectionType = Direct;
+}
+
+#else // BUILDING_ON_TIGER
+
+void SocketStreamHandle::chooseProxy()
+{
+    // We don't need proxy information often, so there is no need to set up a permanent dynamic store session.
+    RetainPtr<CFDictionaryRef> proxyDictionary(AdoptCF, SCDynamicStoreCopyProxies(0));
+
+    // SOCKS or HTTPS (AKA CONNECT) proxies are supported.
+    // WebSocket protocol relies on handshake being transferred unchanged, so we need a proxy that will not modify headers.
+    // Since HTTP proxies must add Via headers, they are highly unlikely to work.
+    // Many CONNECT proxies limit connectivity to port 443, so we prefer SOCKS, if configured.
+
+    if (!proxyDictionary) {
+        m_connectionType = Direct;
+        return;
+    }
+
+    // FIXME: check proxy bypass list and ExcludeSimpleHostnames.
+    // FIXME: Support PAC files.
+
+    CFTypeRef socksEnableCF = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesSOCKSEnable);
+    int socksEnable;
+    if (socksEnableCF && CFGetTypeID(socksEnableCF) == CFNumberGetTypeID() && CFNumberGetValue(static_cast<CFNumberRef>(socksEnableCF), kCFNumberIntType, &socksEnable) && socksEnable) {
+        CFTypeRef proxyHost = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesSOCKSProxy);
+        CFTypeRef proxyPort = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesSOCKSPort);
+        if (proxyHost && CFGetTypeID(proxyHost) == CFStringGetTypeID() && proxyPort && CFGetTypeID(proxyPort) == CFNumberGetTypeID()) {
+            m_proxyHost = static_cast<CFStringRef>(proxyHost);
+            m_proxyPort = static_cast<CFNumberRef>(proxyPort);
+            m_connectionType = SOCKSProxy;
+            return;
+        }
+    }
+
+    CFTypeRef httpsEnableCF = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesHTTPSEnable);
+    int httpsEnable;
+    if (httpsEnableCF && CFGetTypeID(httpsEnableCF) == CFNumberGetTypeID() && CFNumberGetValue(static_cast<CFNumberRef>(httpsEnableCF), kCFNumberIntType, &httpsEnable) && httpsEnable) {
+        CFTypeRef proxyHost = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesHTTPSProxy);
+        CFTypeRef proxyPort = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesHTTPSPort);
+
+        if (proxyHost && CFGetTypeID(proxyHost) == CFStringGetTypeID() && proxyPort && CFGetTypeID(proxyPort) == CFNumberGetTypeID()) {
+            m_proxyHost = static_cast<CFStringRef>(proxyHost);
+            m_proxyPort = static_cast<CFNumberRef>(proxyPort);
+            m_connectionType = CONNECTProxy;
+            return;
+        }
+    }
+
+    m_connectionType = Direct;
+}
+#endif // BUILDING_ON_TIGER
+
+void SocketStreamHandle::createStreams()
+{
+    if (m_connectionType == Unknown)
+        chooseProxy();
+
+    // If it's still unknown, then we're resolving a PAC file asynchronously.
+    if (m_connectionType == Unknown)
+        return;
+
+    RetainPtr<CFStringRef> host(AdoptCF, m_url.host().createCFString());
+
+    // Creating streams to final destination, not to proxy.
+    CFReadStreamRef readStream = 0;
+    CFWriteStreamRef writeStream = 0;
+    CFStreamCreatePairWithSocketToHost(0, host.get(), m_url.port(), &readStream, &writeStream);
+
+    m_readStream.adoptCF(readStream);
+    m_writeStream.adoptCF(writeStream);
+
+    switch (m_connectionType) {
+    case Unknown:
+        ASSERT_NOT_REACHED();
+        break;
+    case Direct:
+        break;
+    case SOCKSProxy: {
+        // FIXME: SOCKS5 doesn't do challenge-response, should we try to apply credentials from Keychain right away?
+        // But SOCKS5 credentials don't work at the time of this writing anyway, see <rdar://6776698>.
+        const void* proxyKeys[] = { kCFStreamPropertySOCKSProxyHost, kCFStreamPropertySOCKSProxyPort };
+        const void* proxyValues[] = { m_proxyHost.get(), m_proxyPort.get() };
+        RetainPtr<CFDictionaryRef> connectDictionary(AdoptCF, CFDictionaryCreate(0, proxyKeys, proxyValues, sizeof(proxyKeys) / sizeof(*proxyKeys), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+        CFReadStreamSetProperty(m_readStream.get(), kCFStreamPropertySOCKSProxy, connectDictionary.get());
+        break;
+        }
+    case CONNECTProxy:
+        wkSetCONNECTProxyForStream(m_readStream.get(), m_proxyHost.get(), m_proxyPort.get());
+        break;
+    }
+
+    if (shouldUseSSL()) {
+        const void* keys[] = { kCFStreamSSLPeerName, kCFStreamSSLLevel };
+        const void* values[] = { host.get(), kCFStreamSocketSecurityLevelNegotiatedSSL };
+        RetainPtr<CFDictionaryRef> settings(AdoptCF, CFDictionaryCreate(0, keys, values, sizeof(keys) / sizeof(*keys), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+        CFReadStreamSetProperty(m_readStream.get(), kCFStreamPropertySSLSettings, settings.get());
+        CFWriteStreamSetProperty(m_writeStream.get(), kCFStreamPropertySSLSettings, settings.get());
+    }
+}
+
+static bool getStoredCONNECTProxyCredentials(const ProtectionSpace& protectionSpace, String& login, String& password)
+{
+    // Try system credential storage first, matching HTTP behavior (CFNetwork only asks the client for password if it couldn't find it in Keychain).
+    Credential storedCredential = CredentialStorage::getFromPersistentStorage(protectionSpace);
+    if (storedCredential.isEmpty())
+        storedCredential = CredentialStorage::get(protectionSpace);
+
+    if (storedCredential.isEmpty())
+        return false;
+
+    login = storedCredential.user();
+    password = storedCredential.password();
+
+    return true;
+}
+
+static ProtectionSpaceAuthenticationScheme authenticationSchemeFromAuthenticationMethod(CFStringRef method)
+{
+    if (CFEqual(method, kCFHTTPAuthenticationSchemeBasic))
+        return ProtectionSpaceAuthenticationSchemeHTTPBasic;
+    if (CFEqual(method, kCFHTTPAuthenticationSchemeDigest))
+        return ProtectionSpaceAuthenticationSchemeHTTPDigest;
+#ifndef BUILDING_ON_TIGER
+    if (CFEqual(method, kCFHTTPAuthenticationSchemeNTLM))
+        return ProtectionSpaceAuthenticationSchemeNTLM;
+    if (CFEqual(method, kCFHTTPAuthenticationSchemeNegotiate))
+        return ProtectionSpaceAuthenticationSchemeNegotiate;
+#endif
+    ASSERT_NOT_REACHED();
+    return ProtectionSpaceAuthenticationSchemeDefault;
+}
+
+void SocketStreamHandle::addCONNECTCredentials(CFHTTPMessageRef proxyResponse)
+{
+    RetainPtr<CFHTTPAuthenticationRef> authentication(AdoptCF, CFHTTPAuthenticationCreateFromResponse(0, proxyResponse));
+
+    if (!CFHTTPAuthenticationRequiresUserNameAndPassword(authentication.get())) {
+        // That's all we can offer...
+        m_client->didFail(this, SocketStreamError()); // FIXME: Provide a sensible error.
+        return;
+    }
+
+    int port = 0;
+    CFNumberGetValue(m_proxyPort.get(), kCFNumberIntType, &port);
+    RetainPtr<CFStringRef> methodCF(AdoptCF, CFHTTPAuthenticationCopyMethod(authentication.get()));
+    RetainPtr<CFStringRef> realmCF(AdoptCF, CFHTTPAuthenticationCopyRealm(authentication.get()));
+    ProtectionSpace protectionSpace(String(m_proxyHost.get()), port, ProtectionSpaceProxyHTTPS, String(realmCF.get()), authenticationSchemeFromAuthenticationMethod(methodCF.get()));
+    String login;
+    String password;
+    if (!m_sentStoredCredentials && getStoredCONNECTProxyCredentials(protectionSpace, login, password)) {
+        // Try to apply stored credentials, if we haven't tried those already.
+        RetainPtr<CFStringRef> loginCF(AdoptCF, login.createCFString());
+        RetainPtr<CFStringRef> passwordCF(AdoptCF, password.createCFString());
+        // Creating a temporary request to make CFNetwork apply credentials to it. Unfortunately, this cannot work with NTLM authentication.
+        RetainPtr<CFHTTPMessageRef> dummyRequest(AdoptCF, CFHTTPMessageCreateRequest(0, CFSTR("GET"), m_httpsURL.get(), kCFHTTPVersion1_1));
+
+        Boolean appliedCredentials = CFHTTPMessageApplyCredentials(dummyRequest.get(), authentication.get(), loginCF.get(), passwordCF.get(), 0);
+        ASSERT_UNUSED(appliedCredentials, appliedCredentials);
+
+        RetainPtr<CFStringRef> proxyAuthorizationString(AdoptCF, CFHTTPMessageCopyHeaderFieldValue(dummyRequest.get(), CFSTR("Proxy-Authorization")));
+
+        if (!proxyAuthorizationString) {
+            // Fails e.g. for NTLM auth.
+            m_client->didFail(this, SocketStreamError()); // FIXME: Provide a sensible error.
+            return;
+        }
+
+        // Setting the authorization results in a new connection attempt.
+        wkSetCONNECTProxyAuthorizationForStream(m_readStream.get(), proxyAuthorizationString.get());
+        m_sentStoredCredentials = true;
+        return;
+    }
+
+    // FIXME: Ask the client if credentials could not be found.
+
+    m_client->didFail(this, SocketStreamError()); // FIXME: Provide a sensible error.
+}
+
+CFStringRef SocketStreamHandle::copyCFStreamDescription(void* info)
+{
+    SocketStreamHandle* handle = static_cast<SocketStreamHandle*>(info);
+    return ("WebKit socket stream, " + handle->m_url.string()).createCFString();
+}
+
+struct MainThreadEventCallbackInfo {
+    MainThreadEventCallbackInfo(CFStreamEventType type, SocketStreamHandle* handle) : type(type), handle(handle) { }
+    CFStreamEventType type;
+    SocketStreamHandle* handle;
+};
+
+void SocketStreamHandle::readStreamCallback(CFReadStreamRef stream, CFStreamEventType type, void* clientCallBackInfo)
+{
+    SocketStreamHandle* handle = static_cast<SocketStreamHandle*>(clientCallBackInfo);
+    ASSERT_UNUSED(stream, stream == handle->m_readStream.get());
+#if PLATFORM(WIN)
+    MainThreadEventCallbackInfo info(type, handle);
+    callOnMainThreadAndWait(readStreamCallbackMainThread, &info);
+#else
+    ASSERT(isMainThread());
+    handle->readStreamCallback(type);
+#endif
+}
+
+void SocketStreamHandle::writeStreamCallback(CFWriteStreamRef stream, CFStreamEventType type, void* clientCallBackInfo)
+{
+    SocketStreamHandle* handle = static_cast<SocketStreamHandle*>(clientCallBackInfo);
+    ASSERT_UNUSED(stream, stream == handle->m_writeStream.get());
+#if PLATFORM(WIN)
+    MainThreadEventCallbackInfo info(type, handle);
+    callOnMainThreadAndWait(writeStreamCallbackMainThread, &info);
+#else
+    ASSERT(isMainThread());
+    handle->writeStreamCallback(type);
+#endif
+}
+
+#if PLATFORM(WIN)
+void SocketStreamHandle::readStreamCallbackMainThread(void* invocation)
+{
+    MainThreadEventCallbackInfo* info = static_cast<MainThreadEventCallbackInfo*>(invocation);
+    info->handle->readStreamCallback(info->type);
+}
+
+void SocketStreamHandle::writeStreamCallbackMainThread(void* invocation)
+{
+    MainThreadEventCallbackInfo* info = static_cast<MainThreadEventCallbackInfo*>(invocation);
+    info->handle->writeStreamCallback(info->type);
+}
+#endif // PLATFORM(WIN)
+
+void SocketStreamHandle::readStreamCallback(CFStreamEventType type)
+{
+    switch(type) {
+    case kCFStreamEventNone:
+        break;
+    case kCFStreamEventOpenCompleted:
+        break;
+    case kCFStreamEventHasBytesAvailable: {
+        if (m_connectingSubstate == WaitingForConnect) {
+            if (m_connectionType == CONNECTProxy) {
+                RetainPtr<CFHTTPMessageRef> proxyResponse(AdoptCF, wkCopyCONNECTProxyResponse(m_readStream.get(), m_httpsURL.get()));
+                if (proxyResponse && (407 == CFHTTPMessageGetResponseStatusCode(proxyResponse.get()))) {
+                    addCONNECTCredentials(proxyResponse.get());
+                    return;
+                }
+            }
+        } else if (m_connectingSubstate == WaitingForCredentials)
+            break;
+
+        if (m_connectingSubstate == WaitingForConnect) {
+            m_connectingSubstate = Connected;
+            m_state = Open;
+
+            RefPtr<SocketStreamHandle> protect(this); // The client can close the handle, potentially removing the last reference.
+            m_client->didOpen(this);
+            if (m_state == Closed)
+                break;
+            // Fall through.
+        } else if (m_state == Closed)
+            break;
+
+        ASSERT(m_state == Open);
+        ASSERT(m_connectingSubstate == Connected);
+
+        CFIndex length;
+        UInt8 localBuffer[1024]; // Used if CFReadStreamGetBuffer couldn't return anything.
+        const UInt8* ptr = CFReadStreamGetBuffer(m_readStream.get(), 0, &length);
+        if (!ptr) {
+            length = CFReadStreamRead(m_readStream.get(), localBuffer, sizeof(localBuffer));
+            ptr = localBuffer;
+        }
+
+        m_client->didReceiveData(this, reinterpret_cast<const char*>(ptr), length);
+
+        break;
+    }
+    case kCFStreamEventCanAcceptBytes:
+        ASSERT_NOT_REACHED();
+        break;
+    case kCFStreamEventErrorOccurred: {
+        CFStreamError error = CFReadStreamGetError(m_readStream.get());
+        m_client->didFail(this, SocketStreamError(error.error)); // FIXME: Provide a sensible error.
+        break;
+    }
+    case kCFStreamEventEndEncountered:
+        platformClose();
+        break;
+    }
+}
+
+void SocketStreamHandle::writeStreamCallback(CFStreamEventType type)
+{
+    switch(type) {
+    case kCFStreamEventNone:
+        break;
+    case kCFStreamEventOpenCompleted:
+        break;
+    case kCFStreamEventHasBytesAvailable:
+        ASSERT_NOT_REACHED();
+        break;
+    case kCFStreamEventCanAcceptBytes: {
+        // Possibly, a spurious event from CONNECT handshake.
+        if (!CFWriteStreamCanAcceptBytes(m_writeStream.get()))
+            return;
+
+        if (m_connectingSubstate == WaitingForCredentials)
+            break;
+
+        if (m_connectingSubstate == WaitingForConnect) {
+            m_connectingSubstate = Connected;
+            m_state = Open;
+
+            RefPtr<SocketStreamHandle> protect(this); // The client can close the handle, potentially removing the last reference.
+            m_client->didOpen(this);
+            break;
+        }
+
+        ASSERT(m_state = Open);
+        ASSERT(m_connectingSubstate == Connected);
+
+        sendPendingData();
+        break;
+    }
+    case kCFStreamEventErrorOccurred: {
+        CFStreamError error = CFWriteStreamGetError(m_writeStream.get());
+        m_client->didFail(this, SocketStreamError(error.error)); // FIXME: Provide a sensible error.
+        break;
+    }
+    case kCFStreamEventEndEncountered:
+        // FIXME: Currently, we handle closing in read callback, but these can come independently (e.g. a server can stop listening, but keep sending data).
+        break;
+    }
 }
 
 SocketStreamHandle::~SocketStreamHandle()
 {
-    LOG(Network, "SocketStreamHandle %p delete", this);
-    setClient(0);
-    notImplemented();
+    LOG(Network, "SocketStreamHandle %p dtor", this);
+
+#ifndef BUILDING_ON_TIGER
+    ASSERT(!m_pacRunLoopSource);
+#endif
 }
 
-int SocketStreamHandle::platformSend(const char*, int)
+int SocketStreamHandle::platformSend(const char* data, int length)
 {
-    LOG(Network, "SocketStreamHandle %p platformSend", this);
-    notImplemented();
-    return 0;
+    if (!CFWriteStreamCanAcceptBytes(m_writeStream.get()))
+        return 0;
+
+    return CFWriteStreamWrite(m_writeStream.get(), reinterpret_cast<const UInt8*>(data), length);
 }
 
 void SocketStreamHandle::platformClose()
 {
     LOG(Network, "SocketStreamHandle %p platformClose", this);
-    notImplemented();
-}
 
-void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
-{
-    notImplemented();
+#ifndef BUILDING_ON_TIGER
+    if (m_pacRunLoopSource) 
+        removePACRunLoopSource();
+#endif
+
+    ASSERT(!m_readStream == !m_writeStream);
+    if (!m_readStream)
+        return;
+
+    CFReadStreamUnscheduleFromRunLoop(m_readStream.get(), CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
+    CFWriteStreamUnscheduleFromRunLoop(m_writeStream.get(), CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
+
+    CFReadStreamClose(m_readStream.get());
+    CFWriteStreamClose(m_writeStream.get());
+    
+    m_readStream = 0;
+    m_writeStream = 0;
+
+    m_client->didClose(this);
 }
 
 void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
 {
-    notImplemented();
 }
 
 void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
 {
-    notImplemented();
 }
 
 void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
 {
-    notImplemented();
 }
 
 }  // namespace WebCore
diff --git a/WebCore/platform/network/chromium/AuthenticationChallenge.h b/WebCore/platform/network/chromium/AuthenticationChallenge.h
index cd1b430..e2d1f42 100644
--- a/WebCore/platform/network/chromium/AuthenticationChallenge.h
+++ b/WebCore/platform/network/chromium/AuthenticationChallenge.h
@@ -28,25 +28,23 @@
 #define AuthenticationChallenge_h
 
 #include "AuthenticationChallengeBase.h"
-#include "ResourceHandle.h"
+#include "AuthenticationClient.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-    class ResourceHandle;
-
     class AuthenticationChallenge : public AuthenticationChallengeBase {
     public:
         AuthenticationChallenge() {}
         AuthenticationChallenge(const ProtectionSpace&, const Credential& proposedCredential, unsigned previousFailureCount, const ResourceResponse&, const ResourceError&);
 
-        ResourceHandle* sourceHandle() const { return m_sourceHandle.get(); }
+        AuthenticationClient* authenticationClient() const { return m_authenticationClient.get(); }
 
     private:
         friend class AuthenticationChallengeBase;
         static bool platformCompare(const AuthenticationChallenge&, const AuthenticationChallenge&);
 
-        RefPtr<ResourceHandle> m_sourceHandle;
+        RefPtr<AuthenticationClient> m_authenticationClient;
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/CookieJarChromium.cpp b/WebCore/platform/network/chromium/CookieJarChromium.cpp
index 7862cc3..279d9b0 100644
--- a/WebCore/platform/network/chromium/CookieJarChromium.cpp
+++ b/WebCore/platform/network/chromium/CookieJarChromium.cpp
@@ -53,16 +53,14 @@ bool cookiesEnabled(const Document*)
     return true;
 }
 
-bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+bool getRawCookies(const Document* document, const KURL& url, Vector<Cookie>& rawCookies)
 {
-    // FIXME: Not yet implemented
-    rawCookies.clear();
-    return false; // return true when implemented
+    return ChromiumBridge::rawCookies(url, document->firstPartyForCookies(), &rawCookies);
 }
 
-void deleteCookie(const Document*, const KURL&, const String&)
+void deleteCookie(const Document*, const KURL& url, const String& cookieName)
 {
-    // FIXME: Not yet implemented
+    return ChromiumBridge::deleteCookie(url, cookieName);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/ResourceRequest.cpp b/WebCore/platform/network/chromium/ResourceRequest.cpp
index 76d1288..5b27c1b 100644
--- a/WebCore/platform/network/chromium/ResourceRequest.cpp
+++ b/WebCore/platform/network/chromium/ResourceRequest.cpp
@@ -23,6 +23,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
+#include "ResourceRequest.h"
+
 namespace WebCore {
 
 // This is used by the loader to control the number of issued parallel load requests. 
diff --git a/WebCore/platform/network/chromium/ResourceRequest.h b/WebCore/platform/network/chromium/ResourceRequest.h
index 48ff1e7..176f923 100644
--- a/WebCore/platform/network/chromium/ResourceRequest.h
+++ b/WebCore/platform/network/chromium/ResourceRequest.h
@@ -35,22 +35,13 @@ namespace WebCore {
 
     class Frame;
 
-    struct ResourceRequest : public ResourceRequestBase {
+    class ResourceRequest : public ResourceRequestBase {
     public:
-        enum TargetType {
-            TargetIsMainFrame,
-            TargetIsSubFrame,
-            TargetIsSubResource,
-            TargetIsObject,
-            TargetIsMedia
-        };
-
         ResourceRequest(const String& url) 
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
         {
         }
 
@@ -59,7 +50,6 @@ namespace WebCore {
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
             , m_securityInfo(securityInfo)
         {
         }
@@ -69,7 +59,6 @@ namespace WebCore {
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
         {
         }
 
@@ -78,7 +67,6 @@ namespace WebCore {
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
         {
             setHTTPReferrer(referrer);
         }
@@ -88,7 +76,6 @@ namespace WebCore {
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
         {
         }
 
@@ -96,10 +83,6 @@ namespace WebCore {
         int requestorID() const { return m_requestorID; }
         void setRequestorID(int requestorID) { m_requestorID = requestorID; }
 
-        // What this request is for.
-        TargetType targetType() const { return m_targetType; }
-        void setTargetType(TargetType type) { m_targetType = type; }
-
         // The process id of the process from which this request originated. In
         // the case of out-of-process plugins, this allows to link back the
         // request to the plugin process (as it is processed through a render
@@ -129,7 +112,6 @@ namespace WebCore {
         int m_requestorID;
         int m_requestorProcessID;
         int m_appCacheHostID;
-        TargetType m_targetType;
         CString m_securityInfo;
     };
 
diff --git a/WebCore/platform/network/curl/AuthenticationChallenge.h b/WebCore/platform/network/curl/AuthenticationChallenge.h
index a64d575..7ace096 100644
--- a/WebCore/platform/network/curl/AuthenticationChallenge.h
+++ b/WebCore/platform/network/curl/AuthenticationChallenge.h
@@ -26,13 +26,11 @@
 #define AuthenticationChallenge_h
 
 #include "AuthenticationChallengeBase.h"
-#include "ResourceHandle.h"
+#include "AuthenticationClient.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-class ResourceHandle;
-
 class AuthenticationChallenge : public AuthenticationChallengeBase {
 public:
     AuthenticationChallenge()
@@ -44,9 +42,9 @@ public:
     {
     }
 
-    ResourceHandle* sourceHandle() const { return m_sourceHandle.get(); }
+    AuthenticationClient* authenticationClient() const { return m_authenticationClient.get(); }
 
-    RefPtr<ResourceHandle> m_sourceHandle;    
+    RefPtr<AuthenticationClient> m_authenticationClient;
 };
 
 }
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.cpp b/WebCore/platform/network/curl/ResourceHandleManager.cpp
index d8a812f..a006a14 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleManager.cpp
@@ -49,6 +49,11 @@
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
 
+#if !PLATFORM(WIN_OS)
+#include <sys/param.h>
+#define MAX_PATH MAXPATHLEN
+#endif
+
 namespace WebCore {
 
 const int selectTimeoutMS = 5;
diff --git a/WebCore/platform/network/curl/ResourceRequest.h b/WebCore/platform/network/curl/ResourceRequest.h
index 3fa2795..40e1e8f 100644
--- a/WebCore/platform/network/curl/ResourceRequest.h
+++ b/WebCore/platform/network/curl/ResourceRequest.h
@@ -33,8 +33,8 @@ typedef const struct _CFURLRequest* CFURLRequestRef;
 
 namespace WebCore {
 
-    struct ResourceRequest : ResourceRequestBase {
-
+    class ResourceRequest : public ResourceRequestBase {
+    public:
         ResourceRequest(const String& url)
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
diff --git a/WebCore/platform/network/mac/AuthenticationChallenge.h b/WebCore/platform/network/mac/AuthenticationChallenge.h
index e8f3a2d..d74a92c 100644
--- a/WebCore/platform/network/mac/AuthenticationChallenge.h
+++ b/WebCore/platform/network/mac/AuthenticationChallenge.h
@@ -37,21 +37,25 @@ class NSURLAuthenticationChallenge;
 
 namespace WebCore {
 
+class AuthenticationClient;
+
 class AuthenticationChallenge : public AuthenticationChallengeBase {
 public:
-    AuthenticationChallenge() {}
+    AuthenticationChallenge() { }
     AuthenticationChallenge(const ProtectionSpace& protectionSpace, const Credential& proposedCredential, unsigned previousFailureCount, const ResourceResponse& response, const ResourceError& error);
     AuthenticationChallenge(NSURLAuthenticationChallenge *);
 
     id sender() const { return m_sender.get(); }
-    NSURLAuthenticationChallenge *nsURLAuthenticationChallenge() const { return m_macChallenge.get(); }
+    NSURLAuthenticationChallenge *nsURLAuthenticationChallenge() const { return m_nsChallenge.get(); }
+
+    void setAuthenticationClient(AuthenticationClient*); // Changes sender to one that invokes client methods.
 
 private:
     friend class AuthenticationChallengeBase;
     static bool platformCompare(const AuthenticationChallenge& a, const AuthenticationChallenge& b);
 
-    RetainPtr<id> m_sender;
-    RetainPtr<NSURLAuthenticationChallenge *> m_macChallenge;
+    RetainPtr<id> m_sender; // Always the same as [m_macChallenge.get() sender], cached here for performance.
+    RetainPtr<NSURLAuthenticationChallenge *> m_nsChallenge;
 };
 
 }
diff --git a/WebCore/platform/network/mac/AuthenticationMac.mm b/WebCore/platform/network/mac/AuthenticationMac.mm
index 93725d5..ea06ecd 100644
--- a/WebCore/platform/network/mac/AuthenticationMac.mm
+++ b/WebCore/platform/network/mac/AuthenticationMac.mm
@@ -26,6 +26,7 @@
 #import "AuthenticationMac.h"
 
 #import "AuthenticationChallenge.h"
+#import "AuthenticationClient.h"
 #import "Credential.h"
 #import "ProtectionSpace.h"
 
@@ -33,6 +34,51 @@
 #import <Foundation/NSURLCredential.h>
 #import <Foundation/NSURLProtectionSpace.h>
 
+using namespace WebCore;
+
+@interface WebCoreAuthenticationClientAsChallengeSender : NSObject <NSURLAuthenticationChallengeSender>
+{
+    AuthenticationClient* m_client;
+}
+- (id)initWithAuthenticationClient:(AuthenticationClient*)client;
+- (void)detachClient;
+@end
+
+@implementation WebCoreAuthenticationClientAsChallengeSender
+
+- (id)initWithAuthenticationClient:(AuthenticationClient*)client
+{
+    self = [self init];
+    if (!self)
+        return nil;
+    m_client = client;
+    return self;
+}
+
+- (void)detachClient
+{
+    m_client = 0;
+}
+
+- (void)useCredential:(NSURLCredential *)credential forAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+{
+    if (m_client)
+        m_client->receivedCredential(core(challenge), core(credential));
+}
+
+- (void)continueWithoutCredentialForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+{
+    if (m_client)
+        m_client->receivedRequestToContinueWithoutCredential(core(challenge));
+}
+
+- (void)cancelAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+{
+    if (m_client)
+        m_client->receivedCancellation(core(challenge));
+}
+
+@end
 
 namespace WebCore {
 
@@ -49,17 +95,28 @@ AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protecti
 {
 }
 
-AuthenticationChallenge::AuthenticationChallenge(NSURLAuthenticationChallenge *macChallenge)
-    : AuthenticationChallengeBase(core([macChallenge protectionSpace]),
-                                  core([macChallenge proposedCredential]),
-                                  [macChallenge previousFailureCount],
-                                  [macChallenge failureResponse],
-                                  [macChallenge error])
-    , m_sender([macChallenge sender])
-    , m_macChallenge(macChallenge)
+AuthenticationChallenge::AuthenticationChallenge(NSURLAuthenticationChallenge *challenge)
+    : AuthenticationChallengeBase(core([challenge protectionSpace]),
+                                  core([challenge proposedCredential]),
+                                  [challenge previousFailureCount],
+                                  [challenge failureResponse],
+                                  [challenge error])
+    , m_sender([challenge sender])
+    , m_nsChallenge(challenge)
 {
 }
 
+void AuthenticationChallenge::setAuthenticationClient(AuthenticationClient* client)
+{
+    if (client) {
+        m_sender.adoptNS([[WebCoreAuthenticationClientAsChallengeSender alloc] initWithAuthenticationClient:client]);
+        m_nsChallenge.adoptNS([[NSURLAuthenticationChallenge alloc] initWithAuthenticationChallenge:m_nsChallenge.get() sender:m_sender.get()]);
+    } else {
+        if ([m_sender.get() isMemberOfClass:[WebCoreAuthenticationClientAsChallengeSender class]])
+            [(WebCoreAuthenticationClientAsChallengeSender *)m_sender.get() detachClient];
+    }
+}
+
 bool AuthenticationChallenge::platformCompare(const AuthenticationChallenge& a, const AuthenticationChallenge& b)
 {
     if (a.sender() != b.sender())
@@ -131,6 +188,11 @@ NSURLProtectionSpace *mac(const ProtectionSpace& coreSpace)
         case ProtectionSpaceAuthenticationSchemeHTMLForm:
             method = NSURLAuthenticationMethodHTMLForm;
             break;
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+        case ProtectionSpaceAuthenticationSchemeNTLM:
+            method = NSURLAuthenticationMethodNTLM;
+            break;
+#endif
         default:
             ASSERT_NOT_REACHED();
     }
@@ -167,6 +229,15 @@ NSURLCredential *mac(const Credential& coreCredential)
             ASSERT_NOT_REACHED();
     }
 
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    if (coreCredential.type() == CredentialTypeClientCertificate) {
+        return [[[NSURLCredential alloc] initWithIdentity:coreCredential.identity()
+                                             certificates:(NSArray *)coreCredential.certificates()
+                                              persistence:persistence]
+                                              autorelease];
+    }
+#endif
+
     return [[[NSURLCredential alloc] initWithUser:coreCredential.user()
                                         password:coreCredential.password()
                                      persistence:persistence]
@@ -218,6 +289,10 @@ ProtectionSpace core(NSURLProtectionSpace *macSpace)
         scheme = ProtectionSpaceAuthenticationSchemeHTTPDigest;
     else if ([method isEqualToString:NSURLAuthenticationMethodHTMLForm])
         scheme = ProtectionSpaceAuthenticationSchemeHTMLForm;
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    else if ([method isEqualToString:NSURLAuthenticationMethodNTLM])
+        scheme = ProtectionSpaceAuthenticationSchemeNTLM;
+#endif
     else
         ASSERT_NOT_REACHED();
         
@@ -240,6 +315,12 @@ Credential core(NSURLCredential *macCredential)
         default:
             ASSERT_NOT_REACHED();
     }
+
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    SecIdentityRef identity = [macCredential identity];
+    if (identity)
+        return Credential(identity, (CFArrayRef)[macCredential certificates], persistence);
+#endif
     
     return Credential([macCredential user], [macCredential password], persistence);
 }
diff --git a/WebCore/platform/network/mac/CredentialStorageMac.mm b/WebCore/platform/network/mac/CredentialStorageMac.mm
new file mode 100644
index 0000000..66e94e9
--- /dev/null
+++ b/WebCore/platform/network/mac/CredentialStorageMac.mm
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CredentialStorage.h"
+
+#include "AuthenticationMac.h"
+#include "Credential.h"
+
+namespace WebCore {
+
+Credential CredentialStorage::getFromPersistentStorage(const ProtectionSpace& protectionSpace)
+{
+    NSURLCredential *credential = [[NSURLCredentialStorage sharedCredentialStorage] defaultCredentialForProtectionSpace:mac(protectionSpace)];
+    return credential ? core(credential) : Credential();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/mac/NetworkStateNotifierMac.cpp b/WebCore/platform/network/mac/NetworkStateNotifierMac.cpp
index c0918a4..2045eb3 100644
--- a/WebCore/platform/network/mac/NetworkStateNotifierMac.cpp
+++ b/WebCore/platform/network/mac/NetworkStateNotifierMac.cpp
@@ -28,10 +28,10 @@
 
 #include <SystemConfiguration/SystemConfiguration.h>
 
-#ifdef BUILDING_ON_TIGER
-// This function is available on Tiger, but not declared in the CFRunLoop.h header on Tiger.
-extern "C" CFRunLoopRef CFRunLoopGetMain();
-#endif
+#ifdef BUILDING_ON_TIGER 
+// This function is available on Tiger, but not declared in the CFRunLoop.h header on Tiger. 
+extern "C" CFRunLoopRef CFRunLoopGetMain(); 
+#endif 
 
 namespace WebCore {
 
diff --git a/WebCore/platform/network/mac/ResourceHandleMac.mm b/WebCore/platform/network/mac/ResourceHandleMac.mm
index 3630b30..360425e 100644
--- a/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -55,7 +55,7 @@ typedef int NSInteger;
 
 using namespace WebCore;
 
-@interface WebCoreResourceHandleAsDelegate : NSObject <NSURLAuthenticationChallengeSender>
+@interface WebCoreResourceHandleAsDelegate : NSObject
 {
     ResourceHandle* m_handle;
 }
@@ -138,6 +138,7 @@ ResourceHandleInternal::~ResourceHandleInternal()
 ResourceHandle::~ResourceHandle()
 {
     releaseDelegate();
+    d->m_currentWebChallenge.setAuthenticationClient(0);
 
     LOG(Network, "Handle %p destroyed", this);
 }
@@ -511,10 +512,8 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
 #endif
 
     d->m_currentMacChallenge = challenge.nsURLAuthenticationChallenge();
-    NSURLAuthenticationChallenge *webChallenge = [[NSURLAuthenticationChallenge alloc] initWithAuthenticationChallenge:d->m_currentMacChallenge 
-                                                                                       sender:(id<NSURLAuthenticationChallengeSender>)delegate()];
-    d->m_currentWebChallenge = core(webChallenge);
-    [webChallenge release];
+    d->m_currentWebChallenge = core(d->m_currentMacChallenge);
+    d->m_currentWebChallenge.setAuthenticationClient(this);
 
     if (client())
         client()->didReceiveAuthenticationChallenge(this, d->m_currentWebChallenge);
@@ -523,8 +522,8 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
 void ResourceHandle::didCancelAuthenticationChallenge(const AuthenticationChallenge& challenge)
 {
     ASSERT(d->m_currentMacChallenge);
+    ASSERT(d->m_currentMacChallenge == challenge.nsURLAuthenticationChallenge());
     ASSERT(!d->m_currentWebChallenge.isNull());
-    ASSERT(d->m_currentWebChallenge == challenge);
 
     if (client())
         client()->didCancelAuthenticationChallenge(this, challenge);
@@ -547,7 +546,7 @@ void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge
         // Manage per-session credentials internally, because once NSURLCredentialPersistenceForSession is used, there is no way
         // to ignore it for a particular request (short of removing it altogether).
         // <rdar://problem/6867598> gallery.me.com is temporarily whitelisted, so that QuickTime plug-in could see the credentials.
-        Credential webCredential(credential.user(), credential.password(), CredentialPersistenceNone);
+        Credential webCredential(credential, CredentialPersistenceNone);
         KURL urlToStore;
         if (challenge.failureResponse().httpStatusCode() == 401)
             urlToStore = d->m_request.url();
@@ -868,27 +867,6 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     return newResponse;
 }
 
-- (void)useCredential:(NSURLCredential *)credential forAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
-{
-    if (!m_handle)
-        return;
-    m_handle->receivedCredential(core(challenge), core(credential));
-}
-
-- (void)continueWithoutCredentialForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
-{
-    if (!m_handle)
-        return;
-    m_handle->receivedRequestToContinueWithoutCredential(core(challenge));
-}
-
-- (void)cancelAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
-{
-    if (!m_handle)
-        return;
-    m_handle->receivedCancellation(core(challenge));
-}
-
 @end
 
 #ifndef BUILDING_ON_TIGER
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index ed5e024..f7bbb9d 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -21,8 +21,6 @@
 #include "config.h"
 #include "QNetworkReplyHandler.h"
 
-#if QT_VERSION >= 0x040400
-
 #include "HTTPParsers.h"
 #include "MIMETypeRegistry.h"
 #include "ResourceHandle.h"
@@ -140,10 +138,14 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
         m_method = QNetworkAccessManager::PostOperation;
     else if (r.httpMethod() == "PUT")
         m_method = QNetworkAccessManager::PutOperation;
+#if QT_VERSION >= 0x040600
+    else if (r.httpMethod() == "DELETE")
+        m_method = QNetworkAccessManager::DeleteOperation;
+#endif
     else
         m_method = QNetworkAccessManager::UnknownOperation;
 
-    m_request = r.toNetworkRequest();
+    m_request = r.toNetworkRequest(m_resourceHandle->getInternal()->m_frame);
 
     if (m_loadMode == LoadNormal)
         start();
@@ -255,7 +257,7 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     if (m_shouldSendResponse)
         return;
 
-    if (m_reply->error())
+    if (m_reply->error() && !ignoreHttpError(m_reply, m_responseDataSent))
         return;
 
     if (m_responseSent || !m_resourceHandle)
@@ -305,9 +307,15 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
         response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
 
         // Add remaining headers.
+#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
+        foreach (const QNetworkReply::RawHeaderPair& pair, m_reply->rawHeaderPairs()) {
+            response.setHTTPHeaderField(QString::fromAscii(pair.first), QString::fromAscii(pair.second));
+        }
+#else
         foreach (const QByteArray& headerName, m_reply->rawHeaderList()) {
             response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
         }
+#endif
     }
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
@@ -321,12 +329,13 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
             newRequest.setHTTPMethod("GET");
         }
 
+        // Should not set Referer after a redirect from a secure resource to non-secure one.
+        if (!newRequest.url().protocolIs("https") && protocolIs(newRequest.httpReferrer(), "https"))
+            newRequest.clearHTTPReferrer();
+
         client->willSendRequest(m_resourceHandle, newRequest, response);
         m_redirected = true;
-        m_request = newRequest.toNetworkRequest();
-
-        ResourceHandleInternal* d = m_resourceHandle->getInternal();
-        emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+        m_request = newRequest.toNetworkRequest(m_resourceHandle->getInternal()->m_frame);
         return;
     }
 
@@ -368,8 +377,6 @@ void QNetworkReplyHandler::start()
 
     QNetworkAccessManager* manager = d->m_frame->page()->networkAccessManager();
 
-    emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
-
     const QUrl url = m_request.url();
     const QString scheme = url.scheme();
     // Post requests on files and data don't really make sense, but for
@@ -398,6 +405,12 @@ void QNetworkReplyHandler::start()
             putDevice->setParent(m_reply);
             break;
         }
+#if QT_VERSION >= 0x040600
+        case QNetworkAccessManager::DeleteOperation: {
+            m_reply = manager->deleteResource(m_request);
+            break;
+        }
+#endif
         case QNetworkAccessManager::UnknownOperation: {
             m_reply = 0;
             ResourceHandleClient* client = m_resourceHandle->client();
@@ -461,5 +474,3 @@ void QNetworkReplyHandler::sendQueuedItems()
 }
 
 #include "moc_QNetworkReplyHandler.cpp"
-
-#endif
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.h b/WebCore/platform/network/qt/QNetworkReplyHandler.h
index fccc4a6..2171083 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -21,8 +21,6 @@
 
 #include <QObject>
 
-#if QT_VERSION >= 0x040400
-
 #include <QNetworkRequest>
 #include <QNetworkAccessManager>
 
@@ -113,6 +111,4 @@ private:
 
 }
 
-#endif
-
 #endif // QNETWORKREPLYHANDLER_H
diff --git a/WebCore/platform/network/qt/ResourceHandleQt.cpp b/WebCore/platform/network/qt/ResourceHandleQt.cpp
index f4c30c9..09cdefd 100644
--- a/WebCore/platform/network/qt/ResourceHandleQt.cpp
+++ b/WebCore/platform/network/qt/ResourceHandleQt.cpp
@@ -48,13 +48,9 @@
 #endif
 #include <QCoreApplication>
 #include <QUrl>
-#if QT_VERSION >= 0x040400
 #include <QNetworkAccessManager>
 #include <QNetworkRequest>
 #include <QNetworkReply>
-#else
-#include "qwebnetworkinterface_p.h"
-#endif
 
 namespace WebCore {
 
@@ -131,24 +127,25 @@ bool ResourceHandle::start(Frame* frame)
     if (!page)
         return false;
 
+    if (!(d->m_user.isEmpty() || d->m_pass.isEmpty())) {
+        // If credentials were specified for this request, add them to the url,
+        // so that they will be passed to QNetworkRequest.
+        KURL urlWithCredentials(d->m_request.url());
+        urlWithCredentials.setUser(d->m_user);
+        urlWithCredentials.setPass(d->m_pass);
+        d->m_request.setURL(urlWithCredentials);
+    }
+
     getInternal()->m_frame = static_cast<FrameLoaderClientQt*>(frame->loader()->client())->webFrame();
-#if QT_VERSION < 0x040400
-    return QWebNetworkManager::self()->add(this, getInternal()->m_frame->page()->d->networkInterface);
-#else
     ResourceHandleInternal *d = getInternal();
     d->m_job = new QNetworkReplyHandler(this, QNetworkReplyHandler::LoadMode(d->m_defersLoading));
     return true;
-#endif
 }
 
 void ResourceHandle::cancel()
 {
-#if QT_VERSION < 0x040400
-    QWebNetworkManager::self()->cancel(this);
-#else
     if (d->m_job)
         d->m_job->abort();
-#endif
 }
 
 bool ResourceHandle::loadsBlocked()
@@ -196,17 +193,17 @@ void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, S
     WebCoreSynchronousLoader syncLoader;
     ResourceHandle handle(request, &syncLoader, true, false, true);
 
-#if QT_VERSION < 0x040400
-    if (!QWebNetworkManager::self()->add(&handle, QWebNetworkInterface::defaultInterface(), QWebNetworkManager::SynchronousJob)) {
-        // FIXME Create a sane ResourceError
-        error = ResourceError(String(), -1, String(), String());
-        return;
-    }
-#else
     ResourceHandleInternal *d = handle.getInternal();
+    if (!(d->m_user.isEmpty() || d->m_pass.isEmpty())) {
+        // If credentials were specified for this request, add them to the url,
+        // so that they will be passed to QNetworkRequest.
+        KURL urlWithCredentials(d->m_request.url());
+        urlWithCredentials.setUser(d->m_user);
+        urlWithCredentials.setPass(d->m_pass);
+        d->m_request.setURL(urlWithCredentials);
+    }
     d->m_frame = static_cast<FrameLoaderClientQt*>(frame->loader()->client())->webFrame();
     d->m_job = new QNetworkReplyHandler(&handle, QNetworkReplyHandler::LoadNormal);
-#endif
 
     syncLoader.waitForCompletion();
     error = syncLoader.resourceError();
@@ -219,10 +216,8 @@ void ResourceHandle::setDefersLoading(bool defers)
 {
     d->m_defersLoading = defers;
 
-#if QT_VERSION >= 0x040400
     if (d->m_job)
         d->m_job->setLoadMode(QNetworkReplyHandler::LoadMode(defers));
-#endif
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/qt/ResourceRequest.h b/WebCore/platform/network/qt/ResourceRequest.h
index 93dacf3..fb69326 100644
--- a/WebCore/platform/network/qt/ResourceRequest.h
+++ b/WebCore/platform/network/qt/ResourceRequest.h
@@ -31,12 +31,13 @@
 
 QT_BEGIN_NAMESPACE
 class QNetworkRequest;
+class QObject;
 QT_END_NAMESPACE
 
 namespace WebCore {
 
-    struct ResourceRequest : ResourceRequestBase {
-
+    class ResourceRequest : public ResourceRequestBase {
+    public:
         ResourceRequest(const String& url) 
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
@@ -58,9 +59,7 @@ namespace WebCore {
         {
         }
 
-#if QT_VERSION >= 0x040400
-        QNetworkRequest toNetworkRequest() const;
-#endif
+        QNetworkRequest toNetworkRequest(QObject* originatingObject) const;
 
     private:
         friend class ResourceRequestBase;
diff --git a/WebCore/platform/network/qt/ResourceRequestQt.cpp b/WebCore/platform/network/qt/ResourceRequestQt.cpp
index c8f6ad5..752abfe 100644
--- a/WebCore/platform/network/qt/ResourceRequestQt.cpp
+++ b/WebCore/platform/network/qt/ResourceRequestQt.cpp
@@ -21,24 +21,31 @@
 #include "ResourceRequest.h"
 
 #include <qglobal.h>
-#if QT_VERSION >= 0x040400
 
 #include <QNetworkRequest>
 #include <QUrl>
 
 namespace WebCore {
 
-QNetworkRequest ResourceRequest::toNetworkRequest() const
+QNetworkRequest ResourceRequest::toNetworkRequest(QObject* originatingFrame) const
 {
     QNetworkRequest request;
     request.setUrl(url());
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    request.setOriginatingObject(originatingFrame);
+#endif
 
     const HTTPHeaderMap &headers = httpHeaderFields();
     for (HTTPHeaderMap::const_iterator it = headers.begin(), end = headers.end();
          it != end; ++it) {
         QByteArray name = QString(it->first).toAscii();
         QByteArray value = QString(it->second).toAscii();
-        request.setRawHeader(name, value);
+        // QNetworkRequest::setRawHeader() would remove the header if the value is null
+        // Make sure to set an empty header instead of null header.
+        if (!value.isNull())
+            request.setRawHeader(name, value);
+        else
+            request.setRawHeader(name, "");
     }
 
     switch (cachePolicy()) {
@@ -62,4 +69,3 @@ QNetworkRequest ResourceRequest::toNetworkRequest() const
 
 }
 
-#endif
diff --git a/WebCore/platform/network/soup/DNSSoup.cpp b/WebCore/platform/network/soup/DNSSoup.cpp
index 1ffe1a0..ce55143 100644
--- a/WebCore/platform/network/soup/DNSSoup.cpp
+++ b/WebCore/platform/network/soup/DNSSoup.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,13 +27,19 @@
 #include "config.h"
 #include "DNS.h"
 
-#include "NotImplemented.h"
+#include "CString.h"
+#include "ResourceHandle.h"
 
 namespace WebCore {
 
 void prefetchDNS(const String& hostname)
 {
-    notImplemented();
+    #ifdef HAVE_LIBSOUP_2_29_3
+    String uri = "http://"+hostname;
+    SoupURI* soupUri = soup_uri_new(uri.utf8().data());
+    soup_session_prepare_for_uri(ResourceHandle::defaultSession(), soupUri);
+    soup_uri_free(soupUri);
+    #endif
 }
 
 }
diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 2177bd2..6367a3e 100644
--- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -200,6 +200,13 @@ static void restartedCallback(SoupMessage* msg, gpointer data)
     request.setURL(newURL);
     request.setHTTPMethod(msg->method);
     fillResponseFromMessage(msg, &response);
+
+    // Should not set Referer after a redirect from a secure resource to non-secure one.
+    if (!request.url().protocolIs("https") && protocolIs(request.httpReferrer(), "https")) {
+        request.clearHTTPReferrer();
+        soup_message_headers_remove(msg->request_headers, "Referer");
+    }
+
     if (d->client())
         d->client()->willSendRequest(handle, request, response);
 }
@@ -686,6 +693,13 @@ static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
 
     g_input_stream_close_finish(d->m_inputStream, res, 0);
     cleanupGioOperation(handle.get());
+
+    // The load may have been cancelled, the client may have been
+    // destroyed already. In such cases calling didFinishLoading is a
+    // bad idea.
+    if (d->m_cancelled || !client)
+        return;
+
     client->didFinishLoading(handle.get());
 }
 
@@ -866,7 +880,7 @@ static bool startGio(ResourceHandle* handle, KURL url)
     // using GIO internally, and providing URIs instead of file paths
     url.removeFragmentIdentifier();
     url.setQuery(String());
-    url.setPort(0);
+    url.removePort();
 
 #if !PLATFORM(WIN_OS)
     // we avoid the escaping for local files, because
diff --git a/WebCore/platform/network/soup/ResourceRequest.h b/WebCore/platform/network/soup/ResourceRequest.h
index 42b7baa..8270863 100644
--- a/WebCore/platform/network/soup/ResourceRequest.h
+++ b/WebCore/platform/network/soup/ResourceRequest.h
@@ -33,8 +33,8 @@
 
 namespace WebCore {
 
-    struct ResourceRequest : ResourceRequestBase {
-
+    class ResourceRequest : public ResourceRequestBase {
+    public:
         ResourceRequest(const String& url)
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
@@ -66,7 +66,7 @@ namespace WebCore {
         void updateFromSoupMessage(SoupMessage* soupMessage);
 
     private:
-        friend struct ResourceRequestBase;
+        friend class ResourceRequestBase;
 
         void doUpdatePlatformRequest() {};
         void doUpdateResourceRequest() {};
diff --git a/WebCore/platform/network/soup/ResourceResponse.h b/WebCore/platform/network/soup/ResourceResponse.h
index 5fa31a0..ecd9f21 100644
--- a/WebCore/platform/network/soup/ResourceResponse.h
+++ b/WebCore/platform/network/soup/ResourceResponse.h
@@ -44,7 +44,14 @@ public:
     {
     }
 
+    ResourceResponse(SoupMessage* soupMessage)
+        : ResourceResponseBase()
+    {
+        updateFromSoupMessage(soupMessage);
+    }
+
     SoupMessage* toSoupMessage() const;
+    void updateFromSoupMessage(SoupMessage* soupMessage);
 
 private:
     friend class ResourceResponseBase;
diff --git a/WebCore/platform/network/soup/ResourceResponseSoup.cpp b/WebCore/platform/network/soup/ResourceResponseSoup.cpp
index 293577f..caf0b31 100644
--- a/WebCore/platform/network/soup/ResourceResponseSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceResponseSoup.cpp
@@ -22,6 +22,7 @@
 #include "ResourceResponse.h"
 
 #include "CString.h"
+#include "GOwnPtr.h"
 #include "PlatformString.h"
 
 using namespace std;
@@ -49,4 +50,21 @@ SoupMessage* ResourceResponse::toSoupMessage() const
     return soupMessage;
 }
 
+void ResourceResponse::updateFromSoupMessage(SoupMessage* soupMessage)
+{
+    SoupURI* soupURI = soup_message_get_uri(soupMessage);
+    GOwnPtr<gchar> uri(soup_uri_to_string(soupURI, FALSE));
+    m_url = KURL(KURL(), String::fromUTF8(uri.get()));
+
+    m_httpStatusCode = soupMessage->status_code;
+
+    SoupMessageHeadersIter headersIter;
+    const char* headerName;
+    const char* headerValue;
+
+    soup_message_headers_iter_init(&headersIter, soupMessage->response_headers);
+    while (soup_message_headers_iter_next(&headersIter, &headerName, &headerValue))
+        m_httpHeaderFields.set(String::fromUTF8(headerName), String::fromUTF8(headerValue));
+}
+
 }
diff --git a/WebCore/platform/qt/ClipboardQt.cpp b/WebCore/platform/qt/ClipboardQt.cpp
index 9d2c452..f9940a6 100644
--- a/WebCore/platform/qt/ClipboardQt.cpp
+++ b/WebCore/platform/qt/ClipboardQt.cpp
@@ -95,21 +95,7 @@ void ClipboardQt::clearData(const String& type)
         return;
 
     if (m_writableData) {
-#if QT_VERSION >= 0x040400
         m_writableData->removeFormat(type);
-#else
-        const QString toClearType = type;
-        QMap<QString, QByteArray> formats;
-        foreach (QString format, m_writableData->formats()) {
-            if (format != toClearType)
-                formats[format] = m_writableData->data(format);
-        }
-
-        m_writableData->clear();
-        QMap<QString, QByteArray>::const_iterator it, end = formats.constEnd();
-        for (it = formats.begin(); it != end; ++it)
-            m_writableData->setData(it.key(), it.value());
-#endif
         if (m_writableData->formats().isEmpty()) {
             if (isForDragging())
                 delete m_writableData;
diff --git a/WebCore/platform/qt/CookieJarQt.cpp b/WebCore/platform/qt/CookieJarQt.cpp
index a27a06e..b621e7e 100644
--- a/WebCore/platform/qt/CookieJarQt.cpp
+++ b/WebCore/platform/qt/CookieJarQt.cpp
@@ -33,19 +33,14 @@
 #include "KURL.h"
 #include "PlatformString.h"
 
-#if QT_VERSION >= 0x040400
 #include "qwebpage.h"
 #include "qwebframe.h"
 #include "FrameLoaderClientQt.h"
 #include <QNetworkAccessManager>
 #include <QNetworkCookie>
-#else
-#include <qcookiejar.h>
-#endif
 
 namespace WebCore {
 
-#if QT_VERSION >= 0x040400
 static QNetworkCookieJar *cookieJar(const Document *document)
 {
     if (!document)
@@ -62,13 +57,11 @@ static QNetworkCookieJar *cookieJar(const Document *document)
     QNetworkCookieJar* jar = manager->cookieJar();
     return jar;
 }
-#endif
 
 void setCookies(Document* document, const KURL& url, const String& value)
 {
     QUrl u(url);
     QUrl p(document->firstPartyForCookies());
-#if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     if (!jar)
         return;
@@ -84,15 +77,11 @@ void setCookies(Document* document, const KURL& url, const String& value)
     }
 #endif
     jar->setCookiesFromUrl(cookies, u);
-#else
-    QCookieJar::cookieJar()->setCookies(u, p, (QString)value);
-#endif
 }
 
 String cookies(const Document* document, const KURL& url)
 {
     QUrl u(url);
-#if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     if (!jar)
         return String();
@@ -112,23 +101,12 @@ String cookies(const Document* document, const KURL& url)
     }
 
     return resultCookies.join(QLatin1String("; "));
-#else
-    QString cookies = QCookieJar::cookieJar()->cookies(u);
-    int idx = cookies.indexOf(QLatin1Char(';'));
-    if (idx > 0)
-        cookies = cookies.left(idx);
-    return cookies;
-#endif
 }
 
 bool cookiesEnabled(const Document* document)
 {
-#if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     return (jar != 0);
-#else
-    return QCookieJar::cookieJar()->isEnabled();
-#endif
 }
 
 bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
diff --git a/WebCore/platform/qt/CursorQt.cpp b/WebCore/platform/qt/CursorQt.cpp
index 3fc83f9..87f4fce 100644
--- a/WebCore/platform/qt/CursorQt.cpp
+++ b/WebCore/platform/qt/CursorQt.cpp
@@ -73,7 +73,7 @@ Cursor& Cursor::operator=(const Cursor& other)
 namespace {
 
 // FIXME: static deleter
-class Cursors {
+class Cursors : public Noncopyable {
 protected:
     Cursors()
 #ifndef QT_NO_CURSOR
diff --git a/WebCore/platform/qt/Localizations.cpp b/WebCore/platform/qt/Localizations.cpp
index ca3ca9d..1768502 100644
--- a/WebCore/platform/qt/Localizations.cpp
+++ b/WebCore/platform/qt/Localizations.cpp
@@ -30,6 +30,7 @@
 
 #include "IntSize.h"
 #include "LocalizedStrings.h"
+#include "NotImplemented.h"
 #include "PlatformString.h"
 
 #include <QCoreApplication>
@@ -470,5 +471,47 @@ String localizedMediaTimeDescription(float time)
 }
 #endif  // ENABLE(VIDEO)
 
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
 }
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 37ea681..f78c7d7 100644
--- a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -52,10 +52,8 @@ static String keyIdentifierForQtKeyCode(int keyCode)
         case Qt::Key_Return:
         case Qt::Key_Enter:
             return "Enter";
-#if QT_VERSION >= 0x040200
         case Qt::Key_Execute:
             return "Execute";
-#endif
         case Qt::Key_F1:
             return "F1";
         case Qt::Key_F2:
@@ -290,10 +288,8 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad = false
             return VK_SELECT; // (29) SELECT key
         case Qt::Key_Print:
             return VK_PRINT; // (2A) PRINT key
-#if QT_VERSION >= 0x040200
         case Qt::Key_Execute:
             return VK_EXECUTE;// (2B) EXECUTE key
-#endif
             //dunno on this
             //case Qt::Key_PrintScreen:
             //      return VK_SNAPSHOT; // (2C) PRINT SCREEN key
diff --git a/WebCore/platform/qt/QWebPageClient.h b/WebCore/platform/qt/QWebPageClient.h
index 28ef724..b510736 100644
--- a/WebCore/platform/qt/QWebPageClient.h
+++ b/WebCore/platform/qt/QWebPageClient.h
@@ -26,13 +26,19 @@
 #ifndef QWebPageClient_h
 #define QWebPageClient_h
 
+#ifndef QT_NO_CURSOR
+#include <QCursor>
+#endif
 #include <QRect>
 
 class QWebPageClient {
 public:
+    virtual ~QWebPageClient() { }
+        
     virtual void scroll(int dx, int dy, const QRect&) = 0;
     virtual void update(const QRect&) = 0;
     virtual void setInputMethodEnabled(bool enable) = 0;
+    virtual bool inputMethodEnabled() const = 0;
 #if QT_VERSION >= 0x040600
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable) = 0;
 #endif
diff --git a/WebCore/platform/qt/RenderThemeQt.cpp b/WebCore/platform/qt/RenderThemeQt.cpp
index b61d356..501a28b 100644
--- a/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/WebCore/platform/qt/RenderThemeQt.cpp
@@ -45,6 +45,7 @@
 #include "RenderBox.h"
 #include "RenderTheme.h"
 #include "UserAgentStyleSheets.h"
+#include "QWebPageClient.h"
 #include "qwebpage.h"
 
 #include <QApplication>
@@ -757,12 +758,13 @@ ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) con
     if (result == RadioPart || result == CheckboxPart)
         option.state |= (isChecked(o) ? QStyle::State_On : QStyle::State_Off);
 
-    // If the webview has a custom palette, use it
+    // If the owner widget has a custom palette, use it
     Page* page = o->document()->page();
     if (page) {
-        QWidget* view = static_cast<ChromeClientQt*>(page->chrome()->client())->m_webPage->view();
-        if (view)
-            option.palette = view->palette();
+        ChromeClient* client = page->chrome()->client();
+        QWebPageClient* pageClient = client->platformPageClient();
+        if (pageClient)
+            option.palette = pageClient->palette();
     }
 
     return result;
diff --git a/WebCore/platform/qt/WheelEventQt.cpp b/WebCore/platform/qt/WheelEventQt.cpp
index 9cc27ab..162a4f2 100644
--- a/WebCore/platform/qt/WheelEventQt.cpp
+++ b/WebCore/platform/qt/WheelEventQt.cpp
@@ -45,8 +45,10 @@ void PlatformWheelEvent::applyDelta(int delta, Qt::Orientation orientation)
     // Use the same single scroll step as QTextEdit
     // (in QTextEditPrivate::init [h,v]bar->setSingleStep)
     static const float cDefaultQtScrollStep = 20.f;
+#ifndef QT_NO_WHEELEVENT
     m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
     m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+#endif
 }
 
 PlatformWheelEvent::PlatformWheelEvent(QGraphicsSceneWheelEvent* e)
diff --git a/WebCore/platform/qt/WidgetQt.cpp b/WebCore/platform/qt/WidgetQt.cpp
index e9c99a4..252bdb4 100644
--- a/WebCore/platform/qt/WidgetQt.cpp
+++ b/WebCore/platform/qt/WidgetQt.cpp
@@ -91,13 +91,17 @@ void Widget::setCursor(const Cursor& cursor)
 
 void Widget::show()
 {
-    if (platformWidget())
+    setSelfVisible(true);
+
+    if (isParentVisible() && platformWidget())
         platformWidget()->show();
 }
 
 void Widget::hide()
 {
-    if (platformWidget())
+    setSelfVisible(false);
+
+    if (isParentVisible() && platformWidget())
         platformWidget()->hide();
 }
 
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
index 3cf961f..752c613 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
@@ -58,7 +58,8 @@ int SQLiteFileSystem::openDatabase(const String& fileName, sqlite3** database)
     // open databases using the default VFS
     // in renderers, it should be Chromium's VFS; in the browser process it should be SQLite's default VFS
     return sqlite3_open_v2(fileName.utf8().data(), database,
-                           SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX, 0);
+                           SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX,
+                           "chromium_vfs");
 }
 
 String SQLiteFileSystem::getFileNameForNewDatabase(
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
index 2960a5f..0050a43 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
@@ -42,8 +42,11 @@ using namespace WebCore;
 
 // Defined in Chromium's codebase in third_party/sqlite/src/os_unix.c
 extern "C" {
-void initUnixFile(sqlite3_file* file);
-int fillInUnixFile(sqlite3_vfs* vfs, int fd, int dirfd, sqlite3_file* file, const char* fileName, int noLock);
+void chromium_sqlite3_initialize_unix_sqlite3_file(sqlite3_file* file);
+int chromium_sqlite3_fill_in_unix_sqlite3_file(sqlite3_vfs* vfs, int fd, int dirfd, sqlite3_file* file, const char* fileName, int noLock);
+int chromium_sqlite3_get_reusable_file_handle(sqlite3_file* file, const char* fileName, int flags, int* fd);
+void chromium_sqlite3_update_reusable_file_handle(sqlite3_file* file, int fd, int flags);
+void chromium_sqlite3_destroy_reusable_file_handle(sqlite3_file* file);
 }
 
 // Chromium's Posix implementation of SQLite VFS
@@ -59,18 +62,28 @@ namespace {
 int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
                  sqlite3_file* id, int desiredFlags, int* usedFlags)
 {
-    initUnixFile(id);
+    chromium_sqlite3_initialize_unix_sqlite3_file(id);
+    int fd = -1;
     int dirfd = -1;
-    int fd = ChromiumBridge::databaseOpenFile(fileName, desiredFlags, &dirfd);
+    int result = chromium_sqlite3_get_reusable_file_handle(id, fileName, desiredFlags, &fd);
+    if (result != SQLITE_OK)
+        return result;
+
     if (fd < 0) {
-        if (desiredFlags & SQLITE_OPEN_READWRITE) {
+        fd = ChromiumBridge::databaseOpenFile(fileName, desiredFlags, &dirfd);
+        if ((fd < 0) && (desiredFlags & SQLITE_OPEN_READWRITE)) {
             int newFlags = (desiredFlags & ~(SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE)) | SQLITE_OPEN_READONLY;
-            return chromiumOpen(vfs, fileName, id, newFlags, usedFlags);
-        } else
-            return SQLITE_CANTOPEN;
+            fd = ChromiumBridge::databaseOpenFile(fileName, newFlags, &dirfd);
+        }
+    }
+    if (fd < 0) {
+        chromium_sqlite3_destroy_reusable_file_handle(id);
+        return SQLITE_CANTOPEN;
     }
+
     if (usedFlags)
         *usedFlags = desiredFlags;
+    chromium_sqlite3_update_reusable_file_handle(id, fd, desiredFlags);
 
     fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
     if (dirfd >= 0)
@@ -79,7 +92,10 @@ int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
     // The mask 0x00007F00 gives us the 7 bits that determine the type of the file SQLite is trying to open.
     int fileType = desiredFlags & 0x00007F00;
     int noLock = (fileType != SQLITE_OPEN_MAIN_DB);
-    return fillInUnixFile(vfs, fd, dirfd, id, fileName, noLock);
+    result = chromium_sqlite3_fill_in_unix_sqlite3_file(vfs, fd, dirfd, id, fileName, noLock);
+    if (result != SQLITE_OK)
+        chromium_sqlite3_destroy_reusable_file_handle(id);
+    return result;
 }
 
 // Deletes the given file.
@@ -184,7 +200,7 @@ void SQLiteFileSystem::registerSQLiteVFS()
         unix_vfs->xCurrentTime,
         unix_vfs->xGetLastError
     };
-    sqlite3_vfs_register(&chromium_vfs, 1);
+    sqlite3_vfs_register(&chromium_vfs, 0);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
index 153793b..7b57db1 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
@@ -169,7 +169,7 @@ void SQLiteFileSystem::registerSQLiteVFS()
         win32_vfs->xCurrentTime,
         win32_vfs->xGetLastError
     };
-    sqlite3_vfs_register(&chromium_vfs, 1);
+    sqlite3_vfs_register(&chromium_vfs, 0);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/text/AtomicString.h b/WebCore/platform/text/AtomicString.h
index 8805f4c..47d07c5 100644
--- a/WebCore/platform/text/AtomicString.h
+++ b/WebCore/platform/text/AtomicString.h
@@ -24,6 +24,14 @@
 #include "AtomicStringImpl.h"
 #include "PlatformString.h"
 
+// Define 'NO_IMPLICIT_ATOMICSTRING' before including this header,
+// to disallow (expensive) implicit String-->AtomicString conversions.
+#ifdef NO_IMPLICIT_ATOMICSTRING
+#define ATOMICSTRING_CONVERSION explicit
+#else
+#define ATOMICSTRING_CONVERSION
+#endif
+
 namespace WebCore {
 
 struct AtomicStringHash;
@@ -40,9 +48,9 @@ public:
     AtomicString(const JSC::UString& s) : m_string(add(s)) { }
     AtomicString(const JSC::Identifier& s) : m_string(add(s)) { }
 #endif
-    AtomicString(StringImpl* imp) : m_string(add(imp)) { }
+    ATOMICSTRING_CONVERSION AtomicString(StringImpl* imp) : m_string(add(imp)) { }
     AtomicString(AtomicStringImpl* imp) : m_string(imp) { }
-    AtomicString(const String& s) : m_string(add(s.impl())) { }
+    ATOMICSTRING_CONVERSION AtomicString(const String& s) : m_string(add(s.impl())) { }
 
     // Hash table deleted values, which are only constructed and never copied or destroyed.
     AtomicString(WTF::HashTableDeletedValueType) : m_string(WTF::HashTableDeletedValue) { }
@@ -96,7 +104,7 @@ public:
 
     static void remove(StringImpl*);
     
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
     AtomicString(CFStringRef s) :  m_string(add(String(s).impl())) { }
     CFStringRef createCFString() const { return m_string.createCFString(); }
 #endif    
diff --git a/WebCore/platform/text/AtomicStringImpl.h b/WebCore/platform/text/AtomicStringImpl.h
index d905afc..ba1c72c 100644
--- a/WebCore/platform/text/AtomicStringImpl.h
+++ b/WebCore/platform/text/AtomicStringImpl.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/platform/text/BidiContext.cpp b/WebCore/platform/text/BidiContext.cpp
index 546571e..59db7bd 100644
--- a/WebCore/platform/text/BidiContext.cpp
+++ b/WebCore/platform/text/BidiContext.cpp
@@ -30,7 +30,7 @@ using namespace WTF::Unicode;
 
 PassRefPtr<BidiContext> BidiContext::create(unsigned char level, Direction direction, bool override, BidiContext* parent)
 {
-    ASSERT(direction == level % 2 ? RightToLeft : LeftToRight);
+    ASSERT(direction == (level % 2 ? RightToLeft : LeftToRight));
 
     if (parent)
         return adoptRef(new BidiContext(level, direction, override, parent));
diff --git a/WebCore/platform/text/PlatformString.h b/WebCore/platform/text/PlatformString.h
index 8d19c17..247536a 100644
--- a/WebCore/platform/text/PlatformString.h
+++ b/WebCore/platform/text/PlatformString.h
@@ -41,7 +41,7 @@
 #include <wtf/OwnPtr.h>
 #endif
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 typedef const struct __CFString * CFStringRef;
 #endif
 
@@ -206,7 +206,7 @@ public:
 
     StringImpl* impl() const { return m_impl.get(); }
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
     String(CFStringRef);
     CFStringRef createCFString() const;
 #endif
@@ -286,6 +286,11 @@ inline bool equalIgnoringCase(const String& a, const String& b) { return equalIg
 inline bool equalIgnoringCase(const String& a, const char* b) { return equalIgnoringCase(a.impl(), b); }
 inline bool equalIgnoringCase(const char* a, const String& b) { return equalIgnoringCase(a, b.impl()); }
 
+inline bool equalPossiblyIgnoringCase(const String& a, const String& b, bool ignoreCase) 
+{
+    return ignoreCase ? equalIgnoringCase(a, b) : (a == b);
+}
+
 inline bool equalIgnoringNullity(const String& a, const String& b) { return equalIgnoringNullity(a.impl(), b.impl()); }
 
 inline bool operator!(const String& str) { return str.isNull(); }
diff --git a/WebCore/platform/text/RegularExpression.h b/WebCore/platform/text/RegularExpression.h
index 3254067..f1611e5 100644
--- a/WebCore/platform/text/RegularExpression.h
+++ b/WebCore/platform/text/RegularExpression.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class RegularExpression {
+class RegularExpression : public FastAllocBase {
 public:
     RegularExpression(const String&, TextCaseSensitivity);
     ~RegularExpression();
diff --git a/WebCore/platform/text/String.cpp b/WebCore/platform/text/String.cpp
index 44582a9..24659a4 100644
--- a/WebCore/platform/text/String.cpp
+++ b/WebCore/platform/text/String.cpp
@@ -81,6 +81,9 @@ String::String(const char* str, unsigned length)
 
 void String::append(const String& str)
 {
+    if (str.isEmpty())
+       return;
+
     // FIXME: This is extremely inefficient. So much so that we might want to take this
     // out of String's API. We can make it better by optimizing the case where exactly
     // one String is pointing at this StringImpl, but even then it's going to require a
diff --git a/WebCore/platform/text/StringHash.h b/WebCore/platform/text/StringHash.h
index fc6cb3c..21a478e 100644
--- a/WebCore/platform/text/StringHash.h
+++ b/WebCore/platform/text/StringHash.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,6 +30,10 @@
 
 namespace WebCore {
 
+    // The hash() functions on StringHash and CaseFoldingHash do not support
+    // null strings. get(), contains(), and add() on HashMap<String,..., StringHash>
+    // cause a null-pointer dereference when passed null strings.
+
     // FIXME: We should really figure out a way to put the computeHash function that's
     // currently a member function of StringImpl into this file so we can be a little
     // closer to having all the nearly-identical hash functions in one place.
diff --git a/WebCore/platform/text/StringImpl.h b/WebCore/platform/text/StringImpl.h
index dac25b2..5155fa5 100644
--- a/WebCore/platform/text/StringImpl.h
+++ b/WebCore/platform/text/StringImpl.h
@@ -37,7 +37,7 @@
 #include <runtime/UString.h>
 #endif
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 typedef const struct __CFString * CFStringRef;
 #endif
 
@@ -168,7 +168,7 @@ public:
 
     WTF::Unicode::Direction defaultWritingDirection();
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
     CFStringRef createCFString();
 #endif
 #ifdef __OBJC__
diff --git a/WebCore/platform/text/TextBoundariesICU.cpp b/WebCore/platform/text/TextBoundaries.cpp
index b1e8ee2..2455f6d 100644
--- a/WebCore/platform/text/TextBoundariesICU.cpp
+++ b/WebCore/platform/text/TextBoundaries.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Dominik Röttsches <dominik.roettsches@access-company.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,39 +27,40 @@
 #include "config.h"
 #include "TextBoundaries.h"
 
-#include <unicode/ubrk.h>
-#include <unicode/uchar.h>
-
 #include "StringImpl.h"
 #include "TextBreakIterator.h"
+#include <wtf/unicode/Unicode.h>
+
+using namespace WTF;
+using namespace Unicode;
 
 namespace WebCore {
 
 int findNextWordFromIndex(const UChar* chars, int len, int position, bool forward)
 {
-    UBreakIterator* it = wordBreakIterator(chars, len);
+    TextBreakIterator* it = wordBreakIterator(chars, len);
 
     if (forward) {
-        position = ubrk_following(it, position);
-        while (position != UBRK_DONE) {
+        position = textBreakFollowing(it, position);
+        while (position != TextBreakDone) {
             // We stop searching when the character preceeding the break
             // is alphanumeric.
-            if (position < len && u_isalnum(chars[position - 1]))
+            if (position < len && isAlphanumeric(chars[position - 1]))
                 return position;
 
-            position = ubrk_following(it, position);
+            position = textBreakFollowing(it, position);
         }
 
         return len;
     } else {
-        position = ubrk_preceding(it, position);
-        while (position != UBRK_DONE) {
+        position = textBreakPreceding(it, position);
+        while (position != TextBreakDone) {
             // We stop searching when the character following the break
             // is alphanumeric.
-            if (position > 0 && u_isalnum(chars[position]))
+            if (position > 0 && isAlphanumeric(chars[position]))
                 return position;
 
-            position = ubrk_preceding(it, position);
+            position = textBreakPreceding(it, position);
         }
 
         return 0;
@@ -67,11 +69,11 @@ int findNextWordFromIndex(const UChar* chars, int len, int position, bool forwar
 
 void findWordBoundary(const UChar* chars, int len, int position, int* start, int* end)
 {
-    UBreakIterator* it = wordBreakIterator(chars, len);
-    *end = ubrk_following(it, position);
+    TextBreakIterator* it = wordBreakIterator(chars, len);
+    *end = textBreakFollowing(it, position);
     if (*end < 0)
-        *end = ubrk_last(it);
-    *start = ubrk_previous(it);
+        *end = textBreakLast(it);
+    *start = textBreakPrevious(it);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/text/TextBreakIterator.h b/WebCore/platform/text/TextBreakIterator.h
index 7b3b963..17cf5f0 100644
--- a/WebCore/platform/text/TextBreakIterator.h
+++ b/WebCore/platform/text/TextBreakIterator.h
@@ -47,7 +47,9 @@ namespace WebCore {
     TextBreakIterator* sentenceBreakIterator(const UChar*, int length);
 
     int textBreakFirst(TextBreakIterator*);
+    int textBreakLast(TextBreakIterator*);
     int textBreakNext(TextBreakIterator*);
+    int textBreakPrevious(TextBreakIterator*);
     int textBreakCurrent(TextBreakIterator*);
     int textBreakPreceding(TextBreakIterator*, int);
     int textBreakFollowing(TextBreakIterator*, int);
diff --git a/WebCore/platform/text/TextBreakIteratorICU.cpp b/WebCore/platform/text/TextBreakIteratorICU.cpp
index c922fbc..44423c0 100644
--- a/WebCore/platform/text/TextBreakIteratorICU.cpp
+++ b/WebCore/platform/text/TextBreakIteratorICU.cpp
@@ -90,11 +90,21 @@ int textBreakFirst(TextBreakIterator* bi)
     return ubrk_first(bi);
 }
 
+int textBreakLast(TextBreakIterator* bi)
+{
+    return ubrk_last(bi);
+}
+
 int textBreakNext(TextBreakIterator* bi)
 {
     return ubrk_next(bi);
 }
 
+int textBreakPrevious(TextBreakIterator* bi)
+{
+    return ubrk_previous(bi);
+}
+
 int textBreakPreceding(TextBreakIterator* bi, int pos)
 {
     return ubrk_preceding(bi, pos);
diff --git a/WebCore/platform/text/TextEncoding.cpp b/WebCore/platform/text/TextEncoding.cpp
index c5c8cfd..ec9a8b0 100644
--- a/WebCore/platform/text/TextEncoding.cpp
+++ b/WebCore/platform/text/TextEncoding.cpp
@@ -32,10 +32,13 @@
 #include "PlatformString.h"
 #include "TextCodec.h"
 #include "TextEncodingRegistry.h"
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
 #include <unicode/unorm.h>
 #elif USE(QT4_UNICODE)
 #include <QString>
+#elif USE(GLIB_UNICODE)
+#include <glib.h>
+#include <wtf/gtk/GOwnPtr.h>
 #endif
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
@@ -84,7 +87,7 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     if (!length)
         return "";
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     // FIXME: What's the right place to do normalization?
     // It's a little strange to do it inside the encode function.
     // Perhaps normalization should be an explicit step done before calling encode.
@@ -114,6 +117,18 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     QString str(reinterpret_cast<const QChar*>(characters), length);
     str = str.normalized(QString::NormalizationForm_C);
     return newTextCodec(*this)->encode(reinterpret_cast<const UChar *>(str.utf16()), str.length(), handling);
+#elif USE(GLIB_UNICODE)
+    GOwnPtr<char> UTF8Source;
+    UTF8Source.set(g_utf16_to_utf8(characters, length, 0, 0, 0));
+
+    GOwnPtr<char> UTF8Normalized;
+    UTF8Normalized.set(g_utf8_normalize(UTF8Source.get(), -1, G_NORMALIZE_NFC));
+
+    long UTF16Length;
+    GOwnPtr<UChar> UTF16Normalized;
+    UTF16Normalized.set(g_utf8_to_utf16(UTF8Normalized.get(), -1, 0, &UTF16Length, 0));
+
+    return newTextCodec(*this)->encode(UTF16Normalized.get(), UTF16Length, handling);
 #elif PLATFORM(WINCE)
     // normalization will be done by Windows CE API
     OwnPtr<TextCodec> textCodec = newTextCodec(*this);
diff --git a/WebCore/platform/text/TextEncodingRegistry.cpp b/WebCore/platform/text/TextEncodingRegistry.cpp
index d3e2965..a4be520 100644
--- a/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -39,7 +39,7 @@
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
 #include "TextCodecICU.h"
 #endif
 #if PLATFORM(MAC)
@@ -48,6 +48,9 @@
 #if PLATFORM(QT)
 #include "qt/TextCodecQt.h"
 #endif
+#if USE(GLIB_UNICODE)
+#include "gtk/TextCodecGtk.h"
+#endif
 #if PLATFORM(WINCE) && !PLATFORM(QT)
 #include "TextCodecWince.h"
 #endif
@@ -217,11 +220,16 @@ static void buildBaseTextCodecMaps()
     TextCodecUserDefined::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecUserDefined::registerCodecs(addToTextCodecMap);
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     TextCodecICU::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerBaseCodecs(addToTextCodecMap);
 #endif
 
+#if USE(GLIB_UNICODE)
+    TextCodecGtk::registerBaseEncodingNames(addToTextEncodingNameMap);
+    TextCodecGtk::registerBaseCodecs(addToTextCodecMap);
+#endif
+
 #if PLATFORM(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerBaseCodecs(addToTextCodecMap);
@@ -230,7 +238,7 @@ static void buildBaseTextCodecMaps()
 
 static void extendTextCodecMaps()
 {
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     TextCodecICU::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerExtendedCodecs(addToTextCodecMap);
 #endif
@@ -245,6 +253,11 @@ static void extendTextCodecMaps()
     TextCodecMac::registerCodecs(addToTextCodecMap);
 #endif
 
+#if USE(GLIB_UNICODE)
+    TextCodecGtk::registerExtendedEncodingNames(addToTextEncodingNameMap);
+    TextCodecGtk::registerExtendedCodecs(addToTextCodecMap);
+#endif
+
 #if PLATFORM(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerExtendedCodecs(addToTextCodecMap);
diff --git a/WebCore/platform/text/cf/StringCF.cpp b/WebCore/platform/text/cf/StringCF.cpp
index b770d0e..97691e5 100644
--- a/WebCore/platform/text/cf/StringCF.cpp
+++ b/WebCore/platform/text/cf/StringCF.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "PlatformString.h"
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 
 #include <CoreFoundation/CoreFoundation.h>
 
@@ -52,4 +52,4 @@ CFStringRef String::createCFString() const
 
 }
 
-#endif // PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#endif // PLATFORM(CF)
diff --git a/WebCore/platform/text/cf/StringImplCF.cpp b/WebCore/platform/text/cf/StringImplCF.cpp
index 8a2ae79..aff45b3 100644
--- a/WebCore/platform/text/cf/StringImplCF.cpp
+++ b/WebCore/platform/text/cf/StringImplCF.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "StringImpl.h"
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 
 #include <CoreFoundation/CoreFoundation.h>
 #include <wtf/MainThread.h>
@@ -159,4 +159,4 @@ CFStringRef StringImpl::createCFString()
 
 }
 
-#endif // PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#endif // PLATFORM(CF)
diff --git a/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp b/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
new file mode 100644
index 0000000..7a10b41
--- /dev/null
+++ b/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
@@ -0,0 +1,217 @@
+/*
+ * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ * Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "TextBreakIterator.h"
+
+#include <pango/pango.h>
+#include <wtf/gtk/GOwnPtr.h>
+
+namespace WebCore {
+
+enum UBreakIteratorType {
+    UBRK_CHARACTER,
+    UBRK_WORD,
+    UBRK_LINE,
+    UBRK_SENTENCE
+};
+
+class TextBreakIterator {
+public:
+    UBreakIteratorType m_type;
+    int m_length;
+    PangoLogAttr* m_logAttrs;
+    int m_index;
+};
+
+static TextBreakIterator* setUpIterator(bool& createdIterator, TextBreakIterator*& iterator,
+    UBreakIteratorType type, const UChar* string, int length)
+{
+    if (!string)
+        return 0;
+
+    if (!createdIterator) {
+        iterator = new TextBreakIterator();
+        createdIterator = true;
+    }
+    if (!iterator)
+        return 0;
+
+    long utf8len;
+    GOwnPtr<char> utf8;
+    utf8.set(g_utf16_to_utf8(string, length, 0, &utf8len, 0));
+
+    // FIXME: assumes no surrogate pairs
+
+    iterator->m_type = type;
+    iterator->m_length = length;
+    if (createdIterator)
+        g_free(iterator->m_logAttrs);
+    iterator->m_logAttrs = g_new0(PangoLogAttr, length + 1);
+    iterator->m_index = -1;
+    pango_get_log_attrs(utf8.get(), utf8len, -1, 0, iterator->m_logAttrs, length + 1);
+
+    return iterator;
+}
+
+TextBreakIterator* characterBreakIterator(const UChar* string, int length)
+{
+    static bool createdCharacterBreakIterator = false;
+    static TextBreakIterator* staticCharacterBreakIterator;
+    return setUpIterator(createdCharacterBreakIterator, staticCharacterBreakIterator, UBRK_CHARACTER, string, length);
+}
+
+TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
+{
+    // FIXME: This needs closer inspection to achieve behaviour identical to the ICU version.
+    return characterBreakIterator(string, length);
+}
+
+TextBreakIterator* wordBreakIterator(const UChar* string, int length)
+{
+    static bool createdWordBreakIterator = false;
+    static TextBreakIterator* staticWordBreakIterator;
+    return setUpIterator(createdWordBreakIterator, staticWordBreakIterator, UBRK_WORD, string, length);
+}
+
+TextBreakIterator* lineBreakIterator(const UChar* string, int length)
+{
+    static bool createdLineBreakIterator = false;
+    static TextBreakIterator* staticLineBreakIterator;
+    return setUpIterator(createdLineBreakIterator, staticLineBreakIterator, UBRK_LINE, string, length);
+}
+
+TextBreakIterator* sentenceBreakIterator(const UChar* string, int length)
+{
+    static bool createdSentenceBreakIterator = false;
+    static TextBreakIterator* staticSentenceBreakIterator;
+    return setUpIterator(createdSentenceBreakIterator, staticSentenceBreakIterator, UBRK_SENTENCE, string, length);
+}
+
+int textBreakFirst(TextBreakIterator* bi)
+{
+    // see textBreakLast
+    
+    int firstCursorPosition = -1;
+    int pos = 0;
+    while (pos <= bi->m_length && (firstCursorPosition < 0)) {
+        if (bi->m_logAttrs[pos].is_cursor_position)
+            firstCursorPosition = pos;
+    }
+    bi->m_index = firstCursorPosition;
+    return firstCursorPosition;
+}
+
+int textBreakLast(TextBreakIterator* bi)
+{
+    // TextBreakLast is not meant to find just any break according to bi->m_type 
+    // but really the one near the last character.
+    // (cmp ICU documentation for ubrk_first and ubrk_last)
+    // From ICU docs for ubrk_last:
+    // "Determine the index immediately beyond the last character in the text being scanned." 
+
+    // So we should advance or traverse back based on bi->m_logAttrs cursor positions.
+    // If last character position in the original string is a whitespace,
+    // traverse to the left until the first non-white character position is found
+    // and return the position of the first white-space char after this one.
+    // Otherwise return m_length, as "the first character beyond the last" is outside our string.
+    
+    bool whiteSpaceAtTheEnd = true;
+    int nextWhiteSpacePos = bi->m_length;
+    
+    int pos = bi->m_length;
+    while (pos >= 0 && whiteSpaceAtTheEnd) {
+        if (bi->m_logAttrs[pos].is_cursor_position) {
+            if (whiteSpaceAtTheEnd = bi->m_logAttrs[pos].is_white)
+                nextWhiteSpacePos = pos;
+        }
+        pos--;
+    }
+    bi->m_index = nextWhiteSpacePos;
+    return nextWhiteSpacePos;
+}
+
+int textBreakNext(TextBreakIterator* bi)
+{
+    for (int i = bi->m_index + 1; i <= bi->m_length; i++) {
+
+        // FIXME: UBRK_WORD case: Single multibyte characters (i.e. white space around them), such as the euro symbol €, 
+        // are not marked as word_start & word_end as opposed to the way ICU does it.
+        // This leads to - for example - different word selection behaviour when right clicking.
+
+        if ((bi->m_type == UBRK_LINE && bi->m_logAttrs[i].is_line_break)
+            || (bi->m_type == UBRK_WORD && (bi->m_logAttrs[i].is_word_start || bi->m_logAttrs[i].is_word_end))
+            || (bi->m_type == UBRK_CHARACTER && bi->m_logAttrs[i].is_cursor_position)
+            || (bi->m_type == UBRK_SENTENCE && (bi->m_logAttrs[i].is_sentence_start || bi->m_logAttrs[i].is_sentence_end)) ) {
+            bi->m_index = i;
+            return i;
+        }
+    }
+    return TextBreakDone;
+}
+
+int textBreakPrevious(TextBreakIterator* bi)
+{
+    for (int i = bi->m_index - 1; i >= 0; i--) {
+        if ((bi->m_type == UBRK_LINE && bi->m_logAttrs[i].is_line_break)
+            || (bi->m_type == UBRK_WORD && (bi->m_logAttrs[i].is_word_start || bi->m_logAttrs[i].is_word_end))
+            || (bi->m_type == UBRK_CHARACTER && bi->m_logAttrs[i].is_cursor_position)
+            || (bi->m_type == UBRK_SENTENCE && (bi->m_logAttrs[i].is_sentence_start || bi->m_logAttrs[i].is_sentence_end)) ) {
+            bi->m_index = i;
+            return i;
+        }
+    }
+    return textBreakFirst(bi);
+}
+
+int textBreakPreceding(TextBreakIterator* bi, int pos)
+{
+    bi->m_index = pos;
+    return textBreakPrevious(bi);
+}
+
+int textBreakFollowing(TextBreakIterator* bi, int pos)
+{
+    if (pos < 0)
+        pos = -1;
+    bi->m_index = pos;
+    return textBreakNext(bi);
+}
+
+int textBreakCurrent(TextBreakIterator* bi)
+{
+    return bi->m_index;
+}
+
+bool isTextBreak(TextBreakIterator* bi, int pos)
+{
+    if (bi->m_index < 0)
+        return false;
+
+    return ((bi->m_type == UBRK_LINE && bi->m_logAttrs[bi->m_index].is_line_break)
+        || (bi->m_type == UBRK_WORD && bi->m_logAttrs[bi->m_index].is_word_end)
+        || (bi->m_type == UBRK_CHARACTER && bi->m_logAttrs[bi->m_index].is_char_break)
+        || (bi->m_type == UBRK_SENTENCE && bi->m_logAttrs[bi->m_index].is_sentence_end) );
+}
+
+}
diff --git a/WebCore/platform/text/gtk/TextCodecGtk.cpp b/WebCore/platform/text/gtk/TextCodecGtk.cpp
new file mode 100644
index 0000000..31da3b7
--- /dev/null
+++ b/WebCore/platform/text/gtk/TextCodecGtk.cpp
@@ -0,0 +1,446 @@
+/*
+ * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ * Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ * Copyright (C) 2009 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TextCodecGtk.h"
+
+#include "CString.h"
+#include "PlatformString.h"
+#include <wtf/Assertions.h>
+#include <wtf/HashMap.h>
+#include <wtf/gtk/GOwnPtr.h>
+#include "Logging.h"
+
+using std::min;
+
+namespace WebCore {
+
+// TextCodec's appendOmittingBOM() is gone (http://trac.webkit.org/changeset/33380). 
+// That's why we need to avoid generating extra BOM's for the conversion result.
+// This can be achieved by specifying the UTF-16 codecs' endianness explicitly when initializing GLib.
+
+#if (G_BYTE_ORDER == G_BIG_ENDIAN)
+    const gchar* WebCore::TextCodecGtk::m_internalEncodingName = "UTF-16BE";
+#else 
+    const gchar* WebCore::TextCodecGtk::m_internalEncodingName = "UTF-16LE";
+#endif
+
+
+// We're specifying the list of text codecs and their aliases here. 
+// For each codec the first entry is the canonical name, remaining ones are used as aliases.
+// Each alias list must be terminated by a 0.
+
+// Unicode
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_UTF_8            = { "UTF-8", 0 }; 
+
+// Western
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_1       = { "ISO-8859-1", "CP819", "IBM819", "ISO-IR-100", "ISO8859-1", "ISO_8859-1", "ISO_8859-1:1987",  "L1", "LATIN1", "CSISOLATIN1", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_MACROMAN         = { "MACROMAN", "MAC", "MACINTOSH", "CSMACINTOSH", 0 };
+
+// Japanese
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_SHIFT_JIS        = { "Shift_JIS", "MS_KANJI", "SHIFT-JIS", "SJIS", "CSSHIFTJIS", 0 };
+    TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_EUC_JP       = { "EUC-JP", "EUC_JP", "EUCJP", "EXTENDED_UNIX_CODE_PACKED_FORMAT_FOR_JAPANESE", "CSEUCPKDFMTJAPANESE", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_2022_JP      = { "ISO-2022-JP", 0 };
+
+// Traditional Chinese
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_BIG5             = { "BIG5", "BIG-5", "BIG-FIVE", "BIG5", "BIGFIVE", "CN-BIG5", "CSBIG5", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_BIG5_HKSCS       = { "BIG5-HKSCS", "BIG5-HKSCS:2004", "BIG5HKSCS", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP950            = { "CP950", 0 };
+
+// Korean
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_2022_KR      = { "ISO-2022-KR", "CSISO2022KR", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP949            = { "CP949", "UHC", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_EUC_KR           = { "EUC-KR", "CSEUCKR", 0 };
+
+// Arabic
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_6       = { "ISO-8859-6", "ARABIC", "ASMO-708", "ECMA-114", "ISO-IR-127", "ISO8859-6", "ISO_8859-6", "ISO_8859-6:1987", "CSISOLATINARABIC", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1256           = { "windows-1256", "CP1256", "MS-ARAB", 0 }; // rearranged, windows-1256 now declared the canonical name and put to lowercase to fix /fast/encoding/ahram-org-eg.html test case
+
+// Hebrew
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_8       = { "ISO-8859-8", "HEBREW", "ISO-8859-8", "ISO-IR-138", "ISO8859-8", "ISO_8859-8", "ISO_8859-8:1988", "CSISOLATINHEBREW", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1255           = { "windows-1255", "CP1255", "MS-HEBR", 0 }; // rearranged, moved windows-1255 as canonical and lowercased, fixing /fast/encoding/meta-charset.html
+
+// Greek
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_7       = { "ISO-8859-7", "ECMA-118", "ELOT_928", "GREEK", "GREEK8", "ISO-IR-126", "ISO8859-7", "ISO_8859-7", "ISO_8859-7:1987", "ISO_8859-7:2003", "CSI", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP869            = { "CP869", "869", "CP-GR", "IBM869", "CSIBM869", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_WINDOWS_1253     = { "WINDOWS-1253", 0 };
+
+// Cyrillic
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_5       = { "ISO-8859-5", "CYRILLIC", "ISO-IR-144", "ISO8859-5", "ISO_8859-5", "ISO_8859-5:1988", "CSISOLATINCYRILLIC", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_KOI8_R           = { "KOI8-R", "CSKOI8R", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP866            = { "CP866", "866", "IBM866", "CSIBM866", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_KOI8_U           = { "KOI8-U", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_WINDOWS_1251     = { "windows-1251", "CP1251", 0 }; // CP1251 added to pass /fast/encoding/charset-cp1251.html
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_MACCYRILLIC      = { "mac-cyrillic", "MACCYRILLIC", "x-mac-cyrillic", 0 }; 
+
+// Thai
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP874            = { "CP874", "WINDOWS-874", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_TIS_620          = { "TIS-620", 0 };
+
+// Simplified Chinese
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_GBK              = { "GBK", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_HZ               = { "HZ", "HZ-GB-2312", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_GB18030          = { "GB18030", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_EUC_CN           = { "EUC-CN", "EUCCN", "GB2312", "CN-GB", "CSGB2312", "EUC_CN", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_2312_80          = { "GB_2312-80", "CHINESE", "csISO58GB231280", "GB2312.1980-0", "ISO-IR-58" };
+
+// Central European
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_2       = { "ISO-8859-2", "ISO-IR-101", "ISO8859-2", "ISO_8859-2", "ISO_8859-2:1987", "L2", "LATIN2", "CSISOLATIN2", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1250           = { "CP1250", "MS-EE", "WINDOWS-1250", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_MACCENTRALEUROPE = { "MAC-CENTRALEUROPE", 0 };
+
+// Vietnamese
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1258           = { "CP1258", "WINDOWS-1258", 0 };
+
+// Turkish
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1254           = { "CP1254", "MS-TURK", "WINDOWS-1254", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_9       = { "ISO-8859-9", "ISO-IR-148", "ISO8859-9", "ISO_8859-9", "ISO_8859-9:1989", "L5", "LATIN5", "CSISOLATIN5", 0 };
+
+// Baltic
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1257           = { "CP1257", "WINBALTRIM", "WINDOWS-1257", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_4       = { "ISO-8859-4", "ISO-IR-110", "ISO8859-4", "ISO_8859-4", "ISO_8859-4:1988", "L4", "LATIN4", "CSISOLATIN4", 0 };
+
+gconstpointer const TextCodecGtk::m_iconvBaseCodecList[] = { 
+    // Unicode
+    &m_codecAliases_UTF_8,
+
+    // Western
+    &m_codecAliases_ISO_8859_1
+};
+
+gconstpointer const TextCodecGtk::m_iconvExtendedCodecList[] = 
+{
+    // Western
+    &m_codecAliases_MACROMAN,
+
+    // Japanese
+    &m_codecAliases_SHIFT_JIS,
+    &m_codecAliases_EUC_JP,
+    &m_codecAliases_ISO_2022_JP,
+
+    // Simplified Chinese
+    &m_codecAliases_BIG5,
+    &m_codecAliases_BIG5_HKSCS,
+    &m_codecAliases_CP950,
+
+    // Korean
+    &m_codecAliases_ISO_2022_KR,
+    &m_codecAliases_CP949,
+    &m_codecAliases_EUC_KR,
+
+    // Arabic
+    &m_codecAliases_ISO_8859_6,
+    &m_codecAliases_CP1256,
+    
+    // Hebrew
+    &m_codecAliases_ISO_8859_8,
+    &m_codecAliases_CP1255,
+    
+    // Greek
+    &m_codecAliases_ISO_8859_7,
+    &m_codecAliases_CP869,
+    &m_codecAliases_WINDOWS_1253,
+    
+    // Cyrillic
+    &m_codecAliases_ISO_8859_5,
+    &m_codecAliases_KOI8_R,
+    &m_codecAliases_CP866,
+    &m_codecAliases_KOI8_U,
+    &m_codecAliases_WINDOWS_1251,
+    &m_codecAliases_MACCYRILLIC,
+    
+    // Thai
+    &m_codecAliases_CP874,
+    &m_codecAliases_TIS_620,
+    
+    // Traditional Chinese
+    &m_codecAliases_GBK,
+    &m_codecAliases_HZ,
+    &m_codecAliases_GB18030,
+    &m_codecAliases_EUC_CN,
+    &m_codecAliases_2312_80,
+    
+    // Central European
+    &m_codecAliases_ISO_8859_2,
+    &m_codecAliases_CP1250,
+    &m_codecAliases_MACCENTRALEUROPE,
+    
+    // Vietnamese
+    &m_codecAliases_CP1258,
+    
+    // Turkish
+    &m_codecAliases_CP1254,
+    &m_codecAliases_ISO_8859_9,
+    
+    // Baltic
+    &m_codecAliases_CP1257,
+    &m_codecAliases_ISO_8859_4
+};
+
+
+const size_t ConversionBufferSize = 16384;
+    
+
+static PassOwnPtr<TextCodec> newTextCodecGtk(const TextEncoding& encoding, const void*)
+{
+    return new TextCodecGtk(encoding);
+}
+
+gboolean TextCodecGtk::isEncodingAvailable(const gchar* encName)
+{
+    GIConv tester;
+    // test decoding
+    tester = g_iconv_open(m_internalEncodingName, encName);
+    if (tester == reinterpret_cast<GIConv>(-1)) {
+        return false;
+    } else {
+        g_iconv_close(tester);
+        // test encoding
+        tester = g_iconv_open(encName, m_internalEncodingName);
+        if (tester == reinterpret_cast<GIConv>(-1)) {
+            return false;
+        } else {
+            g_iconv_close(tester);
+            return true;
+        }
+    }
+}
+
+void TextCodecGtk::registerEncodingNames(EncodingNameRegistrar registrar, bool extended)
+{
+    const void* const* encodingList;
+    unsigned int listLength = 0;
+    if (extended) {
+        encodingList = m_iconvExtendedCodecList;
+        listLength = sizeof(m_iconvExtendedCodecList)/sizeof(gpointer);
+    } else {
+        encodingList = m_iconvBaseCodecList;
+        listLength = sizeof(m_iconvBaseCodecList)/sizeof(gpointer);
+    }
+
+    for (unsigned int i = 0; i < listLength; ++i) {
+        codecAliasList *codecAliases = static_cast<codecAliasList*>(encodingList[i]);
+        
+        // Our convention is, the first entry in codecAliases is the canonical name, 
+        // see above in the list of declarations. 
+        // Probe GLib for this one first. If it's not available, we skip the whole group of aliases.
+
+        int codecCount = 0;
+        const char *canonicalName;
+        canonicalName = (*codecAliases)[codecCount];
+
+        if(!isEncodingAvailable(canonicalName)) {
+            LOG(TextConversion, "Canonical encoding %s not available, skipping.", canonicalName);
+            continue;
+        }
+        registrar(canonicalName, canonicalName);
+
+        const char *currentAlias;
+        while ((currentAlias = (*codecAliases)[++codecCount])) {
+            if (isEncodingAvailable(currentAlias)) {
+                LOG(TextConversion, "Registering encoding name alias %s to canonical %s", currentAlias, canonicalName);
+                registrar(currentAlias, canonicalName);
+            }
+        }
+
+    }
+}
+
+void TextCodecGtk::registerCodecs(TextCodecRegistrar registrar, bool extended)
+{
+    const void* const* encodingList;
+    unsigned int listLength = 0;
+    if (extended) {
+        encodingList = m_iconvExtendedCodecList;
+        listLength = sizeof(m_iconvExtendedCodecList)/sizeof(gpointer);
+    } else {
+        encodingList = m_iconvBaseCodecList;
+        listLength = sizeof(m_iconvBaseCodecList)/sizeof(gpointer);
+    }
+
+    for (unsigned int i = 0; i < listLength; ++i) {
+        codecAliasList *codecAliases = static_cast<codecAliasList*>(encodingList[i]);
+        // by convention, the first "alias" should be the canonical name, see the definition of the alias lists 
+        const gchar *codecName = (*codecAliases)[0];
+        if (isEncodingAvailable(codecName))
+            registrar(codecName, newTextCodecGtk, 0);
+    }
+}
+
+void TextCodecGtk::registerBaseEncodingNames(EncodingNameRegistrar registrar)
+{
+    registerEncodingNames(registrar, false);
+}
+
+void TextCodecGtk::registerBaseCodecs(TextCodecRegistrar registrar)
+{
+    registerCodecs(registrar, false);
+}
+
+void TextCodecGtk::registerExtendedEncodingNames(EncodingNameRegistrar registrar)
+{
+    registerEncodingNames(registrar, true);
+}
+
+void TextCodecGtk::registerExtendedCodecs(TextCodecRegistrar registrar)
+{
+    registerCodecs(registrar, true);
+}
+
+TextCodecGtk::TextCodecGtk(const TextEncoding& encoding)
+    : m_encoding(encoding)
+    , m_numBufferedBytes(0)
+    , m_iconvDecoder(reinterpret_cast<GIConv>(-1))
+    , m_iconvEncoder(reinterpret_cast<GIConv>(-1))
+{
+}
+
+TextCodecGtk::~TextCodecGtk()
+{
+    if (m_iconvDecoder != reinterpret_cast<GIConv>(-1)) {
+        g_iconv_close(m_iconvDecoder);
+        m_iconvDecoder = reinterpret_cast<GIConv>(-1);
+    }
+    if (m_iconvEncoder != reinterpret_cast<GIConv>(-1)) {
+        g_iconv_close(m_iconvEncoder);
+        m_iconvEncoder = reinterpret_cast<GIConv>(-1);
+    }
+}
+
+void TextCodecGtk::createIConvDecoder() const
+{
+    ASSERT(m_iconvDecoder == reinterpret_cast<GIConv>(-1));
+
+    m_iconvDecoder = g_iconv_open(m_internalEncodingName, m_encoding.name());
+}
+
+void TextCodecGtk::createIConvEncoder() const
+{
+    ASSERT(m_iconvDecoder == reinterpret_cast<GIConv>(-1));
+
+    m_iconvEncoder = g_iconv_open(m_encoding.name(), m_internalEncodingName);
+}
+
+String TextCodecGtk::decode(const char* bytes, size_t length, bool flush, bool stopOnError, bool& sawError)
+{
+    // Get a converter for the passed-in encoding.
+    if (m_iconvDecoder == reinterpret_cast<GIConv>(-1)) {
+        createIConvDecoder();
+        ASSERT(m_iconvDecoder != reinterpret_cast<GIConv>(-1));
+        if (m_iconvDecoder == reinterpret_cast<GIConv>(-1)) {
+            LOG_ERROR("Error creating IConv encoder even though encoding was in table.");
+            return String();
+        }
+    }
+
+    size_t countWritten, countRead, conversionLength;
+    const char* conversionBytes;
+    char* prefixedBytes = 0;
+
+    if (m_numBufferedBytes) {
+        conversionLength = length + m_numBufferedBytes;
+        prefixedBytes = static_cast<char*>(fastMalloc(conversionLength));
+        memcpy(prefixedBytes, m_bufferedBytes, m_numBufferedBytes);
+        memcpy(prefixedBytes + m_numBufferedBytes, bytes, length);
+        
+        conversionBytes = prefixedBytes;
+        
+        // all buffered bytes are consumed now
+        m_numBufferedBytes = 0;
+    } else {
+        // no previously buffered partial data, 
+        // just convert the data that was passed in
+        conversionBytes = bytes;
+        conversionLength = length;
+    }
+
+    GOwnPtr<GError> err;
+    GOwnPtr<UChar> buffer;
+
+    buffer.outPtr() = reinterpret_cast<UChar*>(g_convert_with_iconv(conversionBytes, conversionLength, m_iconvDecoder, &countRead, &countWritten, &err.outPtr())); 
+
+
+    if (err) {
+        LOG_ERROR("GIConv conversion error, Code %d: \"%s\"", err->code, err->message);
+        m_numBufferedBytes = 0; // reset state for subsequent calls to decode
+        fastFree(prefixedBytes);
+        sawError = true;
+        return String();
+    }
+    
+    // Partial input at the end of the string may not result in an error being raised. 
+    // From the gnome library documentation on g_convert_with_iconv:
+    // "Even if the conversion was successful, this may be less than len if there were partial characters at the end of the input."
+    // That's why we need to compare conversionLength against countRead 
+
+    m_numBufferedBytes = conversionLength - countRead;
+    if (m_numBufferedBytes > 0) {
+        if (flush) {
+            LOG_ERROR("Partial bytes at end of input while flush requested.");
+            m_numBufferedBytes = 0; // reset state for subsequent calls to decode
+            fastFree(prefixedBytes);
+            sawError = true;
+            return String();
+        }
+        memcpy(m_bufferedBytes, conversionBytes + countRead, m_numBufferedBytes);
+    }
+
+    fastFree(prefixedBytes);
+    
+    Vector<UChar> result;
+
+    result.append(buffer.get(), countWritten / sizeof(UChar));
+
+    return String::adopt(result);
+}
+
+CString TextCodecGtk::encode(const UChar* characters, size_t length, UnencodableHandling handling)
+{
+    if (!length)
+        return "";
+
+    if (m_iconvEncoder == reinterpret_cast<GIConv>(-1))
+        createIConvEncoder();
+    if (m_iconvEncoder == reinterpret_cast<GIConv>(-1))
+        return CString();
+
+    size_t count;
+
+    GOwnPtr<GError> err;
+    GOwnPtr<char> buffer;
+
+    buffer.outPtr() = g_convert_with_iconv(reinterpret_cast<const char*>(characters), length * sizeof(UChar), m_iconvEncoder, 0, &count, &err.outPtr());
+    if (err) {
+        LOG_ERROR("GIConv conversion error, Code %d: \"%s\"", err->code, err->message);
+        return CString();
+    }
+
+    return CString(buffer.get(), count);
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/text/gtk/TextCodecGtk.h b/WebCore/platform/text/gtk/TextCodecGtk.h
new file mode 100644
index 0000000..a8af752
--- /dev/null
+++ b/WebCore/platform/text/gtk/TextCodecGtk.h
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ * Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ * Copyright (C) 2009 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef TextCodecGTK_h
+#define TextCodecGTK_h
+
+#include <glib.h>
+#include "TextCodec.h"
+#include "TextEncoding.h"
+
+namespace WebCore {
+
+    class TextCodecGtk : public TextCodec {
+    public:
+        static void registerBaseEncodingNames(EncodingNameRegistrar);
+        static void registerBaseCodecs(TextCodecRegistrar);
+
+        static void registerExtendedEncodingNames(EncodingNameRegistrar);
+        static void registerExtendedCodecs(TextCodecRegistrar);
+
+        TextCodecGtk(const TextEncoding&);
+        virtual ~TextCodecGtk();
+
+        virtual String decode(const char*, size_t length, bool flush, bool stopOnError, bool& sawError);
+        virtual CString encode(const UChar*, size_t length, UnencodableHandling);
+
+    private:
+        void createIConvDecoder() const;
+        void createIConvEncoder() const;
+
+        static void registerEncodingNames(EncodingNameRegistrar registrar, bool extended);        
+        static void registerCodecs(TextCodecRegistrar registrar, bool extended);
+        static gboolean isEncodingAvailable(const gchar*);
+
+        TextEncoding m_encoding;
+        size_t m_numBufferedBytes;
+        unsigned char m_bufferedBytes[16]; // bigger than any single multi-byte character        
+        mutable GIConv m_iconvDecoder;
+        mutable GIConv m_iconvEncoder;
+
+        static const gchar* m_internalEncodingName;
+
+        typedef const gchar* const codecAliasList[];
+
+        // Unicode
+        static codecAliasList m_codecAliases_UTF_8;
+
+        // Western
+        static codecAliasList m_codecAliases_ISO_8859_1;
+        static codecAliasList m_codecAliases_MACROMAN;
+
+        // Japanese
+        static codecAliasList m_codecAliases_SHIFT_JIS;
+        static codecAliasList m_codecAliases_EUC_JP;
+        static codecAliasList m_codecAliases_ISO_2022_JP;
+
+        // Traditional Chinese
+        static codecAliasList m_codecAliases_BIG5;
+        static codecAliasList m_codecAliases_BIG5_HKSCS;
+        static codecAliasList m_codecAliases_CP950;
+
+        // Korean
+        static codecAliasList m_codecAliases_ISO_2022_KR;
+        static codecAliasList m_codecAliases_CP949;
+        static codecAliasList m_codecAliases_EUC_KR;
+
+        // Arabic
+        static codecAliasList m_codecAliases_ISO_8859_6;
+        static codecAliasList m_codecAliases_CP1256;
+
+        // Hebrew
+        static codecAliasList m_codecAliases_ISO_8859_8;
+        static codecAliasList m_codecAliases_CP1255;
+
+        // Greek
+        static codecAliasList m_codecAliases_ISO_8859_7;
+        static codecAliasList m_codecAliases_CP869;
+        static codecAliasList m_codecAliases_WINDOWS_1253;
+
+        // Cyrillic
+        static codecAliasList m_codecAliases_ISO_8859_5;
+        static codecAliasList m_codecAliases_KOI8_R;
+        static codecAliasList m_codecAliases_CP866;
+        static codecAliasList m_codecAliases_KOI8_U;
+        static codecAliasList m_codecAliases_WINDOWS_1251;
+        static codecAliasList m_codecAliases_MACCYRILLIC;
+
+        // Thai
+        static codecAliasList m_codecAliases_CP874;
+        static codecAliasList m_codecAliases_TIS_620;
+
+        // Simplified Chinese
+        static codecAliasList m_codecAliases_GBK;
+        static codecAliasList m_codecAliases_HZ;
+        static codecAliasList m_codecAliases_GB18030;
+        static codecAliasList m_codecAliases_EUC_CN;
+        static codecAliasList m_codecAliases_2312_80; 
+
+        // Central European
+        static codecAliasList m_codecAliases_ISO_8859_2;
+        static codecAliasList m_codecAliases_CP1250;
+        static codecAliasList m_codecAliases_MACCENTRALEUROPE;
+
+        // Vietnamese
+        static codecAliasList m_codecAliases_CP1258;
+
+        // Turkish
+        static codecAliasList m_codecAliases_CP1254;
+        static codecAliasList m_codecAliases_ISO_8859_9;
+
+        // Baltic
+        static codecAliasList m_codecAliases_CP1257;
+        static codecAliasList m_codecAliases_ISO_8859_4;
+
+        static gconstpointer const m_iconvBaseCodecList[];
+        static gconstpointer const m_iconvExtendedCodecList[];
+
+    };
+
+} // namespace WebCore
+
+#endif // TextCodecGTK_h
diff --git a/WebCore/platform/text/qt/TextBoundaries.cpp b/WebCore/platform/text/qt/TextBoundariesQt.cpp
index ffc4c44..a354ca6 100644
--- a/WebCore/platform/text/qt/TextBoundaries.cpp
+++ b/WebCore/platform/text/qt/TextBoundariesQt.cpp
@@ -36,7 +36,6 @@
 #include <QDebug>
 #include <stdio.h>
 
-#if QT_VERSION >= 0x040400
 #include <qtextboundaryfinder.h>
 
 namespace WebCore {
@@ -76,48 +75,3 @@ void findWordBoundary(UChar const* buffer, int len, int position, int* start, in
 
 }
 
-#else
-namespace WebCore {
-
-int findNextWordFromIndex(UChar const* buffer, int len, int position, bool forward)
-{
-    QString str(reinterpret_cast<QChar const*>(buffer), len);
-    notImplemented();
-    return 0;
-}
-
-void findWordBoundary(UChar const* buffer, int len, int position, int* start, int* end)
-{
-    QString str(reinterpret_cast<QChar const*>(buffer), len);
-
-    if (position > str.length()) {
-        *start = 0;
-        *end = 0;
-        return;
-    }
-
-    int currentPosition = position - 1;
-    QString foundWord;
-    while (currentPosition >= 0 &&
-           str[currentPosition].isLetter()) {
-        foundWord.prepend(str[currentPosition]);
-        --currentPosition;
-    }
-
-    // currentPosition == 0 means the first char is not letter
-    // currentPosition == -1 means we reached the beginning
-    int startPos = (currentPosition < 0) ? 0 : ++currentPosition;
-    currentPosition = position;
-    if (str[currentPosition].isLetter()) {
-            while (str[currentPosition].isLetter()) {
-                foundWord.append(str[currentPosition]);
-                ++currentPosition;
-            }
-    }
-
-    *start = startPos;
-    *end = currentPosition;
-}
-
-}
-#endif
diff --git a/WebCore/platform/text/qt/TextBreakIteratorQt.cpp b/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
index d80e270..101947c 100644
--- a/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
+++ b/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -23,7 +21,6 @@
 #include "config.h"
 #include "TextBreakIterator.h"
 
-#if QT_VERSION >= 0x040400
 #include <QtCore/qtextboundaryfinder.h>
 #include <qdebug.h>
 
@@ -132,183 +129,3 @@ namespace WebCore {
     }
 
 }
-#else
-#include <qtextlayout.h>
-
-namespace WebCore {
-
-    class TextBreakIterator {
-    public:
-        virtual int first() = 0;
-        virtual int next() = 0;
-        virtual int previous() = 0;
-        inline int following(int pos)
-        {
-            currentPos = pos;
-            return next();
-        }
-        inline int preceding(int pos)
-        {
-            currentPos = pos;
-            return previous();
-        }
-        int currentPos;
-        const UChar *string;
-        int length;
-    };
-
-    class WordBreakIteratorQt : public TextBreakIterator {
-    public:
-        virtual int first();
-        virtual int next();
-        virtual int previous();
-    };
-
-    class CharBreakIteratorQt : public TextBreakIterator {
-    public:
-        virtual int first();
-        virtual int next();
-        virtual int previous();
-        QTextLayout layout;
-    };
-
-    int WordBreakIteratorQt::first()
-    {
-        currentPos = 0;
-        return currentPos;
-    }
-
-    int WordBreakIteratorQt::next()
-    {
-        if (currentPos >= length) {
-            currentPos = -1;
-            return currentPos;
-        }
-        bool haveSpace = false;
-        while (currentPos < length) {
-            if (haveSpace && !QChar(string[currentPos]).isSpace())
-                break;
-            if (QChar(string[currentPos]).isSpace())
-                haveSpace = true;
-            ++currentPos;
-        }
-        return currentPos;
-    }
-
-    int WordBreakIteratorQt::previous()
-    {
-        if (currentPos <= 0) {
-            currentPos = -1;
-            return currentPos;
-        }
-        bool haveSpace = false;
-        while (currentPos > 0) {
-            if (haveSpace && !QChar(string[currentPos]).isSpace())
-                break;
-            if (QChar(string[currentPos]).isSpace())
-                haveSpace = true;
-            --currentPos;
-        }
-        return currentPos;
-    }
-
-    int CharBreakIteratorQt::first()
-    {
-        currentPos = 0;
-        return currentPos;
-    }
-
-    int CharBreakIteratorQt::next()
-    {
-        if (currentPos >= length)
-            return -1;
-        currentPos = layout.nextCursorPosition(currentPos);
-        return currentPos;
-    }
-
-    int CharBreakIteratorQt::previous()
-    {
-        if (currentPos <= 0)
-            return -1;
-        currentPos = layout.previousCursorPosition(currentPos);
-        return currentPos;
-    }
-
-
-TextBreakIterator* wordBreakIterator(const UChar* string, int length)
-{
-    static WordBreakIteratorQt *iterator = 0;
-    if (!iterator)
-        iterator = new WordBreakIteratorQt;
-
-    iterator->string = string;
-    iterator->length = length;
-    iterator->currentPos = 0;
-
-    return iterator;
-}
-
-TextBreakIterator* characterBreakIterator(const UChar* string, int length)
-{
-    static CharBreakIteratorQt *iterator = 0;
-    if (!iterator)
-        iterator = new CharBreakIteratorQt;
-
-    iterator->string = string;
-    iterator->length = length;
-    iterator->currentPos = 0;
-    iterator->layout.setText(QString(reinterpret_cast<const QChar*>(string), length));
-
-    return iterator;
-}
-
-TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
-{
-    return characterBreakIterator(string, length);
-}
-
-TextBreakIterator* lineBreakIterator(const UChar*, int)
-{
-    // not yet implemented
-    return 0;
-}
-
-TextBreakIterator* sentenceBreakIterator(const UChar*, int)
-{
-    // not yet implemented
-    return 0;
-}
-
-int textBreakFirst(TextBreakIterator* bi)
-{
-    return bi->first();
-}
-
-int textBreakNext(TextBreakIterator* bi)
-{
-    return bi->next();
-}
-
-int textBreakPreceding(TextBreakIterator* bi, int pos)
-{
-    return bi->preceding(pos);
-}
-
-int textBreakFollowing(TextBreakIterator* bi, int pos)
-{
-    return bi->following(pos);
-}
-
-int textBreakCurrent(TextBreakIterator* bi)
-{
-    return bi->currentPos;
-}
-
-bool isTextBreak(TextBreakIterator*, int)
-{
-    return true;
-}
-
-}
-
-#endif
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.cpp b/WebCore/platform/text/wince/TextBoundariesWince.cpp
index c8a1397..df6f757 100644
--- a/WebCore/html/canvas/CanvasArrayBuffer.cpp
+++ b/WebCore/platform/text/wince/TextBoundariesWince.cpp
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,38 +21,55 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
+#include "TextBoundaries.h"
 
-#if ENABLE(3D_CANVAS)
+#include "NotImplemented.h"
+#include "PlatformString.h"
 
-#include "CanvasArrayBuffer.h"
+using namespace WTF::Unicode;
 
 namespace WebCore {
-    
-    PassRefPtr<CanvasArrayBuffer> CanvasArrayBuffer::create(unsigned sizeInBytes)
-    {
-        return adoptRef(new CanvasArrayBuffer(sizeInBytes));
-    }
-    
-    CanvasArrayBuffer::CanvasArrayBuffer(unsigned sizeInBytes) {
-        m_sizeInBytes = sizeInBytes;
-        m_data = WTF::fastZeroedMalloc(sizeInBytes);
-    }
-    
-    void* CanvasArrayBuffer::data() {
-        return m_data;
+
+int findNextWordFromIndex(const UChar * buffer, int len, int position, bool forward)
+{
+    notImplemented();
+    return 0;
+}
+
+void findWordBoundary(const UChar * buffer, int len, int position, int* start, int* end)
+{
+    if (position > len) {
+        *start = 0;
+        *end = 0;
+        return;
     }
 
-    unsigned CanvasArrayBuffer::byteLength() const {
-        return m_sizeInBytes;
+    String str(buffer, len);
+
+    int currentPosition = position - 1;
+    String foundWord;
+    while (currentPosition >= 0 && isLetter(str[currentPosition])) {
+        UChar c = str[currentPosition];
+        foundWord.insert(&c, 1, 0);
+        --currentPosition;
     }
 
-    CanvasArrayBuffer::~CanvasArrayBuffer() {
-        WTF::fastFree(m_data);
+    // currentPosition == 0 means the first char is not letter
+    // currentPosition == -1 means we reached the beginning
+    int startPos = (currentPosition < 0) ? 0 : ++currentPosition;
+    currentPosition = position;
+    while (isLetter(str[currentPosition])) {
+        foundWord.append(str[currentPosition]);
+        ++currentPosition;
     }
+
+    *start = startPos;
+    *end = currentPosition;
 }
 
-#endif // ENABLE(3D_CANVAS)
+
+}
diff --git a/WebCore/platform/text/wince/TextBreakIteratorWince.cpp b/WebCore/platform/text/wince/TextBreakIteratorWince.cpp
new file mode 100644
index 0000000..26a5be2
--- /dev/null
+++ b/WebCore/platform/text/wince/TextBreakIteratorWince.cpp
@@ -0,0 +1,311 @@
+/*
+ * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#include "config.h"
+#include "TextBreakIterator.h"
+
+#include "PlatformString.h"
+#include <wtf/unicode/Unicode.h>
+
+using namespace WTF::Unicode;
+
+namespace WebCore {
+
+// Hack, not entirely correct
+static inline bool isCharStop(UChar c)
+{
+    CharCategory charCategory = category(c);
+    return charCategory != Mark_NonSpacing && (charCategory != Other_Surrogate || (c < 0xd800 || c >= 0xdc00));
+}
+
+static inline bool isLineStop(UChar c)
+{
+    return category(c) != Separator_Line;
+}
+
+static inline bool isSentenceStop(UChar c)
+{
+    return isPunct(c);
+}
+
+class TextBreakIterator {
+public:
+    void reset(const UChar* str, int len)
+    {
+        string = str;
+        length = len;
+        currentPos = 0;
+    }
+    virtual int first() = 0;
+    virtual int next() = 0;
+    virtual int previous() = 0;
+    int following(int position)
+    {
+        currentPos = position;
+        return next();
+    }
+    int preceding(int position)
+    {
+        currentPos = position;
+        return previous();
+    }
+
+    int currentPos;
+    const UChar* string;
+    int length;
+};
+
+struct WordBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct CharBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct LineBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct SentenceBreakIterator : TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+int WordBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int WordBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isSpace(string[currentPos]))
+            break;
+        if (isSpace(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int WordBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isSpace(string[currentPos]))
+            break;
+        if (isSpace(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+int CharBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int CharBreakIterator::next()
+{
+    if (currentPos >= length)
+        return -1;
+    ++currentPos;
+    while (currentPos < length && !isCharStop(string[currentPos]))
+        ++currentPos;
+    return currentPos;
+}
+
+int CharBreakIterator::previous()
+{
+    if (currentPos <= 0)
+        return -1;
+    if (currentPos > length)
+        currentPos = length;
+    --currentPos;
+    while (currentPos > 0 && !isCharStop(string[currentPos]))
+        --currentPos;
+    return currentPos;
+}
+
+int LineBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int LineBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isLineStop(string[currentPos]))
+            break;
+        if (isLineStop(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int LineBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isLineStop(string[currentPos]))
+            break;
+        if (isLineStop(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+int SentenceBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int SentenceBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isSentenceStop(string[currentPos]))
+            break;
+        if (isSentenceStop(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int SentenceBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isSentenceStop(string[currentPos]))
+            break;
+        if (isSentenceStop(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+TextBreakIterator* wordBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(WordBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* characterBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(CharBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* lineBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(LineBreakIterator , iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* sentenceBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(SentenceBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+int textBreakFirst(TextBreakIterator* breakIterator)
+{
+    return breakIterator->first();
+}
+
+int textBreakNext(TextBreakIterator* breakIterator)
+{
+    return breakIterator->next();
+}
+
+int textBreakPreceding(TextBreakIterator* breakIterator, int position)
+{
+    return breakIterator->preceding(position);
+}
+
+int textBreakFollowing(TextBreakIterator* breakIterator, int position)
+{
+    return breakIterator->following(position);
+}
+
+int textBreakCurrent(TextBreakIterator* breakIterator)
+{
+    return breakIterator->currentPos;
+}
+
+bool isTextBreak(TextBreakIterator*, int)
+{
+    return true;
+}
+
+TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
+{
+    return characterBreakIterator(string, length);
+}
+
+}
diff --git a/WebCore/platform/win/PlatformMouseEventWin.cpp b/WebCore/platform/win/PlatformMouseEventWin.cpp
index e9c0e3e..dc4dd2f 100644
--- a/WebCore/platform/win/PlatformMouseEventWin.cpp
+++ b/WebCore/platform/win/PlatformMouseEventWin.cpp
@@ -24,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "PlatformMouseEvent.h"
 
 #include <wtf/Assertions.h>
diff --git a/WebCore/platform/win/PopupMenuWin.cpp b/WebCore/platform/win/PopupMenuWin.cpp
index 1d9eb71..7d8c8d5 100644
--- a/WebCore/platform/win/PopupMenuWin.cpp
+++ b/WebCore/platform/win/PopupMenuWin.cpp
@@ -617,11 +617,11 @@ void PopupMenu::paint(const IntRect& damageRect, HDC hdc)
 
         // Draw the background for this menu item
         if (itemStyle.isVisible())
-            context.fillRect(itemRect, optionBackgroundColor);
+            context.fillRect(itemRect, optionBackgroundColor, DeviceColorSpace);
 
         if (client()->itemIsSeparator(index)) {
             IntRect separatorRect(itemRect.x() + separatorPadding, itemRect.y() + (itemRect.height() - separatorHeight) / 2, itemRect.width() - 2 * separatorPadding, separatorHeight);
-            context.fillRect(separatorRect, optionTextColor);
+            context.fillRect(separatorRect, optionTextColor, DeviceColorSpace);
             continue;
         }
 
@@ -631,7 +631,7 @@ void PopupMenu::paint(const IntRect& damageRect, HDC hdc)
         const UChar* string = itemText.characters();
         TextRun textRun(string, length, false, 0, 0, itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft);
 
-        context.setFillColor(optionTextColor);
+        context.setFillColor(optionTextColor, DeviceColorSpace);
         
         Font itemFont = client()->menuStyle().font();
         if (client()->itemIsLabel(index)) {
diff --git a/WebCore/platform/win/WebCoreTextRenderer.cpp b/WebCore/platform/win/WebCoreTextRenderer.cpp
index affeb9d..f771e00 100644
--- a/WebCore/platform/win/WebCoreTextRenderer.cpp
+++ b/WebCore/platform/win/WebCoreTextRenderer.cpp
@@ -49,7 +49,7 @@ static void doDrawTextAtPoint(GraphicsContext& context, const String& text, cons
 {
     TextRun run(text.characters(), text.length());
 
-    context.setFillColor(color);
+    context.setFillColor(color, DeviceColorSpace);
     if (isOneLeftToRightRun(run))
         font.drawText(&context, run, point);
     else
@@ -71,7 +71,7 @@ static void doDrawTextAtPoint(GraphicsContext& context, const String& text, cons
         IntPoint underlinePoint(point);
         underlinePoint.move(beforeWidth, 1);
 
-        context.setStrokeColor(color);
+        context.setStrokeColor(color, DeviceColorSpace);
         context.drawLineForText(underlinePoint, underlinedWidth, false);
     }
 }
diff --git a/WebCore/platform/wx/FileSystemWx.cpp b/WebCore/platform/wx/FileSystemWx.cpp
index 109278f..1ee87ae 100644
--- a/WebCore/platform/wx/FileSystemWx.cpp
+++ b/WebCore/platform/wx/FileSystemWx.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007 Kevin Ollivier
  * Copyright (C) 2008 Collabora, Ltd.
+ * Copyright (C) 2009 Peter Laufenberg @ Inhance Digital Corp
  *
  * All rights reserved.
  * 
@@ -34,13 +35,23 @@
 #include "PlatformString.h"
 
 #include <wx/wx.h>
+#include <wx/datetime.h>
+#include <wx/dir.h>
+#include <wx/dynlib.h>
+#include <wx/file.h>
+#include <wx/filefn.h>
 #include <wx/filename.h>
 
+#if PLATFORM(DARWIN)
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
 namespace WebCore {
 
 bool fileExists(const String& path)
 {
-    return wxFileName::FileExists(path);
+    // NOTE: This is called for directory paths too so we need to check both.
+    return wxFileName::FileExists(path) || wxFileName::DirExists(path);
 }
 
 bool deleteFile(const String& path)
@@ -114,16 +125,71 @@ int writeToFile(PlatformFileHandle, const char* data, int length)
     return 0;
 }
 
-bool unloadModule(PlatformModule)
+bool unloadModule(PlatformModule mod)
 {
-    notImplemented();
-    return false;
+#if PLATFORM(WIN_OS)
+    return ::FreeLibrary(mod);
+#elif PLATFORM(DARWIN)
+    CFRelease(mod);
+    return true;
+#else
+    wxASSERT(mod);
+    delete mod;
+    return true;
+#endif
 }
 
+
+class wxDirTraverserNonRecursive : public wxDirTraverser {
+public:
+    wxDirTraverserNonRecursive(wxString basePath, wxArrayString& files) : m_basePath(basePath), m_files(files) { }
+
+    virtual wxDirTraverseResult OnFile(const wxString& filename)
+    {
+        wxFileName afile(filename);
+        afile.MakeRelativeTo(m_basePath);
+        if (afile.GetFullPath().Find(afile.GetPathSeparator()) == wxNOT_FOUND)
+            m_files.push_back(filename);
+
+        return wxDIR_CONTINUE;
+    }
+
+    virtual wxDirTraverseResult OnDir(const wxString& dirname)
+    {
+        wxFileName dirfile(dirname);
+        dirfile.MakeRelativeTo(m_basePath);
+        if (dirfile.GetFullPath().Find(dirfile.GetPathSeparator()) == wxNOT_FOUND)
+            m_files.push_back(dirname);
+
+        return wxDIR_CONTINUE;
+    }
+
+private:
+    wxString m_basePath;
+    wxArrayString& m_files;
+
+    DECLARE_NO_COPY_CLASS(wxDirTraverserNonRecursive)
+};
+
 Vector<String> listDirectory(const String& path, const String& filter)
 {
+    wxArrayString   file_paths;
+    // wxDir::GetAllFiles recurses and for platforms like Mac where
+    // a .plugin or .bundle can be a dir wx will recurse into the bundle
+    // and list the files rather than just returning the plugin name, so
+    // we write a special traverser that works around that issue.
+    wxDirTraverserNonRecursive traverser(path, file_paths);
+    
+    wxDir dir(path);
+    dir.Traverse(traverser, _T(""), wxDIR_FILES | wxDIR_DIRS);
+
     Vector<String> entries;
-    notImplemented();
+    
+    for (int i = 0; i < file_paths.GetCount(); i++)
+    {
+        entries.append(file_paths[i]);
+    }   
+    
     return entries;
 }
 
diff --git a/WebCore/platform/wx/LocalizedStringsWx.cpp b/WebCore/platform/wx/LocalizedStringsWx.cpp
index 5bede52..6a389f2 100644
--- a/WebCore/platform/wx/LocalizedStringsWx.cpp
+++ b/WebCore/platform/wx/LocalizedStringsWx.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "LocalizedStrings.h"
 
+#include "NotImplemented.h"
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -323,4 +324,46 @@ String AXDefinitionListDefinitionText()
     return String();
 }
 
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/wx/ScrollbarThemeWx.cpp b/WebCore/platform/wx/ScrollbarThemeWx.cpp
index 6904f41..82e4a15 100644
--- a/WebCore/platform/wx/ScrollbarThemeWx.cpp
+++ b/WebCore/platform/wx/ScrollbarThemeWx.cpp
@@ -28,6 +28,7 @@
 
 #include "HostWindow.h"
 #include "NotImplemented.h"
+#include "PlatformMouseEvent.h"
 #include "Scrollbar.h"
 #include "ScrollbarClient.h"
 #include "scrollbar_render.h"
@@ -70,6 +71,11 @@ bool ScrollbarThemeWx::hasThumb(Scrollbar* scrollbar)
     return thumbLength(scrollbar) > 0;
 }
 
+int ScrollbarThemeWx::minimumThumbLength(Scrollbar* scrollbar)
+{
+    return 20;
+}
+
 IntSize ScrollbarThemeWx::buttonSize(Scrollbar*) 
 {
 #ifdef __WXMAC__
@@ -79,6 +85,22 @@ IntSize ScrollbarThemeWx::buttonSize(Scrollbar*)
 #endif
 }
 
+void ScrollbarThemeWx::splitTrack(Scrollbar* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
+{
+    ScrollbarThemeComposite::splitTrack(scrollbar, unconstrainedTrackRect, beforeThumbRect, thumbRect, afterThumbRect);
+#ifdef __WXMAC__
+    // on Mac, there are a few pixels drawn above the actual track and so adjust
+    // the hit testing rects accordingly
+    int trackStart = 10; 
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        thumbRect.setX(thumbRect.x() + trackStart);
+        afterThumbRect.setX(afterThumbRect.x() - trackStart);
+    } else {
+        thumbRect.setY(thumbRect.y() + trackStart);
+        afterThumbRect.setY(afterThumbRect.y() - trackStart);
+    }
+#endif
+}
 
 IntRect ScrollbarThemeWx::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
 {
@@ -111,10 +133,16 @@ IntRect ScrollbarThemeWx::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     IntSize size = buttonSize(scrollbar);
     int x, y;
     if (scrollbar->orientation() == HorizontalScrollbar) {
+#ifdef __WXMAC__
+        size.setWidth(size.width() + cMacButtonOverlap);
+#endif
         x = scrollbar->x() + scrollbar->width() - size.width();
         y = scrollbar->y();
     } else {
         x = scrollbar->x();
+#ifdef __WXMAC__
+        size.setHeight(size.height() + cMacButtonOverlap);
+#endif
         y = scrollbar->y() + scrollbar->height() - size.height();
     }
     return IntRect(x, y, size.width(), size.height());
diff --git a/WebCore/platform/wx/ScrollbarThemeWx.h b/WebCore/platform/wx/ScrollbarThemeWx.h
index 2b3bff0..79b10b3 100644
--- a/WebCore/platform/wx/ScrollbarThemeWx.h
+++ b/WebCore/platform/wx/ScrollbarThemeWx.h
@@ -48,6 +48,10 @@ protected:
     virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
     virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
     virtual IntRect trackRect(Scrollbar*, bool painting = false);
+
+    virtual void splitTrack(Scrollbar*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
+    
+    virtual int minimumThumbLength(Scrollbar*);
 };
 
 }
diff --git a/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
index f74b076..3b4daa8 100644
--- a/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
+++ b/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
@@ -116,9 +116,18 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc, const wxRect& rect, wx
     dc.SetPen(wxPen(wxSystemSettings::GetColour(wxSYS_COLOUR_BTNSHADOW)));
     dc.DrawRectangle(rect.x, rect.y, rect.width, rect.height);
 
+    // when going from Cairo -> Gdk, any Cairo context transformations are lost
+    // so we need to alter the coordinates to reflect their transformed point.
+    double xtrans = 0;
+    double ytrans = 0;
+    
+    wxGCDC* gcdc = wxDynamicCast(&dc, wxGCDC);
+    wxGraphicsContext* gc = gcdc->GetGraphicsContext();
+    gc->GetTransform().TransformPoint(&xtrans, &ytrans);
+
     wxRendererNative& renderer = wxRendererNative::Get();
-    int x = rect.x;
-    int y = rect.y;
+    int x = rect.x + (int)xtrans;
+    int y = rect.y + (int)ytrans;
 
     int buttonLength = 16;
 
@@ -138,13 +147,15 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc, const wxRect& rect, wx
     physicalLength -= buttonLength*2;
     int thumbStart = 0;
     int thumbLength = 0;
-    calcThumbStartAndLength(physicalLength, max + step, current, step, &thumbStart, &thumbLength);
+    calcThumbStartAndLength(physicalLength, max, current, step, &thumbStart, &thumbLength);
 
     if (horiz) {
-        buttonRect.x = thumbStart + buttonLength;
+        buttonRect.x = x + thumbStart + buttonLength;
+        buttonRect.y = y;
         buttonRect.width = thumbLength;
     } else {
-        buttonRect.y = thumbStart + buttonLength;
+        buttonRect.x = x;
+        buttonRect.y = y + thumbStart + buttonLength;
         buttonRect.height = thumbLength;
     }
 
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
index c4c4d48..47eb1f8 100644
--- a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
+++ b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
@@ -56,7 +56,7 @@ void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData*
     wxGCDC* dc = static_cast<wxGCDC*>(graphicsContext->platformContext());
 
     wxFont* wxfont = font->getWxFont();
-    graphicsContext->setFillColor(graphicsContext->fillColor());
+    graphicsContext->setFillColor(graphicsContext->fillColor(), DeviceColorSpace);
 
     CGContextRef cgContext = static_cast<CGContextRef>(dc->GetGraphicsContext()->GetNativeContext());
 
diff --git a/WebCore/platform/wx/wxcode/scrollbar_render.h b/WebCore/platform/wx/wxcode/scrollbar_render.h
index 7a0ba1c..5e0ea8e 100644
--- a/WebCore/platform/wx/wxcode/scrollbar_render.h
+++ b/WebCore/platform/wx/wxcode/scrollbar_render.h
@@ -50,16 +50,17 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc,
                                        int current, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, 
                                        int max, int step, int flags=0);
 
-inline void calcThumbStartAndLength(int physicalLength, int virtualLength, int current, 
+inline void calcThumbStartAndLength(int physicalLength, int max, int current, 
                                 int step, int *thumbStart, int *thumbLength)
 {
-        float proportion = (float)physicalLength / virtualLength;
-        float scale = (float)virtualLength / physicalLength;
-        int thumbSize = proportion * physicalLength;
-        int currentPos = current / scale;
-        
+        float proportion = ((float)physicalLength - 8)/ (max + step);
+        float thumbSize =  proportion * (float)physicalLength;
+        if (thumbSize < 20)
+            thumbSize = 20;
+
+        float thumbPos = ((float)current / (float)max) * ((float)physicalLength - thumbSize);
         if (thumbStart)
-            *thumbStart = currentPos;
+            *thumbStart = thumbPos;
         
         if (thumbLength)
             *thumbLength = thumbSize;
diff --git a/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
index 4d6bbc0..890db00 100644
--- a/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
+++ b/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
@@ -30,6 +30,8 @@
 #include <wx/defs.h>
 
 #include <wx/dc.h>
+#include <wx/dcgraph.h>
+#include <wx/graphics.h>
 #include <wx/renderer.h>
 #include <wx/window.h>
 
@@ -131,8 +133,24 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc,
         part = SP_TRACKENDVERT;
 
     int xpState = TS_NORMAL;
+    wxRect transRect = rect;
+
+#if USE(WXGC)
+    // when going from GdiPlus -> Gdi, any GdiPlus transformations are lost
+    // so we need to alter the coordinates to reflect their transformed point.
+    double xtrans = 0;
+    double ytrans = 0;
+    
+    wxGCDC* gcdc = wxDynamicCast(&dc, wxGCDC);
+    wxGraphicsContext* gc = gcdc->GetGraphicsContext();
+    gc->GetTransform().TransformPoint(&xtrans, &ytrans);
+
+    transRect.x += (int)xtrans;
+    transRect.y += (int)ytrans;
+#endif
+
     RECT r;
-    wxCopyRectToRECT(rect, r);
+    wxCopyRectToRECT(transRect, r);
 
     // Unlike Mac, on MSW you draw the scrollbar piece by piece.
     // so we draw the track first, then the buttons
@@ -163,14 +181,14 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc,
         physicalLength -= buttonSize*2;
         int thumbStart = 0;
         int thumbLength = 0;
-        calcThumbStartAndLength(physicalLength, max + step, 
+        calcThumbStartAndLength(physicalLength, max, 
                             current, step, &thumbStart, &thumbLength);
         buttonRect = r;
         if (horiz) {
-            buttonRect.left = thumbStart + buttonSize;
+            buttonRect.left = buttonRect.left + thumbStart + buttonSize;
             buttonRect.right = buttonRect.left + thumbLength;
         } else {
-            buttonRect.top = thumbStart + buttonSize;
+            buttonRect.top = buttonRect.top + thumbStart + buttonSize;
             buttonRect.bottom = buttonRect.top + thumbLength;
         }
 
diff --git a/WebCore/plugins/PluginData.h b/WebCore/plugins/PluginData.h
index b2866bf..6960a25 100644
--- a/WebCore/plugins/PluginData.h
+++ b/WebCore/plugins/PluginData.h
@@ -29,14 +29,14 @@ namespace WebCore {
     class Page;
     struct PluginInfo;
 
-    struct MimeClassInfo {
+    struct MimeClassInfo : Noncopyable {
         String type;
         String desc;
         String suffixes;
         PluginInfo* plugin;
     };
 
-    struct PluginInfo {
+    struct PluginInfo : Noncopyable {
         String name;
         String file;
         String desc;
diff --git a/WebCore/plugins/PluginDatabase.cpp b/WebCore/plugins/PluginDatabase.cpp
index 25e6000..dcd7208 100644
--- a/WebCore/plugins/PluginDatabase.cpp
+++ b/WebCore/plugins/PluginDatabase.cpp
@@ -325,7 +325,7 @@ void PluginDatabase::clear()
     m_preferredPlugins.clear();
 }
 
-#if (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || PLATFORM(WX) || !ENABLE(NETSCAPE_PLUGIN_API))
+#if (!PLATFORM(WINCE)) && (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || !ENABLE(NETSCAPE_PLUGIN_API))
 // For Safari/Win the following three methods are implemented
 // in PluginDatabaseWin.cpp, but if we can use WebCore constructs
 // for the logic we should perhaps move it here under XP_WIN?
@@ -385,7 +385,7 @@ Vector<String> PluginDatabase::defaultPluginDirectories()
     // Add paths specific to each port
 #if PLATFORM(QT)
     Vector<String> qtPaths;
-    String qtPath(getenv("QTWEBKIT_PLUGIN_PATH"));
+    String qtPath(qgetenv("QTWEBKIT_PLUGIN_PATH").constData());
     qtPath.split(UChar(':'), /* allowEmptyEntries */ false, qtPaths);
     paths.append(qtPaths);
 #endif
diff --git a/WebCore/plugins/PluginDatabase.h b/WebCore/plugins/PluginDatabase.h
index fe74682..90214ca 100644
--- a/WebCore/plugins/PluginDatabase.h
+++ b/WebCore/plugins/PluginDatabase.h
@@ -51,7 +51,7 @@ namespace WebCore {
 
     typedef HashSet<RefPtr<PluginPackage>, PluginPackageHash> PluginSet;
 
-    class PluginDatabase {
+    class PluginDatabase : public Noncopyable {
     public:
         PluginDatabase();
 
diff --git a/WebCore/plugins/PluginInfoStore.cpp b/WebCore/plugins/PluginInfoStore.cpp
index bd2f2d0..9a441f3 100644
--- a/WebCore/plugins/PluginInfoStore.cpp
+++ b/WebCore/plugins/PluginInfoStore.cpp
@@ -27,9 +27,15 @@
 #include "PluginInfoStore.h"
 
 #include "KURL.h"
+<<<<<<< HEAD:WebCore/plugins/PluginInfoStore.cpp
 #if PLATFORM(ANDROID)
+=======
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginInfoStore.cpp
 #include "Page.h"
+<<<<<<< HEAD:WebCore/plugins/PluginInfoStore.cpp
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginInfoStore.cpp
 #include "PluginData.h"
 #include "PluginDatabase.h"
 #include "PluginPackage.h"
@@ -96,8 +102,12 @@ bool PluginInfoStore::supportsMIMEType(const WebCore::String& mimeType)
 
 void refreshPlugins(bool reloadOpenPages)
 {
+<<<<<<< HEAD:WebCore/plugins/PluginInfoStore.cpp
 #if PLATFORM(ANDROID)
+=======
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginInfoStore.cpp
     Page::refreshPlugins(reloadOpenPages);
+<<<<<<< HEAD:WebCore/plugins/PluginInfoStore.cpp
 #else
     PluginDatabase::installedPlugins()->refresh();
 
@@ -105,6 +115,8 @@ void refreshPlugins(bool reloadOpenPages)
         // FIXME: reload open pages
     }
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginInfoStore.cpp
 }
 
 }
diff --git a/WebCore/plugins/PluginMainThreadScheduler.h b/WebCore/plugins/PluginMainThreadScheduler.h
index 8872d56..610e89c 100644
--- a/WebCore/plugins/PluginMainThreadScheduler.h
+++ b/WebCore/plugins/PluginMainThreadScheduler.h
@@ -36,7 +36,7 @@ typedef NPP_t* NPP;
 
 namespace WebCore {
 
-class PluginMainThreadScheduler {
+class PluginMainThreadScheduler : public Noncopyable {
 public:
     typedef void MainThreadFunction(void*);
 
diff --git a/WebCore/plugins/PluginStream.cpp b/WebCore/plugins/PluginStream.cpp
index cd9f83d..4be3d13 100644
--- a/WebCore/plugins/PluginStream.cpp
+++ b/WebCore/plugins/PluginStream.cpp
@@ -120,6 +120,8 @@ void PluginStream::stop()
         m_loader->cancel();
         m_loader = 0;
     }
+
+    m_client = 0;
 }
 
 void PluginStream::startStream()
@@ -305,7 +307,7 @@ void PluginStream::destroyStream()
 
     m_streamState = StreamStopped;
 
-    if (!m_loadManually)
+    if (!m_loadManually && m_client)
         m_client->streamDidFinishLoading(this);
 
     if (!m_path.isNull()) {
diff --git a/WebCore/plugins/PluginView.cpp b/WebCore/plugins/PluginView.cpp
index 0b2f6ec..3f40000 100644
--- a/WebCore/plugins/PluginView.cpp
+++ b/WebCore/plugins/PluginView.cpp
@@ -45,7 +45,7 @@
 #include "Page.h"
 #include "FocusController.h"
 #include "PlatformMouseEvent.h"
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
 #include "PluginMessageThrottlerWin.h"
 #endif
 #include "PluginPackage.h"
@@ -141,7 +141,7 @@ void PluginView::setFrameRect(const IntRect& rect)
 #if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
     // On Windows and Symbian, always call plugin to change geometry.
     setNPWindowRect(rect);
-#elif XP_UNIX
+#elif defined(XP_UNIX)
     // On Unix, multiple calls to setNPWindow() in windowed mode causes Flash to crash
     if (m_mode == NP_FULL || !m_isWindowed)
         setNPWindowRect(rect);
@@ -337,7 +337,6 @@ void PluginView::stop()
 #endif
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-#if !PLATFORM(WX) // FIXME: Revisit this when implementing plugins for wx
 #ifdef XP_WIN
     // Unsubclass the window
     if (m_isWindowed) {
@@ -354,7 +353,6 @@ void PluginView::stop()
 #endif
     }
 #endif // XP_WIN
-#endif // !PLATFORM(WX)
 #endif // ENABLE(NETSCAPE_PLUGIN_API)
 
 #if !defined(XP_MACOSX)
@@ -877,7 +875,7 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
 #if defined(XP_UNIX) || defined(Q_WS_X11)
     , m_needsXEmbed(false)
 #endif
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
     , m_pluginWndProc(0)
     , m_lastMessage(0)
     , m_isCallingPluginWndProc(false)
@@ -890,9 +888,11 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
 #if defined(XP_MACOSX)
     , m_drawingModel(NPDrawingModel(-1))
     , m_eventModel(NPEventModel(-1))
+    , m_contextRef(0)
+    , m_fakeWindow(0)
 #endif
 #if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
-    , m_hasPendingGeometryChange(false)
+    , m_hasPendingGeometryChange(true)
     , m_drawable(0)
     , m_visual(0)
     , m_colormap(0)
@@ -1288,7 +1288,7 @@ void PluginView::paintMissingPluginIcon(GraphicsContext* context, const IntRect&
 
     context->save();
     context->clip(windowClipRect());
-    context->drawImage(nullPluginImage.get(), imageRect.location());
+    context->drawImage(nullPluginImage.get(), DeviceColorSpace, imageRect.location());
     context->restore();
 }
 
@@ -1333,4 +1333,9 @@ Node* PluginView::node() const
     return m_element;
 }
 
+String PluginView::pluginName() const
+{
+    return m_plugin->name();
+}
+
 } // namespace WebCore
diff --git a/WebCore/plugins/PluginView.h b/WebCore/plugins/PluginView.h
index 8a5706f..dd2458e 100644
--- a/WebCore/plugins/PluginView.h
+++ b/WebCore/plugins/PluginView.h
@@ -2,6 +2,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,17 +47,24 @@
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
+<<<<<<< HEAD:WebCore/plugins/PluginView.h
 #ifdef PLUGIN_SCHEDULE_TIMER
 #include "PluginTimer.h"
 #endif
 
 #if PLATFORM(WIN_OS) && PLATFORM(QT)
+=======
+#if PLATFORM(WIN_OS) && (PLATFORM(QT) || PLATFORM(WX))
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginView.h
 typedef struct HWND__* HWND;
 typedef HWND PlatformPluginWidget;
 #elif defined(ANDROID_PLUGINS)
 typedef struct PluginWidgetAndroid* PlatformPluginWidget;
 #else
 typedef PlatformWidget PlatformPluginWidget;
+#if defined(XP_MACOSX) && PLATFORM(QT)
+#include <QPixmap>
+#endif
 #endif
 
 #if USE(JSC)
@@ -79,7 +87,7 @@ namespace WebCore {
     class TouchEvent;
 #endif
     class KURL;
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
     class PluginMessageThrottlerWin;
 #endif
     class PluginPackage;
@@ -94,7 +102,7 @@ namespace WebCore {
         PluginStatusLoadedSuccessfully
     };
 
-    class PluginRequest {
+    class PluginRequest : public Noncopyable {
     public:
         PluginRequest(const FrameLoadRequest& frameLoadRequest, bool sendNotification, void* notifyData, bool shouldAllowPopups)
             : m_frameLoadRequest(frameLoadRequest)
@@ -206,7 +214,7 @@ namespace WebCore {
         const String& mimeType() const { return m_mimeType; }
         const KURL& url() const { return m_url; }
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
         static LRESULT CALLBACK PluginViewWndProc(HWND, UINT, WPARAM, LPARAM);
         LRESULT wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
         WNDPROC pluginWndProc() const { return m_pluginWndProc; }
@@ -222,6 +230,8 @@ namespace WebCore {
         virtual void halt();
         virtual void restart();
         virtual Node* node() const;
+        virtual bool isWindowed() const { return m_isWindowed; }
+        virtual String pluginName() const;
 
         bool isHalted() const { return m_isHalted; }
         bool hasBeenHalted() const { return m_hasBeenHalted; }
@@ -254,7 +264,7 @@ namespace WebCore {
 
         void invalidateWindowlessPluginRect(const IntRect&);
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
         void paintWindowedPluginIntoContext(GraphicsContext*, const IntRect&);
         static HDC WINAPI hookedBeginPaint(HWND, PAINTSTRUCT*);
         static BOOL WINAPI hookedEndPaint(HWND, const PAINTSTRUCT*);
@@ -335,7 +345,7 @@ namespace WebCore {
         bool m_needsXEmbed;
 #endif
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
         OwnPtr<PluginMessageThrottlerWin> m_messageThrottler;
         WNDPROC m_pluginWndProc;
         unsigned m_lastMessage;
@@ -344,11 +354,15 @@ namespace WebCore {
         bool m_haveUpdatedPluginWidget;
 #endif
 
+<<<<<<< HEAD:WebCore/plugins/PluginView.h
 #ifdef PLUGIN_SCHEDULE_TIMER
         PluginTimerList m_timerList;
 #endif
 
 #if (PLATFORM(QT) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
+=======
+#if ((PLATFORM(QT) || PLATFORM(WX)) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginView.h
         // On Mac OSX and Qt/Windows the plugin does not have its own native widget,
         // but is using the containing window as its reference for positioning/painting.
         PlatformPluginWidget m_window;
@@ -371,12 +385,15 @@ private:
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
-        OwnPtr<Timer<PluginView> > m_nullEventTimer;
         NPDrawingModel m_drawingModel;
         NPEventModel m_eventModel;
+        CGContextRef m_contextRef;
+        WindowRef m_fakeWindow;
+#if PLATFORM(QT)
+        QPixmap m_pixmap;
+#endif
 
         void setNPWindowIfNeeded();
-        void nullEventTimerFired(Timer<PluginView>*);
         Point globalMousePosForPlugin() const;
 #endif
 
diff --git a/WebCore/plugins/chromium/PluginDataChromium.cpp b/WebCore/plugins/chromium/PluginDataChromium.cpp
index 3df81af..5c28643 100644
--- a/WebCore/plugins/chromium/PluginDataChromium.cpp
+++ b/WebCore/plugins/chromium/PluginDataChromium.cpp
@@ -29,7 +29,7 @@
  */
 
 #include "config.h"
-#include "PluginData.h"
+#include "PluginDataChromium.h"
 
 #include "ChromiumBridge.h"
 
diff --git a/WebCore/html/canvas/CanvasArray.idl b/WebCore/plugins/chromium/PluginDataChromium.h
index 63b2dcd..78701b4 100644
--- a/WebCore/html/canvas/CanvasArray.idl
+++ b/WebCore/plugins/chromium/PluginDataChromium.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-module html {
-    interface [Conditional=3D_CANVAS, CustomToJS] CanvasArray {
-        readonly attribute long length;
-        int sizeInBytes();
-        int alignedSizeInBytes();
-    };
-}
+#ifndef PluginDataChromium_h
+#define PluginDataChromium_h
+
+#include "PluginData.h"
+
+namespace WebCore {
+
+// Checks if any of the plugins handle this extension, and if so returns the
+// plugin's mime type for this extension.  Otherwise returns an empty string.
+String getPluginMimeTypeFromExtension(const String& extension);
+
+} // namespace WebCore
+
+#endif // PluginDataChromium_h
diff --git a/WebCore/plugins/gtk/PluginViewGtk.cpp b/WebCore/plugins/gtk/PluginViewGtk.cpp
index bc3a622..6ea9417 100644
--- a/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -227,7 +227,7 @@ void PluginView::setNPWindowIfNeeded()
 
     GtkAllocation allocation = { m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height() };
     gtk_widget_size_allocate(platformPluginWidget(), &allocation);
-#if PLATFORM(XP_UNIX)
+#if defined(XP_UNIX)
     if (!m_needsXEmbed) {
         gtk_xtbin_set_position(GTK_XTBIN(platformPluginWidget()), m_windowRect.x(), m_windowRect.y());
         gtk_xtbin_resize(platformPluginWidget(), m_windowRect.width(), m_windowRect.height());
@@ -332,7 +332,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
         return NPERR_GENERIC_ERROR;
 #endif
 
-#if PLATFORM(XP_UNIX)
+#if defined(XP_UNIX)
     case NPNVxtAppContext:
         if (!m_needsXEmbed) {
             *(void **)value = XtDisplayToApplicationContext (GTK_XTBIN(platformPluginWidget())->xtclient.xtdisplay);
diff --git a/WebCore/plugins/mac/PluginPackageMac.cpp b/WebCore/plugins/mac/PluginPackageMac.cpp
index 325bc4d..4aef3a0 100644
--- a/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -177,7 +177,7 @@ bool PluginPackage::fetchInfo()
 
             WTF::RetainPtr<CFDictionaryRef> extensionsDict = (CFDictionaryRef)values[i];
 
-            WTF:RetainPtr<CFNumberRef> enabled = (CFNumberRef)CFDictionaryGetValue(extensionsDict.get(), CFSTR("WebPluginTypeEnabled"));
+            WTF::RetainPtr<CFNumberRef> enabled = (CFNumberRef)CFDictionaryGetValue(extensionsDict.get(), CFSTR("WebPluginTypeEnabled"));
             if (enabled) {
                 int enabledValue = 0;
                 if (CFNumberGetValue(enabled.get(), kCFNumberIntType, &enabledValue) && enabledValue == 0)
diff --git a/WebCore/plugins/mac/PluginViewMac.cpp b/WebCore/plugins/mac/PluginViewMac.cpp
index 6521c84..44a0262 100644
--- a/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/WebCore/plugins/mac/PluginViewMac.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -75,6 +76,7 @@ using JSC::UString;
 #if PLATFORM(QT)
 #include <QWidget>
 #include <QKeyEvent>
+#include <QPainter>
 #include "QWebPageClient.h"
 QT_BEGIN_NAMESPACE
 #if QT_VERSION < 0x040500
@@ -85,6 +87,11 @@ extern Q_GUI_EXPORT OSWindowRef qt_mac_window_for(const QWidget* w);
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(WX)
+#include <wx/defs.h>
+#include <wx/wx.h>
+#endif
+
 using std::min;
 
 using namespace WTF;
@@ -101,6 +108,10 @@ static inline WindowRef nativeWindowFor(PlatformWidget widget)
     if (widget)
         return static_cast<WindowRef>(qt_mac_window_for(widget));
 #endif
+#if PLATFORM(WX)
+    if (widget)
+        return (WindowRef)widget->MacGetTopLevelWindowRef();
+#endif
     return 0;
 }
 
@@ -110,6 +121,10 @@ static inline CGContextRef cgHandleFor(PlatformWidget widget)
     if (widget)
         return (CGContextRef)widget->macCGHandle();
 #endif
+#if PLATFORM(WX)
+    if (widget)
+        return (CGContextRef)widget->MacGetCGContextRef();
+#endif
     return 0;
 }
 
@@ -121,6 +136,12 @@ static inline IntPoint topLevelOffsetFor(PlatformWidget widget)
         return widget->mapTo(topLevel, QPoint(0, 0)) + topLevel->geometry().topLeft() - topLevel->pos();
     }
 #endif
+#if PLATFORM(WX)
+    if (widget) {
+        PlatformWidget toplevel = wxGetTopLevelParent(widget);
+        return toplevel->ScreenToClient(widget->GetScreenPosition());
+    }
+#endif
     return IntPoint();
 }
 
@@ -173,18 +194,29 @@ bool PluginView::platformStart()
     }
 
 #if PLATFORM(QT)
+    // Set the platformPluginWidget only in the case of QWebView so that the context menu appears in the right place.
+    // In all other cases, we use off-screen rendering
     if (QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient()) {
-        if (QWidget* widget = client->ownerWidget()) {
+        if (QWidget* widget = qobject_cast<QWidget*>(client->pluginParent()))
             setPlatformPluginWidget(widget);
-        }
     }
 #endif
+#if PLATFORM(WX)
+    if (wxWindow* widget = m_parentFrame->view()->hostWindow()->platformPageClient())
+        setPlatformPluginWidget(widget);
+#endif
 
-    show();
+    // Create a fake window relative to which all events will be sent when using offscreen rendering
+    if (!platformPluginWidget()) {
+        // Make the default size really big. It is unclear why this is required but with a smaller size, mouse move
+        // events don't get processed. Resizing the fake window to flash's size doesn't help.
+        ::Rect windowBounds = { 0, 0, 1000, 1000 };
+        CreateNewWindow(kDocumentWindowClass, kWindowStandardDocumentAttributes, &windowBounds, &m_fakeWindow);
+        // Flash requires the window to be hilited to process mouse move events.
+        HiliteWindow(m_fakeWindow, true); 
+    }
 
-    // TODO: Implement null timer throttling depending on plugin activation
-    m_nullEventTimer.set(new Timer<PluginView>(this, &PluginView::nullEventTimerFired));
-    m_nullEventTimer->startRepeating(0.02);
+    show();
 
     return true;
 }
@@ -193,6 +225,11 @@ void PluginView::platformDestroy()
 {
     if (platformPluginWidget())
         setPlatformPluginWidget(0);
+    else {
+        CGContextRelease(m_contextRef);
+        if (m_fakeWindow)
+            DisposeWindow(m_fakeWindow);
+    }
 }
 
 // Used before the plugin view has been initialized properly, and as a
@@ -322,7 +359,11 @@ void PluginView::setFocus()
     LOG(Plugins, "PluginView::setFocus()");
 
     if (platformPluginWidget())
+#if PLATFORM(QT)
        platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+#else
+        platformPluginWidget()->SetFocus();
+#endif
    else
        Widget::setFocus();
 
@@ -357,15 +398,21 @@ void PluginView::setNPWindowIfNeeded()
     if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
         return;
 
-    CGContextRef newContextRef = cgHandleFor(platformPluginWidget());
-    if (!newContextRef)
-        return;
+    CGContextRef newContextRef = 0;
+    WindowRef newWindowRef = 0;
+    if (platformPluginWidget()) {
+        newContextRef = cgHandleFor(platformPluginWidget());
+        newWindowRef = nativeWindowFor(platformPluginWidget());
+        m_npWindow.type = NPWindowTypeWindow;
+    } else {
+        newContextRef = m_contextRef;
+        newWindowRef = m_fakeWindow;
+        m_npWindow.type = NPWindowTypeDrawable;
+    }
 
-    WindowRef newWindowRef = nativeWindowFor(platformPluginWidget());
-    if (!newWindowRef)
+    if (!newContextRef || !newWindowRef)
         return;
 
-    m_npWindow.type = NPWindowTypeWindow;
     m_npWindow.window = (void*)&m_npCgContext;
     m_npCgContext.window = newWindowRef;
     m_npCgContext.context = newContextRef;
@@ -382,7 +429,7 @@ void PluginView::setNPWindowIfNeeded()
     m_npWindow.clipRect.bottom = m_windowRect.y() + m_windowRect.height();
 
     LOG(Plugins, "PluginView::setNPWindowIfNeeded(): window=%p, context=%p,"
-            " window.x:%d window.y:%d window.width:%d window.height:%d window.clipRect size:%dx%d",
+            " window.x:%ld window.y:%ld window.width:%d window.height:%d window.clipRect size:%dx%d",
             newWindowRef, newContextRef, m_npWindow.x, m_npWindow.y, m_npWindow.width, m_npWindow.height,
             m_npWindow.clipRect.right - m_npWindow.clipRect.left, m_npWindow.clipRect.bottom - m_npWindow.clipRect.top);
 
@@ -409,6 +456,17 @@ void PluginView::updatePluginWidget()
     IntPoint offset = topLevelOffsetFor(platformPluginWidget());
     m_windowRect.move(offset.x(), offset.y());
 
+    if (!platformPluginWidget()) {
+        if (m_windowRect.size() != oldWindowRect.size()) {
+            CGContextRelease(m_contextRef);
+#if PLATFORM(QT)
+            m_pixmap = QPixmap(m_windowRect.size());
+            m_pixmap.fill(Qt::transparent);
+            m_contextRef = qt_mac_cg_context(&m_pixmap);
+#endif
+        }
+    }
+
     m_clipRect = windowClipRect();
     m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
 
@@ -433,8 +491,29 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         return;
 
     CGContextSaveGState(cgContext);
-    IntPoint offset = frameRect().location();
-    CGContextTranslateCTM(cgContext, offset.x(), offset.y());
+    if (platformPluginWidget()) {
+        IntPoint offset = frameRect().location();
+        CGContextTranslateCTM(cgContext, offset.x(), offset.y());
+    }
+
+    IntRect targetRect(frameRect());
+    targetRect.intersects(rect);
+
+    // clip the context so that plugin only updates the interested area.
+    CGRect r;
+    r.origin.x = targetRect.x() - frameRect().x();
+    r.origin.y = targetRect.y() - frameRect().y();
+    r.size.width = targetRect.width();
+    r.size.height = targetRect.height();
+    CGContextClipToRect(cgContext, r);
+
+    if (!platformPluginWidget() && m_isTransparent) { // clean the pixmap in transparent mode
+#if PLATFORM(QT)
+        QPainter painter(&m_pixmap);
+        painter.setCompositionMode(QPainter::CompositionMode_Clear);
+        painter.fillRect(QRectF(r.origin.x, r.origin.y, r.size.width, r.size.height), Qt::transparent);
+#endif
+    }
 
     EventRecord event;
     event.what = updateEvt;
@@ -448,18 +527,32 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         LOG(Events, "PluginView::paint(): Paint event not accepted");
 
     CGContextRestoreGState(cgContext);
+
+    if (!platformPluginWidget()) {
+#if PLATFORM(QT)
+        QPainter* painter = context->platformContext();
+        painter->drawPixmap(targetRect.x(), targetRect.y(), m_pixmap, 
+                            targetRect.x() - frameRect().x(), targetRect.y() - frameRect().y(), targetRect.width(), targetRect.height());
+#endif
+    }
 }
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
     if (platformPluginWidget())
+#if PLATFORM(QT)
         platformPluginWidget()->update(convertToContainingWindow(rect));
+#else
+        platformPluginWidget()->RefreshRect(convertToContainingWindow(rect));
+#endif
+    else
+        invalidateWindowlessPluginRect(rect);
 }
 
 void PluginView::invalidateRect(NPRect* rect)
 {
-    // TODO: optimize
-    invalidate();
+    IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
+    invalidateRect(r);
 }
 
 void PluginView::invalidateRegion(NPRegion region)
@@ -484,8 +577,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     EventRecord record;
 
     if (event->type() == eventNames().mousemoveEvent) {
-        // Mouse movement is handled by null timer events
-        return;
+        record.what = nullEvent;
     } else if (event->type() == eventNames().mouseoverEvent) {
         record.what = adjustCursorEvent;
     } else if (event->type() == eventNames().mouseoutEvent) {
@@ -502,7 +594,20 @@ void PluginView::handleMouseEvent(MouseEvent* event)
         return;
     }
 
-    record.where = globalMousePosForPlugin();
+    if (platformPluginWidget()) {
+        record.where = globalMousePosForPlugin();
+    } else {
+        if (event->button() == 2) {
+            // always pass the global position for right-click since Flash uses it to position the context menu
+            record.where = globalMousePosForPlugin();
+        } else {
+            IntPoint postZoomPos = roundedIntPoint(m_element->renderer()->absoluteToLocal(event->absoluteLocation()));
+            record.where.h = postZoomPos.x() + m_windowRect.x();
+            // The number 22 is the height of the title bar. As to why it figures in the calculation below 
+            // is left as an exercise to the reader :-)
+            record.where.v = postZoomPos.y() + m_windowRect.y() - 22;
+        }
+    }
     record.modifiers = modifiersForEvent(event);
 
     if (!event->buttonDown())
@@ -583,8 +688,10 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
 
     LOG(Plugins, "PV::hKE(): record.modifiers: %d", record.modifiers);
 
+#if PLATFORM(QT)
     LOG(Plugins, "PV::hKE(): PKE.qtEvent()->nativeVirtualKey: 0x%02X, charCode: %d",
                keyCode, int(uchar(charCodes[0])));
+#endif
 
     if (!dispatchNPEvent(record))
         LOG(Events, "PluginView::handleKeyboardEvent(): Keyboard event type %d not accepted", record.what);
@@ -592,22 +699,6 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
         event->setDefaultHandled();
 }
 
-void PluginView::nullEventTimerFired(Timer<PluginView>*)
-{
-    EventRecord record;
-
-    record.what = nullEvent;
-    record.message = 0;
-    record.when = TickCount();
-    record.where = globalMousePosForPlugin();
-    record.modifiers = GetCurrentKeyModifiers();
-    if (!Button())
-        record.modifiers |= btnState;
-
-    if (!dispatchNPEvent(record))
-        LOG(Events, "PluginView::nullEventTimerFired(): Null event not accepted");
-}
-
 static int modifiersForEvent(UIEventWithKeyState* event)
 {
     int modifiers = 0;
@@ -649,6 +740,18 @@ Point PluginView::globalMousePosForPlugin() const
     pos.h = short(pos.h * scaleFactor);
     pos.v = short(pos.v * scaleFactor);
 
+#if PLATFORM(WX)
+    // make sure the titlebar/toolbar size is included
+    WindowRef windowRef = nativeWindowFor(platformPluginWidget());
+    ::Rect content, structure;
+
+    GetWindowBounds(windowRef, kWindowStructureRgn, &structure);
+    GetWindowBounds(windowRef, kWindowContentRgn, &content);
+
+    int top = content.top  - structure.top;
+    pos.v -= top;
+#endif
+
     return pos;
 }
 
diff --git a/WebCore/plugins/qt/PluginDataQt.cpp b/WebCore/plugins/qt/PluginDataQt.cpp
index 5478d38..a836937 100644
--- a/WebCore/plugins/qt/PluginDataQt.cpp
+++ b/WebCore/plugins/qt/PluginDataQt.cpp
@@ -24,18 +24,15 @@
 #include "PluginDatabase.h"
 #include "PluginPackage.h"
 
-#if QT_VERSION >= 0x040400
 #include "ChromeClientQt.h"
 #include "Page.h"
 #include <qwebpage.h>
 #include <qwebpluginfactory.h>
-#endif
 
 namespace WebCore {
 
 void PluginData::initPlugins()
 {
-#if QT_VERSION >= 0x040400
     QWebPage* webPage = static_cast<ChromeClientQt*>(m_page->chrome()->client())->m_webPage;
     QWebPluginFactory* factory = webPage->pluginFactory();
     if (factory) {
@@ -62,7 +59,6 @@ void PluginData::initPlugins()
             m_plugins.append(info);
         }
     }
-#endif
 
     PluginDatabase *db = PluginDatabase::installedPlugins();
     const Vector<PluginPackage*> &plugins = db->plugins();
diff --git a/WebCore/plugins/qt/PluginViewQt.cpp b/WebCore/plugins/qt/PluginViewQt.cpp
index e61736b..063a7e5 100644
--- a/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/WebCore/plugins/qt/PluginViewQt.cpp
@@ -138,26 +138,14 @@ void PluginView::setFocus()
 
 void PluginView::show()
 {
-    setSelfVisible(true);
-
-    if (isParentVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(true);
-
-    // do not call parent impl. here as it will set the platformWidget
-    // (same as platformPluginWidget in the Qt port) to visible, even
-    // when parent isn't visible.
+    Q_ASSERT(platformPluginWidget() == platformWidget());
+    Widget::show();
 }
 
 void PluginView::hide()
 {
-    setSelfVisible(false);
-
-    if (isParentVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(false);
-
-    // do not call parent impl. here as it will set the platformWidget
-    // (same as platformPluginWidget in the Qt port) to invisible, even
-    // when parent isn't visible.
+    Q_ASSERT(platformPluginWidget() == platformWidget());
+    Widget::hide();
 }
 
 void PluginView::paint(GraphicsContext* context, const IntRect& rect)
diff --git a/WebCore/plugins/win/PluginViewWin.cpp b/WebCore/plugins/win/PluginViewWin.cpp
index 5ccce0e..89eecc6 100644
--- a/WebCore/plugins/win/PluginViewWin.cpp
+++ b/WebCore/plugins/win/PluginViewWin.cpp
@@ -30,7 +30,9 @@
 #include "PluginView.h"
 
 #include "BitmapImage.h"
+#if !PLATFORM(WX)
 #include "BitmapInfo.h"
+#endif
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -81,12 +83,21 @@
 #include <QWidget>
 #endif
 
+#if PLATFORM(WX)
+#include <wx/defs.h>
+#include <wx/window.h>
+#endif
+
 static inline HWND windowHandleForPageClient(PlatformPageClient client)
 {
 #if PLATFORM(QT)
     if (!client)
         return 0;
     return client->ownerWidget()->winId();
+#elif PLATFORM(WX)
+    if (!client)
+        return 0;
+    return (HWND)client->GetHandle();
 #else
     return client;
 #endif
@@ -145,7 +156,7 @@ HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
          "push    %3\n"
          "call    *%4\n"
          : "=a" (result)
-         : "a" (beginPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (*beginPaint)
+         : "a" (beginPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (beginPaint)
          : "memory"
         );
     return result;
@@ -175,7 +186,7 @@ BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
          "push   %3\n"
          "call   *%4\n"
          : "=a" (result)
-         : "a" (endPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (*endPaint)
+         : "a" (endPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (endPaint)
         );
     return result;
 #elif defined (_M_IX86)
@@ -702,7 +713,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
 
-#if !PLATFORM(QT) && !PLATFORM(WINCE)
+#if !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(WINCE)
     // Currently, Widget::setCursor is always called after this function in EventHandler.cpp
     // and since we don't want that we set ignoreNextSetCursor to true here to prevent that.
     ignoreNextSetCursor = true;
@@ -987,7 +998,7 @@ bool PluginView::platformStart()
         HWND window = ::CreateWindowEx(0, kWebPluginViewdowClassName, 0, flags,
                                        0, 0, 0, 0, parentWindowHandle, 0, Page::instanceHandle(), 0);
 
-#if PLATFORM(WIN_OS) && PLATFORM(QT)
+#if PLATFORM(WIN_OS) && (PLATFORM(QT) || PLATFORM(WX))
         m_window = window;
 #else
         setPlatformWidget(window);
@@ -1030,6 +1041,7 @@ void PluginView::platformDestroy()
 
 PassRefPtr<Image> PluginView::snapshot()
 {
+#if !PLATFORM(WX)
     OwnPtr<HDC> hdc(CreateCompatibleDC(0));
 
     if (!m_isWindowed) {
@@ -1059,6 +1071,9 @@ PassRefPtr<Image> PluginView::snapshot()
     SelectObject(hdc.get(), hbmpOld);
 
     return BitmapImage::create(hbmp.get());
+#else
+    return 0;
+#endif
 }
 
 void PluginView::halt()
diff --git a/WebCore/plugins/wx/PluginDataWx.cpp b/WebCore/plugins/wx/PluginDataWx.cpp
new file mode 100644
index 0000000..58ee315
--- /dev/null
+++ b/WebCore/plugins/wx/PluginDataWx.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2008 Kevin Ollivier <kevino@theolliviers.com> All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+#include "PluginData.h"
+
+#include "NotImplemented.h"
+#include "PluginDatabase.h"
+#include "PluginPackage.h"
+
+namespace WebCore {
+
+void PluginData::initPlugins()
+{
+    PluginDatabase* db = PluginDatabase::installedPlugins();
+    const Vector<PluginPackage*> &plugins = db->plugins();
+
+    for (unsigned int i = 0; i < plugins.size(); ++i) {
+        PluginInfo* info = new PluginInfo;
+        PluginPackage* package = plugins[i];
+
+        info->name = package->name();
+        info->file = package->fileName();
+        info->desc = package->description();
+
+        const MIMEToDescriptionsMap& mimeToDescriptions = package->mimeToDescriptions();
+        MIMEToDescriptionsMap::const_iterator end = mimeToDescriptions.end();
+        for (MIMEToDescriptionsMap::const_iterator it = mimeToDescriptions.begin(); it != end; ++it) {
+            MimeClassInfo* mime = new MimeClassInfo;
+            info->mimes.append(mime);
+
+            mime->type = it->first;
+            mime->desc = it->second;
+            mime->plugin = info;
+
+            Vector<String> extensions = package->mimeToExtensions().get(mime->type);
+
+            for (unsigned i = 0; i < extensions.size(); i++) {
+                if (i > 0)
+                    mime->suffixes += ",";
+
+                mime->suffixes += extensions[i];
+            }
+        }
+
+        m_plugins.append(info);
+    }
+}
+
+void PluginData::refresh()
+{
+    notImplemented();
+}
+
+};
diff --git a/WebCore/rendering/AutoTableLayout.h b/WebCore/rendering/AutoTableLayout.h
index 641a68b..f1ef768 100644
--- a/WebCore/rendering/AutoTableLayout.h
+++ b/WebCore/rendering/AutoTableLayout.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  *
diff --git a/WebCore/rendering/CounterNode.cpp b/WebCore/rendering/CounterNode.cpp
index f546abb..95a3748 100644
--- a/WebCore/rendering/CounterNode.cpp
+++ b/WebCore/rendering/CounterNode.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
  *
@@ -46,7 +44,58 @@ CounterNode::CounterNode(RenderObject* o, bool isReset, int value)
     , m_nextSibling(0)
     , m_firstChild(0)
     , m_lastChild(0)
-{   
+{
+}
+
+CounterNode* CounterNode::nextInPreOrderAfterChildren(const CounterNode* stayWithin) const
+{
+    if (this == stayWithin)
+        return 0;
+
+    CounterNode* next = m_nextSibling;
+    if (next)
+        return next;
+    next = m_parent;
+    while (next && !next->m_nextSibling) {
+        if (next == stayWithin)
+            return 0;
+        next = next->m_parent;
+    }
+    if (next)
+        return next->m_nextSibling;
+    return 0;
+}
+
+CounterNode* CounterNode::nextInPreOrder(const CounterNode* stayWithin) const
+{
+    if (CounterNode* next = m_firstChild)
+        return next;
+
+    return nextInPreOrderAfterChildren(stayWithin);
+}
+
+CounterNode* CounterNode::lastDescendant() const
+{
+    CounterNode* last = m_lastChild;
+    if (!last)
+        return 0;
+
+    while (CounterNode* lastChild = last->m_lastChild)
+        last = lastChild;
+
+    return last;
+}
+
+CounterNode* CounterNode::previousInPreOrder() const
+{
+    CounterNode* previous = m_previousSibling;
+    if (!previous)
+        return m_parent;
+
+    while (CounterNode* lastChild = previous->m_lastChild)
+        previous = lastChild;
+
+    return previous;
 }
 
 int CounterNode::computeCountInParent() const
@@ -58,26 +107,37 @@ int CounterNode::computeCountInParent() const
     return m_parent->m_value + increment;
 }
 
-void CounterNode::recount()
+
+void CounterNode::resetRenderer(const AtomicString& identifier) const
+{
+    if (!m_renderer || m_renderer->documentBeingDestroyed())
+        return;
+    if (RenderObjectChildList* children = m_renderer->virtualChildren())
+        children->invalidateCounters(m_renderer, identifier);
+}
+
+void CounterNode::resetRenderers(const AtomicString& identifier) const
+{
+    const CounterNode* node = this;
+    do {
+        node->resetRenderer(identifier);
+        node = node->nextInPreOrder(this);
+    } while (node);
+}
+
+void CounterNode::recount(const AtomicString& identifier)
 {
-    for (CounterNode* c = this; c; c = c->m_nextSibling) {
-        int oldCount = c->m_countInParent;
-        int newCount = c->computeCountInParent();
+    for (CounterNode* node = this; node; node = node->m_nextSibling) {
+        int oldCount = node->m_countInParent;
+        int newCount = node->computeCountInParent();
         if (oldCount == newCount)
             break;
-        c->m_countInParent = newCount;
-        // m_renderer contains the parent of the render node
-        // corresponding to a CounterNode. Let's find the counter
-        // child and make this re-layout.
-        for (RenderObject* o = c->m_renderer->firstChild(); o; o = o->nextSibling())
-            if (!o->documentBeingDestroyed() && o->isCounter()) {
-                o->setNeedsLayoutAndPrefWidthsRecalc();
-                break;
-            }
+        node->m_countInParent = newCount;
+        node->resetRenderers(identifier);
     }
 }
 
-void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild)
+void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild, const AtomicString& identifier)
 {
     ASSERT(newChild);
     ASSERT(!newChild->m_parent);
@@ -109,77 +169,56 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild)
 
     newChild->m_countInParent = newChild->computeCountInParent();
     if (next)
-        next->recount();
+        next->recount(identifier);
 }
 
-void CounterNode::removeChild(CounterNode* oldChild)
+void CounterNode::removeChild(CounterNode* oldChild, const AtomicString& identifier)
 {
     ASSERT(oldChild);
     ASSERT(!oldChild->m_firstChild);
     ASSERT(!oldChild->m_lastChild);
 
     CounterNode* next = oldChild->m_nextSibling;
-    CounterNode* prev = oldChild->m_previousSibling;
+    CounterNode* previous = oldChild->m_previousSibling;
 
     oldChild->m_nextSibling = 0;
     oldChild->m_previousSibling = 0;
     oldChild->m_parent = 0;
 
-    if (prev) 
-        prev->m_nextSibling = next;
+    if (previous) 
+        previous->m_nextSibling = next;
     else {
         ASSERT(m_firstChild == oldChild);
         m_firstChild = next;
     }
-    
+
     if (next)
-        next->m_previousSibling = prev;
+        next->m_previousSibling = previous;
     else {
         ASSERT(m_lastChild == oldChild);
-        m_lastChild = prev;
+        m_lastChild = previous;
     }
-    
+
     if (next)
-        next->recount();
+        next->recount(identifier);
 }
 
 #ifndef NDEBUG
 
-static const CounterNode* nextInPreOrderAfterChildren(const CounterNode* node)
-{
-    CounterNode* next = node->nextSibling();
-    if (!next) {
-        next = node->parent();
-        while (next && !next->nextSibling())
-            next = next->parent();
-        if (next)
-            next = next->nextSibling();
-    }
-    return next;
-}
-
-static const CounterNode* nextInPreOrder(const CounterNode* node)
-{
-    if (CounterNode* child = node->firstChild())
-        return child;
-    return nextInPreOrderAfterChildren(node);
-}
-
 static void showTreeAndMark(const CounterNode* node)
 {
     const CounterNode* root = node;
     while (root->parent())
         root = root->parent();
 
-    for (const CounterNode* c = root; c; c = nextInPreOrder(c)) {
-        if (c == node)
-            fprintf(stderr, "*");
-        for (const CounterNode* d = c; d && d != root; d = d->parent())
-            fprintf(stderr, "\t");
-        if (c->isReset())
-            fprintf(stderr, "reset: %d %d\n", c->value(), c->countInParent());
-        else
-            fprintf(stderr, "increment: %d %d\n", c->value(), c->countInParent());
+    for (const CounterNode* current = root; current; current = current->nextInPreOrder()) {
+        fwrite((current == node) ? "*" : " ", 1, 1, stderr);
+        for (const CounterNode* parent = current; parent && parent != root; parent = parent->parent())
+            fwrite("  ", 1, 2, stderr);
+        fprintf(stderr, "%p %s: %d %d P:%p PS:%p NS:%p R:%p\n",
+            current, current->isReset() ? "reset____" : "increment", current->value(),
+            current->countInParent(), current->parent(), current->previousSibling(),
+            current->nextSibling(), current->renderer());
     }
 }
 
diff --git a/WebCore/rendering/CounterNode.h b/WebCore/rendering/CounterNode.h
index b432e1d..8081dc6 100644
--- a/WebCore/rendering/CounterNode.h
+++ b/WebCore/rendering/CounterNode.h
@@ -35,6 +35,7 @@
 
 namespace WebCore {
 
+class AtomicString;
 class RenderObject;
 
 class CounterNode : public Noncopyable {
@@ -51,13 +52,19 @@ public:
     CounterNode* nextSibling() const { return m_nextSibling; }
     CounterNode* firstChild() const { return m_firstChild; }
     CounterNode* lastChild() const { return m_lastChild; }
+    CounterNode* lastDescendant() const;
+    CounterNode* previousInPreOrder() const;
+    CounterNode* nextInPreOrder(const CounterNode* stayWithin = 0) const;
+    CounterNode* nextInPreOrderAfterChildren(const CounterNode* stayWithin = 0) const;
 
-    void insertAfter(CounterNode* newChild, CounterNode* beforeChild);
-    void removeChild(CounterNode*);
+    void insertAfter(CounterNode* newChild, CounterNode* beforeChild, const AtomicString& identifier);
+    void removeChild(CounterNode*, const AtomicString& identifier);
 
 private:
     int computeCountInParent() const;
-    void recount();
+    void recount(const AtomicString& identifier);
+    void resetRenderer(const AtomicString& identifier) const;
+    void resetRenderers(const AtomicString& identifier) const;
 
     bool m_isReset;
     int m_value;
diff --git a/WebCore/rendering/EllipsisBox.cpp b/WebCore/rendering/EllipsisBox.cpp
index db9a101..bea9d73 100644
--- a/WebCore/rendering/EllipsisBox.cpp
+++ b/WebCore/rendering/EllipsisBox.cpp
@@ -1,6 +1,4 @@
 /**
-* This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -34,11 +32,11 @@ void EllipsisBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     RenderStyle* style = m_renderer->style(m_firstLine);
     Color textColor = style->color();
     if (textColor != context->fillColor())
-        context->setFillColor(textColor);
+        context->setFillColor(textColor, style->colorSpace());
     bool setShadow = false;
     if (style->textShadow()) {
         context->setShadow(IntSize(style->textShadow()->x, style->textShadow()->y),
-                           style->textShadow()->blur, style->textShadow()->color);
+                           style->textShadow()->blur, style->textShadow()->color, style->colorSpace());
         setShadow = true;
     }
 
diff --git a/WebCore/rendering/EllipsisBox.h b/WebCore/rendering/EllipsisBox.h
index 9dbd27f..a228d7a 100644
--- a/WebCore/rendering/EllipsisBox.h
+++ b/WebCore/rendering/EllipsisBox.h
@@ -1,6 +1,4 @@
 /**
-* This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/FixedTableLayout.cpp b/WebCore/rendering/FixedTableLayout.cpp
index 4852708..09af518 100644
--- a/WebCore/rendering/FixedTableLayout.cpp
+++ b/WebCore/rendering/FixedTableLayout.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
diff --git a/WebCore/rendering/FixedTableLayout.h b/WebCore/rendering/FixedTableLayout.h
index ed7c089..758ddbb 100644
--- a/WebCore/rendering/FixedTableLayout.h
+++ b/WebCore/rendering/FixedTableLayout.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  *
diff --git a/WebCore/rendering/HitTestRequest.h b/WebCore/rendering/HitTestRequest.h
index 46dd7b8..ca1445a 100644
--- a/WebCore/rendering/HitTestRequest.h
+++ b/WebCore/rendering/HitTestRequest.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
  *
diff --git a/WebCore/rendering/HitTestResult.h b/WebCore/rendering/HitTestResult.h
index 25e1058..d1906ba 100644
--- a/WebCore/rendering/HitTestResult.h
+++ b/WebCore/rendering/HitTestResult.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/InlineFlowBox.cpp b/WebCore/rendering/InlineFlowBox.cpp
index baea956..2bd1683 100644
--- a/WebCore/rendering/InlineFlowBox.cpp
+++ b/WebCore/rendering/InlineFlowBox.cpp
@@ -974,6 +974,7 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
             setClip = true;
         }
 
+        ColorSpace colorSpace = renderer()->style()->colorSpace();
         bool setShadow = false;
         do {
             if (shadow) {
@@ -982,24 +983,24 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
                     ty -= extraOffset;
                     extraOffset = 0;
                 }
-                context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color);
+                context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color, colorSpace);
                 setShadow = true;
                 shadow = shadow->next;
             }
 
             if (paintUnderline) {
-                context->setStrokeColor(underline);
+                context->setStrokeColor(underline, colorSpace);
                 context->setStrokeStyle(SolidStroke);
                 // Leave one pixel of white between the baseline and the underline.
                 context->drawLineForText(IntPoint(tx, ty + baselinePos + 1), w, isPrinting);
             }
             if (paintOverline) {
-                context->setStrokeColor(overline);
+                context->setStrokeColor(overline, colorSpace);
                 context->setStrokeStyle(SolidStroke);
                 context->drawLineForText(IntPoint(tx, ty), w, isPrinting);
             }
             if (paintLineThrough) {
-                context->setStrokeColor(linethrough);
+                context->setStrokeColor(linethrough, colorSpace);
                 context->setStrokeStyle(SolidStroke);
                 context->drawLineForText(IntPoint(tx, ty + 2 * baselinePos / 3), w, isPrinting);
             }
diff --git a/WebCore/rendering/InlineRunBox.h b/WebCore/rendering/InlineRunBox.h
index 0f7c29b..cbc82d5 100644
--- a/WebCore/rendering/InlineRunBox.h
+++ b/WebCore/rendering/InlineRunBox.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the line box implementation for KDE.
- *
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/InlineTextBox.cpp b/WebCore/rendering/InlineTextBox.cpp
index 751340d..31e6967 100644
--- a/WebCore/rendering/InlineTextBox.cpp
+++ b/WebCore/rendering/InlineTextBox.cpp
@@ -214,7 +214,7 @@ Color correctedTextColor(Color textColor, Color backgroundColor)
     return textColor.light();
 }
 
-void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness)
+void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness, ColorSpace colorSpace)
 {
     int mode = context->textDrawingMode();
     if (strokeThickness > 0) {
@@ -225,12 +225,12 @@ void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, con
         }
     }
     
-    if (mode & cTextFill && fillColor != context->fillColor())
-        context->setFillColor(fillColor);
+    if (mode & cTextFill && (fillColor != context->fillColor() || colorSpace != context->fillColorSpace()))
+        context->setFillColor(fillColor, colorSpace);
 
     if (mode & cTextStroke) {
         if (strokeColor != context->strokeColor())
-            context->setStrokeColor(strokeColor);
+            context->setStrokeColor(strokeColor, colorSpace);
         if (strokeThickness != context->strokeThickness())
             context->setStrokeThickness(strokeThickness);
     }
@@ -257,9 +257,10 @@ bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, in
 static void paintTextWithShadows(GraphicsContext* context, const Font& font, const TextRun& textRun, int startOffset, int endOffset, const IntPoint& textOrigin, int x, int y, int w, int h, ShadowData* shadow, bool stroked)
 {
     Color fillColor = context->fillColor();
+    ColorSpace fillColorSpace = context->fillColorSpace();
     bool opaque = fillColor.alpha() == 255;
     if (!opaque)
-        context->setFillColor(Color::black);
+        context->setFillColor(Color::black, fillColorSpace);
 
     do {
         IntSize extraOffset;
@@ -279,9 +280,9 @@ static void paintTextWithShadows(GraphicsContext* context, const Font& font, con
                 extraOffset = IntSize(0, 2 * h + max(0, shadowOffset.height()) + shadowBlur);
                 shadowOffset -= extraOffset;
             }
-            context->setShadow(shadowOffset, shadowBlur, shadowColor);
+            context->setShadow(shadowOffset, shadowBlur, shadowColor, fillColorSpace);
         } else if (!opaque)
-            context->setFillColor(fillColor);
+            context->setFillColor(fillColor, fillColorSpace);
 
         if (startOffset <= endOffset)
             context->drawText(font, textRun, textOrigin + extraOffset, startOffset, endOffset);
@@ -465,7 +466,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         if (textStrokeWidth > 0)
             context->save();
 
-        updateGraphicsContext(context, textFillColor, textStrokeColor, textStrokeWidth);
+        updateGraphicsContext(context, textFillColor, textStrokeColor, textStrokeWidth, styleToUse->colorSpace());
         if (!paintSelectedTextSeparately || ePos <= sPos) {
             // FIXME: Truncate right-to-left text correctly.
             paintTextWithShadows(context, font, textRun, 0, m_truncation == cNoTruncation ? m_len : m_truncation, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
@@ -481,7 +482,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         if (selectionStrokeWidth > 0)
             context->save();
 
-        updateGraphicsContext(context, selectionFillColor, selectionStrokeColor, selectionStrokeWidth);
+        updateGraphicsContext(context, selectionFillColor, selectionStrokeColor, selectionStrokeWidth, styleToUse->colorSpace());
         paintTextWithShadows(context, font, textRun, sPos, ePos, textOrigin, m_x + tx, m_y + ty, width(), height(), selectionShadow, selectionStrokeWidth > 0);
 
         if (selectionStrokeWidth > 0)
@@ -490,7 +491,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 
     // Paint decorations
     if (d != TDNONE && paintInfo.phase != PaintPhaseSelection && styleToUse->htmlHacks()) {
-        context->setStrokeColor(styleToUse->color());
+        context->setStrokeColor(styleToUse->color(), styleToUse->colorSpace());
         paintDecoration(context, tx, ty, d, textShadow);
     }
 
@@ -561,13 +562,13 @@ void InlineTextBox::paintSelection(GraphicsContext* context, int tx, int ty, Ren
         c = Color(0xff - c.red(), 0xff - c.green(), 0xff - c.blue());
 
     context->save();
-    updateGraphicsContext(context, c, c, 0);  // Don't draw text at all!
+    updateGraphicsContext(context, c, c, 0, style->colorSpace());  // Don't draw text at all!
     int y = selectionTop();
     int h = selectionHeight();
     context->clip(IntRect(m_x + tx, y + ty, m_width, h));
     context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, 
                                   direction() == RTL, m_dirOverride || style->visuallyOrdered()),
-                                  IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
+                                  IntPoint(m_x + tx, y + ty), h, c, style->colorSpace(), sPos, ePos);
     context->restore();
 }
 
@@ -584,13 +585,13 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, int tx,
 
     Color c = Color(225, 221, 85);
     
-    updateGraphicsContext(context, c, c, 0); // Don't draw text at all!
+    updateGraphicsContext(context, c, c, 0, style->colorSpace()); // Don't draw text at all!
 
     int y = selectionTop();
     int h = selectionHeight();
     context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd,
                                   direction() == RTL, m_dirOverride || style->visuallyOrdered()),
-                                  IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
+                                  IntPoint(m_x + tx, y + ty), h, c, style->colorSpace(), sPos, ePos);
     context->restore();
 }
 
@@ -660,6 +661,7 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
         setClip = true;
     }
 
+    ColorSpace colorSpace = renderer()->style()->colorSpace();
     bool setShadow = false;
     
     do {
@@ -669,24 +671,24 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
                 ty -= extraOffset;
                 extraOffset = 0;
             }
-            context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color);
+            context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color, colorSpace);
             setShadow = true;
             shadow = shadow->next;
         }
 
         if (deco & UNDERLINE) {
-            context->setStrokeColor(underline);
+            context->setStrokeColor(underline, colorSpace);
             context->setStrokeStyle(SolidStroke);
             // Leave one pixel of white between the baseline and the underline.
             context->drawLineForText(IntPoint(tx, ty + baseline + 1), width, isPrinting);
         }
         if (deco & OVERLINE) {
-            context->setStrokeColor(overline);
+            context->setStrokeColor(overline, colorSpace);
             context->setStrokeStyle(SolidStroke);
             context->drawLineForText(IntPoint(tx, ty), width, isPrinting);
         }
         if (deco & LINE_THROUGH) {
-            context->setStrokeColor(linethrough);
+            context->setStrokeColor(linethrough, colorSpace);
             context->setStrokeStyle(SolidStroke);
             context->drawLineForText(IntPoint(tx, ty + 2 * baseline / 3), width, isPrinting);
         }
@@ -698,7 +700,7 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
         context->clearShadow();
 }
 
-void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font, bool grammar)
+void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, int ty, const DocumentMarker& marker, RenderStyle* style, const Font& font, bool grammar)
 {
     // Never print spelling/grammar markers (5327887)
     if (textRenderer()->document()->printing())
@@ -737,8 +739,11 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, in
         
         // Store rendered rects for bad grammar markers, so we can hit-test against it elsewhere in order to
         // display a toolTip. We don't do this for misspelling markers.
-        if (grammar)
+        if (grammar) {
+            markerRect.move(-tx, -ty);
+            markerRect = renderer()->localToAbsoluteQuad(FloatRect(markerRect)).enclosingBoundingBox();
             renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
+        }
     }
     
     // IMPORTANT: The misspelling underline is not considered when calculating the text bounds, so we have to
@@ -761,7 +766,7 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, in
     pt->drawLineForMisspellingOrBadGrammar(IntPoint(tx + m_x + start, ty + m_y + underlineOffset), width, grammar);
 }
 
-void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font)
+void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, const DocumentMarker& marker, RenderStyle* style, const Font& font)
 {
     // Use same y positioning and height as for selection, so that when the selection and this highlight are on
     // the same word there are no pieces sticking out.
@@ -771,10 +776,10 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, Do
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
     TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
-    IntPoint startPoint = IntPoint(m_x + tx, y + ty);
     
-    // Always compute and store the rect associated with this marker
-    IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, sPos, ePos));
+    // Always compute and store the rect associated with this marker. The computed rect is in absolute coordinates.
+    IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, IntPoint(m_x, y), h, sPos, ePos));
+    markerRect = root()->block()->localToAbsoluteQuad(FloatRect(markerRect)).enclosingBoundingBox();
     renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
      
     // Optionally highlight the text
@@ -783,14 +788,14 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, Do
             renderer()->theme()->platformActiveTextSearchHighlightColor() :
             renderer()->theme()->platformInactiveTextSearchHighlightColor();
         pt->save();
-        updateGraphicsContext(pt, color, color, 0);  // Don't draw text at all!
+        updateGraphicsContext(pt, color, color, 0, style->colorSpace());  // Don't draw text at all!
         pt->clip(IntRect(tx + m_x, ty + y, m_width, h));
-        pt->drawHighlightForText(font, run, startPoint, h, color, sPos, ePos);
+        pt->drawHighlightForText(font, run, IntPoint(m_x + tx, y + ty), h, color, style->colorSpace(), sPos, ePos);
         pt->restore();
     }
 }
 
-void InlineTextBox::computeRectForReplacementMarker(int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font)
+void InlineTextBox::computeRectForReplacementMarker(int /*tx*/, int /*ty*/, const DocumentMarker& marker, RenderStyle* style, const Font& font)
 {
     // Replacement markers are not actually drawn, but their rects need to be computed for hit testing.
     int y = selectionTop();
@@ -799,10 +804,11 @@ void InlineTextBox::computeRectForReplacementMarker(int tx, int ty, DocumentMark
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
     TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
-    IntPoint startPoint = IntPoint(m_x + tx, y + ty);
+    IntPoint startPoint = IntPoint(m_x, y);
     
     // Compute and store the rect associated with this marker.
     IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, sPos, ePos));
+    markerRect = root()->block()->localToAbsoluteQuad(FloatRect(markerRect)).enclosingBoundingBox();
     renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
 }
     
@@ -817,7 +823,7 @@ void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, int tx, int ty, Re
     // Give any document markers that touch this run a chance to draw before the text has been drawn.
     // Note end() points at the last char, not one past it like endOffset and ranges do.
     for ( ; markerIt != markers.end(); markerIt++) {
-        DocumentMarker marker = *markerIt;
+        const DocumentMarker& marker = *markerIt;
         
         // Paint either the background markers or the foreground markers, but not both
         switch (marker.type) {
@@ -911,7 +917,7 @@ void InlineTextBox::paintCompositionUnderline(GraphicsContext* ctx, int tx, int
     start += 1;
     width -= 2;
 
-    ctx->setStrokeColor(underline.color);
+    ctx->setStrokeColor(underline.color, renderer()->style()->colorSpace());
     ctx->setStrokeThickness(lineThickness);
     ctx->drawLineForText(IntPoint(tx + start, ty + height() - lineThickness), width, textRenderer()->document()->printing());
 }
@@ -936,7 +942,7 @@ int InlineTextBox::textPos() const
     if (x() == 0)
         return 0;
         
-    RenderBlock *blockElement = renderer()->containingBlock();
+    RenderBlock* blockElement = renderer()->containingBlock();
     return direction() == RTL ? x() - blockElement->borderRight() - blockElement->paddingRight()
                       : x() - blockElement->borderLeft() - blockElement->paddingLeft();
 }
@@ -947,7 +953,7 @@ int InlineTextBox::offsetForPosition(int _x, bool includePartialGlyphs) const
         return 0;
 
     RenderText* text = toRenderText(renderer());
-    RenderStyle *style = text->style(m_firstLine);
+    RenderStyle* style = text->style(m_firstLine);
     const Font* f = &style->font();
     return f->offsetForPosition(TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered()),
                                 _x - m_x, includePartialGlyphs);
diff --git a/WebCore/rendering/InlineTextBox.h b/WebCore/rendering/InlineTextBox.h
index 3bbb453..80af2e3 100644
--- a/WebCore/rendering/InlineTextBox.h
+++ b/WebCore/rendering/InlineTextBox.h
@@ -34,7 +34,7 @@ const unsigned short cNoTruncation = USHRT_MAX;
 const unsigned short cFullTruncation = USHRT_MAX - 1;
 
 // Helper functions shared by InlineTextBox / SVGRootInlineBox
-void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness);
+void updateGraphicsContext(GraphicsContext*, const Color& fillColor, const Color& strokeColor, float strokeThickness, ColorSpace);
 Color correctedTextColor(Color textColor, Color backgroundColor);
 
 class InlineTextBox : public InlineRunBox {
@@ -131,9 +131,9 @@ protected:
 private:
     void paintDecoration(GraphicsContext*, int tx, int ty, int decoration, ShadowData*);
     void paintSelection(GraphicsContext*, int tx, int ty, RenderStyle*, const Font&);
-    void paintSpellingOrGrammarMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&, bool grammar);
-    void paintTextMatchMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
-    void computeRectForReplacementMarker(int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
+    void paintSpellingOrGrammarMarker(GraphicsContext*, int tx, int ty, const DocumentMarker&, RenderStyle*, const Font&, bool grammar);
+    void paintTextMatchMarker(GraphicsContext*, int tx, int ty, const DocumentMarker&, RenderStyle*, const Font&);
+    void computeRectForReplacementMarker(int tx, int ty, const DocumentMarker&, RenderStyle*, const Font&);
 };
 
 inline RenderText* InlineTextBox::textRenderer() const
diff --git a/WebCore/rendering/MediaControlElements.cpp b/WebCore/rendering/MediaControlElements.cpp
index 9611660..9c56756 100644
--- a/WebCore/rendering/MediaControlElements.cpp
+++ b/WebCore/rendering/MediaControlElements.cpp
@@ -38,6 +38,7 @@
 #include "HTMLNames.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
+#include "Page.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
@@ -347,6 +348,9 @@ MediaControlInputElement::MediaControlInputElement(Document* document, PseudoId
     case MEDIA_CONTROLS_VOLUME_SLIDER:
         m_displayType = MediaVolumeSlider;
         break;
+    case MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON:
+        m_displayType = MediaShowClosedCaptionsButton;
+        break;
     default:
         ASSERT_NOT_REACHED();
         break;
@@ -577,6 +581,29 @@ void MediaControlReturnToRealtimeButtonElement::defaultEventHandler(Event* event
 
 // ----------------------------
 
+MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement(Document* doc, HTMLMediaElement* element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON, "button", element)
+{
+}
+
+void MediaControlToggleClosedCaptionsButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().clickEvent) {
+        m_mediaElement->setClosedCaptionsVisible(!m_mediaElement->closedCaptionsVisible());
+        setChecked(m_mediaElement->closedCaptionsVisible());
+        event->setDefaultHandled();
+    }
+    HTMLInputElement::defaultEventHandler(event);
+}
+
+void MediaControlToggleClosedCaptionsButtonElement::updateDisplayType()
+{
+    setDisplayType(m_mediaElement->closedCaptionsVisible() ? MediaHideClosedCaptionsButton : MediaShowClosedCaptionsButton);
+}
+
+
+// ----------------------------
+
 MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTMLMediaElement* element)
     : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element)
 {
@@ -649,10 +676,9 @@ void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
 void MediaControlVolumeSliderElement::update()
 {
     float volume = m_mediaElement->volume();
-    if (value().toFloat() != volume) {
+    if (value().toFloat() != volume)
         setValue(String::number(volume));
-        MediaControlInputElement::update();
-    }
+    MediaControlInputElement::update();
 }
 
 // ----------------------------
diff --git a/WebCore/rendering/MediaControlElements.h b/WebCore/rendering/MediaControlElements.h
index 8b29773..0ba4aba 100644
--- a/WebCore/rendering/MediaControlElements.h
+++ b/WebCore/rendering/MediaControlElements.h
@@ -54,6 +54,8 @@ enum MediaControlElementType {
     MediaSliderThumb,
     MediaRewindButton,
     MediaReturnToRealtimeButton,
+    MediaShowClosedCaptionsButton,
+    MediaHideClosedCaptionsButton,
     MediaUnMuteButton,
     MediaPauseButton,
     MediaTimelineContainer,
@@ -221,6 +223,15 @@ public:
 
 // ----------------------------
 
+class MediaControlToggleClosedCaptionsButtonElement : public MediaControlInputElement {
+public:
+    MediaControlToggleClosedCaptionsButtonElement(Document*, HTMLMediaElement*);
+    virtual void defaultEventHandler(Event*);
+    virtual void updateDisplayType();
+};    
+
+// ----------------------------
+
 class MediaControlTimelineElement : public MediaControlInputElement {
 public:
     MediaControlTimelineElement(Document*, HTMLMediaElement*);
diff --git a/WebCore/rendering/PointerEventsHitRules.cpp b/WebCore/rendering/PointerEventsHitRules.cpp
index 214fb09..ababcfd 100644
--- a/WebCore/rendering/PointerEventsHitRules.cpp
+++ b/WebCore/rendering/PointerEventsHitRules.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/PointerEventsHitRules.h b/WebCore/rendering/PointerEventsHitRules.h
index 3d8939a..c17c19c 100644
--- a/WebCore/rendering/PointerEventsHitRules.h
+++ b/WebCore/rendering/PointerEventsHitRules.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/RenderArena.h b/WebCore/rendering/RenderArena.h
index ca35361..edf052a 100644
--- a/WebCore/rendering/RenderArena.h
+++ b/WebCore/rendering/RenderArena.h
@@ -36,12 +36,13 @@
 #define RenderArena_h
 
 #include "Arena.h"
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
 static const size_t gMaxRecycledSize = 400;
 
-class RenderArena {
+class RenderArena : public Noncopyable {
 public:
     RenderArena(unsigned arenaSize = 4096);
     ~RenderArena();
diff --git a/WebCore/rendering/RenderBR.cpp b/WebCore/rendering/RenderBR.cpp
index e05c8b4..012a433 100644
--- a/WebCore/rendering/RenderBR.cpp
+++ b/WebCore/rendering/RenderBR.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/rendering/RenderBR.h b/WebCore/rendering/RenderBR.h
index 7eae8ea..8850d46 100644
--- a/WebCore/rendering/RenderBR.h
+++ b/WebCore/rendering/RenderBR.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index 7040e06..204a0c3 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -44,6 +44,7 @@
 #include "RenderView.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "TransformState.h"
 #include <wtf/StdLibExtras.h>
 
 #ifdef ANDROID_LAYOUT
@@ -62,13 +63,7 @@ static const int verticalLineClickFudgeFactor = 3;
 
 using namespace HTMLNames;
 
-static void moveChild(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* from, RenderObjectChildList* fromChildList, RenderObject* child)
-{
-    ASSERT(from == child->parent());
-    toChildList->appendChildNode(to, fromChildList->removeChildNode(from, child, false), false);
-}
-
-struct ColumnInfo {
+struct ColumnInfo : public Noncopyable {
     ColumnInfo()
         : m_desiredColumnWidth(0)
         , m_desiredColumnCount(1)
@@ -167,6 +162,7 @@ RenderBlock::~RenderBlock()
 
 void RenderBlock::destroy()
 {
+<<<<<<< HEAD:WebCore/rendering/RenderBlock.cpp
     // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will 
     // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise. 
     children()->destroyLeftoverChildren(); 
@@ -178,7 +174,20 @@ void RenderBlock::destroy()
         m_inlineContinuation->destroy();
         m_inlineContinuation = 0; 
     }
+=======
+    // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
+    // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise.
+    children()->destroyLeftoverChildren();
+>>>>>>> webkit.org at r51976:WebCore/rendering/RenderBlock.cpp
 
+    // Destroy our continuation before anything other than anonymous children.
+    // The reason we don't destroy it before anonymous children is that they may
+    // have continuations of their own that are anonymous children of our continuation.
+    if (m_inlineContinuation) {
+        m_inlineContinuation->destroy();
+        m_inlineContinuation = 0;
+    }
+    
     if (!documentBeingDestroyed()) {
         if (firstLineBox()) {
             // We can't wait for RenderBox::destroy to clear the selection,
@@ -406,6 +415,19 @@ RootInlineBox* RenderBlock::createAndAppendRootInlineBox()
     m_lineBoxes.appendLineBox(rootBox);
     return rootBox;
 }
+    
+void RenderBlock::moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* child)
+{
+    ASSERT(this == child->parent());
+    toChildList->appendChildNode(to, children()->removeChildNode(this, child, false), false);
+}
+
+void RenderBlock::moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* beforeChild, RenderObject* child)
+{
+    ASSERT(this == child->parent());
+    ASSERT(!beforeChild || to == beforeChild->parent());
+    toChildList->insertChildNode(to, children()->removeChildNode(this, child, false), beforeChild, false);
+}
 
 void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
 {    
@@ -443,9 +465,9 @@ void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
             RenderObject* no = o;
             o = no->nextSibling();
             
-            moveChild(block, block->children(), this, children(), no);
+            moveChildTo(block, block->children(), no);
         }
-        moveChild(block, block->children(), this, children(), inlineRunEnd);
+        moveChildTo(block, block->children(), inlineRunEnd);
     }
 
 #ifndef NDEBUG
@@ -520,7 +542,7 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         while (o) {
             RenderObject* no = o;
             o = no->nextSibling();
-            moveChild(prevBlock, prevBlock->children(), nextBlock, nextBlock->children(), no);
+            nextBlock->moveChildTo(prevBlock, prevBlock->children(), no);
         }
  
         nextBlock->deleteLineBoxTree();
@@ -543,7 +565,7 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         while (o) {
             RenderObject* no = o;
             o = no->nextSibling();
-            moveChild(this, children(), anonBlock, anonBlock->children(), no);
+            anonBlock->moveChildTo(this, children(), no);
         }
 
         // Delete the now-empty block's lines and nuke it.
@@ -613,15 +635,15 @@ void RenderBlock::finishDelayUpdateScrollInfo()
     if (gDelayUpdateScrollInfo == 0) {
         ASSERT(gDelayedUpdateScrollInfoSet);
 
-        for (DelayedUpdateScrollInfoSet::iterator it = gDelayedUpdateScrollInfoSet->begin(); it != gDelayedUpdateScrollInfoSet->end(); ++it) {
+        OwnPtr<DelayedUpdateScrollInfoSet> infoSet(gDelayedUpdateScrollInfoSet);
+        gDelayedUpdateScrollInfoSet = 0;
+
+        for (DelayedUpdateScrollInfoSet::iterator it = infoSet->begin(); it != infoSet->end(); ++it) {
             RenderBlock* block = *it;
             if (block->hasOverflowClip()) {
                 block->layer()->updateScrollInfoAfterLayout();
             }
         }
-
-        delete gDelayedUpdateScrollInfoSet;
-        gDelayedUpdateScrollInfoSet = 0;
     }
 }
 
@@ -876,7 +898,11 @@ void RenderBlock::adjustPositionedBlock(RenderBox* child, const MarginInfo& marg
             }
             y += (collapsedTopPos - collapsedTopNeg) - marginTop;
         }
-        child->layer()->setStaticY(y);
+        RenderLayer* childLayer = child->layer();
+        if (childLayer->staticY() != y) {
+            child->layer()->setStaticY(y);
+            child->setChildNeedsLayout(true, false);
+        }
     }
 }
 
@@ -965,7 +991,7 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
     // Move the nodes from the old child to the new child, but skip any :before/:after content.  It has already
     // been regenerated by the new inline.
     for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild; runInChild = runInChild->nextSibling()) {
-        if (runInIsGenerated || runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER) {
+        if (runInIsGenerated || (runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER)) {
             blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
             inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
         }
@@ -1535,7 +1561,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
     // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
     // z-index.  We paint after we painted the background/border, so that the scrollbars will
     // sit above the background/border.
-    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground))
+    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && shouldPaintWithinRoot(paintInfo))
         layer()->paintOverflowControls(paintInfo.context, tx, ty, paintInfo.rect);
 }
 
@@ -1919,23 +1945,28 @@ bool RenderBlock::isSelectionRoot() const
     return false;
 }
 
-GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* /*repaintContainer*/)
+GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* repaintContainer)
 {
     ASSERT(!needsLayout());
 
     if (!shouldPaintSelectionGaps())
         return GapRects();
 
-    // FIXME: this is broken with transforms and a non-null repaintContainer
-    FloatPoint absContentPoint = localToAbsolute(FloatPoint());
+    // FIXME: this is broken with transforms
+    TransformState transformState(TransformState::ApplyTransformDirection, FloatPoint());
+    mapLocalToContainer(repaintContainer, false, false, transformState);
+    FloatPoint offsetFromRepaintContainer = transformState.mappedPoint();
+    int x = offsetFromRepaintContainer.x();
+    int y = offsetFromRepaintContainer.y();
+
     if (hasOverflowClip())
-        absContentPoint -= layer()->scrolledContentOffset();
+        layer()->subtractScrolledContentOffset(x, y);
 
     int lastTop = 0;
     int lastLeft = leftSelectionOffset(this, lastTop);
     int lastRight = rightSelectionOffset(this, lastTop);
     
-    return fillSelectionGaps(this, absContentPoint.x(), absContentPoint.y(), absContentPoint.x(), absContentPoint.y(), lastTop, lastLeft, lastRight);
+    return fillSelectionGaps(this, x, y, x, y, lastTop, lastLeft, lastRight);
 }
 
 void RenderBlock::paintSelection(PaintInfo& paintInfo, int tx, int ty)
@@ -1945,7 +1976,14 @@ void RenderBlock::paintSelection(PaintInfo& paintInfo, int tx, int ty)
         int lastLeft = leftSelectionOffset(this, lastTop);
         int lastRight = rightSelectionOffset(this, lastTop);
         paintInfo.context->save();
-        fillSelectionGaps(this, tx, ty, tx, ty, lastTop, lastLeft, lastRight, &paintInfo);
+        IntRect gapRectsBounds = fillSelectionGaps(this, tx, ty, tx, ty, lastTop, lastLeft, lastRight, &paintInfo);
+        if (!gapRectsBounds.isEmpty()) {
+            if (RenderLayer* layer = enclosingLayer()) {
+                IntSize offset = hasLayer() ? IntSize() : offsetFromAncestorContainer(layer->renderer());
+                gapRectsBounds.move(offset - IntSize(tx, ty));
+                layer->addBlockSelectionGapsBounds(gapRectsBounds);
+            }
+        }
         paintInfo.context->restore();
     }
 }
@@ -2132,7 +2170,7 @@ IntRect RenderBlock::fillHorizontalSelectionGap(RenderObject* selObj, int xPos,
         return IntRect();
     IntRect gapRect(xPos, yPos, width, height);
     if (paintInfo && selObj->style()->visibility() == VISIBLE)
-        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
@@ -2153,7 +2191,7 @@ IntRect RenderBlock::fillVerticalSelectionGap(int lastTop, int lastLeft, int las
 
     IntRect gapRect(left, top, width, height);
     if (paintInfo)
-        paintInfo->context->fillRect(gapRect, selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selectionBackgroundColor(), style()->colorSpace());
     return gapRect;
 }
 
@@ -2169,7 +2207,7 @@ IntRect RenderBlock::fillLeftSelectionGap(RenderObject* selObj, int xPos, int yP
 
     IntRect gapRect(left, top, width, height);
     if (paintInfo)
-        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
@@ -2185,7 +2223,7 @@ IntRect RenderBlock::fillRightSelectionGap(RenderObject* selObj, int xPos, int y
 
     IntRect gapRect(left, top, width, height);
     if (paintInfo)
-        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
@@ -3418,7 +3456,7 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
     RootInlineBox* firstRootBoxWithChildren = 0;
     RootInlineBox* lastRootBoxWithChildren = 0;
     for (RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox()) {
-        if (!root->firstChild())
+        if (!root->firstLeafChild())
             continue;
         if (!firstRootBoxWithChildren)
             firstRootBoxWithChildren = root;
@@ -3565,11 +3603,15 @@ void RenderBlock::calcColumnWidth()
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         } else if (colGap < availWidth) {
             desiredColumnCount = availWidth / colGap;
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
     } else if (style()->hasAutoColumnCount()) {
         if (colWidth < availWidth) {
             desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
     } else {
@@ -3579,6 +3621,8 @@ void RenderBlock::calcColumnWidth()
             desiredColumnWidth = colWidth;
         } else if (colWidth < availWidth) {
             desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
     }
@@ -3629,7 +3673,7 @@ Vector<IntRect>* RenderBlock::columnRects() const
     return &gColumnInfoMap->get(this)->m_columnRects;    
 }
 
-int RenderBlock::layoutColumns(int endOfContent)
+int RenderBlock::layoutColumns(int endOfContent, int requestedColumnHeight)
 {
     // Don't do anything if we have no columns
     if (!hasColumns())
@@ -3642,17 +3686,20 @@ int RenderBlock::layoutColumns(int endOfContent)
     
     bool computeIntrinsicHeight = (endOfContent == -1);
 
-    // Fill the columns in to the available height.  Attempt to balance the height of the columns
-    int availableHeight = contentHeight();
-    int colHeight = computeIntrinsicHeight ? availableHeight / desiredColumnCount : availableHeight;
-    
+    // Fill the columns in to the available height.  Attempt to balance the height of the columns.
     // Add in half our line-height to help with best-guess initial balancing.
     int columnSlop = lineHeight(false) / 2;
     int remainingSlopSpace = columnSlop * desiredColumnCount;
+    int availableHeight = contentHeight();
+    int colHeight;
+    if (computeIntrinsicHeight && requestedColumnHeight >= 0)
+        colHeight = requestedColumnHeight;
+    else if (computeIntrinsicHeight)
+        colHeight = availableHeight / desiredColumnCount + columnSlop;
+    else
+        colHeight = availableHeight;
+    int originalColHeight = colHeight;
 
-    if (computeIntrinsicHeight)
-        colHeight += columnSlop;
-                                                                            
     int colGap = columnGap();
 
     // Compute a collection of column rects.
@@ -3668,7 +3715,8 @@ int RenderBlock::layoutColumns(int endOfContent)
     int currY = top;
     unsigned colCount = desiredColumnCount;
     int maxColBottom = borderTop() + paddingTop();
-    int contentBottom = top + availableHeight; 
+    int contentBottom = top + availableHeight;
+    int minimumColumnHeight = -1;
     for (unsigned i = 0; i < colCount; i++) {
         // If we aren't constrained, then the last column can just get all the remaining space.
         if (computeIntrinsicHeight && i == colCount - 1)
@@ -3688,6 +3736,11 @@ int RenderBlock::layoutColumns(int endOfContent)
         paintObject(paintInfo, 0, 0);
         setHasColumns(true);
 
+        if (computeIntrinsicHeight && v->minimumColumnHeight() > originalColHeight) {
+            // The initial column height was too small to contain one line of text.
+            minimumColumnHeight = max(minimumColumnHeight, v->minimumColumnHeight());
+        }
+
         int adjustedBottom = v->bestTruncatedAt();
         if (adjustedBottom <= currY)
             adjustedBottom = currY + colHeight;
@@ -3724,6 +3777,11 @@ int RenderBlock::layoutColumns(int endOfContent)
             colCount++;
     }
 
+    if (minimumColumnHeight >= 0) {
+        // If originalColHeight was too small, we need to try to layout again.
+        return layoutColumns(endOfContent, minimumColumnHeight);
+    }
+
     int overflowRight = max(width(), currX - colGap);
     int overflowLeft = min(0, currX + desiredColumnWidth + colGap);
     int overflowHeight = maxColBottom;
@@ -4208,6 +4266,10 @@ void RenderBlock::calcInlinePrefWidths()
                 } else
                     inlineMax += childMax;
             }
+
+            // Ignore spaces after a list marker.
+            if (child->isListMarker())
+                stripFrontSpaces = true;
         } else {
             m_minPrefWidth = max(inlineMin, m_minPrefWidth);
             m_maxPrefWidth = max(inlineMax, m_maxPrefWidth);
diff --git a/WebCore/rendering/RenderBlock.h b/WebCore/rendering/RenderBlock.h
index 1628701..985074d 100644
--- a/WebCore/rendering/RenderBlock.h
+++ b/WebCore/rendering/RenderBlock.h
@@ -140,6 +140,9 @@ public:
     RenderBlock* createAnonymousBlock(bool isFlexibleBox = false) const;
 
 protected:
+    void moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* child);
+    void moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* beforeChild, RenderObject* child);
+
     int maxTopPosMargin() const { return m_maxMargin ? m_maxMargin->m_topPos : MaxMargin::topPosDefault(this); }
     int maxTopNegMargin() const { return m_maxMargin ? m_maxMargin->m_topNeg : MaxMargin::topNegDefault(this); }
     int maxBottomPosMargin() const { return m_maxMargin ? m_maxMargin->m_bottomPos : MaxMargin::bottomPosDefault(this); }
@@ -377,13 +380,13 @@ private:
     void offsetForContents(int& tx, int& ty) const;
 
     void calcColumnWidth();
-    int layoutColumns(int endOfContent = -1);
+    int layoutColumns(int endOfContent = -1, int requestedColumnHeight = -1);
 
     bool expandsToEncloseOverhangingFloats() const;
 
     void updateScrollInfoAfterLayout();
 
-    struct FloatingObject {
+    struct FloatingObject : Noncopyable {
         enum Type {
             FloatLeft,
             FloatRight
@@ -499,7 +502,7 @@ private:
     RenderInline* m_inlineContinuation;
 
     // Allocated only when some of these fields have non-default values
-    struct MaxMargin {
+    struct MaxMargin : Noncopyable {
         MaxMargin(const RenderBlock* o) 
             : m_topPos(topPosDefault(o))
             , m_topNeg(topNegDefault(o))
diff --git a/WebCore/rendering/RenderBlockLineLayout.cpp b/WebCore/rendering/RenderBlockLineLayout.cpp
index cf6514e..8517d6d 100644
--- a/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -1869,10 +1869,10 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             currentCharacterIsSpace = false;
             currentCharacterIsWS = false;
             trailingSpaceObject = 0;
-            
+
             // Optimize for a common case. If we can't find whitespace after the list
             // item, then this is all moot. -dwh
-            if (o->isListMarker() && !toRenderListMarker(o)->isInside()) {
+            if (o->isListMarker()) {
                 if (style()->collapseWhiteSpace() && shouldSkipWhitespaceAfterStartObject(this, o, lineMidpointState)) {
                     // Like with inline flows, we start ignoring spaces to make sure that any 
                     // additional spaces we see will be discarded.
@@ -1880,6 +1880,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     currentCharacterIsWS = true;
                     ignoringSpaces = true;
                 }
+                if (toRenderListMarker(o)->isInside())
+                    tmpW += replacedBox->width() + replacedBox->marginLeft() + replacedBox->marginRight() + inlineWidth(o);
             } else
                 tmpW += replacedBox->width() + replacedBox->marginLeft() + replacedBox->marginRight() + inlineWidth(o);
         } else if (o->isText()) {
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index 8e0f3b7..a7c2e63 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -1523,7 +1523,7 @@ void RenderBox::calcHeight()
     // height since we don't set a height in RenderView when we're printing. So without this quirk, the 
     // height has nothing to be a percentage of, and it ends up being 0. That is bad.
     bool printingNeedsBaseHeight = document()->printing() && h.isPercent()
-        && (isRoot() || isBody() && document()->documentElement()->renderer()->style()->height().isPercent());
+        && (isRoot() || (isBody() && document()->documentElement()->renderer()->style()->height().isPercent()));
     if (stretchesToViewHeight() || printingNeedsBaseHeight) {
         int margins = collapsedMarginTop() + collapsedMarginBottom();
         int visHeight = document()->printing() ? view()->frameView()->visibleHeight() : view()->viewHeight();
@@ -2747,7 +2747,7 @@ VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
 {
     // no children...return this render object's element, if there is one, and offset 0
     if (!firstChild())
-        return createVisiblePosition(firstDeepEditingPositionForNode(node()));
+        return createVisiblePosition(node() ? firstDeepEditingPositionForNode(node()) : Position(0, 0));
 
     int xPos = point.x();
     int yPos = point.y();
diff --git a/WebCore/rendering/RenderBoxModelObject.cpp b/WebCore/rendering/RenderBoxModelObject.cpp
index 23dad2d..98960e0 100644
--- a/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/WebCore/rendering/RenderBoxModelObject.cpp
@@ -441,14 +441,14 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
             if (baseColor.alpha() > 0) {
                 context->save();
                 context->setCompositeOperation(CompositeCopy);
-                context->fillRect(rect, baseColor);
+                context->fillRect(rect, baseColor, style()->colorSpace());
                 context->restore();
             } else
                 context->clearRect(rect);
         }
 
         if (bgColor.isValid() && bgColor.alpha() > 0)
-            context->fillRect(rect, bgColor);
+            context->fillRect(rect, bgColor, style()->colorSpace());
     }
 
     // no progressive loading of the background image
@@ -477,7 +477,7 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
                         clientForBackgroundImage = bodyRenderer;
                 }
             }
-            context->drawTiledImage(bg->image(clientForBackgroundImage, tileSize), destRect, phase, tileSize, compositeOp);
+            context->drawTiledImage(bg->image(clientForBackgroundImage, tileSize), style()->colorSpace(), destRect, phase, tileSize, compositeOp);
         }
     }
 
@@ -706,6 +706,7 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
                       (imageHeight - topSlice - bottomSlice) > 0 && (h - topWidth - bottomWidth) > 0;
 
     Image* image = styleImage->image(this, imageSize);
+    ColorSpace colorSpace = style->colorSpace();
 
     if (drawLeft) {
         // Paint the top and bottom left corners.
@@ -713,18 +714,18 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
         // The top left corner rect is (tx, ty, leftWidth, topWidth)
         // The rect to use from within the image is obtained from our slice, and is (0, 0, leftSlice, topSlice)
         if (drawTop)
-            graphicsContext->drawImage(image, IntRect(tx, ty, leftWidth, topWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx, ty, leftWidth, topWidth),
                                        IntRect(0, 0, leftSlice, topSlice), op);
 
         // The bottom left corner rect is (tx, ty + h - bottomWidth, leftWidth, bottomWidth)
         // The rect to use from within the image is (0, imageHeight - bottomSlice, leftSlice, botomSlice)
         if (drawBottom)
-            graphicsContext->drawImage(image, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
                                        IntRect(0, imageHeight - bottomSlice, leftSlice, bottomSlice), op);
 
         // Paint the left edge.
         // Have to scale and tile into the border rect.
-        graphicsContext->drawTiledImage(image, IntRect(tx, ty + topWidth, leftWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx, ty + topWidth, leftWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(0, topSlice, leftSlice, imageHeight - topSlice - bottomSlice),
                                         Image::StretchTile, (Image::TileRule)vRule, op);
@@ -735,17 +736,17 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
         // The top right corner rect is (tx + w - rightWidth, ty, rightWidth, topWidth)
         // The rect to use from within the image is obtained from our slice, and is (imageWidth - rightSlice, 0, rightSlice, topSlice)
         if (drawTop)
-            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
                                        IntRect(imageWidth - rightSlice, 0, rightSlice, topSlice), op);
 
         // The bottom right corner rect is (tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth)
         // The rect to use from within the image is (imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice)
         if (drawBottom)
-            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
                                        IntRect(imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice), op);
 
         // Paint the right edge.
-        graphicsContext->drawTiledImage(image, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(imageWidth - rightSlice, topSlice, rightSlice, imageHeight - topSlice - bottomSlice),
                                         Image::StretchTile, (Image::TileRule)vRule, op);
@@ -753,20 +754,20 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
 
     // Paint the top edge.
     if (drawTop)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
                                         IntRect(leftSlice, 0, imageWidth - rightSlice - leftSlice, topSlice),
                                         (Image::TileRule)hRule, Image::StretchTile, op);
 
     // Paint the bottom edge.
     if (drawBottom)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + h - bottomWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty + h - bottomWidth,
                                         w - leftWidth - rightWidth, bottomWidth),
                                         IntRect(leftSlice, imageHeight - bottomSlice, imageWidth - rightSlice - leftSlice, bottomSlice),
                                         (Image::TileRule)hRule, Image::StretchTile, op);
 
     // Paint the middle.
     if (drawMiddle)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(leftSlice, topSlice, imageWidth - rightSlice - leftSlice, imageHeight - topSlice - bottomSlice),
                                         (Image::TileRule)hRule, (Image::TileRule)vRule, op);
@@ -1198,7 +1199,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
             shadowOffset -= extraOffset;
             fillRect.move(extraOffset);
 
-            context->setShadow(shadowOffset, shadowBlur, shadowColor);
+            context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
             if (hasBorderRadius) {
                 IntRect rectToClipOut = rect;
                 IntSize topLeftToClipOut = topLeft;
@@ -1241,7 +1242,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
                 if (!rectToClipOut.isEmpty())
                     context->clipOutRoundedRect(rectToClipOut, topLeftToClipOut, topRightToClipOut, bottomLeftToClipOut, bottomRightToClipOut);
-                context->fillRoundedRect(fillRect, topLeft, topRight, bottomLeft, bottomRight, Color::black);
+                context->fillRoundedRect(fillRect, topLeft, topRight, bottomLeft, bottomRight, Color::black, s->colorSpace());
             } else {
                 IntRect rectToClipOut = rect;
 
@@ -1258,7 +1259,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
                 if (!rectToClipOut.isEmpty())
                     context->clipOut(rectToClipOut);
-                context->fillRect(fillRect, Color::black);
+                context->fillRect(fillRect, Color::black, s->colorSpace());
             }
 
             context->restore();
@@ -1269,9 +1270,9 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
             if (holeRect.isEmpty()) {
                 if (hasBorderRadius)
-                    context->fillRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight, shadowColor);
+                    context->fillRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight, shadowColor, s->colorSpace());
                 else
-                    context->fillRect(rect, shadowColor);
+                    context->fillRect(rect, shadowColor, s->colorSpace());
                 continue;
             }
             if (!begin) {
@@ -1320,8 +1321,8 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
                 context->addPath(Path::createRectangle(holeRect));
 
             context->setFillRule(RULE_EVENODD);
-            context->setFillColor(fillColor);
-            context->setShadow(shadowOffset, shadowBlur, shadowColor);
+            context->setFillColor(fillColor, s->colorSpace());
+            context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
             context->fillPath();
 
             context->restore();
diff --git a/WebCore/rendering/RenderButton.cpp b/WebCore/rendering/RenderButton.cpp
index f3ae558..3ecd382 100644
--- a/WebCore/rendering/RenderButton.cpp
+++ b/WebCore/rendering/RenderButton.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/RenderButton.h b/WebCore/rendering/RenderButton.h
index 3a74589..7fd6ab0 100644
--- a/WebCore/rendering/RenderButton.h
+++ b/WebCore/rendering/RenderButton.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2005 Apple Computer
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/RenderCounter.cpp b/WebCore/rendering/RenderCounter.cpp
index 17c6dad..b0aefc5 100644
--- a/WebCore/rendering/RenderCounter.cpp
+++ b/WebCore/rendering/RenderCounter.cpp
@@ -38,7 +38,7 @@ using namespace HTMLNames;
 typedef HashMap<RefPtr<AtomicStringImpl>, CounterNode*> CounterMap;
 typedef HashMap<const RenderObject*, CounterMap*> CounterMaps;
 
-static CounterNode* counter(RenderObject*, const AtomicString& counterName, bool alwaysCreateCounter);
+static CounterNode* makeCounterNode(RenderObject*, const AtomicString& counterName, bool alwaysCreateCounter);
 
 static CounterMaps& counterMaps()
 {
@@ -53,30 +53,6 @@ static inline RenderObject* previousSiblingOrParent(RenderObject* object)
     return object->parent();
 }
 
-static CounterNode* lastDescendant(CounterNode* node)
-{
-    CounterNode* last = node->lastChild();
-    if (!last)
-        return 0;
-
-    while (CounterNode* lastChild = last->lastChild())
-        last = lastChild;
-
-    return last;
-}
-
-static CounterNode* previousInPreOrder(CounterNode* node)
-{
-    CounterNode* previous = node->previousSibling();
-    if (!previous)
-        return node->parent();
-
-    while (CounterNode* lastChild = previous->lastChild())
-        previous = lastChild;
-
-    return previous;
-}
-
 static bool planCounter(RenderObject* object, const AtomicString& counterName, bool& isReset, int& value)
 {
     ASSERT(object);
@@ -133,59 +109,124 @@ static bool planCounter(RenderObject* object, const AtomicString& counterName, b
     return false;
 }
 
-static bool findPlaceForCounter(RenderObject* object, const AtomicString& counterName,
-    bool isReset, CounterNode*& parent, CounterNode*& previousSibling)
+// - Finds the insertion point for the counter described by counterOwner, isReset and 
+// identifier in the CounterNode tree for identifier and sets parent and
+// previousSibling accordingly.
+// - The function returns true if the counter whose insertion point is searched is NOT
+// the root of the tree.
+// - The root of the tree is a counter reference that is not in the scope of any other
+// counter with the same identifier.
+// - All the counter references with the same identifier as this one that are in
+// children or subsequent siblings of the renderer that owns the root of the tree
+// form the rest of of the nodes of the tree.
+// - The root of the tree is always a reset type reference.
+// - A subtree rooted at any reset node in the tree is equivalent to all counter 
+// references that are in the scope of the counter or nested counter defined by that
+// reset node.
+// - Non-reset CounterNodes cannot have descendants.
+
+static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString& identifier, bool isReset, CounterNode*& parent, CounterNode*& previousSibling)
 {
-    // Find the appropriate previous sibling for insertion into the parent node
-    // by searching in render tree order for a child of the counter.
-    parent = 0;
+    // We cannot stop searching for counters with the same identifier before we also
+    // check this renderer, because it may affect the positioning in the tree of our counter.
+    RenderObject* searchEndRenderer = previousSiblingOrParent(counterOwner);
+    // We check renderers in preOrder from the renderer that our counter is attached to
+    // towards the begining of the document for counters with the same identifier as the one
+    // we are trying to find a place for. This is the next renderer to be checked.
+    RenderObject* currentRenderer = counterOwner->previousInPreOrder();
     previousSibling = 0;
-    RenderObject* resetCandidate = isReset ? object->parent() : previousSiblingOrParent(object);
-    RenderObject* prevCounterCandidate = object;
-    CounterNode* candidateCounter = 0;
-    // When a reset counter is chosen as candidateCounter, we'll
-    // decide the new node should be a child of the reset node or a
-    // sibling or the reset node. This flag controls it.
-    bool createChildForReset = true;
-    while ((prevCounterCandidate = prevCounterCandidate->previousInPreOrder())) {
-        CounterNode* c = counter(prevCounterCandidate, counterName, false);
-        if (prevCounterCandidate == resetCandidate) {
-            if (!candidateCounter) {
-                candidateCounter = c;
-                createChildForReset = true;
-            }
-            if (candidateCounter) {
-                if (createChildForReset && candidateCounter->isReset()) {
-                    parent = candidateCounter;
-                    previousSibling = 0;
-                } else {
-                    parent = candidateCounter->parent();
-                    previousSibling = candidateCounter;
+    while (currentRenderer) {
+        CounterNode* currentCounter = makeCounterNode(currentRenderer, identifier, false);
+        if (searchEndRenderer == currentRenderer) {
+            // We may be at the end of our search.
+            if (currentCounter) {
+                // We have a suitable counter on the EndSearchRenderer.
+                if (previousSibling) { // But we already found another counter that we come after.
+                    if (currentCounter->isReset()) {
+                        // We found a reset counter that is on a renderer that is a sibling of ours or a parent.
+                        if (isReset && currentRenderer->parent() == counterOwner->parent()) {
+                            // We are also a reset counter and the previous reset was on a sibling renderer
+                            // hence we are the next sibling of that counter if that reset is not a root or
+                            // we are a root node if that reset is a root.
+                            parent = currentCounter->parent();
+                            previousSibling = parent ? currentCounter : 0;
+                            return parent;
+                        }
+                        // We are not a reset node or the previous reset must be on an ancestor of our renderer
+                        // hence we must be a child of that reset counter.
+                        parent = currentCounter;
+                        ASSERT(previousSibling->parent() == currentCounter);
+                        return true;
+                    }
+                    // CurrentCounter, the counter at the EndSearchRenderer, is not reset.
+                    if (!isReset || currentRenderer->parent() != counterOwner->parent()) {
+                        // If the node we are placing is not reset or we have found a counter that is attached
+                        // to an ancestor of the placed counter's renderer we know we are a sibling of that node.
+                        ASSERT(currentCounter->parent() == previousSibling->parent());
+                        parent = currentCounter->parent();
+                        return true;
+                    }
+                } else { 
+                    // We are at the potential end of the search, but we had no previous sibling candidate
+                    // In this case we follow pretty much the same logic as above but no ASSERTs about 
+                    // previousSibling, and when we are a sibling of the end counter we must set previousSibling
+                    // to currentCounter.
+                    if (currentCounter->isReset()) {
+                        if (isReset && currentRenderer->parent() == counterOwner->parent()) {
+                            parent = currentCounter->parent();
+                            previousSibling = currentCounter;
+                            return parent;
+                        }
+                        parent = currentCounter;
+                        return true;
+                    }
+                    if (!isReset || currentRenderer->parent() != counterOwner->parent()) {
+                        parent = currentCounter->parent();
+                        previousSibling = currentCounter;
+                        return true;
+                    }
+                    previousSibling = currentCounter;
                 }
-                return true;
             }
-            resetCandidate = previousSiblingOrParent(resetCandidate);
-        } else if (c) {
-            if (c->isReset()) {
-                if (c->parent()) {
-                    // The new node may be the next sibling of this reset node.
-                    createChildForReset = false;
-                    candidateCounter = c;
-                } else {
-                    createChildForReset = true;
-                    candidateCounter = 0;
-                }
-            } else if (!candidateCounter) {
-                createChildForReset = true;
-                candidateCounter = c;
+            // We come here if the previous sibling or parent of our renderer had no 
+            // good counter, or we are a reset node and the counter on the previous sibling
+            // of our renderer was not a reset counter.
+            // Set a new goal for the end of the search.
+            searchEndRenderer = previousSiblingOrParent(currentRenderer);
+        } else {
+            // We are searching descendants of a previous sibling of the renderer that the
+            // counter being placed is attached to.
+            if (currentCounter) {
+                // We found a suitable counter.
+                if (previousSibling) {
+                    // Since we had a suitable previous counter before, we should only consider this one as our 
+                    // previousSibling if it is a reset counter and hence the current previousSibling is its child.
+                    if (currentCounter->isReset()) {
+                        previousSibling = currentCounter;
+                        // We are no longer interested in previous siblings of the currentRenderer or their children
+                        // as counters they may have attached cannot be the previous sibling of the counter we are placing.
+                        currentRenderer = currentRenderer->parent();
+                        continue;
+                    }
+                } else
+                    previousSibling = currentCounter;
+                currentRenderer = previousSiblingOrParent(currentRenderer);
+                continue;
             }
         }
+        // This function is designed so that the same test is not done twice in an iteration, except for this one
+        // which may be done twice in some cases. Rearranging the decision points though, to accommodate this 
+        // performance improvement would create more code duplication than is worthwhile in my oppinion and may further
+        // impede the readability of this already complex algorithm.
+        if (previousSibling)
+            currentRenderer = previousSiblingOrParent(currentRenderer);
+        else
+            currentRenderer = currentRenderer->previousInPreOrder();
     }
-
     return false;
 }
 
-static CounterNode* counter(RenderObject* object, const AtomicString& counterName, bool alwaysCreateCounter)
+static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& counterName, bool alwaysCreateCounter)
 {
     ASSERT(object);
 
@@ -204,7 +245,7 @@ static CounterNode* counter(RenderObject* object, const AtomicString& counterNam
     CounterNode* newNode;
     if (findPlaceForCounter(object, counterName, isReset, newParent, newPreviousSibling)) {
         newNode = new CounterNode(object, isReset, value);
-        newParent->insertAfter(newNode, newPreviousSibling);
+        newParent->insertAfter(newNode, newPreviousSibling, counterName);
     } else {
         // Make a reset node for counters that aren't inside an existing reset node.
         newNode = new CounterNode(object, true, value);
@@ -246,7 +287,7 @@ PassRefPtr<StringImpl> RenderCounter::originalText() const
         return 0;
 
     if (!m_counterNode)
-        m_counterNode = counter(parent(), m_counter.identifier(), true);
+        m_counterNode = makeCounterNode(parent(), m_counter.identifier(), true);
 
     CounterNode* child = m_counterNode;
     int value = child->isReset() ? child->value() : child->countInParent();
@@ -272,24 +313,26 @@ void RenderCounter::calcPrefWidths(int lead)
     RenderText::calcPrefWidths(lead);
 }
 
-void RenderCounter::invalidate()
+void RenderCounter::invalidate(const AtomicString& identifier)
 {
+    if (m_counter.identifier() != identifier)
+        return;
     m_counterNode = 0;
     setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-static void destroyCounterNodeChildren(AtomicStringImpl* identifier, CounterNode* node)
+static void destroyCounterNodeChildren(const AtomicString& identifier, CounterNode* node)
 {
     CounterNode* previous;
-    for (CounterNode* child = lastDescendant(node); child && child != node; child = previous) {
-        previous = previousInPreOrder(child);
-        child->parent()->removeChild(child);
-        ASSERT(counterMaps().get(child->renderer())->get(identifier) == child);
-        counterMaps().get(child->renderer())->remove(identifier);
+    for (CounterNode* child = node->lastDescendant(); child && child != node; child = previous) {
+        previous = child->previousInPreOrder();
+        child->parent()->removeChild(child, identifier);
+        ASSERT(counterMaps().get(child->renderer())->get(identifier.impl()) == child);
+        counterMaps().get(child->renderer())->remove(identifier.impl());
         if (!child->renderer()->documentBeingDestroyed()) {
             RenderObjectChildList* children = child->renderer()->virtualChildren();
             if (children)
-                children->invalidateCounters(child->renderer());
+                children->invalidateCounters(child->renderer(), identifier);
         }
         delete child;
     }
@@ -306,9 +349,10 @@ void RenderCounter::destroyCounterNodes(RenderObject* object)
     CounterMap::const_iterator end = map->end();
     for (CounterMap::const_iterator it = map->begin(); it != end; ++it) {
         CounterNode* node = it->second;
-        destroyCounterNodeChildren(it->first.get(), node);
+        AtomicString identifier(it->first.get());
+        destroyCounterNodeChildren(identifier, node);
         if (CounterNode* parent = node->parent())
-            parent->removeChild(node);
+            parent->removeChild(node, identifier);
         delete node;
     }
 
diff --git a/WebCore/rendering/RenderCounter.h b/WebCore/rendering/RenderCounter.h
index 961968e..356f1bd 100644
--- a/WebCore/rendering/RenderCounter.h
+++ b/WebCore/rendering/RenderCounter.h
@@ -33,7 +33,11 @@ class RenderCounter : public RenderText {
 public:
     RenderCounter(Document*, const CounterContent&);
 
-    void invalidate();
+    // Removes the reference to the CounterNode associated with this renderer
+    // if its identifier matches the argument.
+    // This is used to cause a counter display update when the CounterNode
+    // tree for identifier changes.
+    void invalidate(const AtomicString& identifier);
 
     static void destroyCounterNodes(RenderObject*);
 
diff --git a/WebCore/rendering/RenderFieldset.cpp b/WebCore/rendering/RenderFieldset.cpp
index 8618d11..1f2b371 100644
--- a/WebCore/rendering/RenderFieldset.cpp
+++ b/WebCore/rendering/RenderFieldset.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
diff --git a/WebCore/rendering/RenderFileUploadControl.cpp b/WebCore/rendering/RenderFileUploadControl.cpp
index 72623f7..37ee8fb 100644
--- a/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/WebCore/rendering/RenderFileUploadControl.cpp
@@ -63,8 +63,13 @@ private:
 RenderFileUploadControl::RenderFileUploadControl(HTMLInputElement* input)
     : RenderBlock(input)
     , m_button(0)
-    , m_fileChooser(FileChooser::create(this, input->value()))
 {
+    FileList* list = input->files();
+    Vector<String> filenames;
+    unsigned length = list ? list->length() : 0;
+    for (unsigned i = 0; i < length; ++i)
+        filenames.append(list->item(i)->path());
+    m_fileChooser = FileChooser::create(this, filenames);
 }
 
 RenderFileUploadControl::~RenderFileUploadControl()
@@ -184,7 +189,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
     }
 
     if (paintInfo.phase == PaintPhaseForeground) {
-        const String& displayedFilename = m_fileChooser->basenameForWidth(style()->font(), maxFilenameWidth());        
+        const String& displayedFilename = fileTextValue();
         unsigned length = displayedFilename.length();
         const UChar* string = displayedFilename.characters();
         TextRun textRun(string, length, false, 0, 0, style()->direction() == RTL, style()->unicodeBidi() == Override);
@@ -204,7 +209,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
             + buttonRenderer->marginTop() + buttonRenderer->borderTop() + buttonRenderer->paddingTop()
             + buttonRenderer->baselinePosition(true, false);
 
-        paintInfo.context->setFillColor(style()->color());
+        paintInfo.context->setFillColor(style()->color(), style()->colorSpace());
         
         // Draw the filename
         paintInfo.context->drawBidiText(style()->font(), textRun, IntPoint(textX, textY));
@@ -284,7 +289,7 @@ String RenderFileUploadControl::buttonValue()
     return m_button->value();
 }
 
-String RenderFileUploadControl::fileTextValue()
+String RenderFileUploadControl::fileTextValue() const
 {
     return m_fileChooser->basenameForWidth(style()->font(), maxFilenameWidth());
 }
diff --git a/WebCore/rendering/RenderFileUploadControl.h b/WebCore/rendering/RenderFileUploadControl.h
index bd7d62a..72ba308 100644
--- a/WebCore/rendering/RenderFileUploadControl.h
+++ b/WebCore/rendering/RenderFileUploadControl.h
@@ -37,6 +37,8 @@ public:
     RenderFileUploadControl(HTMLInputElement*);
     virtual ~RenderFileUploadControl();
 
+    virtual bool isFileUploadControl() const { return true; }
+
     void click();
 
     void valueChanged();
@@ -44,7 +46,7 @@ public:
     void receiveDroppedFiles(const Vector<String>&);
 
     String buttonValue();
-    String fileTextValue();
+    String fileTextValue() const;
     
     bool allowsMultipleFiles();
 
@@ -66,10 +68,16 @@ private:
 
 inline RenderFileUploadControl* toRenderFileUploadControl(RenderObject* object)
 {
-    ASSERT(!object || !strcmp(object->renderName(), "RenderFileUploadControl"));
+    ASSERT(!object || object->isFileUploadControl());
     return static_cast<RenderFileUploadControl*>(object);
 }
 
+inline const RenderFileUploadControl* toRenderFileUploadControl(const RenderObject* object)
+{
+    ASSERT(!object || object->isFileUploadControl());
+    return static_cast<const RenderFileUploadControl*>(object);
+}
+
 // This will catch anyone doing an unnecessary cast.
 void toRenderFileUploadControl(const RenderFileUploadControl*);
 
diff --git a/WebCore/rendering/RenderFlexibleBox.cpp b/WebCore/rendering/RenderFlexibleBox.cpp
index f32e6e3..6882097 100644
--- a/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/WebCore/rendering/RenderFlexibleBox.cpp
@@ -426,8 +426,13 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                         child->layer()->setStaticX(xPos);
                     else child->layer()->setStaticX(width() - xPos);
                 }
-                if (child->style()->hasStaticY())
-                    child->layer()->setStaticY(yPos);
+                if (child->style()->hasStaticY()) {
+                    RenderLayer* childLayer = child->layer();
+                    if (childLayer->staticY() != yPos) {
+                        child->layer()->setStaticY(yPos);
+                        child->setChildNeedsLayout(true, false);
+                    }
+                }
                 child = iterator.next();
                 continue;
             }
@@ -656,7 +661,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
 
     // We confine the line clamp ugliness to vertical flexible boxes (thus keeping it out of
     // mainstream block layout); this is not really part of the XUL box model.
-    bool haveLineClamp = style()->lineClamp() >= 0 && style()->lineClamp() <= 100;
+    bool haveLineClamp = !style()->lineClamp().isNone();
     if (haveLineClamp) {
         int maxLineCount = 0;
         child = iterator.first();
@@ -681,7 +686,8 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
         
         // Get the # of lines and then alter all block flow children with auto height to use the
         // specified height. We always try to leave room for at least one line.
-        int numVisibleLines = max(1, static_cast<int>((maxLineCount + 1) * style()->lineClamp() / 100.0));
+        LineClampValue lineClamp = style()->lineClamp();
+        int numVisibleLines = lineClamp.isPercentage() ? max(1, (maxLineCount + 1) * lineClamp.value() / 100) : lineClamp.value();
         if (numVisibleLines < maxLineCount) {
             for (child = iterator.first(); child; child = iterator.next()) {
                 if (child->isPositioned() || !child->style()->height().isAuto() || !child->isBlockFlow())
@@ -712,28 +718,25 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                 if (!lastLine)
                     continue;
                 
-                // See if the last item is an anchor
-                InlineBox* anchorBox = lastLine->lastChild();
-                if (!anchorBox)
-                    continue;
-                if (!anchorBox->renderer()->node())
-                    continue;
-                if (!anchorBox->renderer()->node()->isLink())
-                    continue;
-                
                 RootInlineBox* lastVisibleLine = blockChild->lineAtIndex(numVisibleLines-1);
                 if (!lastVisibleLine)
                     continue;
 
                 const UChar ellipsisAndSpace[2] = { horizontalEllipsis, ' ' };
                 DEFINE_STATIC_LOCAL(AtomicString, ellipsisAndSpaceStr, (ellipsisAndSpace, 2));
-
+                DEFINE_STATIC_LOCAL(AtomicString, ellipsisStr, (&horizontalEllipsis, 1));
                 const Font& font = style(numVisibleLines == 1)->font();
-                int ellipsisAndSpaceWidth = font.width(TextRun(ellipsisAndSpace, 2));
 
-                // Get ellipsis width + " " + anchor width
-                int totalWidth = ellipsisAndSpaceWidth + anchorBox->width();
-                
+                // Get ellipsis width, and if the last child is an anchor, it will go after the ellipsis, so add in a space and the anchor width too 
+                int totalWidth;
+                InlineBox* anchorBox = lastLine->lastChild();
+                if (anchorBox && anchorBox->renderer()->node() && anchorBox->renderer()->node()->isLink())
+                    totalWidth = anchorBox->width() + font.width(TextRun(ellipsisAndSpace, 2));
+                else {
+                    anchorBox = 0;
+                    totalWidth = font.width(TextRun(&horizontalEllipsis, 1));
+                }
+                                
                 // See if this width can be accommodated on the last visible line
                 RenderBlock* destBlock = toRenderBlock(lastVisibleLine->renderer());
                 RenderBlock* srcBlock = toRenderBlock(lastLine->renderer());
@@ -755,7 +758,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     continue;
 
                 // Let the truncation code kick in.
-                lastVisibleLine->placeEllipsis(ellipsisAndSpaceStr, ltr, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
+                lastVisibleLine->placeEllipsis(anchorBox ? ellipsisAndSpaceStr : ellipsisStr, ltr, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
                 destBlock->setHasMarkupTruncation(true);
             }
         }
@@ -785,8 +788,13 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     else
                         child->layer()->setStaticX(borderRight()+paddingRight());
                 }
-                if (child->style()->hasStaticY())
-                    child->layer()->setStaticY(height());
+                if (child->style()->hasStaticY()) {
+                    RenderLayer* childLayer = child->layer();
+                    if (childLayer->staticY() != height()) {
+                        child->layer()->setStaticY(height());
+                        child->setChildNeedsLayout(true, false);
+                    }
+                }
                 child = iterator.next();
                 continue;
             } 
diff --git a/WebCore/rendering/RenderFrameSet.cpp b/WebCore/rendering/RenderFrameSet.cpp
index a855a08..09ad11f 100644
--- a/WebCore/rendering/RenderFrameSet.cpp
+++ b/WebCore/rendering/RenderFrameSet.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the KDE project.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
@@ -90,13 +88,14 @@ void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const IntRect
     
     // Fill first.
     GraphicsContext* context = paintInfo.context;
-    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor());
+    ColorSpace colorSpace = style()->colorSpace();
+    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor(), colorSpace);
     
     // Now stroke the edges but only if we have enough room to paint both edges with a little
     // bit of the fill color showing through.
     if (borderRect.width() >= 3) {
-        context->fillRect(IntRect(borderRect.topLeft(), IntSize(1, height())), borderStartEdgeColor());
-        context->fillRect(IntRect(borderRect.topRight(), IntSize(1, height())), borderEndEdgeColor());
+        context->fillRect(IntRect(borderRect.topLeft(), IntSize(1, height())), borderStartEdgeColor(), colorSpace);
+        context->fillRect(IntRect(borderRect.topRight(), IntSize(1, height())), borderEndEdgeColor(), colorSpace);
     }
 }
 
@@ -109,13 +108,14 @@ void RenderFrameSet::paintRowBorder(const PaintInfo& paintInfo, const IntRect& b
     
     // Fill first.
     GraphicsContext* context = paintInfo.context;
-    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor());
+    ColorSpace colorSpace = style()->colorSpace();
+    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor(), colorSpace);
 
     // Now stroke the edges but only if we have enough room to paint both edges with a little
     // bit of the fill color showing through.
     if (borderRect.height() >= 3) {
-        context->fillRect(IntRect(borderRect.topLeft(), IntSize(width(), 1)), borderStartEdgeColor());
-        context->fillRect(IntRect(borderRect.bottomLeft(), IntSize(width(), 1)), borderEndEdgeColor());
+        context->fillRect(IntRect(borderRect.topLeft(), IntSize(width(), 1)), borderStartEdgeColor(), colorSpace);
+        context->fillRect(IntRect(borderRect.bottomLeft(), IntSize(width(), 1)), borderEndEdgeColor(), colorSpace);
     }
 }
 
diff --git a/WebCore/rendering/RenderImage.cpp b/WebCore/rendering/RenderImage.cpp
index ff7c9c9..d06ca1f 100644
--- a/WebCore/rendering/RenderImage.cpp
+++ b/WebCore/rendering/RenderImage.cpp
@@ -53,7 +53,7 @@ namespace WebCore {
 static const double cInterpolationCutoff = 800. * 800.;
 static const double cLowQualityTimeThreshold = 0.050; // 50 ms
 
-class RenderImageScaleData {
+class RenderImageScaleData : public Noncopyable {
 public:
     RenderImageScaleData(RenderImage* image, const IntSize& size, double time, bool lowQualityScale)
         : m_size(size)
@@ -371,8 +371,8 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
             context->save();
 #endif
             context->setStrokeStyle(SolidStroke);
-            context->setStrokeColor(Color::lightGray);
-            context->setFillColor(Color::transparent);
+            context->setStrokeColor(Color::lightGray, style()->colorSpace());
+            context->setFillColor(Color::transparent, style()->colorSpace());
             context->drawRect(IntRect(tx + leftBorder + leftPad, ty + topBorder + topPad, cWidth, cHeight));
 #ifdef ANDROID_FIX // see http://b/issue?id=2052757
             context->restore();
@@ -396,13 +396,13 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
                     centerY = 0;
                 imageX = leftBorder + leftPad + centerX + 1;
                 imageY = topBorder + topPad + centerY + 1;
-                context->drawImage(image(), IntPoint(tx + imageX, ty + imageY));
+                context->drawImage(image(), style()->colorSpace(), IntPoint(tx + imageX, ty + imageY));
                 errorPictureDrawn = true;
             }
 
             if (!m_altText.isEmpty()) {
                 String text = document()->displayStringModifiedByEncoding(m_altText);
-                context->setFillColor(style()->color());
+                context->setFillColor(style()->color(), style()->colorSpace());
                 int ax = tx + leftBorder + leftPad;
                 int ay = ty + topBorder + topPad;
                 const Font& font = style()->font();
@@ -434,7 +434,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
         IntRect rect(IntPoint(tx + leftBorder + leftPad, ty + topBorder + topPad), contentSize);
         HTMLImageElement* imageElt = (node() && node()->hasTagName(imgTag)) ? static_cast<HTMLImageElement*>(node()) : 0;
         CompositeOperator compositeOperator = imageElt ? imageElt->compositeOperator() : CompositeSourceOver;
-        context->drawImage(image(cWidth, cHeight), rect, compositeOperator, useLowQualityScaling);
+        context->drawImage(image(cWidth, cHeight), style()->colorSpace(), rect, compositeOperator, useLowQualityScaling);
     }
 }
 
diff --git a/WebCore/rendering/RenderInline.cpp b/WebCore/rendering/RenderInline.cpp
index 8b0c3c7..6df5ffe 100644
--- a/WebCore/rendering/RenderInline.cpp
+++ b/WebCore/rendering/RenderInline.cpp
@@ -56,6 +56,7 @@ void RenderInline::destroy()
     // properly dirty line boxes that they are removed from.  Effects that do :before/:after only on hover could crash otherwise.
     children()->destroyLeftoverChildren();
 
+<<<<<<< HEAD:WebCore/rendering/RenderInline.cpp
     // Destroy our continuation before anything other than anonymous children. 
     // The reason we don't destroy it before anonymous children is that they may 
     // have continuations of their own that are anonymous children of our continuation. 
@@ -64,6 +65,16 @@ void RenderInline::destroy()
         m_continuation = 0; 
     } 
 
+=======
+    // Destroy our continuation before anything other than anonymous children.
+    // The reason we don't destroy it before anonymous children is that they may
+    // have continuations of their own that are anonymous children of our continuation.
+    if (m_continuation) {
+        m_continuation->destroy();
+        m_continuation = 0;
+    }
+    
+>>>>>>> webkit.org at r51976:WebCore/rendering/RenderInline.cpp
     if (!documentBeingDestroyed()) {
         if (firstLineBox()) {
             // We can't wait for RenderBoxModelObject::destroy to clear the selection,
diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index 8f2805a..ee7814c 100644
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -243,14 +243,6 @@ bool RenderLayer::hasAcceleratedCompositing() const
 #endif
 }
 
-void RenderLayer::setStaticY(int staticY)
-{
-    if (m_staticY == staticY)
-        return;
-    m_staticY = staticY;
-    renderer()->setChildNeedsLayout(true, false);
-}
-
 void RenderLayer::updateLayerPositions(UpdateLayerPositionsFlags flags)
 {
     if (flags & DoFullRepaint) {
@@ -383,6 +375,20 @@ TransformationMatrix RenderLayer::currentTransform() const
     return *m_transform;
 }
 
+TransformationMatrix RenderLayer::renderableTransform(PaintBehavior paintBehavior) const
+{
+    if (!m_transform)
+        return TransformationMatrix();
+    
+    if (paintBehavior & PaintBehaviorFlattenCompositingLayers) {
+        TransformationMatrix matrix = *m_transform;
+        makeMatrixRenderable(matrix, false /* flatten 3d */);
+        return matrix;
+    }
+
+    return *m_transform;
+}
+
 void RenderLayer::setHasVisibleContent(bool b)
 { 
     if (m_hasVisibleContent == b && !m_visibleContentStatusDirty)
@@ -689,6 +695,27 @@ RenderLayer* RenderLayer::enclosingCompositingLayer(bool includeSelf) const
 }
 #endif
 
+RenderLayer* RenderLayer::clippingRoot() const
+{
+    const RenderLayer* current = this;
+    while (current) {
+        if (current->renderer()->isRenderView())
+            return const_cast<RenderLayer*>(current);
+
+        current = compositingContainer(current);
+        ASSERT(current);
+        if (current->transform()
+#if USE(ACCELERATED_COMPOSITING)
+            || current->isComposited()
+#endif
+        )
+            return const_cast<RenderLayer*>(current);
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 IntPoint RenderLayer::absoluteToContents(const IntPoint& absolutePoint) const
 {
     // We don't use convertToLayerCoords because it doesn't know about transforms
@@ -727,46 +754,18 @@ RenderLayer* RenderLayer::transparentPaintingAncestor()
     return 0;
 }
 
-static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransform, const RenderLayer* l, const RenderLayer* rootLayer)
-{
-    // FIXME: Although this function completely ignores CSS-imposed clipping, we did already intersect with the
-    // paintDirtyRect, and that should cut down on the amount we have to paint.  Still it
-    // would be better to respect clips.
-    
-    if (rootLayer != l && l->paintsWithTransform()) {
-        // The best we can do here is to use enclosed bounding boxes to establish a "fuzzy" enough clip to encompass
-        // the transformed layer and all of its children.
-        int x = 0;
-        int y = 0;
-        l->convertToLayerCoords(rootLayer, x, y);
-
-        TransformationMatrix transform;
-        transform.translate(x, y);
-        transform = *l->transform() * transform;
-        transform = transform * enclosingTransform;
+static IntRect transparencyClipBox(const RenderLayer* l, const RenderLayer* rootLayer, PaintBehavior paintBehavior);
 
-        // We now have a transform that will produce a rectangle in our view's space.
-        IntRect clipRect = transform.mapRect(l->boundingBox(l));
-        
-        // Now shift the root layer to be us and pass down the new enclosing transform.
-        for (RenderLayer* curr = l->firstChild(); curr; curr = curr->nextSibling()) {
-            if (!l->reflection() || l->reflectionLayer() != curr)
-                clipRect.unite(transparencyClipBox(transform, curr, l));
-        }
-            
-        return clipRect;
-    }
-    
-    // Note: we don't have to walk z-order lists since transparent elements always establish
-    // a stacking context.  This means we can just walk the layer tree directly.
-    IntRect clipRect = l->boundingBox(rootLayer);
-    
+static void expandClipRectForDescendantsAndReflection(IntRect& clipRect, const RenderLayer* l, const RenderLayer* rootLayer, PaintBehavior paintBehavior)
+{
     // If we have a mask, then the clip is limited to the border box area (and there is
     // no need to examine child layers).
     if (!l->renderer()->hasMask()) {
+        // Note: we don't have to walk z-order lists since transparent elements always establish
+        // a stacking context.  This means we can just walk the layer tree directly.
         for (RenderLayer* curr = l->firstChild(); curr; curr = curr->nextSibling()) {
             if (!l->reflection() || l->reflectionLayer() != curr)
-                clipRect.unite(transparencyClipBox(enclosingTransform, curr, rootLayer));
+                clipRect.unite(transparencyClipBox(curr, rootLayer, paintBehavior));
         }
     }
 
@@ -782,25 +781,54 @@ static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransfor
         clipRect.unite(l->renderBox()->reflectedRect(clipRect));
         clipRect.move(deltaX, deltaY);
     }
+}
 
-    // Now map the clipRect via the enclosing transform
-    return enclosingTransform.mapRect(clipRect);
+static IntRect transparencyClipBox(const RenderLayer* l, const RenderLayer* rootLayer, PaintBehavior paintBehavior)
+{
+    // FIXME: Although this function completely ignores CSS-imposed clipping, we did already intersect with the
+    // paintDirtyRect, and that should cut down on the amount we have to paint.  Still it
+    // would be better to respect clips.
+    
+    if (rootLayer != l && l->paintsWithTransform(paintBehavior)) {
+        // The best we can do here is to use enclosed bounding boxes to establish a "fuzzy" enough clip to encompass
+        // the transformed layer and all of its children.
+        int x = 0;
+        int y = 0;
+        l->convertToLayerCoords(rootLayer, x, y);
+
+        TransformationMatrix transform;
+        transform.translate(x, y);
+        transform = *l->transform() * transform;
+
+        IntRect clipRect = l->boundingBox(l);
+        expandClipRectForDescendantsAndReflection(clipRect, l, l, paintBehavior);
+        return transform.mapRect(clipRect);
+    }
+    
+    IntRect clipRect = l->boundingBox(rootLayer);
+    expandClipRectForDescendantsAndReflection(clipRect, l, rootLayer, paintBehavior);
+    return clipRect;
 }
 
-void RenderLayer::beginTransparencyLayers(GraphicsContext* p, const RenderLayer* rootLayer)
+void RenderLayer::beginTransparencyLayers(GraphicsContext* p, const RenderLayer* rootLayer, PaintBehavior paintBehavior)
 {
-    if (p->paintingDisabled() || (paintsWithTransparency() && m_usedTransparency))
+    if (p->paintingDisabled() || (paintsWithTransparency(paintBehavior) && m_usedTransparency))
         return;
     
     RenderLayer* ancestor = transparentPaintingAncestor();
     if (ancestor)
-        ancestor->beginTransparencyLayers(p, rootLayer);
+        ancestor->beginTransparencyLayers(p, rootLayer, paintBehavior);
     
-    if (paintsWithTransparency()) {
+    if (paintsWithTransparency(paintBehavior)) {
         m_usedTransparency = true;
         p->save();
-        p->clip(transparencyClipBox(TransformationMatrix(), this, rootLayer));
+        IntRect clipRect = transparencyClipBox(this, rootLayer, paintBehavior);
+        p->clip(clipRect);
         p->beginTransparencyLayer(renderer()->opacity());
+#ifdef REVEAL_TRANSPARENCY_LAYERS
+        p->setFillColor(Color(0.0f, 0.0f, 0.5f, 0.2f));
+        p->fillRect(clipRect);
+#endif
     }
 }
 
@@ -1061,7 +1089,7 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
 
     bool restrictedByLineClamp = false;
     if (renderer()->parent())
-        restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
+        restrictedByLineClamp = !renderer()->parent()->style()->lineClamp().isNone();
 
     if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
         int newOffsetX = scrollXOffset() + xDelta;
@@ -1205,7 +1233,7 @@ void RenderLayer::scrollRectToVisible(const IntRect &rect, bool scrollToAnchor,
     bool restrictedByLineClamp = false;
     if (renderer()->parent()) {
         parentLayer = renderer()->parent()->enclosingLayer();
-        restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
+        restrictedByLineClamp = !renderer()->parent()->style()->lineClamp().isNone();
     }
 
     if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
@@ -1921,7 +1949,7 @@ void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, co
         return;
     }
     
-    context->fillRect(absRect, Color::white);
+    context->fillRect(absRect, Color::white, box->style()->colorSpace());
 }
 
 void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
@@ -1950,7 +1978,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
     // Paint the resizer control.
     DEFINE_STATIC_LOCAL(RefPtr<Image>, resizeCornerImage, (Image::loadPlatformResource("textAreaResizeCorner")));
     IntPoint imagePoint(absRect.right() - resizeCornerImage->width(), absRect.bottom() - resizeCornerImage->height());
-    context->drawImage(resizeCornerImage.get(), imagePoint);
+    context->drawImage(resizeCornerImage.get(), box->style()->colorSpace(), imagePoint);
 
     // Draw a frame around the resizer (1px grey line) if there are any scrollbars present.
     // Clipping will exclude the right and bottom edges of this frame.
@@ -1959,9 +1987,9 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
         context->clip(absRect);
         IntRect largerCorner = absRect;
         largerCorner.setSize(IntSize(largerCorner.width() + 1, largerCorner.height() + 1));
-        context->setStrokeColor(Color(makeRGB(217, 217, 217)));
+        context->setStrokeColor(Color(makeRGB(217, 217, 217)), DeviceColorSpace);
         context->setStrokeThickness(1.0f);
-        context->setFillColor(Color::transparent);
+        context->setFillColor(Color::transparent, DeviceColorSpace);
         context->drawRect(largerCorner);
         context->restore();
     }
@@ -2044,10 +2072,10 @@ bool RenderLayer::scroll(ScrollDirection direction, ScrollGranularity granularit
     return (didHorizontalScroll || didVerticalScroll);
 }
 
-void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintRestriction paintRestriction, RenderObject *paintingRoot)
+void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintBehavior paintBehavior, RenderObject *paintingRoot)
 {
     RenderObject::OverlapTestRequestMap overlapTestRequests;
-    paintLayer(this, p, damageRect, paintRestriction, paintingRoot, &overlapTestRequests);
+    paintLayer(this, p, damageRect, paintBehavior, paintingRoot, &overlapTestRequests);
     RenderObject::OverlapTestRequestMap::iterator end = overlapTestRequests.end();
     for (RenderObject::OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it)
         it->first->setOverlapTestResult(false);
@@ -2091,7 +2119,7 @@ static bool shouldDoSoftwarePaint(const RenderLayer* layer, bool paintingReflect
 #endif
 
 void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
-                        const IntRect& paintDirtyRect, PaintRestriction paintRestriction,
+                        const IntRect& paintDirtyRect, PaintBehavior paintBehavior,
                         RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* overlapTestRequests,
                         PaintLayerFlags paintFlags)
 {
@@ -2099,7 +2127,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (isComposited()) {
         // The updatingControlTints() painting pass goes through compositing layers,
         // but we need to ensure that we don't cache clip rects computed with the wrong root in this case.
-        if (p->updatingControlTints())
+        if (p->updatingControlTints() || (paintBehavior & PaintBehaviorFlattenCompositingLayers))
             paintFlags |= PaintLayerTemporaryClipRects;
         else if (!backing()->paintingGoesToWindow() && !shouldDoSoftwarePaint(this, paintFlags & PaintLayerPaintingReflection)) {
             // If this RenderLayer should paint into its backing, that will be done via RenderLayerBacking::paintIntoLayer().
@@ -2118,19 +2146,20 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (!renderer()->opacity())
         return;
 
-    if (paintsWithTransparency())
+    if (paintsWithTransparency(paintBehavior))
         paintFlags |= PaintLayerHaveTransparency;
 
     // Apply a transform if we have one.  A reflection is considered to be a transform, since it is a flip and a translate.
-    if (paintsWithTransform() && !(paintFlags & PaintLayerAppliedTransform)) {
+    if (paintsWithTransform(paintBehavior) && !(paintFlags & PaintLayerAppliedTransform)) {
+        TransformationMatrix layerTransform = renderableTransform(paintBehavior);
         // If the transform can't be inverted, then don't paint anything.
-        if (!m_transform->isInvertible())
+        if (!layerTransform.isInvertible())
             return;
 
         // If we have a transparency layer enclosing us and we are the root of a transform, then we need to establish the transparency
         // layer from the parent now.
         if (paintFlags & PaintLayerHaveTransparency)
-            parent()->beginTransparencyLayers(p, rootLayer);
+            parent()->beginTransparencyLayers(p, rootLayer, paintBehavior);
   
         // Make sure the parent's clip rects have been calculated.
         IntRect clipRect = paintDirtyRect;
@@ -2153,15 +2182,19 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
 #else
         TransformationMatrix transform;
         transform.translate(x, y);
+<<<<<<< HEAD:WebCore/rendering/RenderLayer.cpp
         transform = *m_transform * transform;
 #endif
+=======
+        transform = layerTransform * transform;
+>>>>>>> webkit.org at r51976:WebCore/rendering/RenderLayer.cpp
         
         // Apply the transform.
         p->save();
         p->concatCTM(transform);
 
         // Now do a paint with the root layer shifted to be us.
-        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), paintRestriction, paintingRoot, overlapTestRequests, paintFlags | PaintLayerAppliedTransform);
+        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), paintBehavior, paintingRoot, overlapTestRequests, paintFlags | PaintLayerAppliedTransform);
 
         p->restore();
         
@@ -2178,7 +2211,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (m_reflection && !m_paintingInsideReflection) {
         // Mark that we are now inside replica painting.
         m_paintingInsideReflection = true;
-        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags | PaintLayerPaintingReflection);
+        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags | PaintLayerPaintingReflection);
         m_paintingInsideReflection = false;
     }
 
@@ -2193,8 +2226,8 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Ensure our lists are up-to-date.
     updateCompositingAndLayerListsIfNeeded();
 
-    bool selectionOnly = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+    bool forceBlackText = paintBehavior & PaintBehaviorForceBlackText;
+    bool selectionOnly  = paintBehavior & PaintBehaviorSelectionOnly;
     
     // If this layer's renderer is a child of the paintingRoot, we render unconditionally, which
     // is done by passing a nil paintingRoot down to our renderer (as if no paintingRoot was ever set).
@@ -2212,7 +2245,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
-            beginTransparencyLayers(p, rootLayer);
+            beginTransparencyLayers(p, rootLayer, paintBehavior);
         
         // Paint our background first, before painting any child layers.
         // Establish the clip used to paint our background.
@@ -2229,13 +2262,13 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Now walk the sorted list of children with negative z-indices.
     if (m_negZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_negZOrderList->begin(); it != m_negZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
     
     // Now establish the appropriate clip and paint our child RenderObjects.
     if (shouldPaint && !clipRectToApply.isEmpty()) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
-            beginTransparencyLayers(p, rootLayer);
+            beginTransparencyLayers(p, rootLayer, paintBehavior);
 
         // Set up the clip used when painting our children.
         setClip(p, paintDirtyRect, clipRectToApply);
@@ -2268,12 +2301,12 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Paint any child layers that have overflow.
     if (m_normalFlowList)
         for (Vector<RenderLayer*>::iterator it = m_normalFlowList->begin(); it != m_normalFlowList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
 
     // Now walk the sorted list of children with positive z-indices.
     if (m_posZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_posZOrderList->begin(); it != m_posZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
     
     if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         setClip(p, paintDirtyRect, damageRect);
@@ -2813,17 +2846,49 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& pa
 IntRect RenderLayer::childrenClipRect() const
 {
     RenderLayer* rootLayer = renderer()->view()->layer();
+    RenderLayer* clippingRootLayer = clippingRoot();
     IntRect layerBounds, backgroundRect, foregroundRect, outlineRect;
-    calculateRects(rootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
-    return foregroundRect;
+    calculateRects(clippingRootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
+    return clippingRootLayer->renderer()->localToAbsoluteQuad(FloatQuad(foregroundRect)).enclosingBoundingBox();
 }
 
 IntRect RenderLayer::selfClipRect() const
 {
     RenderLayer* rootLayer = renderer()->view()->layer();
+    RenderLayer* clippingRootLayer = clippingRoot();
     IntRect layerBounds, backgroundRect, foregroundRect, outlineRect;
-    calculateRects(rootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
-    return backgroundRect;
+    calculateRects(clippingRootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
+    return clippingRootLayer->renderer()->localToAbsoluteQuad(FloatQuad(backgroundRect)).enclosingBoundingBox();
+}
+
+void RenderLayer::addBlockSelectionGapsBounds(const IntRect& bounds)
+{
+    m_blockSelectionGapsBounds.unite(bounds);
+}
+
+void RenderLayer::clearBlockSelectionGapsBounds()
+{
+    m_blockSelectionGapsBounds = IntRect();
+    for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
+        child->clearBlockSelectionGapsBounds();
+}
+
+void RenderLayer::repaintBlockSelectionGaps()
+{
+    for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
+        child->repaintBlockSelectionGaps();
+
+    if (m_blockSelectionGapsBounds.isEmpty())
+        return;
+
+    IntRect rect = m_blockSelectionGapsBounds;
+    rect.move(-scrolledContentOffset());
+    if (renderer()->hasOverflowClip())
+        rect.intersect(toRenderBox(renderer())->overflowClipRect(0, 0));
+    if (renderer()->hasClip())
+        rect.intersect(toRenderBox(renderer())->clipRect(0, 0));
+    if (!rect.isEmpty())
+        renderer()->repaintRectangle(rect);
 }
 
 bool RenderLayer::intersectsDamageRect(const IntRect& layerBounds, const IntRect& damageRect, const RenderLayer* rootLayer) const
diff --git a/WebCore/rendering/RenderLayer.h b/WebCore/rendering/RenderLayer.h
index a274638..af64fc4 100644
--- a/WebCore/rendering/RenderLayer.h
+++ b/WebCore/rendering/RenderLayer.h
@@ -202,7 +202,7 @@ public:
 
     bool isTransparent() const;
     RenderLayer* transparentPaintingAncestor();
-    void beginTransparencyLayers(GraphicsContext*, const RenderLayer* rootLayer);
+    void beginTransparencyLayers(GraphicsContext*, const RenderLayer* rootLayer, PaintBehavior);
 
     bool hasReflection() const { return renderer()->hasReflection(); }
     RenderReplica* reflection() const { return m_reflection; }
@@ -312,6 +312,10 @@ public:
     void clearClipRectsIncludingDescendants();
     void clearClipRects();
 
+    void addBlockSelectionGapsBounds(const IntRect&);
+    void clearBlockSelectionGapsBounds();
+    void repaintBlockSelectionGaps();
+
     // Get the enclosing stacking context for this layer.  A stacking context is a layer
     // that has a non-auto z-index.
     RenderLayer* stackingContext() const;
@@ -336,6 +340,9 @@ public:
     // the <html> layer and the root layer).
     RenderLayer* enclosingPositionedAncestor() const;
 
+    // The layer relative to which clipping rects for this layer are computed.
+    RenderLayer* clippingRoot() const;
+
 #if USE(ACCELERATED_COMPOSITING)
     // Enclosing compositing layer; if includeSelf is true, may return this.
     RenderLayer* enclosingCompositingLayer(bool includeSelf = true) const;
@@ -352,7 +359,7 @@ public:
     // paints the layers that intersect the damage rect from back to
     // front.  The hitTest method looks for mouse events by walking
     // layers that intersect the point from front to back.
-    void paint(GraphicsContext*, const IntRect& damageRect, PaintRestriction = PaintRestrictionNone, RenderObject* paintingRoot = 0);
+    void paint(GraphicsContext*, const IntRect& damageRect, PaintBehavior = PaintBehaviorNormal, RenderObject* paintingRoot = 0);
     bool hitTest(const HitTestRequest&, HitTestResult&);
 
     // This method figures out our layerBounds in coordinates relative to
@@ -390,7 +397,7 @@ public:
     int staticX() const { return m_staticX; }
     int staticY() const { return m_staticY; }
     void setStaticX(int staticX) { m_staticX = staticX; }
-    void setStaticY(int staticY);
+    void setStaticY(int staticY) { m_staticY = staticY; }
 
     bool hasTransform() const { return renderer()->hasTransform(); }
     // Note that this transform has the transform-origin baked in.
@@ -399,6 +406,7 @@ public:
     // resulting transform has transform-origin baked in. If the layer does not have a transform,
     // returns the identity matrix.
     TransformationMatrix currentTransform() const;
+    TransformationMatrix renderableTransform(PaintBehavior) const;
     
     // Get the perspective transform, which is applied to transformed sublayers.
     // Returns true if the layer has a -webkit-perspective.
@@ -426,14 +434,14 @@ public:
     bool hasCompositedMask() const { return false; }
 #endif
 
-    bool paintsWithTransparency() const
+    bool paintsWithTransparency(PaintBehavior paintBehavior) const
     {
-        return isTransparent() && !isComposited();
+        return isTransparent() && ((paintBehavior & PaintBehaviorFlattenCompositingLayers) || !isComposited());
     }
 
-    bool paintsWithTransform() const
+    bool paintsWithTransform(PaintBehavior paintBehavior) const
     {
-        return transform() && !isComposited();
+        return transform() && ((paintBehavior & PaintBehaviorFlattenCompositingLayers) || !isComposited());
     }
 
 private:
@@ -465,7 +473,7 @@ private:
     typedef unsigned PaintLayerFlags;
 
     void paintLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
-                    PaintRestriction, RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* = 0,
+                    PaintBehavior, RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* = 0,
                     PaintLayerFlags paintFlags = 0);
 
     RenderLayer* hitTestLayer(RenderLayer* rootLayer, RenderLayer* containerLayer, const HitTestRequest& request, HitTestResult& result,
@@ -644,6 +652,9 @@ protected:
     RenderScrollbarPart* m_scrollCorner;
     RenderScrollbarPart* m_resizer;
 
+private:
+    IntRect m_blockSelectionGapsBounds;
+
 #if USE(ACCELERATED_COMPOSITING)
     OwnPtr<RenderLayerBacking> m_backing;
 #endif
diff --git a/WebCore/rendering/RenderLayerBacking.cpp b/WebCore/rendering/RenderLayerBacking.cpp
index d7248d4..a62c1be 100644
--- a/WebCore/rendering/RenderLayerBacking.cpp
+++ b/WebCore/rendering/RenderLayerBacking.cpp
@@ -28,7 +28,9 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "AnimationController.h"
-#include "CanvasRenderingContext3D.h"
+#if ENABLE(3D_CANVAS)    
+#include "WebGLRenderingContext.h"
+#endif
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "FrameView.h"
@@ -37,11 +39,14 @@
 #include "HTMLCanvasElement.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "InspectorTimelineAgent.h"
+#include "KeyframeList.h"
 #include "RenderBox.h"
 #include "RenderImage.h"
 #include "RenderLayerCompositor.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
+#include "Settings.h"
 
 #include "RenderLayerBacking.h"
 
@@ -192,7 +197,7 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
         else if (renderer()->isCanvas()) {
             HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
             if (canvas->is3D()) {
-                CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(canvas->renderingContext());
+                WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(canvas->renderingContext());
                 if (context->graphicsContext3D()->platformGraphicsContext3D())
                     m_graphicsLayer->setContentsToGraphicsContext3D(context->graphicsContext3D());
             }
@@ -849,7 +854,7 @@ static void restoreClip(GraphicsContext* p, const IntRect& paintDirtyRect, const
 // Share this with RenderLayer::paintLayer, which would have to be educated about GraphicsLayerPaintingPhase?
 void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext* context,
                     const IntRect& paintDirtyRect,      // in the coords of rootLayer
-                    PaintRestriction paintRestriction, GraphicsLayerPaintingPhase paintingPhase,
+                    PaintBehavior paintBehavior, GraphicsLayerPaintingPhase paintingPhase,
                     RenderObject* paintingRoot)
 {
     if (paintingGoesToWindow()) {
@@ -863,7 +868,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     if (m_owningLayer->hasReflection()) {
         // Mark that we are now inside replica painting.
         m_owningLayer->setPaintingInsideReflection(true);
-        m_owningLayer->reflectionLayer()->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot, 0, RenderLayer::PaintLayerPaintingReflection);
+        m_owningLayer->reflectionLayer()->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot, 0, RenderLayer::PaintLayerPaintingReflection);
         m_owningLayer->setPaintingInsideReflection(false);
     }
 
@@ -899,9 +904,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
             
             int rw;
             int rh;
-            if (box->view()->frameView()) {
-                rw = box->view()->frameView()->contentsWidth();
-                rh = box->view()->frameView()->contentsHeight();
+            if (FrameView* frameView = box->view()->frameView()) {
+                rw = frameView->contentsWidth();
+                rh = frameView->contentsHeight();
             } else {
                 rw = box->view()->width();
                 rh = box->view()->height();
@@ -930,8 +935,8 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         restoreClip(context, paintDirtyRect, damageRect);
     }
                 
-    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-    bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+    bool forceBlackText = paintBehavior & PaintBehaviorForceBlackText;
+    bool selectionOnly  = paintBehavior & PaintBehaviorSelectionOnly;
 
     if (shouldPaint && (paintingPhase & GraphicsLayerPaintForeground)) {
         // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
@@ -939,7 +944,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
         if (negZOrderList) {
             for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it)
-                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot);
         }
 
         // Set up the clip used when painting our children.
@@ -975,14 +980,14 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         Vector<RenderLayer*>* normalFlowList = m_owningLayer->normalFlowList();
         if (normalFlowList) {
             for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it)
-                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot);
         }
 
         // Now walk the sorted list of children with positive z-indices.
         Vector<RenderLayer*>* posZOrderList = m_owningLayer->posZOrderList();
         if (posZOrderList) {
             for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it)
-                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot);
         }
     }
     
@@ -1002,9 +1007,25 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     ASSERT(!m_owningLayer->m_usedTransparency);
 }
 
+static InspectorTimelineAgent* inspectorTimelineAgent(RenderObject* renderer)
+{
+    Frame* frame = renderer->document()->frame();
+    if (!frame)
+        return 0;
+    Page* page = frame->page();
+    if (!page)
+        return 0;
+    return page->inspectorTimelineAgent();
+}
+
 // Up-call from compositing layer drawing callback.
 void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent(m_owningLayer->renderer()))
+        timelineAgent->willPaint(clip);
+#endif
+
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
     IntRect enclosingBBox = compositedBounds();
@@ -1021,7 +1042,22 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
     IntRect dirtyRect = enclosingBBox;
     dirtyRect.intersect(clipRect);
 
-    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, paintingPhase, renderer());
+    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintBehaviorNormal, paintingPhase, renderer());
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent(m_owningLayer->renderer()))
+        timelineAgent->didPaint();
+#endif
+}
+
+bool RenderLayerBacking::showDebugBorders() const
+{
+    return compositor() ? compositor()->showDebugBorders() : false;
+}
+
+bool RenderLayerBacking::showRepaintCounter() const
+{
+    return compositor() ? compositor()->showRepaintCounter() : false;
 }
 
 bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes)
diff --git a/WebCore/rendering/RenderLayerBacking.h b/WebCore/rendering/RenderLayerBacking.h
index 17bcaf7..2bbb37f 100644
--- a/WebCore/rendering/RenderLayerBacking.h
+++ b/WebCore/rendering/RenderLayerBacking.h
@@ -119,6 +119,9 @@ public:
 
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& clip);
 
+    virtual bool showDebugBorders() const;
+    virtual bool showRepaintCounter() const;
+
     IntRect contentsBox() const;
     
 private:
@@ -160,7 +163,7 @@ private:
     bool hasNonCompositingContent() const;
     
     void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
-                    PaintRestriction paintRestriction, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
+                    PaintBehavior paintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
 
     static int graphicsLayerToCSSProperty(AnimatedPropertyID);
     static AnimatedPropertyID cssToGraphicsLayerProperty(int);
diff --git a/WebCore/rendering/RenderLayerCompositor.cpp b/WebCore/rendering/RenderLayerCompositor.cpp
index 5201287..2f5e267 100644
--- a/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/WebCore/rendering/RenderLayerCompositor.cpp
@@ -79,6 +79,8 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     : m_renderView(renderView)
     , m_rootPlatformLayer(0)
     , m_hasAcceleratedCompositing(true)
+    , m_showDebugBorders(false)
+    , m_showRepaintCounter(false)
     , m_compositingConsultsOverlap(true)
     , m_compositing(false)
     , m_rootLayerAttached(false)
@@ -109,16 +111,24 @@ void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
     }
 }
 
-void RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag()
+void RenderLayerCompositor::cacheAcceleratedCompositingFlags()
 {
     bool hasAcceleratedCompositing = false;
-    if (Settings* settings = m_renderView->document()->settings())
+    bool showDebugBorders = false;
+    bool showRepaintCounter = false;
+    
+    if (Settings* settings = m_renderView->document()->settings()) {
         hasAcceleratedCompositing = settings->acceleratedCompositingEnabled();
+        showDebugBorders = settings->showDebugBorders();
+        showRepaintCounter = settings->showRepaintCounter();
+    }
 
-    if (hasAcceleratedCompositing != m_hasAcceleratedCompositing)
+    if (hasAcceleratedCompositing != m_hasAcceleratedCompositing || showDebugBorders != m_showDebugBorders || showRepaintCounter != m_showRepaintCounter)
         setCompositingLayersNeedRebuild();
         
     m_hasAcceleratedCompositing = hasAcceleratedCompositing;
+    m_showDebugBorders = showDebugBorders;
+    m_showRepaintCounter = showRepaintCounter;
 }
 
 void RenderLayerCompositor::setCompositingLayersNeedRebuild(bool needRebuild)
@@ -175,10 +185,18 @@ void RenderLayerCompositor::updateCompositingLayers(RenderLayer* updateRoot)
         needLayerRebuild |= layersChanged;
     }
 
-    // Now create and parent the compositing layers.
-    {
+    if (needLayerRebuild) {
+        // Now updated and parent the compositing layers.
         CompositingState compState(updateRoot);
-        rebuildCompositingLayerTree(updateRoot, compState, needLayerRebuild);
+        Vector<GraphicsLayer*> childList;
+        rebuildCompositingLayerTree(updateRoot, compState, childList);
+
+        // Host the document layer in the RenderView's root layer.
+        if (updateRoot == rootRenderLayer() && !childList.isEmpty())
+            m_rootPlatformLayer->setChildren(childList);
+    } else {
+        // We just need to do a geometry update.
+        updateLayerTreeGeometry(updateRoot);
     }
     
 #if PROFILE_LAYER_REBUILD
@@ -328,7 +346,7 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         }
     }
 
-    if (layer->paintsWithTransform()) {
+    if (layer->paintsWithTransform(PaintBehaviorNormal)) {
         TransformationMatrix* affineTrans = layer->transform();
         boundingBoxRect = affineTrans->mapRect(boundingBoxRect);
         unionBounds = affineTrans->mapRect(unionBounds);
@@ -476,7 +494,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
                 // If we have to make a layer for this child, make one now so we can have a contents layer
                 // (since we need to ensure that the -ve z-order child renders underneath our contents).
-                if (childState.m_subtreeIsCompositing) {
+                if (!willBeComposited && childState.m_subtreeIsCompositing) {
                     // make layer compositing
                     layer->setMustOverlapCompositedLayers(true);
                     childState.m_compositingAncestor = layer;
@@ -509,7 +527,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // If we have a software transform, and we have layers under us, we need to also
     // be composited. Also, if we have opacity < 1, then we need to be a layer so that
     // the child layers are opaque, then rendered with opacity on this layer.
-    if (childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
+    if (!willBeComposited && childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
         layer->setMustOverlapCompositedLayers(true);
         if (overlapMap)
             addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
@@ -586,11 +604,12 @@ bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 }
 #endif
 
-void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState& compositingState, bool updateHierarchy)
+void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, const CompositingState& compositingState, Vector<GraphicsLayer*>& childLayersOfEnclosingLayer)
 {
     // Make the layer compositing if necessary, and set up clipping and content layers.
     // Note that we can only do work here that is independent of whether the descendant layers
     // have been processed. computeCompositingRequirements() will already have done the repaint if necessary.
+    
     RenderLayerBacking* layerBacking = layer->backing();
     if (layerBacking) {
         // The compositing state of all our children has been updated already, so now
@@ -601,15 +620,12 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
 
         if (!layer->parent())
             updateRootLayerPosition();
-
-        // FIXME: make this more incremental
-        if (updateHierarchy)
-            layerBacking->parentForSublayers()->removeAllChildren();
     }
 
-    // host the document layer in the RenderView's root layer
-    if (updateHierarchy && layer->isRootLayer() && layer->isComposited())
-        parentInRootLayer(layer);
+    // If this layer has backing, then we are collecting its children, otherwise appending
+    // to the compositing child list of an enclosing layer.
+    Vector<GraphicsLayer*> layerChildren;
+    Vector<GraphicsLayer*>& childList = layerBacking ? layerChildren : childLayersOfEnclosingLayer;
 
     CompositingState childState = compositingState;
     if (layer->isComposited())
@@ -630,19 +646,13 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
             size_t listSize = negZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = negZOrderList->at(i);
-                rebuildCompositingLayerTree(curLayer, childState, updateHierarchy);
-                if (updateHierarchy && curLayer->isComposited())
-                    setCompositingParent(curLayer, childState.m_compositingAncestor);
+                rebuildCompositingLayerTree(curLayer, childState, childList);
             }
         }
 
-        if (updateHierarchy && layerBacking && layerBacking->foregroundLayer()) {
-            layerBacking->foregroundLayer()->removeFromParent();
-            
-            // The foreground layer has to be correctly sorted with child layers, so needs to become a child of the clipping layer.
-            GraphicsLayer* hostingLayer = layerBacking->parentForSublayers();
-            hostingLayer->addChild(layerBacking->foregroundLayer());
-        }
+        // If a negative z-order child is compositing, we get a foreground layer which needs to get parented.
+        if (layerBacking && layerBacking->foregroundLayer())
+            childList.append(layerBacking->foregroundLayer());
     }
 
     ASSERT(!layer->m_normalFlowListDirty);
@@ -650,9 +660,7 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
         size_t listSize = normalFlowList->size();
         for (size_t i = 0; i < listSize; ++i) {
             RenderLayer* curLayer = normalFlowList->at(i);
-            rebuildCompositingLayerTree(curLayer, childState, updateHierarchy);
-            if (updateHierarchy && curLayer->isComposited())
-                setCompositingParent(curLayer, childState.m_compositingAncestor);
+            rebuildCompositingLayerTree(curLayer, childState, childList);
         }
     }
     
@@ -661,14 +669,60 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
             size_t listSize = posZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = posZOrderList->at(i);
-                rebuildCompositingLayerTree(curLayer, childState, updateHierarchy);
-                if (updateHierarchy && curLayer->isComposited())
-                    setCompositingParent(curLayer, childState.m_compositingAncestor);
+                rebuildCompositingLayerTree(curLayer, childState, childList);
             }
         }
     }
+    
+    if (layerBacking) {
+        layerBacking->parentForSublayers()->setChildren(layerChildren);
+        childLayersOfEnclosingLayer.append(layerBacking->childForSuperlayers());
+    }
 }
 
+// This just updates layer geometry without changing the hierarchy.
+void RenderLayerCompositor::updateLayerTreeGeometry(RenderLayer* layer)
+{
+    if (RenderLayerBacking* layerBacking = layer->backing()) {
+        // The compositing state of all our children has been updated already, so now
+        // we can compute and cache the composited bounds for this layer.
+        layerBacking->updateCompositedBounds();
+
+        if (layer->reflectionLayer())
+            layer->reflectionLayer()->backing()->updateCompositedBounds();
+
+        layerBacking->updateGraphicsLayerConfiguration();
+        layerBacking->updateGraphicsLayerGeometry();
+
+        if (!layer->parent())
+            updateRootLayerPosition();
+    }
+
+    if (layer->isStackingContext()) {
+        ASSERT(!layer->m_zOrderListsDirty);
+
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
+                updateLayerTreeGeometry(negZOrderList->at(i));
+        }
+    }
+
+    ASSERT(!layer->m_normalFlowListDirty);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i)
+            updateLayerTreeGeometry(normalFlowList->at(i));
+    }
+    
+    if (layer->isStackingContext()) {
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
+                updateLayerTreeGeometry(posZOrderList->at(i));
+        }
+    }
+}
 
 // Recurs down the RenderLayer tree until its finds the compositing descendants of compositingAncestor and updates their geometry.
 void RenderLayerCompositor::updateCompositingDescendantGeometry(RenderLayer* compositingAncestor, RenderLayer* layer, RenderLayerBacking::UpdateDepth updateDepth)
@@ -716,6 +770,7 @@ void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const IntRect& a
 
 void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const IntRect& rect)
 {
+    // FIXME: This method does not work correctly with transforms.
     if (layer->isComposited())
         layer->setBackingNeedsRepaintInRect(rect);
 
@@ -724,7 +779,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = negZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = negZOrderList->at(i);
-                int x = 0, y = 0;
+                int x = 0;
+                int y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
                 childRect.move(-x, -y);
@@ -736,7 +792,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = posZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = posZOrderList->at(i);
-                int x = 0, y = 0;
+                int x = 0;
+                int y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
                 childRect.move(-x, -y);
@@ -748,7 +805,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
         size_t listSize = normalFlowList->size();
         for (size_t i = 0; i < listSize; ++i) {
             RenderLayer* curLayer = normalFlowList->at(i);
-            int x = 0, y = 0;
+            int x = 0;
+            int y = 0;
             curLayer->convertToLayerCoords(layer, x, y);
             IntRect childRect(rect);
             childRect.move(-x, -y);
diff --git a/WebCore/rendering/RenderLayerCompositor.h b/WebCore/rendering/RenderLayerCompositor.h
index a809a70..73683f3 100644
--- a/WebCore/rendering/RenderLayerCompositor.h
+++ b/WebCore/rendering/RenderLayerCompositor.h
@@ -61,8 +61,11 @@ public:
     // Returns true if the accelerated compositing is enabled
     bool hasAcceleratedCompositing() const { return m_hasAcceleratedCompositing; }
     
-    // Copy the acceleratedCompositingEnabledFlag from Settings
-    void cacheAcceleratedCompositingEnabledFlag();
+    bool showDebugBorders() const { return m_showDebugBorders; }
+    bool showRepaintCounter() const { return m_showRepaintCounter; }
+    
+    // Copy the accelerated compositing related flags from Settings
+    void cacheAcceleratedCompositingFlags();
 
     // Called when the layer hierarchy needs to be updated (compositing layers have been
     // created, destroyed or re-parented).
@@ -147,8 +150,13 @@ private:
 
     // Returns true if any layer's compositing changed
     void computeCompositingRequirements(RenderLayer*, OverlapMap*, struct CompositingState&, bool& layersChanged);
-    void rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState&, bool updateHierarchy);
+    
+    // Recurses down the tree, parenting descendant compositing layers and collecting an array of child layers for the current compositing layer.
+    void rebuildCompositingLayerTree(RenderLayer* layer, const struct CompositingState&, Vector<GraphicsLayer*>& childGraphicsLayersOfEnclosingLayer);
 
+    // Recurses down the tree, updating layer geometry only.
+    void updateLayerTreeGeometry(RenderLayer*);
+    
     // Hook compositing layers together
     void setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer);
     void removeCompositedChildren(RenderLayer*);
@@ -171,6 +179,8 @@ private:
     RenderView* m_renderView;
     OwnPtr<GraphicsLayer> m_rootPlatformLayer;
     bool m_hasAcceleratedCompositing;
+    bool m_showDebugBorders;
+    bool m_showRepaintCounter;
     bool m_compositingConsultsOverlap;
     bool m_compositing;
     bool m_rootLayerAttached;
diff --git a/WebCore/rendering/RenderLineBoxList.cpp b/WebCore/rendering/RenderLineBoxList.cpp
index 76a2e2f..57bc26c 100644
--- a/WebCore/rendering/RenderLineBoxList.cpp
+++ b/WebCore/rendering/RenderLineBoxList.cpp
@@ -199,6 +199,7 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
         int bottom = curr->bottomVisibleOverflow() + renderer->maximalOutlineSize(info.phase);
         h = bottom - top;
         yPos = ty + top;
+        v->setMinimumColumnHeight(h);
         if (yPos < info.rect.bottom() && yPos + h > info.rect.y())
             curr->paint(info, tx, ty);
     }
diff --git a/WebCore/rendering/RenderListBox.cpp b/WebCore/rendering/RenderListBox.cpp
index 0edfdef..15c652c 100644
--- a/WebCore/rendering/RenderListBox.cpp
+++ b/WebCore/rendering/RenderListBox.cpp
@@ -321,7 +321,8 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
             textColor = theme()->inactiveListBoxSelectionForegroundColor();
     }
 
-    paintInfo.context->setFillColor(textColor);
+    ColorSpace colorSpace = itemStyle->colorSpace();
+    paintInfo.context->setFillColor(textColor, colorSpace);
 
     Font itemFont = style()->font();
     if (isOptionGroupElement(element)) {
@@ -358,9 +359,10 @@ void RenderListBox::paintItemBackground(PaintInfo& paintInfo, int tx, int ty, in
 
     // Draw the background for this list box item
     if (!element->renderStyle() || element->renderStyle()->visibility() != HIDDEN) {
+        ColorSpace colorSpace = element->renderStyle() ? element->renderStyle()->colorSpace() : style()->colorSpace();
         IntRect itemRect = itemBoundingBoxRect(tx, ty, listIndex);
         itemRect.intersect(controlClipRect(tx, ty));
-        paintInfo.context->fillRect(itemRect, backColor);
+        paintInfo.context->fillRect(itemRect, backColor, colorSpace);
     }
 }
 
diff --git a/WebCore/rendering/RenderListItem.cpp b/WebCore/rendering/RenderListItem.cpp
index e487c60..539b8c7 100644
--- a/WebCore/rendering/RenderListItem.cpp
+++ b/WebCore/rendering/RenderListItem.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
diff --git a/WebCore/rendering/RenderListMarker.cpp b/WebCore/rendering/RenderListMarker.cpp
index 9627711..eab4404 100644
--- a/WebCore/rendering/RenderListMarker.cpp
+++ b/WebCore/rendering/RenderListMarker.cpp
@@ -48,7 +48,9 @@ static String toRoman(int number, bool upper)
     if (number < 1 || number > 3999)
         return String::number(number);
 
-    const int lettersSize = 12; // big enough for three each of I, X, C, and M
+    // Big enough to store largest roman number less than 3999 which
+    // is 3888 (MMMDCCCLXXXVIII)
+    const int lettersSize = 15;
     UChar letters[lettersSize];
 
     int length = 0;
@@ -543,10 +545,10 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
         if (style()->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
             paintCustomHighlight(tx, ty, style()->highlight(), true);
 #endif
-        context->drawImage(m_image->image(this, marker.size()), marker.location());
+        context->drawImage(m_image->image(this, marker.size()), style()->colorSpace(), marker.location());
         if (selectionState() != SelectionNone) {
             // FIXME: selectionRect() is in absolute, not painting coordinates.
-            context->fillRect(selectionRect(), selectionBackgroundColor());
+            context->fillRect(selectionRect(), selectionBackgroundColor(), style()->colorSpace());
         }
         return;
     }
@@ -559,21 +561,21 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
 
     if (selectionState() != SelectionNone) {
         // FIXME: selectionRect() is in absolute, not painting coordinates.
-        context->fillRect(selectionRect(), selectionBackgroundColor());
+        context->fillRect(selectionRect(), selectionBackgroundColor(), style()->colorSpace());
     }
 
     const Color color(style()->color());
-    context->setStrokeColor(color);
+    context->setStrokeColor(color, style()->colorSpace());
     context->setStrokeStyle(SolidStroke);
     context->setStrokeThickness(1.0f);
-    context->setFillColor(color);
+    context->setFillColor(color, style()->colorSpace());
 
     switch (style()->listStyleType()) {
         case DISC:
             context->drawEllipse(marker);
             return;
         case CIRCLE:
-            context->setFillColor(Color::transparent);
+            context->setFillColor(Color::transparent, DeviceColorSpace);
             context->drawEllipse(marker);
             return;
         case SQUARE:
diff --git a/WebCore/rendering/RenderMarquee.h b/WebCore/rendering/RenderMarquee.h
index 886c343..1651454 100644
--- a/WebCore/rendering/RenderMarquee.h
+++ b/WebCore/rendering/RenderMarquee.h
@@ -53,7 +53,7 @@ namespace WebCore {
 class RenderLayer;
 
 // This class handles the auto-scrolling of layers with overflow: marquee.
-class RenderMarquee {
+class RenderMarquee : public Noncopyable {
 public:
     RenderMarquee(RenderLayer*);
 
diff --git a/WebCore/rendering/RenderMedia.cpp b/WebCore/rendering/RenderMedia.cpp
index 1d4da23..2ff50df 100644
--- a/WebCore/rendering/RenderMedia.cpp
+++ b/WebCore/rendering/RenderMedia.cpp
@@ -121,6 +121,8 @@ void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
             m_rewindButton->updateStyle();
         if (m_returnToRealtimeButton)
             m_returnToRealtimeButton->updateStyle();
+        if (m_toggleClosedCaptionsButton)
+            m_toggleClosedCaptionsButton->updateStyle();
         if (m_statusDisplay)
             m_statusDisplay->updateStyle();
         if (m_timelineContainer)
@@ -223,6 +225,13 @@ void RenderMedia::createReturnToRealtimeButton()
     m_returnToRealtimeButton->attachToParent(m_panel.get());
 }
 
+void RenderMedia::createToggleClosedCaptionsButton()
+{
+    ASSERT(!m_toggleClosedCaptionsButton);
+    m_toggleClosedCaptionsButton = new MediaControlToggleClosedCaptionsButtonElement(document(), mediaElement());
+    m_toggleClosedCaptionsButton->attachToParent(m_panel.get());
+}
+
 void RenderMedia::createStatusDisplay()
 {
     ASSERT(!m_statusDisplay);
@@ -310,6 +319,7 @@ void RenderMedia::updateControls()
             m_volumeSliderContainer = 0;
             m_volumeSlider = 0;
             m_controlsShadowRoot = 0;
+            m_toggleClosedCaptionsButton = 0;
         }
         m_opacityAnimationTo = 1.0f;
         m_opacityAnimationTimer.stop();
@@ -333,6 +343,7 @@ void RenderMedia::updateControls()
             }
             createSeekBackButton();
             createSeekForwardButton();
+            createToggleClosedCaptionsButton();
             createFullscreenButton();
             createMuteButton();
             createVolumeSliderContainer();
@@ -379,6 +390,8 @@ void RenderMedia::updateControls()
         m_rewindButton->update();
     if (m_returnToRealtimeButton)
         m_returnToRealtimeButton->update();
+    if (m_toggleClosedCaptionsButton)
+        m_toggleClosedCaptionsButton->update();
     if (m_statusDisplay)
         m_statusDisplay->update();
     if (m_fullscreenButton)
@@ -535,6 +548,9 @@ void RenderMedia::forwardEvent(Event* event)
         if (m_returnToRealtimeButton && m_returnToRealtimeButton->hitTest(point))
             m_returnToRealtimeButton->defaultEventHandler(event);
 
+       if (m_toggleClosedCaptionsButton && m_toggleClosedCaptionsButton->hitTest(point))
+            m_toggleClosedCaptionsButton->defaultEventHandler(event);
+
         if (m_timeline && m_timeline->hitTest(point))
             m_timeline->defaultEventHandler(event);
 
diff --git a/WebCore/rendering/RenderMedia.h b/WebCore/rendering/RenderMedia.h
index 602cd26..066b83d 100644
--- a/WebCore/rendering/RenderMedia.h
+++ b/WebCore/rendering/RenderMedia.h
@@ -40,6 +40,7 @@ class MediaControlPlayButtonElement;
 class MediaControlSeekButtonElement;
 class MediaControlRewindButtonElement;
 class MediaControlReturnToRealtimeButtonElement;
+class MediaControlToggleClosedCaptionsButtonElement;
 class MediaControlTimelineElement;
 class MediaControlVolumeSliderElement;
 class MediaControlFullscreenButtonElement;
@@ -96,6 +97,7 @@ private:
     void createSeekForwardButton();
     void createRewindButton();
     void createReturnToRealtimeButton();
+    void createToggleClosedCaptionsButton();
     void createStatusDisplay();
     void createTimelineContainer();
     void createTimeline();
@@ -123,6 +125,7 @@ private:
     RefPtr<MediaControlSeekButtonElement> m_seekForwardButton;
     RefPtr<MediaControlRewindButtonElement> m_rewindButton;
     RefPtr<MediaControlReturnToRealtimeButtonElement> m_returnToRealtimeButton;
+    RefPtr<MediaControlToggleClosedCaptionsButtonElement> m_toggleClosedCaptionsButton;
     RefPtr<MediaControlTimelineElement> m_timeline;
     RefPtr<MediaControlVolumeSliderElement> m_volumeSlider;
     RefPtr<MediaControlFullscreenButtonElement> m_fullscreenButton;
diff --git a/WebCore/rendering/RenderMediaControls.cpp b/WebCore/rendering/RenderMediaControls.cpp
index 9cc1493..17576ae 100644
--- a/WebCore/rendering/RenderMediaControls.cpp
+++ b/WebCore/rendering/RenderMediaControls.cpp
@@ -90,6 +90,15 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
         case MediaFullscreenButton:
             paintThemePart(SafariTheme::MediaFullscreenButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
+        case MediaShowClosedCaptionsButton:
+        case MediaHideClosedCaptionsButton:
+#if SAFARI_THEME_VERSION >= 4
+            if (MediaControlToggleClosedCaptionsButtonElement* btn = static_cast<MediaControlToggleClosedCaptionsButtonElement*>(o->node())) {
+                bool captionsVisible = btn->displayType() == MediaHideClosedCaptionsButton;
+                paintThemePart(captionsVisible ? SafariTheme::MediaHideClosedCaptionsButtonPart : SafariTheme::MediaShowClosedCaptionsButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            }
+#endif
+            break;
         case MediaMuteButton:
         case MediaUnMuteButton:
             if (MediaControlMuteButtonElement* btn = static_cast<MediaControlMuteButtonElement*>(o->node())) {
diff --git a/WebCore/rendering/RenderMediaControlsChromium.cpp b/WebCore/rendering/RenderMediaControlsChromium.cpp
index 56fbec4..50feb46 100644
--- a/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -63,7 +63,7 @@ static bool hasSource(const HTMLMediaElement* mediaElement)
 static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
 {
     IntRect imageRect = image->rect();
-    context->drawImage(image, rect);
+    context->drawImage(image, DeviceColorSpace, rect);
     return true;
 }
 
@@ -114,9 +114,9 @@ static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo
     context->save();
     context->setShouldAntialias(true);
     context->setStrokeStyle(SolidStroke);
-    context->setStrokeColor(style->borderLeftColor());
+    context->setStrokeColor(style->borderLeftColor(), DeviceColorSpace);
     context->setStrokeThickness(style->borderLeftWidth());
-    context->setFillColor(style->backgroundColor());
+    context->setFillColor(style->backgroundColor(), DeviceColorSpace);
     context->drawRect(rect);
     context->restore();
 
@@ -172,13 +172,13 @@ static bool paintMediaVolumeSlider(RenderObject* object, const RenderObject::Pai
     GraphicsContext* context = paintInfo.context;
     Color originalColor = context->strokeColor();
     if (originalColor != Color::white)
-        context->setStrokeColor(Color::white);
+        context->setStrokeColor(Color::white, DeviceColorSpace);
 
     int x = rect.x() + rect.width() / 2;
     context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
 
     if (originalColor != Color::white)
-        context->setStrokeColor(originalColor);
+        context->setStrokeColor(originalColor, DeviceColorSpace);
     return true;
 }
 
@@ -207,17 +207,17 @@ static bool paintMediaTimelineContainer(RenderObject* object, const RenderObject
 
         // Draw the left border using CSS defined width and color.
         context->setStrokeThickness(object->style()->borderLeftWidth());
-        context->setStrokeColor(object->style()->borderLeftColor().rgb());
+        context->setStrokeColor(object->style()->borderLeftColor().rgb(), DeviceColorSpace);
         context->drawLine(IntPoint(rect.x() + 1, rect.y()),
                           IntPoint(rect.x() + 1, rect.y() + rect.height()));
 
         // Draw the right border using CSS defined width and color.
         context->setStrokeThickness(object->style()->borderRightWidth());
-        context->setStrokeColor(object->style()->borderRightColor().rgb());
+        context->setStrokeColor(object->style()->borderRightColor().rgb(), DeviceColorSpace);
         context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
                           IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
 
-        context->setStrokeColor(originalColor);
+        context->setStrokeColor(originalColor, DeviceColorSpace);
         context->setStrokeThickness(originalThickness);
         context->setStrokeStyle(originalStyle);
     }
@@ -275,6 +275,8 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
     case MediaRewindButton:
     case MediaReturnToRealtimeButton:
     case MediaStatusDisplay:
+    case MediaShowClosedCaptionsButton:
+    case MediaHideClosedCaptionsButton:
         ASSERT_NOT_REACHED();
         break;
     }
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index 21ced26..712519b 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -41,6 +42,8 @@
 #include "RenderImageGeneratedContent.h"
 #include "RenderInline.h"
 #include "RenderListItem.h"
+#include "RenderRuby.h"
+#include "RenderRubyText.h"
 #include "RenderTableCell.h"
 #include "RenderTableCol.h"
 #include "RenderTableRow.h"
@@ -106,46 +109,42 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
         return image;
     }
 
-    RenderObject* o = 0;
+    if (node->hasTagName(rubyTag)) {
+        if (style->display() == INLINE)
+            return new (arena) RenderRubyAsInline(node);
+        else
+            return new (arena) RenderRubyAsBlock(node);
+    }
+    // treat <rt> as ruby text ONLY if it still has its default treatment of block
+    if (node->hasTagName(rtTag) && style->display() == BLOCK)
+        return new (arena) RenderRubyText(node); 
 
     switch (style->display()) {
         case NONE:
-            break;
+            return 0;
         case INLINE:
-            o = new (arena) RenderInline(node);
-            break;
+            return new (arena) RenderInline(node);
         case BLOCK:
-            o = new (arena) RenderBlock(node);
-            break;
         case INLINE_BLOCK:
-            o = new (arena) RenderBlock(node);
-            break;
-        case LIST_ITEM:
-            o = new (arena) RenderListItem(node);
-            break;
         case RUN_IN:
         case COMPACT:
-            o = new (arena) RenderBlock(node);
-            break;
+            return new (arena) RenderBlock(node);
+        case LIST_ITEM:
+            return new (arena) RenderListItem(node);
         case TABLE:
         case INLINE_TABLE:
-            o = new (arena) RenderTable(node);
-            break;
+            return new (arena) RenderTable(node);
         case TABLE_ROW_GROUP:
         case TABLE_HEADER_GROUP:
         case TABLE_FOOTER_GROUP:
-            o = new (arena) RenderTableSection(node);
-            break;
+            return new (arena) RenderTableSection(node);
         case TABLE_ROW:
-            o = new (arena) RenderTableRow(node);
-            break;
+            return new (arena) RenderTableRow(node);
         case TABLE_COLUMN_GROUP:
         case TABLE_COLUMN:
-            o = new (arena) RenderTableCol(node);
-            break;
+            return new (arena) RenderTableCol(node);
         case TABLE_CELL:
-            o = new (arena) RenderTableCell(node);
-            break;
+            return new (arena) RenderTableCell(node);
         case TABLE_CAPTION:
 #if ENABLE(WCSS)
         // As per the section 17.1 of the spec WAP-239-WCSS-20011026-a.pdf, 
@@ -153,15 +152,13 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
         // principal block box ([CSS2] section 9.2.1).
         case WAP_MARQUEE:
 #endif
-            o = new (arena) RenderBlock(node);
-            break;
+            return new (arena) RenderBlock(node);
         case BOX:
         case INLINE_BOX:
-            o = new (arena) RenderFlexibleBox(node);
-            break;
+            return new (arena) RenderFlexibleBox(node);
     }
 
-    return o;
+    return 0;
 }
 
 #ifndef NDEBUG 
@@ -646,7 +643,7 @@ RenderBlock* RenderObject::containingBlock() const
     }
 
     if (!o || !o->isRenderBlock())
-        return 0; // Probably doesn't happen any more, but leave just in case. -dwh
+        return 0; // This can still happen in case of an orphaned tree
 
     return toRenderBlock(o);
 }
@@ -722,7 +719,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
             return;
         case DOTTED:
         case DASHED:
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(width);
             graphicsContext->setStrokeStyle(style == DASHED ? DashedStroke : DottedStroke);
 
@@ -743,7 +740,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
 
             if (adjbw1 == 0 && adjbw2 == 0) {
                 graphicsContext->setStrokeStyle(NoStroke);
-                graphicsContext->setFillColor(c);
+                graphicsContext->setFillColor(c, m_style->colorSpace());
                 switch (s) {
                     case BSTop:
                     case BSBottom:
@@ -856,7 +853,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
             // fall through
         case SOLID: {
             graphicsContext->setStrokeStyle(NoStroke);
-            graphicsContext->setFillColor(c);
+            graphicsContext->setFillColor(c, m_style->colorSpace());
             ASSERT(x2 >= x1);
             ASSERT(y2 >= y1);
             if (!adjbw1 && !adjbw2) {
@@ -916,7 +913,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             return;
         case DOTTED:
         case DASHED:
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeStyle(style == DOTTED ? DottedStroke : DashedStroke);
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
@@ -938,7 +935,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             }
 
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(third);
             graphicsContext->strokeArc(IntRect(x, outerY, radius.width() * 2, outerHeight), angleStart, angleSpan);
             graphicsContext->setStrokeThickness(innerThird > 2 ? innerThird - 1 : innerThird);
@@ -957,13 +954,13 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             }
 
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
 
             float halfThickness = (thickness + 1.0f) / 4.0f;
             int shiftForInner = static_cast<int>(halfThickness * 1.5f);
-            graphicsContext->setStrokeColor(c2);
+            graphicsContext->setStrokeColor(c2, m_style->colorSpace());
             graphicsContext->setStrokeThickness(halfThickness > 2 ? halfThickness - 1 : halfThickness);
             graphicsContext->strokeArc(IntRect(x + shiftForInner, y + shiftForInner, (radius.width() - shiftForInner) * 2,
                                        (radius.height() - shiftForInner) * 2), angleStart, angleSpan);
@@ -977,7 +974,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
                 c = c.dark();
         case SOLID:
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
             break;
@@ -1341,6 +1338,50 @@ void RenderObject::showTreeForThis() const
         node()->showTreeForThis();
 }
 
+void RenderObject::showRenderObject() const
+{
+    showRenderObject(0);
+}
+
+void RenderObject::showRenderObject(int printedCharacters) const
+{
+    // As this function is intended to be used when debugging, the
+    // this pointer may be 0.
+    if (!this) {
+        fputs("(null)\n", stderr);
+        return;
+    }
+
+    printedCharacters += fprintf(stderr, "%s %p", renderName(), this);
+
+    if (node()) {
+        if (printedCharacters)
+            for (; printedCharacters < 39; printedCharacters++)
+                fputc(' ', stderr);
+        fputc('\t', stderr);
+        node()->showNode();
+    } else
+        fputc('\n', stderr);
+}
+
+void RenderObject::showRenderTreeAndMark(const RenderObject* markedObject1, const char* markedLabel1, const RenderObject* markedObject2, const char* markedLabel2, int depth) const
+{
+    int printedCharacters = 0;
+    if (markedObject1 == this && markedLabel1)
+        printedCharacters += fprintf(stderr, "%s", markedLabel1);
+    if (markedObject2 == this && markedLabel2)
+        printedCharacters += fprintf(stderr, "%s", markedLabel2);
+    for (; printedCharacters < depth * 2; printedCharacters++)
+        fputc(' ', stderr);
+
+    showRenderObject(printedCharacters);
+    if (!this)
+        return;
+
+    for (const RenderObject* child = firstChild(); child; child = child->nextSibling())
+        child->showRenderTreeAndMark(markedObject1, markedLabel1, markedObject2, markedLabel2, depth + 1);
+}
+
 #endif // NDEBUG
 
 Color RenderObject::selectionBackgroundColor() const
@@ -2372,9 +2413,20 @@ RenderBoxModelObject* RenderObject::offsetParent() const
 
 VisiblePosition RenderObject::createVisiblePosition(int offset, EAffinity affinity)
 {
-    // If this is a non-anonymous renderer, then it's simple.
-    if (Node* node = this->node())
+    // If this is a non-anonymous renderer in an editable area, then it's simple.
+    if (Node* node = this->node()) {
+        if (!node->isContentEditable()) {
+            // If it can be found, we prefer a visually equivalent position that is editable. 
+            Position position(node, offset);
+            Position candidate = position.downstream(Position::CanCrossEditingBoundary);
+            if (candidate.node()->isContentEditable())
+                return VisiblePosition(candidate, affinity);
+            candidate = position.upstream(Position::CanCrossEditingBoundary);
+            if (candidate.node()->isContentEditable())
+                return VisiblePosition(candidate, affinity);
+        }
         return VisiblePosition(node, offset, affinity);
+    }
 
     // We don't want to cross the boundary between editable and non-editable
     // regions of the document, but that is either impossible or at least
@@ -2476,4 +2528,19 @@ void showTree(const WebCore::RenderObject* ro)
         ro->showTreeForThis();
 }
 
+void showRenderTree(const WebCore::RenderObject* object1)
+{
+    showRenderTree(object1, 0);
+}
+
+void showRenderTree(const WebCore::RenderObject* object1, const WebCore::RenderObject* object2)
+{
+    if (object1) {
+        const WebCore::RenderObject* root = object1;
+        while (root->parent())
+            root = root->parent();
+        root->showRenderTreeAndMark(object1, "*", object2, "-", 0);
+    }
+}
+
 #endif
diff --git a/WebCore/rendering/RenderObject.h b/WebCore/rendering/RenderObject.h
index e358c98..d40ae6d 100644
--- a/WebCore/rendering/RenderObject.h
+++ b/WebCore/rendering/RenderObject.h
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -76,11 +77,13 @@ enum PaintPhase {
     PaintPhaseMask
 };
 
-enum PaintRestriction {
-    PaintRestrictionNone,
-    PaintRestrictionSelectionOnly,
-    PaintRestrictionSelectionOnlyBlackText
+enum PaintBehaviorFlags {
+    PaintBehaviorNormal = 0,
+    PaintBehaviorSelectionOnly = 1 << 0,
+    PaintBehaviorForceBlackText = 1 << 1,
+    PaintBehaviorFlattenCompositingLayers = 1 << 2
 };
+typedef unsigned PaintBehavior;
 
 enum HitTestFilter {
     HitTestAll,
@@ -228,6 +231,12 @@ private:
 public:
 #ifndef NDEBUG
     void showTreeForThis() const;
+
+    void showRenderObject() const;
+    // We don't make printedCharacters an optional parameter so that
+    // showRenderObject can be called from gdb easily.
+    void showRenderObject(int printedCharacters) const;
+    void showRenderTreeAndMark(const RenderObject* markedObject1 = 0, const char* markedLabel1 = 0, const RenderObject* markedObject2 = 0, const char* markedLabel2 = 0, int depth = 0) const;
 #endif
 
     static RenderObject* createObject(Node*, RenderStyle*);
@@ -252,6 +261,7 @@ public:
     virtual bool isBoxModelObject() const { return false; }
     virtual bool isCounter() const { return false; }
     virtual bool isFieldset() const { return false; }
+    virtual bool isFileUploadControl() const { return false; }
     virtual bool isFrame() const { return false; }
     virtual bool isFrameSet() const { return false; }
     virtual bool isImage() const { return false; }
@@ -267,6 +277,10 @@ public:
     virtual bool isRenderInline() const { return false; }
     virtual bool isRenderPart() const { return false; }
     virtual bool isRenderView() const { return false; }
+    virtual bool isRuby() const { return false; }
+    virtual bool isRubyBase() const { return false; }
+    virtual bool isRubyRun() const { return false; }
+    virtual bool isRubyText() const { return false; }
     virtual bool isSlider() const { return false; }
     virtual bool isTable() const { return false; }
     virtual bool isTableCell() const { return false; }
@@ -1028,6 +1042,10 @@ inline void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* render
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 void showTree(const WebCore::RenderObject*);
+void showRenderTree(const WebCore::RenderObject* object1);
+// We don't make object2 an optional parameter so that showRenderTree
+// can be called from gdb easily.
+void showRenderTree(const WebCore::RenderObject* object1, const WebCore::RenderObject* object2);
 #endif
 
 #endif // RenderObject_h
diff --git a/WebCore/rendering/RenderObjectChildList.cpp b/WebCore/rendering/RenderObjectChildList.cpp
index 23ab98f..d56a015 100644
--- a/WebCore/rendering/RenderObjectChildList.cpp
+++ b/WebCore/rendering/RenderObjectChildList.cpp
@@ -271,24 +271,29 @@ static RenderObject* findBeforeAfterParent(RenderObject* object)
     return beforeAfterParent;
 }
 
-static void invalidateCountersInContainer(RenderObject* container)
+static void invalidateCountersInContainer(RenderObject* container, const AtomicString& identifier)
 {
     if (!container)
         return;
     container = findBeforeAfterParent(container);
     if (!container)
         return;
+    // Sometimes the counter is attached directly on the container.
+    if (container->isCounter()) {
+        toRenderCounter(container)->invalidate(identifier);
+        return;
+    }
     for (RenderObject* content = container->firstChild(); content; content = content->nextSibling()) {
         if (content->isCounter())
-            toRenderCounter(content)->invalidate();
+            toRenderCounter(content)->invalidate(identifier);
     }
 }
 
-void RenderObjectChildList::invalidateCounters(RenderObject* owner)
+void RenderObjectChildList::invalidateCounters(RenderObject* owner, const AtomicString& identifier)
 {
     ASSERT(!owner->documentBeingDestroyed());
-    invalidateCountersInContainer(beforeAfterContainer(owner, BEFORE));
-    invalidateCountersInContainer(beforeAfterContainer(owner, AFTER));
+    invalidateCountersInContainer(beforeAfterContainer(owner, BEFORE), identifier);
+    invalidateCountersInContainer(beforeAfterContainer(owner, AFTER), identifier);
 }
 
 void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject)
@@ -369,9 +374,11 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                     RefPtr<RenderStyle> style = RenderStyle::create();
                     style->inheritFrom(pseudoElementStyle);
                     genChild->setStyle(style.release());
-                } else
-                    // Must be a first-letter container. updateFirstLetter() will take care of it.
-                    ASSERT(genChild->style()->styleType() == FIRST_LETTER);
+                } else {
+                    // RenderListItem may insert a list marker here. We do not need to care about this case.
+                    // Otherwise, genChild must be a first-letter container. updateFirstLetter() will take care of it.
+                    ASSERT(genChild->isListMarker() || genChild->style()->styleType() == FIRST_LETTER);
+                }
             }
         }
         return; // We've updated the generated content. That's all we needed to do.
diff --git a/WebCore/rendering/RenderObjectChildList.h b/WebCore/rendering/RenderObjectChildList.h
index bf8800a..ba73c50 100644
--- a/WebCore/rendering/RenderObjectChildList.h
+++ b/WebCore/rendering/RenderObjectChildList.h
@@ -30,6 +30,7 @@
 
 namespace WebCore {
 
+class AtomicString;
 class RenderObject;
 
 class RenderObjectChildList {
@@ -55,7 +56,7 @@ public:
     void insertChildNode(RenderObject* owner, RenderObject* child, RenderObject* before, bool fullInsert = true);
 
     void updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject = 0);
-    void invalidateCounters(RenderObject* owner);
+    void invalidateCounters(RenderObject* owner, const AtomicString& identifier);
 
 private:
     RenderObject* m_firstChild;
diff --git a/WebCore/rendering/RenderOverflow.h b/WebCore/rendering/RenderOverflow.h
index ed8976a..253a672 100644
--- a/WebCore/rendering/RenderOverflow.h
+++ b/WebCore/rendering/RenderOverflow.h
@@ -37,7 +37,7 @@ namespace WebCore
 // Examples of visual overflow are shadows, text stroke (and eventually outline and border-image).
 
 // This object is allocated only when some of these fields have non-default values in the owning box.
-class RenderOverflow {
+class RenderOverflow : public Noncopyable {
 public:
     RenderOverflow(const IntRect& defaultRect = IntRect()) 
         : m_topLayoutOverflow(defaultRect.y())
diff --git a/WebCore/rendering/RenderReplaced.cpp b/WebCore/rendering/RenderReplaced.cpp
index 27d2e72..ba579df 100644
--- a/WebCore/rendering/RenderReplaced.cpp
+++ b/WebCore/rendering/RenderReplaced.cpp
@@ -153,7 +153,7 @@ void RenderReplaced::paint(PaintInfo& paintInfo, int tx, int ty)
     if (drawSelectionTint) {
         IntRect selectionPaintingRect = localSelectionRect();
         selectionPaintingRect.move(tx, ty);
-        paintInfo.context->fillRect(selectionPaintingRect, selectionBackgroundColor());
+        paintInfo.context->fillRect(selectionPaintingRect, selectionBackgroundColor(), style()->colorSpace());
     }
 }
 
diff --git a/WebCore/rendering/RenderReplica.cpp b/WebCore/rendering/RenderReplica.cpp
index 5fa3c62..1d589ae 100644
--- a/WebCore/rendering/RenderReplica.cpp
+++ b/WebCore/rendering/RenderReplica.cpp
@@ -72,7 +72,7 @@ void RenderReplica::paint(PaintInfo& paintInfo, int tx, int ty)
         // computing using the wrong rootLayer
         layer()->parent()->paintLayer(layer()->transform() ? layer()->parent() : layer()->enclosingTransformedAncestor(),
                                       paintInfo.context, paintInfo.rect,
-                                      PaintRestrictionNone, 0, 0,
+                                      PaintBehaviorNormal, 0, 0,
                                       RenderLayer::PaintLayerHaveTransparency | RenderLayer::PaintLayerAppliedTransform | RenderLayer::PaintLayerTemporaryClipRects | RenderLayer::PaintLayerPaintingReflection);
     else if (paintInfo.phase == PaintPhaseMask)
         paintMask(paintInfo, tx, ty);
diff --git a/WebCore/rendering/RenderRuby.cpp b/WebCore/rendering/RenderRuby.cpp
new file mode 100644
index 0000000..8d113f9
--- /dev/null
+++ b/WebCore/rendering/RenderRuby.cpp
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderRuby.h"
+
+#include "RenderRubyRun.h"
+
+namespace WebCore {
+
+//=== generic helper functions to avoid excessive code duplication ===
+
+static RenderRubyRun* lastRubyRun(const RenderObject* ruby)
+{
+    RenderObject* child = ruby->lastChild();
+    if (child && ruby->isAfterContent(child))
+        child = child->previousSibling();
+    ASSERT(!child || child->isRubyRun());
+    return static_cast<RenderRubyRun*>(child);
+}
+
+static inline RenderRubyRun* findRubyRunParent(RenderObject* child)
+{
+    while (child && !child->isRubyRun())
+        child = child->parent();
+    return static_cast<RenderRubyRun*>(child);
+}
+
+//=== ruby as inline object ===
+
+RenderRubyAsInline::RenderRubyAsInline(Node* node)
+    : RenderInline(node)
+{
+}
+
+RenderRubyAsInline::~RenderRubyAsInline()
+{
+}
+
+bool RenderRubyAsInline::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isRubyText()
+        || child->isRubyRun()
+        || child->isInline();
+}
+
+void RenderRubyAsInline::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    // Note: ':after' content is handled implicitely below
+
+    // if child is a ruby run, just add it normally
+    if (child->isRubyRun()) {
+        RenderInline::addChild(child, beforeChild);
+        return;
+    }
+
+    if (beforeChild && !isAfterContent(beforeChild)) {
+        // insert child into run
+        ASSERT(!beforeChild->isRubyRun());
+        RenderRubyRun* run = findRubyRunParent(beforeChild);
+        ASSERT(run); // beforeChild should always have a run as parent
+        if (run) {
+            run->addChild(child, beforeChild);
+            return;
+        }
+        ASSERT(false); // beforeChild should always have a run as parent!
+        // Emergency fallback: fall through and just append.
+    }
+
+    // If the new child would be appended, try to add the child to the previous run
+    // if possible, or create a new run otherwise.
+    // (The RenderRubyRun object will handle the details)
+    RenderRubyRun* lastRun = lastRubyRun(this);
+    if (!lastRun || lastRun->hasRubyText()) {
+        lastRun = RenderRubyRun::staticCreateRubyRun(this);
+        RenderInline::addChild(lastRun);
+    }
+    lastRun->addChild(child);
+}
+
+void RenderRubyAsInline::removeChild(RenderObject* child)
+{
+    // If the child's parent is *this, i.e. a ruby run or ':after' content,
+    // just use the normal remove method.
+    if (child->parent() == this) {
+        ASSERT(child->isRubyRun() || child->isAfterContent());
+        RenderInline::removeChild(child);
+        return;
+    }
+
+    // Find the containing run
+    RenderRubyRun* run = findRubyRunParent(child);
+    ASSERT(run);
+    run->removeChild(child);
+}
+
+
+//=== ruby as block object ===
+
+RenderRubyAsBlock::RenderRubyAsBlock(Node* node)
+    : RenderBlock(node)
+{
+}
+
+RenderRubyAsBlock::~RenderRubyAsBlock()
+{
+}
+
+bool RenderRubyAsBlock::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isRubyText()
+        || child->isRubyRun()
+        || child->isInline();
+}
+
+void RenderRubyAsBlock::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    // Note: ':after' content is handled implicitely below
+
+    // if child is a ruby run, just add it normally
+    if (child->isRubyRun()) {
+        RenderBlock::addChild(child, beforeChild);
+        return;
+    }
+
+    if (beforeChild && !isAfterContent(beforeChild)) {
+        // insert child into run
+        ASSERT(!beforeChild->isRubyRun());
+        RenderObject* run = beforeChild;
+        while (run && !run->isRubyRun())
+            run = run->parent();
+        if (run) {
+            run->addChild(child, beforeChild);
+            return;
+        }
+        ASSERT(false); // beforeChild should always have a run as parent!
+        // Emergency fallback: fall through and just append.
+    }
+
+    // If the new child would be appended, try to add the child to the previous run
+    // if possible, or create a new run otherwise.
+    // (The RenderRubyRun object will handle the details)
+    RenderRubyRun* lastRun = lastRubyRun(this);
+    if (!lastRun || lastRun->hasRubyText()) {
+        lastRun = RenderRubyRun::staticCreateRubyRun(this);
+        RenderBlock::addChild(lastRun);
+    }
+    lastRun->addChild(child);
+}
+
+void RenderRubyAsBlock::removeChild(RenderObject* child)
+{
+    // If the child's parent is *this, just use the normal remove method.
+    if (child->parent() == this) {
+        // This should happen only during destruction of the whole ruby element, though.
+        RenderBlock::removeChild(child);
+        return;
+    }
+
+    // Find the containing run
+    RenderRubyRun* run = findRubyRunParent(child);
+    ASSERT(run);
+    run->removeChild(child);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/rendering/RenderRuby.h b/WebCore/rendering/RenderRuby.h
new file mode 100644
index 0000000..a74150c
--- /dev/null
+++ b/WebCore/rendering/RenderRuby.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRuby_h
+#define RenderRuby_h
+
+#include "RenderBlock.h"
+#include "RenderInline.h"
+
+namespace WebCore {
+
+// Following the HTML 5 spec, the box object model for a <ruby> element allows several runs of ruby
+// bases with their respective ruby texts looks as follows:
+//
+// 1 RenderRuby object, corresponding to the whole <ruby> HTML element
+//      1+ RenderRubyRun (anonymous)
+//          0 or 1 RenderRubyText - shuffled to the front in order to re-use existing block layouting
+//              0-n inline object(s)
+//          0 or 1 RenderRubyBase - contains the inline objects that make up the ruby base
+//              1-n inline object(s)
+//
+// Note: <rp> elements are defined as having 'display:none' and thus normally are not assigned a renderer.
+
+// <ruby> when used as 'display:inline'
+class RenderRubyAsInline : public RenderInline {
+public:
+    RenderRubyAsInline(Node*);
+    virtual ~RenderRubyAsInline();
+
+    virtual const char* renderName() const { return "RenderRuby (inline)"; }
+
+    virtual bool isRuby() const { return true; }
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* child);
+};
+
+// <ruby> when used as 'display:block' or 'display:inline-block'
+class RenderRubyAsBlock : public RenderBlock {
+public:
+    RenderRubyAsBlock(Node*);
+    virtual ~RenderRubyAsBlock();
+
+    virtual const char* renderName() const { return "RenderRuby (block)"; }
+
+    virtual bool isRuby() const { return true; }
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* child);
+};
+
+} // namespace WebCore
+
+#endif // RenderRuby_h
diff --git a/WebCore/rendering/RenderRubyBase.cpp b/WebCore/rendering/RenderRubyBase.cpp
new file mode 100644
index 0000000..5cb25f4
--- /dev/null
+++ b/WebCore/rendering/RenderRubyBase.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderRubyBase.h"
+
+namespace WebCore {
+
+RenderRubyBase::RenderRubyBase(Node* node)
+    : RenderBlock(node)
+{
+    setInline(false);
+}
+
+RenderRubyBase::~RenderRubyBase()
+{
+}
+
+bool RenderRubyBase::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isInline();
+}
+
+void RenderRubyBase::splitToLeft(RenderBlock* leftBase, RenderObject* beforeChild)
+{
+    // This function removes all children that are before (!) beforeChild
+    // and appends them to leftBase.
+    ASSERT(leftBase);
+
+    // First make sure that beforeChild (if set) is indeed a direct child of this.
+    // Fallback: climb up the tree to make sure. This may result in somewhat incorrect rendering.
+    // FIXME: Can this happen? Is there a better/more correct way to solve this?
+    ASSERT(!beforeChild || beforeChild->parent() == this);
+    while (beforeChild && beforeChild->parent() != this)
+        beforeChild = beforeChild->parent();
+
+    RenderObject* child = firstChild();
+    while (child != beforeChild) {
+        RenderObject* nextChild = child->nextSibling();
+        moveChildTo(leftBase, leftBase->children(), child);
+        child = nextChild;
+    }
+}
+
+void RenderRubyBase::mergeWithRight(RenderBlock* rightBase)
+{
+    // This function removes all children and prepends (!) them to rightBase.
+    ASSERT(rightBase);
+
+    RenderObject* firstPos = rightBase->firstChild();
+    RenderObject* child = lastChild();
+    while (child) {
+        moveChildTo(rightBase, rightBase->children(), firstPos, child);
+        firstPos = child;
+        child = lastChild();
+    }
+}
+
+} // namespace WebCore
diff --git a/WebCore/rendering/RenderRubyBase.h b/WebCore/rendering/RenderRubyBase.h
new file mode 100644
index 0000000..57baf99
--- /dev/null
+++ b/WebCore/rendering/RenderRubyBase.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRubyBase_h
+#define RenderRubyBase_h
+
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class RenderRubyBase : public RenderBlock {
+public:
+    RenderRubyBase(Node*);
+    virtual ~RenderRubyBase();
+
+    virtual const char* renderName() const { return "RenderRubyBase (anonymous)"; }
+
+    virtual bool isRubyBase() const { return true; }
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+
+    void splitToLeft(RenderBlock* leftBase, RenderObject* beforeChild);
+    void mergeWithRight(RenderBlock* rightBase);
+};
+
+} // namespace WebCore
+
+#endif // RenderRubyBase_h
diff --git a/WebCore/rendering/RenderRubyRun.cpp b/WebCore/rendering/RenderRubyRun.cpp
new file mode 100644
index 0000000..8578c55
--- /dev/null
+++ b/WebCore/rendering/RenderRubyRun.cpp
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderRubyRun.h"
+
+#include "RenderRubyBase.h"
+#include "RenderRubyText.h"
+#include "RenderView.h"
+
+using namespace std;
+
+namespace WebCore {
+
+RenderRubyRun::RenderRubyRun(Node* node)
+    : RenderBlock(node)
+    , m_beingDestroyed(false)
+{
+    setReplaced(true);
+    setInline(true);
+}
+
+RenderRubyRun::~RenderRubyRun()
+{
+}
+
+void RenderRubyRun::destroy()
+{
+    // Mark if the run is being destroyed to avoid trouble in removeChild().
+    m_beingDestroyed = true;
+    RenderBlock::destroy();
+}
+
+bool RenderRubyRun::hasRubyText() const
+{
+    // The only place where a ruby text can be is in the first position
+    // Note: As anonymous blocks, ruby runs do not have ':before' or ':after' content themselves.
+    return firstChild() && firstChild()->isRubyText();
+}
+
+bool RenderRubyRun::hasRubyBase() const
+{
+    // The only place where a ruby base can be is in the last position
+    // Note: As anonymous blocks, ruby runs do not have ':before' or ':after' content themselves.
+    return lastChild() && lastChild()->isRubyBase();
+}
+
+bool RenderRubyRun::isEmpty() const
+{
+    return !hasRubyText() && !hasRubyBase();
+}
+
+RenderRubyText* RenderRubyRun::rubyText() const
+{
+    RenderObject* child = firstChild();
+    return child && child->isRubyText() ? static_cast<RenderRubyText*>(child) : 0;
+}
+
+RenderRubyBase* RenderRubyRun::rubyBase() const
+{
+    RenderObject* child = lastChild();
+    return child && child->isRubyBase() ? static_cast<RenderRubyBase*>(child) : 0;
+}
+
+RenderRubyBase* RenderRubyRun::rubyBaseSafe()
+{
+    RenderRubyBase* base = rubyBase();
+    if (!base) {
+        base = createRubyBase();
+        RenderBlock::addChild(base);
+    }
+    return base;
+}
+
+RenderBlock* RenderRubyRun::firstLineBlock() const
+{
+    return 0;
+}
+
+void RenderRubyRun::updateFirstLetter()
+{
+}
+
+bool RenderRubyRun::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isRubyText() || child->isInline();
+}
+
+void RenderRubyRun::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    ASSERT(child);
+
+    // If child is a ruby text
+    if (child->isRubyText()) {
+        if (!beforeChild) {
+            // RenderRuby has already ascertained that we can add the child here.
+            ASSERT(!hasRubyText());
+            // prepend ruby texts as first child
+            RenderBlock::addChild(child, firstChild());
+        }  else if (beforeChild->isRubyText()) {
+            // New text is inserted just before another.
+            // In this case the new text takes the place of the old one, and
+            // the old text goes into a new run that is inserted as next sibling.
+            ASSERT(beforeChild->parent() == this);
+            RenderObject* ruby = parent();
+            ASSERT(ruby->isRuby());
+            RenderBlock* newRun = staticCreateRubyRun(ruby);
+            ruby->addChild(newRun, nextSibling());
+            // Add the new ruby text and move the old one to the new run
+            // Note: Doing it in this order and not using RenderRubyRun's methods,
+            // in order to avoid automatic removal of the ruby run in case there is no
+            // other child besides the old ruby text.
+            RenderBlock::addChild(child, beforeChild);
+            RenderBlock::removeChild(beforeChild);
+            newRun->addChild(beforeChild);
+        } else {
+            ASSERT(hasRubyBase()); // Otherwise beforeChild would be borked.
+            // Insertion before a ruby base object.
+            // In this case we need insert a new run before the current one and split the base.
+            RenderObject* ruby = parent();
+            RenderRubyRun* newRun = staticCreateRubyRun(ruby);
+            ruby->addChild(newRun, this);
+            newRun->addChild(child);
+            rubyBaseSafe()->splitToLeft(newRun->rubyBaseSafe(), beforeChild);
+        }
+    } else {
+        // child is not a text -> insert it into the base
+        // (append it instead if beforeChild is the ruby text)
+        if (beforeChild && beforeChild->isRubyText())
+            beforeChild = 0;
+        rubyBaseSafe()->addChild(child, beforeChild);
+    }
+}
+
+void RenderRubyRun::removeChild(RenderObject* child)
+{
+    // If the child is a ruby text, then merge the ruby base with the base of
+    // the right sibling run, if possible.
+    if (!m_beingDestroyed && !documentBeingDestroyed() && child->isRubyText()) {
+        RenderRubyBase* base = rubyBase();
+        RenderObject* rightNeighbour = nextSibling();
+        if (base && rightNeighbour && rightNeighbour->isRubyRun()) {
+            // Ruby run without a base can happen only at the first run.
+            RenderRubyRun* rightRun = static_cast<RenderRubyRun*>(rightNeighbour);
+            ASSERT(rightRun->hasRubyBase());
+            base->mergeWithRight(rightRun->rubyBaseSafe());
+            // The now empty ruby base will be removed below.
+        }
+    }
+
+    RenderBlock::removeChild(child);
+
+    if (!m_beingDestroyed && !documentBeingDestroyed()) {
+        // Check if our base (if any) is now empty. If so, destroy it.
+        RenderBlock* base = rubyBase();
+        if (base && !base->firstChild()) {
+            RenderBlock::removeChild(base);
+            base->deleteLineBoxTree();
+            base->destroy();
+        }
+
+        // If any of the above leaves the run empty, destroy it as well.
+        if (isEmpty()) {
+            parent()->removeChild(this);
+            deleteLineBoxTree();
+            destroy();
+        }
+    }
+}
+
+RenderRubyBase* RenderRubyRun::createRubyBase() const
+{
+    RenderRubyBase* rb = new (renderArena()) RenderRubyBase(document() /* anonymous */);
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(style());
+    newStyle->setDisplay(BLOCK);
+    newStyle->setTextAlign(CENTER); // FIXME: use WEBKIT_CENTER?
+    rb->setStyle(newStyle.release());
+    return rb;
+}
+
+RenderRubyRun* RenderRubyRun::staticCreateRubyRun(const RenderObject* parentRuby)
+{
+    ASSERT(parentRuby && parentRuby->isRuby());
+    RenderRubyRun* rr = new (parentRuby->renderArena()) RenderRubyRun(parentRuby->document() /* anonymous */);
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(parentRuby->style());
+    newStyle->setDisplay(INLINE_BLOCK);
+    rr->setStyle(newStyle.release());
+    return rr;
+}
+
+} // namespace WebCore
diff --git a/WebCore/rendering/RenderRubyRun.h b/WebCore/rendering/RenderRubyRun.h
new file mode 100644
index 0000000..361dfe5
--- /dev/null
+++ b/WebCore/rendering/RenderRubyRun.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRubyRun_h
+#define RenderRubyRun_h
+
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class RenderRubyBase;
+class RenderRubyText;
+
+// RenderRubyRun are 'inline-block/table' like objects,and wrap a single pairing of a ruby base with its ruby text(s).
+// See RenderRuby.h for further comments on the structure
+
+class RenderRubyRun : public RenderBlock {
+public:
+    RenderRubyRun(Node*);
+    virtual ~RenderRubyRun();
+
+    virtual void destroy();
+
+    virtual const char* renderName() const { return "RenderRubyRun (anonymous)"; }
+
+    virtual bool isRubyRun() const { return true; }
+
+    bool hasRubyText() const;
+    bool hasRubyBase() const;
+    bool isEmpty() const;
+    RenderRubyText* rubyText() const;
+    RenderRubyBase* rubyBase() const;
+    RenderRubyBase* rubyBaseSafe(); // creates the base if it doesn't already exist
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* child);
+
+    virtual RenderBlock* firstLineBlock() const;
+    virtual void updateFirstLetter();
+
+    static RenderRubyRun* staticCreateRubyRun(const RenderObject* parentRuby);
+
+protected:
+    RenderRubyBase* createRubyBase() const;
+    
+private:
+    bool m_beingDestroyed;
+};
+
+} // namespace WebCore
+
+#endif // RenderRubyRun_h
diff --git a/WebCore/rendering/RenderRubyText.cpp b/WebCore/rendering/RenderRubyText.cpp
new file mode 100644
index 0000000..cfe3b5c
--- /dev/null
+++ b/WebCore/rendering/RenderRubyText.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderRubyText.h"
+
+namespace WebCore {
+
+RenderRubyText::RenderRubyText(Node* node)
+    : RenderBlock(node)
+{
+}
+
+RenderRubyText::~RenderRubyText()
+{
+}
+
+bool RenderRubyText::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isInline();
+}
+
+} // namespace WebCore
diff --git a/WebCore/rendering/RenderRubyText.h b/WebCore/rendering/RenderRubyText.h
new file mode 100644
index 0000000..e475914
--- /dev/null
+++ b/WebCore/rendering/RenderRubyText.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRubyText_h
+#define RenderRubyText_h
+
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class RenderRubyText : public RenderBlock {
+public:
+    RenderRubyText(Node*);
+    virtual ~RenderRubyText();
+
+    virtual const char* renderName() const { return "RenderRubyText"; }
+
+    virtual bool isRubyText() const { return true; }
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+};
+
+} // namespace WebCore
+
+#endif // RenderRubyText_h
diff --git a/WebCore/rendering/RenderSVGImage.cpp b/WebCore/rendering/RenderSVGImage.cpp
index 7e0b40d..41a1a10 100644
--- a/WebCore/rendering/RenderSVGImage.cpp
+++ b/WebCore/rendering/RenderSVGImage.cpp
@@ -166,7 +166,7 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
         if (imageElt->preserveAspectRatio()->align() != SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE)
             adjustRectsForAspectRatio(destRect, srcRect, imageElt->preserveAspectRatio());
 
-        paintInfo.context->drawImage(image(), destRect, srcRect);
+        paintInfo.context->drawImage(image(), DeviceColorSpace, destRect, srcRect);
         finishRenderSVGContent(this, paintInfo, filter, savedInfo.context);
     }
 
diff --git a/WebCore/rendering/RenderScrollbarTheme.cpp b/WebCore/rendering/RenderScrollbarTheme.cpp
index 06ca32a..19143cc 100644
--- a/WebCore/rendering/RenderScrollbarTheme.cpp
+++ b/WebCore/rendering/RenderScrollbarTheme.cpp
@@ -109,7 +109,7 @@ IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(Scrollbar* scrollb
 void RenderScrollbarTheme::paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect)
 {
     // FIXME: Implement.
-    context->fillRect(cornerRect, Color::white);
+    context->fillRect(cornerRect, Color::white, DeviceColorSpace);
 }
 
 void RenderScrollbarTheme::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
diff --git a/WebCore/rendering/RenderSelectionInfo.h b/WebCore/rendering/RenderSelectionInfo.h
index e7b7b78..c06a9ae 100644
--- a/WebCore/rendering/RenderSelectionInfo.h
+++ b/WebCore/rendering/RenderSelectionInfo.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class RenderSelectionInfoBase {
+class RenderSelectionInfoBase : public Noncopyable {
 public:
     RenderSelectionInfoBase()
         : m_object(0)
diff --git a/WebCore/rendering/RenderSlider.cpp b/WebCore/rendering/RenderSlider.cpp
index c8b60fd..7398a2f 100644
--- a/WebCore/rendering/RenderSlider.cpp
+++ b/WebCore/rendering/RenderSlider.cpp
@@ -52,7 +52,8 @@ static const int defaultTrackLength = 129;
 // FIXME: The SliderRange class and functions are entirely based on the DOM,
 // and could be put with HTMLInputElement (possibly with a new name) instead of here.
 struct SliderRange {
-    bool isIntegral;
+    bool hasStep;
+    double step;
     double minimum;
     double maximum;  // maximum must be >= minimum.
 
@@ -79,19 +80,28 @@ struct SliderRange {
 
 SliderRange::SliderRange(HTMLInputElement* element)
 {
-    // FIXME: What's the right way to handle an integral range with non-integral minimum and maximum?
-    // Currently values are guaranteed to be integral but could be outside the range in that case.
-
-    isIntegral = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
-
-    maximum = element->rangeMaximum();
-    minimum = element->rangeMinimum();
+    if (element->hasAttribute(precisionAttr)) {
+        step = 1.0;
+        hasStep = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
+    } else
+        hasStep = element->getAllowedValueStep(&step);
+
+    maximum = element->maximum();
+    minimum = element->minimum();
 }
 
 double SliderRange::clampValue(double value)
 {
     double clampedValue = max(minimum, min(value, maximum));
-    return isIntegral ? round(clampedValue) : clampedValue;
+    if (!hasStep)
+        return clampedValue;
+    // Rounds clampedValue to minimum + N * step.
+    clampedValue = minimum + round((clampedValue - minimum) / step) * step;
+    if (clampedValue > maximum)
+       clampedValue -= step;
+    ASSERT(clampedValue >= minimum);
+    ASSERT(clampedValue <= maximum);
+    return clampedValue;
 }
 
 double SliderRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
@@ -356,10 +366,9 @@ void RenderSlider::layout()
             thumb->repaintDuringLayoutIfMoved(oldThumbRect);
 
         statePusher.pop();
+        addOverflowFromChild(thumb);
     }
 
-    addOverflowFromChild(thumb);
-
     repainter.repaintAfterLayout();    
 
     setNeedsLayout(false);
@@ -374,7 +383,7 @@ void RenderSlider::updateFromElement()
     bool clamped;
     double value = range.valueFromElement(element, &clamped);
     if (clamped)
-        element->setValueFromRenderer(String::number(value));
+        element->setValueFromRenderer(HTMLInputElement::formStringFromDouble(value));
 
     // Layout will take care of the thumb's size and position.
     if (!m_thumb) {
@@ -430,7 +439,7 @@ void RenderSlider::setValueForPosition(int position)
     if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         fraction = 1 - fraction;
     double value = range.clampValue(range.valueFromProportion(fraction));
-    element->setValueFromRenderer(String::number(value));
+    element->setValueFromRenderer(HTMLInputElement::formStringFromDouble(value));
 
     // Also update the position if appropriate.
     if (position != currentPosition()) {
diff --git a/WebCore/rendering/RenderTableCell.cpp b/WebCore/rendering/RenderTableCell.cpp
index 8e0b613..4e7036e 100644
--- a/WebCore/rendering/RenderTableCell.cpp
+++ b/WebCore/rendering/RenderTableCell.cpp
@@ -168,6 +168,17 @@ void RenderTableCell::setOverrideSize(int size)
     RenderBlock::setOverrideSize(size);
 }
 
+IntSize RenderTableCell::offsetFromContainer(RenderObject* o) const
+{
+    ASSERT(o == container());
+
+    IntSize offset = RenderBlock::offsetFromContainer(o);
+    if (parent())
+        offset.expand(-parentBox()->x(), -parentBox()->y());
+
+    return offset;
+}
+
 IntRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     // If the table grid is dirty, we cannot get reliable information about adjoining cells,
@@ -231,30 +242,6 @@ void RenderTableCell::computeRectForRepaint(RenderBoxModelObject* repaintContain
     RenderBlock::computeRectForRepaint(repaintContainer, r, fixed);
 }
 
-void RenderTableCell::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
-{
-    if (repaintContainer == this)
-        return;
-
-    RenderView* v = view();
-    if ((!v || !v->layoutStateEnabled()) && parent()) {
-        // Rows are in the same coordinate space, so don't add their offset in.
-        // FIXME: this is wrong with transforms
-        transformState.move(-parentBox()->x(), -parentBox()->y());
-    }
-    RenderBlock::mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
-}
-
-void RenderTableCell::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState& transformState) const
-{
-    RenderBlock::mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
-    if (parent()) {
-        // Rows are in the same coordinate space, so add their offset back in.
-        // FIXME: this is wrong with transforms
-        transformState.move(parentBox()->x(), parentBox()->y());
-    }
-}
-
 int RenderTableCell::baselinePosition(bool firstLine, bool isRootLineBox) const
 {
     if (isRootLineBox)
diff --git a/WebCore/rendering/RenderTableCell.h b/WebCore/rendering/RenderTableCell.h
index 9532bb6..f285198 100644
--- a/WebCore/rendering/RenderTableCell.h
+++ b/WebCore/rendering/RenderTableCell.h
@@ -110,9 +110,6 @@ protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
-    virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
-
 private:
     virtual const char* renderName() const { return isAnonymous() ? "RenderTableCell (anonymous)" : "RenderTableCell"; }
 
@@ -127,6 +124,7 @@ private:
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
     virtual void paintMask(PaintInfo&, int tx, int ty);
 
+    virtual IntSize offsetFromContainer(RenderObject*) const;
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
 
diff --git a/WebCore/rendering/RenderTableRow.cpp b/WebCore/rendering/RenderTableRow.cpp
index bafadfc..a11a14b 100644
--- a/WebCore/rendering/RenderTableRow.cpp
+++ b/WebCore/rendering/RenderTableRow.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/rendering/RenderTableSection.cpp b/WebCore/rendering/RenderTableSection.cpp
index 5052c3a..b627afe 100644
--- a/WebCore/rendering/RenderTableSection.cpp
+++ b/WebCore/rendering/RenderTableSection.cpp
@@ -46,6 +46,14 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static inline void setRowHeightToRowStyleHeightIfNotRelative(RenderTableSection::RowStruct* row)
+{
+    ASSERT(row && row->rowRenderer);
+    row->height = row->rowRenderer->style()->height();
+    if (row->height.isRelative())
+        row->height = Length();
+}
+
 RenderTableSection::RenderTableSection(Node* node)
     : RenderBox(node)
     , m_gridRows(0)
@@ -126,11 +134,8 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
 
     m_grid[m_cRow].rowRenderer = toRenderTableRow(child);
 
-    if (!beforeChild) {
-        m_grid[m_cRow].height = child->style()->height();
-        if (m_grid[m_cRow].height.isRelative())
-            m_grid[m_cRow].height = Length();
-    }
+    if (!beforeChild)
+        setRowHeightToRowStyleHeightIfNotRelative(&m_grid[m_cRow]);
 
     // If the next renderer is actually wrapped in an anonymous table row, we need to go up and find that.
     while (beforeChild && beforeChild->parent() != this)
@@ -1190,6 +1195,7 @@ void RenderTableSection::recalcCells()
             
             RenderTableRow* tableRow = toRenderTableRow(row);
             m_grid[m_cRow].rowRenderer = tableRow;
+            setRowHeightToRowStyleHeightIfNotRelative(&m_grid[m_cRow]);
 
             for (RenderObject* cell = row->firstChild(); cell; cell = cell->nextSibling()) {
                 if (cell->isTableCell())
diff --git a/WebCore/rendering/RenderText.cpp b/WebCore/rendering/RenderText.cpp
index 40c3d75..95aa277 100644
--- a/WebCore/rendering/RenderText.cpp
+++ b/WebCore/rendering/RenderText.cpp
@@ -757,6 +757,17 @@ void RenderText::calcPrefWidths(int leadWidth, HashSet<const SimpleFontData*>& f
     setPrefWidthsDirty(false);
 }
 
+bool RenderText::isAllCollapsibleWhitespace()
+{
+    int length = textLength();
+    const UChar* text = characters();
+    for (int i = 0; i < length; i++) {
+        if (!style()->isCollapsibleWhiteSpace(text[i]))
+            return false;
+    }
+    return true;
+}
+    
 bool RenderText::containsOnlyWhitespace(unsigned from, unsigned len) const
 {
     unsigned currPos;
@@ -813,7 +824,9 @@ void RenderText::setSelectionState(SelectionState state)
         }
     }
 
-    containingBlock()->setSelectionState(state);
+    // The returned value can be null in case of an orphaned tree.
+    if (RenderBlock* cb = containingBlock())
+        cb->setSelectionState(state);
 }
 
 void RenderText::setTextWithOffset(PassRefPtr<StringImpl> text, unsigned offset, unsigned len, bool force)
diff --git a/WebCore/rendering/RenderText.h b/WebCore/rendering/RenderText.h
index 915ff40..d46bce9 100644
--- a/WebCore/rendering/RenderText.h
+++ b/WebCore/rendering/RenderText.h
@@ -121,7 +121,8 @@ public:
     void checkConsistency() const;
 
     virtual void calcPrefWidths(int leadWidth);
-
+    bool isAllCollapsibleWhitespace();
+    
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle*) { }
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
diff --git a/WebCore/rendering/RenderTextControl.cpp b/WebCore/rendering/RenderTextControl.cpp
index f430399..b258597 100644
--- a/WebCore/rendering/RenderTextControl.cpp
+++ b/WebCore/rendering/RenderTextControl.cpp
@@ -70,8 +70,8 @@ static Color disabledTextColor(const Color& textColor, const Color& backgroundCo
 RenderTextControl::RenderTextControl(Node* node, bool placeholderVisible)
     : RenderBlock(node)
     , m_placeholderVisible(placeholderVisible)
-    , m_edited(false)
-    , m_userEdited(false)
+    , m_wasChangedSinceLastChangeEvent(false)
+    , m_lastChangeWasUserEdit(false)
 {
 }
 
@@ -195,17 +195,17 @@ void RenderTextControl::setInnerTextValue(const String& innerTextValue)
             ASSERT(!ec);
         }
 
-        m_edited = false;
-        m_userEdited = false;
+        // We set m_lastChangeWasUserEdit to false since this change was not explicty made by the user (say, via typing on the keyboard), see <rdar://problem/5359921>.
+        m_lastChangeWasUserEdit = false;
     }
 
     static_cast<Element*>(node())->setFormControlValueMatchesRenderer(true);
 }
 
-void RenderTextControl::setUserEdited(bool isUserEdited)
+void RenderTextControl::setLastChangeWasUserEdit(bool lastChangeWasUserEdit)
 {
-    m_userEdited = isUserEdited;
-    document()->setIgnoreAutofocus(isUserEdited);
+    m_lastChangeWasUserEdit = lastChangeWasUserEdit;
+    document()->setIgnoreAutofocus(lastChangeWasUserEdit);
 }
 
 int RenderTextControl::selectionStart()
@@ -312,8 +312,8 @@ int RenderTextControl::indexForVisiblePosition(const VisiblePosition& pos)
 
 void RenderTextControl::subtreeHasChanged()
 {
-    m_edited = true;
-    m_userEdited = true;
+    m_wasChangedSinceLastChangeEvent = true;
+    m_lastChangeWasUserEdit = true;
 }
 
 String RenderTextControl::finishText(Vector<UChar>& result) const
diff --git a/WebCore/rendering/RenderTextControl.h b/WebCore/rendering/RenderTextControl.h
index cdd8716..394eb9c 100644
--- a/WebCore/rendering/RenderTextControl.h
+++ b/WebCore/rendering/RenderTextControl.h
@@ -34,11 +34,11 @@ class RenderTextControl : public RenderBlock {
 public:
     virtual ~RenderTextControl();
 
-    bool isEdited() const { return m_edited; }
-    void setEdited(bool isEdited) { m_edited = isEdited; }
+    bool wasChangedSinceLastChangeEvent() const { return m_wasChangedSinceLastChangeEvent; }
+    void setChangedSinceLastChangeEvent(bool wasChangedSinceLastChangeEvent) { m_wasChangedSinceLastChangeEvent = wasChangedSinceLastChangeEvent; }
 
-    bool isUserEdited() const { return m_userEdited; }
-    void setUserEdited(bool isUserEdited);
+    bool lastChangeWasUserEdit() const { return m_lastChangeWasUserEdit; }
+    void setLastChangeWasUserEdit(bool lastChangeWasUserEdit);
 
     int selectionStart();
     int selectionEnd();
@@ -105,8 +105,8 @@ private:
 
     String finishText(Vector<UChar>&) const;
 
-    bool m_edited;
-    bool m_userEdited;
+    bool m_wasChangedSinceLastChangeEvent;
+    bool m_lastChangeWasUserEdit;
     RefPtr<TextControlInnerTextElement> m_innerText;
 };
 
diff --git a/WebCore/rendering/RenderTextControlMultiLine.cpp b/WebCore/rendering/RenderTextControlMultiLine.cpp
index 6ff9235..afc3edd 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -67,8 +67,8 @@ bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitT
         return false;
 
     bool resultIsTextValueOrPlaceholder
-        = !m_placeholderVisible && result.innerNode() == innerTextElement()
-        || m_placeholderVisible && result.innerNode()->isDescendantOf(innerTextElement());
+        = (!m_placeholderVisible && result.innerNode() == innerTextElement())
+        || (m_placeholderVisible && result.innerNode()->isDescendantOf(innerTextElement()));
     if (result.innerNode() == node() || resultIsTextValueOrPlaceholder)
         hitInnerTextElement(result, x, y, tx, ty);
 
diff --git a/WebCore/rendering/RenderTextControlSingleLine.cpp b/WebCore/rendering/RenderTextControlSingleLine.cpp
index dd1c24c..56d4363 100644
--- a/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -150,7 +150,7 @@ void RenderTextControlSingleLine::hidePopup()
 
 void RenderTextControlSingleLine::subtreeHasChanged()
 {
-    bool wasEdited = isEdited();
+    bool wasChanged = wasChangedSinceLastChangeEvent();
     RenderTextControl::subtreeHasChanged();
 
     InputElement* input = inputElement();
@@ -167,7 +167,7 @@ void RenderTextControlSingleLine::subtreeHasChanged()
     if (input->searchEventsShouldBeDispatched())
         startSearchEventTimer();
 
-    if (!wasEdited && node()->focused()) {
+    if (!wasChanged && node()->focused()) {
         if (Frame* frame = document()->frame())
             frame->textFieldDidBeginEditing(static_cast<Element*>(node()));
     }
diff --git a/WebCore/rendering/RenderTheme.cpp b/WebCore/rendering/RenderTheme.cpp
index 238279a..f6afb77 100644
--- a/WebCore/rendering/RenderTheme.cpp
+++ b/WebCore/rendering/RenderTheme.cpp
@@ -1,7 +1,7 @@
 /**
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2005, 2006, 2007, 2008 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -282,6 +282,8 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             return paintMediaRewindButton(o, paintInfo, r);
         case MediaReturnToRealtimeButtonPart:
             return paintMediaReturnToRealtimeButton(o, paintInfo, r);
+        case MediaToggleClosedCaptionsButtonPart:
+            return paintMediaToggleClosedCaptionsButton(o, paintInfo, r);
         case MediaSliderPart:
             return paintMediaSliderTrack(o, paintInfo, r);
         case MediaSliderThumbPart:
@@ -420,6 +422,8 @@ bool RenderTheme::shouldRenderMediaControlPart(ControlPart part, Element* e)
         return mediaElement->movieLoadType() == MediaPlayer::LiveStream;
     case MediaFullscreenButtonPart:
         return mediaElement->supportsFullscreen();
+    case MediaToggleClosedCaptionsButtonPart:
+        return mediaElement->hasClosedCaptions();
     default:
         return true;
     }
@@ -705,6 +709,10 @@ bool RenderTheme::isHovered(const RenderObject* o) const
 
 bool RenderTheme::isDefault(const RenderObject* o) const
 {
+    // A button should only have the default appearance if the page is active
+    if (!isActive(o))
+        return false;
+
     if (!o->document())
         return false;
 
diff --git a/WebCore/rendering/RenderTheme.h b/WebCore/rendering/RenderTheme.h
index 68e2eba..ee359d7 100644
--- a/WebCore/rendering/RenderTheme.h
+++ b/WebCore/rendering/RenderTheme.h
@@ -253,6 +253,7 @@ protected:
     virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.cpp b/WebCore/rendering/RenderThemeChromiumLinux.cpp
index 9048ce3..4b09174 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.cpp
+++ b/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -32,6 +32,10 @@
 
 namespace WebCore {
 
+unsigned RenderThemeChromiumLinux::m_thumbInactiveColor = 0xf0ebe5;
+unsigned RenderThemeChromiumLinux::m_thumbActiveColor = 0xfaf8f5;
+unsigned RenderThemeChromiumLinux::m_trackColor = 0xe3ddd8;
+
 PassRefPtr<RenderTheme> RenderThemeChromiumLinux::create()
 {
     return adoptRef(new RenderThemeChromiumLinux());
@@ -122,4 +126,12 @@ double RenderThemeChromiumLinux::caretBlinkIntervalInternal() const
     return m_caretBlinkInterval;
 }
 
+void RenderThemeChromiumLinux::setScrollbarColors(
+    SkColor inactiveColor, SkColor activeColor, SkColor trackColor)
+{
+    m_thumbInactiveColor = inactiveColor;
+    m_thumbActiveColor = activeColor;
+    m_trackColor = trackColor;
+}
+
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.h b/WebCore/rendering/RenderThemeChromiumLinux.h
index e137ad5..8736b0d 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.h
+++ b/WebCore/rendering/RenderThemeChromiumLinux.h
@@ -54,6 +54,13 @@ namespace WebCore {
         void setCaretBlinkInterval(double interval);
         virtual double caretBlinkIntervalInternal() const;
 
+        static void setScrollbarColors(unsigned inactive_color,
+                                       unsigned active_color,
+                                       unsigned track_color);
+        static unsigned thumbInactiveColor() { return m_thumbInactiveColor; }
+        static unsigned thumbActiveColor() { return m_thumbActiveColor; }
+        static unsigned trackColor() { return m_trackColor; }
+
     private:
         RenderThemeChromiumLinux();
         virtual ~RenderThemeChromiumLinux();
@@ -62,6 +69,10 @@ namespace WebCore {
         virtual bool supportsControlTints() const;
 
         double m_caretBlinkInterval;
+
+        static unsigned m_thumbInactiveColor;
+        static unsigned m_thumbActiveColor;
+        static unsigned m_trackColor;
     };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumMac.mm b/WebCore/rendering/RenderThemeChromiumMac.mm
index bcfcd57..4e57cb5 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -983,7 +983,7 @@ bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderOb
     
     paintInfo.context->save();
 
-    paintInfo.context->setFillColor(o->style()->color());
+    paintInfo.context->setFillColor(o->style()->color(), DeviceColorSpace);
     paintInfo.context->setStrokeStyle(NoStroke);
 
     FloatPoint arrow1[3];
@@ -1012,11 +1012,11 @@ bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderOb
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f); // Deliberately ignores zoom since it looks nicer if it stays thin.
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.cpp b/WebCore/rendering/RenderThemeChromiumSkia.cpp
index fb42bb7..016a264 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -231,7 +231,7 @@ bool RenderThemeChromiumSkia::paintCheckbox(RenderObject* o, const RenderObject:
     else
         image = this->isChecked(o) ? disabledCheckedImage : disabledUncheckedImage;
 
-    i.context->drawImage(image, rect);
+    i.context->drawImage(image, o->style()->colorSpace(), rect);
     return false;
 }
 
@@ -263,7 +263,7 @@ bool RenderThemeChromiumSkia::paintRadio(RenderObject* o, const RenderObject::Pa
     else
         image = this->isChecked(o) ? disabledCheckedImage : disabledUncheckedImage;
 
-    i.context->drawImage(image, rect);
+    i.context->drawImage(image, o->style()->colorSpace(), rect);
     return false;
 }
 
@@ -348,6 +348,15 @@ bool RenderThemeChromiumSkia::paintButton(RenderObject* o, const RenderObject::P
     return false;
 }
 
+void RenderThemeChromiumSkia::adjustButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    if (style->appearance() == PushButtonPart) {
+        // Ignore line-height.
+        style->setLineHeight(RenderStyle::initialLineHeight());
+    }
+}
+
+
 bool RenderThemeChromiumSkia::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
 {
     return true;
@@ -358,6 +367,12 @@ bool RenderThemeChromiumSkia::paintTextArea(RenderObject* o, const RenderObject:
     return paintTextField(o, i, r);
 }
 
+void RenderThemeChromiumSkia::adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+     // Ignore line-height.
+     style->setLineHeight(RenderStyle::initialLineHeight());
+}
+
 bool RenderThemeChromiumSkia::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
@@ -393,7 +408,7 @@ bool RenderThemeChromiumSkia::paintSearchFieldCancelButton(RenderObject* o, cons
 
     static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
     static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
-    i.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    i.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -433,7 +448,7 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsDecoration(RenderObject* o,
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
 
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
-    i.context->drawImage(magnifierImage, bounds);
+    i.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -469,7 +484,7 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* o, con
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
 
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
-    i.context->drawImage(magnifierImage, bounds);
+    i.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.h b/WebCore/rendering/RenderThemeChromiumSkia.h
index 98e3a35..18fa859 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -71,11 +71,13 @@ namespace WebCore {
         virtual void setRadioSize(RenderStyle*) const;
 
         virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
         virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
         virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+        virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
         virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
diff --git a/WebCore/rendering/RenderThemeMac.h b/WebCore/rendering/RenderThemeMac.h
index 1d68c63..48c6c42 100644
--- a/WebCore/rendering/RenderThemeMac.h
+++ b/WebCore/rendering/RenderThemeMac.h
@@ -126,6 +126,7 @@ protected:
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
diff --git a/WebCore/rendering/RenderThemeMac.mm b/WebCore/rendering/RenderThemeMac.mm
index 03e39a0..6304947 100644
--- a/WebCore/rendering/RenderThemeMac.mm
+++ b/WebCore/rendering/RenderThemeMac.mm
@@ -913,7 +913,7 @@ bool RenderThemeMac::paintMenuListButton(RenderObject* o, const RenderObject::Pa
     
     paintInfo.context->save();
 
-    paintInfo.context->setFillColor(o->style()->color());
+    paintInfo.context->setFillColor(o->style()->color(), o->style()->colorSpace());
     paintInfo.context->setStrokeStyle(NoStroke);
 
     FloatPoint arrow1[3];
@@ -942,11 +942,11 @@ bool RenderThemeMac::paintMenuListButton(RenderObject* o, const RenderObject::Pa
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f); // Deliberately ignores zoom since it looks nicer if it stays thin.
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
@@ -1427,8 +1427,6 @@ typedef enum {
 
 static int mediaControllerTheme()
 {
-    static const long minimumQuickTimeVersion = 0x07630000; // 7.6.3
-    static SInt32 quickTimeVersion = 0;
     static int controllerTheme = -1;
     
     if (controllerTheme != -1)
@@ -1436,23 +1434,17 @@ static int mediaControllerTheme()
 
     controllerTheme = MediaControllerThemeClassic;
 
-    if (!quickTimeVersion) {
-        OSErr err;
-        err = Gestalt(gestaltQuickTime, &quickTimeVersion);
-        if (err != noErr)
-            return controllerTheme;
-    }
-    if (quickTimeVersion < minimumQuickTimeVersion)
+    if (!wkMediaControllerThemeAvailable(MediaControllerThemeQuickTime))
         return controllerTheme;
 
     Boolean validKey;
-    Boolean useQTMediaUI = CFPreferencesGetAppBooleanValue(CFSTR("UseQuickTimeMediaUI"), CFSTR("com.apple.WebCore"), &validKey);
+    Boolean useQTMediaUIPref = CFPreferencesGetAppBooleanValue(CFSTR("UseQuickTimeMediaUI"), CFSTR("com.apple.WebCore"), &validKey);
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    if (validKey && !useQTMediaUI)
+    if (validKey && !useQTMediaUIPref)
         return controllerTheme;
 #else
-    if (!validKey || !useQTMediaUI)
+    if (!validKey || !useQTMediaUIPref)
         return controllerTheme;
 #endif
 
@@ -1652,7 +1644,22 @@ bool RenderThemeMac::paintMediaReturnToRealtimeButton(RenderObject* o, const Ren
     return false;
 }
 
+bool RenderThemeMac::paintMediaToggleClosedCaptionsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    HTMLInputElement* node = static_cast<HTMLInputElement*>(o->node());
+    if (!node)
+        return false;
+    
+    MediaControlToggleClosedCaptionsButtonElement* btn = static_cast<MediaControlToggleClosedCaptionsButtonElement*>(node);
+    if (!btn)
+        return false;
 
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(btn->displayType(), mediaControllerTheme(), paintInfo.context->platformContext(), r, getMediaUIPartStateFlags(node));
+
+    return false;
+}
+ 
 bool RenderThemeMac::paintMediaControlsBackground(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
@@ -1698,12 +1705,16 @@ String RenderThemeMac::extraMediaControlsStyleSheet()
         return String();
 }
 
-bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
+bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* element)
 {
-    if (part == MediaFullscreenButtonPart)
-        return mediaControllerTheme() == MediaControllerThemeQuickTime;
+    if (part == MediaToggleClosedCaptionsButtonPart) {
+
+        // We rely on QTKit to render captions so don't enable the button unless it will be able to do so.
+        if (!element->hasTagName(videoTag))
+            return false;
+    }
 
-    return RenderTheme::shouldRenderMediaControlPart(part, e);
+    return RenderTheme::shouldRenderMediaControlPart(part, element);
 }
 
 #endif // ENABLE(VIDEO)
diff --git a/WebCore/rendering/RenderThemeSafari.cpp b/WebCore/rendering/RenderThemeSafari.cpp
index 2ea3b8b..9e97079 100644
--- a/WebCore/rendering/RenderThemeSafari.cpp
+++ b/WebCore/rendering/RenderThemeSafari.cpp
@@ -830,8 +830,8 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject:
 
     paintInfo.context->save();
 
-    paintInfo.context->setFillColor(o->style()->color());
-    paintInfo.context->setStrokeColor(NoStroke);
+    paintInfo.context->setFillColor(o->style()->color(), DeviceColorSpace);
+    paintInfo.context->setStrokeColor(NoStroke, DeviceColorSpace);
 
     FloatPoint arrow[3];
     arrow[0] = FloatPoint(leftEdge, centerY - arrowHeight / 2.0f);
@@ -851,11 +851,11 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject:
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f);
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
diff --git a/WebCore/rendering/RenderThemeWin.cpp b/WebCore/rendering/RenderThemeWin.cpp
index 92bfd03..52afbd6 100644
--- a/WebCore/rendering/RenderThemeWin.cpp
+++ b/WebCore/rendering/RenderThemeWin.cpp
@@ -819,7 +819,7 @@ bool RenderThemeWin::paintSearchFieldCancelButton(RenderObject* o, const RenderO
 
     static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
     static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
-    paintInfo.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    paintInfo.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -868,7 +868,7 @@ bool RenderThemeWin::paintSearchFieldResultsDecoration(RenderObject* o, const Re
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
     
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
-    paintInfo.context->drawImage(magnifierImage, bounds);
+    paintInfo.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -904,7 +904,7 @@ bool RenderThemeWin::paintSearchFieldResultsButton(RenderObject* o, const Render
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
 
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
-    paintInfo.context->drawImage(magnifierImage, bounds);
+    paintInfo.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -955,6 +955,23 @@ Color RenderThemeWin::systemColor(int cssValueId) const
 }
 
 #if ENABLE(VIDEO)
+
+bool RenderThemeWin::shouldRenderMediaControlPart(ControlPart part, Element* element)
+{
+    if (part == MediaToggleClosedCaptionsButtonPart) {
+        // We rely on QuickTime to render captions so only enable the button for a video element.
+#if SAFARI_THEME_VERSION >= 4
+        if (!element->hasTagName(videoTag))
+            return false;
+#else
+        return false;
+#endif
+    }
+
+    return RenderTheme::shouldRenderMediaControlPart(part, element);
+}
+
+
 bool RenderThemeWin::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
@@ -989,6 +1006,12 @@ bool RenderThemeWin::paintMediaSliderThumb(RenderObject* o, const RenderObject::
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSliderThumb, o, paintInfo, r);
 }
+
+bool RenderThemeWin::paintMediaToggleClosedCaptionsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaShowClosedCaptionsButton, o, paintInfo, r);
+}
+
 #endif
 
 }
diff --git a/WebCore/rendering/RenderThemeWin.h b/WebCore/rendering/RenderThemeWin.h
index 99c2004..a9fa5e6 100644
--- a/WebCore/rendering/RenderThemeWin.h
+++ b/WebCore/rendering/RenderThemeWin.h
@@ -125,6 +125,7 @@ public:
     virtual bool supportsFocusRing(const RenderStyle*) const;
 
 #if ENABLE(VIDEO)
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
     virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
@@ -132,6 +133,7 @@ public:
     virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 #endif
 
 private:
diff --git a/WebCore/rendering/RenderTreeAsText.cpp b/WebCore/rendering/RenderTreeAsText.cpp
index b7ab191..a6f5144 100644
--- a/WebCore/rendering/RenderTreeAsText.cpp
+++ b/WebCore/rendering/RenderTreeAsText.cpp
@@ -36,8 +36,10 @@
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "RenderBR.h"
+#include "RenderFileUploadControl.h"
 #include "RenderInline.h"
 #include "RenderListMarker.h"
+#include "RenderPart.h"
 #include "RenderTableCell.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
@@ -55,6 +57,10 @@
 #include "SVGRenderTreeAsText.h"
 #endif
 
+#if PLATFORM(QT)
+#include <QWidget>
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -217,6 +223,9 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
     ts << " " << r;
 
     if (!(o.isText() && !o.isBR())) {
+        if (o.isFileUploadControl()) {
+            ts << " " << quoteAndEscapeNonPrintables(toRenderFileUploadControl(&o)->fileTextValue());
+        }
         if (o.parent() && (o.parent()->style()->color() != o.style()->color()))
             ts << " [color=" << o.style()->color().name() << "]";
 
@@ -336,6 +345,24 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
         }
     }
 
+#if PLATFORM(QT)
+    // Print attributes of embedded QWidgets. E.g. when the WebCore::Widget
+    // is invisible the QWidget should be invisible too.
+    if (o.isRenderPart()) {
+        const RenderPart* part = toRenderPart(const_cast<RenderObject*>(&o));
+        if (part->widget() && part->widget()->platformWidget()) {
+            QWidget* wid = part->widget()->platformWidget();
+
+            ts << " [QT: ";
+            ts << "geometry: {" << wid->geometry() << "} ";
+            ts << "isHidden: " << wid->isHidden() << " ";
+            ts << "isSelfVisible: " << part->widget()->isSelfVisible() << " ";
+            ts << "isParentVisible: " << part->widget()->isParentVisible() << " ";
+            ts << "mask: {" << wid->mask().boundingRect() << "} ] ";
+        }
+    }
+#endif
+
     return ts;
 }
 
@@ -535,8 +562,11 @@ static void writeSelection(TextStream& ts, const RenderObject* o)
            << "selection end:   position " << selection.end().deprecatedEditingOffset() << " of " << nodePosition(selection.end().node()) << "\n";
 }
 
-String externalRepresentation(RenderObject* o)
+String externalRepresentation(Frame* frame)
 {
+    frame->document()->updateLayout();
+
+    RenderObject* o = frame->contentRenderer();
     if (!o)
         return String();
 
@@ -544,8 +574,6 @@ String externalRepresentation(RenderObject* o)
 #if ENABLE(SVG)
     writeRenderResources(ts, o->document());
 #endif
-    if (o->view()->frameView())
-        o->view()->frameView()->layout();
     if (o->hasLayer()) {
         RenderLayer* l = toRenderBox(o)->layer();
         writeLayers(ts, l, l, IntRect(l->x(), l->y(), l->width(), l->height()));
@@ -554,10 +582,13 @@ String externalRepresentation(RenderObject* o)
     return ts.release();
 }
 
-static void writeCounterValuesFromChildren(TextStream& stream, RenderObject* parent)
+static void writeCounterValuesFromChildren(TextStream& stream, RenderObject* parent, bool& isFirstCounter)
 {
     for (RenderObject* child = parent->firstChild(); child; child = child->nextSibling()) {
         if (child->isCounter()) {
+            if (!isFirstCounter)
+                stream << " ";
+            isFirstCounter = false;
             String str(toRenderText(child)->text());
             stream << str;
         }
@@ -570,12 +601,13 @@ String counterValueForElement(Element* element)
     RefPtr<Element> elementRef(element);
     element->document()->updateLayout();
     TextStream stream;
+    bool isFirstCounter = true;
     // The counter renderers should be children of anonymous children
     // (i.e., :before or :after pseudo-elements).
     if (RenderObject* renderer = element->renderer()) {
         for (RenderObject* child = renderer->firstChild(); child; child = child->nextSibling()) {
             if (child->isAnonymous())
-                writeCounterValuesFromChildren(stream, child);
+                writeCounterValuesFromChildren(stream, child, isFirstCounter);
         }
     }
     return stream.release();
diff --git a/WebCore/rendering/RenderTreeAsText.h b/WebCore/rendering/RenderTreeAsText.h
index 325f109..b00f7c9 100644
--- a/WebCore/rendering/RenderTreeAsText.h
+++ b/WebCore/rendering/RenderTreeAsText.h
@@ -29,11 +29,12 @@
 namespace WebCore {
 
 class Element;
+class Frame;
 class RenderObject;
 class String;
 class TextStream;
 
-String externalRepresentation(RenderObject*);
+String externalRepresentation(Frame*);
 void write(TextStream&, const RenderObject&, int indent = 0);
 
 // Helper function shared with SVGRenderTreeAsText
diff --git a/WebCore/rendering/RenderView.cpp b/WebCore/rendering/RenderView.cpp
index c4a666f..753afe4 100644
--- a/WebCore/rendering/RenderView.cpp
+++ b/WebCore/rendering/RenderView.cpp
@@ -210,7 +210,7 @@ void RenderView::paintBoxDecorations(PaintInfo& paintInfo, int, int)
         if (baseColor.alpha() > 0) {
             paintInfo.context->save();
             paintInfo.context->setCompositeOperation(CompositeCopy);
-            paintInfo.context->fillRect(paintInfo.rect, baseColor);
+            paintInfo.context->fillRect(paintInfo.rect, baseColor, style()->colorSpace());
             paintInfo.context->restore();
         } else
             paintInfo.context->clearRect(paintInfo.rect);
@@ -338,7 +338,13 @@ IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
     SelectionMap::iterator end = selectedObjects.end();
     for (SelectionMap::iterator i = selectedObjects.begin(); i != end; ++i) {
         RenderSelectionInfo* info = i->second;
-        selRect.unite(info->rect());
+        // RenderSelectionInfo::rect() is in the coordinates of the repaintContainer, so map to page coordinates.
+        IntRect currRect = info->rect();
+        if (RenderBoxModelObject* repaintContainer = info->repaintContainer()) {
+            FloatQuad absQuad = repaintContainer->localToAbsoluteQuad(FloatRect(currRect));
+            currRect = absQuad.enclosingBoundingBox(); 
+        }
+        selRect.unite(currRect);
         delete info;
     }
     return selRect;
@@ -437,7 +443,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         o = o->nextInPreOrder();
     }
 
-    m_cachedSelectionBounds = IntRect();
+    m_layer->clearBlockSelectionGapsBounds();
 
     // Now that the selection state has been updated for the new objects, walk them again and
     // put them in the new objects list.
@@ -450,9 +456,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
                 RenderBlockSelectionInfo* blockInfo = newSelectedBlocks.get(cb);
                 if (blockInfo)
                     break;
-                blockInfo = new RenderBlockSelectionInfo(cb);
-                newSelectedBlocks.set(cb, blockInfo);
-                m_cachedSelectionBounds.unite(blockInfo->rects());
+                newSelectedBlocks.set(cb, new RenderBlockSelectionInfo(cb));
                 cb = cb->containingBlock();
             }
         }
@@ -529,7 +533,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
 
 void RenderView::clearSelection()
 {
-    repaintViewRectangle(m_cachedSelectionBounds);
+    m_layer->repaintBlockSelectionGaps();
     setSelection(0, -1, 0, -1, RepaintNewMinusOld);
 }
 
diff --git a/WebCore/rendering/RenderView.h b/WebCore/rendering/RenderView.h
index a486b34..37b3f01 100644
--- a/WebCore/rendering/RenderView.h
+++ b/WebCore/rendering/RenderView.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML widget for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2006 Apple Computer, Inc.
  *
@@ -77,9 +75,11 @@ public:
     bool printing() const;
     void setPrintImages(bool enable) { m_printImages = enable; }
     bool printImages() const { return m_printImages; }
-    void setTruncatedAt(int y) { m_truncatedAt = y; m_bestTruncatedAt = m_truncatorWidth = 0; m_forcedPageBreak = false; }
+    void setTruncatedAt(int y) { m_truncatedAt = y; m_bestTruncatedAt = m_truncatorWidth = 0; m_minimumColumnHeight = 0; m_forcedPageBreak = false; }
     void setBestTruncatedAt(int y, RenderBoxModelObject* forRenderer, bool forcedBreak = false);
+    void setMinimumColumnHeight(int height) { m_minimumColumnHeight = height; }
     int bestTruncatedAt() const { return m_bestTruncatedAt; }
+    int minimumColumnHeight() const { return m_minimumColumnHeight; }
 
     int truncatedAt() const { return m_truncatedAt; }
 
@@ -196,10 +196,9 @@ protected:
     RenderWidgetSet m_widgets;
 
 private:
-    IntRect m_cachedSelectionBounds;
-
     int m_bestTruncatedAt;
     int m_truncatorWidth;
+    int m_minimumColumnHeight;
     bool m_forcedPageBreak;
     LayoutState* m_layoutState;
     unsigned m_layoutStateDisableCount;
diff --git a/WebCore/rendering/RenderWidget.cpp b/WebCore/rendering/RenderWidget.cpp
index 5a5c9f1..33f03e2 100644
--- a/WebCore/rendering/RenderWidget.cpp
+++ b/WebCore/rendering/RenderWidget.cpp
@@ -23,8 +23,8 @@
 #include "config.h"
 #include "RenderWidget.h"
 
-#include "AnimationController.h"
 #include "AXObjectCache.h"
+#include "AnimationController.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
 #include "RenderView.h"
@@ -40,18 +40,65 @@ static HashMap<const Widget*, RenderWidget*>& widgetRendererMap()
     return *staticWidgetRendererMap;
 }
 
+static size_t widgetHierarchyUpdateSuspendCount;
+
+typedef HashMap<RefPtr<Widget>, FrameView*> WidgetToParentMap;
+
+static WidgetToParentMap& widgetNewParentMap()
+{
+    DEFINE_STATIC_LOCAL(WidgetToParentMap, map, ());
+    return map;
+}
+
+void RenderWidget::suspendWidgetHierarchyUpdates()
+{
+    widgetHierarchyUpdateSuspendCount++;
+}
+
+void RenderWidget::resumeWidgetHierarchyUpdates()
+{
+    ASSERT(widgetHierarchyUpdateSuspendCount);
+    if (widgetHierarchyUpdateSuspendCount == 1) {
+        WidgetToParentMap map = widgetNewParentMap();
+        widgetNewParentMap().clear();
+        WidgetToParentMap::iterator end = map.end();
+        for (WidgetToParentMap::iterator it = map.begin(); it != end; ++it) {
+            Widget* child = it->first.get();
+            ScrollView* currentParent = child->parent();
+            FrameView* newParent = it->second;
+            if (newParent != currentParent) {
+                if (currentParent)
+                    currentParent->removeChild(child);
+                if (newParent)
+                    newParent->addChild(child);
+            }
+        }
+    }
+    widgetHierarchyUpdateSuspendCount--;
+}
+
+static void moveWidgetToParentSoon(Widget* child, FrameView* parent)
+{
+    if (!widgetHierarchyUpdateSuspendCount) {
+        if (parent)
+            parent->addChild(child);
+        else
+            child->removeFromParent();
+        return;
+    }
+    widgetNewParentMap().set(child, parent);
+}
+
 RenderWidget::RenderWidget(Node* node)
     : RenderReplaced(node)
     , m_widget(0)
     , m_frameView(node->document()->view())
-    , m_refCount(0)
-{
-    view()->addWidget(this);
-
     // Reference counting is used to prevent the widget from being
     // destroyed while inside the Widget code, which might not be
     // able to handle that.
-    ref();
+    , m_refCount(1)
+{
+    view()->addWidget(this);
 }
 
 void RenderWidget::destroy()
@@ -62,14 +109,6 @@ void RenderWidget::destroy()
     // both RenderBox::destroy() and RenderObject::destroy().
     // Fix originally made for <rdar://problem/4228818>.
 
-    // <rdar://problem/6937089> suggests that node() can be null by the time we call renderArena()
-    // in the end of this function. One way this might happen is if this function was invoked twice
-    // in a row, so bail out and turn a crash into an assertion failure in debug builds and a leak
-    // in release builds.
-    ASSERT(node());
-    if (!node())
-        return;
-
     animation()->cancelAnimations(this);
 
     if (RenderView* v = view())
@@ -81,12 +120,8 @@ void RenderWidget::destroy()
     }
     remove();
 
-    if (m_widget) {
-        if (m_frameView)
-            m_frameView->removeChild(m_widget.get());
-        widgetRendererMap().remove(m_widget.get());
-    }
-    
+    setWidget(0);
+
     // removes from override size map
     if (hasOverrideSize())
         setOverrideSize(-1);
@@ -100,14 +135,6 @@ void RenderWidget::destroy()
         destroyLayer();
     }
 
-    // <rdar://problem/6937089> suggests that node() can be null here. One way this might happen is
-    // if this function was re-entered (and therefore the null check at the beginning did not fail),
-    // so bail out and turn a crash into an assertion failure in debug builds and a leak in release
-    // builds.
-    ASSERT(node());
-    if (!node())
-        return;
-
     // Grab the arena from node()->document()->renderArena() before clearing the node pointer.
     // Clear the node before deref-ing, as this may be deleted when deref is called.
     RenderArena* arena = renderArena();
@@ -121,39 +148,43 @@ RenderWidget::~RenderWidget()
     clearWidget();
 }
 
-void RenderWidget::setWidgetGeometry(const IntRect& frame)
+bool RenderWidget::setWidgetGeometry(const IntRect& frame)
 {
-    if (node() && m_widget->frameRect() != frame) {
-        RenderWidgetProtector protector(this);
-        RefPtr<Node> protectedNode(node());
-        m_widget->setFrameRect(frame);
-    }
+    ASSERT(!widgetHierarchyUpdateSuspendCount);
+    if (!node() || m_widget->frameRect() == frame)
+        return false;
+
+    RenderWidgetProtector protector(this);
+    RefPtr<Node> protectedNode(node());
+    m_widget->setFrameRect(frame);
+    return true;
 }
 
 void RenderWidget::setWidget(PassRefPtr<Widget> widget)
 {
-    if (widget != m_widget) {
-        if (m_widget) {
-            m_widget->removeFromParent();
-            widgetRendererMap().remove(m_widget.get());
-            clearWidget();
-        }
-        m_widget = widget;
-        if (m_widget) {
-            widgetRendererMap().add(m_widget.get(), this);
-            // if we've already received a layout, apply the calculated space to the
-            // widget immediately, but we have to have really been full constructed (with a non-null
-            // style pointer).
-            if (style()) {
-                if (!needsLayout())
-                    setWidgetGeometry(absoluteContentBox());
-                if (style()->visibility() != VISIBLE)
-                    m_widget->hide();
-                else
-                    m_widget->show();
-            }
-            m_frameView->addChild(m_widget.get());
+    if (widget == m_widget)
+        return;
+
+    if (m_widget) {
+        moveWidgetToParentSoon(m_widget.get(), 0);
+        widgetRendererMap().remove(m_widget.get());
+        clearWidget();
+    }
+    m_widget = widget;
+    if (m_widget) {
+        widgetRendererMap().add(m_widget.get(), this);
+        // If we've already received a layout, apply the calculated space to the
+        // widget immediately, but we have to have really been fully constructed (with a non-null
+        // style pointer).
+        if (style()) {
+            if (!needsLayout())
+                setWidgetGeometry(absoluteContentBox());
+            if (style()->visibility() != VISIBLE)
+                m_widget->hide();
+            else
+                m_widget->show();
         }
+        moveWidgetToParentSoon(m_widget.get(), m_frameView);
     }
 }
 
@@ -229,11 +260,11 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
         // Tell the widget to paint now.  This is the only time the widget is allowed
         // to paint itself.  That way it will composite properly with z-indexed layers.
         if (m_substituteImage)
-            paintInfo.context->drawImage(m_substituteImage.get(), m_widget->frameRect());
+            paintInfo.context->drawImage(m_substituteImage.get(), style()->colorSpace(), m_widget->frameRect());
         else
             m_widget->paint(paintInfo.context, paintInfo.rect);
 
-        if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaints()) {
+        if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaintsIfNotOverlapped()) {
             ASSERT(!paintInfo.overlapTestRequests->contains(this));
             paintInfo.overlapTestRequests->set(this, m_widget->frameRect());
         }
@@ -245,7 +276,7 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
     // Paint a partially transparent wash over selected widgets.
     if (isSelected() && !document()->printing()) {
         // FIXME: selectionRect() is in absolute, not painting coordinates.
-        paintInfo.context->fillRect(selectionRect(), selectionBackgroundColor());
+        paintInfo.context->fillRect(selectionRect(), selectionBackgroundColor(), style()->colorSpace());
     }
 }
 
@@ -274,6 +305,7 @@ void RenderWidget::updateWidgetPosition()
     int w = width() - borderLeft() - borderRight() - paddingLeft() - paddingRight();
     int h = height() - borderTop() - borderBottom() - paddingTop() - paddingBottom();
 
+<<<<<<< HEAD:WebCore/rendering/RenderWidget.cpp
     IntRect newBounds(absPos.x(), absPos.y(), w, h);
     IntRect oldBounds(m_widget->frameRect());
     bool boundsChanged = newBounds != oldBounds;
@@ -284,6 +316,10 @@ void RenderWidget::updateWidgetPosition()
     }
     
 #ifndef FLATTEN_IFRAME
+=======
+    bool boundsChanged = setWidgetGeometry(IntRect(absPos.x(), absPos.y(), w, h));
+
+>>>>>>> webkit.org at r51976:WebCore/rendering/RenderWidget.cpp
     // if the frame bounds got changed, or if view needs layout (possibly indicating
     // content size is wrong) we have to do a layout to set the right widget size
     if (m_widget->isFrameView()) {
diff --git a/WebCore/rendering/RenderWidget.h b/WebCore/rendering/RenderWidget.h
index 78537fd..6cad04a 100644
--- a/WebCore/rendering/RenderWidget.h
+++ b/WebCore/rendering/RenderWidget.h
@@ -42,6 +42,9 @@ public:
 
     void showSubstituteImage(PassRefPtr<Image>);
 
+    static void suspendWidgetHierarchyUpdates();
+    static void resumeWidgetHierarchyUpdates();
+
 protected:
     RenderWidget(Node*);
 
@@ -61,7 +64,7 @@ private:
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual void setOverlapTestResult(bool);
 
-    void setWidgetGeometry(const IntRect&);
+    bool setWidgetGeometry(const IntRect&);
 
     friend class RenderWidgetProtector;
     RenderArena* ref() { ++m_refCount; return renderArena(); }
diff --git a/WebCore/rendering/RootInlineBox.h b/WebCore/rendering/RootInlineBox.h
index b0b0e15..7fce1d3 100644
--- a/WebCore/rendering/RootInlineBox.h
+++ b/WebCore/rendering/RootInlineBox.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the line box implementation for KDE.
- *
  * Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/SVGInlineTextBox.cpp b/WebCore/rendering/SVGInlineTextBox.cpp
index d0fa9ae..cf8464e 100644
--- a/WebCore/rendering/SVGInlineTextBox.cpp
+++ b/WebCore/rendering/SVGInlineTextBox.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *
@@ -384,7 +382,8 @@ void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int t
     bool setShadow = false;
     if (styleToUse->textShadow()) {
         paintInfo.context->setShadow(IntSize(styleToUse->textShadow()->x, styleToUse->textShadow()->y),
-                                     styleToUse->textShadow()->blur, styleToUse->textShadow()->color);
+                                     styleToUse->textShadow()->blur, styleToUse->textShadow()->color,
+                                     styleToUse->colorSpace());
         setShadow = true;
     }
 
@@ -477,7 +476,7 @@ void SVGInlineTextBox::paintSelection(int boxStartOffset, const SVGChar& svgChar
     int adjust = startPos >= boxStartOffset ? boxStartOffset : 0;
     p->drawHighlightForText(font, svgTextRunForInlineTextBox(textRenderer()->text()->characters() + start() + boxStartOffset, length, style, this, svgChar.x),
                             IntPoint((int) svgChar.x, (int) svgChar.y - font.ascent()),
-                            font.ascent() + font.descent(), color, startPos - adjust, endPos - adjust);
+                            font.ascent() + font.descent(), color, style->colorSpace(), startPos - adjust, endPos - adjust);
 
     p->restore();
 }
diff --git a/WebCore/rendering/SVGInlineTextBox.h b/WebCore/rendering/SVGInlineTextBox.h
index 76837cc..ad39aab 100644
--- a/WebCore/rendering/SVGInlineTextBox.h
+++ b/WebCore/rendering/SVGInlineTextBox.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *
diff --git a/WebCore/rendering/SVGRenderSupport.cpp b/WebCore/rendering/SVGRenderSupport.cpp
index ea087f9..a594410 100644
--- a/WebCore/rendering/SVGRenderSupport.cpp
+++ b/WebCore/rendering/SVGRenderSupport.cpp
@@ -94,8 +94,17 @@ void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
         paintInfo.context->beginTransparencyLayer(opacity);
     }
 
-    if (ShadowData* shadow = svgStyle->shadow())
-        paintInfo.context->setShadow(IntSize(shadow->x, shadow->y), shadow->blur, shadow->color); 
+    if (ShadowData* shadow = svgStyle->shadow()) {
+        int xShift = shadow->x < 0 ? shadow->x : 0;
+        int yShift = shadow->y < 0 ? shadow->y :0;
+        int widthShift = shadow->x < 0 ? 0 : shadow->x;
+        int heightShift = shadow->y < 0 ? 0 : shadow->y;
+        FloatRect shadowRect = FloatRect(boundingBox.x() + xShift, boundingBox.y() + yShift,
+            boundingBox.width() + widthShift, boundingBox.height() + heightShift);
+        paintInfo.context->clip(enclosingIntRect(shadowRect));
+        paintInfo.context->setShadow(IntSize(shadow->x, shadow->y), shadow->blur, shadow->color, style->colorSpace());
+        paintInfo.context->beginTransparencyLayer(1.0f);
+    }
 
 #if ENABLE(FILTERS)
     AtomicString filterId(svgStyle->filter());
@@ -163,6 +172,11 @@ void SVGRenderBase::finishRenderSVGContent(RenderObject* object, RenderObject::P
     float opacity = style->opacity();    
     if (opacity < 1.0f)
         paintInfo.context->endTransparencyLayer();
+
+    // This needs to be done separately from opacity, because if both properties are set,
+    // then the transparency layers are nested. 
+    if (style->svgStyle()->shadow())
+        paintInfo.context->endTransparencyLayer();
 }
 
 void renderSubtreeToImage(ImageBuffer* image, RenderObject* item)
diff --git a/WebCore/rendering/TableLayout.h b/WebCore/rendering/TableLayout.h
index 8ae0ce7..10d6e26 100644
--- a/WebCore/rendering/TableLayout.h
+++ b/WebCore/rendering/TableLayout.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  *
@@ -23,11 +21,13 @@
 #ifndef TableLayout_h
 #define TableLayout_h
 
+#include <wtf/Noncopyable.h>
+
 namespace WebCore {
 
 class RenderTable;
 
-class TableLayout {
+class TableLayout : public Noncopyable {
 public:
     TableLayout(RenderTable* table)
         : m_table(table)
diff --git a/WebCore/rendering/break_lines.h b/WebCore/rendering/break_lines.h
index 14f740f..4d6b8dc 100644
--- a/WebCore/rendering/break_lines.h
+++ b/WebCore/rendering/break_lines.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/style/ContentData.h b/WebCore/rendering/style/ContentData.h
index 24d5f86..2c261f8 100644
--- a/WebCore/rendering/style/ContentData.h
+++ b/WebCore/rendering/style/ContentData.h
@@ -25,15 +25,15 @@
 #ifndef ContentData_h
 #define ContentData_h
 
-#include "PlatformString.h"
 #include "RenderStyleConstants.h"
-#include "StringImpl.h"
-#include "StyleImage.h"
 #include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
 class CounterContent;
+class StringImpl;
+class StyleImage;
 
 struct ContentData : Noncopyable {
 public:
diff --git a/WebCore/rendering/style/CounterContent.h b/WebCore/rendering/style/CounterContent.h
index cf11813..702d9c2 100644
--- a/WebCore/rendering/style/CounterContent.h
+++ b/WebCore/rendering/style/CounterContent.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class CounterContent {
+class CounterContent : public FastAllocBase {
 public:
     CounterContent(const AtomicString& identifier, EListStyleType style, const AtomicString& separator)
         : m_identifier(identifier)
diff --git a/WebCore/rendering/style/FillLayer.h b/WebCore/rendering/style/FillLayer.h
index fb928b6..9c615b4 100644
--- a/WebCore/rendering/style/FillLayer.h
+++ b/WebCore/rendering/style/FillLayer.h
@@ -59,7 +59,7 @@ struct FillSize {
     LengthSize size;
 };
 
-struct FillLayer {
+struct FillLayer : FastAllocBase {
 public:
     FillLayer(EFillLayerType);
     ~FillLayer();
diff --git a/WebCore/rendering/style/LineClampValue.h b/WebCore/rendering/style/LineClampValue.h
new file mode 100644
index 0000000..2119ca2
--- /dev/null
+++ b/WebCore/rendering/style/LineClampValue.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LineClampValue_h
+#define LineClampValue_h
+
+#include "RenderStyleConstants.h"
+
+namespace WebCore {
+    
+class LineClampValue {
+public:
+    LineClampValue()
+        : m_type(LineClampLineCount)
+        , m_value(-1)
+    {
+    }
+    
+    LineClampValue(int value, ELineClampType type)
+        : m_type(type)
+        , m_value(value)
+    {
+    }
+    
+    int value() const { return m_value; }
+    
+    bool isPercentage() const { return m_type == LineClampPercentage; }
+
+    bool isNone() const { return m_value == -1; }
+
+    bool operator==(const LineClampValue& o) const
+    {
+        return value() == o.value() && isPercentage() == o.isPercentage();
+    }
+    
+    bool operator!=(const LineClampValue& o) const
+    {
+        return !(*this == o);
+    }
+    
+private:
+    ELineClampType m_type;
+    int m_value;
+};
+    
+} // namespace WebCore
+
+#endif // LineClampValue_h
diff --git a/WebCore/rendering/style/RenderStyle.cpp b/WebCore/rendering/style/RenderStyle.cpp
index a861fea..59d40b4 100644
--- a/WebCore/rendering/style/RenderStyle.cpp
+++ b/WebCore/rendering/style/RenderStyle.cpp
@@ -454,8 +454,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     if (inherited->m_effectiveZoom != other->inherited->m_effectiveZoom)
         return StyleDifferenceLayout;
 
-    if (rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1 ||
-        rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1) {
+    if ((rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1) ||
+        (rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1)) {
         // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
         return StyleDifferenceLayout;
     }
diff --git a/WebCore/rendering/style/RenderStyle.h b/WebCore/rendering/style/RenderStyle.h
index 674f062..a72b66d 100644
--- a/WebCore/rendering/style/RenderStyle.h
+++ b/WebCore/rendering/style/RenderStyle.h
@@ -37,6 +37,7 @@
 #include "CachedImage.h"
 #include "CollapsedBorderValue.h"
 #include "Color.h"
+#include "ColorSpace.h"
 #include "ContentData.h"
 #include "CounterDirectives.h"
 #include "CursorList.h"
@@ -49,6 +50,7 @@
 #include "Length.h"
 #include "LengthBox.h"
 #include "LengthSize.h"
+#include "LineClampValue.h"
 #include "NinePieceImage.h"
 #include "OutlineValue.h"
 #include "Pair.h"
@@ -599,6 +601,7 @@ public:
     const Color& textStrokeColor() const { return rareInheritedData->textStrokeColor; }
     float textStrokeWidth() const { return rareInheritedData->textStrokeWidth; }
     const Color& textFillColor() const { return rareInheritedData->textFillColor; }
+    ColorSpace colorSpace() const { return static_cast<ColorSpace>(rareInheritedData->colorSpace); }
     float opacity() const { return rareNonInheritedData->opacity; }
     ControlPart appearance() const { return static_cast<ControlPart>(rareNonInheritedData->m_appearance); }
     EBoxAlignment boxAlign() const { return static_cast<EBoxAlignment>(rareNonInheritedData->flexibleBox->align); }
@@ -693,7 +696,7 @@ public:
     bool isRunningAcceleratedAnimation() const { return rareNonInheritedData->m_runningAcceleratedAnimation; }
 #endif
 
-    int lineClamp() const { return rareNonInheritedData->lineClamp; }
+    const LineClampValue& lineClamp() const { return rareNonInheritedData->lineClamp; }
     bool textSizeAdjust() const { return rareInheritedData->textSizeAdjust; }
     ETextSecurity textSecurity() const { return static_cast<ETextSecurity>(rareInheritedData->textSecurity); }
 
@@ -934,6 +937,7 @@ public:
     void setTextStrokeColor(const Color& c) { SET_VAR(rareInheritedData, textStrokeColor, c) }
     void setTextStrokeWidth(float w) { SET_VAR(rareInheritedData, textStrokeWidth, w) }
     void setTextFillColor(const Color& c) { SET_VAR(rareInheritedData, textFillColor, c) }
+    void setColorSpace(ColorSpace space) { SET_VAR(rareInheritedData, colorSpace, space) }
     void setOpacity(float f) { SET_VAR(rareNonInheritedData, opacity, f); }
     void setAppearance(ControlPart a) { SET_VAR(rareNonInheritedData, m_appearance, a); }
     void setBoxAlign(EBoxAlignment a) { SET_VAR(rareNonInheritedData.access()->flexibleBox, align, a); }
@@ -1013,7 +1017,7 @@ public:
     void setIsRunningAcceleratedAnimation(bool b = true) { SET_VAR(rareNonInheritedData, m_runningAcceleratedAnimation, b); }
 #endif
 
-    void setLineClamp(int c) { SET_VAR(rareNonInheritedData, lineClamp, c); }
+    void setLineClamp(LineClampValue c) { SET_VAR(rareNonInheritedData, lineClamp, c); }
     void setTextSizeAdjust(bool b) { SET_VAR(rareInheritedData, textSizeAdjust, b); }
     void setTextSecurity(ETextSecurity aTextSecurity) { SET_VAR(rareInheritedData, textSecurity, aTextSecurity); }
 
@@ -1186,9 +1190,10 @@ public:
     static float initialPerspective() { return 0; }
     static Length initialPerspectiveOriginX() { return Length(50.0, Percent); }
     static Length initialPerspectiveOriginY() { return Length(50.0, Percent); }
+    static Color initialBackgroundColor() { return Color::transparent; }
 
     // Keep these at the end.
-    static int initialLineClamp() { return -1; }
+    static LineClampValue initialLineClamp() { return LineClampValue(); }
     static bool initialTextSizeAdjust() { return true; }
     static ETextSecurity initialTextSecurity() { return TSNONE; }
 #if ENABLE(DASHBOARD_SUPPORT)
diff --git a/WebCore/rendering/style/RenderStyleConstants.h b/WebCore/rendering/style/RenderStyleConstants.h
index 3010947..92cd3d5 100644
--- a/WebCore/rendering/style/RenderStyleConstants.h
+++ b/WebCore/rendering/style/RenderStyleConstants.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ -69,8 +69,9 @@ enum PseudoId {
     NOPSEUDO, FIRST_LINE, FIRST_LETTER, BEFORE, AFTER, SELECTION, FIRST_LINE_INHERITED, SCROLLBAR, FILE_UPLOAD_BUTTON, INPUT_PLACEHOLDER,
     SLIDER_THUMB, SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON, MEDIA_CONTROLS_PANEL,
     MEDIA_CONTROLS_PLAY_BUTTON, MEDIA_CONTROLS_MUTE_BUTTON, MEDIA_CONTROLS_TIMELINE, MEDIA_CONTROLS_TIMELINE_CONTAINER,
-    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON,
-    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON,
+    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, 
+    MEDIA_CONTROLS_SEEK_BACK_BUTTON, MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, 
+    MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON,
     MEDIA_CONTROLS_STATUS_DISPLAY, SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
     INPUT_LIST_BUTTON,
 
@@ -321,6 +322,8 @@ enum ETransformStyle3D {
 enum EBackfaceVisibility {
     BackfaceVisibilityVisible, BackfaceVisibilityHidden
 };
+    
+enum ELineClampType { LineClampLineCount, LineClampPercentage };
 
 } // namespace WebCore
 
diff --git a/WebCore/rendering/style/SVGRenderStyle.cpp b/WebCore/rendering/style/SVGRenderStyle.cpp
index e8827c4..728738b 100644
--- a/WebCore/rendering/style/SVGRenderStyle.cpp
+++ b/WebCore/rendering/style/SVGRenderStyle.cpp
@@ -8,8 +8,6 @@
     Copyright (C) 2002-2003 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Apple Computer, Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/style/SVGRenderStyle.h b/WebCore/rendering/style/SVGRenderStyle.h
index 12477d7..c65be97 100644
--- a/WebCore/rendering/style/SVGRenderStyle.h
+++ b/WebCore/rendering/style/SVGRenderStyle.h
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2005, 2006 Apple Computer, Inc.
 
-     This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/style/SVGRenderStyleDefs.cpp b/WebCore/rendering/style/SVGRenderStyleDefs.cpp
index 2ed1d8f..093f1f1 100644
--- a/WebCore/rendering/style/SVGRenderStyleDefs.cpp
+++ b/WebCore/rendering/style/SVGRenderStyleDefs.cpp
@@ -8,8 +8,6 @@
     Copyright (C) 2002-2003 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Apple Computer, Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/style/SVGRenderStyleDefs.h b/WebCore/rendering/style/SVGRenderStyleDefs.h
index f4cf932..8f01d9f 100644
--- a/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -8,8 +8,6 @@
               (C) 2000-2003 Dirk Mueller (mueller@kde.org)
               (C) 2002-2003 Apple Computer, Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/style/ShadowData.h b/WebCore/rendering/style/ShadowData.h
index f4061f2..089cf77 100644
--- a/WebCore/rendering/style/ShadowData.h
+++ b/WebCore/rendering/style/ShadowData.h
@@ -26,6 +26,7 @@
 #define ShadowData_h
 
 #include "Color.h"
+#include <wtf/FastAllocBase.h>
 
 namespace WebCore {
 
@@ -33,7 +34,7 @@ enum ShadowStyle { Normal, Inset };
 
 // This struct holds information about shadows for the text-shadow and box-shadow properties.
 
-struct ShadowData {
+struct ShadowData : FastAllocBase {
     ShadowData()
         : x(0)
         , y(0)
diff --git a/WebCore/rendering/style/StyleBackgroundData.cpp b/WebCore/rendering/style/StyleBackgroundData.cpp
index 68a9ddd..08f5527 100644
--- a/WebCore/rendering/style/StyleBackgroundData.cpp
+++ b/WebCore/rendering/style/StyleBackgroundData.cpp
@@ -22,12 +22,14 @@
 #include "config.h"
 #include "StyleBackgroundData.h"
 
+#include "RenderStyle.h"
 #include "RenderStyleConstants.h"
 
 namespace WebCore {
 
 StyleBackgroundData::StyleBackgroundData()
     : m_background(BackgroundFillLayer)
+    , m_color(RenderStyle::initialBackgroundColor())
 {
 }
 
diff --git a/WebCore/rendering/style/StyleRareInheritedData.cpp b/WebCore/rendering/style/StyleRareInheritedData.cpp
index 0f3b7e7..ff626b7 100644
--- a/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -42,6 +42,7 @@ StyleRareInheritedData::StyleRareInheritedData()
     , textSizeAdjust(RenderStyle::initialTextSizeAdjust())
     , resize(RenderStyle::initialResize())
     , userSelect(RenderStyle::initialUserSelect())
+    , colorSpace(DeviceColorSpace)
 {
 }
 
@@ -64,6 +65,7 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
     , textSizeAdjust(o.textSizeAdjust)
     , resize(o.resize)
     , userSelect(o.userSelect)
+    , colorSpace(o.colorSpace)
 {
 }
 
@@ -90,7 +92,8 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && tapHighlightColor == o.tapHighlightColor
 #endif
         && resize == o.resize
-        && userSelect == o.userSelect;
+        && userSelect == o.userSelect
+        && colorSpace == o.colorSpace;
 }
 
 bool StyleRareInheritedData::shadowDataEquivalent(const StyleRareInheritedData& o) const
diff --git a/WebCore/rendering/style/StyleRareInheritedData.h b/WebCore/rendering/style/StyleRareInheritedData.h
index 4abd3cf..1aa7b05 100644
--- a/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/WebCore/rendering/style/StyleRareInheritedData.h
@@ -68,6 +68,7 @@ public:
     bool textSizeAdjust : 1; // An Apple extension.
     unsigned resize : 2; // EResize
     unsigned userSelect : 1;  // EUserSelect
+    unsigned colorSpace : 1; // ColorSpace
     
 private:
     StyleRareInheritedData();
diff --git a/WebCore/rendering/style/StyleRareNonInheritedData.h b/WebCore/rendering/style/StyleRareNonInheritedData.h
index 8dd22b3..452b273 100644
--- a/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -29,6 +29,7 @@
 #include "CursorData.h"
 #include "DataRef.h"
 #include "FillLayer.h"
+#include "LineClampValue.h"
 #include "NinePieceImage.h"
 #include "StyleTransformData.h"
 #include <wtf/OwnPtr.h>
@@ -77,7 +78,7 @@ public:
     bool animationDataEquivalent(const StyleRareNonInheritedData&) const;
     bool transitionDataEquivalent(const StyleRareNonInheritedData&) const;
 
-    int lineClamp; // An Apple extension.
+    LineClampValue lineClamp; // An Apple extension.
 #if ENABLE(DASHBOARD_SUPPORT)
     Vector<StyleDashboardRegion> m_dashboardRegions;
 #endif
diff --git a/WebCore/storage/Database.cpp b/WebCore/storage/Database.cpp
index 5aaa26f..29dec26 100644
--- a/WebCore/storage/Database.cpp
+++ b/WebCore/storage/Database.cpp
@@ -149,11 +149,12 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
 
 Database::Database(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize)
     : m_transactionInProgress(false)
+    , m_isTransactionQueueEnabled(true)
     , m_document(document)
     , m_name(name.crossThreadString())
     , m_guid(0)
-    , m_expectedVersion(expectedVersion)
-    , m_displayName(displayName)
+    , m_expectedVersion(expectedVersion.crossThreadString())
+    , m_displayName(displayName.crossThreadString())
     , m_estimatedSize(estimatedSize)
     , m_deleted(false)
     , m_stopped(false)
@@ -190,6 +191,11 @@ Database::Database(Document* document, const String& name, const String& expecte
     m_document->addOpenDatabase(this);
 }
 
+static void derefDocument(void* document)
+{
+    static_cast<Document*>(document)->deref();
+}
+
 Database::~Database()
 {
     if (m_document->databaseThread())
@@ -197,6 +203,9 @@ Database::~Database()
 
     DatabaseTracker::tracker().removeOpenDatabase(this);
     m_document->removeOpenDatabase(this);
+
+    // Deref m_document on the main thread.
+    callOnMainThread(derefDocument, m_document.release().releaseRef());
 }
 
 bool Database::openAndVerifyVersion(ExceptionCode& e)
@@ -205,15 +214,14 @@ bool Database::openAndVerifyVersion(ExceptionCode& e)
         return false;
     m_databaseAuthorizer = DatabaseAuthorizer::create();
 
-    RefPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this);
+    bool success = false;
+    DatabaseTaskSynchronizer synchronizer;
+    OwnPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this, &synchronizer, e, success);
 
-    task->lockForSynchronousScheduling();
-    m_document->databaseThread()->scheduleImmediateTask(task);
-    task->waitForSynchronousCompletion();
+    m_document->databaseThread()->scheduleImmediateTask(task.release());
+    synchronizer.waitForTaskCompletion();
 
-    ASSERT(task->isComplete());
-    e = task->exceptionCode();
-    return task->openSuccessful();
+    return success;
 }
 
 
@@ -318,11 +326,11 @@ void Database::markAsDeletedAndClose()
 
     m_document->databaseThread()->unscheduleDatabaseTasks(this);
 
-    RefPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this);
+    DatabaseTaskSynchronizer synchronizer;
+    OwnPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this, &synchronizer);
 
-    task->lockForSynchronousScheduling();
-    m_document->databaseThread()->scheduleImmediateTask(task);
-    task->waitForSynchronousCompletion();
+    m_document->databaseThread()->scheduleImmediateTask(task.release());
+    synchronizer.waitForTaskCompletion();
 }
 
 void Database::close()
@@ -362,7 +370,7 @@ void Database::stop()
 
     {
         MutexLocker locker(m_transactionInProgressMutex);
-        m_transactionQueue.kill();
+        m_isTransactionQueueEnabled = false;
         m_transactionInProgress = false;
     }
 }
@@ -497,15 +505,13 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
         currentVersion = "";
     }
 
-    // FIXME: For now, the spec says that if the database has no version, it is valid for any "Expected version" string.  That seems silly and I think it should be
-    // changed, and here's where we would change it
-    if (m_expectedVersion.length()) {
-        if (currentVersion.length() && m_expectedVersion != currentVersion) {
-            LOG(StorageAPI, "page expects version %s from database %s, which actually has version name %s - openDatabase() call will fail", m_expectedVersion.ascii().data(),
-                databaseDebugName().ascii().data(), currentVersion.ascii().data());
-            e = INVALID_STATE_ERR;
-            return false;
-        }
+    // If the expected version isn't the empty string, ensure that the current database version we have matches that version. Otherwise, set an exception.
+    // If the expected version is the empty string, then we always return with whatever version of the database we have.
+    if (m_expectedVersion.length() && m_expectedVersion != currentVersion) {
+        LOG(StorageAPI, "page expects version %s from database %s, which actually has version name %s - openDatabase() call will fail", m_expectedVersion.ascii().data(),
+            databaseDebugName().ascii().data(), currentVersion.ascii().data());
+        e = INVALID_STATE_ERR;
+        return false;
     }
 
     return true;
@@ -534,8 +540,14 @@ void Database::scheduleTransaction()
 {
     ASSERT(!m_transactionInProgressMutex.tryLock()); // Locked by caller.
     RefPtr<SQLTransaction> transaction;
-    if (m_transactionQueue.tryGetMessage(transaction) && m_document->databaseThread()) {
-        RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
+
+    if (m_isTransactionQueueEnabled && !m_transactionQueue.isEmpty()) {
+        transaction = m_transactionQueue.first();
+        m_transactionQueue.removeFirst();
+    }
+
+    if (transaction && m_document->databaseThread()) {
+        OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
         LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for transaction %p\n", task.get(), task->transaction());
         m_transactionInProgress = true;
         m_document->databaseThread()->scheduleTask(task.release());
@@ -548,7 +560,7 @@ void Database::scheduleTransactionStep(SQLTransaction* transaction, bool immedia
     if (!m_document->databaseThread())
         return;
 
-    RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
+    OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
     LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
     if (immediately)
         m_document->databaseThread()->scheduleImmediateTask(task.release());
@@ -618,15 +630,19 @@ void Database::deliverPendingCallback(void* context)
 
 Vector<String> Database::tableNames()
 {
+    // FIXME: Not using threadsafeCopy on these strings looks ok since threads take strict turns
+    // in dealing with them. However, if the code changes, this may not be true anymore.
+    Vector<String> result;
     if (!m_document->databaseThread())
-        return Vector<String>();
-    RefPtr<DatabaseTableNamesTask> task = DatabaseTableNamesTask::create(this);
+        return result;
+
+    DatabaseTaskSynchronizer synchronizer;
+    OwnPtr<DatabaseTableNamesTask> task = DatabaseTableNamesTask::create(this, &synchronizer, result);
 
-    task->lockForSynchronousScheduling();
-    m_document->databaseThread()->scheduleImmediateTask(task);
-    task->waitForSynchronousCompletion();
+    m_document->databaseThread()->scheduleImmediateTask(task.release());
+    synchronizer.waitForTaskCompletion();
 
-    return task->tableNames();
+    return result;
 }
 
 void Database::setExpectedVersion(const String& version)
diff --git a/WebCore/storage/Database.h b/WebCore/storage/Database.h
index f275027..61c9b66 100644
--- a/WebCore/storage/Database.h
+++ b/WebCore/storage/Database.h
@@ -30,7 +30,6 @@
 #define Database_h
 
 #if ENABLE(DATABASE)
-#include <wtf/MessageQueue.h>
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
 #include "SQLiteDatabase.h"
@@ -133,9 +132,10 @@ private:
     void scheduleTransactionCallback(SQLTransaction*);
     void scheduleTransactionStep(SQLTransaction* transaction, bool immediately = false);
 
-    MessageQueue<RefPtr<SQLTransaction> > m_transactionQueue;
+    Deque<RefPtr<SQLTransaction> > m_transactionQueue;
     Mutex m_transactionInProgressMutex;
     bool m_transactionInProgress;
+    bool m_isTransactionQueueEnabled;
 
     static void deliverPendingCallback(void*);
 
diff --git a/WebCore/storage/DatabaseTask.cpp b/WebCore/storage/DatabaseTask.cpp
index 755da7c..702c96b 100644
--- a/WebCore/storage/DatabaseTask.cpp
+++ b/WebCore/storage/DatabaseTask.cpp
@@ -35,9 +35,33 @@
 
 namespace WebCore {
 
-DatabaseTask::DatabaseTask(Database* database)
+DatabaseTaskSynchronizer::DatabaseTaskSynchronizer()
+    : m_taskCompleted(false)
+{
+}
+
+void DatabaseTaskSynchronizer::waitForTaskCompletion()
+{
+    m_synchronousMutex.lock();
+    if (!m_taskCompleted)
+        m_synchronousCondition.wait(m_synchronousMutex);
+    m_synchronousMutex.unlock();
+}
+
+void DatabaseTaskSynchronizer::taskCompleted()
+{
+    m_synchronousMutex.lock();
+    m_taskCompleted = true;
+    m_synchronousCondition.signal();
+    m_synchronousMutex.unlock();
+}
+
+DatabaseTask::DatabaseTask(Database* database, DatabaseTaskSynchronizer* synchronizer)
     : m_database(database)
+    , m_synchronizer(synchronizer)
+#ifndef NDEBUG
     , m_complete(false)
+#endif
 {
 }
 
@@ -56,43 +80,19 @@ void DatabaseTask::performTask()
     doPerformTask();
     m_database->performPolicyChecks();
 
-    if (m_synchronousMutex)
-        m_synchronousMutex->lock();
-
-    m_complete = true;
-
-    if (m_synchronousMutex) {
-        m_synchronousCondition->signal();
-        m_synchronousMutex->unlock();
-    }
-}
-
-void DatabaseTask::lockForSynchronousScheduling()
-{
-    // Called from main thread.
-    ASSERT(!m_synchronousMutex);
-    ASSERT(!m_synchronousCondition);
-    m_synchronousMutex.set(new Mutex);
-    m_synchronousCondition.set(new ThreadCondition);
-}
-
-void DatabaseTask::waitForSynchronousCompletion()
-{
-    // Called from main thread.
-    m_synchronousMutex->lock();
-    if (!m_complete)
-        m_synchronousCondition->wait(*m_synchronousMutex);
-    m_synchronousMutex->unlock();
+    if (m_synchronizer)
+        m_synchronizer->taskCompleted();
 }
 
 // *** DatabaseOpenTask ***
 // Opens the database file and verifies the version matches the expected version.
 
-DatabaseOpenTask::DatabaseOpenTask(Database* database)
-    : DatabaseTask(database)
-    , m_code(0)
-    , m_success(false)
+DatabaseOpenTask::DatabaseOpenTask(Database* database, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
+    : DatabaseTask(database, synchronizer)
+    , m_code(code)
+    , m_success(success)
 {
+    ASSERT(synchronizer); // A task with output parameters is supposed to be synchronous.
 }
 
 void DatabaseOpenTask::doPerformTask()
@@ -110,8 +110,8 @@ const char* DatabaseOpenTask::debugTaskName() const
 // *** DatabaseCloseTask ***
 // Closes the database.
 
-DatabaseCloseTask::DatabaseCloseTask(Database* database)
-    : DatabaseTask(database)
+DatabaseCloseTask::DatabaseCloseTask(Database* database, DatabaseTaskSynchronizer* synchronizer)
+    : DatabaseTask(database, synchronizer)
 {
 }
 
@@ -131,7 +131,7 @@ const char* DatabaseCloseTask::debugTaskName() const
 // Starts a transaction that will report its results via a callback.
 
 DatabaseTransactionTask::DatabaseTransactionTask(PassRefPtr<SQLTransaction> transaction)
-    : DatabaseTask(transaction->database())
+    : DatabaseTask(transaction->database(), 0)
     , m_transaction(transaction)
 {
 }
@@ -159,9 +159,11 @@ const char* DatabaseTransactionTask::debugTaskName() const
 // *** DatabaseTableNamesTask ***
 // Retrieves a list of all tables in the database - for WebInspector support.
 
-DatabaseTableNamesTask::DatabaseTableNamesTask(Database* database)
-    : DatabaseTask(database)
+DatabaseTableNamesTask::DatabaseTableNamesTask(Database* database, DatabaseTaskSynchronizer* synchronizer, Vector<String>& names)
+    : DatabaseTask(database, synchronizer)
+    , m_tableNames(names)
 {
+    ASSERT(synchronizer); // A task with output parameters is supposed to be synchronous.
 }
 
 void DatabaseTableNamesTask::doPerformTask()
diff --git a/WebCore/storage/DatabaseTask.h b/WebCore/storage/DatabaseTask.h
index 4aef892..97a23c7 100644
--- a/WebCore/storage/DatabaseTask.h
+++ b/WebCore/storage/DatabaseTask.h
@@ -32,6 +32,7 @@
 #include "ExceptionCode.h"
 #include "PlatformString.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
@@ -39,13 +40,33 @@
 namespace WebCore {
 
 class Database;
+class DatabaseTask;
 class DatabaseThread;
 class SQLValue;
 class SQLCallback;
 class SQLTransaction;
 class VersionChangeCallback;
 
-class DatabaseTask : public ThreadSafeShared<DatabaseTask> {
+// Can be used to wait until DatabaseTask is completed.
+// Has to be passed into DatabaseTask::create to be associated with the task.
+class DatabaseTaskSynchronizer : public Noncopyable {
+    friend class DatabaseTask;
+public:
+    DatabaseTaskSynchronizer();
+
+    // Called from main thread to wait until task is completed.
+    void waitForTaskCompletion();
+
+private:
+    // Called by the task.
+    void taskCompleted();
+
+    bool m_taskCompleted;
+    Mutex m_synchronousMutex;
+    ThreadCondition m_synchronousCondition;
+};
+
+class DatabaseTask : public Noncopyable {
     friend class Database;
 public:
     virtual ~DatabaseTask();
@@ -53,53 +74,50 @@ public:
     void performTask();
 
     Database* database() const { return m_database; }
-    bool isComplete() const { return m_complete; }
 
 protected:
-    DatabaseTask(Database*);
+    DatabaseTask(Database*, DatabaseTaskSynchronizer*);
 
 private:
     virtual void doPerformTask() = 0;
-#ifndef NDEBUG
-    virtual const char* debugTaskName() const = 0;
-#endif
-
-    void lockForSynchronousScheduling();
-    void waitForSynchronousCompletion();
 
     Database* m_database;
+    DatabaseTaskSynchronizer* m_synchronizer;
 
-    bool m_complete;
-
-    OwnPtr<Mutex> m_synchronousMutex;
-    OwnPtr<ThreadCondition> m_synchronousCondition;
+#ifndef NDEBUG
+     virtual const char* debugTaskName() const = 0;
+     bool m_complete;
+#endif
 };
 
 class DatabaseOpenTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseOpenTask> create(Database* db) { return adoptRef(new DatabaseOpenTask(db)); }
-
-    ExceptionCode exceptionCode() const { return m_code; }
-    bool openSuccessful() const { return m_success; }
+    static PassOwnPtr<DatabaseOpenTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
+    {
+        return new DatabaseOpenTask(db, synchronizer, code, success);
+    }
 
 private:
-    DatabaseOpenTask(Database*);
+    DatabaseOpenTask(Database*, DatabaseTaskSynchronizer*, ExceptionCode&, bool& success);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
     virtual const char* debugTaskName() const;
 #endif
 
-    ExceptionCode m_code;
-    bool m_success;
+    ExceptionCode& m_code;
+    bool& m_success;
 };
 
 class DatabaseCloseTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseCloseTask> create(Database* db) { return adoptRef(new DatabaseCloseTask(db)); }
+    static PassOwnPtr<DatabaseCloseTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer)
+    { 
+        return new DatabaseCloseTask(db, synchronizer);
+    }
 
 private:
-    DatabaseCloseTask(Database*);
+    DatabaseCloseTask(Database*, DatabaseTaskSynchronizer*);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
@@ -109,7 +127,11 @@ private:
 
 class DatabaseTransactionTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseTransactionTask> create(PassRefPtr<SQLTransaction> transaction) { return adoptRef(new DatabaseTransactionTask(transaction)); }
+    // Transaction task is never synchronous, so no 'synchronizer' parameter.
+    static PassOwnPtr<DatabaseTransactionTask> create(PassRefPtr<SQLTransaction> transaction)
+    {
+        return new DatabaseTransactionTask(transaction);
+    }
 
     SQLTransaction* transaction() const { return m_transaction.get(); }
 
@@ -127,19 +149,20 @@ private:
 
 class DatabaseTableNamesTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseTableNamesTask> create(Database* db) { return adoptRef(new DatabaseTableNamesTask(db)); }
-
-    Vector<String>& tableNames() { return m_tableNames; }
+    static PassOwnPtr<DatabaseTableNamesTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer, Vector<String>& names)
+    {
+        return new DatabaseTableNamesTask(db, synchronizer, names);
+    }
 
 private:
-    DatabaseTableNamesTask(Database*);
+    DatabaseTableNamesTask(Database*, DatabaseTaskSynchronizer*, Vector<String>& names);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
     virtual const char* debugTaskName() const;
 #endif
 
-    Vector<String> m_tableNames;
+    Vector<String>& m_tableNames;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/DatabaseThread.cpp b/WebCore/storage/DatabaseThread.cpp
index 40c83ee..12e9251 100644
--- a/WebCore/storage/DatabaseThread.cpp
+++ b/WebCore/storage/DatabaseThread.cpp
@@ -91,13 +91,8 @@ void* DatabaseThread::databaseThread()
     }
 
     AutodrainedPool pool;
-    while (true) {
-        RefPtr<DatabaseTask> task;
-        if (!m_queue.waitForMessage(task))
-            break;
-
+    while (OwnPtr<DatabaseTask> task = m_queue.waitForMessage()) {
         task->performTask();
-
         pool.cycle();
     }
 
@@ -142,12 +137,12 @@ void DatabaseThread::recordDatabaseClosed(Database* database)
     m_openDatabaseSet.remove(database);
 }
 
-void DatabaseThread::scheduleTask(PassRefPtr<DatabaseTask> task)
+void DatabaseThread::scheduleTask(PassOwnPtr<DatabaseTask> task)
 {
     m_queue.append(task);
 }
 
-void DatabaseThread::scheduleImmediateTask(PassRefPtr<DatabaseTask> task)
+void DatabaseThread::scheduleImmediateTask(PassOwnPtr<DatabaseTask> task)
 {
     m_queue.prepend(task);
 }
@@ -155,7 +150,7 @@ void DatabaseThread::scheduleImmediateTask(PassRefPtr<DatabaseTask> task)
 class SameDatabasePredicate {
 public:
     SameDatabasePredicate(const Database* database) : m_database(database) { }
-    bool operator()(RefPtr<DatabaseTask>& task) const { return task->database() == m_database; }
+    bool operator()(DatabaseTask* task) const { return task->database() == m_database; }
 private:
     const Database* m_database;
 };
diff --git a/WebCore/storage/DatabaseThread.h b/WebCore/storage/DatabaseThread.h
index 83b1baf..269a633 100644
--- a/WebCore/storage/DatabaseThread.h
+++ b/WebCore/storage/DatabaseThread.h
@@ -34,6 +34,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
@@ -55,8 +56,8 @@ public:
     void requestTermination();
     bool terminationRequested() const;
 
-    void scheduleTask(PassRefPtr<DatabaseTask>);
-    void scheduleImmediateTask(PassRefPtr<DatabaseTask>); // This just adds the task to the front of the queue - the caller needs to be extremely careful not to create deadlocks when waiting for completion.
+    void scheduleTask(PassOwnPtr<DatabaseTask>);
+    void scheduleImmediateTask(PassOwnPtr<DatabaseTask>); // This just adds the task to the front of the queue - the caller needs to be extremely careful not to create deadlocks when waiting for completion.
     void unscheduleDatabaseTasks(Database*);
 
     void recordDatabaseOpen(Database*);
@@ -76,7 +77,7 @@ private:
     ThreadIdentifier m_threadID;
     RefPtr<DatabaseThread> m_selfRef;
 
-    MessageQueue<RefPtr<DatabaseTask> > m_queue;
+    MessageQueue<DatabaseTask> m_queue;
 
     // This set keeps track of the open databases that have been used on this thread.
     typedef HashSet<RefPtr<Database> > DatabaseSet;
diff --git a/WebCore/storage/DatabaseTracker.h b/WebCore/storage/DatabaseTracker.h
index 85e4858..c87b26a 100644
--- a/WebCore/storage/DatabaseTracker.h
+++ b/WebCore/storage/DatabaseTracker.h
@@ -31,41 +31,56 @@
 
 #if ENABLE(DATABASE)
 
-#include "DatabaseDetails.h"
 #include "PlatformString.h"
+
+#if !PLATFORM(CHROMIUM)
+#include "DatabaseDetails.h"
 #include "SQLiteDatabase.h"
 #include "StringHash.h"
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
+#endif // !PLATFORM(CHROMIUM)
 
 namespace WebCore {
 
 class Database;
-class DatabaseTrackerClient;
 class Document;
-class OriginQuotaManager;
 class SecurityOrigin;
 
+#if !PLATFORM(CHROMIUM)
+class DatabaseTrackerClient;
+class OriginQuotaManager;
+
 struct SecurityOriginHash;
 struct SecurityOriginTraits;
+#endif // !PLATFORM(CHROMIUM)
 
-class DatabaseTracker {
+class DatabaseTracker : public Noncopyable {
 public:
-    void setDatabaseDirectoryPath(const String&);
-    const String& databaseDirectoryPath() const;
+    static DatabaseTracker& tracker();
 
     bool canEstablishDatabase(Document*, const String& name, const String& displayName, unsigned long estimatedSize);
     void setDatabaseDetails(SecurityOrigin*, const String& name, const String& displayName, unsigned long estimatedSize);
     String fullPathForDatabase(SecurityOrigin*, const String& name, bool createIfDoesNotExist = true);
 
+    void addOpenDatabase(Database*);
+    void removeOpenDatabase(Database*);
+
+    unsigned long long getMaxSizeForDatabase(const Database*);
+
+private:
+    DatabaseTracker();
+
+#if !PLATFORM(CHROMIUM)
+public:
+    void setDatabaseDirectoryPath(const String&);
+    const String& databaseDirectoryPath() const;
+
     void origins(Vector<RefPtr<SecurityOrigin> >& result);
     bool databaseNamesForOrigin(SecurityOrigin*, Vector<String>& result);
 
     DatabaseDetails detailsForNameAndOrigin(const String&, SecurityOrigin*);
 
-    void addOpenDatabase(Database*);
-    void removeOpenDatabase(Database*);
-
     unsigned long long usageForDatabase(const String&, SecurityOrigin*);
     unsigned long long usageForOrigin(SecurityOrigin*);
     unsigned long long quotaForOrigin(SecurityOrigin*);
@@ -82,15 +97,10 @@ public:
 
     OriginQuotaManager& originQuotaManager();
 
-    static DatabaseTracker& tracker();
 
     bool hasEntryForOrigin(SecurityOrigin*);
 
-    unsigned long long getMaxSizeForDatabase(const Database*);
-
 private:
-    DatabaseTracker();
-
     String trackerDatabasePath() const;
     void openTrackerDatabase(bool createIfDoesNotExist);
 
@@ -130,6 +140,7 @@ private:
 
     static void scheduleForNotification();
     static void notifyDatabasesChanged(void*);
+#endif // !PLATFORM(CHROMIUM)
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/LocalStorageTask.h b/WebCore/storage/LocalStorageTask.h
index f03d851..dc3e7e2 100644
--- a/WebCore/storage/LocalStorageTask.h
+++ b/WebCore/storage/LocalStorageTask.h
@@ -28,8 +28,7 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
@@ -38,15 +37,15 @@ namespace WebCore {
     class LocalStorageThread;
 
     // FIXME: Rename this class to StorageTask
-    class LocalStorageTask : public ThreadSafeShared<LocalStorageTask> {
+    class LocalStorageTask : public Noncopyable {
     public:
         enum Type { AreaImport, AreaSync, TerminateThread };
 
         ~LocalStorageTask();
 
-        static PassRefPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
-        static PassRefPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
-        static PassRefPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
+        static PassOwnPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return new LocalStorageTask(AreaImport, area); }
+        static PassOwnPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return new LocalStorageTask(AreaSync, area); }
+        static PassOwnPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return new LocalStorageTask(TerminateThread, thread); }
 
         void performTask();
 
diff --git a/WebCore/storage/LocalStorageThread.cpp b/WebCore/storage/LocalStorageThread.cpp
index 78640a9..d4a7b4c 100644
--- a/WebCore/storage/LocalStorageThread.cpp
+++ b/WebCore/storage/LocalStorageThread.cpp
@@ -33,96 +33,70 @@
 
 namespace WebCore {
 
-PassRefPtr<LocalStorageThread> LocalStorageThread::create()
+PassOwnPtr<LocalStorageThread> LocalStorageThread::create()
 {
-    return adoptRef(new LocalStorageThread);
+    return new LocalStorageThread;
 }
 
 LocalStorageThread::LocalStorageThread()
     : m_threadID(0)
 {
-    m_selfRef = this;
 }
 
-bool LocalStorageThread::start()
+LocalStorageThread::~LocalStorageThread()
 {
-    MutexLocker lock(m_threadCreationMutex);
-
-    if (m_threadID)
-        return true;
-
-    m_threadID = createThread(LocalStorageThread::localStorageThreadStart, this, "WebCore: LocalStorage");
+    ASSERT(isMainThread());
+    ASSERT(!m_threadID);
+}
 
+bool LocalStorageThread::start()
+{
+    ASSERT(isMainThread());
+    if (!m_threadID)
+        m_threadID = createThread(LocalStorageThread::threadEntryPointCallback, this, "WebCore: LocalStorage");
     return m_threadID;
 }
 
-void* LocalStorageThread::localStorageThreadStart(void* thread)
+void* LocalStorageThread::threadEntryPointCallback(void* thread)
 {
-    return static_cast<LocalStorageThread*>(thread)->localStorageThread();
+    return static_cast<LocalStorageThread*>(thread)->threadEntryPoint();
 }
 
-void* LocalStorageThread::localStorageThread()
+void* LocalStorageThread::threadEntryPoint()
 {
-    {
-        // Wait for LocalStorageThread::start() to complete.
-        MutexLocker lock(m_threadCreationMutex);
-    }
-
-    while (true) {
-        RefPtr<LocalStorageTask> task;
-        if (!m_queue.waitForMessage(task))
-            break;
-
+    ASSERT(!isMainThread());
+    while (OwnPtr<LocalStorageTask> task = m_queue.waitForMessage())
         task->performTask();
-    }
-
-    // Detach the thread so its resources are no longer of any concern to anyone else
-    detachThread(m_threadID);
-    m_threadID = 0;
-
-    // Clear the self refptr, possibly resulting in deletion
-    m_selfRef = 0;
 
     return 0;
 }
 
-void LocalStorageThread::scheduleImport(StorageAreaSync* area)
-{
-    ASSERT(!m_queue.killed() && m_threadID);
-    m_queue.append(LocalStorageTask::createImport(area));
-}
-
-void LocalStorageThread::scheduleSync(StorageAreaSync* area)
+void LocalStorageThread::scheduleTask(PassOwnPtr<LocalStorageTask> task)
 {
+    ASSERT(isMainThread());
     ASSERT(!m_queue.killed() && m_threadID);
-    m_queue.append(LocalStorageTask::createSync(area));
+    m_queue.append(task);
 }
 
 void LocalStorageThread::terminate()
 {
     ASSERT(isMainThread());
-
-    // Ideally we'd never be killing a thread that wasn't live, so ASSERT it.
-    // But if we do in a release build, make sure to not wait on a condition that will never get signalled
     ASSERT(!m_queue.killed() && m_threadID);
+    // Even in weird, exceptional cases, don't wait on a nonexistent thread to terminate.
     if (!m_threadID)
         return;
 
-    MutexLocker locker(m_terminateLock);
-
+    void* returnValue;
     m_queue.append(LocalStorageTask::createTerminate(this));
-
-    m_terminateCondition.wait(m_terminateLock);
+    waitForThreadCompletion(m_threadID, &returnValue);
+    ASSERT(m_queue.killed());
+    m_threadID = 0;
 }
 
 void LocalStorageThread::performTerminate()
 {
     ASSERT(!isMainThread());
-
     m_queue.kill();
-
-    MutexLocker locker(m_terminateLock);
-    m_terminateCondition.signal();
 }
 
 }
diff --git a/WebCore/storage/LocalStorageThread.h b/WebCore/storage/LocalStorageThread.h
index e9e2b58..6f05911 100644
--- a/WebCore/storage/LocalStorageThread.h
+++ b/WebCore/storage/LocalStorageThread.h
@@ -30,6 +30,7 @@
 
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
@@ -39,34 +40,27 @@ namespace WebCore {
     class LocalStorageTask;
 
     // FIXME: Rename this class to StorageThread
-    class LocalStorageThread : public ThreadSafeShared<LocalStorageThread> {
+    class LocalStorageThread : public Noncopyable {
     public:
-        static PassRefPtr<LocalStorageThread> create();
+        static PassOwnPtr<LocalStorageThread> create();
+        ~LocalStorageThread();
 
         bool start();
-
-        void scheduleImport(StorageAreaSync*);
-        void scheduleSync(StorageAreaSync*);
-
-        // Called from the main thread to synchronously shut down this thread
         void terminate();
-        // Background thread part of the terminate procedure
+        void scheduleTask(PassOwnPtr<LocalStorageTask>);
+
+        // Background thread part of the terminate procedure.
         void performTerminate();
 
     private:
         LocalStorageThread();
 
-        static void* localStorageThreadStart(void*);
-        void* localStorageThread();
+        // Called on background thread.
+        static void* threadEntryPointCallback(void*);
+        void* threadEntryPoint();
 
-        Mutex m_threadCreationMutex;
         ThreadIdentifier m_threadID;
-        RefPtr<LocalStorageThread> m_selfRef;
-
-        MessageQueue<RefPtr<LocalStorageTask> > m_queue;
-
-        Mutex m_terminateLock;
-        ThreadCondition m_terminateCondition;
+        MessageQueue<LocalStorageTask> m_queue;
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/OriginUsageRecord.h b/WebCore/storage/OriginUsageRecord.h
index 609a793..25bddf2 100644
--- a/WebCore/storage/OriginUsageRecord.h
+++ b/WebCore/storage/OriginUsageRecord.h
@@ -40,7 +40,7 @@ namespace WebCore {
 
 // Objects of this class can be used from multiple threads with external synchronization.
 // String arguments are also supposed to be deeply copied by the caller when necessary.
-class OriginUsageRecord {
+class OriginUsageRecord : public Noncopyable {
 public:
     OriginUsageRecord();
 
diff --git a/WebCore/storage/SQLTransactionClient.h b/WebCore/storage/SQLTransactionClient.h
index 941c163..e822594 100644
--- a/WebCore/storage/SQLTransactionClient.h
+++ b/WebCore/storage/SQLTransactionClient.h
@@ -31,13 +31,15 @@
 #ifndef SQLTransactionClient_h
 #define SQLTransactionClient_h
 
+#include <wtf/Noncopyable.h>
+
 namespace WebCore {
 
     class SQLTransaction;
 
     // A client to the SQLTransaction class. Allows SQLTransaction to notify interested
     // parties that certain things have happened in a transaction.
-    class SQLTransactionClient {
+    class SQLTransactionClient : public Noncopyable {
     public:
         void didCommitTransaction(SQLTransaction*);
         void didExecuteStatement(SQLTransaction*);
diff --git a/WebCore/storage/SQLTransactionCoordinator.h b/WebCore/storage/SQLTransactionCoordinator.h
index 20cc863..ae5674b 100644
--- a/WebCore/storage/SQLTransactionCoordinator.h
+++ b/WebCore/storage/SQLTransactionCoordinator.h
@@ -42,7 +42,7 @@ namespace WebCore {
 
     class SQLTransaction;
 
-    class SQLTransactionCoordinator {
+    class SQLTransactionCoordinator : public Noncopyable {
     public:
         void acquireLock(SQLTransaction*);
         void releaseLock(SQLTransaction*);
diff --git a/WebCore/storage/StorageAreaImpl.cpp b/WebCore/storage/StorageAreaImpl.cpp
index 612cb5f..8c2a29c 100644
--- a/WebCore/storage/StorageAreaImpl.cpp
+++ b/WebCore/storage/StorageAreaImpl.cpp
@@ -30,6 +30,7 @@
 
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "Page.h"
 #include "Settings.h"
 #include "StorageAreaSync.h"
 #include "StorageEventDispatcher.h"
@@ -64,7 +65,7 @@ StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOri
     // FIXME: If there's no backing storage for LocalStorage, the default WebKit behavior should be that of private browsing,
     // not silently ignoring it.  https://bugs.webkit.org/show_bug.cgi?id=25894
     if (m_storageSyncManager) {
-        m_storageAreaSync = StorageAreaSync::create(m_storageSyncManager, this);
+        m_storageAreaSync = StorageAreaSync::create(m_storageSyncManager, this, m_securityOrigin->databaseIdentifier());
         ASSERT(m_storageAreaSync);
     }
 }
@@ -106,6 +107,8 @@ static bool privateBrowsingEnabled(Frame* frame)
 unsigned StorageAreaImpl::length() const
 {
     ASSERT(!m_isShutdown);
+    blockUntilImportComplete();
+
     return m_storageMap->length();
 }
 
@@ -113,6 +116,7 @@ String StorageAreaImpl::key(unsigned index) const
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
+
     return m_storageMap->key(index);
 }
 
@@ -138,21 +142,20 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
     String oldValue;
     bool quotaException;
     RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue, quotaException);
+    if (newMap)
+        m_storageMap = newMap.release();
 
     if (quotaException) {
         ec = QUOTA_EXCEEDED_ERR;
         return;
     }
 
-    if (newMap)
-        m_storageMap = newMap.release();
+    if (oldValue == value)
+        return;
 
-    // Only notify the client if an item was actually changed
-    if (oldValue != value) {
-        if (m_storageAreaSync)
-            m_storageAreaSync->scheduleItemForSync(key, value);
-        StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
-    }
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleItemForSync(key, value);
+    StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
 }
 
 void StorageAreaImpl::removeItem(const String& key, Frame* frame)
@@ -168,12 +171,12 @@ void StorageAreaImpl::removeItem(const String& key, Frame* frame)
     if (newMap)
         m_storageMap = newMap.release();
 
-    // Only notify the client if an item was actually removed
-    if (!oldValue.isNull()) {
-        if (m_storageAreaSync)
-            m_storageAreaSync->scheduleItemForSync(key, String());
-        StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
-    }
+    if (oldValue.isNull())
+        return;
+
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleItemForSync(key, String());
+    StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
 }
 
 void StorageAreaImpl::clear(Frame* frame)
@@ -184,6 +187,9 @@ void StorageAreaImpl::clear(Frame* frame)
     if (privateBrowsingEnabled(frame))
         return;
 
+    if (!m_storageMap->length())
+        return;
+
     unsigned quota = m_storageMap->quota();
     m_storageMap = StorageMap::create(quota);
 
@@ -206,11 +212,6 @@ void StorageAreaImpl::importItem(const String& key, const String& value)
     m_storageMap->importItem(key, value);
 }
 
-SecurityOrigin* StorageAreaImpl::securityOrigin()
-{
-    return m_securityOrigin.get();
-}
-
 void StorageAreaImpl::close()
 {
     if (m_storageAreaSync)
diff --git a/WebCore/storage/StorageAreaImpl.h b/WebCore/storage/StorageAreaImpl.h
index fe21a45..0b2d34d 100644
--- a/WebCore/storage/StorageAreaImpl.h
+++ b/WebCore/storage/StorageAreaImpl.h
@@ -56,9 +56,8 @@ namespace WebCore {
         PassRefPtr<StorageAreaImpl> copy();
         void close();
 
-        // Could be called from a background thread.
+        // Only called from a background thread.
         void importItem(const String& key, const String& value);
-        SecurityOrigin* securityOrigin();
 
     private:
         StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
diff --git a/WebCore/storage/StorageAreaSync.cpp b/WebCore/storage/StorageAreaSync.cpp
index ad41e28..d4eba76 100644
--- a/WebCore/storage/StorageAreaSync.cpp
+++ b/WebCore/storage/StorageAreaSync.cpp
@@ -31,6 +31,7 @@
 #include "CString.h"
 #include "EventNames.h"
 #include "HTMLElement.h"
+#include "SecurityOrigin.h"
 #include "SQLiteStatement.h"
 #include "StorageAreaImpl.h"
 #include "StorageSyncManager.h"
@@ -42,17 +43,18 @@ namespace WebCore {
 // Instead, queue up a batch of items to sync and actually do the sync at the following interval.
 static const double StorageSyncInterval = 1.0;
 
-PassRefPtr<StorageAreaSync> StorageAreaSync::create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea)
+PassRefPtr<StorageAreaSync> StorageAreaSync::create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier)
 {
-    return adoptRef(new StorageAreaSync(storageSyncManager, storageArea));
+    return adoptRef(new StorageAreaSync(storageSyncManager, storageArea, databaseIdentifier));
 }
 
-StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea)
+StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier)
     : m_syncTimer(this, &StorageAreaSync::syncTimerFired)
     , m_itemsCleared(false)
     , m_finalSyncScheduled(false)
     , m_storageArea(storageArea)
     , m_syncManager(storageSyncManager)
+    , m_databaseIdentifier(databaseIdentifier.crossThreadString())
     , m_clearItemsWhileSyncing(false)
     , m_syncScheduled(false)
     , m_importComplete(false)
@@ -71,6 +73,7 @@ StorageAreaSync::~StorageAreaSync()
 {
     ASSERT(isMainThread());
     ASSERT(!m_syncTimer.isActive());
+    ASSERT(m_finalSyncScheduled);
 }
 
 void StorageAreaSync::scheduleFinalSync()
@@ -78,6 +81,7 @@ void StorageAreaSync::scheduleFinalSync()
     ASSERT(isMainThread());
     // FIXME: We do this to avoid races, but it'd be better to make things safe without blocking.
     blockUntilImportComplete();
+    m_storageArea = 0;  // This is done in blockUntilImportComplete() but this is here as a form of documentation that we must be absolutely sure the ref count cycle is broken.
 
     if (m_syncTimer.isActive())
         m_syncTimer.stop();
@@ -165,7 +169,7 @@ void StorageAreaSync::performImport()
     ASSERT(!isMainThread());
     ASSERT(!m_database.isOpen());
 
-    String databaseFilename = m_syncManager->fullDatabaseFilename(m_storageArea->securityOrigin());
+    String databaseFilename = m_syncManager->fullDatabaseFilename(m_databaseIdentifier);
 
     if (databaseFilename.isEmpty()) {
         LOG_ERROR("Filename for local storage database is empty - cannot open for persistent storage");
@@ -206,27 +210,18 @@ void StorageAreaSync::performImport()
         return;
     }
 
-    MutexLocker locker(m_importLock);
-
     HashMap<String, String>::iterator it = itemMap.begin();
     HashMap<String, String>::iterator end = itemMap.end();
 
     for (; it != end; ++it)
         m_storageArea->importItem(it->first, it->second);
 
-    // Break the (ref count) cycle.
-    m_storageArea = 0;
-    m_importComplete = true;
-    m_importCondition.signal();
+    markImported();
 }
 
 void StorageAreaSync::markImported()
 {
-    ASSERT(!isMainThread());
-
     MutexLocker locker(m_importLock);
-    // Break the (ref count) cycle.
-    m_storageArea = 0;
     m_importComplete = true;
     m_importCondition.signal();
 }
@@ -238,19 +233,18 @@ void StorageAreaSync::markImported()
 // item currently in the map. Get/remove can work whether or not it's in the map, but we'll need a list
 // of items the import should not overwrite. Clear can also work, but it'll need to kill the import
 // job first.
-void StorageAreaSync::blockUntilImportComplete() const
+void StorageAreaSync::blockUntilImportComplete()
 {
     ASSERT(isMainThread());
 
-    // Fast path to avoid locking.
-    if (m_importComplete)
+    // Fast path.  We set m_storageArea to 0 only after m_importComplete being true.
+    if (!m_storageArea)
         return;
 
     MutexLocker locker(m_importLock);
     while (!m_importComplete)
         m_importCondition.wait(m_importLock);
-    ASSERT(m_importComplete);
-    ASSERT(!m_storageArea);
+    m_storageArea = 0;
 }
 
 void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items)
diff --git a/WebCore/storage/StorageAreaSync.h b/WebCore/storage/StorageAreaSync.h
index 9d6436f..9afdfde 100644
--- a/WebCore/storage/StorageAreaSync.h
+++ b/WebCore/storage/StorageAreaSync.h
@@ -42,17 +42,17 @@ namespace WebCore {
 
     class StorageAreaSync : public RefCounted<StorageAreaSync> {
     public:
-        static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
+        static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier);
         ~StorageAreaSync();
 
         void scheduleFinalSync();
-        void blockUntilImportComplete() const;
+        void blockUntilImportComplete();
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
 
     private:
-        StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
+        StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier);
 
         void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
@@ -78,6 +78,8 @@ namespace WebCore {
         void syncTimerFired(Timer<StorageAreaSync>*);
         void sync(bool clearItems, const HashMap<String, String>& items);
 
+        const String m_databaseIdentifier;
+
         Mutex m_syncLock;
         HashMap<String, String> m_itemsPendingSync;
         bool m_clearItemsWhileSyncing;
diff --git a/WebCore/storage/StorageMap.cpp b/WebCore/storage/StorageMap.cpp
index 5498d9e..bb08671 100644
--- a/WebCore/storage/StorageMap.cpp
+++ b/WebCore/storage/StorageMap.cpp
@@ -111,12 +111,21 @@ PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& valu
         return newStorageMap.release();
     }
 
-    // Quota tracking.  If the quota is enabled and this would go over it, bail.
+    // Quota tracking.  This is done in a couple of steps to keep the overflow tracking simple.
+    unsigned newLength = m_currentLength;
+    bool overflow = newLength + value.length() < newLength;
+    newLength += value.length();
+
     oldValue = m_map.get(key);
-    unsigned newLength = m_currentLength + value.length() - oldValue.length();
+    overflow |= newLength - oldValue.length() > newLength;
+    newLength -= oldValue.length();
+
+    unsigned adjustedKeyLength = oldValue.isNull() ? key.length() : 0;
+    overflow |= newLength + adjustedKeyLength < newLength;
+    newLength += adjustedKeyLength;
+
+    ASSERT(!overflow);  // Overflow is bad...even if quotas are off.
     bool overQuota = newLength > m_quotaSize / sizeof(UChar);
-    bool overflow = (newLength > m_currentLength) != (value.length() > oldValue.length());
-    ASSERT(!overflow);  // If we're debugging, make a fuss.  But it's still worth checking this in the following if statement.
     if (m_quotaSize != noQuota && (overflow || overQuota)) {
         quotaException = true;
         return 0;
@@ -143,10 +152,11 @@ PassRefPtr<StorageMap> StorageMap::removeItem(const String& key, String& oldValu
     }
 
     oldValue = m_map.take(key);
-    if (!oldValue.isNull())
+    if (!oldValue.isNull()) {
         invalidateIterator();
-
-    // Update quota.
+        ASSERT(m_currentLength - key.length() <= m_currentLength);
+        m_currentLength -= key.length();
+    }
     ASSERT(m_currentLength - oldValue.length() <= m_currentLength);
     m_currentLength -= oldValue.length();
 
@@ -162,12 +172,11 @@ void StorageMap::importItem(const String& key, const String& value)
 {
     // Be sure to copy the keys/values as items imported on a background thread are destined
     // to cross a thread boundary
-    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), String());
-
-    if (result.second)
-        result.first->second = value.threadsafeCopy();
+    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), value.threadsafeCopy());
+    ASSERT(result.second);  // True if the key didn't exist previously.
 
-    // Update quota.
+    ASSERT(m_currentLength + key.length() >= m_currentLength);
+    m_currentLength += key.length();
     ASSERT(m_currentLength + value.length() >= m_currentLength);
     m_currentLength += value.length();
 }
diff --git a/WebCore/storage/StorageSyncManager.cpp b/WebCore/storage/StorageSyncManager.cpp
index f9276dd..d9641b7 100644
--- a/WebCore/storage/StorageSyncManager.cpp
+++ b/WebCore/storage/StorageSyncManager.cpp
@@ -48,28 +48,29 @@ PassRefPtr<StorageSyncManager> StorageSyncManager::create(const String& path)
 }
 
 StorageSyncManager::StorageSyncManager(const String& path)
-    : m_path(path.crossThreadString())
+    : m_thread(LocalStorageThread::create())
+    , m_path(path.crossThreadString())
 {
     ASSERT(isMainThread());
     ASSERT(!m_path.isEmpty());
-    m_thread = LocalStorageThread::create();
     m_thread->start();
 }
 
 StorageSyncManager::~StorageSyncManager()
 {
     ASSERT(isMainThread());
+    ASSERT(!m_thread);
 }
 
-String StorageSyncManager::fullDatabaseFilename(SecurityOrigin* origin)
+// Called on a background thread.
+String StorageSyncManager::fullDatabaseFilename(const String& databaseIdentifier)
 {
-    ASSERT(origin);
     if (!makeAllDirectories(m_path)) {
         LOG_ERROR("Unabled to create LocalStorage database path %s", m_path.utf8().data());
         return String();
     }
 
-    return pathByAppendingComponent(m_path, origin->databaseIdentifier() + ".localstorage");
+    return pathByAppendingComponent(m_path, databaseIdentifier + ".localstorage");
 }
 
 void StorageSyncManager::close()
@@ -85,19 +86,18 @@ void StorageSyncManager::close()
 bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
-
+    ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleImport(area.get());
-
+        m_thread->scheduleTask(LocalStorageTask::createImport(area.get()));
     return m_thread;
 }
 
 void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
-
+    ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleSync(area.get());
+        m_thread->scheduleTask(LocalStorageTask::createSync(area.get()));
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageSyncManager.h b/WebCore/storage/StorageSyncManager.h
index fe35e3d..e2dfa76 100644
--- a/WebCore/storage/StorageSyncManager.h
+++ b/WebCore/storage/StorageSyncManager.h
@@ -32,7 +32,7 @@
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -53,12 +53,12 @@ namespace WebCore {
     private:
         StorageSyncManager(const String& path);
 
-        RefPtr<LocalStorageThread> m_thread;
+        OwnPtr<LocalStorageThread> m_thread;
 
     // The following members are subject to thread synchronization issues
     public:
         // To be called from the background thread:
-        String fullDatabaseFilename(SecurityOrigin*);
+        String fullDatabaseFilename(const String& databaseIdentifier);
 
     private:
         String m_path;
diff --git a/WebCore/storage/chromium/DatabaseObserver.h b/WebCore/storage/chromium/DatabaseObserver.h
new file mode 100644
index 0000000..535c0d2
--- /dev/null
+++ b/WebCore/storage/chromium/DatabaseObserver.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DatabaseObserver_h
+#define DatabaseObserver_h
+
+namespace WebCore {
+
+class Database;
+
+// The implementation of this class is in the WebKit API (Chromium source tree)
+// in webkit/api/src/DatabaseObserver.cpp.
+class DatabaseObserver {
+public:
+    static void databaseOpened(Database*);
+    static void databaseModified(Database*);
+    static void databaseClosed(Database*);
+};
+
+}
+
+#endif // DatabaseObserver_h
diff --git a/WebCore/storage/chromium/DatabaseTrackerChromium.cpp b/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
new file mode 100644
index 0000000..e4b8178
--- /dev/null
+++ b/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DatabaseTracker.h"
+
+#include "CString.h"
+#include "Database.h"
+#include "DatabaseObserver.h"
+#include "DatabaseThread.h"
+#include "Document.h"
+#include "QuotaTracker.h"
+#include "SecurityOrigin.h"
+#include "SQLiteFileSystem.h"
+#include <wtf/HashSet.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+DatabaseTracker& DatabaseTracker::tracker()
+{
+    DEFINE_STATIC_LOCAL(DatabaseTracker, tracker, ());
+    return tracker;
+}
+
+DatabaseTracker::DatabaseTracker()
+{
+    SQLiteFileSystem::registerSQLiteVFS();
+}
+
+bool DatabaseTracker::canEstablishDatabase(Document*, const String&, const String&, unsigned long)
+{
+    // In Chromium, a database can always be established (even though we might not
+    // be able to write anything to it if the quota for this origin was exceeded)
+    return true;
+}
+
+void DatabaseTracker::setDatabaseDetails(SecurityOrigin*, const String&, const String&, unsigned long)
+{
+    // Chromium sets the database details when the database is opened
+}
+
+String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String& name, bool)
+{
+    return origin->databaseIdentifier() + "/" + name + "#";
+}
+
+void DatabaseTracker::addOpenDatabase(Database* database)
+{
+    ASSERT(isMainThread());
+    DatabaseObserver::databaseOpened(database);
+}
+
+void DatabaseTracker::removeOpenDatabase(Database* database)
+{
+    // FIXME: once we know how to use this information, figure out
+    //        how to get this method called on the main thread
+    //ASSERT(isMainThread());
+    //DatabaseObserver::databaseClosed(database);
+}
+
+unsigned long long DatabaseTracker::getMaxSizeForDatabase(const Database* database)
+{
+    ASSERT(currentThread() == database->document()->databaseThread()->getThreadID());
+    unsigned long long spaceAvailable = 0;
+    unsigned long long databaseSize = 0;
+    QuotaTracker::instance().getDatabaseSizeAndSpaceAvailableToOrigin(
+        database->securityOrigin()->databaseIdentifier(),
+        database->stringIdentifier(), &databaseSize, &spaceAvailable);
+    return databaseSize + spaceAvailable;
+}
+
+}
diff --git a/WebCore/storage/chromium/QuotaTracker.cpp b/WebCore/storage/chromium/QuotaTracker.cpp
new file mode 100644
index 0000000..b49639d
--- /dev/null
+++ b/WebCore/storage/chromium/QuotaTracker.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "QuotaTracker.h"
+
+#include "CString.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+QuotaTracker& QuotaTracker::instance()
+{
+    DEFINE_STATIC_LOCAL(QuotaTracker, tracker, ());
+    return tracker;
+}
+
+void QuotaTracker::getDatabaseSizeAndSpaceAvailableToOrigin(
+    const String& originIdentifier, const String& databaseName,
+    unsigned long long* databaseSize, unsigned long long* spaceAvailable)
+{
+    MutexLocker lockData(m_dataGuard);
+    ASSERT(m_databaseSizes.contains(originIdentifier));
+    HashMap<String, SizeMap>::const_iterator it = m_databaseSizes.find(originIdentifier);
+    ASSERT(it->second.contains(databaseName));
+    *databaseSize = it->second.get(databaseName);
+
+    ASSERT(m_spaceAvailableToOrigins.contains(originIdentifier));
+    *spaceAvailable = m_spaceAvailableToOrigins.get(originIdentifier);
+}
+
+void QuotaTracker::updateDatabaseSizeAndSpaceAvailableToOrigin(
+    const String& originIdentifier, const String& databaseName,
+    unsigned long long databaseSize, unsigned long long spaceAvailable)
+{
+    MutexLocker lockData(m_dataGuard);
+    m_spaceAvailableToOrigins.set(originIdentifier, spaceAvailable);
+    HashMap<String, SizeMap>::iterator it = m_databaseSizes.add(originIdentifier, SizeMap()).first;
+    it->second.set(databaseName, databaseSize);
+}
+
+}
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.h b/WebCore/storage/chromium/QuotaTracker.h
index 712dd9b..9146910 100644
--- a/WebCore/bindings/v8/ScriptObjectQuarantine.h
+++ b/WebCore/storage/chromium/QuotaTracker.h
@@ -28,32 +28,36 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-// ScriptObjectQuarantine is used in JSC for wrapping DOM objects of the page
-// before they are passed to Inspector's front-end. The wrapping prevents
-// malicious scripts from gaining privileges. For V8, we are currently just
-// passing the object itself, without any wrapping.
+#ifndef QuotaTracker_h
+#define QuotaTracker_h
 
-#ifndef ScriptObjectQuarantine_h
-#define ScriptObjectQuarantine_h
-
-#include "ScriptState.h"
+#include "CString.h"
+#include "SecurityOrigin.h"
+#include "StringHash.h"
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
-    class Database;
-    class DOMWindow;
-    class Node;
-    class ScriptObject;
-    class ScriptValue;
-    class Storage;
+class QuotaTracker {
+public:
+    static QuotaTracker& instance();
+
+    void getDatabaseSizeAndSpaceAvailableToOrigin(
+        const String& originIdentifier, const String& databaseName,
+        unsigned long long* databaseSize, unsigned long long* spaceAvailable);
+    void updateDatabaseSizeAndSpaceAvailableToOrigin(
+        const String& originIdentifier, const String& databaseName,
+        unsigned long long databaseSize, unsigned long long spaceAvailable);
 
-    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+private:
+    QuotaTracker() { }
 
-    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+    typedef HashMap<String, unsigned long long> SizeMap;
+    SizeMap m_spaceAvailableToOrigins;
+    HashMap<String, SizeMap> m_databaseSizes;
+    Mutex m_dataGuard;
+};
 
 }
 
-#endif // ScriptObjectQuarantine_h
+#endif // QuotaTracker_h
diff --git a/WebCore/storage/chromium/SQLTransactionClientChromium.cpp b/WebCore/storage/chromium/SQLTransactionClientChromium.cpp
new file mode 100644
index 0000000..46d73ba
--- /dev/null
+++ b/WebCore/storage/chromium/SQLTransactionClientChromium.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLTransactionClient.h"
+
+#include "Database.h"
+#include "DatabaseObserver.h"
+#include "DatabaseThread.h"
+#include "Document.h"
+#include "SQLTransaction.h"
+#include <wtf/MainThread.h>
+
+static void notifyDatabaseChanged(void* context) {
+    WebCore::Database* database = static_cast<WebCore::Database*>(context);
+    WebCore::DatabaseObserver::databaseModified(database);
+    database->deref();  // ref()'d in didCommitTransaction()
+}
+
+namespace WebCore {
+
+void SQLTransactionClient::didCommitTransaction(SQLTransaction* transaction)
+{
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    if (!transaction->isReadOnly()) {
+        transaction->database()->ref();  // deref()'d in notifyDatabaseChanged()
+        callOnMainThread(notifyDatabaseChanged, transaction->database());
+    }
+}
+
+void SQLTransactionClient::didExecuteStatement(SQLTransaction* transaction)
+{
+    // This method is called after executing every statement that changes the DB.
+    // Chromium doesn't need to do anything at that point.
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+}
+
+bool SQLTransactionClient::didExceedQuota(SQLTransaction*)
+{
+    // Chromium does not allow users to manually change the quota for an origin (for now, at least).
+    // Don't do anything.
+    ASSERT(isMainThread());
+    return false;
+}
+
+}
diff --git a/WebCore/svg/GradientAttributes.h b/WebCore/svg/GradientAttributes.h
index 6b3408e..941e816 100644
--- a/WebCore/svg/GradientAttributes.h
+++ b/WebCore/svg/GradientAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/LinearGradientAttributes.h b/WebCore/svg/LinearGradientAttributes.h
index 0aefbac..b71dc22 100644
--- a/WebCore/svg/LinearGradientAttributes.h
+++ b/WebCore/svg/LinearGradientAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/PatternAttributes.h b/WebCore/svg/PatternAttributes.h
index b43d87e..36d1765 100644
--- a/WebCore/svg/PatternAttributes.h
+++ b/WebCore/svg/PatternAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/RadialGradientAttributes.h b/WebCore/svg/RadialGradientAttributes.h
index 7645721..76a78ec 100644
--- a/WebCore/svg/RadialGradientAttributes.h
+++ b/WebCore/svg/RadialGradientAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAElement.cpp b/WebCore/svg/SVGAElement.cpp
index 7cb7b3e..d0d3613 100644
--- a/WebCore/svg/SVGAElement.cpp
+++ b/WebCore/svg/SVGAElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAngle.idl b/WebCore/svg/SVGAngle.idl
index fc7c1e1..1a05646 100644
--- a/WebCore/svg/SVGAngle.idl
+++ b/WebCore/svg/SVGAngle.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimateColorElement.cpp b/WebCore/svg/SVGAnimateColorElement.cpp
index 1555f5e..ab48f18 100644
--- a/WebCore/svg/SVGAnimateColorElement.cpp
+++ b/WebCore/svg/SVGAnimateColorElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimateColorElement.h b/WebCore/svg/SVGAnimateColorElement.h
index 595f0a9..9071185 100644
--- a/WebCore/svg/SVGAnimateColorElement.h
+++ b/WebCore/svg/SVGAnimateColorElement.h
@@ -3,8 +3,6 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimateElement.cpp b/WebCore/svg/SVGAnimateElement.cpp
index c2a83c0..31d681b 100644
--- a/WebCore/svg/SVGAnimateElement.cpp
+++ b/WebCore/svg/SVGAnimateElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -64,7 +62,7 @@ static bool parseNumberValueAndUnit(const String& in, double& value, String& uni
         unitLength = 4;
     String newUnit = parse.right(unitLength);
     String number = parse.left(parse.length() - unitLength);
-    if (!unit.isEmpty() && newUnit != unit || number.isEmpty())
+    if ((!unit.isEmpty() && newUnit != unit) || number.isEmpty())
         return false;
     UChar last = number[number.length() - 1];
     if (last < '0' || last > '9')
diff --git a/WebCore/svg/SVGAnimateElement.h b/WebCore/svg/SVGAnimateElement.h
index b90e5c8..ac5883c 100644
--- a/WebCore/svg/SVGAnimateElement.h
+++ b/WebCore/svg/SVGAnimateElement.h
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimateTransformElement.h b/WebCore/svg/SVGAnimateTransformElement.h
index 9b1f192..c9139c4 100644
--- a/WebCore/svg/SVGAnimateTransformElement.h
+++ b/WebCore/svg/SVGAnimateTransformElement.h
@@ -4,8 +4,6 @@
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All Rights Reserved.
     
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedPathData.cpp b/WebCore/svg/SVGAnimatedPathData.cpp
index be75809..0f43f2c 100644
--- a/WebCore/svg/SVGAnimatedPathData.cpp
+++ b/WebCore/svg/SVGAnimatedPathData.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedPathData.h b/WebCore/svg/SVGAnimatedPathData.h
index 88b994b..79bd586 100644
--- a/WebCore/svg/SVGAnimatedPathData.h
+++ b/WebCore/svg/SVGAnimatedPathData.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedPoints.cpp b/WebCore/svg/SVGAnimatedPoints.cpp
index 584f875..57101b3 100644
--- a/WebCore/svg/SVGAnimatedPoints.cpp
+++ b/WebCore/svg/SVGAnimatedPoints.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedPoints.h b/WebCore/svg/SVGAnimatedPoints.h
index 1e61057..9f44e1f 100644
--- a/WebCore/svg/SVGAnimatedPoints.h
+++ b/WebCore/svg/SVGAnimatedPoints.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedTemplate.h b/WebCore/svg/SVGAnimatedTemplate.h
index e7c49c1..d65fe0b 100644
--- a/WebCore/svg/SVGAnimatedTemplate.h
+++ b/WebCore/svg/SVGAnimatedTemplate.h
@@ -172,7 +172,7 @@ namespace WebCore {
         typedef Type* DecoratedType;
 
         static Type null() { return 0; }
-        static AtomicString toString(Type type) { return type ? AtomicString(type->valueAsString()) : nullAtom; }
+        static String toString(Type type) { return type ? type->valueAsString() : String(); }
     };
 
     template<>
@@ -181,7 +181,7 @@ namespace WebCore {
         typedef bool DecoratedType;
 
         static bool null() { return false; }
-        static AtomicString toString(bool type) { return type ? "true" : "false"; }
+        static String toString(bool type) { return type ? "true" : "false"; }
     };
 
     template<>
@@ -190,7 +190,7 @@ namespace WebCore {
         typedef int DecoratedType;
 
         static int null() { return 0; }
-        static AtomicString toString(int type) { return String::number(type); }
+        static String toString(int type) { return String::number(type); }
     };
 
     template<>
@@ -199,7 +199,7 @@ namespace WebCore {
         typedef long DecoratedType;
 
         static long null() { return 0l; }
-        static AtomicString toString(long type) { return String::number(type); }
+        static String toString(long type) { return String::number(type); }
     };
 
     template<>
@@ -208,7 +208,7 @@ namespace WebCore {
         typedef SVGLength DecoratedType;
 
         static SVGLength null() { return SVGLength(); }
-        static AtomicString toString(const SVGLength& type) { return type.valueAsString(); }
+        static String toString(const SVGLength& type) { return type.valueAsString(); }
     };
 
     template<>
@@ -217,7 +217,7 @@ namespace WebCore {
         typedef float DecoratedType;
 
         static float null() { return 0.0f; }
-        static AtomicString toString(float type) { return String::number(type); }
+        static String toString(float type) { return String::number(type); }
     };
 
     template<>
@@ -226,7 +226,7 @@ namespace WebCore {
         typedef FloatRect DecoratedType;
 
         static FloatRect null() { return FloatRect(); }
-        static AtomicString toString(const FloatRect& type) { return String::format("%f %f %f %f", type.x(), type.y(), type.width(), type.height()); }
+        static String toString(const FloatRect& type) { return String::format("%f %f %f %f", type.x(), type.y(), type.width(), type.height()); }
     };
 
     template<>
@@ -235,7 +235,7 @@ namespace WebCore {
         typedef String DecoratedType;
 
         static String null() { return String(); }
-        static AtomicString toString(const String& type) { return type; }
+        static String toString(const String& type) { return type; }
     };
 
     // Common type definitions, to ease IDL generation.
diff --git a/WebCore/svg/SVGAnimationElement.cpp b/WebCore/svg/SVGAnimationElement.cpp
index 67e32e0..ce3670d 100644
--- a/WebCore/svg/SVGAnimationElement.cpp
+++ b/WebCore/svg/SVGAnimationElement.cpp
@@ -5,8 +5,6 @@
     Copyright (C) 2008 Apple Inc. All rights reserved.
     Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -489,7 +487,7 @@ void SVGAnimationElement::startedActiveInterval()
         m_animationValid = m_values.size() > 1
             && (calcMode == CalcModePaced || !hasAttribute(SVGNames::keyTimesAttr) || hasAttribute(SVGNames::keyPointsAttr) || (m_values.size() == m_keyTimes.size()))
             && (calcMode == CalcModeDiscrete || !m_keyTimes.size() || m_keyTimes.last() == 1.0)
-            && (calcMode != CalcModeSpline || (m_keySplines.size() && (m_keySplines.size() == m_values.size() - 1) || m_keySplines.size() == m_keyPoints.size() - 1))
+            && (calcMode != CalcModeSpline || ((m_keySplines.size() && (m_keySplines.size() == m_values.size() - 1)) || m_keySplines.size() == m_keyPoints.size() - 1))
             && (!hasAttribute(SVGNames::keyPointsAttr) || (m_keyTimes.size() > 1 && m_keyTimes.size() == m_keyPoints.size()));
         if (calcMode == CalcModePaced && m_animationValid)
             calculateKeyTimesForCalcModePaced();
diff --git a/WebCore/svg/SVGCircleElement.cpp b/WebCore/svg/SVGCircleElement.cpp
index 2329299..d96842a 100644
--- a/WebCore/svg/SVGCircleElement.cpp
+++ b/WebCore/svg/SVGCircleElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGClipPathElement.cpp b/WebCore/svg/SVGClipPathElement.cpp
index bbeac91..d5df29c 100644
--- a/WebCore/svg/SVGClipPathElement.cpp
+++ b/WebCore/svg/SVGClipPathElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGColor.cpp b/WebCore/svg/SVGColor.cpp
index d819ebf..ede0b0a 100644
--- a/WebCore/svg/SVGColor.cpp
+++ b/WebCore/svg/SVGColor.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGColor.idl b/WebCore/svg/SVGColor.idl
index 320a9b7..43bcb70 100644
--- a/WebCore/svg/SVGColor.idl
+++ b/WebCore/svg/SVGColor.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGComponentTransferFunctionElement.cpp b/WebCore/svg/SVGComponentTransferFunctionElement.cpp
index e479fae..bb08ebb 100644
--- a/WebCore/svg/SVGComponentTransferFunctionElement.cpp
+++ b/WebCore/svg/SVGComponentTransferFunctionElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGComponentTransferFunctionElement.h b/WebCore/svg/SVGComponentTransferFunctionElement.h
index a26c953..c955df5 100644
--- a/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGCursorElement.cpp b/WebCore/svg/SVGCursorElement.cpp
index b282aa3..f5aa615 100644
--- a/WebCore/svg/SVGCursorElement.cpp
+++ b/WebCore/svg/SVGCursorElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDefsElement.cpp b/WebCore/svg/SVGDefsElement.cpp
index c03c09b..051edeb 100644
--- a/WebCore/svg/SVGDefsElement.cpp
+++ b/WebCore/svg/SVGDefsElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDescElement.cpp b/WebCore/svg/SVGDescElement.cpp
index 0297ad2..319dfda 100644
--- a/WebCore/svg/SVGDescElement.cpp
+++ b/WebCore/svg/SVGDescElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDescElement.h b/WebCore/svg/SVGDescElement.h
index c8bc501..846a23e 100644
--- a/WebCore/svg/SVGDescElement.h
+++ b/WebCore/svg/SVGDescElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDocument.idl b/WebCore/svg/SVGDocument.idl
index 61f4e2e..26b70d1 100644
--- a/WebCore/svg/SVGDocument.idl
+++ b/WebCore/svg/SVGDocument.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDocumentExtensions.cpp b/WebCore/svg/SVGDocumentExtensions.cpp
index 61645f4..b2492b4 100644
--- a/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/WebCore/svg/SVGDocumentExtensions.cpp
@@ -34,6 +34,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "Page.h"
+#include "SVGSMILElement.h"
 #include "SVGSVGElement.h"
 #include "SMILTimeContainer.h"
 #include "XMLTokenizer.h"
@@ -86,6 +87,17 @@ void SVGDocumentExtensions::unpauseAnimations()
         (*itr)->unpauseAnimations();
 }
 
+bool SVGDocumentExtensions::sampleAnimationAtTime(const String& elementId, SVGSMILElement* element, double time)
+{
+    ASSERT(element);
+    SMILTimeContainer* container = element->timeContainer();
+    if (!container || container->isPaused())
+        return false;
+
+    container->sampleAnimationAtTime(elementId, time);
+    return true;
+}
+
 void SVGDocumentExtensions::reportWarning(const String& message)
 {
     if (Frame* frame = m_doc->frame())
diff --git a/WebCore/svg/SVGDocumentExtensions.h b/WebCore/svg/SVGDocumentExtensions.h
index cd20a30..b66e2dc 100644
--- a/WebCore/svg/SVGDocumentExtensions.h
+++ b/WebCore/svg/SVGDocumentExtensions.h
@@ -41,9 +41,10 @@ class Node;
 class String;
 class SVGElementInstance;
 class SVGStyledElement;
+class SVGSMILElement;
 class SVGSVGElement;
 
-class SVGDocumentExtensions {
+class SVGDocumentExtensions : public Noncopyable {
 public:
     SVGDocumentExtensions(Document*);
     ~SVGDocumentExtensions();
@@ -54,6 +55,7 @@ public:
     void startAnimations();
     void pauseAnimations();
     void unpauseAnimations();
+    bool sampleAnimationAtTime(const String& elementId, SVGSMILElement*, double time);
 
     void reportWarning(const String&);
     void reportError(const String&);
diff --git a/WebCore/svg/SVGElement.idl b/WebCore/svg/SVGElement.idl
index e4112c1..27fcb8d 100644
--- a/WebCore/svg/SVGElement.idl
+++ b/WebCore/svg/SVGElement.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGElementInstanceList.cpp b/WebCore/svg/SVGElementInstanceList.cpp
index f039d44..9404734 100644
--- a/WebCore/svg/SVGElementInstanceList.cpp
+++ b/WebCore/svg/SVGElementInstanceList.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGElementInstanceList.h b/WebCore/svg/SVGElementInstanceList.h
index ef4c73c..9da4cdc 100644
--- a/WebCore/svg/SVGElementInstanceList.h
+++ b/WebCore/svg/SVGElementInstanceList.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGEllipseElement.cpp b/WebCore/svg/SVGEllipseElement.cpp
index 4c67ff3..3946fb9 100644
--- a/WebCore/svg/SVGEllipseElement.cpp
+++ b/WebCore/svg/SVGEllipseElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGExternalResourcesRequired.cpp b/WebCore/svg/SVGExternalResourcesRequired.cpp
index 201ecbf..b6b62d1 100644
--- a/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEBlendElement.cpp b/WebCore/svg/SVGFEBlendElement.cpp
index 0497ea9..03c5795 100644
--- a/WebCore/svg/SVGFEBlendElement.cpp
+++ b/WebCore/svg/SVGFEBlendElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEBlendElement.h b/WebCore/svg/SVGFEBlendElement.h
index bed649f..c32eabd 100644
--- a/WebCore/svg/SVGFEBlendElement.h
+++ b/WebCore/svg/SVGFEBlendElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEColorMatrixElement.cpp b/WebCore/svg/SVGFEColorMatrixElement.cpp
index c2d605b..88a0d66 100644
--- a/WebCore/svg/SVGFEColorMatrixElement.cpp
+++ b/WebCore/svg/SVGFEColorMatrixElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEColorMatrixElement.h b/WebCore/svg/SVGFEColorMatrixElement.h
index 5b7a9ae..f3329e4 100644
--- a/WebCore/svg/SVGFEColorMatrixElement.h
+++ b/WebCore/svg/SVGFEColorMatrixElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEComponentTransferElement.cpp b/WebCore/svg/SVGFEComponentTransferElement.cpp
index 691d5cd..f1df08c 100644
--- a/WebCore/svg/SVGFEComponentTransferElement.cpp
+++ b/WebCore/svg/SVGFEComponentTransferElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEComponentTransferElement.h b/WebCore/svg/SVGFEComponentTransferElement.h
index 21c95d2..46d6d9d 100644
--- a/WebCore/svg/SVGFEComponentTransferElement.h
+++ b/WebCore/svg/SVGFEComponentTransferElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFECompositeElement.cpp b/WebCore/svg/SVGFECompositeElement.cpp
index 6eec6ea..a2dd05a 100644
--- a/WebCore/svg/SVGFECompositeElement.cpp
+++ b/WebCore/svg/SVGFECompositeElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFECompositeElement.h b/WebCore/svg/SVGFECompositeElement.h
index fc97169..1bb6b05 100644
--- a/WebCore/svg/SVGFECompositeElement.h
+++ b/WebCore/svg/SVGFECompositeElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEDiffuseLightingElement.cpp b/WebCore/svg/SVGFEDiffuseLightingElement.cpp
index edbd852..ed6e353 100644
--- a/WebCore/svg/SVGFEDiffuseLightingElement.cpp
+++ b/WebCore/svg/SVGFEDiffuseLightingElement.cpp
@@ -88,20 +88,18 @@ bool SVGFEDiffuseLightingElement::build(SVGResourceFilter* filterResource)
     return true;
 }
 
-LightSource* SVGFEDiffuseLightingElement::findLights() const
+PassRefPtr<LightSource> SVGFEDiffuseLightingElement::findLights() const
 {
-    LightSource* light = 0;
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feDistantLightTag) ||
             n->hasTagName(SVGNames::fePointLightTag) ||
             n->hasTagName(SVGNames::feSpotLightTag)) {
             SVGFELightElement* lightNode = static_cast<SVGFELightElement*>(n); 
-            light = lightNode->lightSource();
-            break;
+            return lightNode->lightSource();
         }
     }
 
-    return light;
+    return 0;
 }
 
 }
diff --git a/WebCore/svg/SVGFEDiffuseLightingElement.h b/WebCore/svg/SVGFEDiffuseLightingElement.h
index fcb5eee..ed117a4 100644
--- a/WebCore/svg/SVGFEDiffuseLightingElement.h
+++ b/WebCore/svg/SVGFEDiffuseLightingElement.h
@@ -49,7 +49,7 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
 
-        LightSource* findLights() const;
+        PassRefPtr<LightSource> findLights() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEDistantLightElement.cpp b/WebCore/svg/SVGFEDistantLightElement.cpp
index 35c487b..8322a3a 100644
--- a/WebCore/svg/SVGFEDistantLightElement.cpp
+++ b/WebCore/svg/SVGFEDistantLightElement.cpp
@@ -34,9 +34,9 @@ SVGFEDistantLightElement::~SVGFEDistantLightElement()
 {
 }
 
-LightSource* SVGFEDistantLightElement::lightSource() const
+PassRefPtr<LightSource> SVGFEDistantLightElement::lightSource() const
 {
-    return new DistantLightSource(azimuth(), elevation());
+    return DistantLightSource::create(azimuth(), elevation());
 }
 
 }
diff --git a/WebCore/svg/SVGFEDistantLightElement.h b/WebCore/svg/SVGFEDistantLightElement.h
index 95f45c8..3d0c039 100644
--- a/WebCore/svg/SVGFEDistantLightElement.h
+++ b/WebCore/svg/SVGFEDistantLightElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
         SVGFEDistantLightElement(const QualifiedName&, Document*);
         virtual ~SVGFEDistantLightElement();
 
-        virtual LightSource* lightSource() const;
+        virtual PassRefPtr<LightSource> lightSource() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEFloodElement.cpp b/WebCore/svg/SVGFEFloodElement.cpp
index 3d80799..d69c240 100644
--- a/WebCore/svg/SVGFEFloodElement.cpp
+++ b/WebCore/svg/SVGFEFloodElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFloodElement.h b/WebCore/svg/SVGFEFloodElement.h
index e83fc94..b8b49e7 100644
--- a/WebCore/svg/SVGFEFloodElement.h
+++ b/WebCore/svg/SVGFEFloodElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncAElement.cpp b/WebCore/svg/SVGFEFuncAElement.cpp
index 41118fe..a02b0e5 100644
--- a/WebCore/svg/SVGFEFuncAElement.cpp
+++ b/WebCore/svg/SVGFEFuncAElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncAElement.h b/WebCore/svg/SVGFEFuncAElement.h
index 8ec6b1c..55a3c9d 100644
--- a/WebCore/svg/SVGFEFuncAElement.h
+++ b/WebCore/svg/SVGFEFuncAElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncBElement.cpp b/WebCore/svg/SVGFEFuncBElement.cpp
index 190b23a..2bf939b 100644
--- a/WebCore/svg/SVGFEFuncBElement.cpp
+++ b/WebCore/svg/SVGFEFuncBElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncBElement.h b/WebCore/svg/SVGFEFuncBElement.h
index 5d86f87..177ed26 100644
--- a/WebCore/svg/SVGFEFuncBElement.h
+++ b/WebCore/svg/SVGFEFuncBElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncGElement.cpp b/WebCore/svg/SVGFEFuncGElement.cpp
index d5e5625..e0d60f4 100644
--- a/WebCore/svg/SVGFEFuncGElement.cpp
+++ b/WebCore/svg/SVGFEFuncGElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncGElement.h b/WebCore/svg/SVGFEFuncGElement.h
index 9f5d3d7..4eeafa0 100644
--- a/WebCore/svg/SVGFEFuncGElement.h
+++ b/WebCore/svg/SVGFEFuncGElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncRElement.cpp b/WebCore/svg/SVGFEFuncRElement.cpp
index e3d7ee4..e8e6b99 100644
--- a/WebCore/svg/SVGFEFuncRElement.cpp
+++ b/WebCore/svg/SVGFEFuncRElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncRElement.h b/WebCore/svg/SVGFEFuncRElement.h
index 0a0d115..196cfa3 100644
--- a/WebCore/svg/SVGFEFuncRElement.h
+++ b/WebCore/svg/SVGFEFuncRElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.cpp b/WebCore/svg/SVGFEGaussianBlurElement.cpp
index 4cddb5a..b2970b3 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.cpp
+++ b/WebCore/svg/SVGFEGaussianBlurElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.h b/WebCore/svg/SVGFEGaussianBlurElement.h
index c9bb613..9a5c058 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEImageElement.cpp b/WebCore/svg/SVGFEImageElement.cpp
index 269d6b2..52531ee 100644
--- a/WebCore/svg/SVGFEImageElement.cpp
+++ b/WebCore/svg/SVGFEImageElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFELightElement.h b/WebCore/svg/SVGFELightElement.h
index 92947a1..705eeaa 100644
--- a/WebCore/svg/SVGFELightElement.h
+++ b/WebCore/svg/SVGFELightElement.h
@@ -36,7 +36,7 @@ namespace WebCore {
         SVGFELightElement(const QualifiedName&, Document*);
         virtual ~SVGFELightElement();
         
-        virtual LightSource* lightSource() const = 0;
+        virtual PassRefPtr<LightSource> lightSource() const = 0;
         virtual void parseMappedAttribute(MappedAttribute*);
 
     private:
diff --git a/WebCore/svg/SVGFEMergeElement.cpp b/WebCore/svg/SVGFEMergeElement.cpp
index 8f4eed9..6c703ca 100644
--- a/WebCore/svg/SVGFEMergeElement.cpp
+++ b/WebCore/svg/SVGFEMergeElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEMergeElement.h b/WebCore/svg/SVGFEMergeElement.h
index e63ed04..f84ddce 100644
--- a/WebCore/svg/SVGFEMergeElement.h
+++ b/WebCore/svg/SVGFEMergeElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEMergeNodeElement.cpp b/WebCore/svg/SVGFEMergeNodeElement.cpp
index ae08706..4161de8 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.cpp
+++ b/WebCore/svg/SVGFEMergeNodeElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEOffsetElement.cpp b/WebCore/svg/SVGFEOffsetElement.cpp
index 945a9da..95cbc8d 100644
--- a/WebCore/svg/SVGFEOffsetElement.cpp
+++ b/WebCore/svg/SVGFEOffsetElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEOffsetElement.h b/WebCore/svg/SVGFEOffsetElement.h
index 1471abe..ae07ed8 100644
--- a/WebCore/svg/SVGFEOffsetElement.h
+++ b/WebCore/svg/SVGFEOffsetElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEPointLightElement.cpp b/WebCore/svg/SVGFEPointLightElement.cpp
index 088f878..36ed2e9 100644
--- a/WebCore/svg/SVGFEPointLightElement.cpp
+++ b/WebCore/svg/SVGFEPointLightElement.cpp
@@ -34,10 +34,10 @@ SVGFEPointLightElement::~SVGFEPointLightElement()
 {
 }
 
-LightSource* SVGFEPointLightElement::lightSource() const
+PassRefPtr<LightSource> SVGFEPointLightElement::lightSource() const
 {
     FloatPoint3D pos(x(), y(), z());
-    return new PointLightSource(pos);
+    return PointLightSource::create(pos);
 }
 
 }
diff --git a/WebCore/svg/SVGFEPointLightElement.h b/WebCore/svg/SVGFEPointLightElement.h
index b39fffa..9b1f997 100644
--- a/WebCore/svg/SVGFEPointLightElement.h
+++ b/WebCore/svg/SVGFEPointLightElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
         SVGFEPointLightElement(const QualifiedName&, Document*);
         virtual ~SVGFEPointLightElement();
 
-        virtual LightSource* lightSource() const;
+        virtual PassRefPtr<LightSource> lightSource() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFESpecularLightingElement.cpp b/WebCore/svg/SVGFESpecularLightingElement.cpp
index 7afa4cc..90e9cb3 100644
--- a/WebCore/svg/SVGFESpecularLightingElement.cpp
+++ b/WebCore/svg/SVGFESpecularLightingElement.cpp
@@ -70,20 +70,18 @@ void SVGFESpecularLightingElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-LightSource* SVGFESpecularLightingElement::findLights() const
+PassRefPtr<LightSource> SVGFESpecularLightingElement::findLights() const
 {
-    LightSource* light = 0;
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feDistantLightTag) ||
             n->hasTagName(SVGNames::fePointLightTag) ||
             n->hasTagName(SVGNames::feSpotLightTag)) {
             SVGFELightElement* lightNode = static_cast<SVGFELightElement*>(n); 
-            light = lightNode->lightSource();
-            break;
+            return lightNode->lightSource();
         }
     }
 
-    return light;
+    return 0;
 }
 
 bool SVGFESpecularLightingElement::build(SVGResourceFilter* filterResource)
diff --git a/WebCore/svg/SVGFESpecularLightingElement.h b/WebCore/svg/SVGFESpecularLightingElement.h
index 8ef490a..b3771fe 100644
--- a/WebCore/svg/SVGFESpecularLightingElement.h
+++ b/WebCore/svg/SVGFESpecularLightingElement.h
@@ -48,8 +48,8 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::surfaceScaleAttrString, float, SurfaceScale, surfaceScale)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
-        
-        LightSource* findLights() const;
+
+        PassRefPtr<LightSource> findLights() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFESpotLightElement.cpp b/WebCore/svg/SVGFESpotLightElement.cpp
index 980a3bb..01fe54e 100644
--- a/WebCore/svg/SVGFESpotLightElement.cpp
+++ b/WebCore/svg/SVGFESpotLightElement.cpp
@@ -34,7 +34,7 @@ SVGFESpotLightElement::~SVGFESpotLightElement()
 {
 }
 
-LightSource* SVGFESpotLightElement::lightSource() const
+PassRefPtr<LightSource> SVGFESpotLightElement::lightSource() const
 {
     FloatPoint3D pos(x(), y(), z());
 
@@ -44,7 +44,7 @@ LightSource* SVGFESpotLightElement::lightSource() const
                            pointsAtZ() - pos.z());
 
     direction.normalize();
-    return new SpotLightSource(pos, direction, specularExponent(), limitingConeAngle());
+    return SpotLightSource::create(pos, direction, specularExponent(), limitingConeAngle());
 }
 
 }
diff --git a/WebCore/svg/SVGFESpotLightElement.h b/WebCore/svg/SVGFESpotLightElement.h
index 440c664..d54e232 100644
--- a/WebCore/svg/SVGFESpotLightElement.h
+++ b/WebCore/svg/SVGFESpotLightElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
         SVGFESpotLightElement(const QualifiedName&, Document*);
         virtual ~SVGFESpotLightElement();
 
-        virtual LightSource* lightSource() const;
+        virtual PassRefPtr<LightSource> lightSource() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFETileElement.cpp b/WebCore/svg/SVGFETileElement.cpp
index 14af25f..8894d4b 100644
--- a/WebCore/svg/SVGFETileElement.cpp
+++ b/WebCore/svg/SVGFETileElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFETileElement.h b/WebCore/svg/SVGFETileElement.h
index b4fc0c5..142a797 100644
--- a/WebCore/svg/SVGFETileElement.h
+++ b/WebCore/svg/SVGFETileElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFETurbulenceElement.cpp b/WebCore/svg/SVGFETurbulenceElement.cpp
index b296e00..57114a3 100644
--- a/WebCore/svg/SVGFETurbulenceElement.cpp
+++ b/WebCore/svg/SVGFETurbulenceElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFETurbulenceElement.h b/WebCore/svg/SVGFETurbulenceElement.h
index 3c95da8..f024f57 100644
--- a/WebCore/svg/SVGFETurbulenceElement.h
+++ b/WebCore/svg/SVGFETurbulenceElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFilterElement.cpp b/WebCore/svg/SVGFilterElement.cpp
index db46179..bb14448 100644
--- a/WebCore/svg/SVGFilterElement.cpp
+++ b/WebCore/svg/SVGFilterElement.cpp
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -28,12 +26,14 @@
 #include "SVGFilterElement.h"
 
 #include "Attr.h"
-#include "SVGFilterBuilder.h"
+#include "FloatSize.h"
 #include "MappedAttribute.h"
 #include "PlatformString.h"
+#include "SVGFilterBuilder.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
+#include "SVGParserUtilities.h"
 #include "SVGResourceFilter.h"
 #include "SVGUnitTypes.h"
 
@@ -91,7 +91,13 @@ void SVGFilterElement::parseMappedAttribute(MappedAttribute* attr)
         setWidthBaseValue(SVGLength(LengthModeWidth, value));
     else if (attr->name() == SVGNames::heightAttr)
         setHeightBaseValue(SVGLength(LengthModeHeight, value));
-    else {
+    else if (attr->name() == SVGNames::filterResAttr) {
+        float x, y;
+        if (parseNumberOptionalNumber(value, x, y)) {
+            setFilterResXBaseValue(x);
+            setFilterResYBaseValue(y);
+        }
+    } else {
         if (SVGURIReference::parseMappedAttribute(attr))
             return;
         if (SVGLangSpace::parseMappedAttribute(attr))
@@ -132,6 +138,11 @@ void SVGFilterElement::buildFilter(const FloatRect& targetRect) const
     m_filter->setEffectBoundingBoxMode(primitiveBBoxMode);
     m_filter->setFilterBoundingBoxMode(filterBBoxMode);
 
+    if (hasAttribute(SVGNames::filterResAttr)) {
+        m_filter->setHasFilterResolution(true);
+        m_filter->setFilterResolution(FloatSize(filterResX(), filterResY()));
+    }
+
     // Add effects to the filter
     m_filter->builder()->clearEffects();
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
diff --git a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index 67c8bff..08559b4 100644
--- a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -97,7 +97,7 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilt
                                width().value(this),
                                height().value(this));
 
-    filterEffect->setSubRegion(effectBBox);
+    filterEffect->setEffectBoundaries(effectBBox);
 }
 
 }
diff --git a/WebCore/svg/SVGFontData.h b/WebCore/svg/SVGFontData.h
index 4df3db2..3f17e3e 100644
--- a/WebCore/svg/SVGFontData.h
+++ b/WebCore/svg/SVGFontData.h
@@ -26,7 +26,7 @@
 
 namespace WebCore {
 
-class SVGFontData {
+class SVGFontData : public Noncopyable {
 public:
     SVGFontData(SVGFontFaceElement*);
     virtual ~SVGFontData();
diff --git a/WebCore/svg/SVGGElement.cpp b/WebCore/svg/SVGGElement.cpp
index 241f264..ef46af4 100644
--- a/WebCore/svg/SVGGElement.cpp
+++ b/WebCore/svg/SVGGElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGGradientElement.cpp b/WebCore/svg/SVGGradientElement.cpp
index 93e2cb4..b4fe21d 100644
--- a/WebCore/svg/SVGGradientElement.cpp
+++ b/WebCore/svg/SVGGradientElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGHKernElement.idl b/WebCore/svg/SVGHKernElement.idl
index 1971aef..7706578 100644
--- a/WebCore/svg/SVGHKernElement.idl
+++ b/WebCore/svg/SVGHKernElement.idl
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2008 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLangSpace.cpp b/WebCore/svg/SVGLangSpace.cpp
index d49e09a..f0d6997 100644
--- a/WebCore/svg/SVGLangSpace.cpp
+++ b/WebCore/svg/SVGLangSpace.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLangSpace.h b/WebCore/svg/SVGLangSpace.h
index df8606e..1613998 100644
--- a/WebCore/svg/SVGLangSpace.h
+++ b/WebCore/svg/SVGLangSpace.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLength.cpp b/WebCore/svg/SVGLength.cpp
index ca3bac3..2884507 100644
--- a/WebCore/svg/SVGLength.cpp
+++ b/WebCore/svg/SVGLength.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
                   2007 Apple Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLength.h b/WebCore/svg/SVGLength.h
index 7846b4a..a14bc68 100644
--- a/WebCore/svg/SVGLength.h
+++ b/WebCore/svg/SVGLength.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLength.idl b/WebCore/svg/SVGLength.idl
index 20748b1..3938a2c 100644
--- a/WebCore/svg/SVGLength.idl
+++ b/WebCore/svg/SVGLength.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLengthList.cpp b/WebCore/svg/SVGLengthList.cpp
index 20b61d6..367befb 100644
--- a/WebCore/svg/SVGLengthList.cpp
+++ b/WebCore/svg/SVGLengthList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLengthList.h b/WebCore/svg/SVGLengthList.h
index e83fee8..00fc3f8 100644
--- a/WebCore/svg/SVGLengthList.h
+++ b/WebCore/svg/SVGLengthList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLineElement.cpp b/WebCore/svg/SVGLineElement.cpp
index 4f7b7e5..a359698 100644
--- a/WebCore/svg/SVGLineElement.cpp
+++ b/WebCore/svg/SVGLineElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLinearGradientElement.h b/WebCore/svg/SVGLinearGradientElement.h
index 0e1efd4..492c366 100644
--- a/WebCore/svg/SVGLinearGradientElement.h
+++ b/WebCore/svg/SVGLinearGradientElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGList.h b/WebCore/svg/SVGList.h
index c04c200..8fb3bc1 100644
--- a/WebCore/svg/SVGList.h
+++ b/WebCore/svg/SVGList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -41,6 +39,10 @@ namespace WebCore {
         {
             return SVGListTraits<UsesDefaultInitializer<Item>::value, Item>::nullItem();
         }
+        static bool isNull(const Item& it)
+        {
+            return SVGListTraits<UsesDefaultInitializer<Item>::value, Item>::isNull(it);
+        }
     };
 
     template<typename Item>
@@ -58,6 +60,10 @@ namespace WebCore {
 
         Item initialize(Item newItem, ExceptionCode& ec)
         {
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
             clear(ec);
             return appendItem(newItem, ec);
         }
@@ -94,8 +100,13 @@ namespace WebCore {
             return m_vector[index];
         }
 
-        Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode&)
+        Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode& ec)
         {
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
+
             if (index < m_vector.size()) {
                 m_vector.insert(index, newItem);
             } else {
@@ -110,6 +121,11 @@ namespace WebCore {
                 ec = INDEX_SIZE_ERR;
                 return TypeOperations::nullItem();
             }
+    
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
 
             m_vector[index] = newItem;
             return newItem;
@@ -127,8 +143,13 @@ namespace WebCore {
             return item;
         }
 
-        Item appendItem(Item newItem, ExceptionCode&)
+        Item appendItem(Item newItem, ExceptionCode& ec)
         {
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
+
             m_vector.append(newItem);
             return newItem;
         }
diff --git a/WebCore/svg/SVGListTraits.h b/WebCore/svg/SVGListTraits.h
index d96bc67..f58b9b9 100644
--- a/WebCore/svg/SVGListTraits.h
+++ b/WebCore/svg/SVGListTraits.h
@@ -2,8 +2,6 @@
     Copyright (C) 2006 Nikolas Zimmermann <wildfox@kde.org>
                   2006 Apple Computer Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,24 +23,48 @@
 
 #if ENABLE(SVG)
 
+#include <wtf/RefPtr.h>
+
 namespace WebCore {
 
     template<typename Item> struct UsesDefaultInitializer { static const bool value = true; };
     template<> struct UsesDefaultInitializer<double>      { static const bool value = false; };
+    template<> struct UsesDefaultInitializer<float>       { static const bool value = false; };
 
     template<bool usesDefaultInitializer, typename Item>
     struct SVGListTraits { };
 
+    template<typename ItemPtr>
+    struct SVGListTraits<true, ItemPtr*> {
+        static ItemPtr* nullItem() { return 0; }
+        static bool isNull(ItemPtr* it) { return !it; }
+    };
+    
+    template<typename ItemPtr>
+    struct SVGListTraits<true, RefPtr<ItemPtr> > {
+        static RefPtr<ItemPtr> nullItem() { return 0; }
+        static bool isNull(const RefPtr<ItemPtr>& it) { return !it; }
+    };
+    
     template<typename Item>
     struct SVGListTraits<true, Item> {
-        static Item nullItem() { return Item(); } 
+        static Item nullItem() { return Item(); }
+        static bool isNull(Item it) { return !it; }
     };
 
     template<>
     struct SVGListTraits<false, double> {
         static double nullItem() { return 0.0; }
+        static bool isNull(double) { return false; }
     };
 
+    template<>
+    struct SVGListTraits<false, float> {
+        static float nullItem() { return 0; }
+        static bool isNull(float) { return false; }
+    };
+
+
 } // namespace WebCore
 
 #endif // SVG_SUPPORT
diff --git a/WebCore/svg/SVGLocatable.h b/WebCore/svg/SVGLocatable.h
index ccb9072..180dae5 100644
--- a/WebCore/svg/SVGLocatable.h
+++ b/WebCore/svg/SVGLocatable.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGMaskElement.cpp b/WebCore/svg/SVGMaskElement.cpp
index 127f6f4..e131d34 100644
--- a/WebCore/svg/SVGMaskElement.cpp
+++ b/WebCore/svg/SVGMaskElement.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
                   2005 Alexander Kellett <lypanov@kde.org>
-
-    This file is part of the KDE project
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -158,11 +157,14 @@ PassOwnPtr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targe
         return 0;
 
     FloatPoint maskContextLocation = maskDestRect.location();
-    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
         maskDestRect.move(targetRect.x(), targetRect.y());
-
-    if (maskContentUnits() != SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-        maskContextLocation.move(targetRect.x(), targetRect.y());
+        if (maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
+            maskContextLocation.move(targetRect.x(), targetRect.y());
+    } else {
+        if (maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+            maskContextLocation.move(-targetRect.x(), -targetRect.y());
+    }
 
     GraphicsContext* maskImageContext = maskImage->context();
     ASSERT(maskImageContext);
diff --git a/WebCore/svg/SVGMatrix.idl b/WebCore/svg/SVGMatrix.idl
index cb8c08b..d064aa9 100644
--- a/WebCore/svg/SVGMatrix.idl
+++ b/WebCore/svg/SVGMatrix.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -34,7 +32,7 @@ module svg {
         attribute double e;
         attribute double f;
 
-        [Immutable] SVGMatrix multiply(in SVGMatrix secondMatrix);
+        [Custom] SVGMatrix multiply(in SVGMatrix secondMatrix);
         [Custom] SVGMatrix inverse()
             raises(SVGException);
         [Immutable] SVGMatrix translate(in float x, in float y);
diff --git a/WebCore/svg/SVGMetadataElement.cpp b/WebCore/svg/SVGMetadataElement.cpp
index a18f73a..2cefc7d 100644
--- a/WebCore/svg/SVGMetadataElement.cpp
+++ b/WebCore/svg/SVGMetadataElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGMetadataElement.h b/WebCore/svg/SVGMetadataElement.h
index 63d0aae..afa6a8e 100644
--- a/WebCore/svg/SVGMetadataElement.h
+++ b/WebCore/svg/SVGMetadataElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGMetadataElement.idl b/WebCore/svg/SVGMetadataElement.idl
index ce65b5e..9434f4d 100644
--- a/WebCore/svg/SVGMetadataElement.idl
+++ b/WebCore/svg/SVGMetadataElement.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGNumber.idl b/WebCore/svg/SVGNumber.idl
index 7e4c8bd..7e1a117 100644
--- a/WebCore/svg/SVGNumber.idl
+++ b/WebCore/svg/SVGNumber.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGNumberList.cpp b/WebCore/svg/SVGNumberList.cpp
index 4e904f4..c73e397 100644
--- a/WebCore/svg/SVGNumberList.cpp
+++ b/WebCore/svg/SVGNumberList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGNumberList.h b/WebCore/svg/SVGNumberList.h
index 6cd43ff..29de27e 100644
--- a/WebCore/svg/SVGNumberList.h
+++ b/WebCore/svg/SVGNumberList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPaint.cpp b/WebCore/svg/SVGPaint.cpp
index 45abe69..3b39b91 100644
--- a/WebCore/svg/SVGPaint.cpp
+++ b/WebCore/svg/SVGPaint.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathElement.cpp b/WebCore/svg/SVGPathElement.cpp
index 7079929..d53fbb2 100644
--- a/WebCore/svg/SVGPathElement.cpp
+++ b/WebCore/svg/SVGPathElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -71,9 +69,9 @@ FloatPoint SVGPathElement::getPointAtLength(float length)
     return toPathData().pointAtLength(length, ok);
 }
 
-unsigned long SVGPathElement::getPathSegAtLength(float length)
+unsigned long SVGPathElement::getPathSegAtLength(float length, ExceptionCode& ec)
 {
-    return pathSegList()->getPathSegAtLength(length);
+    return pathSegList()->getPathSegAtLength(length, ec);
 }
 
 PassRefPtr<SVGPathSegClosePath> SVGPathElement::createSVGPathSegClosePath()
diff --git a/WebCore/svg/SVGPathElement.h b/WebCore/svg/SVGPathElement.h
index 7ea010b..266bfdd 100644
--- a/WebCore/svg/SVGPathElement.h
+++ b/WebCore/svg/SVGPathElement.h
@@ -62,7 +62,7 @@ namespace WebCore {
         virtual bool isValid() const { return SVGTests::isValid(); }
         float getTotalLength();
         FloatPoint getPointAtLength(float distance);
-        unsigned long getPathSegAtLength(float distance);
+        unsigned long getPathSegAtLength(float distance, ExceptionCode&);
 
         static PassRefPtr<SVGPathSegClosePath> createSVGPathSegClosePath();
         static PassRefPtr<SVGPathSegMovetoAbs> createSVGPathSegMovetoAbs(float x, float y);
diff --git a/WebCore/svg/SVGPathElement.idl b/WebCore/svg/SVGPathElement.idl
index d66df1d..9a389c8 100644
--- a/WebCore/svg/SVGPathElement.idl
+++ b/WebCore/svg/SVGPathElement.idl
@@ -37,7 +37,8 @@ module svg {
 
         float getTotalLength();
         SVGPoint getPointAtLength(in float distance);
-        unsigned long getPathSegAtLength(in float distance);
+        unsigned long getPathSegAtLength(in float distance)
+            raises(DOMException, SVGException);
 
         SVGPathSegClosePath createSVGPathSegClosePath();
 
diff --git a/WebCore/svg/SVGPathSeg.h b/WebCore/svg/SVGPathSeg.h
index 84de92f..b88806c 100644
--- a/WebCore/svg/SVGPathSeg.h
+++ b/WebCore/svg/SVGPathSeg.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegArc.cpp b/WebCore/svg/SVGPathSegArc.cpp
index a54f057..5fb0243 100644
--- a/WebCore/svg/SVGPathSegArc.cpp
+++ b/WebCore/svg/SVGPathSegArc.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegArc.h b/WebCore/svg/SVGPathSegArc.h
index 8611e8a..e1cbeb1 100644
--- a/WebCore/svg/SVGPathSegArc.h
+++ b/WebCore/svg/SVGPathSegArc.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegClosePath.cpp b/WebCore/svg/SVGPathSegClosePath.cpp
index 04b711c..1f58096 100644
--- a/WebCore/svg/SVGPathSegClosePath.cpp
+++ b/WebCore/svg/SVGPathSegClosePath.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegClosePath.h b/WebCore/svg/SVGPathSegClosePath.h
index 190af9e..0e29bb3 100644
--- a/WebCore/svg/SVGPathSegClosePath.h
+++ b/WebCore/svg/SVGPathSegClosePath.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoCubic.cpp b/WebCore/svg/SVGPathSegCurvetoCubic.cpp
index 14359de..6b87f55 100644
--- a/WebCore/svg/SVGPathSegCurvetoCubic.cpp
+++ b/WebCore/svg/SVGPathSegCurvetoCubic.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoCubic.h b/WebCore/svg/SVGPathSegCurvetoCubic.h
index 68e3311..125b3a3 100644
--- a/WebCore/svg/SVGPathSegCurvetoCubic.h
+++ b/WebCore/svg/SVGPathSegCurvetoCubic.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp b/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp
index 26babdb..97b256b 100644
--- a/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp
+++ b/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h b/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
index 816ba0f..db71dac 100644
--- a/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
+++ b/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp b/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp
index 8594fde..f3de513 100644
--- a/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp
+++ b/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoQuadratic.h b/WebCore/svg/SVGPathSegCurvetoQuadratic.h
index 1625f13..eb8b0d5 100644
--- a/WebCore/svg/SVGPathSegCurvetoQuadratic.h
+++ b/WebCore/svg/SVGPathSegCurvetoQuadratic.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp b/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp
index 3377709..a64cbb6 100644
--- a/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp
+++ b/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h b/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h
index 3017689..00eeec7 100644
--- a/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h
+++ b/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLineto.cpp b/WebCore/svg/SVGPathSegLineto.cpp
index ac3a8bd..9ad300e 100644
--- a/WebCore/svg/SVGPathSegLineto.cpp
+++ b/WebCore/svg/SVGPathSegLineto.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLineto.h b/WebCore/svg/SVGPathSegLineto.h
index 1818ad2..500d5e4 100644
--- a/WebCore/svg/SVGPathSegLineto.h
+++ b/WebCore/svg/SVGPathSegLineto.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLinetoHorizontal.cpp b/WebCore/svg/SVGPathSegLinetoHorizontal.cpp
index 3de2cc7..f217919 100644
--- a/WebCore/svg/SVGPathSegLinetoHorizontal.cpp
+++ b/WebCore/svg/SVGPathSegLinetoHorizontal.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLinetoHorizontal.h b/WebCore/svg/SVGPathSegLinetoHorizontal.h
index 84965a5..87d6475 100644
--- a/WebCore/svg/SVGPathSegLinetoHorizontal.h
+++ b/WebCore/svg/SVGPathSegLinetoHorizontal.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLinetoVertical.cpp b/WebCore/svg/SVGPathSegLinetoVertical.cpp
index 4f667ee..341ab02 100644
--- a/WebCore/svg/SVGPathSegLinetoVertical.cpp
+++ b/WebCore/svg/SVGPathSegLinetoVertical.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLinetoVertical.h b/WebCore/svg/SVGPathSegLinetoVertical.h
index 8d4ba29..844f2f2 100644
--- a/WebCore/svg/SVGPathSegLinetoVertical.h
+++ b/WebCore/svg/SVGPathSegLinetoVertical.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegList.cpp b/WebCore/svg/SVGPathSegList.cpp
index 8d6fdef..11cad14 100644
--- a/WebCore/svg/SVGPathSegList.cpp
+++ b/WebCore/svg/SVGPathSegList.cpp
@@ -51,15 +51,16 @@ SVGPathSegList::~SVGPathSegList()
 {
 }
 
-unsigned SVGPathSegList::getPathSegAtLength(double)
+unsigned SVGPathSegList::getPathSegAtLength(double, ExceptionCode& ec)
 {
     // FIXME : to be useful this will need to support non-normalized SVGPathSegLists
-    ExceptionCode ec = 0;
     int len = numberOfItems();
     // FIXME: Eventually this will likely move to a "path applier"-like model, until then PathTraversalState is less useful as we could just use locals
     PathTraversalState traversalState(PathTraversalState::TraversalSegmentAtLength);
     for (int i = 0; i < len; ++i) {
         SVGPathSeg* segment = getItem(i, ec).get();
+        if (ec)
+            return 0;
         float segmentLength = 0;
         switch (segment->pathSegType()) {
         case SVGPathSeg::PATHSEG_MOVETO_ABS:
@@ -104,10 +105,12 @@ Path SVGPathSegList::toPathData()
 {
     // FIXME : This should also support non-normalized PathSegLists
     Path pathData;
-    ExceptionCode ec = 0;
     int len = numberOfItems();
+    ExceptionCode ec = 0;
     for (int i = 0; i < len; ++i) {
         SVGPathSeg* segment = getItem(i, ec).get();
+        if (ec)
+            return Path();
         switch (segment->pathSegType()) {
             case SVGPathSeg::PATHSEG_MOVETO_ABS:
             {
@@ -182,10 +185,14 @@ PassRefPtr<SVGPathSegList> SVGPathSegList::createAnimated(const SVGPathSegList*
     if (!itemCount || itemCount != toList->numberOfItems())
         return 0;
     RefPtr<SVGPathSegList> result = create(fromList->associatedAttributeName());
-    ExceptionCode ec;
+    ExceptionCode ec = 0;
     for (unsigned n = 0; n < itemCount; ++n) {
         SVGPathSeg* from = fromList->getItem(n, ec).get();
+        if (ec)
+            return 0;
         SVGPathSeg* to = toList->getItem(n, ec).get();
+        if (ec)
+            return 0;
         if (from->pathSegType() == SVGPathSeg::PATHSEG_UNKNOWN || from->pathSegType() != to->pathSegType())
             return 0;
         RefPtr<SVGPathSeg> segment = 0;
@@ -251,6 +258,8 @@ PassRefPtr<SVGPathSegList> SVGPathSegList::createAnimated(const SVGPathSegList*
             ASSERT_NOT_REACHED();
         }
         result->appendItem(segment, ec);
+        if (ec)
+            return 0;
     }
     return result.release();
 }
diff --git a/WebCore/svg/SVGPathSegList.h b/WebCore/svg/SVGPathSegList.h
index d9325ce..d2999f0 100644
--- a/WebCore/svg/SVGPathSegList.h
+++ b/WebCore/svg/SVGPathSegList.h
@@ -36,7 +36,7 @@ namespace WebCore {
         static PassRefPtr<SVGPathSegList> create(const QualifiedName& attributeName) { return adoptRef(new SVGPathSegList(attributeName)); }
         virtual ~SVGPathSegList();
 
-        unsigned getPathSegAtLength(double);
+        unsigned getPathSegAtLength(double, ExceptionCode&);
         Path toPathData();
         
         static PassRefPtr<SVGPathSegList> createAnimated(const SVGPathSegList* fromList, const SVGPathSegList* toList, float progress);
diff --git a/WebCore/svg/SVGPathSegMoveto.cpp b/WebCore/svg/SVGPathSegMoveto.cpp
index fc67b29..1144779 100644
--- a/WebCore/svg/SVGPathSegMoveto.cpp
+++ b/WebCore/svg/SVGPathSegMoveto.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegMoveto.h b/WebCore/svg/SVGPathSegMoveto.h
index 726b819..5d30633 100644
--- a/WebCore/svg/SVGPathSegMoveto.h
+++ b/WebCore/svg/SVGPathSegMoveto.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPatternElement.cpp b/WebCore/svg/SVGPatternElement.cpp
index 34b7db4..a10c2c2 100644
--- a/WebCore/svg/SVGPatternElement.cpp
+++ b/WebCore/svg/SVGPatternElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPoint.idl b/WebCore/svg/SVGPoint.idl
index 1a0d227..1bf96f8 100644
--- a/WebCore/svg/SVGPoint.idl
+++ b/WebCore/svg/SVGPoint.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPointList.cpp b/WebCore/svg/SVGPointList.cpp
index c5a6dd2..02a67ed 100644
--- a/WebCore/svg/SVGPointList.cpp
+++ b/WebCore/svg/SVGPointList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPointList.h b/WebCore/svg/SVGPointList.h
index d443e2d..cc12366 100644
--- a/WebCore/svg/SVGPointList.h
+++ b/WebCore/svg/SVGPointList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolyElement.cpp b/WebCore/svg/SVGPolyElement.cpp
index 62e53a3..61725b5 100644
--- a/WebCore/svg/SVGPolyElement.cpp
+++ b/WebCore/svg/SVGPolyElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolygonElement.cpp b/WebCore/svg/SVGPolygonElement.cpp
index 95513e4..a4a62af 100644
--- a/WebCore/svg/SVGPolygonElement.cpp
+++ b/WebCore/svg/SVGPolygonElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolygonElement.h b/WebCore/svg/SVGPolygonElement.h
index 7afb553..fa6eef6 100644
--- a/WebCore/svg/SVGPolygonElement.h
+++ b/WebCore/svg/SVGPolygonElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolylineElement.cpp b/WebCore/svg/SVGPolylineElement.cpp
index 9ea136e..899c072 100644
--- a/WebCore/svg/SVGPolylineElement.cpp
+++ b/WebCore/svg/SVGPolylineElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolylineElement.h b/WebCore/svg/SVGPolylineElement.h
index d43dbbe..e070c9f 100644
--- a/WebCore/svg/SVGPolylineElement.h
+++ b/WebCore/svg/SVGPolylineElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPreserveAspectRatio.cpp b/WebCore/svg/SVGPreserveAspectRatio.cpp
index 5793976..e6452c3 100644
--- a/WebCore/svg/SVGPreserveAspectRatio.cpp
+++ b/WebCore/svg/SVGPreserveAspectRatio.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -180,7 +178,7 @@ TransformationMatrix SVGPreserveAspectRatio::getCTM(double logicX, double logicY
     if (align() == SVG_PRESERVEASPECTRATIO_NONE) {
         temp.scaleNonUniform(physWidth / logicWidth, physHeight / logicHeight);
         temp.translate(-logicX, -logicY);
-    } else if (vpar < svgar && (meetOrSlice() == SVG_MEETORSLICE_MEET) || vpar >= svgar && (meetOrSlice() == SVG_MEETORSLICE_SLICE)) {
+    } else if ((vpar < svgar && (meetOrSlice() == SVG_MEETORSLICE_MEET)) || (vpar >= svgar && (meetOrSlice() == SVG_MEETORSLICE_SLICE))) {
         temp.scaleNonUniform(physHeight / logicHeight, physHeight / logicHeight);
 
         if (align() == SVG_PRESERVEASPECTRATIO_XMINYMIN || align() == SVG_PRESERVEASPECTRATIO_XMINYMID || align() == SVG_PRESERVEASPECTRATIO_XMINYMAX)
diff --git a/WebCore/svg/SVGPreserveAspectRatio.h b/WebCore/svg/SVGPreserveAspectRatio.h
index a0100ff..18a89dd 100644
--- a/WebCore/svg/SVGPreserveAspectRatio.h
+++ b/WebCore/svg/SVGPreserveAspectRatio.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGRadialGradientElement.cpp b/WebCore/svg/SVGRadialGradientElement.cpp
index a9b5cff..270de6f 100644
--- a/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/WebCore/svg/SVGRadialGradientElement.cpp
@@ -105,23 +105,37 @@ void SVGRadialGradientElement::buildGradient() const
         radius = attributes.r().value(this);
     }
 
-    float adjustedFocusX = focalPoint.x();
-    float adjustedFocusY = focalPoint.y();
-
-    float fdx = focalPoint.x() - centerPoint.x();
-    float fdy = focalPoint.y() - centerPoint.y();
+    FloatPoint adjustedFocalPoint = focalPoint;
+    float dfx = focalPoint.x() - centerPoint.x();
+    float dfy = focalPoint.y() - centerPoint.y();
 
     // Spec: If (fx, fy) lies outside the circle defined by (cx, cy) and
     // r, set (fx, fy) to the point of intersection of the line through
     // (fx, fy) and the circle.
-    if (sqrt(fdx * fdx + fdy * fdy) > radius) {
-        float angle = atan2f(focalPoint.y() * 100.0f, focalPoint.x() * 100.0f);
-        adjustedFocusX = cosf(angle) * radius;
-        adjustedFocusY = sinf(angle) * radius;
+    if (sqrt(dfx * dfx + dfy * dfy) >= radius) {
+        float angle = atan2f(dfx, dfy);
+
+        // The maximum deviation of 0.2% is needed on Cairo, since Cairo
+        // is working with fixed point numbers.
+#if PLATFORM(CAIRO)
+        if (focalPoint.x() < centerPoint.x())
+            dfx = cosf(angle) * radius + 0.002f;
+        else
+            dfx = cosf(angle) * radius - 0.002f;
+        if (focalPoint.y() < centerPoint.y())
+            dfy = sinf(angle) * radius + 0.002f;
+        else
+            dfy = sinf(angle) * radius - 0.002f;
+#else
+        dfx = cosf(angle) * radius;
+        dfy = sinf(angle) * radius;
+#endif
+
+        adjustedFocalPoint = FloatPoint(dfx + centerPoint.x(), dfy + centerPoint.y());
     }
 
     RefPtr<Gradient> gradient = Gradient::create(
-        FloatPoint(adjustedFocusX, adjustedFocusY),
+        adjustedFocalPoint,
         0.f, // SVG does not support a "focus radius"
         centerPoint,
         radius);
diff --git a/WebCore/svg/SVGRadialGradientElement.h b/WebCore/svg/SVGRadialGradientElement.h
index 6813e65..61f56f5 100644
--- a/WebCore/svg/SVGRadialGradientElement.h
+++ b/WebCore/svg/SVGRadialGradientElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGRect.idl b/WebCore/svg/SVGRect.idl
index 7fdce65..0278030 100644
--- a/WebCore/svg/SVGRect.idl
+++ b/WebCore/svg/SVGRect.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGRectElement.cpp b/WebCore/svg/SVGRectElement.cpp
index 966976a..f9b04c8 100644
--- a/WebCore/svg/SVGRectElement.cpp
+++ b/WebCore/svg/SVGRectElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGRenderingIntent.h b/WebCore/svg/SVGRenderingIntent.h
index 699f228..f4bfa6a 100644
--- a/WebCore/svg/SVGRenderingIntent.h
+++ b/WebCore/svg/SVGRenderingIntent.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSVGElement.idl b/WebCore/svg/SVGSVGElement.idl
index b188894..46a17b0 100644
--- a/WebCore/svg/SVGSVGElement.idl
+++ b/WebCore/svg/SVGSVGElement.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGScriptElement.cpp b/WebCore/svg/SVGScriptElement.cpp
index c2f4a6e..7be72dc 100644
--- a/WebCore/svg/SVGScriptElement.cpp
+++ b/WebCore/svg/SVGScriptElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSetElement.cpp b/WebCore/svg/SVGSetElement.cpp
index 5800580..a6e81b3 100644
--- a/WebCore/svg/SVGSetElement.cpp
+++ b/WebCore/svg/SVGSetElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSetElement.h b/WebCore/svg/SVGSetElement.h
index fda6919..7d0eced 100644
--- a/WebCore/svg/SVGSetElement.h
+++ b/WebCore/svg/SVGSetElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStopElement.cpp b/WebCore/svg/SVGStopElement.cpp
index 51582d7..0549031 100644
--- a/WebCore/svg/SVGStopElement.cpp
+++ b/WebCore/svg/SVGStopElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStringList.cpp b/WebCore/svg/SVGStringList.cpp
index 9a23a4a..70bfad8 100644
--- a/WebCore/svg/SVGStringList.cpp
+++ b/WebCore/svg/SVGStringList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStringList.h b/WebCore/svg/SVGStringList.h
index 1cbe9d2..2fca6bc 100644
--- a/WebCore/svg/SVGStringList.h
+++ b/WebCore/svg/SVGStringList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStylable.cpp b/WebCore/svg/SVGStylable.cpp
index 5d063c3..c72843a 100644
--- a/WebCore/svg/SVGStylable.cpp
+++ b/WebCore/svg/SVGStylable.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStylable.h b/WebCore/svg/SVGStylable.h
index ade5c2f..7e13d35 100644
--- a/WebCore/svg/SVGStylable.h
+++ b/WebCore/svg/SVGStylable.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyleElement.cpp b/WebCore/svg/SVGStyleElement.cpp
index 31f5920..0a2195a 100644
--- a/WebCore/svg/SVGStyleElement.cpp
+++ b/WebCore/svg/SVGStyleElement.cpp
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Apple Computer, Inc.
     Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyleElement.h b/WebCore/svg/SVGStyleElement.h
index 3853fb3..de37f5d 100644
--- a/WebCore/svg/SVGStyleElement.h
+++ b/WebCore/svg/SVGStyleElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledElement.h b/WebCore/svg/SVGStyledElement.h
index e21db97..9cc21c5 100644
--- a/WebCore/svg/SVGStyledElement.h
+++ b/WebCore/svg/SVGStyledElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledLocatableElement.cpp b/WebCore/svg/SVGStyledLocatableElement.cpp
index 39ecb7d..a48082c 100644
--- a/WebCore/svg/SVGStyledLocatableElement.cpp
+++ b/WebCore/svg/SVGStyledLocatableElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledLocatableElement.h b/WebCore/svg/SVGStyledLocatableElement.h
index 41a034d..3902c73 100644
--- a/WebCore/svg/SVGStyledLocatableElement.h
+++ b/WebCore/svg/SVGStyledLocatableElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledTransformableElement.cpp b/WebCore/svg/SVGStyledTransformableElement.cpp
index b7cf979..4e97c83 100644
--- a/WebCore/svg/SVGStyledTransformableElement.cpp
+++ b/WebCore/svg/SVGStyledTransformableElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledTransformableElement.h b/WebCore/svg/SVGStyledTransformableElement.h
index cf5713e..3145e6f 100644
--- a/WebCore/svg/SVGStyledTransformableElement.h
+++ b/WebCore/svg/SVGStyledTransformableElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSwitchElement.cpp b/WebCore/svg/SVGSwitchElement.cpp
index a07b2a7..6d0f5d1 100644
--- a/WebCore/svg/SVGSwitchElement.cpp
+++ b/WebCore/svg/SVGSwitchElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSymbolElement.cpp b/WebCore/svg/SVGSymbolElement.cpp
index 4155b0c..6f3a644 100644
--- a/WebCore/svg/SVGSymbolElement.cpp
+++ b/WebCore/svg/SVGSymbolElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTRefElement.cpp b/WebCore/svg/SVGTRefElement.cpp
index 5b8640a..1f32e90 100644
--- a/WebCore/svg/SVGTRefElement.cpp
+++ b/WebCore/svg/SVGTRefElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTSpanElement.cpp b/WebCore/svg/SVGTSpanElement.cpp
index eadae1e..12bf377 100644
--- a/WebCore/svg/SVGTSpanElement.cpp
+++ b/WebCore/svg/SVGTSpanElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTSpanElement.h b/WebCore/svg/SVGTSpanElement.h
index 7a29e96..17445d3 100644
--- a/WebCore/svg/SVGTSpanElement.h
+++ b/WebCore/svg/SVGTSpanElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTests.h b/WebCore/svg/SVGTests.h
index 2d82cb4..a2abddf 100644
--- a/WebCore/svg/SVGTests.h
+++ b/WebCore/svg/SVGTests.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextElement.cpp b/WebCore/svg/SVGTextElement.cpp
index b8c7331..c1481cf 100644
--- a/WebCore/svg/SVGTextElement.cpp
+++ b/WebCore/svg/SVGTextElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextElement.h b/WebCore/svg/SVGTextElement.h
index a5cb382..400aa47 100644
--- a/WebCore/svg/SVGTextElement.h
+++ b/WebCore/svg/SVGTextElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextPathElement.cpp b/WebCore/svg/SVGTextPathElement.cpp
index ebbb628..8a01ad9 100644
--- a/WebCore/svg/SVGTextPathElement.cpp
+++ b/WebCore/svg/SVGTextPathElement.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextPositioningElement.cpp b/WebCore/svg/SVGTextPositioningElement.cpp
index 32d9dc0..fd7c8aa 100644
--- a/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/WebCore/svg/SVGTextPositioningElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextPositioningElement.h b/WebCore/svg/SVGTextPositioningElement.h
index 3e01dab..2b07d09 100644
--- a/WebCore/svg/SVGTextPositioningElement.h
+++ b/WebCore/svg/SVGTextPositioningElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTitleElement.cpp b/WebCore/svg/SVGTitleElement.cpp
index 3e23a1b..5afde8d 100644
--- a/WebCore/svg/SVGTitleElement.cpp
+++ b/WebCore/svg/SVGTitleElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTitleElement.h b/WebCore/svg/SVGTitleElement.h
index e053a42..340f725 100644
--- a/WebCore/svg/SVGTitleElement.h
+++ b/WebCore/svg/SVGTitleElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransform.cpp b/WebCore/svg/SVGTransform.cpp
index 17d9b8f..9fe770c 100644
--- a/WebCore/svg/SVGTransform.cpp
+++ b/WebCore/svg/SVGTransform.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransform.h b/WebCore/svg/SVGTransform.h
index 0a5e410..1e15468 100644
--- a/WebCore/svg/SVGTransform.h
+++ b/WebCore/svg/SVGTransform.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransform.idl b/WebCore/svg/SVGTransform.idl
index 3163cd6..0fd3a1e 100644
--- a/WebCore/svg/SVGTransform.idl
+++ b/WebCore/svg/SVGTransform.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransformList.cpp b/WebCore/svg/SVGTransformList.cpp
index 648f1e9..f4f0965 100644
--- a/WebCore/svg/SVGTransformList.cpp
+++ b/WebCore/svg/SVGTransformList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransformList.h b/WebCore/svg/SVGTransformList.h
index d095fe4..9aea524 100644
--- a/WebCore/svg/SVGTransformList.h
+++ b/WebCore/svg/SVGTransformList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransformable.h b/WebCore/svg/SVGTransformable.h
index da31c75..1e87b78 100644
--- a/WebCore/svg/SVGTransformable.h
+++ b/WebCore/svg/SVGTransformable.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGURIReference.h b/WebCore/svg/SVGURIReference.h
index 812fb59..7f91b72 100644
--- a/WebCore/svg/SVGURIReference.h
+++ b/WebCore/svg/SVGURIReference.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008, 2009 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGUnitTypes.h b/WebCore/svg/SVGUnitTypes.h
index 6be737f..b639f29 100644
--- a/WebCore/svg/SVGUnitTypes.h
+++ b/WebCore/svg/SVGUnitTypes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index 42517bd..a566992 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     Copyright (C) Research In Motion Limited 2009. All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -446,6 +444,9 @@ Path SVGUseElement::toClipPath() const
     if (!m_shadowTreeRootElement)
         const_cast<SVGUseElement*>(this)->buildPendingResource();
 
+    if (!m_shadowTreeRootElement)
+        return Path();
+
     Node* n = m_shadowTreeRootElement->firstChild();
     if (n->isSVGElement() && static_cast<SVGElement*>(n)->isStyledTransformable()) {
         if (!isDirectReference(n))
@@ -772,7 +773,7 @@ void SVGUseElement::transferEventListenersToShadowTree(SVGElementInstance* targe
             EventListenerMap& map = d->eventListenerMap;
             EventListenerMap::iterator end = map.end();
             for (EventListenerMap::iterator it = map.begin(); it != end; ++it) {
-                EventListenerVector& entry = it->second;
+                EventListenerVector& entry = *it->second;
                 for (size_t i = 0; i < entry.size(); ++i) {
                     // Event listeners created from markup have already been transfered to the shadow tree during cloning.
                     if (entry[i].listener->wasCreatedFromMarkup())
diff --git a/WebCore/svg/SVGViewElement.cpp b/WebCore/svg/SVGViewElement.cpp
index af1d1fe..0fe6a90 100644
--- a/WebCore/svg/SVGViewElement.cpp
+++ b/WebCore/svg/SVGViewElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGViewSpec.h b/WebCore/svg/SVGViewSpec.h
index 090b7ae..5f963af 100644
--- a/WebCore/svg/SVGViewSpec.h
+++ b/WebCore/svg/SVGViewSpec.h
@@ -33,7 +33,8 @@ namespace WebCore {
     class SVGTransformList;
 
     class SVGViewSpec : public SVGFitToViewBox,
-                        public SVGZoomAndPan {
+                        public SVGZoomAndPan,
+                        public Noncopyable {
     public:
         SVGViewSpec(const SVGSVGElement*);
         virtual ~SVGViewSpec();
diff --git a/WebCore/svg/SVGZoomAndPan.cpp b/WebCore/svg/SVGZoomAndPan.cpp
index c5eafb2..b1ea995 100644
--- a/WebCore/svg/SVGZoomAndPan.cpp
+++ b/WebCore/svg/SVGZoomAndPan.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGZoomAndPan.h b/WebCore/svg/SVGZoomAndPan.h
index d7be342..c11f8e2 100644
--- a/WebCore/svg/SVGZoomAndPan.h
+++ b/WebCore/svg/SVGZoomAndPan.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGZoomEvent.cpp b/WebCore/svg/SVGZoomEvent.cpp
index 2d5a870..92609b1 100644
--- a/WebCore/svg/SVGZoomEvent.cpp
+++ b/WebCore/svg/SVGZoomEvent.cpp
@@ -3,8 +3,6 @@
     Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/animation/SMILTimeContainer.cpp b/WebCore/svg/animation/SMILTimeContainer.cpp
index a37e481..f0b479d 100644
--- a/WebCore/svg/animation/SMILTimeContainer.cpp
+++ b/WebCore/svg/animation/SMILTimeContainer.cpp
@@ -46,6 +46,7 @@ SMILTimeContainer::SMILTimeContainer(SVGSVGElement* owner)
     : m_beginTime(0)
     , m_pauseTime(0)
     , m_accumulatedPauseTime(0)
+    , m_nextManualSampleTime(0)
     , m_documentOrderIndexesDirty(false)
     , m_timer(this, &SMILTimeContainer::timerFired)
     , m_ownerSVGElement(owner)
@@ -207,14 +208,45 @@ String SMILTimeContainer::baseValueFor(ElementAttributePair key)
     m_savedBaseValues.add(key, baseValue);
     return baseValue;
 }
-      
+
+void SMILTimeContainer::sampleAnimationAtTime(const String& elementId, double newTime)
+{
+    ASSERT(m_beginTime);
+    ASSERT(!isPaused());
+
+    // Fast-forward to the time DRT wants to sample
+    m_timer.stop();
+    m_nextSamplingTarget = elementId;
+    m_nextManualSampleTime = newTime;
+
+    updateAnimations(elapsed());
+}
+
 void SMILTimeContainer::updateAnimations(SMILTime elapsed)
 {
     SMILTime earliersFireTime = SMILTime::unresolved();
 
     Vector<SVGSMILElement*> toAnimate;
     copyToVector(m_scheduledAnimations, toAnimate);
-    
+
+    if (m_nextManualSampleTime) {
+        SMILTime samplingDiff;
+        for (unsigned n = 0; n < toAnimate.size(); ++n) {
+            SVGSMILElement* animation = toAnimate[n];
+            ASSERT(animation->timeContainer() == this);
+
+            SVGElement* targetElement = animation->targetElement();
+            if (!targetElement || targetElement->getIDAttribute() != m_nextSamplingTarget)
+                continue;
+
+            samplingDiff = animation->intervalBegin();
+            break;
+        }
+
+        elapsed = SMILTime(m_nextManualSampleTime) + samplingDiff;
+        m_nextManualSampleTime = 0;
+    }
+
     // Sort according to priority. Elements with later begin time have higher priority.
     // In case of a tie, document order decides. 
     // FIXME: This should also consider timing relationships between the elements. Dependents
diff --git a/WebCore/svg/animation/SMILTimeContainer.h b/WebCore/svg/animation/SMILTimeContainer.h
index 5cef507..a6a61c0 100644
--- a/WebCore/svg/animation/SMILTimeContainer.h
+++ b/WebCore/svg/animation/SMILTimeContainer.h
@@ -60,6 +60,9 @@ namespace WebCore {
         
         void setDocumentOrderIndexesDirty() { m_documentOrderIndexesDirty = true; }
 
+        // Move to a specific time. Only used for DRT testing purposes.
+        void sampleAnimationAtTime(const String& elementId, double seconds);
+
     private:
         SMILTimeContainer(SVGSVGElement* owner);
         
@@ -76,7 +79,9 @@ namespace WebCore {
         double m_beginTime;
         double m_pauseTime;
         double m_accumulatedPauseTime;
-        
+        double m_nextManualSampleTime;
+        String m_nextSamplingTarget;
+
         bool m_documentOrderIndexesDirty;
         
         Timer<SMILTimeContainer> m_timer;
diff --git a/WebCore/svg/graphics/SVGImage.cpp b/WebCore/svg/graphics/SVGImage.cpp
index 0a506f8..c4be11e 100644
--- a/WebCore/svg/graphics/SVGImage.cpp
+++ b/WebCore/svg/graphics/SVGImage.cpp
@@ -173,7 +173,7 @@ bool SVGImage::hasRelativeHeight() const
     return rootElement->height().unitType() == LengthTypePercentage;
 }
 
-void SVGImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+void SVGImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace, CompositeOperator compositeOp)
 {
     if (!m_page)
         return;
diff --git a/WebCore/svg/graphics/SVGImage.h b/WebCore/svg/graphics/SVGImage.h
index 2cea91a..10f39ba 100644
--- a/WebCore/svg/graphics/SVGImage.h
+++ b/WebCore/svg/graphics/SVGImage.h
@@ -64,7 +64,7 @@ namespace WebCore {
         virtual NativeImagePtr frameAtIndex(size_t) { return 0; }
         
         SVGImage(ImageObserver*);
-        virtual void draw(GraphicsContext*, const FloatRect& fromRect, const FloatRect& toRect, CompositeOperator);
+        virtual void draw(GraphicsContext*, const FloatRect& fromRect, const FloatRect& toRect, ColorSpace styleColorSpace, CompositeOperator);
         
         virtual NativeImagePtr nativeImageForCurrentFrame();
         
diff --git a/WebCore/svg/graphics/SVGPaintServerGradient.cpp b/WebCore/svg/graphics/SVGPaintServerGradient.cpp
index 4a8e9e0..74e3c22 100644
--- a/WebCore/svg/graphics/SVGPaintServerGradient.cpp
+++ b/WebCore/svg/graphics/SVGPaintServerGradient.cpp
@@ -233,7 +233,7 @@ bool SVGPaintServerGradient::setup(GraphicsContext*& context, const RenderObject
         // lines or rectangles without width or height.
         if (bbox.width() == 0 || bbox.height() == 0) {
             Color color(0, 0, 0);
-            context->setStrokeColor(color);
+            context->setStrokeColor(color, object->style()->colorSpace());
             return true;
         }
         matrix.translate(bbox.x(), bbox.y());
diff --git a/WebCore/svg/graphics/SVGPaintServerPattern.cpp b/WebCore/svg/graphics/SVGPaintServerPattern.cpp
index e825a0b..289c40c 100644
--- a/WebCore/svg/graphics/SVGPaintServerPattern.cpp
+++ b/WebCore/svg/graphics/SVGPaintServerPattern.cpp
@@ -131,7 +131,7 @@ bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject*
             tileImageContext->translate(0, patternBoundaries().height());
             for (int j = numX; j > 0; j--) {
                 tileImageContext->translate(patternBoundaries().width(), 0);
-                tileImageContext->drawImage(tile()->image(), tileRect, tileRect);
+                tileImageContext->drawImage(tile()->image(), object->style()->colorSpace(), tileRect, tileRect);
             }
             tileImageContext->translate(-patternBoundaries().width() * numX, 0);
         }
diff --git a/WebCore/svg/graphics/SVGPaintServerSolid.cpp b/WebCore/svg/graphics/SVGPaintServerSolid.cpp
index b333042..72baad2 100644
--- a/WebCore/svg/graphics/SVGPaintServerSolid.cpp
+++ b/WebCore/svg/graphics/SVGPaintServerSolid.cpp
@@ -64,10 +64,11 @@ bool SVGPaintServerSolid::setup(GraphicsContext*& context, const RenderObject* o
 {
     RenderStyle* style = object ? object->style() : 0;
     const SVGRenderStyle* svgStyle = style ? style->svgStyle() : 0;
+    ColorSpace colorSpace = style ? style->colorSpace() : DeviceColorSpace;
 
     if ((type & ApplyToFillTargetType) && (!style || svgStyle->hasFill())) {
         context->setAlpha(style ? svgStyle->fillOpacity() : 1);
-        context->setFillColor(color().rgb());
+        context->setFillColor(color().rgb(), colorSpace);
         context->setFillRule(style ? svgStyle->fillRule() : RULE_NONZERO);
 
         if (isPaintingText)
@@ -76,7 +77,7 @@ bool SVGPaintServerSolid::setup(GraphicsContext*& context, const RenderObject* o
 
     if ((type & ApplyToStrokeTargetType) && (!style || svgStyle->hasStroke())) {
         context->setAlpha(style ? svgStyle->strokeOpacity() : 1);
-        context->setStrokeColor(color().rgb());
+        context->setStrokeColor(color().rgb(), colorSpace);
 
         if (style)
             applyStrokeStyleToContext(context, style, object);
diff --git a/WebCore/svg/graphics/SVGResource.cpp b/WebCore/svg/graphics/SVGResource.cpp
index 049edc7..514b70d 100644
--- a/WebCore/svg/graphics/SVGResource.cpp
+++ b/WebCore/svg/graphics/SVGResource.cpp
@@ -39,7 +39,7 @@ SVGResource::SVGResource()
 {
 }
 
-struct ResourceSet { 
+struct ResourceSet : Noncopyable {
     ResourceSet() 
     {
         for (int i = 0; i < _ResourceTypeCount; i++)
diff --git a/WebCore/svg/graphics/SVGResourceFilter.cpp b/WebCore/svg/graphics/SVGResourceFilter.cpp
index 973743c..fcf0e40 100644
--- a/WebCore/svg/graphics/SVGResourceFilter.cpp
+++ b/WebCore/svg/graphics/SVGResourceFilter.cpp
@@ -35,6 +35,10 @@
 #include "SVGRenderTreeAsText.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
+static const float kMaxFilterSize = 5000.0f;
+
+using std::min;
+
 namespace WebCore {
 
 SVGResourceFilter::SVGResourceFilter(const SVGFilterElement* ownerElement)
@@ -42,6 +46,9 @@ SVGResourceFilter::SVGResourceFilter(const SVGFilterElement* ownerElement)
     , m_ownerElement(ownerElement)
     , m_filterBBoxMode(false)
     , m_effectBBoxMode(false)
+    , m_filterRes(false)
+    , m_scaleX(1.f)
+    , m_scaleY(1.f)
     , m_savedContext(0)
     , m_sourceGraphicBuffer(0)
 {
@@ -52,27 +59,72 @@ SVGResourceFilter::~SVGResourceFilter()
 {
 }
 
+static inline bool shouldProcessFilter(SVGResourceFilter* filter)
+{
+    return (!filter->scaleX() || !filter->scaleY() || !filter->filterBoundingBox().width()
+            || !filter->filterBoundingBox().height());
+}
+
 void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
 {
     effectAttributes->setStandardAttributes(this, effect.get());
     builder()->add(effectAttributes->result(), effect);
 }
 
+bool SVGResourceFilter::fitsInMaximumImageSize(const FloatSize& size)
+{
+    bool matchesFilterSize = true;
+    if (size.width() > kMaxFilterSize) {
+        m_scaleX *= kMaxFilterSize / size.width();
+        matchesFilterSize = false;
+    }
+    if (size.height() > kMaxFilterSize) {
+        m_scaleY *= kMaxFilterSize / size.height();
+        matchesFilterSize = false;
+    }
+
+    return matchesFilterSize;
+}
+
 void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObject* object)
 {
     FloatRect targetRect = object->objectBoundingBox();
     m_ownerElement->buildFilter(targetRect);
 
+    if (shouldProcessFilter(this))
+        return;
+
     // clip sourceImage to filterRegion
     FloatRect clippedSourceRect = targetRect;
     clippedSourceRect.intersect(m_filterBBox);
 
+    // scale filter size to filterRes
+    FloatRect tempSourceRect = clippedSourceRect;
+    if (m_filterRes) {
+        m_scaleX = m_filterResSize.width() / m_filterBBox.width();
+        m_scaleY = m_filterResSize.height() / m_filterBBox.height();
+    }
+
+    // scale to big sourceImage size to kMaxFilterSize
+    tempSourceRect.scale(m_scaleX, m_scaleY);
+    fitsInMaximumImageSize(tempSourceRect.size());
+
     // prepare Filters
     m_filter = SVGFilter::create(targetRect, m_filterBBox, m_effectBBoxMode);
+    m_filter->setFilterResolution(FloatSize(m_scaleX, m_scaleY));
 
     FilterEffect* lastEffect = m_filterBuilder->lastEffect();
-    if (lastEffect)
+    if (lastEffect) {
         lastEffect->calculateEffectRect(m_filter.get());
+        // at least one FilterEffect has a too big image size,
+        // recalculate the effect sizes with new scale factors
+        if (!fitsInMaximumImageSize(m_filter->maxImageSize())) {
+            m_filter->setFilterResolution(FloatSize(m_scaleX, m_scaleY));
+            lastEffect->calculateEffectRect(m_filter.get());
+        }
+    }
+
+    clippedSourceRect.scale(m_scaleX, m_scaleY);
 
     // Draw the content of the current element and it's childs to a imageBuffer to get the SourceGraphic.
     // The size of the SourceGraphic is clipped to the size of the filterRegion.
@@ -83,6 +135,7 @@ void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObj
         return;
 
     GraphicsContext* sourceGraphicContext = sourceGraphic->context();
+    sourceGraphicContext->scale(FloatSize(m_scaleX, m_scaleY));
     sourceGraphicContext->translate(-targetRect.x(), -targetRect.y());
     sourceGraphicContext->clearRect(FloatRect(FloatPoint(), targetRect.size()));
     m_sourceGraphicBuffer.set(sourceGraphic.release());
@@ -91,8 +144,11 @@ void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObj
     context = sourceGraphicContext;
 }
 
-void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObject*)
+void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObject* object)
 {
+    if (shouldProcessFilter(this))
+        return;
+
     if (!m_savedContext)
         return;
 
@@ -113,7 +169,10 @@ void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObjec
 #if !PLATFORM(CG)
             resultImage->transformColorSpace(LinearRGB, DeviceRGB);
 #endif
-            context->drawImage(resultImage->image(), lastEffect->subRegion());
+            ColorSpace colorSpace = DeviceColorSpace;
+            if (object)
+                colorSpace = object->style()->colorSpace();
+            context->drawImage(resultImage->image(), colorSpace, lastEffect->subRegion());
         }
     }
 
diff --git a/WebCore/svg/graphics/SVGResourceFilter.h b/WebCore/svg/graphics/SVGResourceFilter.h
index 86b11fe..ffd926d 100644
--- a/WebCore/svg/graphics/SVGResourceFilter.h
+++ b/WebCore/svg/graphics/SVGResourceFilter.h
@@ -53,6 +53,9 @@ public:
     
     virtual SVGResourceType resourceType() const { return FilterResourceType; }
 
+    void setFilterResolution(const FloatSize& filterResSize) { m_filterResSize = filterResSize; }
+    void setHasFilterResolution(bool filterRes) { m_filterRes = filterRes; }
+
     bool filterBoundingBoxMode() const { return m_filterBBoxMode; }
     void setFilterBoundingBoxMode(bool bboxMode) { m_filterBBoxMode = bboxMode; }
 
@@ -62,12 +65,17 @@ public:
     FloatRect filterRect() const { return m_filterRect; }
     void setFilterRect(const FloatRect& rect) { m_filterRect = rect; }
 
+    float scaleX() const { return m_scaleX; }
+    float scaleY() const { return m_scaleY; }
+
     FloatRect filterBoundingBox() { return m_filterBBox; }
     void setFilterBoundingBox(const FloatRect& rect) { m_filterBBox = rect; }
 
     void prepareFilter(GraphicsContext*&, const RenderObject*);
     void applyFilter(GraphicsContext*&, const RenderObject*);
 
+    bool fitsInMaximumImageSize(const FloatSize&);
+
     void addFilterEffect(SVGFilterPrimitiveStandardAttributes*, PassRefPtr<FilterEffect>);
 
     SVGFilterBuilder* builder() { return m_filterBuilder.get(); }
@@ -81,9 +89,13 @@ private:
 
     bool m_filterBBoxMode : 1;
     bool m_effectBBoxMode : 1;
+    bool m_filterRes : 1;
+    float m_scaleX;
+    float m_scaleY;
 
     FloatRect m_filterRect;
     FloatRect m_filterBBox;
+    FloatSize m_filterResSize;
 
     OwnPtr<SVGFilterBuilder> m_filterBuilder;
     GraphicsContext* m_savedContext;
diff --git a/WebCore/svg/graphics/filters/SVGDistantLightSource.h b/WebCore/svg/graphics/filters/SVGDistantLightSource.h
index 07ac16c..db9b59d 100644
--- a/WebCore/svg/graphics/filters/SVGDistantLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGDistantLightSource.h
@@ -30,11 +30,10 @@ namespace WebCore {
 
     class DistantLightSource : public LightSource {
     public:
-        DistantLightSource(float azimuth, float elevation)
-            : LightSource(LS_DISTANT)
-            , m_azimuth(azimuth)
-            , m_elevation(elevation)
-        { }
+        static PassRefPtr<DistantLightSource> create(float azimuth, float elevation)
+        {
+            return adoptRef(new DistantLightSource(azimuth, elevation));
+        }
 
         float azimuth() const { return m_azimuth; }
         float elevation() const { return m_elevation; }
@@ -42,6 +41,13 @@ namespace WebCore {
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
+        DistantLightSource(float azimuth, float elevation)
+            : LightSource(LS_DISTANT)
+            , m_azimuth(azimuth)
+            , m_elevation(elevation)
+        {
+        }
+
         float m_azimuth;
         float m_elevation;
     };
diff --git a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
index c536478..93921df 100644
--- a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
@@ -30,7 +30,7 @@
 namespace WebCore {
 
 FEDiffuseLighting::FEDiffuseLighting(FilterEffect* in , const Color& lightingColor, const float& surfaceScale,
-    const float& diffuseConstant, const float& kernelUnitLengthX, const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& diffuseConstant, const float& kernelUnitLengthX, const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
     : FilterEffect()
     , m_in(in)
     , m_lightingColor(lightingColor)
@@ -44,7 +44,7 @@ FEDiffuseLighting::FEDiffuseLighting(FilterEffect* in , const Color& lightingCol
 
 PassRefPtr<FEDiffuseLighting> FEDiffuseLighting::create(FilterEffect* in , const Color& lightingColor,
     const float& surfaceScale, const float& diffuseConstant, const float& kernelUnitLengthX,
-    const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
 {
     return adoptRef(new FEDiffuseLighting(in, lightingColor, surfaceScale, diffuseConstant, kernelUnitLengthX, kernelUnitLengthY, lightSource));
 }
@@ -108,7 +108,7 @@ const LightSource* FEDiffuseLighting::lightSource() const
     return m_lightSource.get();
 }
 
-void FEDiffuseLighting::setLightSource(LightSource* lightSource)
+void FEDiffuseLighting::setLightSource(PassRefPtr<LightSource> lightSource)
 {    
     m_lightSource = lightSource;
 }
diff --git a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
index 71f8e22..bf7f28e 100644
--- a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
+++ b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
@@ -34,7 +34,7 @@ namespace WebCore {
     class FEDiffuseLighting : public FilterEffect {
     public:
         static PassRefPtr<FEDiffuseLighting> create(FilterEffect*, const Color&, const float&, const float&,
-                const float&, const float&, LightSource*);
+                const float&, const float&, PassRefPtr<LightSource>);
         virtual ~FEDiffuseLighting();
 
         Color lightingColor() const;
@@ -53,7 +53,7 @@ namespace WebCore {
         void setKernelUnitLengthY(float);
 
         const LightSource* lightSource() const;
-        void setLightSource(LightSource*);
+        void setLightSource(PassRefPtr<LightSource>);
 
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
         void apply(Filter*);
@@ -62,7 +62,7 @@ namespace WebCore {
         
     private:
         FEDiffuseLighting(FilterEffect*, const Color&, const float&, const float&,
-                const float&, const float&, LightSource*);
+                const float&, const float&, PassRefPtr<LightSource>);
 
         RefPtr<FilterEffect> m_in;
         Color m_lightingColor;
diff --git a/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp b/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
index abb57ee..a22bc94 100644
--- a/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,8 +24,12 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDisplacementMap.h"
-#include "SVGRenderTreeAsText.h"
+
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
 
@@ -75,8 +80,53 @@ void FEDisplacementMap::setScale(float scale)
     m_scale = scale;
 }
 
-void FEDisplacementMap::apply(Filter*)
+void FEDisplacementMap::apply(Filter* filter)
 {
+    m_in->apply(filter);
+    m_in2->apply(filter);
+    if (!m_in->resultImage() || !m_in2->resultImage())
+        return;
+
+    if (m_xChannelSelector == CHANNEL_UNKNOWN || m_yChannelSelector == CHANNEL_UNKNOWN)
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
+
+    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->scaledSubRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayB(m_in2->resultImage()->getUnmultipliedImageData(effectBDrawingRect)->data());
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    ASSERT(srcPixelArrayA->length() == srcPixelArrayB->length());
+
+    float scaleX = m_scale / 255.f * filter->filterResolution().width();
+    float scaleY = m_scale / 255.f * filter->filterResolution().height();
+    float scaleAdjustmentX = (0.5f - 0.5f * m_scale) * filter->filterResolution().width();
+    float scaleAdjustmentY = (0.5f - 0.5f * m_scale) * filter->filterResolution().height();
+    int stride = imageRect.width() * 4;
+    for (int y = 0; y < imageRect.height(); ++y) {
+        int line = y * stride;
+        for (int x = 0; x < imageRect.width(); ++x) {
+            int dstIndex = line + x * 4;
+            int srcX = x + static_cast<int>(scaleX * srcPixelArrayB->get(dstIndex + m_xChannelSelector - 1) + scaleAdjustmentX);
+            int srcY = y + static_cast<int>(scaleY * srcPixelArrayB->get(dstIndex + m_yChannelSelector - 1) + scaleAdjustmentY);
+            for (unsigned channel = 0; channel < 4; ++channel) {
+                if (srcX < 0 || srcX >= imageRect.width() || srcY < 0 || srcY >= imageRect.height())
+                    imageData->data()->set(dstIndex + channel, static_cast<unsigned char>(0));
+                else {
+                    unsigned char pixelValue = srcPixelArrayA->get(srcY * stride + srcX * 4 + channel);
+                    imageData->data()->set(dstIndex + channel, pixelValue);
+                }
+            }
+
+        }
+    }
+    resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEDisplacementMap::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFEFlood.cpp b/WebCore/svg/graphics/filters/SVGFEFlood.cpp
index 668209f..648bf54 100644
--- a/WebCore/svg/graphics/filters/SVGFEFlood.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEFlood.cpp
@@ -70,7 +70,7 @@ void FEFlood::apply(Filter*)
         return;
 
     Color color = colorWithOverrideAlpha(floodColor().rgb(), floodOpacity());
-    filterContext->fillRect(FloatRect(FloatPoint(), subRegion().size()), color);
+    filterContext->fillRect(FloatRect(FloatPoint(), scaledSubRegion().size()), color, DeviceColorSpace);
 }
 
 void FEFlood::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFEMerge.cpp b/WebCore/svg/graphics/filters/SVGFEMerge.cpp
index acf3c45..3f9ad38 100644
--- a/WebCore/svg/graphics/filters/SVGFEMerge.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEMerge.cpp
@@ -78,8 +78,8 @@ void FEMerge::apply(Filter* filter)
         return;
 
     for (unsigned i = 0; i < m_mergeInputs.size(); i++) {
-        FloatRect destRect = calculateDrawingRect(m_mergeInputs[i]->subRegion());
-        filterContext->drawImage(m_mergeInputs[i]->resultImage()->image(), destRect);
+        FloatRect destRect = calculateDrawingRect(m_mergeInputs[i]->scaledSubRegion());
+        filterContext->drawImage(m_mergeInputs[i]->resultImage()->image(), DeviceColorSpace, destRect);
     }
 }
 
diff --git a/WebCore/svg/graphics/filters/SVGFEMorphology.cpp b/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
index f7fc5d8..20d109a 100644
--- a/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,8 +24,16 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMorphology.h"
-#include "SVGRenderTreeAsText.h"
+
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "ImageData.h"
+#include "SVGRenderTreeAsText.h"
+
+#include <wtf/Vector.h>
+
+using std::min;
+using std::max;
 
 namespace WebCore {
 
@@ -72,8 +81,73 @@ void FEMorphology::setRadiusY(float radiusY)
     m_radiusY = radiusY;
 }
 
-void FEMorphology::apply(Filter*)
+void FEMorphology::apply(Filter* filter)
 {
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+    
+    if (!getEffectContext())
+        return;
+
+    if (!m_radiusX || !m_radiusY)
+        return;
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
+    RefPtr<CanvasPixelArray> srcPixelArray(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect)->data());
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    int radiusX = static_cast<int>(m_radiusX * filter->filterResolution().width());
+    int radiusY = static_cast<int>(m_radiusY * filter->filterResolution().height());
+    int effectWidth = effectDrawingRect.width() * 4;
+    
+    // Limit the radius size to effect width
+    radiusX = min(effectDrawingRect.width() - 1, radiusX);
+    
+    Vector<unsigned char> extrema;
+    for (int y = 0; y < effectDrawingRect.height(); ++y) {
+        int startY = max(0, y - radiusY);
+        int endY = min(effectDrawingRect.height() - 1, y + radiusY);
+        for (unsigned channel = 0; channel < 4; ++channel) {
+            // Fill the kernel
+            extrema.clear();
+            for (int j = 0; j <= radiusX; ++j) {
+                unsigned char columnExtrema = srcPixelArray->get(startY * effectWidth + 4 * j + channel);
+                for (int i = startY; i <= endY; ++i) {
+                    unsigned char pixel = srcPixelArray->get(i * effectWidth + 4 * j + channel);
+                    if ((m_type == FEMORPHOLOGY_OPERATOR_ERODE && pixel <= columnExtrema) ||
+                        (m_type == FEMORPHOLOGY_OPERATOR_DILATE && pixel >= columnExtrema))
+                        columnExtrema = pixel;
+                }
+                extrema.append(columnExtrema);
+            }
+            
+            // Kernel is filled, get extrema of next column 
+            for (int x = 0; x < effectDrawingRect.width(); ++x) {
+                unsigned endX = min(x + radiusX, effectDrawingRect.width() - 1);
+                unsigned char columnExtrema = srcPixelArray->get(startY * effectWidth + endX * 4 + channel);
+                for (int i = startY; i <= endY; ++i) {
+                    unsigned char pixel = srcPixelArray->get(i * effectWidth + endX * 4 + channel);
+                    if ((m_type == FEMORPHOLOGY_OPERATOR_ERODE && pixel <= columnExtrema) ||
+                        (m_type == FEMORPHOLOGY_OPERATOR_DILATE && pixel >= columnExtrema))
+                        columnExtrema = pixel;
+                }
+                if (x - radiusX >= 0)
+                    extrema.remove(0);
+                if (x + radiusX <= effectDrawingRect.width())
+                    extrema.append(columnExtrema);
+                unsigned char entireExtrema = extrema[0];
+                for (unsigned kernelIndex = 0; kernelIndex < extrema.size(); ++kernelIndex) {
+                    if ((m_type == FEMORPHOLOGY_OPERATOR_ERODE && extrema[kernelIndex] <= entireExtrema) ||
+                        (m_type == FEMORPHOLOGY_OPERATOR_DILATE && extrema[kernelIndex] >= entireExtrema))
+                        entireExtrema = extrema[kernelIndex];
+                }
+                imageData->data()->set(y * effectWidth + 4 * x + channel, entireExtrema);
+            }
+        }
+    }
+    resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEMorphology::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFEOffset.cpp b/WebCore/svg/graphics/filters/SVGFEOffset.cpp
index ce9ee3d..9fd50ed 100644
--- a/WebCore/svg/graphics/filters/SVGFEOffset.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEOffset.cpp
@@ -74,17 +74,22 @@ void FEOffset::apply(Filter* filter)
     if (!filterContext)
         return;
 
+    FloatRect sourceImageRect = filter->sourceImageRect();
+    sourceImageRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+
     if (filter->effectBoundingBoxMode()) {
-        setDx(dx() * filter->sourceImageRect().width());
-        setDy(dy() * filter->sourceImageRect().height());
+        m_dx *= sourceImageRect.width();
+        m_dy *= sourceImageRect.height();
     }
+    m_dx *= filter->filterResolution().width();
+    m_dy *= filter->filterResolution().height();
 
-    FloatRect dstRect = FloatRect(dx() + m_in->subRegion().x() - subRegion().x(),
-                                  dy() + m_in->subRegion().y() - subRegion().y(),
-                                  m_in->subRegion().width(),
-                                  m_in->subRegion().height());
+    FloatRect dstRect = FloatRect(m_dx + m_in->scaledSubRegion().x() - scaledSubRegion().x(),
+                                  m_dy + m_in->scaledSubRegion().y() - scaledSubRegion().y(),
+                                  m_in->scaledSubRegion().width(),
+                                  m_in->scaledSubRegion().height());
 
-    filterContext->drawImage(m_in->resultImage()->image(), dstRect);
+    filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, dstRect);
 }
 
 void FEOffset::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp b/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
index eb0c280..0b43aba 100644
--- a/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
+++ b/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
@@ -30,7 +30,7 @@ namespace WebCore {
 
 FESpecularLighting::FESpecularLighting(FilterEffect* in, const Color& lightingColor, const float& surfaceScale,
     const float& specularConstant, const float& specularExponent, const float& kernelUnitLengthX,
-    const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
     : FilterEffect()
     , m_in(in)
     , m_lightingColor(lightingColor)
@@ -45,7 +45,7 @@ FESpecularLighting::FESpecularLighting(FilterEffect* in, const Color& lightingCo
 
 PassRefPtr<FESpecularLighting> FESpecularLighting::create(FilterEffect* in, const Color& lightingColor,
     const float& surfaceScale, const float& specularConstant, const float& specularExponent,
-    const float& kernelUnitLengthX, const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& kernelUnitLengthX, const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
 {
     return adoptRef(new FESpecularLighting(in, lightingColor, surfaceScale, specularConstant, specularExponent,
         kernelUnitLengthX, kernelUnitLengthY, lightSource));
@@ -120,7 +120,7 @@ const LightSource* FESpecularLighting::lightSource() const
     return m_lightSource.get();
 }
 
-void FESpecularLighting::setLightSource(LightSource* lightSource)
+void FESpecularLighting::setLightSource(PassRefPtr<LightSource> lightSource)
 {
     m_lightSource = lightSource;
 }
diff --git a/WebCore/svg/graphics/filters/SVGFESpecularLighting.h b/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
index dec5163..f4947fd 100644
--- a/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
+++ b/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
@@ -33,7 +33,7 @@ namespace WebCore {
     class FESpecularLighting : public FilterEffect {
     public:
         static PassRefPtr<FESpecularLighting> create(FilterEffect*, const Color&, const float&, const float&,
-            const float&, const float&, const float&, LightSource*);
+            const float&, const float&, const float&, PassRefPtr<LightSource>);
         virtual ~FESpecularLighting();
 
         Color lightingColor() const;
@@ -55,7 +55,7 @@ namespace WebCore {
         void setKernelUnitLengthY(float);
 
         const LightSource* lightSource() const;
-        void setLightSource(LightSource*);
+        void setLightSource(PassRefPtr<LightSource>);
 
         virtual FloatRect uniteEffectRect(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
         void apply(Filter*);
@@ -64,7 +64,7 @@ namespace WebCore {
 
     private:
         FESpecularLighting(FilterEffect*, const Color&, const float&, const float&, const float&,
-            const float&, const float&, LightSource*);
+            const float&, const float&, PassRefPtr<LightSource>);
 
         RefPtr<FilterEffect> m_in;
         Color m_lightingColor;
diff --git a/WebCore/svg/graphics/filters/SVGFETile.cpp b/WebCore/svg/graphics/filters/SVGFETile.cpp
index 3071501..e97f68f 100644
--- a/WebCore/svg/graphics/filters/SVGFETile.cpp
+++ b/WebCore/svg/graphics/filters/SVGFETile.cpp
@@ -58,24 +58,27 @@ void FETile::apply(Filter* filter)
     if (!filterContext)
         return;
 
-    IntRect tileRect = enclosingIntRect(m_in->subRegion());
+    IntRect tileRect = enclosingIntRect(m_in->scaledSubRegion());
 
     // Source input needs more attention. It has the size of the filterRegion but gives the
     // size of the cutted sourceImage back. This is part of the specification and optimization.
-    if (m_in->isSourceInput())
-        tileRect = enclosingIntRect(filter->filterRegion());
+    if (m_in->isSourceInput()) {
+        FloatRect filterRegion = filter->filterRegion();
+        filterRegion.scale(filter->filterResolution().width(), filter->filterResolution().height());
+        tileRect = enclosingIntRect(filterRegion);
+    }
 
     OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(tileRect.size());
     GraphicsContext* tileImageContext = tileImage->context();
-    tileImageContext->drawImage(m_in->resultImage()->image(), IntPoint());
+    tileImageContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, IntPoint());
     RefPtr<Pattern> pattern = Pattern::create(tileImage->image(), true, true);
 
     TransformationMatrix matrix;
-    matrix.translate(m_in->subRegion().x() - subRegion().x(), m_in->subRegion().y() - subRegion().y());
+    matrix.translate(m_in->scaledSubRegion().x() - scaledSubRegion().x(), m_in->scaledSubRegion().y() - scaledSubRegion().y());
     pattern.get()->setPatternSpaceTransform(matrix);
 
     filterContext->setFillPattern(pattern);
-    filterContext->fillRect(FloatRect(FloatPoint(), subRegion().size()));
+    filterContext->fillRect(FloatRect(FloatPoint(), scaledSubRegion().size()));
 }
 
 void FETile::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFilter.cpp b/WebCore/svg/graphics/filters/SVGFilter.cpp
index 6bfcf39..4ec4e6e 100644
--- a/WebCore/svg/graphics/filters/SVGFilter.cpp
+++ b/WebCore/svg/graphics/filters/SVGFilter.cpp
@@ -34,7 +34,7 @@ SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool
 
 void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
 {
-    FloatRect subRegionBBox = effect->subRegion();
+    FloatRect subRegionBBox = effect->effectBoundaries();
     FloatRect useBBox = effect->unionOfChildEffectSubregions();
     FloatRect newSubRegion = subRegionBBox;
 
@@ -70,6 +70,9 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
     newSubRegion.intersect(m_filterRect);
 
     effect->setSubRegion(newSubRegion);
+    newSubRegion.scale(filterResolution().width(), filterResolution().height());
+    effect->setScaledSubRegion(newSubRegion);
+    m_maxImageSize = m_maxImageSize.expandedTo(newSubRegion.size()); 
 }
 
 PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode)
diff --git a/WebCore/svg/graphics/filters/SVGFilter.h b/WebCore/svg/graphics/filters/SVGFilter.h
index f23d1ea..c4714c6 100644
--- a/WebCore/svg/graphics/filters/SVGFilter.h
+++ b/WebCore/svg/graphics/filters/SVGFilter.h
@@ -24,6 +24,7 @@
 #include "Filter.h"
 #include "FilterEffect.h"
 #include "FloatRect.h"
+#include "FloatSize.h"
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,15 +36,18 @@ namespace WebCore {
     public:
         static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool);
 
-        bool effectBoundingBoxMode() { return m_effectBBoxMode; }
+        virtual bool effectBoundingBoxMode() const { return m_effectBBoxMode; }
 
-        FloatRect filterRegion() { return m_filterRect; }
-        FloatRect sourceImageRect() { return m_itemBox; }
-        void calculateEffectSubRegion(FilterEffect*);
+        virtual FloatRect filterRegion() const { return m_filterRect; }
+        virtual FloatRect sourceImageRect() const { return m_itemBox; }
+
+        virtual FloatSize maxImageSize() const { return m_maxImageSize; }
+        virtual void calculateEffectSubRegion(FilterEffect*);
 
     private:
         SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode);
 
+        FloatSize m_maxImageSize;
         FloatRect m_itemBox;
         FloatRect m_filterRect;
         bool m_effectBBoxMode;
diff --git a/WebCore/svg/graphics/filters/SVGLightSource.h b/WebCore/svg/graphics/filters/SVGLightSource.h
index 22b43c8..6f0075c 100644
--- a/WebCore/svg/graphics/filters/SVGLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGLightSource.h
@@ -24,6 +24,7 @@
 #define SVGLightSource_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
diff --git a/WebCore/svg/graphics/filters/SVGPointLightSource.h b/WebCore/svg/graphics/filters/SVGPointLightSource.h
index 772e278..1e966cc 100644
--- a/WebCore/svg/graphics/filters/SVGPointLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGPointLightSource.h
@@ -31,16 +31,22 @@ namespace WebCore {
 
     class PointLightSource : public LightSource {
     public:
-        PointLightSource(const FloatPoint3D& position)
-            : LightSource(LS_POINT)
-            , m_position(position)
-        { }
+        static PassRefPtr<PointLightSource> create(const FloatPoint3D& position)
+        {
+            return adoptRef(new PointLightSource(position));
+        }
 
         const FloatPoint3D& position() const { return m_position; }
 
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
+        PointLightSource(const FloatPoint3D& position)
+            : LightSource(LS_POINT)
+            , m_position(position)
+        {
+        }
+
         FloatPoint3D m_position;
     };
 
diff --git a/WebCore/svg/graphics/filters/SVGSpotLightSource.h b/WebCore/svg/graphics/filters/SVGSpotLightSource.h
index 9a787fb..05280d2 100644
--- a/WebCore/svg/graphics/filters/SVGSpotLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGSpotLightSource.h
@@ -31,13 +31,11 @@ namespace WebCore {
 
     class SpotLightSource : public LightSource {
     public:
-        SpotLightSource(const FloatPoint3D& position, const FloatPoint3D& direction, float specularExponent, float limitingConeAngle)
-            : LightSource(LS_SPOT)
-            , m_position(position)
-            , m_direction(direction)
-            , m_specularExponent(specularExponent)
-            , m_limitingConeAngle(limitingConeAngle)
-        { }
+        static PassRefPtr<SpotLightSource> create(const FloatPoint3D& position, const FloatPoint3D& direction,
+                                                  float specularExponent, float limitingConeAngle)
+        {
+            return adoptRef(new SpotLightSource(position, direction, specularExponent, limitingConeAngle));
+        }
 
         const FloatPoint3D& position() const { return m_position; }
         const FloatPoint3D& direction() const { return m_direction; }
@@ -48,6 +46,16 @@ namespace WebCore {
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
+        SpotLightSource(const FloatPoint3D& position, const FloatPoint3D& direction,
+                        float specularExponent, float limitingConeAngle)
+            : LightSource(LS_SPOT)
+            , m_position(position)
+            , m_direction(direction)
+            , m_specularExponent(specularExponent)
+            , m_limitingConeAngle(limitingConeAngle)
+        {
+        }
+
         FloatPoint3D m_position;
         FloatPoint3D m_direction;
 
diff --git a/WebCore/svg/svgtags.in b/WebCore/svg/svgtags.in
index 30a0e4c..ca1ea89 100644
--- a/WebCore/svg/svgtags.in
+++ b/WebCore/svg/svgtags.in
@@ -2,7 +2,7 @@ namespace="SVG"
 namespaceURI="http://www.w3.org/2000/svg"
 guardFactoryWith="ENABLE(SVG)"
 exportStrings
-
+ 
 a createWithNew
 #if ENABLE_SVG_FONTS
 altGlyph createWithNew
diff --git a/WebCore/websockets/WebSocket.cpp b/WebCore/websockets/WebSocket.cpp
index 32e0559..ee78174 100644
--- a/WebCore/websockets/WebSocket.cpp
+++ b/WebCore/websockets/WebSocket.cpp
@@ -43,35 +43,11 @@
 #include "Logging.h"
 #include "MessageEvent.h"
 #include "ScriptExecutionContext.h"
-#include "SecurityOrigin.h"
 #include "WebSocketChannel.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-class ProcessWebSocketEventTask : public ScriptExecutionContext::Task {
-public:
-    typedef void (WebSocket::*Method)(Event*);
-    static PassRefPtr<ProcessWebSocketEventTask> create(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
-    {
-        return adoptRef(new ProcessWebSocketEventTask(webSocket, event));
-    }
-    virtual void performTask(ScriptExecutionContext*)
-    {
-        ExceptionCode ec = 0;
-        m_webSocket->dispatchEvent(m_event.get(), ec);
-        ASSERT(!ec);
-    }
-
-  private:
-    ProcessWebSocketEventTask(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
-        : m_webSocket(webSocket)
-        , m_event(event) { }
-
-    RefPtr<WebSocket> m_webSocket;
-    RefPtr<Event> m_event;
-};
-
 static bool isValidProtocolString(const WebCore::String& protocol)
 {
     if (protocol.isNull())
@@ -80,7 +56,7 @@ static bool isValidProtocolString(const WebCore::String& protocol)
         return false;
     const UChar* characters = protocol.characters();
     for (size_t i = 0; i < protocol.length(); i++) {
-        if (characters[i] < 0x21 || characters[i] > 0x7E)
+        if (characters[i] < 0x20 || characters[i] > 0x7E)
             return false;
     }
     return true;
@@ -110,7 +86,7 @@ WebSocket::WebSocket(ScriptExecutionContext* context)
 
 WebSocket::~WebSocket()
 {
-    if (m_channel.get())
+    if (m_channel)
         m_channel->disconnect();
 }
 
@@ -126,18 +102,29 @@ void WebSocket::connect(const KURL& url, const String& protocol, ExceptionCode&
     m_protocol = protocol;
 
     if (!m_url.protocolIs("ws") && !m_url.protocolIs("wss")) {
-        LOG_ERROR("Error: wrong url for WebSocket %s", url.string().utf8().data());
+        LOG(Network, "Wrong url scheme for WebSocket %s", url.string().utf8().data());
+        m_state = CLOSED;
+        ec = SYNTAX_ERR;
+        return;
+    }
+    if (m_url.hasFragmentIdentifier()) {
+        LOG(Network, "URL has fragment component %s", url.string().utf8().data());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
     if (!isValidProtocolString(m_protocol)) {
-        LOG_ERROR("Error: wrong protocol for WebSocket %s", m_protocol.utf8().data());
+        LOG(Network, "Wrong protocol for WebSocket %s", m_protocol.utf8().data());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
-    // FIXME: if m_url.port() is blocking port, raise SECURITY_ERR.
+    if (!portAllowed(url)) {
+        LOG(Network, "WebSocket port %d blocked", url.port());
+        m_state = CLOSED;
+        ec = SECURITY_ERR;
+        return;
+    }
 
     m_channel = WebSocketChannel::create(scriptExecutionContext(), this, m_url, m_protocol);
     m_channel->connect();
@@ -196,7 +183,7 @@ void WebSocket::didConnect()
         return;
     }
     m_state = OPEN;
-    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().openEvent, false, false)));
+    dispatchEvent(Event::create(eventNames().openEvent, false, false));
 }
 
 void WebSocket::didReceiveMessage(const String& msg)
@@ -207,15 +194,14 @@ void WebSocket::didReceiveMessage(const String& msg)
     RefPtr<MessageEvent> evt = MessageEvent::create();
     // FIXME: origin, lastEventId, source, messagePort.
     evt->initMessageEvent(eventNames().messageEvent, false, false, SerializedScriptValue::create(msg), "", "", 0, 0);
-    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, evt));
+    dispatchEvent(evt);
 }
 
 void WebSocket::didClose()
 {
     LOG(Network, "WebSocket %p didClose", this);
     m_state = CLOSED;
-    if (scriptExecutionContext())
-        scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().closeEvent, false, false)));
+    dispatchEvent(Event::create(eventNames().closeEvent, false, false));
 }
 
 EventTargetData* WebSocket::eventTargetData()
diff --git a/WebCore/websockets/WebSocketChannel.cpp b/WebCore/websockets/WebSocketChannel.cpp
index be388b4..a222b4d 100644
--- a/WebCore/websockets/WebSocketChannel.cpp
+++ b/WebCore/websockets/WebSocketChannel.cpp
@@ -69,7 +69,7 @@ WebSocketChannel::~WebSocketChannel()
 void WebSocketChannel::connect()
 {
     LOG(Network, "WebSocketChannel %p connect", this);
-    ASSERT(!m_handle.get());
+    ASSERT(!m_handle);
     m_handshake.reset();
     ref();
     m_handle = SocketStreamHandle::create(m_handshake.url(), this);
@@ -82,7 +82,7 @@ bool WebSocketChannel::send(const String& msg)
     buf.append('\0');  // frame type
     buf.append(msg.utf8().data(), msg.utf8().length());
     buf.append('\xff');  // frame end
-    if (!m_handle.get()) {
+    if (!m_handle) {
         m_unhandledBufferSize += buf.size();
         return false;
     }
@@ -92,7 +92,7 @@ bool WebSocketChannel::send(const String& msg)
 unsigned long WebSocketChannel::bufferedAmount() const
 {
     LOG(Network, "WebSocketChannel %p bufferedAmount", this);
-    if (!m_handle.get())
+    if (!m_handle)
         return m_unhandledBufferSize;
     return m_handle->bufferedAmount();
 }
@@ -100,7 +100,7 @@ unsigned long WebSocketChannel::bufferedAmount() const
 void WebSocketChannel::close()
 {
     LOG(Network, "WebSocketChannel %p close", this);
-    if (m_handle.get())
+    if (m_handle)
         m_handle->close();  // will call didClose()
 }
 
@@ -108,22 +108,14 @@ void WebSocketChannel::disconnect()
 {
     LOG(Network, "WebSocketChannel %p disconnect", this);
     m_client = 0;
-    if (m_handle.get())
+    if (m_handle)
         m_handle->close();
 }
 
-void WebSocketChannel::willOpenStream(SocketStreamHandle*, const KURL&)
-{
-}
-
-void WebSocketChannel::willSendData(SocketStreamHandle*, const char*, int)
-{
-}
-
 void WebSocketChannel::didOpen(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didOpen", this);
-    ASSERT(handle == m_handle.get());
+    ASSERT(handle == m_handle);
     const CString& handshakeMessage = m_handshake.clientHandshakeMessage();
     if (!handle->send(handshakeMessage.data(), handshakeMessage.length())) {
         LOG(Network, "Error in sending handshake message.");
@@ -134,8 +126,8 @@ void WebSocketChannel::didOpen(SocketStreamHandle* handle)
 void WebSocketChannel::didClose(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didClose", this);
-    ASSERT(handle == m_handle.get() || !m_handle.get());
-    if (m_handle.get()) {
+    ASSERT(handle == m_handle || !m_handle);
+    if (m_handle) {
         m_unhandledBufferSize = handle->bufferedAmount();
         WebSocketChannelClient* client = m_client;
         m_client = 0;
@@ -149,7 +141,7 @@ void WebSocketChannel::didClose(SocketStreamHandle* handle)
 void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* data, int len)
 {
     LOG(Network, "WebSocketChannel %p didReceiveData %d", this, len);
-    ASSERT(handle == m_handle.get());
+    ASSERT(handle == m_handle);
     if (!appendToBuffer(data, len)) {
         handle->close();
         return;
@@ -167,8 +159,10 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
             if (!m_handshake.serverSetCookie().isEmpty()) {
                 if (m_context->isDocument()) {
                     Document* document = static_cast<Document*>(m_context);
-                    if (cookiesEnabled(document))
-                        document->setCookie(m_handshake.serverSetCookie());
+                    if (cookiesEnabled(document)) {
+                        ExceptionCode ec; // Exception (for sandboxed documents) ignored.
+                        document->setCookie(m_handshake.serverSetCookie(), ec);
+                    }
                 }
             }
             // FIXME: handle set-cookie2.
@@ -193,19 +187,23 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
         unsigned char frameByte = static_cast<unsigned char>(*p++);
         if ((frameByte & 0x80) == 0x80) {
             int length = 0;
-            while (p < end && (*p & 0x80) == 0x80) {
+            while (p < end) {
                 if (length > std::numeric_limits<int>::max() / 128) {
                     LOG(Network, "frame length overflow %d", length);
                     handle->close();
                     return;
                 }
-                length = length * 128 + (*p & 0x7f);
+                char msgByte = *p;
+                length = length * 128 + (msgByte & 0x7f);
                 ++p;
+                if (!(msgByte & 0x80))
+                    break;
             }
             if (p + length < end) {
                 p += length;
                 nextFrame = p;
-            }
+            } else
+                break;
         } else {
             const char* msgStart = p;
             while (p < end && *p != '\xff')
@@ -224,10 +222,18 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
 void WebSocketChannel::didFail(SocketStreamHandle* handle, const SocketStreamError&)
 {
     LOG(Network, "WebSocketChannel %p didFail", this);
-    ASSERT(handle == m_handle.get() || !m_handle.get());
+    ASSERT(handle == m_handle || !m_handle);
     handle->close();
 }
 
+void WebSocketChannel::didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&)
+{
+}
+
+void WebSocketChannel::didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&)
+{
+}
+
 bool WebSocketChannel::appendToBuffer(const char* data, int len)
 {
     char* newBuffer = 0;
diff --git a/WebCore/websockets/WebSocketChannel.h b/WebCore/websockets/WebSocketChannel.h
index ad38163..14b1e8c 100644
--- a/WebCore/websockets/WebSocketChannel.h
+++ b/WebCore/websockets/WebSocketChannel.h
@@ -50,21 +50,18 @@ namespace WebCore {
         static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return adoptRef(new WebSocketChannel(context, client, url, protocol)); }
         virtual ~WebSocketChannel();
 
-        virtual void connect();
+        void connect();
+        bool send(const String& msg);
+        unsigned long bufferedAmount() const;
+        void close();
+        void disconnect(); // Will suppress didClose().
 
-        virtual bool send(const String& msg);
-        virtual unsigned long bufferedAmount() const;
-
-        virtual void close();
-
-        virtual void disconnect();
-
-        virtual void willOpenStream(SocketStreamHandle*, const KURL&);
-        virtual void willSendData(SocketStreamHandle*, const char*, int);
         virtual void didOpen(SocketStreamHandle*);
         virtual void didClose(SocketStreamHandle*);
         virtual void didReceiveData(SocketStreamHandle*, const char*, int);
         virtual void didFail(SocketStreamHandle*, const SocketStreamError&);
+        virtual void didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&);
+        virtual void didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&);
 
     private:
         WebSocketChannel(ScriptExecutionContext*, WebSocketChannelClient*, const KURL&, const String&);
diff --git a/WebCore/websockets/WebSocketHandshake.cpp b/WebCore/websockets/WebSocketHandshake.cpp
index 691fa1c..d1da443 100644
--- a/WebCore/websockets/WebSocketHandshake.cpp
+++ b/WebCore/websockets/WebSocketHandshake.cpp
@@ -74,6 +74,13 @@ static String extractResponseCode(const char* header, int len)
     return String(space1 + 1, space2 - space1 - 1);
 }
 
+static String resourceName(const KURL& url)
+{
+    if (url.query().isNull())
+        return url.path();
+    return url.path() + "?" + url.query();
+}
+
 WebSocketHandshake::WebSocketHandshake(const KURL& url, const String& protocol, ScriptExecutionContext* context)
     : m_url(url)
     , m_clientProtocol(protocol)
@@ -139,7 +146,7 @@ String WebSocketHandshake::clientLocation() const
             builder.append(String::number(m_url.port()));
         }
     }
-    builder.append(m_url.path());
+    builder.append(resourceName(m_url));
     return builder.toString();
 }
 
@@ -148,11 +155,7 @@ CString WebSocketHandshake::clientHandshakeMessage() const
     StringBuilder builder;
 
     builder.append("GET ");
-    builder.append(m_url.path());
-    if (!m_url.query().isEmpty()) {
-        builder.append("?");
-        builder.append(m_url.query());
-    }
+    builder.append(resourceName(m_url));
     builder.append(" HTTP/1.1\r\n");
     builder.append("Upgrade: WebSocket\r\n");
     builder.append("Connection: Upgrade\r\n");
diff --git a/WebCore/wml/WMLAElement.cpp b/WebCore/wml/WMLAElement.cpp
index 074c371..8bd6fad 100644
--- a/WebCore/wml/WMLAElement.cpp
+++ b/WebCore/wml/WMLAElement.cpp
@@ -140,8 +140,8 @@ void WMLAElement::defaultEventHandler(Event* event)
         }
  
         if (!event->defaultPrevented() && document()->frame()) {
-            KURL url = document()->completeURL(deprecatedParseURL(getAttribute(HTMLNames::hrefAttr)));
-            document()->frame()->loader()->urlSelected(url, target(), event, false, false, true);
+            String url = document()->completeURL(deprecatedParseURL(getAttribute(HTMLNames::hrefAttr)));
+            document()->frame()->loader()->urlSelected(url, target(), event, false, false, true, SendReferrer);
         }
 
         event->setDefaultHandled();
diff --git a/WebCore/wml/WMLInputElement.cpp b/WebCore/wml/WMLInputElement.cpp
index b027bf0..eb31502 100644
--- a/WebCore/wml/WMLInputElement.cpp
+++ b/WebCore/wml/WMLInputElement.cpp
@@ -280,13 +280,13 @@ void WMLInputElement::defaultEventHandler(Event* evt)
     if (clickDefaultFormButton) {
         // Fire onChange for text fields.
         RenderObject* r = renderer();
-        if (r && toRenderTextControl(r)->isEdited()) {
-            dispatchEvent(eventNames().changeEvent, true, false);
+        if (r && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
+            dispatchEvent(Event::create(eventNames().changeEvent, true, false));
             
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
             if (r)
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         evt->setDefaultHandled();
diff --git a/WebCore/workers/DefaultSharedWorkerRepository.cpp b/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 8b1a480..655b90e 100644
--- a/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -73,8 +73,8 @@ public:
     bool matches(const String& name, PassRefPtr<SecurityOrigin> origin, const KURL& urlToMatch) const;
 
     // WorkerLoaderProxy
-    virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
-    virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String&);
+    virtual void postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task>);
+    virtual void postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task>, const String&);
 
     // WorkerReportingProxy
     virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
@@ -128,7 +128,7 @@ bool SharedWorkerProxy::matches(const String& name, PassRefPtr<SecurityOrigin> o
     return name == m_name;
 }
 
-void SharedWorkerProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
+void SharedWorkerProxy::postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
     MutexLocker lock(m_workerDocumentsLock);
 
@@ -144,7 +144,7 @@ void SharedWorkerProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task
     document->postTask(task);
 }
 
-void SharedWorkerProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+void SharedWorkerProxy::postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     if (isClosing())
         return;
@@ -221,9 +221,9 @@ void SharedWorkerProxy::close()
 
 class SharedWorkerConnectTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<SharedWorkerConnectTask> create(PassOwnPtr<MessagePortChannel> channel)
+    static PassOwnPtr<SharedWorkerConnectTask> create(PassOwnPtr<MessagePortChannel> channel)
     {
-        return adoptRef(new SharedWorkerConnectTask(channel));
+        return new SharedWorkerConnectTask(channel);
     }
 
 private:
diff --git a/WebCore/workers/GenericWorkerTask.h b/WebCore/workers/GenericWorkerTask.h
index d6a9994..27694c4 100644
--- a/WebCore/workers/GenericWorkerTask.h
+++ b/WebCore/workers/GenericWorkerTask.h
@@ -70,9 +70,9 @@ namespace WebCore {
         typedef GenericWorkerTask1<P1, MP1> GenericWorkerTask;
         typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1));
+            return new GenericWorkerTask(method, parameter1);
         }
 
     private:
@@ -100,9 +100,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
         typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2));
+            return new GenericWorkerTask(method, parameter1, parameter2);
         }
 
     private:
@@ -133,9 +133,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
         typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3);
         }
 
     private:
@@ -169,9 +169,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
         typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4);
         }
 
     private:
@@ -208,9 +208,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
         typedef typename GenericWorkerTaskTraits<P5>::ParamType Param5;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5);
         }
 
     private:
@@ -250,9 +250,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P5>::ParamType Param5;
         typedef typename GenericWorkerTaskTraits<P6>::ParamType Param6;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6);
         }
 
     private:
@@ -295,9 +295,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P6>::ParamType Param6;
         typedef typename GenericWorkerTaskTraits<P7>::ParamType Param7;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7);
         }
 
     private:
@@ -343,9 +343,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P7>::ParamType Param7;
         typedef typename GenericWorkerTaskTraits<P8>::ParamType Param8;
         
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7, Param8 parameter8)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7, Param8 parameter8)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7, parameter8));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7, parameter8);
         }
         
     private:
@@ -380,7 +380,7 @@ namespace WebCore {
     };
 
     template<typename P1, typename MP1>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1),
         const P1& parameter1)
     {
@@ -390,7 +390,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2),
         const P1& parameter1, const P2& parameter2)
     {
@@ -400,7 +400,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3),
         const P1& parameter1, const P2& parameter2, const P3& parameter3)
     {
@@ -411,7 +411,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4)
     {
@@ -423,7 +423,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5)
     {
@@ -436,7 +436,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6)
     {
@@ -449,7 +449,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6, typename P7, typename MP7>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6, MP7),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6, const P7& parameter7)
     {
@@ -464,7 +464,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6, typename P7, typename MP7, typename P8, typename MP8>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
                                                                 void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6, MP7, MP8),
                                                                 const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6, const P7& parameter7, const P8& parameter8)
     {
diff --git a/WebCore/workers/WorkerContext.cpp b/WebCore/workers/WorkerContext.cpp
index 9a88309..e823278 100644
--- a/WebCore/workers/WorkerContext.cpp
+++ b/WebCore/workers/WorkerContext.cpp
@@ -162,7 +162,7 @@ void WorkerContext::scriptImported(unsigned long, const String&)
     notImplemented();
 }
 
-void WorkerContext::postTask(PassRefPtr<Task> task)
+void WorkerContext::postTask(PassOwnPtr<Task> task)
 {
     thread()->runLoop().postTask(task);
 }
diff --git a/WebCore/workers/WorkerContext.h b/WebCore/workers/WorkerContext.h
index 9725cf7..f37d42c 100644
--- a/WebCore/workers/WorkerContext.h
+++ b/WebCore/workers/WorkerContext.h
@@ -74,7 +74,7 @@ namespace WebCore {
         virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
         virtual void scriptImported(unsigned long identifier, const String& sourceString);
 
-        virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
+        virtual void postTask(PassOwnPtr<Task>); // Executes the task on context's thread asynchronously.
 
         // WorkerGlobalScope
         WorkerContext* self() { return this; }
diff --git a/WebCore/workers/WorkerLoaderProxy.h b/WebCore/workers/WorkerLoaderProxy.h
index ac7cda1..fe1bf51 100644
--- a/WebCore/workers/WorkerLoaderProxy.h
+++ b/WebCore/workers/WorkerLoaderProxy.h
@@ -34,7 +34,7 @@
 #if ENABLE(WORKERS)
 
 #include "ScriptExecutionContext.h"
-#include <wtf/PassRefPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -50,11 +50,11 @@ namespace WebCore {
         virtual ~WorkerLoaderProxy() { }
 
         // Posts a task to the thread which runs the loading code (normally, the main thread).
-        virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>) = 0;
+        virtual void postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task>) = 0;
 
         // Posts callbacks from loading code to the WorkerContext. The 'mode' is used to differentiate
         // specific synchronous loading requests so they can be 'nested', per spec.
-        virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode) = 0;
+        virtual void postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task>, const String& mode) = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerMessagingProxy.cpp b/WebCore/workers/WorkerMessagingProxy.cpp
index 0b66694..2e1dfe0 100644
--- a/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/WebCore/workers/WorkerMessagingProxy.cpp
@@ -46,9 +46,9 @@ namespace WebCore {
 
 class MessageWorkerContextTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+    static PassOwnPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
     {
-        return adoptRef(new MessageWorkerContextTask(message, channels));
+        return new MessageWorkerContextTask(message, channels);
     }
 
 private:
@@ -74,9 +74,9 @@ private:
 
 class MessageWorkerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new MessageWorkerTask(message, channels, messagingProxy));
+        return new MessageWorkerTask(message, channels, messagingProxy);
     }
 
 private:
@@ -105,9 +105,9 @@ private:
 
 class WorkerExceptionTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerExceptionTask> create(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<WorkerExceptionTask> create(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new WorkerExceptionTask(errorMessage, lineNumber, sourceURL, messagingProxy));
+        return new WorkerExceptionTask(errorMessage, lineNumber, sourceURL, messagingProxy);
     }
 
 private:
@@ -141,9 +141,9 @@ private:
 
 class WorkerContextDestroyedTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerContextDestroyedTask> create(WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<WorkerContextDestroyedTask> create(WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new WorkerContextDestroyedTask(messagingProxy));
+        return new WorkerContextDestroyedTask(messagingProxy);
     }
 
 private:
@@ -162,9 +162,9 @@ private:
 
 class WorkerTerminateTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerTerminateTask> create(WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<WorkerTerminateTask> create(WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new WorkerTerminateTask(messagingProxy));
+        return new WorkerTerminateTask(messagingProxy);
     }
 
 private:
@@ -183,9 +183,9 @@ private:
 
 class WorkerThreadActivityReportTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerThreadActivityReportTask> create(WorkerMessagingProxy* messagingProxy, bool confirmingMessage, bool hasPendingActivity)
+    static PassOwnPtr<WorkerThreadActivityReportTask> create(WorkerMessagingProxy* messagingProxy, bool confirmingMessage, bool hasPendingActivity)
     {
-        return adoptRef(new WorkerThreadActivityReportTask(messagingProxy, confirmingMessage, hasPendingActivity));
+        return new WorkerThreadActivityReportTask(messagingProxy, confirmingMessage, hasPendingActivity);
     }
 
 private:
@@ -257,7 +257,7 @@ void WorkerMessagingProxy::postMessageToWorkerContext(PassRefPtr<SerializedScrip
         m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message, channels.release()));
 }
 
-void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     if (m_askedToTerminate)
         return;
@@ -266,7 +266,7 @@ void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecu
     m_workerThread->runLoop().postTaskForMode(task, mode);
 }
 
-void WorkerMessagingProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
+void WorkerMessagingProxy::postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
     // FIXME: In case of nested workers, this should go directly to the root Document context.
     ASSERT(m_scriptExecutionContext->isDocument());
@@ -304,7 +304,7 @@ void WorkerMessagingProxy::workerThreadCreated(PassRefPtr<DedicatedWorkerThread>
         m_workerThreadHadPendingActivity = true; // Worker initialization means a pending activity.
 
         for (unsigned i = 0; i < taskCount; ++i)
-            m_workerThread->runLoop().postTask(m_queuedEarlyTasks[i]);
+            m_workerThread->runLoop().postTask(m_queuedEarlyTasks[i].release());
         m_queuedEarlyTasks.clear();
     }
 }
diff --git a/WebCore/workers/WorkerMessagingProxy.h b/WebCore/workers/WorkerMessagingProxy.h
index 754102a..90b87f4 100644
--- a/WebCore/workers/WorkerMessagingProxy.h
+++ b/WebCore/workers/WorkerMessagingProxy.h
@@ -71,8 +71,8 @@ namespace WebCore {
         // Implementation of WorkerLoaderProxy.
         // These methods are called on different threads to schedule loading
         // requests and to send callbacks back to WorkerContext.
-        virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
-        virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
+        virtual void postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task>);
+        virtual void postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task>, const String& mode);
 
         void workerThreadCreated(PassRefPtr<DedicatedWorkerThread>);
 
@@ -100,7 +100,7 @@ namespace WebCore {
 
         bool m_askedToTerminate;
 
-        Vector<RefPtr<ScriptExecutionContext::Task> > m_queuedEarlyTasks; // Tasks are queued here until there's a thread object created.
+        Vector<OwnPtr<ScriptExecutionContext::Task> > m_queuedEarlyTasks; // Tasks are queued here until there's a thread object created.
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerRunLoop.cpp b/WebCore/workers/WorkerRunLoop.cpp
index 39b21c6..445fa65 100644
--- a/WebCore/workers/WorkerRunLoop.cpp
+++ b/WebCore/workers/WorkerRunLoop.cpp
@@ -64,27 +64,6 @@ private:
     double m_nextFireTime;
 };
 
-class WorkerRunLoop::Task : public RefCounted<Task> {
-public:
-    static PassRefPtr<Task> create(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
-    {
-        return adoptRef(new Task(task, mode));
-    }
-
-    const String& mode() const { return m_mode; }
-    void performTask(ScriptExecutionContext* context) { m_task->performTask(context); }
-
-private:
-    Task(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
-        : m_task(task)
-        , m_mode(mode.crossThreadString())
-    {
-    }
-
-    RefPtr<ScriptExecutionContext::Task> m_task;
-    String m_mode;
-};
-
 class ModePredicate {
 public:
     ModePredicate(const String& mode)
@@ -98,7 +77,7 @@ public:
         return m_defaultMode;
     }
 
-    bool operator()(PassRefPtr<WorkerRunLoop::Task> task) const
+    bool operator()(WorkerRunLoop::Task* task) const
     {
         return m_defaultMode || m_mode == task->mode();
     }
@@ -169,9 +148,9 @@ MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const Mo
     ASSERT(context->thread());
     ASSERT(context->thread()->threadID() == currentThread());
 
-    double absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<RefPtr<Task> >::infiniteTime();
-    RefPtr<Task> task;
-    MessageQueueWaitResult result = m_messageQueue.waitForMessageFilteredWithTimeout(task, predicate, absoluteTime);
+    double absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<Task>::infiniteTime();
+    MessageQueueWaitResult result;
+    OwnPtr<WorkerRunLoop::Task> task = m_messageQueue.waitForMessageFilteredWithTimeout(result, predicate, absoluteTime);
 
     // If the context is closing, don't dispatch any further tasks (per section 4.1.1 of the Web Workers spec).
     if (context->isClosing())
@@ -198,16 +177,33 @@ void WorkerRunLoop::terminate()
     m_messageQueue.kill();
 }
 
-void WorkerRunLoop::postTask(PassRefPtr<ScriptExecutionContext::Task> task)
+void WorkerRunLoop::postTask(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
     postTaskForMode(task, defaultMode());
 }
 
-void WorkerRunLoop::postTaskForMode(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+void WorkerRunLoop::postTaskForMode(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     m_messageQueue.append(Task::create(task, mode.crossThreadString()));
 }
 
+PassOwnPtr<WorkerRunLoop::Task> WorkerRunLoop::Task::create(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
+{
+    return new Task(task, mode);
+}
+
+void WorkerRunLoop::Task::performTask(ScriptExecutionContext* context)
+{
+    m_task->performTask(context);
+}
+
+WorkerRunLoop::Task::Task(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
+    : m_task(task)
+    , m_mode(mode.crossThreadString())
+{
+}
+
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/WebCore/workers/WorkerRunLoop.h b/WebCore/workers/WorkerRunLoop.h
index 5f74f01..9d4edfd 100644
--- a/WebCore/workers/WorkerRunLoop.h
+++ b/WebCore/workers/WorkerRunLoop.h
@@ -36,7 +36,7 @@
 #include "ScriptExecutionContext.h"
 #include <wtf/MessageQueue.h>
 #include <wtf/OwnPtr.h>
-#include <wtf/PassRefPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -58,18 +58,32 @@ namespace WebCore {
         void terminate();
         bool terminated() { return m_messageQueue.killed(); }
 
-        void postTask(PassRefPtr<ScriptExecutionContext::Task>);
-        void postTaskForMode(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
+        void postTask(PassOwnPtr<ScriptExecutionContext::Task>);
+        void postTaskForMode(PassOwnPtr<ScriptExecutionContext::Task>, const String& mode);
 
         unsigned long createUniqueId() { return ++m_uniqueId; }
 
         static String defaultMode();
-        class Task;
+
+        class Task : public Noncopyable {
+        public:
+            static PassOwnPtr<Task> create(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode);
+            ~Task() { }
+            const String& mode() const { return m_mode; }
+            void performTask(ScriptExecutionContext* context);
+
+        private:
+            Task(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode);
+        
+            OwnPtr<ScriptExecutionContext::Task> m_task;
+            String m_mode;
+        };
+
     private:
         friend class RunLoopSetup;
         MessageQueueWaitResult runInMode(WorkerContext*, const ModePredicate&);
 
-        MessageQueue<RefPtr<Task> > m_messageQueue;
+        MessageQueue<Task> m_messageQueue;
         OwnPtr<WorkerSharedTimer> m_sharedTimer;
         int m_nestedCount;
         unsigned long m_uniqueId;
diff --git a/WebCore/wscript b/WebCore/wscript
index 3719b84..1ad8e90 100644
--- a/WebCore/wscript
+++ b/WebCore/wscript
@@ -30,30 +30,41 @@ from settings import *
 webcore_sources = {}
 
 if build_port == "wx":
-    webcore_sources['plugins'] = [  'plugins/PluginDataNone.cpp',
-                                    'plugins/PluginViewNone.cpp'
-                                  ]
-    
     if building_on_win32:
-        webcore_dirs.append('platform/wx/wxcode/win')
+        webcore_dirs.extend(['platform/wx/wxcode/win', 'plugins/win'])
         webcore_sources['wx-win'] = [
                # wxTimer on Windows has a bug that causes it to eat crashes in callbacks
                # so we need to use the Win port's implementation until the wx bug fix is
                # widely available (it was fixed in 2.8.10).
                'platform/win/SharedTimerWin.cpp',
+               # Use the Windows plugin architecture
                'page/win/PageWin.cpp',
+               'plugins/win/PluginDataWin.cpp',
+               'plugins/win/PluginDatabaseWin.cpp',
+               'plugins/win/PluginMessageThrottlerWin.cpp',
                'plugins/win/PluginPackageWin.cpp',
+               'plugins/win/PluginViewWin.cpp',
         ]
     elif sys.platform.startswith('darwin'):
+        webcore_dirs.append('plugins/mac')
         webcore_dirs.append('platform/wx/wxcode/mac/carbon')
+        webcore_dirs.append('platform/mac')
         webcore_sources['wx-mac'] = [
+               'platform/mac/WebCoreNSStringExtras.mm',
                'platform/mac/PurgeableBufferMac.cpp',
+               'plugins/wx/PluginDataWx.cpp',
+               'plugins/mac/PluginPackageMac.cpp',
+               'plugins/mac/PluginViewMac.cpp'
         ]
-        webcore_sources['plugins'].append('plugins/PluginPackageNone.cpp')
     else:
+        webcore_sources['wx-gtk'] = [
+               'plugins/PluginDataNone.cpp',
+               'plugins/PluginViewNone.cpp',
+               'plugins/PluginPackageNone.cpp'
+        ]
         webcore_dirs.append('platform/wx/wxcode/gtk')
-        webcore_sources['plugins'].append('plugins/PluginPackageNone.cpp')
         
+import TaskGen
 from TaskGen import taskgen, feature, after
 import Task, ccroot
 
@@ -81,7 +92,9 @@ def configure(conf):
 
 def build(bld):
     import Options
-
+    if sys.platform.startswith('darwin'):
+        TaskGen.task_gen.mappings['.mm'] = TaskGen.task_gen.mappings['.cxx']
+    
     wk_includes = ['.', '..', 'DerivedSources',
                 wk_root, 
                 os.path.join(wk_root, 'JavaScriptCore'),
@@ -92,8 +105,14 @@ def build(bld):
         ]
 
     features = [build_port]
+    exclude_patterns = ['*None.cpp', '*CFNet.cpp', '*Qt.cpp', '*Win.cpp', '*Wince.cpp', '*Gtk.cpp', '*Mac.cpp', '*Safari.cpp', '*Chromium*.cpp','*SVG*.cpp', '*AllInOne.cpp', 'test*bindings.*']
     if build_port == 'wx':
         features.append('curl')
+        
+    if sys.platform.startswith('darwin'):
+        features.append('cf')
+    else:
+        exclude_patterns.append('*CF.cpp')
 
     full_dirs = get_dirs_for_features(webcore_dir, features=features, dirs=webcore_dirs)
 
@@ -123,8 +142,9 @@ def build(bld):
         )
         
     excludes = []
+    
     if build_port == 'wx':
-        excludes = get_excludes(webcore_dir, ['*None.cpp', '*CF.cpp', '*Qt.cpp', '*Win.cpp', '*Wince.cpp', '*Gtk.cpp', '*Mac.cpp', '*Safari.cpp', '*Chromium*.cpp','*SVG*.cpp', '*AllInOne.cpp', 'test*bindings.*'])
+        excludes = get_excludes(webcore_dir, exclude_patterns)
         excludes.extend(['UserStyleSheetLoader.cpp', 'RenderMediaControls.cpp'])
 
 
@@ -145,5 +165,8 @@ def build(bld):
         excludes.append('JSInspectorController.cpp')
         if building_on_win32:
             excludes.append('SharedTimerWx.cpp')
+            
+        excludes.append('AuthenticationCF.cpp')
+        excludes.append('LoaderRunLoopCF.cpp')
         
     webcore.find_sources_in_dirs(full_dirs, excludes = excludes, exts=['.c', '.cpp'])
diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index 87a6540..f1a7969 100644
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -59,7 +59,7 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter xmlHttpRequestCounter("XMLHttpRequest");
 #endif
 
-struct XMLHttpRequestStaticData {
+struct XMLHttpRequestStaticData : Noncopyable {
     XMLHttpRequestStaticData();
     String m_proxyHeaderPrefix;
     String m_secHeaderPrefix;
@@ -253,27 +253,30 @@ void XMLHttpRequest::callReadyStateChangeListener()
 
 #if ENABLE(INSPECTOR)
     InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
-    if (timelineAgent)
+    bool callTimelineAgentOnReadyStateChange = timelineAgent && hasEventListeners(eventNames().readystatechangeEvent);
+    if (callTimelineAgentOnReadyStateChange)
         timelineAgent->willChangeXHRReadyState(m_url.string(), m_state);
 #endif
 
     dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent));
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (callTimelineAgentOnReadyStateChange && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))
         timelineAgent->didChangeXHRReadyState();
 #endif
 
     if (m_state == DONE && !m_error) {
 #if ENABLE(INSPECTOR)
-        if (timelineAgent)
+        timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
+        bool callTimelineAgentOnLoad = timelineAgent && hasEventListeners(eventNames().loadEvent);
+        if (callTimelineAgentOnLoad)
             timelineAgent->willLoadXHR(m_url.string());
 #endif
 
         dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
 
 #if ENABLE(INSPECTOR)
-        if (timelineAgent)
+        if (callTimelineAgentOnLoad && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))
             timelineAgent->didLoadXHR();
 #endif
     }
@@ -629,8 +632,9 @@ void XMLHttpRequest::dropProtection()
     // out. But it is protected from GC while loading, so this
     // can't be recouped until the load is done, so only
     // report the extra cost at that point.
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*scriptExecutionContext()->globalData(), this))
-        JSC::Heap::heap(wrapper)->reportExtraMemoryCost(m_responseText.size() * 2);
+    JSC::JSGlobalData* globalData = scriptExecutionContext()->globalData();
+    if (hasCachedDOMObjectWrapper(globalData, this))
+        globalData->heap.reportExtraMemoryCost(m_responseText.size() * 2);
 #endif
 
     unsetPendingActivity(this);
diff --git a/WebCore/xml/XMLHttpRequest.h b/WebCore/xml/XMLHttpRequest.h
index c7e0192..69019a5 100644
--- a/WebCore/xml/XMLHttpRequest.h
+++ b/WebCore/xml/XMLHttpRequest.h
@@ -35,7 +35,7 @@ namespace WebCore {
 
 class Document;
 class File;
-struct ResourceRequest;
+class ResourceRequest;
 class TextResourceDecoder;
 class ThreadableLoader;
 
diff --git a/WebCore/xml/XPathExpressionNode.h b/WebCore/xml/XPathExpressionNode.h
index 74b134e..38070b9 100644
--- a/WebCore/xml/XPathExpressionNode.h
+++ b/WebCore/xml/XPathExpressionNode.h
@@ -39,7 +39,7 @@ namespace WebCore {
 
     namespace XPath {
         
-        struct EvaluationContext {
+        struct EvaluationContext : FastAllocBase {
             RefPtr<Node> node;
             unsigned long size;
             unsigned long position;
diff --git a/WebCore/xml/XPathNodeSet.h b/WebCore/xml/XPathNodeSet.h
index 1130488..d5c47be 100644
--- a/WebCore/xml/XPathNodeSet.h
+++ b/WebCore/xml/XPathNodeSet.h
@@ -37,7 +37,7 @@ namespace WebCore {
 
     namespace XPath {
 
-        class NodeSet {
+        class NodeSet : public FastAllocBase {
         public:
             NodeSet() : m_isSorted(true), m_subtreesAreDisjoint(false) { }
             
diff --git a/WebCore/xml/XPathStep.cpp b/WebCore/xml/XPathStep.cpp
index 411b616..e5f2048 100644
--- a/WebCore/xml/XPathStep.cpp
+++ b/WebCore/xml/XPathStep.cpp
@@ -193,9 +193,13 @@ static inline bool nodeMatchesBasicTest(Node* node, Step::Axis axis, const Step:
             if (name == starAtom)
                 return namespaceURI.isEmpty() || namespaceURI == node->namespaceURI();
 
-            if (node->isHTMLElement() && node->document()->isHTMLDocument()) {
-                // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace. Names are compared case-insensitively.
-                return equalIgnoringCase(static_cast<Element*>(node)->localName(), name) && (namespaceURI.isNull() || namespaceURI == node->namespaceURI());
+            if (node->document()->isHTMLDocument()) {
+                if (node->isHTMLElement()) {
+                    // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace. Names are compared case-insensitively.
+                    return equalIgnoringCase(static_cast<Element*>(node)->localName(), name) && (namespaceURI.isNull() || namespaceURI == node->namespaceURI());
+                }
+                // An expression without any prefix shouldn't match no-namespace nodes (because HTML5 says so).
+                return static_cast<Element*>(node)->hasLocalName(name) && namespaceURI == node->namespaceURI() && !namespaceURI.isNull();
             }
             return static_cast<Element*>(node)->hasLocalName(name) && namespaceURI == node->namespaceURI();
         }
diff --git a/WebCore/xml/XPathStep.h b/WebCore/xml/XPathStep.h
index 11612e9..ec022b3 100644
--- a/WebCore/xml/XPathStep.h
+++ b/WebCore/xml/XPathStep.h
@@ -49,7 +49,7 @@ namespace WebCore {
                 SelfAxis
             };
             
-            class NodeTest {
+            class NodeTest : public FastAllocBase {
             public:
                 enum Kind {
                     TextNodeTest, CommentNodeTest, ProcessingInstructionNodeTest, AnyNodeTest, NameTest
diff --git a/WebKit/ChangeLog b/WebKit/ChangeLog
index 5006da7..90a6a28 100644
--- a/WebKit/ChangeLog
+++ b/WebKit/ChangeLog
@@ -1,3 +1,125 @@
+2009-11-30  Mark Rowe  <mrowe@apple.com>
+
+        Use the correct path to Info.plist to avoid creating an empty file at the top of the WebKit directory.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * chromium/features.gypi:
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-11-20  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt and Jon Honeycutt.
+
+        Add support for WebSerializedJSValue to WebKit.  This object wraps the SerializedScriptValue functionality in WebCore
+        and exposes the ability to do JS value serialization/deserialization to WebKit clients.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for 'math' role
+        https://bugs.webkit.org/show_bug.cgi?id=31706
+
+        * English.lproj/Localizable.strings:
+        * StringsNotToBeLocalized.txt:
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        * English.lproj/Localizable.strings:
+            Add strings for toggle captions button.
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        * English.lproj/Localizable.strings: new localizable strings
+
+2009-11-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Make the Mac Geolocation API async.
+
+        * WebKit.xcodeproj/project.pbxproj: Remove WebGeolocation.
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Add WebFrameLoadDelegatePrivat.h to WebKit.xcodeproj
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Reviewed by Dave Hyatt.
+
+        * WebKit.xcodeproj/project.pbxproj: Added
+        WebFrameLoadDelegatePrivate.h, which already existed.
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        * WebKit.xcodeproj/project.pbxproj: Added WebScriptWorld to the project.
+
+2009-11-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA: add alert type roles
+        https://bugs.webkit.org/show_bug.cgi?id=31392
+
+        * English.lproj/Localizable.strings:
+        * StringsNotToBeLocalized.txt:
+
+2009-11-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by John Sullivan and Mark Rowe.
+
+        <rdar://problem/7356733> Voiceover does not read correct media controller time values
+        
+        Fix localized strings for media controller time values.
+
+        * English.lproj/Localizable.strings:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Support ARIA "tab" roles
+        https://bugs.webkit.org/show_bug.cgi?id=30842
+
+        Add a localizable string for tab panel.
+
+        * English.lproj/Localizable.strings:
+        * StringsNotToBeLocalized.txt:
+
 2009-10-27  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
diff --git a/WebKit/English.lproj/Localizable.strings b/WebKit/English.lproj/Localizable.strings
index e4a172b..fb857f5 100644
--- a/WebKit/English.lproj/Localizable.strings
+++ b/WebKit/English.lproj/Localizable.strings
diff --git a/WebKit/StringsNotToBeLocalized.txt b/WebKit/StringsNotToBeLocalized.txt
index 3f1964d..90b29be 100644
--- a/WebKit/StringsNotToBeLocalized.txt
+++ b/WebKit/StringsNotToBeLocalized.txt
@@ -96,12 +96,16 @@
 "@"
 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."
 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+.-"
+"ARIAApplicationAlert"
+"ARIAApplicationAlertDialog"
+"ARIAApplicationDialog"
 "ARIAApplicationLog"
 "ARIAApplicationMarquee"
 "ARIAApplicationStatus"
 "ARIAApplicationTimer"
 "ARIADocument"
 "ARIADocumentArticle"
+"ARIADocumentMath"
 "ARIADocumentNote"
 "ARIADocumentRegion"
 "ARIALandmarkApplication"
@@ -111,6 +115,7 @@
 "ARIALandmarkMain"
 "ARIALandmarkNavigation"
 "ARIALandmarkSearch"
+"ARIATabPanel"
 "ARIAUserInterfaceTooltip"
 "AXEnhancedUserInterface"
 "AccessibleBase"
diff --git a/WebKit/WebKit.xcodeproj/project.pbxproj b/WebKit/WebKit.xcodeproj/project.pbxproj
index a5a2e39..de8c687 100644
--- a/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -326,6 +326,8 @@
 		ABDDF20D08EB0DDC001E1241 /* WebDownloadInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = ABDDF20C08EB0DDC001E1241 /* WebDownloadInternal.h */; };
 		B6CE5C24100BC5CE00219936 /* WebApplicationCache.mm in Sources */ = {isa = PBXBuildFile; fileRef = B68049720FFBCEC1009F7F62 /* WebApplicationCache.mm */; };
 		B6CE5C25100BC5F500219936 /* WebApplicationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = B68049710FFBCEC1009F7F62 /* WebApplicationCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC26C69E10B743F400B687ED /* WebSerializedJSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC26C69D10B743F400B687ED /* WebSerializedJSValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC26C6A510B7447A00B687ED /* WebSerializedJSValue.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC26C6A410B7447A00B687ED /* WebSerializedJSValue.mm */; };
 		BC2E464D0FD8A96800A9D9DE /* WebViewData.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2E464B0FD8A96800A9D9DE /* WebViewData.h */; };
 		BC2E464E0FD8A96800A9D9DE /* WebViewData.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC2E464C0FD8A96800A9D9DE /* WebViewData.mm */; };
 		BC542C420FD7766F00D8AB5D /* WebDelegateImplementationCaching.h in Headers */ = {isa = PBXBuildFile; fileRef = BC542C400FD7766F00D8AB5D /* WebDelegateImplementationCaching.h */; };
@@ -333,6 +335,10 @@
 		BC97E7E210963D260010D361 /* WebViewEventHandling.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC97E7E110963D260010D361 /* WebViewEventHandling.mm */; };
 		C0167BF80D7F5DD00028696E /* WebScriptDebugger.h in Headers */ = {isa = PBXBuildFile; fileRef = C0167BF60D7F5DD00028696E /* WebScriptDebugger.h */; };
 		C0167BF90D7F5DD00028696E /* WebScriptDebugger.mm in Sources */ = {isa = PBXBuildFile; fileRef = C0167BF70D7F5DD00028696E /* WebScriptDebugger.mm */; };
+		C0B1F7E810AC8E3100C925D9 /* WebScriptWorld.h in Headers */ = {isa = PBXBuildFile; fileRef = C0B1F7E510AC8E3100C925D9 /* WebScriptWorld.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C0B1F7E910AC8E3100C925D9 /* WebScriptWorld.mm in Sources */ = {isa = PBXBuildFile; fileRef = C0B1F7E610AC8E3100C925D9 /* WebScriptWorld.mm */; };
+		C0B1F7EA10AC8E3100C925D9 /* WebScriptWorldInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = C0B1F7E710AC8E3100C925D9 /* WebScriptWorldInternal.h */; };
+		C0B88E8B10A08F3D00FBB3F5 /* WebFrameLoadDelegatePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = C0B88E8A10A08F3D00FBB3F5 /* WebFrameLoadDelegatePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DD7CDEE70A23BA9E00069928 /* WebTypesInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = DD7CDEE60A23BA9E00069928 /* WebTypesInternal.h */; };
 		DD89682009AA87240097E7F0 /* WebElementDictionary.h in Headers */ = {isa = PBXBuildFile; fileRef = DD89681E09AA87240097E7F0 /* WebElementDictionary.h */; };
 		DD89682109AA87240097E7F0 /* WebElementDictionary.mm in Sources */ = {isa = PBXBuildFile; fileRef = DD89681F09AA87240097E7F0 /* WebElementDictionary.mm */; };
@@ -344,9 +350,6 @@
 		EDE983810BCDF5FE00FDAE28 /* WebNSArrayExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = EDE9837F0BCDF5FE00FDAE28 /* WebNSArrayExtras.m */; };
 		F834AAD70E64B1C700E2737C /* WebTextIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = F834AAD50E64B1C700E2737C /* WebTextIterator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F834AAD80E64B1C700E2737C /* WebTextIterator.mm in Sources */ = {isa = PBXBuildFile; fileRef = F834AAD60E64B1C700E2737C /* WebTextIterator.mm */; };
-		FEF52DFA0F6748F200FF70EE /* WebGeolocation.mm in Sources */ = {isa = PBXBuildFile; fileRef = FEF52DF70F6748F200FF70EE /* WebGeolocation.mm */; };
-		FEF52DFB0F6748F200FF70EE /* WebGeolocationInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = FEF52DF80F6748F200FF70EE /* WebGeolocationInternal.h */; };
-		FEF52DFC0F6748F200FF70EE /* WebGeolocationPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = FEF52DF90F6748F200FF70EE /* WebGeolocationPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 /* End PBXBuildFile section */
 
 /* Begin PBXFileReference section */
@@ -601,6 +604,8 @@
 		ABDDF20C08EB0DDC001E1241 /* WebDownloadInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebDownloadInternal.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		B68049710FFBCEC1009F7F62 /* WebApplicationCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebApplicationCache.h; sourceTree = "<group>"; };
 		B68049720FFBCEC1009F7F62 /* WebApplicationCache.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebApplicationCache.mm; sourceTree = "<group>"; };
+		BC26C69D10B743F400B687ED /* WebSerializedJSValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSerializedJSValue.h; sourceTree = "<group>"; };
+		BC26C6A410B7447A00B687ED /* WebSerializedJSValue.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebSerializedJSValue.mm; sourceTree = "<group>"; };
 		BC2E464B0FD8A96800A9D9DE /* WebViewData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebViewData.h; sourceTree = "<group>"; };
 		BC2E464C0FD8A96800A9D9DE /* WebViewData.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebViewData.mm; sourceTree = "<group>"; };
 		BC542C400FD7766F00D8AB5D /* WebDelegateImplementationCaching.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebDelegateImplementationCaching.h; sourceTree = "<group>"; };
@@ -621,6 +626,10 @@
 		BEE52D4B0473032500CA289C /* WebKitSystemBits.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebKitSystemBits.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		C0167BF60D7F5DD00028696E /* WebScriptDebugger.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebScriptDebugger.h; sourceTree = "<group>"; };
 		C0167BF70D7F5DD00028696E /* WebScriptDebugger.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebScriptDebugger.mm; sourceTree = "<group>"; };
+		C0B1F7E510AC8E3100C925D9 /* WebScriptWorld.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebScriptWorld.h; sourceTree = "<group>"; };
+		C0B1F7E610AC8E3100C925D9 /* WebScriptWorld.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebScriptWorld.mm; sourceTree = "<group>"; };
+		C0B1F7E710AC8E3100C925D9 /* WebScriptWorldInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebScriptWorldInternal.h; sourceTree = "<group>"; };
+		C0B88E8A10A08F3D00FBB3F5 /* WebFrameLoadDelegatePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebFrameLoadDelegatePrivate.h; sourceTree = "<group>"; };
 		DD7CDEE60A23BA9E00069928 /* WebTypesInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebTypesInternal.h; sourceTree = "<group>"; };
 		DD89681E09AA87240097E7F0 /* WebElementDictionary.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebElementDictionary.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		DD89681F09AA87240097E7F0 /* WebElementDictionary.mm */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebElementDictionary.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -694,9 +703,6 @@
 		F834AAD60E64B1C700E2737C /* WebTextIterator.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebTextIterator.mm; sourceTree = "<group>"; };
 		F8CA15B5029A39D901000122 /* WebAuthenticationPanel.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebAuthenticationPanel.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F8CA15B6029A39D901000122 /* WebAuthenticationPanel.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebAuthenticationPanel.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		FEF52DF70F6748F200FF70EE /* WebGeolocation.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebGeolocation.mm; sourceTree = "<group>"; };
-		FEF52DF80F6748F200FF70EE /* WebGeolocationInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebGeolocationInternal.h; sourceTree = "<group>"; };
-		FEF52DF90F6748F200FF70EE /* WebGeolocationPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebGeolocationPrivate.h; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -1103,6 +1109,7 @@
 				F5143A370221DCCE01A80181 /* WebFrame.mm */,
 				930D02BD06275F710076701E /* WebFrameInternal.h */,
 				5152FAE5033FC52200CA2ACD /* WebFrameLoadDelegate.h */,
+				C0B88E8A10A08F3D00FBB3F5 /* WebFrameLoadDelegatePrivate.h */,
 				9CF0E249021361B00ECA16EA /* WebFramePrivate.h */,
 				51A8B52E04282B5900CA2D3A /* WebFrameView.h */,
 				51A8B52F04282B5900CA2D3A /* WebFrameView.mm */,
@@ -1130,6 +1137,11 @@
 				7E6FEF0608985A7200C44C3F /* WebScriptDebugDelegate.mm */,
 				C0167BF60D7F5DD00028696E /* WebScriptDebugger.h */,
 				C0167BF70D7F5DD00028696E /* WebScriptDebugger.mm */,
+				C0B1F7E510AC8E3100C925D9 /* WebScriptWorld.h */,
+				C0B1F7E610AC8E3100C925D9 /* WebScriptWorld.mm */,
+				C0B1F7E710AC8E3100C925D9 /* WebScriptWorldInternal.h */,
+				BC26C6A410B7447A00B687ED /* WebSerializedJSValue.mm */,
+				BC26C69D10B743F400B687ED /* WebSerializedJSValue.h */,
 				936A2DE90FD2D08400D312DB /* WebTextCompletionController.h */,
 				936A2DE70FD2D08000D312DB /* WebTextCompletionController.mm */,
 				F834AAD50E64B1C700E2737C /* WebTextIterator.h */,
@@ -1203,9 +1215,6 @@
 				4BF99F8F0AE050BC00815C2B /* WebEditorClient.mm */,
 				931633EA0AEDFF930062B92D /* WebFrameLoaderClient.h */,
 				931633EE0AEDFFAE0062B92D /* WebFrameLoaderClient.mm */,
-				FEF52DF70F6748F200FF70EE /* WebGeolocation.mm */,
-				FEF52DF80F6748F200FF70EE /* WebGeolocationInternal.h */,
-				FEF52DF90F6748F200FF70EE /* WebGeolocationPrivate.h */,
 				51494CD40C7EBDE0004178C5 /* WebIconDatabaseClient.h */,
 				51494CD50C7EBDE0004178C5 /* WebIconDatabaseClient.mm */,
 				9CE1F8A302A5C6F30ECA2ACD /* WebImageRendererFactory.m */,
@@ -1384,8 +1393,6 @@
 				9398106E0824BF01008DF038 /* WebFrameView.h in Headers */,
 				9398106F0824BF01008DF038 /* WebFrameViewInternal.h in Headers */,
 				939810AF0824BF01008DF038 /* WebFrameViewPrivate.h in Headers */,
-				FEF52DFB0F6748F200FF70EE /* WebGeolocationInternal.h in Headers */,
-				FEF52DFC0F6748F200FF70EE /* WebGeolocationPrivate.h in Headers */,
 				939810120824BF01008DF038 /* WebHistory.h in Headers */,
 				93FDE9330D79CAF30074F029 /* WebHistoryInternal.h in Headers */,
 				939810130824BF01008DF038 /* WebHistoryItem.h in Headers */,
@@ -1513,6 +1520,10 @@
 				0FD3B0F41076C3E900039B96 /* WebVideoFullscreenHUDWindowController.h in Headers */,
 				0FD3B0F81076C3F700039B96 /* WebWindowAnimation.h in Headers */,
 				0A2D87FD107AF52B00CDDEE3 /* WebPluginHalterClient.h in Headers */,
+				C0B1F7E810AC8E3100C925D9 /* WebScriptWorld.h in Headers */,
+				C0B1F7EA10AC8E3100C925D9 /* WebScriptWorldInternal.h in Headers */,
+				C0B88E8B10A08F3D00FBB3F5 /* WebFrameLoadDelegatePrivate.h in Headers */,
+				BC26C69E10B743F400B687ED /* WebSerializedJSValue.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1650,7 +1661,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\ntouch \"$PROJECT_DIR/mac/Info.plist\"\n";
+			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\nif [[ \"${CONFIGURATION}\" != \"Production\" ]]; then\n    touch \"${PROJECT_DIR}/mac/Info.plist\";\nfi;\n";
 		};
 		5DE6D18C0FCF231B002DE28C /* Symlink WebKitPluginHost in to place */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -1764,7 +1775,6 @@
 				939810F20824BF01008DF038 /* WebFrame.mm in Sources */,
 				931633EF0AEDFFAE0062B92D /* WebFrameLoaderClient.mm in Sources */,
 				939811060824BF01008DF038 /* WebFrameView.mm in Sources */,
-				FEF52DFA0F6748F200FF70EE /* WebGeolocation.mm in Sources */,
 				939811130824BF01008DF038 /* WebHistory.mm in Sources */,
 				939810BD0824BF01008DF038 /* WebHistoryItem.mm in Sources */,
 				1AAF5FC00EDE3A92008D883D /* WebHostedNetscapePluginView.mm in Sources */,
@@ -1853,6 +1863,8 @@
 				0FD3B0F91076C3F700039B96 /* WebWindowAnimation.m in Sources */,
 				0A2D87FE107AF52B00CDDEE3 /* WebPluginHalterClient.mm in Sources */,
 				BC97E7E210963D260010D361 /* WebViewEventHandling.mm in Sources */,
+				C0B1F7E910AC8E3100C925D9 /* WebScriptWorld.mm in Sources */,
+				BC26C6A510B7447A00B687ED /* WebSerializedJSValue.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebKit/cf/ChangeLog b/WebKit/cf/ChangeLog
index 27caf1c..1d061fb 100644
--- a/WebKit/cf/ChangeLog
+++ b/WebKit/cf/ChangeLog
@@ -1,3 +1,15 @@
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        * WebCoreSupport/WebInspectorClientCF.cpp:
+        (WebInspectorClient::populateSetting):
+        (WebInspectorClient::storeSetting):
+
 2009-04-20  Steve Falkenburg  <sfalken@apple.com>
 
         Separate JavaScriptCore.dll from WebKit.dll.
diff --git a/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp b/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
index 600d58d..cb47205 100644
--- a/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
+++ b/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
@@ -64,7 +64,7 @@ static inline CFStringRef createKeyForPreferences(const String& key)
     return CFStringCreateWithFormat(0, 0, CFSTR("WebKit Web Inspector Setting - %@"), keyCFString.get());
 }
 
-void WebInspectorClient::populateSetting(const String& key, InspectorController::Setting& setting)
+void WebInspectorClient::populateSetting(const String& key, String* setting)
 {
     RetainPtr<CFStringRef> preferencesKey(AdoptCF, createKeyForPreferences(key));
     RetainPtr<CFPropertyListRef> value(AdoptCF, CFPreferencesCopyAppValue(preferencesKey.get(), kCFPreferencesCurrentApplication));
@@ -74,88 +74,19 @@ void WebInspectorClient::populateSetting(const String& key, InspectorController:
 
     CFTypeID type = CFGetTypeID(value.get());
     if (type == CFStringGetTypeID())
-        setting.set(static_cast<String>(static_cast<CFStringRef>(value.get())));
+        *setting = static_cast<String>(static_cast<CFStringRef>(value.get()));
     else if (type == CFBooleanGetTypeID())
-        setting.set(static_cast<bool>(CFBooleanGetValue(static_cast<CFBooleanRef>(value.get()))));
-    else if (type == CFNumberGetTypeID()) {
-        CFNumberRef number = static_cast<CFNumberRef>(value.get());
-        if (CFNumberIsFloatType(number)) {
-            double doubleNumber = 0.0;
-            CFNumberGetValue(static_cast<CFNumberRef>(value.get()), kCFNumberDoubleType, &doubleNumber);
-            setting.set(doubleNumber);
-        } else {
-            long longNumber = 0;
-            CFNumberGetValue(static_cast<CFNumberRef>(value.get()), kCFNumberLongType, &longNumber);
-            setting.set(longNumber);
-        }
-    } else if (type == CFArrayGetTypeID()) {
-        Vector<String> strings;
-
-        CFArrayRef array = static_cast<CFArrayRef>(value.get());
-        unsigned length = CFArrayGetCount(array);
-        for (unsigned i = 0; i < length; ++i) {
-            CFStringRef string = static_cast<CFStringRef>(CFArrayGetValueAtIndex(array, i));
-            if (CFGetTypeID(string) == CFStringGetTypeID())
-                strings.append(static_cast<String>(static_cast<CFStringRef>(string)));
-        }
-
-        setting.set(strings);
-    } else
-        ASSERT_NOT_REACHED();
+        *setting = static_cast<bool>(CFBooleanGetValue(static_cast<CFBooleanRef>(value.get()))) ? "true" : "false";
+    else
+        *setting = "";
 }
 
-void WebInspectorClient::storeSetting(const String& key, const InspectorController::Setting& setting)
+void WebInspectorClient::storeSetting(const String& key, const String& setting)
 {
     RetainPtr<CFPropertyListRef> objectToStore;
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            ASSERT_NOT_REACHED();
-            break;
-        case InspectorController::Setting::StringType:
-            objectToStore.adoptCF(setting.string().createCFString());
-            break;
-        case InspectorController::Setting::BooleanType:
-            objectToStore = (setting.booleanValue() ? kCFBooleanTrue : kCFBooleanFalse);
-            break;
-
-        case InspectorController::Setting::DoubleType: {
-            double value = setting.doubleValue();
-            objectToStore.adoptCF(CFNumberCreate(0, kCFNumberDoubleType, &value));
-            break;
-        }
-
-        case InspectorController::Setting::IntegerType: {
-            long value = setting.integerValue();
-            objectToStore.adoptCF(CFNumberCreate(0, kCFNumberLongType, &value));
-            break;
-        }
-
-        case InspectorController::Setting::StringVectorType: {
-            const Vector<String>& strings = setting.stringVector();
-            const unsigned length = strings.size();
-
-            RetainPtr<CFMutableArrayRef> array(AdoptCF, CFArrayCreateMutable(0, length, &kCFTypeArrayCallBacks));
-
-            for (unsigned i = 0; i < length; ++i) {
-                RetainPtr<CFStringRef> string(AdoptCF, strings[i].createCFString());
-                CFArraySetValueAtIndex(array.get(), i, string.get());
-            }
-
-            objectToStore = array;
-            break;
-        }
-    }
-
+    objectToStore.adoptCF(setting.createCFString());
     ASSERT(objectToStore);
 
     RetainPtr<CFStringRef> preferencesKey(AdoptCF, createKeyForPreferences(key));
     CFPreferencesSetAppValue(preferencesKey.get(), objectToStore.get(), kCFPreferencesCurrentApplication);
 }
-
-void WebInspectorClient::removeSetting(const String& key)
-{
-    RetainPtr<CFStringRef> preferencesKey(AdoptCF, createKeyForPreferences(key));
-    CFPreferencesSetAppValue(preferencesKey.get(), 0, kCFPreferencesCurrentApplication);
-}
diff --git a/WebKit/chromium/ChangeLog b/WebKit/chromium/ChangeLog
new file mode 100644
index 0000000..d55548b
--- /dev/null
+++ b/WebKit/chromium/ChangeLog
@@ -0,0 +1,3666 @@
+2009-12-10  Mike Belshe  <mike@belshe.com>
+
+        Unreviewed, build fix for chromium.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchWillSendRequest):
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Changed WebGLRenderingContext to synthesize GL errors rather than
+        raising JavaScript exceptions. Removed internal getError() calls
+        after each graphics call. The GraphicsContext3D maintains the
+        synthetic exceptions because only it has complete information
+        about certain conditions requiring them to be raised.
+
+        Based on idea from Ilmari Heikkinen, added create3DDebugContext()
+        to webgl-test.js and changed the WebGL layout tests expecting
+        error conditions to use it. Updated expected.txt files, which now
+        implicitly test the OpenGL error as it is part of the exception's
+        message.
+
+        Added new targeted test covering aspects of synthetic errors as
+        well as regression tests for bugs uncovered during its development.
+
+        Test: fast/canvas/webgl/error-reporting.html
+
+        * src/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3DInternal::reshape):
+        (WebCore::GraphicsContext3DInternal::getError):
+        (WebCore::GraphicsContext3DInternal::synthesizeGLError):
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+
+2009-12-10  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        Fix FrameLoader to use the new ResourceTypes properly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32336
+
+        * public/WebURLRequest.h:
+        (WebKit::WebURLRequest::):
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::setTargetTypeFromLoader):
+        (WebKit::FrameLoaderClientImpl::dispatchWillSendRequest):
+
+2009-12-10  Ilya Tikhonovsky <loislo@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Chromium: Expose devtools agent API for inspector layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32379
+
+        * public/WebDevToolsAgent.h:
+        (WebKit::WebDevToolsAgent::setTimelineProfilingEnabled):
+        (WebKit::WebDevToolsAgent::evaluateInWebInspector):
+
+2009-12-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed, build fix.
+
+        Change forward declaration of WebContextMenuData from class to
+        struct to match its definition. The bug was introduced by
+        http://trac.webkit.org/changeset/51874
+
+        * src/ContextMenuClientImpl.h:
+
+2009-12-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32324
+        [Chromium] Suppress WebFrameClient callbacks from a detached frame.
+
+        This change means that we no longer need the ClientHandle class.
+        FrameLoaderClient::detachedFromParent3() is called on each frame
+        in the frame tree from within frameDetached().
+
+        Test: http/tests/loading/gmail-assert-on-load.html
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::detachedFromParent3):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::create):
+        (WebKit::WebFrameImpl::WebFrameImpl):
+        (WebKit::WebFrameImpl::createChildFrame):
+        * src/WebFrameImpl.h:
+        (WebKit::WebFrameImpl::client):
+        (WebKit::WebFrameImpl::dropClient):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::close):
+
+2009-12-08  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Include clickCount when doing MouseEvent -> WebMouseEvent conversion
+        in Chromium API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32289
+
+        * src/WebInputEventConversion.cpp:
+        (WebKit::WebMouseEventBuilder::WebMouseEventBuilder):
+
+2009-12-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed, build fix.
+
+        Add return statement to default implementation of hostIdentifier method
+        introduced in http://trac.webkit.org/changeset/51897
+
+        * public/WebDevToolsAgentClient.h:
+        (WebKit::WebDevToolsAgentClient::hostIdentifier):
+
+2009-12-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Add declaration of static methods that allow to dispatch
+        DevTools messages on the IO thread and accept WebDevToolsMessageData
+        argument.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32314
+
+        * public/WebDevToolsAgent.h:
+        * public/WebDevToolsAgentClient.h:
+
+2009-12-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Introduce a class for devtools message data
+
+        https://bugs.webkit.org/show_bug.cgi?id=32314
+
+        * WebKit.gyp:
+        * public/WebDevToolsAgent.h:
+        * public/WebDevToolsAgentClient.h:
+        (WebKit::WebDevToolsAgentClient::sendMessageToFrontend):
+        (WebKit::WebDevToolsAgentClient::forceRepaint):
+        (WebKit::WebDevToolsAgentClient::hostIdentifier):
+        (WebKit::WebDevToolsAgentClient::runtimeFeatureStateChanged):
+        * public/WebDevToolsFrontend.h:
+        * public/WebDevToolsFrontendClient.h:
+        (WebKit::WebDevToolsFrontendClient::sendMessageToAgent):
+        * public/WebDevToolsMessageData.h: Added.
+
+2009-12-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: support custom WebCore context menu items in Chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32277
+
+        * public/WebContextMenuData.h:
+        * public/WebPopupMenuInfo.h:
+        (WebKit::WebPopupMenuInfo::Item::):
+        * public/WebView.h:
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::executeCustomContextMenuAction):
+        * src/WebViewImpl.h:
+
+2009-12-08  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix.
+
+        r51859 changed the case for some of the ResourceRequest::TargetType
+        enums.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::determineTargetTypeFromLoader):
+
+2009-12-07  Zhe Su  <suzhe@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] accesskey is not supported on Chromium Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=32213
+
+        This change fixes (partially) the accesskey issue by decoupling the
+        code for handling accesskeys and system keys. Because on Mac,
+        the modifiers of accesskeys are ctrl+alt, which are not marked as
+        system keys.
+        In order to fully fix this issue, some changes in Chromium code is
+        also required.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::keyEvent):
+        (WebKit::WebViewImpl::charEvent):
+
+2009-12-07  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: theme scrollbars to match GTK theme.
+        Add API to set the colors.
+
+        Since the change is to the Chromium WebKit API layer, testing will
+        be in Chromium's test shell.
+        http://bugs.webkit.org/show_bug.cgi?id=32048
+
+        Patch from Markus Gutschke <markus@chromium.org>.
+
+        * public/WebView.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setScrollbarColors):
+        * src/WebViewImpl.h:
+
+2009-12-07  Finnur Thorarinsson  <finnur.webkit@gmail.com>
+
+        Reviewed by Darin Fisher.
+
+        A patch for Chromium to restrict the scope of the Gmail focus fix,
+        where we set the Selection to 0,0 for content-editable fields and
+        also make sure we set the selection end-state for find to select the
+        text found (when not focusing a link we found).
+        WebKit bug: https://bugs.webkit.org/show_bug.cgi?id=32248
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::setFindEndstateFocusAndSelection):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setFocus):
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * features.gypi:
+
+2009-12-07  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        fixes to build-webkit --chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32179
+
+        * DEPS:
+        * WebKit.gyp:
+        * gyp_webkit:
+
+2009-12-07  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [Chromium] Add declarations for DevTools message dispatching on IO thread
+        (see http://codereview.chromium.org/460018)
+
+        https://bugs.webkit.org/show_bug.cgi?id=32217
+
+        * public/WebDevToolsAgent.h:
+        * public/WebDevToolsAgentClient.h:
+
+2009-12-04  James Hawkins  <jhawkins@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32095
+        Implement WebRegularExpression, a WebKit API for accessing
+        WebCore::RegularExpression.
+
+        * WebKit.gyp:
+        * public/WebRegularExpression.h: Added.
+        * public/WebTextCaseSensitivity.h: Added.
+        (WebKit::):
+        * src/AssertMatchingEnums.cpp:
+        * src/WebRegularExpression.cpp: Added.
+        (WebKit::WebRegularExpression::WebRegularExpression):
+        (WebKit::WebRegularExpression::~WebRegularExpression):
+        (WebKit::WebRegularExpression::match):
+
+2009-12-04  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Simplify zoom-related APIs and add a zoom level getter,
+        part two: Remove deprecated APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31893
+
+        * public/WebView.h:
+        * src/WebViewImpl.cpp:
+        * src/WebViewImpl.h:
+
+2009-12-03  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32066 - Add enable geolocation flag to WebCore::Settings for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32066
+
+        Add the plumbing to map WebSettings through to WebCore::Settings
+
+        * features.gypi:
+        * public/WebSettings.h: Add setGeolocationEnabled API to interface
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setGeolocationEnabled): Calls through to WebCore::Settings::setGeolocationEnabled
+        * src/WebSettingsImpl.h: Add setGeolocationEnabled interface function
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchDidPushStateWithinPage):
+        (WebKit::FrameLoaderClientImpl::dispatchDidReplaceStateWithinPage):
+        (WebKit::FrameLoaderClientImpl::dispatchDidPopStateWithinPage):
+        * src/FrameLoaderClientImpl.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Chromium: Add support for settings containing ":"
+
+        https://bugs.webkit.org/show_bug.cgi?id=32118
+
+        * src/InspectorClientImpl.cpp:
+        (WebKit::InspectorClientImpl::loadSettings):
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        * src/InspectorClientImpl.cpp:
+        (WebKit::InspectorClientImpl::hiddenPanels):
+        (WebKit::InspectorClientImpl::populateSetting):
+        (WebKit::InspectorClientImpl::storeSetting):
+        (WebKit::InspectorClientImpl::loadSettings):
+        (WebKit::InspectorClientImpl::saveSettings):
+        * src/InspectorClientImpl.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchDidAddBackForwardItem): Add an empty implementation. Method added to FrameLoaderClient by Android (see bug).
+        (WebKit::FrameLoaderClientImpl::dispatchDidRemoveBackForwardItem): ditto.
+        (WebKit::FrameLoaderClientImpl::dispatchDidChangeBackForwardIndex): dito.
+        * src/FrameLoaderClientImpl.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sanitize web fonts using the OTS library 
+        https://bugs.webkit.org/show_bug.cgi?id=31106
+
+        * DEPS: Added dependency to the OpenType sanitizer library.
+        * features.gypi: Added ENABLE_OPENTYPE_SANITIZER=1.
+
+2009-12-02  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32029
+        Mousewheel event delta has reversed sign on Linux Chrome.
+
+        No new tests (layout tests don't cover event conversion code).
+        Manual test: http://www.switchonthecode.com/tutorials/javascript-tutorial-the-scroll-wheel
+
+        * src/gtk/WebInputEventFactory.cpp:
+        (WebKit::WebInputEventFactory::mouseWheelEvent):
+
+2009-12-02  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Allow to skip thread checks when accessing DOMDataStore for processes
+        which run V8 in single thread mode.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        * src/WebScriptController.cpp:
+        (WebKit::WebScriptController::enableV8SingleThreadMode):
+
+2009-12-01  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Simplify zoom-related APIs and add a zoom level getter,
+        part one: Add new APIs.  (Old APIs will be removed in a second pass.)
+        https://bugs.webkit.org/show_bug.cgi?id=31893
+
+        * public/WebView.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::zoomLevel):
+        (WebKit::WebViewImpl::setZoomLevel):
+        * src/WebViewImpl.h:
+
+2009-12-01  Xiyuan Xia  <xiyuan@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Only fire start/stop events when main frame is not loading.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31838
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchDidChangeLocationWithinPage):
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Add separate method for pause command to WebDevToolsAgent
+        and WebDevToolsFrontendClient interfaces so that pause command
+        can be processed on the IO thread.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31934
+
+        * public/WebDevToolsAgent.h:
+        * public/WebDevToolsFrontendClient.h:
+        (WebKit::WebDevToolsFrontendClient::sendDebuggerCommandToAgent):
+        (WebKit::WebDevToolsFrontendClient::sendDebuggerPauseScript):
+        (WebKit::WebDevToolsFrontendClient::activateWindow):
+        (WebKit::WebDevToolsFrontendClient::closeWindow):
+        (WebKit::WebDevToolsFrontendClient::dockWindow):
+        (WebKit::WebDevToolsFrontendClient::undockWindow):
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebCore part of the fix that allows to view plugin
+        resources loaded by plugins. Methods that for resource
+        loading notifications are exposed through WebDevToolsAgent
+        interface to the glue code to allow Chromium's plugin
+        implementation to notify InspectorController about resource
+        loading in plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * public/WebDevToolsAgent.h:
+        * public/WebView.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::createUniqueIdentifierForRequest):
+        * src/WebViewImpl.h:
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Not reviewed. Build fix: revert r51421.
+
+        * public/WebDevToolsAgent.h:
+        * public/WebView.h:
+        * src/WebViewImpl.cpp:
+        * src/WebViewImpl.h:
+
+2009-11-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Implement canSetValueAttribute in the API.
+        https://bugs.webkit.org/show_bug.cgi?id=31894
+
+        * public/WebAccessibilityObject.h: Added decl.
+        * src/WebAccessibilityCacheImpl.h: Cleaned up mis-include.
+        * src/WebAccessibilityObject.cpp:
+        (WebKit::WebAccessibilityObject::canSetValueAttribute): Added impl.
+
+2009-11-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Plumb setNeedsSiteSpecificQuirks throught WebKit API.
+        https://bugs.webkit.org/show_bug.cgi?id=31878
+
+        * public/WebSettings.h: Added decl.
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setNeedsSiteSpecificQuirks): Added impl.
+        * src/WebSettingsImpl.h:
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * features.gypi:
+
+2009-11-24  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Linux Chromium sends too many click events
+        https://bugs.webkit.org/show_bug.cgi?id=31841
+
+        Manually count number of clicks for double/triple click events. This
+        makes us match Firefox on http://www.quirksmode.org/js/events_mouse.html
+        Chromium side of this patch is here:
+        http://codereview.chromium.org/431031/show
+
+        * src/gtk/WebInputEventFactory.cpp:
+        (WebKit::WebInputEventFactory::mouseEvent):
+
+2009-11-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Renderer hang when using www.expedia.com
+        https://bugs.webkit.org/show_bug.cgi?id=31822
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchWillSendRequest):
+        Assign ReturnCacheDataDontLoad cache policy at the last moment
+        to match Safari.  This way the cache policy does not get stored
+        in DocumentLoader's originalRequest preventing it from being
+        inherited by subresource requests.
+        * src/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache): Remove assignment
+        of ReturnCacheDataDontLoad cache policy so that it doesn't end
+        up applying to the DocumentLoader's originalRequest.
+
+2009-11-23  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Change get... calls to latest spec
+        https://bugs.webkit.org/show_bug.cgi?id=30091
+
+        Removed old versions of get calls on WebGLRenderingContext and
+        added new ones per spec returning "any". New code simplifies
+        GraphicsContext3D and fixes previously unimplemented routines.
+        Added custom JS and V8 bindings. Added exhaustive test case
+        exercising all new code paths. Updated preexisting test cases for
+        new APIs. Fixed preexisting bugs in WebKit's and Chrome's WebGL
+        implementations.
+
+        Ran WebGL layout tests in WebKit (clean) and Chrome (couple of
+        preexisting known failures) and manual WebGL tests in both
+        browsers.
+
+        Test: fast/canvas/webgl/gl-object-get-calls.html
+
+        * src/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::createFramebuffer):
+        (WebCore::GraphicsContext3D::createRenderbuffer):
+        (WebCore::GraphicsContext3D::deleteFramebuffer):
+        (WebCore::GraphicsContext3D::deleteRenderbuffer):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::isFramebuffer):
+        (WebCore::GraphicsContext3D::isRenderbuffer):
+
+2009-11-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: Expose method for reporting user stats
+        to the host. Also includes drive-by default implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31830
+
+        * public/WebKitClient.h:
+
+2009-11-24  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Fix DOM storage layout tests
+        https://bugs.webkit.org/show_bug.cgi?id=31833
+
+        The issue is, essentially, that this code assumes that
+        SecurityOrigin::createString can re-create a SecurityOrigin given
+        the string produced from SecurityOrigin::toString.  This is a bogus
+        assumption in a number of corner cases (e.g., document.domain,
+        @sandbox).  A recent patch (http://trac.webkit.org/changeset/51294)
+        make this assumption further invalid in the case of of file:// URLs.
+
+        The correct fix is for this code to use WebSecurityOrigin objects
+        (and not strings) to represent SecurityOrigin objects.  However, the
+        expert on this code is on vacation, and I don't want to do major
+        surgery here without his involvement.  This patch is a temporary fix
+        to get these tests passing again.  We'll do the right fix once
+        jorlow gets back from vacation.
+
+        Tests: Covered by a number of existing DOM storage tests.
+
+        * src/WebStorageNamespaceImpl.cpp:
+        (WebKit::WebStorageNamespaceImpl::createStorageArea):
+
+2009-11-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium build fix).
+
+        * src/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::createShader):
+
+2009-11-20  Jian Li  <jianli@chromium.org>
+
+        Not reviewed. Fix chromium build.
+
+        * public/WebAccessibilityRole.h:
+        (WebKit::):
+        * src/AssertMatchingEnums.cpp:
+
+2009-11-19  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Make chromium/webkit/glue/FormFieldValues use the WebKit API
+
+        https://bugs.webkit.org/show_bug.cgi?id=31650
+
+        * public/WebElement.h:
+        * public/WebFormElement.h:
+        * public/WebInputElement.h:
+        (WebKit::WebInputElement::):
+        * public/WebNode.h:
+        * src/AssertMatchingEnums.cpp:
+        * src/DOMUtilitiesPrivate.cpp:
+        (WebKit::nameOfInputElement):
+        * src/DOMUtilitiesPrivate.h:
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::autofill):
+        (WebKit::EditorClientImpl::doAutofill):
+        * src/WebFormElement.cpp:
+        (WebKit::WebFormElement::name):
+        (WebKit::WebFormElement::method):
+        (WebKit::WebFormElement::getNamedElements):
+        (WebKit::WebFormElement::getInputElements):
+        * src/WebInputElement.cpp:
+        (WebKit::WebInputElement::isEnabledFormControl):
+        (WebKit::WebInputElement::inputType):
+        (WebKit::WebInputElement::formControlType):
+        (WebKit::WebInputElement::value):
+        (WebKit::WebInputElement::dispatchFormControlChangeEvent):
+        (WebKit::WebInputElement::setSelectionRange):
+        (WebKit::WebInputElement::name):
+        (WebKit::WebInputElement::nameForAutofill):
+        * src/WebNode.cpp:
+        (WebKit::WebNode::frame):
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        * src/LocalizedStrings.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove Chromium port's dependency on some dummy pthreads header
+        files that live in the Chromium repository.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31648
+
+        * DEPS: Remove reference to chromium svn's webkit/build/ directory.
+
+2009-11-18  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Menu button shows wrong content in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=31448
+
+        Make context menu button (VK_APPS) show context menu for node that has
+        keyboard focus. This affects both the content and the positioning.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::sendContextMenuEvent):
+
+2009-11-17  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Minor cleanup in WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=31616
+
+        * public/WebFormElement.h: Add missing WEBKIT_API prefix.
+        * public/WebNode.h: Add missing WEBKIT_API prefix.
+        * src/WebFormElement.cpp:
+        (WebKit::WebFormElement::action): Make action getter const.
+        * src/WebNode.cpp:
+        (WebKit::WebNode::frame): Utilize WebFrameImpl::fromFrame.
+
+2009-11-17  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher, Dmitry Titov.
+
+        Revert r50887, it regressed handling of cmd-left when a text box is focused.
+        https://bugs.webkit.org/show_bug.cgi?id=31566
+
+        * src/mac/WebInputEventFactory.mm:
+        (WebKit::WebInputEventFactory::keyboardEvent):
+
+2009-11-16  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update API of WebGLArray and friends
+        https://bugs.webkit.org/show_bug.cgi?id=31175
+
+        * src/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+
+2009-11-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Correct an error in the previous commit
+
+        * public/WebAccessibilityRole.h: It should be WebAccessibilityRoleDirectory,
+          not WebAccessibilityDirectoryRole.
+
+2009-11-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Bring WebAccessibilityRole up to sync after
+        http://trac.webkit.org/changeset/51007.
+
+        * public/WebAccessibilityRole.h: Added WebAccessibilityRoleDirectory.
+        * src/AssertMatchingEnums.cpp: Added a match between DirectoryRole and
+          WebAccessibilityRoleDirectory.
+
+2009-11-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Rename windowObjectCleared to dispatchDidClearWindowObjectInWorld
+        to catch up http://trac.webkit.org/changeset/50973.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchDidClearWindowObjectInWorld):
+        * src/FrameLoaderClientImpl.h:
+
+2009-11-13  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium WebKit Port to compile as dynamic lib
+
+        https://bugs.webkit.org/show_bug.cgi?id=31478
+
+        * WebKit.gyp:
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Adds a way to get the document element's scrollHeight,
+        which is sort of the moral equivalent to
+        RenderBox::minPrefWidth().
+
+        https://bugs.webkit.org/show_bug.cgi?id=31036
+
+        * public/WebFrame.h: Declare documentElementScrollHeight()
+        * src/WebFrameImpl.h: Ditto
+        * src/WebFrameImpl.cpp: Implement documentElementScrollHeight()
+        (WebKit::WebFrameImpl::documentElementScrollHeight): Return the
+        scroll height of the document element, or zero if there's no
+        documentElement.
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31440
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::exceededDatabaseQuota):
+        * src/DatabaseObserver.cpp: Added.
+        (WebCore::DatabaseObserver::databaseOpened):
+        (WebCore::DatabaseObserver::databaseModified):
+        (WebCore::DatabaseObserver::databaseClosed):
+        * src/WebDatabase.cpp:
+        (WebKit::WebDatabase::name):
+        (WebKit::WebDatabase::displayName):
+        (WebKit::WebDatabase::estimatedSize):
+        (WebKit::WebDatabase::securityOrigin):
+        (WebKit::WebDatabase::updateDatabaseSize):
+        * src/WebSecurityOrigin.cpp:
+        (WebKit::WebSecurityOrigin::toString):
+        (WebKit::WebSecurityOrigin::databaseIdentifier):
+
+2009-11-13  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Rolling Chromium dependencies to match Chromium revision 31834. 
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31445
+
+        * DEPS:
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Renaming some parameters passed to DB-related methods to better
+        indicate their purpose.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31449
+
+        * public/WebKitClient.h:
+        * src/ChromiumBridge.cpp:
+        (WebCore::ChromiumBridge::databaseOpenFile):
+        (WebCore::ChromiumBridge::databaseDeleteFile):
+        (WebCore::ChromiumBridge::databaseGetFileAttributes):
+        (WebCore::ChromiumBridge::databaseGetFileSize):
+
+2009-11-12  Adam Barth  <abarth>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] reload-subframe-object.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=31398
+
+        More closely match FrameLoaderClient.mm.  Turns out we don't want to
+        use MIMETypeRegistry::getMIMETypeForPath because we can't distinguish
+        between application/octet-stream and lack of knowledge of the MIME
+        type.
+
+        Covered by reload-subframe-object.html.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::objectContentType):
+
+2009-11-12  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, Chromium build fix.
+
+        Add new accessibility enum values to Chromium enums from
+        http://trac.webkit.org/changeset/50865 and
+        http://trac.webkit.org/changeset/50883.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31424
+
+        * public/WebAccessibilityRole.h:
+        (WebKit::):
+        * src/AssertMatchingEnums.cpp:
+
+2009-11-12  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Send |keypress()| events for keys with cmd down, like safari.
+        Test: Hit cmd-shift-a on unixpapa.com/js/testkey.html , should show a
+        keypress() event.
+
+        * src/mac/WebInputEventFactory.mm:
+        (WebKit::WebInputEventFactory::keyboardEvent):
+
+2009-11-11  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix.  Will be cleaned up in subsequent patch once we know exaclty what's going on.
+
+        * src/WebBindings.cpp:
+
+2009-11-11  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        SharedWorkerRepository.connect() does not call WebSharedWorkerRepository
+        https://bugs.webkit.org/show_bug.cgi?id=31371
+
+        Test: Unit tests can be enabled downstream when this lands.
+
+        * src/SharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerRepository::connect):
+        Added missing call to WebSharedWorkerRepository.addSharedWorker().
+
+2009-11-11  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Tiny path fixes in Chromium API includes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31369
+
+        * public/linux/WebSandboxSupport.h: Fixed path.
+        * src/WebBindings.cpp: Fixed path.
+
+2009-11-11  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        http://trac.webkit.org/changeset/50811 removed some methods from
+        platform/network/SocketStreamHandleClient.h, so remove them
+        here too.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31360
+
+        * public/WebSocketStreamHandleClient.h:
+        * src/SocketStreamHandle.cpp:
+        (WebCore::SocketStreamHandleInternal::send):
+
+2009-11-11  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove some additional references to dragSourceMovedTo() not
+        needed after http://trac.webkit.org/changeset/50786.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31354
+
+        * public/WebView.h:
+        * src/WebViewImpl.h:
+
+2009-11-11  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove WebViewImpl::dragSourceMovedTo(), as it is no longer
+        needed after http://trac.webkit.org/changeset/50786.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31354
+
+        * src/WebViewImpl.cpp:
+
+2009-11-10  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, Chromium build fix for http://trac.webkit.org/changeset/50760.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::paint):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Modified WebKit.gyp to build the webkit api.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31320
+
+        * README: Added.
+        * WebKit.gyp: Added.
+        * webkit.gyp: Removed.
+
+2009-11-10  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Update references to Canvas 3D classes to use the WebGL prefix
+        introduced in http://trac.webkit.org/changeset/50725.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3DInternal::beginPaint):
+        (WebCore::GraphicsContext3DInternal::bindBuffer):
+        (WebCore::GraphicsContext3DInternal::bindTexture):
+        (WebCore::GraphicsContext3D::beginPaint):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::bindBuffer):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getAttribLocation):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformf):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformi):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::isBuffer):
+        (WebCore::GraphicsContext3D::isFramebuffer):
+        (WebCore::GraphicsContext3D::isProgram):
+        (WebCore::GraphicsContext3D::isRenderbuffer):
+        (WebCore::GraphicsContext3D::isShader):
+        (WebCore::GraphicsContext3D::isTexture):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: WebWorker and friends.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WebWorkerBase.cpp: Added.
+        (WebKit::WorkerWebFrameClient::didCreateDataSource):
+        (WebKit::WorkerWebFrameClient::sharedInstance):
+        (WebKit::WorkerWebFrameClient::WorkerWebFrameClient):
+        (WebKit::initializeWebKitStaticValues):
+        (WebKit::WebWorkerBase::WebWorkerBase):
+        (WebKit::WebWorkerBase::~WebWorkerBase):
+        (WebKit::WebWorkerBase::stopWorkerThread):
+        (WebKit::WebWorkerBase::initializeLoader):
+        (WebKit::WebWorkerBase::dispatchTaskToMainThread):
+        (WebKit::WebWorkerBase::invokeTaskMethod):
+        (WebKit::WebWorkerBase::postMessageToWorkerObject):
+        (WebKit::WebWorkerBase::postMessageTask):
+        (WebKit::WebWorkerBase::postExceptionToWorkerObject):
+        (WebKit::WebWorkerBase::postExceptionTask):
+        (WebKit::WebWorkerBase::postConsoleMessageToWorkerObject):
+        (WebKit::WebWorkerBase::postConsoleMessageTask):
+        (WebKit::WebWorkerBase::confirmMessageFromWorkerObject):
+        (WebKit::WebWorkerBase::confirmMessageTask):
+        (WebKit::WebWorkerBase::reportPendingActivity):
+        (WebKit::WebWorkerBase::reportPendingActivityTask):
+        (WebKit::WebWorkerBase::workerContextClosed):
+        (WebKit::WebWorkerBase::workerContextClosedTask):
+        (WebKit::WebWorkerBase::workerContextDestroyed):
+        (WebKit::WebWorkerBase::workerContextDestroyedTask):
+        (WebKit::WebWorkerBase::postTaskToLoader):
+        (WebKit::WebWorkerBase::postTaskForModeToWorkerContext):
+        * src/WebWorkerBase.h: Added.
+        (WebKit::WebWorkerBase::setWorkerThread):
+        (WebKit::WebWorkerBase::workerThread):
+        * src/WebWorkerClientImpl.cpp: Added.
+        (WebKit::WebWorkerClientImpl::createWorkerContextProxy):
+        (WebKit::WebWorkerClientImpl::WebWorkerClientImpl):
+        (WebKit::WebWorkerClientImpl::~WebWorkerClientImpl):
+        (WebKit::WebWorkerClientImpl::setWebWorker):
+        (WebKit::WebWorkerClientImpl::startWorkerContext):
+        (WebKit::WebWorkerClientImpl::terminateWorkerContext):
+        (WebKit::WebWorkerClientImpl::postMessageToWorkerContext):
+        (WebKit::WebWorkerClientImpl::hasPendingActivity):
+        (WebKit::WebWorkerClientImpl::workerObjectDestroyed):
+        (WebKit::WebWorkerClientImpl::postMessageToWorkerObject):
+        (WebKit::WebWorkerClientImpl::postExceptionToWorkerObject):
+        (WebKit::WebWorkerClientImpl::postConsoleMessageToWorkerObject):
+        (WebKit::WebWorkerClientImpl::confirmMessageFromWorkerObject):
+        (WebKit::WebWorkerClientImpl::reportPendingActivity):
+        (WebKit::WebWorkerClientImpl::workerContextDestroyed):
+        (WebKit::WebWorkerClientImpl::workerContextClosed):
+        (WebKit::WebWorkerClientImpl::startWorkerContextTask):
+        (WebKit::WebWorkerClientImpl::terminateWorkerContextTask):
+        (WebKit::WebWorkerClientImpl::postMessageToWorkerContextTask):
+        (WebKit::WebWorkerClientImpl::workerObjectDestroyedTask):
+        (WebKit::WebWorkerClientImpl::postMessageToWorkerObjectTask):
+        (WebKit::WebWorkerClientImpl::postExceptionToWorkerObjectTask):
+        (WebKit::WebWorkerClientImpl::postConsoleMessageToWorkerObjectTask):
+        (WebKit::WebWorkerClientImpl::confirmMessageFromWorkerObjectTask):
+        (WebKit::WebWorkerClientImpl::reportPendingActivityTask):
+        * src/WebWorkerClientImpl.h: Added.
+        (WebKit::WebWorkerClientImpl::createWorker):
+        (WebKit::WebWorkerClientImpl::notificationPresenter):
+        * src/WebWorkerImpl.cpp: Added.
+        (WebKit::WebWorker::create):
+        (WebKit::WebWorkerImpl::WebWorkerImpl):
+        (WebKit::WebWorkerImpl::~WebWorkerImpl):
+        (WebKit::WebWorkerImpl::commonClient):
+        (WebKit::WebWorkerImpl::postMessageToWorkerContextTask):
+        (WebKit::WebWorkerImpl::startWorkerContext):
+        (WebKit::WebWorkerImpl::terminateWorkerContext):
+        (WebKit::WebWorkerImpl::postMessageToWorkerContext):
+        (WebKit::WebWorkerImpl::workerObjectDestroyed):
+        (WebKit::WebWorkerImpl::clientDestroyed):
+        * src/WebWorkerImpl.h: Added.
+        (WebKit::WebWorkerImpl::client):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: Platform specific files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/gtk/WebFontInfo.cpp: Added.
+        (WebKit::WebFontInfo::familyForChars):
+        * src/gtk/WebInputEventFactory.cpp: Added.
+        (WebKit::gdkEventTimeToWebEventTime):
+        (WebKit::gdkStateToWebEventModifiers):
+        (WebKit::gdkEventToWindowsKeyCode):
+        (WebKit::getControlCharacter):
+        (WebKit::WebInputEventFactory::keyboardEvent):
+        (WebKit::WebInputEventFactory::mouseEvent):
+        (WebKit::WebInputEventFactory::mouseWheelEvent):
+        * src/gtk/WebScreenInfoFactory.cpp: Added.
+        (WebKit::WebScreenInfoFactory::screenInfo):
+        * src/linux/WebFontRendering.cpp: Added.
+        (WebKit::WebFontRendering::setHinting):
+        (WebKit::WebFontRendering::setAntiAlias):
+        (WebKit::WebFontRendering::setSubpixelGlyphs):
+        (WebKit::WebFontRendering::setLCDOrder):
+        (WebKit::WebFontRendering::setLCDOrientation):
+        * src/mac/WebInputEventFactory.mm: Added.
+        (WebKit::isKeyUpEvent):
+        (WebKit::isKeypadEvent):
+        (WebKit::windowsKeyCodeForKeyEvent):
+        (WebKit::textFromEvent):
+        (WebKit::unmodifiedTextFromEvent):
+        (WebKit::keyIdentifierForKeyEvent):
+        (WebKit::modifiersFromEvent):
+        (WebKit::WebInputEventFactory::keyboardEvent):
+        (WebKit::WebInputEventFactory::mouseEvent):
+        (WebKit::WebInputEventFactory::mouseWheelEvent):
+        * src/mac/WebScreenInfoFactory.mm: Added.
+        (WebKit::screenForWindow):
+        (WebKit::toUserSpace):
+        (WebKit::WebScreenInfoFactory::screenInfo):
+        * src/win/WebInputEventFactory.cpp: Added.
+        (WebKit::isKeyPad):
+        (WebKit::WebInputEventFactory::keyboardEvent):
+        (WebKit::GetRelativeCursorPos):
+        (WebKit::WebInputEventFactory::resetLastClickState):
+        (WebKit::WebInputEventFactory::mouseEvent):
+        (WebKit::WebInputEventFactory::mouseWheelEvent):
+        * src/win/WebScreenInfoFactory.cpp: Added.
+        (WebKit::toWebRect):
+        (WebKit::WebScreenInfoFactory::screenInfo):
+        * src/x11/WebScreenInfoFactory.cpp: Added.
+        (WebKit::WebScreenInfoFactory::screenInfo):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Up-streaming Chromium API src files: WrapperResourceRequest and Response
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WrappedResourceRequest.h: Added.
+        (WebKit::WrappedResourceRequest::~WrappedResourceRequest):
+        (WebKit::WrappedResourceRequest::WrappedResourceRequest):
+        (WebKit::WrappedResourceRequest::bind):
+        (WebKit::WrappedResourceRequest::Handle::dispose):
+        * src/WrappedResourceResponse.h: Added.
+        (WebKit::WrappedResourceResponse::~WrappedResourceResponse):
+        (WebKit::WrappedResourceResponse::WrappedResourceResponse):
+        (WebKit::WrappedResourceResponse::bind):
+        (WebKit::WrappedResourceResponse::Handle::dispose):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: StorageStreamHandlers...StorageNamespaceProxy
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/SocketStreamHandle.cpp: Added.
+        (WebCore::SocketStreamHandleInternal::create):
+        (WebCore::SocketStreamHandleInternal::SocketStreamHandleInternal):
+        (WebCore::SocketStreamHandleInternal::~SocketStreamHandleInternal):
+        (WebCore::SocketStreamHandleInternal::connect):
+        (WebCore::SocketStreamHandleInternal::send):
+        (WebCore::SocketStreamHandleInternal::close):
+        (WebCore::SocketStreamHandleInternal::willOpenStream):
+        (WebCore::SocketStreamHandleInternal::didOpenStream):
+        (WebCore::SocketStreamHandleInternal::didSendData):
+        (WebCore::SocketStreamHandleInternal::didReceiveData):
+        (WebCore::SocketStreamHandleInternal::didClose):
+        (WebCore::SocketStreamHandleInternal::didFail):
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+        (WebCore::SocketStreamHandle::didReceiveAuthenticationChallenge):
+        (WebCore::SocketStreamHandle::receivedCredential):
+        (WebCore::SocketStreamHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::SocketStreamHandle::receivedCancellation):
+        * src/StorageAreaProxy.cpp: Added.
+        (WebCore::StorageAreaProxy::StorageAreaProxy):
+        (WebCore::StorageAreaProxy::~StorageAreaProxy):
+        (WebCore::StorageAreaProxy::length):
+        (WebCore::StorageAreaProxy::key):
+        (WebCore::StorageAreaProxy::getItem):
+        (WebCore::StorageAreaProxy::setItem):
+        (WebCore::StorageAreaProxy::removeItem):
+        (WebCore::StorageAreaProxy::clear):
+        (WebCore::StorageAreaProxy::contains):
+        * src/StorageAreaProxy.h: Added.
+        * src/StorageEventDispatcherChromium.cpp: Added.
+        (WebCore::StorageEventDispatcher::dispatch):
+        * src/StorageEventDispatcherImpl.cpp: Added.
+        (WebCore::StorageEventDispatcherImpl::StorageEventDispatcherImpl):
+        (WebCore::StorageEventDispatcherImpl::dispatchStorageEvent):
+        * src/StorageEventDispatcherImpl.h: Added.
+        * src/StorageNamespaceProxy.cpp: Added.
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        (WebCore::StorageNamespaceProxy::StorageNamespaceProxy):
+        (WebCore::StorageNamespaceProxy::~StorageNamespaceProxy):
+        (WebCore::StorageNamespaceProxy::copy):
+        (WebCore::StorageNamespaceProxy::storageArea):
+        (WebCore::StorageNamespaceProxy::close):
+        (WebCore::StorageNamespaceProxy::unlock):
+        * src/StorageNamespaceProxy.h: Added.
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: NotificationPresenterImpl...SharedWorkerRepository
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/NotificationPresenterImpl.cpp: Added.
+        (WebKit::VoidCallbackClient::VoidCallbackClient):
+        (WebKit::VoidCallbackClient::permissionRequestComplete):
+        (WebKit::NotificationPresenterImpl::initialize):
+        (WebKit::NotificationPresenterImpl::isInitialized):
+        (WebKit::NotificationPresenterImpl::show):
+        (WebKit::NotificationPresenterImpl::cancel):
+        (WebKit::NotificationPresenterImpl::notificationObjectDestroyed):
+        (WebKit::NotificationPresenterImpl::checkPermission):
+        (WebKit::NotificationPresenterImpl::requestPermission):
+        * src/NotificationPresenterImpl.h: Added.
+        (WebKit::NotificationPresenterImpl::NotificationPresenterImpl):
+        * src/PlatformMessagePortChannel.cpp: Added.
+        (WebCore::MessagePortChannel::create):
+        (WebCore::MessagePortChannel::createChannel):
+        (WebCore::MessagePortChannel::MessagePortChannel):
+        (WebCore::MessagePortChannel::~MessagePortChannel):
+        (WebCore::MessagePortChannel::entangleIfOpen):
+        (WebCore::MessagePortChannel::disentangle):
+        (WebCore::MessagePortChannel::postMessageToRemote):
+        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::MessagePortChannel::close):
+        (WebCore::MessagePortChannel::isConnectedTo):
+        (WebCore::MessagePortChannel::hasPendingActivity):
+        (WebCore::MessagePortChannel::locallyEntangledPort):
+        (WebCore::PlatformMessagePortChannel::create):
+        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::~PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::createChannel):
+        (WebCore::PlatformMessagePortChannel::messageAvailable):
+        (WebCore::PlatformMessagePortChannel::entangleIfOpen):
+        (WebCore::PlatformMessagePortChannel::disentangle):
+        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::PlatformMessagePortChannel::close):
+        (WebCore::PlatformMessagePortChannel::isConnectedTo):
+        (WebCore::PlatformMessagePortChannel::hasPendingActivity):
+        (WebCore::PlatformMessagePortChannel::setEntangledChannel):
+        (WebCore::PlatformMessagePortChannel::webChannelRelease):
+        * src/PlatformMessagePortChannel.h: Added.
+        * src/ResourceHandle.cpp: Added.
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        (WebCore::ResourceHandleInternal::start):
+        (WebCore::ResourceHandleInternal::cancel):
+        (WebCore::ResourceHandleInternal::setDefersLoading):
+        (WebCore::ResourceHandleInternal::allowStoredCredentials):
+        (WebCore::ResourceHandleInternal::willSendRequest):
+        (WebCore::ResourceHandleInternal::didSendData):
+        (WebCore::ResourceHandleInternal::didReceiveResponse):
+        (WebCore::ResourceHandleInternal::didReceiveData):
+        (WebCore::ResourceHandleInternal::didFinishLoading):
+        (WebCore::ResourceHandleInternal::didFail):
+        (WebCore::ResourceHandle::ResourceHandle):
+        (WebCore::ResourceHandle::create):
+        (WebCore::ResourceHandle::request):
+        (WebCore::ResourceHandle::client):
+        (WebCore::ResourceHandle::setClient):
+        (WebCore::ResourceHandle::setDefersLoading):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::clearAuthentication):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::ResourceHandle::bufferedData):
+        (WebCore::ResourceHandle::loadsBlocked):
+        (WebCore::ResourceHandle::supportsBufferedData):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * src/SharedWorkerRepository.cpp: Added.
+        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::getWebPort):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        (WebCore::SharedWorkerScriptLoader::sendConnect):
+        (WebCore::SharedWorkerScriptLoader::contextDestroyed):
+        (WebCore::SharedWorkerScriptLoader::connected):
+        (WebCore::SharedWorkerRepository::isAvailable):
+        (WebCore::getId):
+        (WebCore::SharedWorkerRepository::connect):
+        (WebCore::SharedWorkerRepository::documentDetached):
+        (WebCore::SharedWorkerRepository::hasSharedWorkers):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: GraphicContext3D...MediaPlaterPrivateChromium
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/GraphicsContext3D.cpp: Added.
+        (WebCore::GraphicsContext3DInternal::):
+        (WebCore::GraphicsContext3DInternal::VertexAttribPointerState::VertexAttribPointerState):
+        (WebCore::tryLoad):
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::~GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::checkError):
+        (WebCore::GraphicsContext3DInternal::makeContextCurrent):
+        (WebCore::GraphicsContext3DInternal::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3DInternal::platformTexture):
+        (WebCore::createTextureObject):
+        (WebCore::GraphicsContext3DInternal::reshape):
+        (WebCore::GraphicsContext3DInternal::flipVertically):
+        (WebCore::GraphicsContext3DInternal::beginPaint):
+        (WebCore::GraphicsContext3DInternal::validateTextureTarget):
+        (WebCore::GraphicsContext3DInternal::validateTextureParameter):
+        (WebCore::GraphicsContext3DInternal::activeTexture):
+        (WebCore::GraphicsContext3DInternal::bindBuffer):
+        (WebCore::GraphicsContext3DInternal::bindTexture):
+        (WebCore::GraphicsContext3DInternal::bufferDataImpl):
+        (WebCore::GraphicsContext3DInternal::disableVertexAttribArray):
+        (WebCore::GraphicsContext3DInternal::enableVertexAttribArray):
+        (WebCore::GraphicsContext3DInternal::vertexAttribPointer):
+        (WebCore::GraphicsContext3DInternal::viewportImpl):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        (WebCore::GraphicsContext3D::checkError):
+        (WebCore::GraphicsContext3D::makeContextCurrent):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::beginPaint):
+        (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::sizeInBytes):
+        (WebCore::GraphicsContext3D::createBuffer):
+        (WebCore::GraphicsContext3D::createFramebuffer):
+        (WebCore::GraphicsContext3D::createProgram):
+        (WebCore::GraphicsContext3D::createRenderbuffer):
+        (WebCore::GraphicsContext3D::createShader):
+        (WebCore::GraphicsContext3D::createTexture):
+        (WebCore::GraphicsContext3D::deleteBuffer):
+        (WebCore::GraphicsContext3D::deleteFramebuffer):
+        (WebCore::GraphicsContext3D::deleteProgram):
+        (WebCore::GraphicsContext3D::deleteRenderbuffer):
+        (WebCore::GraphicsContext3D::deleteShader):
+        (WebCore::GraphicsContext3D::deleteTexture):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::bindBuffer):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::disableVertexAttribArray):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::enableVertexAttribArray):
+        (WebCore::GraphicsContext3D::generateMipmap):
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getAttribLocation):
+        (WebCore::GraphicsContext3D::getBoolean):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteri):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::getFloat):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getInteger):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getString):
+        (WebCore::GraphicsContext3D::getTexParameterf):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteri):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformf):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformi):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+        (WebCore::GraphicsContext3D::getVertexAttribf):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribi):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::isBuffer):
+        (WebCore::GraphicsContext3D::isEnabled):
+        (WebCore::GraphicsContext3D::isFramebuffer):
+        (WebCore::GraphicsContext3D::isProgram):
+        (WebCore::GraphicsContext3D::isRenderbuffer):
+        (WebCore::GraphicsContext3D::isShader):
+        (WebCore::GraphicsContext3D::isTexture):
+        (WebCore::GraphicsContext3D::pixelStorei):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::unmultiplyAlpha):
+        (WebCore::texImage2DHelper):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::viewport):
+        * src/InspectorClientImpl.cpp: Added.
+        (WebKit::InspectorClientImpl::InspectorClientImpl):
+        (WebKit::InspectorClientImpl::~InspectorClientImpl):
+        (WebKit::InspectorClientImpl::inspectorDestroyed):
+        (WebKit::InspectorClientImpl::createPage):
+        (WebKit::InspectorClientImpl::showWindow):
+        (WebKit::InspectorClientImpl::closeWindow):
+        (WebKit::InspectorClientImpl::windowVisible):
+        (WebKit::InspectorClientImpl::attachWindow):
+        (WebKit::InspectorClientImpl::detachWindow):
+        (WebKit::InspectorClientImpl::setAttachedWindowHeight):
+        (WebKit::invalidateNodeBoundingRect):
+        (WebKit::InspectorClientImpl::highlight):
+        (WebKit::InspectorClientImpl::hideHighlight):
+        (WebKit::InspectorClientImpl::inspectedURLChanged):
+        (WebKit::InspectorClientImpl::localizedStringsURL):
+        (WebKit::InspectorClientImpl::hiddenPanels):
+        (WebKit::InspectorClientImpl::populateSetting):
+        (WebKit::InspectorClientImpl::storeSetting):
+        (WebKit::InspectorClientImpl::removeSetting):
+        (WebKit::InspectorClientImpl::inspectorWindowObjectCleared):
+        (WebKit::InspectorClientImpl::loadSettings):
+        (WebKit::InspectorClientImpl::saveSettings):
+        * src/InspectorClientImpl.h: Added.
+        * src/LocalizedStrings.cpp: Added.
+        (WebCore::query):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::multipleFileUploadText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::keygenMenuHighGradeKeySize):
+        (WebCore::keygenMenuMediumGradeKeySize):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::mediaElementLiveBroadcastStateText):
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+        * src/MediaPlayerPrivateChromium.cpp: Added.
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: DOMUtilities...FrameLoaderClientImpl
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/DOMUtilitiesPrivate.cpp: Added.
+        (WebCore::toHTMLElement):
+        (WebKit::toHTMLInputElement):
+        (WebKit::toHTMLLinkElement):
+        (WebKit::toHTMLMetaElement):
+        (WebKit::toHTMLOptionElement):
+        (WebKit::nameOfInputElement):
+        * src/DOMUtilitiesPrivate.h: Added.
+        * src/DragClientImpl.cpp: Added.
+        (WebKit::DragClientImpl::willPerformDragDestinationAction):
+        (WebKit::DragClientImpl::willPerformDragSourceAction):
+        (WebKit::DragClientImpl::actionMaskForDrag):
+        (WebKit::DragClientImpl::dragSourceActionMaskForPoint):
+        (WebKit::DragClientImpl::startDrag):
+        (WebKit::DragClientImpl::createDragImageForLink):
+        (WebKit::DragClientImpl::dragControllerDestroyed):
+        * src/DragClientImpl.h: Added.
+        (WebKit::DragClientImpl::DragClientImpl):
+        * src/EditorClientImpl.cpp: Added.
+        (WebKit::EditorClientImpl::EditorClientImpl):
+        (WebKit::EditorClientImpl::~EditorClientImpl):
+        (WebKit::EditorClientImpl::pageDestroyed):
+        (WebKit::EditorClientImpl::shouldShowDeleteInterface):
+        (WebKit::EditorClientImpl::smartInsertDeleteEnabled):
+        (WebKit::EditorClientImpl::isSelectTrailingWhitespaceEnabled):
+        (WebKit::EditorClientImpl::shouldSpellcheckByDefault):
+        (WebKit::EditorClientImpl::isContinuousSpellCheckingEnabled):
+        (WebKit::EditorClientImpl::toggleContinuousSpellChecking):
+        (WebKit::EditorClientImpl::isGrammarCheckingEnabled):
+        (WebKit::EditorClientImpl::toggleGrammarChecking):
+        (WebKit::EditorClientImpl::spellCheckerDocumentTag):
+        (WebKit::EditorClientImpl::isEditable):
+        (WebKit::EditorClientImpl::shouldBeginEditing):
+        (WebKit::EditorClientImpl::shouldEndEditing):
+        (WebKit::EditorClientImpl::shouldInsertNode):
+        (WebKit::EditorClientImpl::shouldInsertText):
+        (WebKit::EditorClientImpl::shouldDeleteRange):
+        (WebKit::EditorClientImpl::shouldChangeSelectedRange):
+        (WebKit::EditorClientImpl::shouldApplyStyle):
+        (WebKit::EditorClientImpl::shouldMoveRangeAfterDelete):
+        (WebKit::EditorClientImpl::didBeginEditing):
+        (WebKit::EditorClientImpl::respondToChangedSelection):
+        (WebKit::EditorClientImpl::respondToChangedContents):
+        (WebKit::EditorClientImpl::didEndEditing):
+        (WebKit::EditorClientImpl::didWriteSelectionToPasteboard):
+        (WebKit::EditorClientImpl::didSetSelectionTypesForPasteboard):
+        (WebKit::EditorClientImpl::registerCommandForUndo):
+        (WebKit::EditorClientImpl::registerCommandForRedo):
+        (WebKit::EditorClientImpl::clearUndoRedoOperations):
+        (WebKit::EditorClientImpl::canUndo):
+        (WebKit::EditorClientImpl::canRedo):
+        (WebKit::EditorClientImpl::undo):
+        (WebKit::EditorClientImpl::redo):
+        (WebKit::):
+        (WebKit::EditorClientImpl::interpretKeyEvent):
+        (WebKit::EditorClientImpl::handleEditingKeyboardEvent):
+        (WebKit::EditorClientImpl::handleKeyboardEvent):
+        (WebKit::EditorClientImpl::handleInputMethodKeydown):
+        (WebKit::EditorClientImpl::textFieldDidBeginEditing):
+        (WebKit::EditorClientImpl::textFieldDidEndEditing):
+        (WebKit::EditorClientImpl::textDidChangeInTextField):
+        (WebKit::EditorClientImpl::showFormAutofillForNode):
+        (WebKit::EditorClientImpl::autofill):
+        (WebKit::EditorClientImpl::doAutofill):
+        (WebKit::EditorClientImpl::cancelPendingAutofill):
+        (WebKit::EditorClientImpl::onAutofillSuggestionAccepted):
+        (WebKit::EditorClientImpl::doTextFieldCommandFromEvent):
+        (WebKit::EditorClientImpl::textWillBeDeletedInTextField):
+        (WebKit::EditorClientImpl::textDidChangeInTextArea):
+        (WebKit::EditorClientImpl::ignoreWordInSpellDocument):
+        (WebKit::EditorClientImpl::learnWord):
+        (WebKit::EditorClientImpl::checkSpellingOfString):
+        (WebKit::EditorClientImpl::getAutoCorrectSuggestionForMisspelledWord):
+        (WebKit::EditorClientImpl::checkGrammarOfString):
+        (WebKit::EditorClientImpl::updateSpellingUIWithGrammarString):
+        (WebKit::EditorClientImpl::updateSpellingUIWithMisspelledWord):
+        (WebKit::EditorClientImpl::showSpellingUI):
+        (WebKit::EditorClientImpl::spellingUIIsShowing):
+        (WebKit::EditorClientImpl::getGuessesForWord):
+        (WebKit::EditorClientImpl::setInputMethodState):
+        * src/EditorClientImpl.h: Added.
+        (WebKit::EditorClientImpl::):
+        * src/FrameLoaderClientImpl.cpp: Added.
+        (WebKit::):
+        (WebKit::FrameLoaderClientImpl::FrameLoaderClientImpl):
+        (WebKit::FrameLoaderClientImpl::~FrameLoaderClientImpl):
+        (WebKit::FrameLoaderClientImpl::frameLoaderDestroyed):
+        (WebKit::FrameLoaderClientImpl::windowObjectCleared):
+        (WebKit::FrameLoaderClientImpl::documentElementAvailable):
+        (WebKit::FrameLoaderClientImpl::didCreateScriptContextForFrame):
+        (WebKit::FrameLoaderClientImpl::didDestroyScriptContextForFrame):
+        (WebKit::FrameLoaderClientImpl::didCreateIsolatedScriptContext):
+        (WebKit::FrameLoaderClientImpl::didPerformFirstNavigation):
+        (WebKit::FrameLoaderClientImpl::registerForIconNotification):
+        (WebKit::FrameLoaderClientImpl::didChangeScrollOffset):
+        (WebKit::FrameLoaderClientImpl::allowJavaScript):
+        (WebKit::FrameLoaderClientImpl::hasWebView):
+        (WebKit::FrameLoaderClientImpl::hasFrameView):
+        (WebKit::FrameLoaderClientImpl::makeDocumentView):
+        (WebKit::FrameLoaderClientImpl::makeRepresentation):
+        (WebKit::FrameLoaderClientImpl::forceLayout):
+        (WebKit::FrameLoaderClientImpl::forceLayoutForNonHTML):
+        (WebKit::FrameLoaderClientImpl::setCopiesOnScroll):
+        (WebKit::FrameLoaderClientImpl::detachedFromParent2):
+        (WebKit::FrameLoaderClientImpl::detachedFromParent3):
+        (WebKit::FrameLoaderClientImpl::assignIdentifierToInitialRequest):
+        (WebKit::determineTargetTypeFromLoader):
+        (WebKit::FrameLoaderClientImpl::dispatchWillSendRequest):
+        (WebKit::FrameLoaderClientImpl::shouldUseCredentialStorage):
+        (WebKit::FrameLoaderClientImpl::dispatchDidReceiveAuthenticationChallenge):
+        (WebKit::FrameLoaderClientImpl::dispatchDidCancelAuthenticationChallenge):
+        (WebKit::FrameLoaderClientImpl::dispatchDidReceiveResponse):
+        (WebKit::FrameLoaderClientImpl::dispatchDidReceiveContentLength):
+        (WebKit::FrameLoaderClientImpl::dispatchDidFinishLoading):
+        (WebKit::FrameLoaderClientImpl::dispatchDidFailLoading):
+        (WebKit::FrameLoaderClientImpl::dispatchDidFinishDocumentLoad):
+        (WebKit::FrameLoaderClientImpl::dispatchDidLoadResourceFromMemoryCache):
+        (WebKit::FrameLoaderClientImpl::dispatchDidLoadResourceByXMLHttpRequest):
+        (WebKit::FrameLoaderClientImpl::dispatchDidHandleOnloadEvents):
+        (WebKit::FrameLoaderClientImpl::dispatchDidReceiveServerRedirectForProvisionalLoad):
+        (WebKit::FrameLoaderClientImpl::dispatchDidCancelClientRedirect):
+        (WebKit::FrameLoaderClientImpl::dispatchWillPerformClientRedirect):
+        (WebKit::FrameLoaderClientImpl::dispatchDidChangeLocationWithinPage):
+        (WebKit::FrameLoaderClientImpl::dispatchWillClose):
+        (WebKit::FrameLoaderClientImpl::dispatchDidReceiveIcon):
+        (WebKit::FrameLoaderClientImpl::dispatchDidStartProvisionalLoad):
+        (WebKit::FrameLoaderClientImpl::dispatchDidReceiveTitle):
+        (WebKit::FrameLoaderClientImpl::dispatchDidCommitLoad):
+        (WebKit::FrameLoaderClientImpl::dispatchDidFailProvisionalLoad):
+        (WebKit::FrameLoaderClientImpl::dispatchDidFailLoad):
+        (WebKit::FrameLoaderClientImpl::dispatchDidFinishLoad):
+        (WebKit::FrameLoaderClientImpl::dispatchDidFirstLayout):
+        (WebKit::FrameLoaderClientImpl::dispatchDidFirstVisuallyNonEmptyLayout):
+        (WebKit::FrameLoaderClientImpl::dispatchCreatePage):
+        (WebKit::FrameLoaderClientImpl::dispatchShow):
+        (WebKit::shouldTreatAsAttachment):
+        (WebKit::FrameLoaderClientImpl::dispatchDecidePolicyForMIMEType):
+        (WebKit::FrameLoaderClientImpl::dispatchDecidePolicyForNewWindowAction):
+        (WebKit::FrameLoaderClientImpl::dispatchDecidePolicyForNavigationAction):
+        (WebKit::FrameLoaderClientImpl::cancelPolicyCheck):
+        (WebKit::FrameLoaderClientImpl::dispatchUnableToImplementPolicy):
+        (WebKit::FrameLoaderClientImpl::dispatchWillSubmitForm):
+        (WebKit::FrameLoaderClientImpl::dispatchDidLoadMainResource):
+        (WebKit::FrameLoaderClientImpl::revertToProvisionalState):
+        (WebKit::FrameLoaderClientImpl::setMainDocumentError):
+        (WebKit::FrameLoaderClientImpl::postProgressStartedNotification):
+        (WebKit::FrameLoaderClientImpl::postProgressEstimateChangedNotification):
+        (WebKit::FrameLoaderClientImpl::postProgressFinishedNotification):
+        (WebKit::FrameLoaderClientImpl::setMainFrameDocumentReady):
+        (WebKit::FrameLoaderClientImpl::startDownload):
+        (WebKit::FrameLoaderClientImpl::willChangeTitle):
+        (WebKit::FrameLoaderClientImpl::didChangeTitle):
+        (WebKit::FrameLoaderClientImpl::committedLoad):
+        (WebKit::FrameLoaderClientImpl::finishedLoading):
+        (WebKit::FrameLoaderClientImpl::updateGlobalHistory):
+        (WebKit::FrameLoaderClientImpl::updateGlobalHistoryRedirectLinks):
+        (WebKit::FrameLoaderClientImpl::shouldGoToHistoryItem):
+        (WebKit::FrameLoaderClientImpl::didDisplayInsecureContent):
+        (WebKit::FrameLoaderClientImpl::didRunInsecureContent):
+        (WebKit::FrameLoaderClientImpl::blockedError):
+        (WebKit::FrameLoaderClientImpl::cancelledError):
+        (WebKit::FrameLoaderClientImpl::cannotShowURLError):
+        (WebKit::FrameLoaderClientImpl::interruptForPolicyChangeError):
+        (WebKit::FrameLoaderClientImpl::cannotShowMIMETypeError):
+        (WebKit::FrameLoaderClientImpl::fileDoesNotExistError):
+        (WebKit::FrameLoaderClientImpl::pluginWillHandleLoadError):
+        (WebKit::FrameLoaderClientImpl::shouldFallBack):
+        (WebKit::FrameLoaderClientImpl::canHandleRequest):
+        (WebKit::FrameLoaderClientImpl::canShowMIMEType):
+        (WebKit::FrameLoaderClientImpl::representationExistsForURLScheme):
+        (WebKit::FrameLoaderClientImpl::generatedMIMETypeForURLScheme):
+        (WebKit::FrameLoaderClientImpl::frameLoadCompleted):
+        (WebKit::FrameLoaderClientImpl::saveViewStateToItem):
+        (WebKit::FrameLoaderClientImpl::restoreViewState):
+        (WebKit::FrameLoaderClientImpl::provisionalLoadStarted):
+        (WebKit::FrameLoaderClientImpl::didFinishLoad):
+        (WebKit::FrameLoaderClientImpl::prepareForDataSourceReplacement):
+        (WebKit::FrameLoaderClientImpl::createDocumentLoader):
+        (WebKit::FrameLoaderClientImpl::setTitle):
+        (WebKit::FrameLoaderClientImpl::userAgent):
+        (WebKit::FrameLoaderClientImpl::savePlatformDataToCachedFrame):
+        (WebKit::FrameLoaderClientImpl::transitionToCommittedFromCachedFrame):
+        (WebKit::FrameLoaderClientImpl::transitionToCommittedForNewPage):
+        (WebKit::FrameLoaderClientImpl::canCachePage):
+        (WebKit::FrameLoaderClientImpl::download):
+        (WebKit::FrameLoaderClientImpl::createFrame):
+        (WebKit::FrameLoaderClientImpl::createPlugin):
+        (WebKit::FrameLoaderClientImpl::redirectDataToPlugin):
+        (WebKit::FrameLoaderClientImpl::createJavaAppletWidget):
+        (WebKit::FrameLoaderClientImpl::objectContentType):
+        (WebKit::FrameLoaderClientImpl::overrideMediaType):
+        (WebKit::FrameLoaderClientImpl::actionSpecifiesNavigationPolicy):
+        (WebKit::FrameLoaderClientImpl::handleBackForwardNavigation):
+        (WebKit::FrameLoaderClientImpl::pluginLoadObserver):
+        * src/FrameLoaderClientImpl.h: Added.
+        (WebKit::FrameLoaderClientImpl::webFrame):
+        (WebKit::FrameLoaderClientImpl::willChangeEstimatedProgress):
+        (WebKit::FrameLoaderClientImpl::didChangeEstimatedProgress):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: ChromeClientImpl...ContextMenuClientImpl
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/ChromeClientImpl.cpp: Added.
+        (WebKit::ChromeClientImpl::ChromeClientImpl):
+        (WebKit::ChromeClientImpl::~ChromeClientImpl):
+        (WebKit::ChromeClientImpl::chromeDestroyed):
+        (WebKit::ChromeClientImpl::setWindowRect):
+        (WebKit::ChromeClientImpl::windowRect):
+        (WebKit::ChromeClientImpl::pageRect):
+        (WebKit::ChromeClientImpl::scaleFactor):
+        (WebKit::ChromeClientImpl::focus):
+        (WebKit::ChromeClientImpl::unfocus):
+        (WebKit::ChromeClientImpl::canTakeFocus):
+        (WebKit::ChromeClientImpl::takeFocus):
+        (WebKit::ChromeClientImpl::focusedNodeChanged):
+        (WebKit::ChromeClientImpl::createWindow):
+        (WebKit::currentEventShouldCauseBackgroundTab):
+        (WebKit::ChromeClientImpl::show):
+        (WebKit::ChromeClientImpl::canRunModal):
+        (WebKit::ChromeClientImpl::runModal):
+        (WebKit::ChromeClientImpl::setToolbarsVisible):
+        (WebKit::ChromeClientImpl::toolbarsVisible):
+        (WebKit::ChromeClientImpl::setStatusbarVisible):
+        (WebKit::ChromeClientImpl::statusbarVisible):
+        (WebKit::ChromeClientImpl::setScrollbarsVisible):
+        (WebKit::ChromeClientImpl::scrollbarsVisible):
+        (WebKit::ChromeClientImpl::setMenubarVisible):
+        (WebKit::ChromeClientImpl::menubarVisible):
+        (WebKit::ChromeClientImpl::setResizable):
+        (WebKit::ChromeClientImpl::addMessageToConsole):
+        (WebKit::ChromeClientImpl::canRunBeforeUnloadConfirmPanel):
+        (WebKit::ChromeClientImpl::runBeforeUnloadConfirmPanel):
+        (WebKit::ChromeClientImpl::closeWindowSoon):
+        (WebKit::ChromeClientImpl::runJavaScriptAlert):
+        (WebKit::ChromeClientImpl::runJavaScriptConfirm):
+        (WebKit::ChromeClientImpl::runJavaScriptPrompt):
+        (WebKit::ChromeClientImpl::setStatusbarText):
+        (WebKit::ChromeClientImpl::shouldInterruptJavaScript):
+        (WebKit::ChromeClientImpl::tabsToLinks):
+        (WebKit::ChromeClientImpl::windowResizerRect):
+        (WebKit::ChromeClientImpl::repaint):
+        (WebKit::ChromeClientImpl::scroll):
+        (WebKit::ChromeClientImpl::screenToWindow):
+        (WebKit::ChromeClientImpl::windowToScreen):
+        (WebKit::ChromeClientImpl::contentsSizeChanged):
+        (WebKit::ChromeClientImpl::scrollbarsModeDidChange):
+        (WebKit::ChromeClientImpl::mouseDidMoveOverElement):
+        (WebKit::ChromeClientImpl::setToolTip):
+        (WebKit::ChromeClientImpl::print):
+        (WebKit::ChromeClientImpl::exceededDatabaseQuota):
+        (WebKit::ChromeClientImpl::reachedMaxAppCacheSize):
+        (WebKit::ChromeClientImpl::runOpenPanel):
+        (WebKit::ChromeClientImpl::popupOpened):
+        (WebKit::ChromeClientImpl::setCursor):
+        (WebKit::ChromeClientImpl::setCursorForPlugin):
+        (WebKit::ChromeClientImpl::formStateDidChange):
+        (WebKit::ChromeClientImpl::getPopupMenuInfo):
+        (WebKit::ChromeClientImpl::notificationPresenter):
+        * src/ChromeClientImpl.h: Added.
+        (WebKit::ChromeClientImpl::webView):
+        (WebKit::ChromeClientImpl::platformPageClient):
+        (WebKit::ChromeClientImpl::scrollRectIntoView):
+        (WebKit::ChromeClientImpl::requestGeolocationPermissionForFrame):
+        (WebKit::ChromeClientImpl::setCursor):
+        (WebKit::ChromeClientImpl::createHTMLParserQuirks):
+        * src/ChromiumBridge.cpp: Added.
+        (WebCore::toChromeClientImpl):
+        (WebCore::toWebWidgetClient):
+        (WebCore::ChromiumBridge::clipboardIsFormatAvailable):
+        (WebCore::ChromiumBridge::clipboardReadPlainText):
+        (WebCore::ChromiumBridge::clipboardReadHTML):
+        (WebCore::ChromiumBridge::clipboardWriteSelection):
+        (WebCore::ChromiumBridge::clipboardWritePlainText):
+        (WebCore::ChromiumBridge::clipboardWriteURL):
+        (WebCore::ChromiumBridge::clipboardWriteImage):
+        (WebCore::ChromiumBridge::setCookies):
+        (WebCore::ChromiumBridge::cookies):
+        (WebCore::ChromiumBridge::rawCookies):
+        (WebCore::ChromiumBridge::deleteCookie):
+        (WebCore::ChromiumBridge::prefetchDNS):
+        (WebCore::ChromiumBridge::fileExists):
+        (WebCore::ChromiumBridge::deleteFile):
+        (WebCore::ChromiumBridge::deleteEmptyDirectory):
+        (WebCore::ChromiumBridge::getFileSize):
+        (WebCore::ChromiumBridge::getFileModificationTime):
+        (WebCore::ChromiumBridge::directoryName):
+        (WebCore::ChromiumBridge::pathByAppendingComponent):
+        (WebCore::ChromiumBridge::makeAllDirectories):
+        (WebCore::ChromiumBridge::getAbsolutePath):
+        (WebCore::ChromiumBridge::isDirectory):
+        (WebCore::ChromiumBridge::filePathToURL):
+        (WebCore::ChromiumBridge::ensureFontLoaded):
+        (WebCore::ChromiumBridge::getFontFamilyForCharacters):
+        (WebCore::ChromiumBridge::databaseOpenFile):
+        (WebCore::ChromiumBridge::databaseDeleteFile):
+        (WebCore::ChromiumBridge::databaseGetFileAttributes):
+        (WebCore::ChromiumBridge::databaseGetFileSize):
+        (WebCore::ChromiumBridge::signedPublicKeyAndChallengeString):
+        (WebCore::ChromiumBridge::computedDefaultLanguage):
+        (WebCore::ChromiumBridge::layoutTestMode):
+        (WebCore::ChromiumBridge::isSupportedImageMIMEType):
+        (WebCore::ChromiumBridge::isSupportedJavaScriptMIMEType):
+        (WebCore::ChromiumBridge::isSupportedNonImageMIMEType):
+        (WebCore::ChromiumBridge::mimeTypeForExtension):
+        (WebCore::ChromiumBridge::mimeTypeFromFile):
+        (WebCore::ChromiumBridge::preferredExtensionForMIMEType):
+        (WebCore::ChromiumBridge::plugins):
+        (WebCore::ChromiumBridge::pluginScriptableObject):
+        (WebCore::ChromiumBridge::loadPlatformImageResource):
+        (WebCore::ChromiumBridge::sandboxEnabled):
+        (WebCore::ChromiumBridge::setSharedTimerFiredFunction):
+        (WebCore::ChromiumBridge::setSharedTimerFireTime):
+        (WebCore::ChromiumBridge::stopSharedTimer):
+        (WebCore::ChromiumBridge::decrementStatsCounter):
+        (WebCore::ChromiumBridge::incrementStatsCounter):
+        (WebCore::ChromiumBridge::suddenTerminationChanged):
+        (WebCore::ChromiumBridge::currentTime):
+        (WebCore::ChromiumBridge::paintButton):
+        (WebCore::ChromiumBridge::paintMenuList):
+        (WebCore::ChromiumBridge::paintScrollbarArrow):
+        (WebCore::ChromiumBridge::paintScrollbarThumb):
+        (WebCore::ChromiumBridge::paintScrollbarTrack):
+        (WebCore::ChromiumBridge::paintTextField):
+        (WebCore::ChromiumBridge::paintTrackbar):
+        (WebCore::ChromiumBridge::traceEventBegin):
+        (WebCore::ChromiumBridge::traceEventEnd):
+        (WebCore::ChromiumBridge::visitedLinkHash):
+        (WebCore::ChromiumBridge::isLinkVisited):
+        (WebCore::ChromiumBridge::notifyJSOutOfMemory):
+        (WebCore::ChromiumBridge::memoryUsageMB):
+        (WebCore::ChromiumBridge::screenDepth):
+        (WebCore::ChromiumBridge::screenDepthPerComponent):
+        (WebCore::ChromiumBridge::screenIsMonochrome):
+        (WebCore::ChromiumBridge::screenRect):
+        (WebCore::ChromiumBridge::screenAvailableRect):
+        (WebCore::ChromiumBridge::popupsAllowed):
+        (WebCore::ChromiumBridge::widgetSetCursor):
+        (WebCore::ChromiumBridge::widgetSetFocus):
+        (WebCore::WorkerContextProxy::create):
+        * src/ChromiumCurrentTime.cpp: Added.
+        (WTF::currentTime):
+        * src/ChromiumThreading.cpp: Added.
+        (WTF::ChromiumThreading::initializeMainThread):
+        (WTF::ChromiumThreading::scheduleDispatchFunctionsOnMainThread):
+        * src/ContextMenuClientImpl.cpp: Added.
+        (WebKit::urlFromFrame):
+        (WebKit::isASingleWord):
+        (WebKit::selectMisspelledWord):
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/ContextMenuClientImpl.h: Added.
+        (WebKit::ContextMenuClientImpl::ContextMenuClientImpl):
+        (WebKit::ContextMenuClientImpl::~ContextMenuClientImpl):
+        (WebKit::ContextMenuClientImpl::copyImageToClipboard):
+        (WebKit::ContextMenuClientImpl::contextMenuDestroyed):
+        (WebKit::ContextMenuClientImpl::contextMenuItemSelected):
+        (WebKit::ContextMenuClientImpl::downloadURL):
+        (WebKit::ContextMenuClientImpl::isSpeaking):
+        (WebKit::ContextMenuClientImpl::lookUpInDictionary):
+        (WebKit::ContextMenuClientImpl::searchWithGoogle):
+        (WebKit::ContextMenuClientImpl::shouldIncludeInspectElementItem):
+        (WebKit::ContextMenuClientImpl::speak):
+        (WebKit::ContextMenuClientImpl::stopSpeaking):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: AppCach...BackForwardListClientImpl
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/ApplicationCacheHost.cpp: Added.
+        (WebCore::ApplicationCacheHostInternal::ApplicationCacheHostInternal):
+        (WebCore::ApplicationCacheHostInternal::notifyEventListener):
+        (WebCore::ApplicationCacheHost::ApplicationCacheHost):
+        (WebCore::ApplicationCacheHost::~ApplicationCacheHost):
+        (WebCore::ApplicationCacheHost::maybeLoadMainResource):
+        (WebCore::ApplicationCacheHost::selectCacheWithoutManifest):
+        (WebCore::ApplicationCacheHost::selectCacheWithManifest):
+        (WebCore::ApplicationCacheHost::maybeLoadFallbackForMainResponse):
+        (WebCore::ApplicationCacheHost::maybeLoadFallbackForMainError):
+        (WebCore::ApplicationCacheHost::mainResourceDataReceived):
+        (WebCore::ApplicationCacheHost::failedLoadingMainResource):
+        (WebCore::ApplicationCacheHost::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheHost::maybeLoadResource):
+        (WebCore::ApplicationCacheHost::maybeLoadFallbackForRedirect):
+        (WebCore::ApplicationCacheHost::maybeLoadFallbackForResponse):
+        (WebCore::ApplicationCacheHost::maybeLoadFallbackForError):
+        (WebCore::ApplicationCacheHost::maybeLoadSynchronously):
+        (WebCore::ApplicationCacheHost::maybeLoadFallbackSynchronously):
+        (WebCore::ApplicationCacheHost::canCacheInPageCache):
+        (WebCore::ApplicationCacheHost::setDOMApplicationCache):
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
+        (WebCore::ApplicationCacheHost::status):
+        (WebCore::ApplicationCacheHost::update):
+        (WebCore::ApplicationCacheHost::swapCache):
+        (WebCore::ApplicationCacheHost::isApplicationCacheEnabled):
+        * src/AssertMatchingEnums.cpp: Added.
+        * src/AutocompletePopupMenuClient.cpp: Added.
+        (WebKit::AutocompletePopupMenuClient::AutocompletePopupMenuClient):
+        (WebKit::AutocompletePopupMenuClient::~AutocompletePopupMenuClient):
+        (WebKit::AutocompletePopupMenuClient::initialize):
+        (WebKit::AutocompletePopupMenuClient::valueChanged):
+        (WebKit::AutocompletePopupMenuClient::itemText):
+        (WebKit::AutocompletePopupMenuClient::itemStyle):
+        (WebKit::AutocompletePopupMenuClient::menuStyle):
+        (WebKit::AutocompletePopupMenuClient::clientPaddingLeft):
+        (WebKit::AutocompletePopupMenuClient::clientPaddingRight):
+        (WebKit::AutocompletePopupMenuClient::popupDidHide):
+        (WebKit::AutocompletePopupMenuClient::setTextFromItem):
+        (WebKit::AutocompletePopupMenuClient::fontSelector):
+        (WebKit::AutocompletePopupMenuClient::hostWindow):
+        (WebKit::AutocompletePopupMenuClient::createScrollbar):
+        (WebKit::AutocompletePopupMenuClient::setSuggestions):
+        (WebKit::AutocompletePopupMenuClient::removeItemAtIndex):
+        (WebKit::AutocompletePopupMenuClient::textFieldStyle):
+        * src/AutocompletePopupMenuClient.h: Added.
+        (WebKit::AutocompletePopupMenuClient::textField):
+        (WebKit::AutocompletePopupMenuClient::itemToolTip):
+        (WebKit::AutocompletePopupMenuClient::itemIsEnabled):
+        (WebKit::AutocompletePopupMenuClient::clientInsetLeft):
+        (WebKit::AutocompletePopupMenuClient::clientInsetRight):
+        (WebKit::AutocompletePopupMenuClient::listSize):
+        (WebKit::AutocompletePopupMenuClient::selectedIndex):
+        (WebKit::AutocompletePopupMenuClient::itemIsSeparator):
+        (WebKit::AutocompletePopupMenuClient::itemIsLabel):
+        (WebKit::AutocompletePopupMenuClient::itemIsSelected):
+        (WebKit::AutocompletePopupMenuClient::shouldPopOver):
+        (WebKit::AutocompletePopupMenuClient::valueShouldChangeOnHotTrack):
+        * src/BackForwardListClientImpl.cpp: Added.
+        (WebKit::BackForwardListClientImpl::BackForwardListClientImpl):
+        (WebKit::BackForwardListClientImpl::~BackForwardListClientImpl):
+        (WebKit::BackForwardListClientImpl::setCurrentHistoryItem):
+        (WebKit::BackForwardListClientImpl::previousHistoryItem):
+        (WebKit::BackForwardListClientImpl::addItem):
+        (WebKit::BackForwardListClientImpl::goToItem):
+        (WebKit::BackForwardListClientImpl::currentItem):
+        (WebKit::BackForwardListClientImpl::itemAtIndex):
+        (WebKit::BackForwardListClientImpl::backListCount):
+        (WebKit::BackForwardListClientImpl::forwardListCount):
+        (WebKit::BackForwardListClientImpl::close):
+        * src/BackForwardListClientImpl.h: Added.
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: WebString...WebViewImpl
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WebString.cpp: Added.
+        (WebKit::WebString::reset):
+        (WebKit::WebString::assign):
+        (WebKit::WebString::length):
+        (WebKit::WebString::data):
+        (WebKit::WebString::utf8):
+        (WebKit::WebString::fromUTF8):
+        (WebKit::WebString::WebString):
+        (WebKit::WebString::operator=):
+        (WebKit::WebString::operator WebCore::String):
+        (WebKit::WebString::operator WebCore::AtomicString):
+        * src/WebURL.cpp: Added.
+        (WebKit::WebURL::WebURL):
+        (WebKit::WebURL::operator=):
+        (WebKit::WebURL::operator WebCore::KURL):
+        * src/WebURLError.cpp: Added.
+        (WebKit::WebURLError::WebURLError):
+        (WebKit::WebURLError::operator=):
+        (WebKit::WebURLError::operator ResourceError):
+        * src/WebURLRequest.cpp: Added.
+        (WebKit::WebURLRequestPrivateImpl::WebURLRequestPrivateImpl):
+        (WebKit::WebURLRequestPrivateImpl::dispose):
+        (WebKit::WebURLRequest::initialize):
+        (WebKit::WebURLRequest::reset):
+        (WebKit::WebURLRequest::assign):
+        (WebKit::WebURLRequest::isNull):
+        (WebKit::WebURLRequest::url):
+        (WebKit::WebURLRequest::setURL):
+        (WebKit::WebURLRequest::firstPartyForCookies):
+        (WebKit::WebURLRequest::setFirstPartyForCookies):
+        (WebKit::WebURLRequest::allowCookies):
+        (WebKit::WebURLRequest::setAllowCookies):
+        (WebKit::WebURLRequest::allowStoredCredentials):
+        (WebKit::WebURLRequest::setAllowStoredCredentials):
+        (WebKit::WebURLRequest::cachePolicy):
+        (WebKit::WebURLRequest::setCachePolicy):
+        (WebKit::WebURLRequest::httpMethod):
+        (WebKit::WebURLRequest::setHTTPMethod):
+        (WebKit::WebURLRequest::httpHeaderField):
+        (WebKit::WebURLRequest::setHTTPHeaderField):
+        (WebKit::WebURLRequest::addHTTPHeaderField):
+        (WebKit::WebURLRequest::clearHTTPHeaderField):
+        (WebKit::WebURLRequest::visitHTTPHeaderFields):
+        (WebKit::WebURLRequest::httpBody):
+        (WebKit::WebURLRequest::setHTTPBody):
+        (WebKit::WebURLRequest::reportUploadProgress):
+        (WebKit::WebURLRequest::setReportUploadProgress):
+        (WebKit::WebURLRequest::targetType):
+        (WebKit::WebURLRequest::setTargetType):
+        (WebKit::WebURLRequest::requestorID):
+        (WebKit::WebURLRequest::setRequestorID):
+        (WebKit::WebURLRequest::requestorProcessID):
+        (WebKit::WebURLRequest::setRequestorProcessID):
+        (WebKit::WebURLRequest::appCacheHostID):
+        (WebKit::WebURLRequest::setAppCacheHostID):
+        (WebKit::WebURLRequest::toMutableResourceRequest):
+        (WebKit::WebURLRequest::toResourceRequest):
+        * src/WebURLRequestPrivate.h: Added.
+        (WebKit::WebURLRequestPrivate::WebURLRequestPrivate):
+        * src/WebURLResponse.cpp: Added.
+        (WebKit::WebURLResponsePrivateImpl::WebURLResponsePrivateImpl):
+        (WebKit::WebURLResponsePrivateImpl::dispose):
+        (WebKit::WebURLResponse::initialize):
+        (WebKit::WebURLResponse::reset):
+        (WebKit::WebURLResponse::assign):
+        (WebKit::WebURLResponse::isNull):
+        (WebKit::WebURLResponse::url):
+        (WebKit::WebURLResponse::setURL):
+        (WebKit::WebURLResponse::mimeType):
+        (WebKit::WebURLResponse::setMIMEType):
+        (WebKit::WebURLResponse::expectedContentLength):
+        (WebKit::WebURLResponse::setExpectedContentLength):
+        (WebKit::WebURLResponse::textEncodingName):
+        (WebKit::WebURLResponse::setTextEncodingName):
+        (WebKit::WebURLResponse::suggestedFileName):
+        (WebKit::WebURLResponse::setSuggestedFileName):
+        (WebKit::WebURLResponse::httpStatusCode):
+        (WebKit::WebURLResponse::setHTTPStatusCode):
+        (WebKit::WebURLResponse::httpStatusText):
+        (WebKit::WebURLResponse::setHTTPStatusText):
+        (WebKit::WebURLResponse::httpHeaderField):
+        (WebKit::WebURLResponse::setHTTPHeaderField):
+        (WebKit::WebURLResponse::addHTTPHeaderField):
+        (WebKit::WebURLResponse::clearHTTPHeaderField):
+        (WebKit::WebURLResponse::visitHTTPHeaderFields):
+        (WebKit::WebURLResponse::lastModifiedDate):
+        (WebKit::WebURLResponse::setLastModifiedDate):
+        (WebKit::WebURLResponse::isContentFiltered):
+        (WebKit::WebURLResponse::setIsContentFiltered):
+        (WebKit::WebURLResponse::appCacheID):
+        (WebKit::WebURLResponse::setAppCacheID):
+        (WebKit::WebURLResponse::appCacheManifestURL):
+        (WebKit::WebURLResponse::setAppCacheManifestURL):
+        (WebKit::WebURLResponse::securityInfo):
+        (WebKit::WebURLResponse::setSecurityInfo):
+        (WebKit::WebURLResponse::toMutableResourceResponse):
+        (WebKit::WebURLResponse::toResourceResponse):
+        * src/WebURLResponsePrivate.h: Added.
+        (WebKit::WebURLResponsePrivate::WebURLResponsePrivate):
+        * src/WebViewImpl.cpp: Added.
+        (WebKit::):
+        (WebKit::WebView::create):
+        (WebKit::WebView::updateVisitedLinkState):
+        (WebKit::WebView::resetVisitedLinkState):
+        (WebKit::WebViewImpl::initializeMainFrame):
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::~WebViewImpl):
+        (WebKit::WebViewImpl::theme):
+        (WebKit::WebViewImpl::mainFrameImpl):
+        (WebKit::WebViewImpl::tabKeyCyclesThroughElements):
+        (WebKit::WebViewImpl::setTabKeyCyclesThroughElements):
+        (WebKit::WebViewImpl::mouseMove):
+        (WebKit::WebViewImpl::mouseLeave):
+        (WebKit::WebViewImpl::mouseDown):
+        (WebKit::WebViewImpl::mouseContextMenu):
+        (WebKit::WebViewImpl::mouseUp):
+        (WebKit::WebViewImpl::mouseWheel):
+        (WebKit::WebViewImpl::keyEvent):
+        (WebKit::WebViewImpl::autocompleteHandleKeyEvent):
+        (WebKit::WebViewImpl::charEvent):
+        (WebKit::WebViewImpl::sendContextMenuEvent):
+        (WebKit::WebViewImpl::keyEventDefault):
+        (WebKit::WebViewImpl::scrollViewWithKeyboard):
+        (WebKit::WebViewImpl::propagateScroll):
+        (WebKit::WebViewImpl::focusedWebCoreFrame):
+        (WebKit::WebViewImpl::fromPage):
+        (WebKit::WebViewImpl::close):
+        (WebKit::WebViewImpl::resize):
+        (WebKit::WebViewImpl::layout):
+        (WebKit::WebViewImpl::paint):
+        (WebKit::WebViewImpl::handleInputEvent):
+        (WebKit::WebViewImpl::mouseCaptureLost):
+        (WebKit::WebViewImpl::setFocus):
+        (WebKit::WebViewImpl::handleCompositionEvent):
+        (WebKit::WebViewImpl::queryCompositionStatus):
+        (WebKit::WebViewImpl::setTextDirection):
+        (WebKit::WebViewImpl::settings):
+        (WebKit::WebViewImpl::pageEncoding):
+        (WebKit::WebViewImpl::setPageEncoding):
+        (WebKit::WebViewImpl::dispatchBeforeUnloadEvent):
+        (WebKit::WebViewImpl::dispatchUnloadEvent):
+        (WebKit::WebViewImpl::mainFrame):
+        (WebKit::WebViewImpl::findFrameByName):
+        (WebKit::WebViewImpl::focusedFrame):
+        (WebKit::WebViewImpl::setFocusedFrame):
+        (WebKit::WebViewImpl::setInitialFocus):
+        (WebKit::WebViewImpl::clearFocusedNode):
+        (WebKit::WebViewImpl::zoomIn):
+        (WebKit::WebViewImpl::zoomOut):
+        (WebKit::WebViewImpl::zoomDefault):
+        (WebKit::WebViewImpl::performMediaPlayerAction):
+        (WebKit::WebViewImpl::copyImageAt):
+        (WebKit::WebViewImpl::dragSourceEndedAt):
+        (WebKit::WebViewImpl::dragSourceMovedTo):
+        (WebKit::WebViewImpl::dragSourceSystemDragEnded):
+        (WebKit::WebViewImpl::dragTargetDragEnter):
+        (WebKit::WebViewImpl::dragTargetDragOver):
+        (WebKit::WebViewImpl::dragTargetDragLeave):
+        (WebKit::WebViewImpl::dragTargetDrop):
+        (WebKit::WebViewImpl::dragIdentity):
+        (WebKit::WebViewImpl::inspectElementAt):
+        (WebKit::WebViewImpl::inspectorSettings):
+        (WebKit::WebViewImpl::setInspectorSettings):
+        (WebKit::WebViewImpl::devToolsAgent):
+        (WebKit::WebViewImpl::setDevToolsAgent):
+        (WebKit::WebViewImpl::accessibilityObject):
+        (WebKit::WebViewImpl::applyAutofillSuggestions):
+        (WebKit::WebViewImpl::hideAutofillPopup):
+        (WebKit::WebViewImpl::setDropEffect):
+        (WebKit::WebViewImpl::setIsTransparent):
+        (WebKit::WebViewImpl::isTransparent):
+        (WebKit::WebViewImpl::setIsActive):
+        (WebKit::WebViewImpl::isActive):
+        (WebKit::WebViewImpl::didCommitLoad):
+        (WebKit::WebViewImpl::navigationPolicyFromMouseEvent):
+        (WebKit::WebViewImpl::startDragging):
+        (WebKit::WebViewImpl::setCurrentHistoryItem):
+        (WebKit::WebViewImpl::previousHistoryItem):
+        (WebKit::WebViewImpl::observeNewNavigation):
+        (WebKit::WebViewImpl::hideAutoCompletePopup):
+        (WebKit::WebViewImpl::autoCompletePopupDidHide):
+        (WebKit::WebViewImpl::setIgnoreInputEvents):
+        (WebKit::WebViewImpl::notificationPresenterImpl):
+        (WebKit::WebViewImpl::refreshAutofillPopup):
+        (WebKit::WebViewImpl::focusedWebCoreNode):
+        (WebKit::WebViewImpl::hitTestResultForWindowPos):
+        (WebKit::WebViewImpl::setTabsToLinks):
+        (WebKit::WebViewImpl::tabsToLinks):
+        * src/WebViewImpl.h: Added.
+        (WebKit::WebViewImpl::size):
+        (WebKit::WebViewImpl::devToolsAgentPrivate):
+        (WebKit::WebViewImpl::lastMouseDownPoint):
+        (WebKit::WebViewImpl::client):
+        (WebKit::WebViewImpl::page):
+        (WebKit::WebViewImpl::contextMenuAllowed):
+        (WebKit::WebViewImpl::setInitialNavigationPolicy):
+        (WebKit::WebViewImpl::initialNavigationPolicy):
+        (WebKit::WebViewImpl::currentInputEvent):
+        (WebKit::WebViewImpl::):
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: WebScriptController...WebStorageNamespaceImpl
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WebScriptController.cpp: Added.
+        (WebKit::WebScriptController::registerExtension):
+        (WebKit::WebScriptController::enableV8SingleThreadMode):
+        (WebKit::WebScriptController::flushConsoleMessages):
+        * src/WebSearchableFormData.cpp: Added.
+        (WebCore::GetFormEncoding):
+        (WebCore::IsHTTPFormSubmit):
+        (WebCore::GetButtonToActivate):
+        (WebCore::IsSelectInDefaultState):
+        (WebCore::IsInDefaultState):
+        (WebCore::HasSuitableTextElement):
+        (WebKit::WebSearchableFormData::WebSearchableFormData):
+        * src/WebSecurityOrigin.cpp: Added.
+        (WebKit::WebSecurityOrigin::reset):
+        (WebKit::WebSecurityOrigin::assign):
+        (WebKit::WebSecurityOrigin::protocol):
+        (WebKit::WebSecurityOrigin::host):
+        (WebKit::WebSecurityOrigin::port):
+        (WebKit::WebSecurityOrigin::isEmpty):
+        (WebKit::WebSecurityOrigin::toString):
+        (WebKit::WebSecurityOrigin::databaseIdentifier):
+        (WebKit::WebSecurityOrigin::WebSecurityOrigin):
+        (WebKit::WebSecurityOrigin::operator=):
+        (WebKit::WebSecurityOrigin::operator WTF::PassRefPtr<WebCore::SecurityOrigin>):
+        * src/WebSecurityPolicy.cpp: Added.
+        (WebKit::WebSecurityPolicy::registerURLSchemeAsLocal):
+        (WebKit::WebSecurityPolicy::registerURLSchemeAsNoAccess):
+        (WebKit::WebSecurityPolicy::whiteListAccessFromOrigin):
+        (WebKit::WebSecurityPolicy::resetOriginAccessWhiteLists):
+        * src/WebSettingsImpl.cpp: Added.
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        (WebKit::WebSettingsImpl::setStandardFontFamily):
+        (WebKit::WebSettingsImpl::setFixedFontFamily):
+        (WebKit::WebSettingsImpl::setSerifFontFamily):
+        (WebKit::WebSettingsImpl::setSansSerifFontFamily):
+        (WebKit::WebSettingsImpl::setCursiveFontFamily):
+        (WebKit::WebSettingsImpl::setFantasyFontFamily):
+        (WebKit::WebSettingsImpl::setDefaultFontSize):
+        (WebKit::WebSettingsImpl::setDefaultFixedFontSize):
+        (WebKit::WebSettingsImpl::setMinimumFontSize):
+        (WebKit::WebSettingsImpl::setMinimumLogicalFontSize):
+        (WebKit::WebSettingsImpl::setDefaultTextEncodingName):
+        (WebKit::WebSettingsImpl::setJavaScriptEnabled):
+        (WebKit::WebSettingsImpl::setWebSecurityEnabled):
+        (WebKit::WebSettingsImpl::setJavaScriptCanOpenWindowsAutomatically):
+        (WebKit::WebSettingsImpl::setLoadsImagesAutomatically):
+        (WebKit::WebSettingsImpl::setPluginsEnabled):
+        (WebKit::WebSettingsImpl::setDOMPasteAllowed):
+        (WebKit::WebSettingsImpl::setDeveloperExtrasEnabled):
+        (WebKit::WebSettingsImpl::setShrinksStandaloneImagesToFit):
+        (WebKit::WebSettingsImpl::setUsesEncodingDetector):
+        (WebKit::WebSettingsImpl::setTextAreasAreResizable):
+        (WebKit::WebSettingsImpl::setJavaEnabled):
+        (WebKit::WebSettingsImpl::setAllowScriptsToCloseWindows):
+        (WebKit::WebSettingsImpl::setUserStyleSheetLocation):
+        (WebKit::WebSettingsImpl::setUsesPageCache):
+        (WebKit::WebSettingsImpl::setDownloadableBinaryFontsEnabled):
+        (WebKit::WebSettingsImpl::setXSSAuditorEnabled):
+        (WebKit::WebSettingsImpl::setLocalStorageEnabled):
+        (WebKit::WebSettingsImpl::setEditableLinkBehaviorNeverLive):
+        (WebKit::WebSettingsImpl::setFontRenderingModeNormal):
+        (WebKit::WebSettingsImpl::setShouldPaintCustomScrollbars):
+        (WebKit::WebSettingsImpl::setDatabasesEnabled):
+        (WebKit::WebSettingsImpl::setAllowUniversalAccessFromFileURLs):
+        (WebKit::WebSettingsImpl::setTextDirectionSubmenuInclusionBehaviorNeverIncluded):
+        (WebKit::WebSettingsImpl::setOfflineWebApplicationCacheEnabled):
+        (WebKit::WebSettingsImpl::setExperimentalWebGLEnabled):
+        * src/WebSettingsImpl.h: Added.
+        (WebKit::WebSettingsImpl::~WebSettingsImpl):
+        * src/WebSharedWorkerImpl.cpp: Added.
+        (WebKit::WebSharedWorkerImpl::WebSharedWorkerImpl):
+        (WebKit::WebSharedWorkerImpl::~WebSharedWorkerImpl):
+        (WebKit::WebSharedWorkerImpl::isStarted):
+        (WebKit::WebSharedWorkerImpl::connect):
+        (WebKit::WebSharedWorkerImpl::connectTask):
+        (WebKit::WebSharedWorkerImpl::startWorkerContext):
+        (WebKit::WebSharedWorkerImpl::terminateWorkerContext):
+        (WebKit::WebSharedWorkerImpl::clientDestroyed):
+        (WebKit::WebSharedWorkerImpl::client):
+        (WebKit::WebSharedWorker::create):
+        * src/WebSharedWorkerImpl.h: Added.
+        (WebKit::WebSharedWorkerImpl::commonClient):
+        * src/WebStorageAreaImpl.cpp: Added.
+        (WebKit::WebStorageAreaImpl::WebStorageAreaImpl):
+        (WebKit::WebStorageAreaImpl::~WebStorageAreaImpl):
+        (WebKit::WebStorageAreaImpl::length):
+        (WebKit::WebStorageAreaImpl::key):
+        (WebKit::WebStorageAreaImpl::getItem):
+        (WebKit::WebStorageAreaImpl::setItem):
+        (WebKit::WebStorageAreaImpl::removeItem):
+        (WebKit::WebStorageAreaImpl::clear):
+        * src/WebStorageAreaImpl.h: Added.
+        (WebKit::WebStorageAreaImpl::currentStorageEventURL):
+        (WebKit::WebStorageAreaImpl::ScopedStorageEventURL::ScopedStorageEventURL):
+        (WebKit::WebStorageAreaImpl::ScopedStorageEventURL::~ScopedStorageEventURL):
+        * src/WebStorageEventDispatcherImpl.cpp: Added.
+        (WebKit::WebStorageEventDispatcher::create):
+        (WebKit::WebStorageEventDispatcherImpl::WebStorageEventDispatcherImpl):
+        (WebKit::WebStorageEventDispatcherImpl::dispatchStorageEvent):
+        * src/WebStorageEventDispatcherImpl.h: Added.
+        * src/WebStorageNamespaceImpl.cpp: Added.
+        (WebKit::WebStorageNamespace::createLocalStorageNamespace):
+        (WebKit::WebStorageNamespace::createSessionStorageNamespace):
+        (WebKit::WebStorageNamespaceImpl::WebStorageNamespaceImpl):
+        (WebKit::WebStorageNamespaceImpl::~WebStorageNamespaceImpl):
+        (WebKit::WebStorageNamespaceImpl::createStorageArea):
+        (WebKit::WebStorageNamespaceImpl::copy):
+        (WebKit::WebStorageNamespaceImpl::close):
+        * src/WebStorageNamespaceImpl.h: Added.
+
+2009-11-10  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: WebPasswordFormData...WebRuntimeFeatures
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WebPasswordFormData.cpp: Added.
+        (WebKit::):
+        (WebKit::WebPasswordFormData::WebPasswordFormData):
+        * src/WebPasswordFormUtils.cpp: Added.
+        (WebKit::findPasswordFormFields):
+        * src/WebPasswordFormUtils.h: Added.
+        (WebKit::PasswordFormFields::PasswordFormFields):
+        * src/WebPluginContainerImpl.cpp: Added.
+        (WebKit::WebPluginContainerImpl::setFrameRect):
+        (WebKit::WebPluginContainerImpl::paint):
+        (WebKit::WebPluginContainerImpl::invalidateRect):
+        (WebKit::WebPluginContainerImpl::setFocus):
+        (WebKit::WebPluginContainerImpl::show):
+        (WebKit::WebPluginContainerImpl::hide):
+        (WebKit::WebPluginContainerImpl::handleEvent):
+        (WebKit::WebPluginContainerImpl::frameRectsChanged):
+        (WebKit::WebPluginContainerImpl::setParentVisible):
+        (WebKit::WebPluginContainerImpl::setParent):
+        (WebKit::WebPluginContainerImpl::invalidate):
+        (WebKit::WebPluginContainerImpl::reportGeometry):
+        (WebKit::WebPluginContainerImpl::clearScriptObjects):
+        (WebKit::WebPluginContainerImpl::scriptableObjectForElement):
+        (WebKit::WebPluginContainerImpl::executeScriptURL):
+        (WebKit::WebPluginContainerImpl::loadFrameRequest):
+        (WebKit::WebPluginContainerImpl::didReceiveResponse):
+        (WebKit::WebPluginContainerImpl::didReceiveData):
+        (WebKit::WebPluginContainerImpl::didFinishLoading):
+        (WebKit::WebPluginContainerImpl::didFailLoading):
+        (WebKit::WebPluginContainerImpl::scriptableObject):
+        (WebKit::WebPluginContainerImpl::willDestroyPluginLoadObserver):
+        (WebKit::WebPluginContainerImpl::~WebPluginContainerImpl):
+        (WebKit::WebPluginContainerImpl::handleMouseEvent):
+        (WebKit::WebPluginContainerImpl::handleKeyboardEvent):
+        (WebKit::WebPluginContainerImpl::calculateGeometry):
+        (WebKit::WebPluginContainerImpl::windowClipRect):
+        (WebKit::getObjectStack):
+        (WebKit::checkStackOnTop):
+        (WebKit::WebPluginContainerImpl::windowCutOutRects):
+        * src/WebPluginContainerImpl.h: Added.
+        (WebKit::WebPluginContainerImpl::create):
+        (WebKit::WebPluginContainerImpl::plugin):
+        (WebKit::WebPluginContainerImpl::WebPluginContainerImpl):
+        * src/WebPluginListBuilderImpl.cpp: Added.
+        (WebKit::WebPluginListBuilderImpl::addPlugin):
+        (WebKit::WebPluginListBuilderImpl::addMediaTypeToLastPlugin):
+        (WebKit::WebPluginListBuilderImpl::addFileExtensionToLastMediaType):
+        * src/WebPluginListBuilderImpl.h: Added.
+        (WebKit::WebPluginListBuilderImpl::WebPluginListBuilderImpl):
+        * src/WebPluginLoadObserver.cpp: Added.
+        (WebKit::WebPluginLoadObserver::~WebPluginLoadObserver):
+        (WebKit::WebPluginLoadObserver::didFinishLoading):
+        (WebKit::WebPluginLoadObserver::didFailLoading):
+        * src/WebPluginLoadObserver.h: Added.
+        (WebKit::WebPluginLoadObserver::WebPluginLoadObserver):
+        (WebKit::WebPluginLoadObserver::url):
+        (WebKit::WebPluginLoadObserver::clearPluginContainer):
+        * src/WebPopupMenuImpl.cpp: Added.
+        (WebKit::WebPopupMenu::create):
+        (WebKit::WebPopupMenuImpl::WebPopupMenuImpl):
+        (WebKit::WebPopupMenuImpl::~WebPopupMenuImpl):
+        (WebKit::WebPopupMenuImpl::Init):
+        (WebKit::WebPopupMenuImpl::MouseMove):
+        (WebKit::WebPopupMenuImpl::MouseLeave):
+        (WebKit::WebPopupMenuImpl::MouseDown):
+        (WebKit::WebPopupMenuImpl::MouseUp):
+        (WebKit::WebPopupMenuImpl::MouseWheel):
+        (WebKit::WebPopupMenuImpl::KeyEvent):
+        (WebKit::WebPopupMenuImpl::close):
+        (WebKit::WebPopupMenuImpl::resize):
+        (WebKit::WebPopupMenuImpl::layout):
+        (WebKit::WebPopupMenuImpl::paint):
+        (WebKit::WebPopupMenuImpl::handleInputEvent):
+        (WebKit::WebPopupMenuImpl::mouseCaptureLost):
+        (WebKit::WebPopupMenuImpl::setFocus):
+        (WebKit::WebPopupMenuImpl::handleCompositionEvent):
+        (WebKit::WebPopupMenuImpl::queryCompositionStatus):
+        (WebKit::WebPopupMenuImpl::setTextDirection):
+        (WebKit::WebPopupMenuImpl::repaint):
+        (WebKit::WebPopupMenuImpl::scroll):
+        (WebKit::WebPopupMenuImpl::screenToWindow):
+        (WebKit::WebPopupMenuImpl::windowToScreen):
+        (WebKit::WebPopupMenuImpl::scrollRectIntoView):
+        (WebKit::WebPopupMenuImpl::scrollbarsModeDidChange):
+        (WebKit::WebPopupMenuImpl::popupClosed):
+        * src/WebPopupMenuImpl.h: Added.
+        (WebKit::WebPopupMenuImpl::size):
+        (WebKit::WebPopupMenuImpl::client):
+        (WebKit::WebPopupMenuImpl::platformPageClient):
+        * src/WebRange.cpp: Added.
+        (WebKit::WebRange::reset):
+        (WebKit::WebRange::assign):
+        (WebKit::WebRange::startOffset):
+        (WebKit::WebRange::endOffset):
+        (WebKit::WebRange::startContainer):
+        (WebKit::WebRange::endContainer):
+        (WebKit::WebRange::toHTMLText):
+        (WebKit::WebRange::toPlainText):
+        (WebKit::WebRange::WebRange):
+        (WebKit::WebRange::operator=):
+        (WebKit::WebRange::operator WTF::PassRefPtr<WebCore::Range>):
+        * src/WebRuntimeFeatures.cpp: Added.
+        (WebKit::WebRuntimeFeatures::enableDatabase):
+        (WebKit::WebRuntimeFeatures::isDatabaseEnabled):
+        (WebKit::WebRuntimeFeatures::enableLocalStorage):
+        (WebKit::WebRuntimeFeatures::isLocalStorageEnabled):
+        (WebKit::WebRuntimeFeatures::enableSessionStorage):
+        (WebKit::WebRuntimeFeatures::isSessionStorageEnabled):
+        (WebKit::WebRuntimeFeatures::enableMediaPlayer):
+        (WebKit::WebRuntimeFeatures::isMediaPlayerEnabled):
+        (WebKit::WebRuntimeFeatures::enableSockets):
+        (WebKit::WebRuntimeFeatures::isSocketsEnabled):
+        (WebKit::WebRuntimeFeatures::enableNotifications):
+        (WebKit::WebRuntimeFeatures::isNotificationsEnabled):
+        (WebKit::WebRuntimeFeatures::enableApplicationCache):
+        (WebKit::WebRuntimeFeatures::isApplicationCacheEnabled):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: WebFileInputElement...WebNotifications
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WebInputElement.cpp: Added.
+        (WebKit::WebInputElement::WebInputElement):
+        (WebKit::WebInputElement::operator=):
+        (WebKit::WebInputElement::operator WTF::PassRefPtr<HTMLInputElement>):
+        (WebKit::WebInputElement::setActivatedSubmit):
+        (WebKit::WebInputElement::setValue):
+        (WebKit::WebInputElement::value):
+        (WebKit::WebInputElement::setAutofilled):
+        (WebKit::WebInputElement::dispatchFormControlChangeEvent):
+        (WebKit::WebInputElement::setSelectionRange):
+        * src/WebInputEvent.cpp: Added.
+        (WebKit::staticKeyIdentifiers):
+        (WebKit::WebKeyboardEvent::setKeyIdentifierFromWindowsKeyCode):
+        * src/WebInputEventConversion.cpp: Added.
+        (WebKit::PlatformMouseEventBuilder::PlatformMouseEventBuilder):
+        (WebKit::PlatformWheelEventBuilder::PlatformWheelEventBuilder):
+        (WebKit::toPlatformKeyboardEventType):
+        (WebKit::PlatformKeyboardEventBuilder::PlatformKeyboardEventBuilder):
+        (WebKit::PlatformKeyboardEventBuilder::setKeyType):
+        (WebKit::PlatformKeyboardEventBuilder::isCharacterKey):
+        (WebKit::getWebInputModifiers):
+        (WebKit::WebMouseEventBuilder::WebMouseEventBuilder):
+        (WebKit::WebKeyboardEventBuilder::WebKeyboardEventBuilder):
+        * src/WebInputEventConversion.h: Added.
+        * src/WebKit.cpp: Added.
+        (WebKit::initialize):
+        (WebKit::shutdown):
+        (WebKit::webKitClient):
+        (WebKit::setLayoutTestMode):
+        (WebKit::layoutTestMode):
+        (WebKit::resetPluginCache):
+        * src/WebMediaPlayerClientImpl.cpp: Added.
+        (WebKit::createWebMediaPlayer):
+        (WebKit::WebMediaPlayerClientImpl::isEnabled):
+        (WebKit::WebMediaPlayerClientImpl::setIsEnabled):
+        (WebKit::WebMediaPlayerClientImpl::registerSelf):
+        (WebKit::WebMediaPlayerClientImpl::networkStateChanged):
+        (WebKit::WebMediaPlayerClientImpl::readyStateChanged):
+        (WebKit::WebMediaPlayerClientImpl::volumeChanged):
+        (WebKit::WebMediaPlayerClientImpl::timeChanged):
+        (WebKit::WebMediaPlayerClientImpl::repaint):
+        (WebKit::WebMediaPlayerClientImpl::durationChanged):
+        (WebKit::WebMediaPlayerClientImpl::rateChanged):
+        (WebKit::WebMediaPlayerClientImpl::sizeChanged):
+        (WebKit::WebMediaPlayerClientImpl::sawUnsupportedTracks):
+        (WebKit::WebMediaPlayerClientImpl::load):
+        (WebKit::WebMediaPlayerClientImpl::cancelLoad):
+        (WebKit::WebMediaPlayerClientImpl::play):
+        (WebKit::WebMediaPlayerClientImpl::pause):
+        (WebKit::WebMediaPlayerClientImpl::naturalSize):
+        (WebKit::WebMediaPlayerClientImpl::hasVideo):
+        (WebKit::WebMediaPlayerClientImpl::hasAudio):
+        (WebKit::WebMediaPlayerClientImpl::setVisible):
+        (WebKit::WebMediaPlayerClientImpl::duration):
+        (WebKit::WebMediaPlayerClientImpl::currentTime):
+        (WebKit::WebMediaPlayerClientImpl::seek):
+        (WebKit::WebMediaPlayerClientImpl::seeking):
+        (WebKit::WebMediaPlayerClientImpl::setEndTime):
+        (WebKit::WebMediaPlayerClientImpl::setRate):
+        (WebKit::WebMediaPlayerClientImpl::paused):
+        (WebKit::WebMediaPlayerClientImpl::supportsFullscreen):
+        (WebKit::WebMediaPlayerClientImpl::supportsSave):
+        (WebKit::WebMediaPlayerClientImpl::setVolume):
+        (WebKit::WebMediaPlayerClientImpl::networkState):
+        (WebKit::WebMediaPlayerClientImpl::readyState):
+        (WebKit::WebMediaPlayerClientImpl::maxTimeSeekable):
+        (WebKit::WebMediaPlayerClientImpl::buffered):
+        (WebKit::WebMediaPlayerClientImpl::dataRate):
+        (WebKit::WebMediaPlayerClientImpl::totalBytesKnown):
+        (WebKit::WebMediaPlayerClientImpl::totalBytes):
+        (WebKit::WebMediaPlayerClientImpl::bytesLoaded):
+        (WebKit::WebMediaPlayerClientImpl::setSize):
+        (WebKit::WebMediaPlayerClientImpl::paint):
+        (WebKit::WebMediaPlayerClientImpl::setAutobuffer):
+        (WebKit::WebMediaPlayerClientImpl::hasSingleSecurityOrigin):
+        (WebKit::WebMediaPlayerClientImpl::movieLoadType):
+        (WebKit::WebMediaPlayerClientImpl::create):
+        (WebKit::WebMediaPlayerClientImpl::getSupportedTypes):
+        (WebKit::WebMediaPlayerClientImpl::supportsType):
+        (WebKit::WebMediaPlayerClientImpl::WebMediaPlayerClientImpl):
+        * src/WebMediaPlayerClientImpl.h: Added.
+        * src/WebNode.cpp: Added.
+        (WebKit::WebNode::reset):
+        (WebKit::WebNode::assign):
+        (WebKit::WebNode::parentNode):
+        (WebKit::WebNode::nodeName):
+        (WebKit::WebNode::WebNode):
+        (WebKit::WebNode::operator=):
+        (WebKit::WebNode::operator WTF::PassRefPtr<WebCore::Node>):
+        (WebKit::WebNode::frame):
+        * src/WebNotification.cpp: Added.
+        (WebKit::WebNotification::reset):
+        (WebKit::WebNotification::assign):
+        (WebKit::WebNotification::lessThan):
+        (WebKit::WebNotification::isHTML):
+        (WebKit::WebNotification::url):
+        (WebKit::WebNotification::icon):
+        (WebKit::WebNotification::title):
+        (WebKit::WebNotification::body):
+        (WebKit::WebNotification::dispatchDisplayEvent):
+        (WebKit::WebNotification::dispatchErrorEvent):
+        (WebKit::WebNotification::dispatchCloseEvent):
+        (WebKit::WebNotification::WebNotification):
+        (WebKit::WebNotification::operator=):
+        (WebKit::WebNotification::operator WTF::PassRefPtr<Notification>):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: WebFileChooser...WebImageSkia
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WebFileChooserCompletionImpl.cpp: Added.
+        (WebKit::WebFileChooserCompletionImpl::WebFileChooserCompletionImpl):
+        (WebKit::WebFileChooserCompletionImpl::~WebFileChooserCompletionImpl):
+        (WebKit::WebFileChooserCompletionImpl::didChooseFile):
+        * src/WebFileChooserCompletionImpl.h: Added.
+        * src/WebFontCache.cpp: Added.
+        (WebKit::WebFontCache::fontDataCount):
+        (WebKit::WebFontCache::inactiveFontDataCount):
+        (WebKit::WebFontCache::clear):
+        * src/WebFormElement.cpp: Added.
+        (WebKit::WebFormElement::WebFormElement):
+        (WebKit::WebFormElement::operator=):
+        (WebKit::WebFormElement::operator WTF::PassRefPtr<WebCore::HTMLFormElement>):
+        (WebKit::WebFormElement::autoComplete):
+        (WebKit::WebFormElement::action):
+        (WebKit::WebFormElement::submit):
+        (WebKit::WebFormElement::getNamedElements):
+        * src/WebFrameImpl.cpp: Added.
+        (WebKit::frameContentAsPlainText):
+        (WebKit::ChromePrintContext::ChromePrintContext):
+        (WebKit::ChromePrintContext::begin):
+        (WebKit::ChromePrintContext::getPageShrink):
+        (WebKit::ChromePrintContext::spoolPage):
+        (WebKit::DataSourceForDocLoader):
+        (WebKit::WebFrameImpl::DeferredScopeStringMatches::DeferredScopeStringMatches):
+        (WebKit::WebFrameImpl::DeferredScopeStringMatches::doTimeout):
+        (WebKit::WebFrame::frameForEnteredContext):
+        (WebKit::WebFrame::frameForCurrentContext):
+        (WebKit::WebFrameImpl::name):
+        (WebKit::WebFrameImpl::url):
+        (WebKit::WebFrameImpl::favIconURL):
+        (WebKit::WebFrameImpl::openSearchDescriptionURL):
+        (WebKit::WebFrameImpl::scrollOffset):
+        (WebKit::WebFrameImpl::contentsSize):
+        (WebKit::WebFrameImpl::contentsPreferredWidth):
+        (WebKit::WebFrameImpl::hasVisibleContent):
+        (WebKit::WebFrameImpl::view):
+        (WebKit::WebFrameImpl::opener):
+        (WebKit::WebFrameImpl::parent):
+        (WebKit::WebFrameImpl::top):
+        (WebKit::WebFrameImpl::firstChild):
+        (WebKit::WebFrameImpl::lastChild):
+        (WebKit::WebFrameImpl::nextSibling):
+        (WebKit::WebFrameImpl::previousSibling):
+        (WebKit::WebFrameImpl::traverseNext):
+        (WebKit::WebFrameImpl::traversePrevious):
+        (WebKit::WebFrameImpl::findChildByName):
+        (WebKit::WebFrameImpl::findChildByExpression):
+        (WebKit::WebFrameImpl::forms):
+        (WebKit::WebFrameImpl::securityOrigin):
+        (WebKit::WebFrameImpl::grantUniversalAccess):
+        (WebKit::WebFrameImpl::windowObject):
+        (WebKit::WebFrameImpl::bindToWindowObject):
+        (WebKit::WebFrameImpl::executeScript):
+        (WebKit::WebFrameImpl::executeScriptInNewContext):
+        (WebKit::WebFrameImpl::executeScriptInIsolatedWorld):
+        (WebKit::WebFrameImpl::addMessageToConsole):
+        (WebKit::WebFrameImpl::collectGarbage):
+        (WebKit::WebFrameImpl::mainWorldScriptContext):
+        (WebKit::WebFrameImpl::insertStyleText):
+        (WebKit::WebFrameImpl::reload):
+        (WebKit::WebFrameImpl::loadRequest):
+        (WebKit::WebFrameImpl::loadHistoryItem):
+        (WebKit::WebFrameImpl::loadData):
+        (WebKit::WebFrameImpl::loadHTMLString):
+        (WebKit::WebFrameImpl::isLoading):
+        (WebKit::WebFrameImpl::stopLoading):
+        (WebKit::WebFrameImpl::provisionalDataSource):
+        (WebKit::WebFrameImpl::dataSource):
+        (WebKit::WebFrameImpl::previousHistoryItem):
+        (WebKit::WebFrameImpl::currentHistoryItem):
+        (WebKit::WebFrameImpl::enableViewSourceMode):
+        (WebKit::WebFrameImpl::isViewSourceModeEnabled):
+        (WebKit::WebFrameImpl::setReferrerForRequest):
+        (WebKit::WebFrameImpl::dispatchWillSendRequest):
+        (WebKit::WebFrameImpl::commitDocumentData):
+        (WebKit::WebFrameImpl::unloadListenerCount):
+        (WebKit::WebFrameImpl::isProcessingUserGesture):
+        (WebKit::WebFrameImpl::willSuppressOpenerInNewFrame):
+        (WebKit::WebFrameImpl::replaceSelection):
+        (WebKit::WebFrameImpl::insertText):
+        (WebKit::WebFrameImpl::setMarkedText):
+        (WebKit::WebFrameImpl::unmarkText):
+        (WebKit::WebFrameImpl::hasMarkedText):
+        (WebKit::WebFrameImpl::markedRange):
+        (WebKit::WebFrameImpl::executeCommand):
+        (WebKit::WebFrameImpl::isCommandEnabled):
+        (WebKit::WebFrameImpl::enableContinuousSpellChecking):
+        (WebKit::WebFrameImpl::isContinuousSpellCheckingEnabled):
+        (WebKit::WebFrameImpl::hasSelection):
+        (WebKit::WebFrameImpl::selectionRange):
+        (WebKit::WebFrameImpl::selectionAsText):
+        (WebKit::WebFrameImpl::selectionAsMarkup):
+        (WebKit::WebFrameImpl::printBegin):
+        (WebKit::WebFrameImpl::getPrintPageShrink):
+        (WebKit::WebFrameImpl::printPage):
+        (WebKit::WebFrameImpl::printEnd):
+        (WebKit::WebFrameImpl::find):
+        (WebKit::WebFrameImpl::stopFinding):
+        (WebKit::WebFrameImpl::scopeStringMatches):
+        (WebKit::WebFrameImpl::cancelPendingScopingEffort):
+        (WebKit::WebFrameImpl::increaseMatchCount):
+        (WebKit::WebFrameImpl::reportFindInPageSelection):
+        (WebKit::WebFrameImpl::resetMatchCount):
+        (WebKit::WebFrameImpl::completeURL):
+        (WebKit::WebFrameImpl::contentAsText):
+        (WebKit::WebFrameImpl::contentAsMarkup):
+        (WebKit::WebFrameImpl::create):
+        (WebKit::WebFrameImpl::WebFrameImpl):
+        (WebKit::WebFrameImpl::~WebFrameImpl):
+        (WebKit::WebFrameImpl::initializeAsMainFrame):
+        (WebKit::WebFrameImpl::createChildFrame):
+        (WebKit::WebFrameImpl::layout):
+        (WebKit::WebFrameImpl::paint):
+        (WebKit::WebFrameImpl::createFrameView):
+        (WebKit::WebFrameImpl::fromFrame):
+        (WebKit::WebFrameImpl::viewImpl):
+        (WebKit::WebFrameImpl::dataSourceImpl):
+        (WebKit::WebFrameImpl::provisionalDataSourceImpl):
+        (WebKit::WebFrameImpl::setFindEndstateFocusAndSelection):
+        (WebKit::WebFrameImpl::didFail):
+        (WebKit::WebFrameImpl::setAllowsScrolling):
+        (WebKit::WebFrameImpl::registerPasswordListener):
+        (WebKit::WebFrameImpl::getPasswordListener):
+        (WebKit::WebFrameImpl::closing):
+        (WebKit::WebFrameImpl::invalidateArea):
+        (WebKit::WebFrameImpl::addMarker):
+        (WebKit::WebFrameImpl::setMarkerActive):
+        (WebKit::WebFrameImpl::ordinalOfFirstMatchForFrame):
+        (WebKit::WebFrameImpl::shouldScopeMatches):
+        (WebKit::WebFrameImpl::scopeStringMatchesSoon):
+        (WebKit::WebFrameImpl::callScopeStringMatches):
+        (WebKit::WebFrameImpl::invalidateIfNecessary):
+        (WebKit::WebFrameImpl::clearPasswordListeners):
+        (WebKit::WebFrameImpl::loadJavaScriptURL):
+        * src/WebFrameImpl.h: Added.
+        (WebKit::WebFrameImpl::liveObjectCount):
+        (WebKit::WebFrameImpl::frame):
+        (WebKit::WebFrameImpl::frameView):
+        (WebKit::WebFrameImpl::activeMatchFrame):
+        (WebKit::WebFrameImpl::client):
+        (WebKit::WebFrameImpl::dropClient):
+        (WebKit::WebFrameImpl::ClientHandle::create):
+        (WebKit::WebFrameImpl::ClientHandle::client):
+        (WebKit::WebFrameImpl::ClientHandle::dropClient):
+        (WebKit::WebFrameImpl::ClientHandle::ClientHandle):
+        (WebKit::WebFrameImpl::):
+        * src/WebHTTPBody.cpp: Added.
+        (WebKit::WebHTTPBody::initialize):
+        (WebKit::WebHTTPBody::reset):
+        (WebKit::WebHTTPBody::assign):
+        (WebKit::WebHTTPBody::elementCount):
+        (WebKit::WebHTTPBody::elementAt):
+        (WebKit::WebHTTPBody::appendData):
+        (WebKit::WebHTTPBody::appendFile):
+        (WebKit::WebHTTPBody::identifier):
+        (WebKit::WebHTTPBody::setIdentifier):
+        (WebKit::WebHTTPBody::WebHTTPBody):
+        (WebKit::WebHTTPBody::operator=):
+        (WebKit::WebHTTPBody::operator PassRefPtr<FormData>):
+        (WebKit::WebHTTPBody::ensureMutable):
+        * src/WebHistoryItem.cpp: Added.
+        (WebKit::WebHistoryItem::initialize):
+        (WebKit::WebHistoryItem::reset):
+        (WebKit::WebHistoryItem::assign):
+        (WebKit::WebHistoryItem::urlString):
+        (WebKit::WebHistoryItem::setURLString):
+        (WebKit::WebHistoryItem::originalURLString):
+        (WebKit::WebHistoryItem::setOriginalURLString):
+        (WebKit::WebHistoryItem::referrer):
+        (WebKit::WebHistoryItem::setReferrer):
+        (WebKit::WebHistoryItem::target):
+        (WebKit::WebHistoryItem::setTarget):
+        (WebKit::WebHistoryItem::parent):
+        (WebKit::WebHistoryItem::setParent):
+        (WebKit::WebHistoryItem::title):
+        (WebKit::WebHistoryItem::setTitle):
+        (WebKit::WebHistoryItem::alternateTitle):
+        (WebKit::WebHistoryItem::setAlternateTitle):
+        (WebKit::WebHistoryItem::lastVisitedTime):
+        (WebKit::WebHistoryItem::setLastVisitedTime):
+        (WebKit::WebHistoryItem::scrollOffset):
+        (WebKit::WebHistoryItem::setScrollOffset):
+        (WebKit::WebHistoryItem::isTargetItem):
+        (WebKit::WebHistoryItem::setIsTargetItem):
+        (WebKit::WebHistoryItem::visitCount):
+        (WebKit::WebHistoryItem::setVisitCount):
+        (WebKit::WebHistoryItem::documentState):
+        (WebKit::WebHistoryItem::setDocumentState):
+        (WebKit::WebHistoryItem::httpContentType):
+        (WebKit::WebHistoryItem::setHTTPContentType):
+        (WebKit::WebHistoryItem::httpBody):
+        (WebKit::WebHistoryItem::setHTTPBody):
+        (WebKit::WebHistoryItem::children):
+        (WebKit::WebHistoryItem::setChildren):
+        (WebKit::WebHistoryItem::appendToChildren):
+        (WebKit::WebHistoryItem::WebHistoryItem):
+        (WebKit::WebHistoryItem::operator=):
+        (WebKit::WebHistoryItem::operator PassRefPtr<HistoryItem>):
+        (WebKit::WebHistoryItem::ensureMutable):
+        * src/WebImageCG.cpp: Added.
+        (WebKit::WebImage::fromData):
+        (WebKit::WebImage::reset):
+        (WebKit::WebImage::assign):
+        (WebKit::WebImage::isNull):
+        (WebKit::WebImage::size):
+        (WebKit::WebImage::WebImage):
+        (WebKit::WebImage::operator=):
+        * src/WebImageSkia.cpp: Added.
+        (WebKit::WebImage::fromData):
+        (WebKit::WebImage::reset):
+        (WebKit::WebImage::assign):
+        (WebKit::WebImage::isNull):
+        (WebKit::WebImage::size):
+        (WebKit::WebImage::WebImage):
+        (WebKit::WebImage::operator=):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.src>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: WebData...WebElement
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WebData.cpp: Added.
+        (WebKit::WebData::reset):
+        (WebKit::WebData::assign):
+        (WebKit::WebData::size):
+        (WebKit::WebData::data):
+        (WebKit::WebData::WebData):
+        (WebKit::WebData::operator=):
+        (WebKit::WebData::operator PassRefPtr<SharedBuffer>):
+        * src/WebDataSourceImpl.cpp: Added.
+        (WebKit::WebDataSourceImpl::create):
+        (WebKit::WebDataSourceImpl::originalRequest):
+        (WebKit::WebDataSourceImpl::request):
+        (WebKit::WebDataSourceImpl::response):
+        (WebKit::WebDataSourceImpl::hasUnreachableURL):
+        (WebKit::WebDataSourceImpl::unreachableURL):
+        (WebKit::WebDataSourceImpl::redirectChain):
+        (WebKit::WebDataSourceImpl::pageTitle):
+        (WebKit::WebDataSourceImpl::navigationType):
+        (WebKit::WebDataSourceImpl::triggeringEventTime):
+        (WebKit::WebDataSourceImpl::extraData):
+        (WebKit::WebDataSourceImpl::setExtraData):
+        (WebKit::WebDataSourceImpl::toWebNavigationType):
+        (WebKit::WebDataSourceImpl::endOfRedirectChain):
+        (WebKit::WebDataSourceImpl::clearRedirectChain):
+        (WebKit::WebDataSourceImpl::appendRedirect):
+        (WebKit::WebDataSourceImpl::setNextPluginLoadObserver):
+        (WebKit::WebDataSourceImpl::WebDataSourceImpl):
+        (WebKit::WebDataSourceImpl::~WebDataSourceImpl):
+        * src/WebDataSourceImpl.h: Added.
+        (WebKit::WebDataSourceImpl::fromDocumentLoader):
+        (WebKit::WebDataSourceImpl::hasRedirectChain):
+        (WebKit::WebDataSourceImpl::releasePluginLoadObserver):
+        * src/WebDatabase.cpp: Added.
+        (WebKit::WebDatabase::reset):
+        (WebKit::WebDatabase::assign):
+        (WebKit::WebDatabase::name):
+        (WebKit::WebDatabase::displayName):
+        (WebKit::WebDatabase::estimatedSize):
+        (WebKit::WebDatabase::securityOrigin):
+        (WebKit::WebDatabase::setObserver):
+        (WebKit::WebDatabase::observer):
+        (WebKit::WebDatabase::updateDatabaseSize):
+        (WebKit::WebDatabase::WebDatabase):
+        (WebKit::WebDatabase::operator=):
+        (WebKit::WebDatabase::operator WTF::PassRefPtr<Database>):
+        * src/WebDevToolsAgentPrivate.h: Added.
+        * src/WebDragData.cpp: Added.
+        (WebKit::WebDragData::initialize):
+        (WebKit::WebDragData::reset):
+        (WebKit::WebDragData::assign):
+        (WebKit::WebDragData::url):
+        (WebKit::WebDragData::setURL):
+        (WebKit::WebDragData::urlTitle):
+        (WebKit::WebDragData::setURLTitle):
+        (WebKit::WebDragData::fileExtension):
+        (WebKit::WebDragData::setFileExtension):
+        (WebKit::WebDragData::hasFileNames):
+        (WebKit::WebDragData::fileNames):
+        (WebKit::WebDragData::setFileNames):
+        (WebKit::WebDragData::appendToFileNames):
+        (WebKit::WebDragData::plainText):
+        (WebKit::WebDragData::setPlainText):
+        (WebKit::WebDragData::htmlText):
+        (WebKit::WebDragData::setHTMLText):
+        (WebKit::WebDragData::htmlBaseURL):
+        (WebKit::WebDragData::setHTMLBaseURL):
+        (WebKit::WebDragData::fileContentFileName):
+        (WebKit::WebDragData::setFileContentFileName):
+        (WebKit::WebDragData::fileContent):
+        (WebKit::WebDragData::setFileContent):
+        (WebKit::WebDragData::WebDragData):
+        (WebKit::WebDragData::operator=):
+        (WebKit::WebDragData::operator WTF::PassRefPtr<WebCore::ChromiumDataObject>):
+        (WebKit::WebDragData::ensureMutable):
+        * src/WebElement.cpp: Added.
+        (WebKit::WebElement::WebElement):
+        (WebKit::WebElement::operator=):
+        (WebKit::WebElement::operator WTF::PassRefPtr<Element>):
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebPo*.h and WebRunetimeFeatures.h Chromium API headers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebPoint.h: Added.
+        (WebKit::WebPoint::WebPoint):
+        (WebKit::WebPoint::operator=):
+        (WebKit::WebPoint::operator WebCore::IntPoint):
+        (WebKit::WebPoint::operator gfx::Point):
+        (WebKit::operator==):
+        (WebKit::operator!=):
+        * public/WebPopupMenu.h: Added.
+        * public/WebPopupMenuInfo.h: Added.
+        (WebKit::WebPopupMenuInfo::Item::):
+        * public/WebRuntimeFeatures.h: Added.
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebPa*.h and WebPl*.h Chromium API headers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebPasswordAutocompleteListener.h: Added.
+        (WebKit::WebPasswordAutocompleteListener::~WebPasswordAutocompleteListener):
+        * public/WebPasswordFormData.h: Added.
+        (WebKit::WebPasswordFormData::isValid):
+        * public/WebPlugin.h: Added.
+        (WebKit::WebPlugin::~WebPlugin):
+        * public/WebPluginContainer.h: Added.
+        (WebKit::WebPluginContainer::~WebPluginContainer):
+        * public/WebPluginListBuilder.h: Added.
+        * public/WebPluginParams.h: Added.
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: WebBindging ... WebCursorInfo
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WebBindings.cpp: Added.
+        (WebKit::WebBindings::construct):
+        (WebKit::WebBindings::createObject):
+        (WebKit::WebBindings::enumerate):
+        (WebKit::WebBindings::evaluate):
+        (WebKit::WebBindings::evaluateHelper):
+        (WebKit::WebBindings::getIntIdentifier):
+        (WebKit::WebBindings::getProperty):
+        (WebKit::WebBindings::getStringIdentifier):
+        (WebKit::WebBindings::getStringIdentifiers):
+        (WebKit::WebBindings::hasMethod):
+        (WebKit::WebBindings::hasProperty):
+        (WebKit::WebBindings::identifierIsString):
+        (WebKit::WebBindings::intFromIdentifier):
+        (WebKit::WebBindings::initializeVariantWithStringCopy):
+        (WebKit::WebBindings::invoke):
+        (WebKit::WebBindings::invokeDefault):
+        (WebKit::WebBindings::releaseObject):
+        (WebKit::WebBindings::releaseVariantValue):
+        (WebKit::WebBindings::removeProperty):
+        (WebKit::WebBindings::retainObject):
+        (WebKit::WebBindings::setException):
+        (WebKit::WebBindings::setProperty):
+        (WebKit::WebBindings::unregisterObject):
+        (WebKit::WebBindings::utf8FromIdentifier):
+        (WebKit::WebBindings::extractIdentifierData):
+        (WebKit::getEvent):
+        (WebKit::getDragDataImpl):
+        (WebKit::getRangeImpl):
+        (WebKit::WebBindings::getDragData):
+        (WebKit::WebBindings::isDragEvent):
+        (WebKit::WebBindings::getRange):
+        * src/WebCString.cpp: Added.
+        (WebKit::WebCString::reset):
+        (WebKit::WebCString::assign):
+        (WebKit::WebCString::length):
+        (WebKit::WebCString::data):
+        (WebKit::WebCString::utf16):
+        (WebKit::WebCString::fromUTF16):
+        (WebKit::WebCString::WebCString):
+        (WebKit::WebCString::operator=):
+        (WebKit::WebCString::operator WebCore::CString):
+        * src/WebCache.cpp: Added.
+        (WebKit::ToResourceTypeStat):
+        (WebKit::WebCache::setCapacities):
+        (WebKit::WebCache::clear):
+        (WebKit::WebCache::getUsageStats):
+        (WebKit::WebCache::getResourceTypeStats):
+        * src/WebColor.cpp: Added.
+        (WebKit::toCSSValueKeyword):
+        (WebKit::setNamedColors):
+        * src/WebCrossOriginPreflightResultCache.cpp: Added.
+        (WebKit::WebCrossOriginPreflightResultCache::clear):
+        * src/WebCursorInfo.cpp: Added.
+        (WebKit::WebCursorInfo::WebCursorInfo):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Up-streaming Chromium API src files: WebAccessibilty
+
+        https://bugs.webkit.org/show_bug.cgi?id=31276
+
+        * src/WebAccessibilityCache.cpp: Added.
+        (WebKit::WebAccessibilityCache::enableAccessibility):
+        * src/WebAccessibilityCacheImpl.cpp: Added.
+        (WebKit::toAccessibilityObject):
+        (WebKit::WebAccessibilityCache::create):
+        (WebKit::WebAccessibilityCacheImpl::WeakHandle::create):
+        (WebKit::WebAccessibilityCacheImpl::WeakHandle::WeakHandle):
+        (WebKit::WebAccessibilityCacheImpl::WeakHandle::detach):
+        (WebKit::WebAccessibilityCacheImpl::WebAccessibilityCacheImpl):
+        (WebKit::WebAccessibilityCacheImpl::~WebAccessibilityCacheImpl):
+        (WebKit::WebAccessibilityCacheImpl::initialize):
+        (WebKit::WebAccessibilityCacheImpl::getObjectById):
+        (WebKit::WebAccessibilityCacheImpl::isValidId):
+        (WebKit::WebAccessibilityCacheImpl::remove):
+        (WebKit::WebAccessibilityCacheImpl::clear):
+        (WebKit::WebAccessibilityCacheImpl::addOrGetId):
+        * src/WebAccessibilityCacheImpl.h: Added.
+        (WebKit::WebAccessibilityCacheImpl::isInitialized):
+        * src/WebAccessibilityObject.cpp: Added.
+        (WebKit::WebAccessibilityObject::reset):
+        (WebKit::WebAccessibilityObject::assign):
+        (WebKit::WebAccessibilityObject::accessibilityDescription):
+        (WebKit::WebAccessibilityObject::actionVerb):
+        (WebKit::WebAccessibilityObject::canSetFocusAttribute):
+        (WebKit::WebAccessibilityObject::childCount):
+        (WebKit::WebAccessibilityObject::childAt):
+        (WebKit::WebAccessibilityObject::firstChild):
+        (WebKit::WebAccessibilityObject::focusedChild):
+        (WebKit::WebAccessibilityObject::lastChild):
+        (WebKit::WebAccessibilityObject::nextSibling):
+        (WebKit::WebAccessibilityObject::parentObject):
+        (WebKit::WebAccessibilityObject::previousSibling):
+        (WebKit::WebAccessibilityObject::isAnchor):
+        (WebKit::WebAccessibilityObject::isChecked):
+        (WebKit::WebAccessibilityObject::isFocused):
+        (WebKit::WebAccessibilityObject::isEnabled):
+        (WebKit::WebAccessibilityObject::isHovered):
+        (WebKit::WebAccessibilityObject::isIndeterminate):
+        (WebKit::WebAccessibilityObject::isMultiSelect):
+        (WebKit::WebAccessibilityObject::isOffScreen):
+        (WebKit::WebAccessibilityObject::isPasswordField):
+        (WebKit::WebAccessibilityObject::isPressed):
+        (WebKit::WebAccessibilityObject::isReadOnly):
+        (WebKit::WebAccessibilityObject::isVisited):
+        (WebKit::WebAccessibilityObject::boundingBoxRect):
+        (WebKit::WebAccessibilityObject::helpText):
+        (WebKit::WebAccessibilityObject::hitTest):
+        (WebKit::WebAccessibilityObject::keyboardShortcut):
+        (WebKit::WebAccessibilityObject::performDefaultAction):
+        (WebKit::WebAccessibilityObject::roleValue):
+        (WebKit::WebAccessibilityObject::stringValue):
+        (WebKit::WebAccessibilityObject::title):
+        (WebKit::WebAccessibilityObject::WebAccessibilityObject):
+        (WebKit::WebAccessibilityObject::operator=):
+        (WebKit::WebAccessibilityObject::operator WTF::PassRefPtr<WebCore::AccessibilityObject>):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstreaming Chromium API: Platform specific files
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/gtk/WebFontInfo.h: Added.
+        * public/gtk/WebInputEventFactory.h: Added.
+        * public/gtk/WebScreenInfoFactory.h: Added.
+        * public/linux/WebFontRendering.h: Added.
+        * public/linux/WebSandboxSupport.h: Added.
+        * public/mac/WebInputEventFactory.h: Added.
+        * public/mac/WebScreenInfoFactory.h: Added.
+        * public/win/WebInputEventFactory.h: Added.
+        * public/win/WebSandboxSupport.h: Added.
+        * public/win/WebScreenInfoFactory.h: Added.
+        * public/win/WebThemeEngine.h: Added.
+        * public/x11/WebScreenInfoFactory.h: Added.
+
+2009-11-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Change struct ResourceRequest to class ResourceRequest per
+        http://trac.webkit.org/changeset/50625.
+
+        * public/WebURLRequest.h:
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream remaining Chromium API WebN*.h headers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebNonCopyable.h: Added.
+        (WebKit::WebNonCopyable::WebNonCopyable):
+        (WebKit::WebNonCopyable::~WebNonCopyable):
+        * public/WebNotification.h: Added.
+        (WebKit::WebNotification::WebNotification):
+        (WebKit::WebNotification::~WebNotification):
+        (WebKit::WebNotification::operator=):
+        (WebKit::WebNotification::equals):
+        (WebKit::operator==):
+        (WebKit::operator!=):
+        (WebKit::operator<):
+        * public/WebNotificationPermissionCallback.h: Added.
+        (WebKit::WebNotificationPermissionCallback::~WebNotificationPermissionCallback):
+        * public/WebNotificationPresenter.h: Added.
+        (WebKit::WebNotificationPresenter::):
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream Chromium API headers WebMessage through WebNavigation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebMessagePortChannel.h: Added.
+        (WebKit::WebMessagePortChannel::~WebMessagePortChannel):
+        * public/WebMessagePortChannelClient.h: Added.
+        (WebKit::WebMessagePortChannelClient::~WebMessagePortChannelClient):
+        * public/WebMimeRegistry.h: Added.
+        (WebKit::WebMimeRegistry::):
+        (WebKit::WebMimeRegistry::~WebMimeRegistry):
+        * public/WebNavigationPolicy.h: Added.
+        (WebKit::):
+        * public/WebNavigationType.h: Added.
+        (WebKit::):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstreaming the Chromium WebKit API: WebScreenInfo to WebSharedWorkerRepo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebScreenInfo.h: Added.
+        (WebKit::WebScreenInfo::WebScreenInfo):
+        * public/WebScriptController.h: Added.
+        * public/WebScriptSource.h: Added.
+        (WebKit::WebScriptSource::WebScriptSource):
+        * public/WebSearchableFormData.h: Added.
+        (WebKit::WebSearchableFormData::isValid):
+        (WebKit::WebSearchableFormData::url):
+        (WebKit::WebSearchableFormData::encoding):
+        * public/WebSecurityOrigin.h: Added.
+        (WebKit::WebSecurityOrigin::~WebSecurityOrigin):
+        (WebKit::WebSecurityOrigin::WebSecurityOrigin):
+        (WebKit::WebSecurityOrigin::operator=):
+        (WebKit::WebSecurityOrigin::isNull):
+        * public/WebSecurityPolicy.h: Added.
+        * public/WebSettings.h: Added.
+        (WebKit::WebSettings::~WebSettings):
+        * public/WebSharedWorker.h: Added.
+        (WebKit::WebSharedWorker::~WebSharedWorker):
+        * public/WebSharedWorkerRepository.h: Added.
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream Chromium API headers Webkit.h thru WebMediaPlayerClient.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebKit.h: Added.
+        * public/WebKitClient.h: Added.
+        (WebKit::WebKitClient::~WebKitClient):
+        * public/WebLocalizedString.h: Added.
+        (WebKit::WebLocalizedString::):
+        * public/WebMediaPlayer.h: Added.
+        (WebKit::WebTimeRange::WebTimeRange):
+        (WebKit::WebMediaPlayer::):
+        (WebKit::WebMediaPlayer::~WebMediaPlayer):
+        * public/WebMediaPlayerAction.h: Added.
+        (WebKit::WebMediaPlayerAction::):
+        (WebKit::WebMediaPlayerAction::WebMediaPlayerAction):
+        * public/WebMediaPlayerClient.h: Added.
+        (WebKit::WebMediaPlayerClient::~WebMediaPlayerClient):
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream rest of WebH*.h and WebI*.h Chromium API headers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebHTTPBody.h: Added.
+        (WebKit::WebHTTPBody::Element::):
+        (WebKit::WebHTTPBody::~WebHTTPBody):
+        (WebKit::WebHTTPBody::WebHTTPBody):
+        (WebKit::WebHTTPBody::operator=):
+        (WebKit::WebHTTPBody::isNull):
+        * public/WebHTTPHeaderVisitor.h: Added.
+        (WebKit::WebHTTPHeaderVisitor::~WebHTTPHeaderVisitor):
+        * public/WebHistoryItem.h: Added.
+        (WebKit::WebHistoryItem::~WebHistoryItem):
+        (WebKit::WebHistoryItem::WebHistoryItem):
+        (WebKit::WebHistoryItem::operator=):
+        (WebKit::WebHistoryItem::isNull):
+        * public/WebImage.h: Added.
+        (WebKit::WebImage::~WebImage):
+        (WebKit::WebImage::WebImage):
+        (WebKit::WebImage::operator=):
+        (WebKit::WebImage::getSkBitmap):
+        (WebKit::WebImage::init):
+        (WebKit::WebImage::getCGImageRef):
+        * public/WebInputEvent.h: Added.
+        (WebKit::WebInputEvent::WebInputEvent):
+        (WebKit::WebInputEvent::):
+        (WebKit::WebInputEvent::isKeyboardEventType):
+        (WebKit::WebKeyboardEvent::WebKeyboardEvent):
+        (WebKit::WebMouseEvent::):
+        (WebKit::WebMouseEvent::WebMouseEvent):
+        (WebKit::WebMouseWheelEvent::WebMouseWheelEvent):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Upstreaming the Chromium WebKit API: WebSockets and WebStorage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebSocketStreamError.h: Added.
+        * public/WebSocketStreamHandle.h: Added.
+        (WebKit::WebSocketStreamHandle::~WebSocketStreamHandle):
+        * public/WebSocketStreamHandleClient.h: Added.
+        * public/WebStorageArea.h: Added.
+        (WebKit::WebStorageArea::~WebStorageArea):
+        * public/WebStorageEventDispatcher.h: Added.
+        (WebKit::WebStorageEventDispatcher::~WebStorageEventDispatcher):
+        * public/WebStorageNamespace.h: Added.
+        (WebKit::WebStorageNamespace::~WebStorageNamespace):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstreaming the Chromium WebKit API: WebString and other basic objects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebRange.h: Added.
+        (WebKit::WebRange::~WebRange):
+        (WebKit::WebRange::WebRange):
+        (WebKit::WebRange::operator=):
+        (WebKit::WebRange::isNull):
+        * public/WebRect.h: Added.
+        (WebKit::WebRect::isEmpty):
+        (WebKit::WebRect::WebRect):
+        (WebKit::WebRect::operator=):
+        (WebKit::WebRect::operator WebCore::IntRect):
+        (WebKit::WebRect::operator gfx::Rect):
+        (WebKit::operator==):
+        (WebKit::operator!=):
+        * public/WebSize.h: Added.
+        (WebKit::WebSize::isEmpty):
+        (WebKit::WebSize::WebSize):
+        (WebKit::WebSize::operator=):
+        (WebKit::WebSize::operator WebCore::IntSize):
+        (WebKit::WebSize::operator gfx::Size):
+        (WebKit::operator==):
+        (WebKit::operator!=):
+        * public/WebString.h: Added.
+        (WebKit::WebString::~WebString):
+        (WebKit::WebString::WebString):
+        (WebKit::WebString::operator=):
+        (WebKit::WebString::isEmpty):
+        (WebKit::WebString::isNull):
+        (WebKit::WebString::operator string16):
+        (WebKit::WebString::operator NullableString16):
+        (WebKit::WebString::fromUTF8):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Upstreaming the Chromium WebKit API: WebText*
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebTextAffinity.h: Added.
+        (WebKit::):
+        * public/WebTextDirection.h: Added.
+        (WebKit::):
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream remainder of WebE*.h and WebF*.h Chromium API headers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebEditingAction.h: Added.
+        (WebKit::):
+        * public/WebFileChooserCompletion.h: Added.
+        (WebKit::WebFileChooserCompletion::~WebFileChooserCompletion):
+        * public/WebFindOptions.h: Added.
+        (WebKit::WebFindOptions::WebFindOptions):
+        * public/WebFontCache.h: Added.
+        * public/WebFrame.h: Added.
+        (WebKit::WebFrame::~WebFrame):
+        * public/WebFrameClient.h: Added.
+        (WebKit::WebFrameClient::createPlugin):
+        (WebKit::WebFrameClient::createWorker):
+        (WebKit::WebFrameClient::createSharedWorker):
+        (WebKit::WebFrameClient::createMediaPlayer):
+        (WebKit::WebFrameClient::willClose):
+        (WebKit::WebFrameClient::loadURLExternally):
+        (WebKit::WebFrameClient::decidePolicyForNavigation):
+        (WebKit::WebFrameClient::canHandleRequest):
+        (WebKit::WebFrameClient::cannotHandleRequestError):
+        (WebKit::WebFrameClient::cancelledError):
+        (WebKit::WebFrameClient::unableToImplementPolicyWithError):
+        (WebKit::WebFrameClient::willSubmitForm):
+        (WebKit::WebFrameClient::willPerformClientRedirect):
+        (WebKit::WebFrameClient::didCancelClientRedirect):
+        (WebKit::WebFrameClient::didCompleteClientRedirect):
+        (WebKit::WebFrameClient::didCreateDataSource):
+        (WebKit::WebFrameClient::didStartProvisionalLoad):
+        (WebKit::WebFrameClient::didReceiveServerRedirectForProvisionalLoad):
+        (WebKit::WebFrameClient::didFailProvisionalLoad):
+        (WebKit::WebFrameClient::didReceiveDocumentData):
+        (WebKit::WebFrameClient::didCommitProvisionalLoad):
+        (WebKit::WebFrameClient::didClearWindowObject):
+        (WebKit::WebFrameClient::didCreateDocumentElement):
+        (WebKit::WebFrameClient::didReceiveTitle):
+        (WebKit::WebFrameClient::didFinishDocumentLoad):
+        (WebKit::WebFrameClient::didHandleOnloadEvents):
+        (WebKit::WebFrameClient::didFailLoad):
+        (WebKit::WebFrameClient::didFinishLoad):
+        (WebKit::WebFrameClient::didChangeLocationWithinPage):
+        (WebKit::WebFrameClient::didUpdateCurrentHistoryItem):
+        (WebKit::WebFrameClient::assignIdentifierToRequest):
+        (WebKit::WebFrameClient::willSendRequest):
+        (WebKit::WebFrameClient::didReceiveResponse):
+        (WebKit::WebFrameClient::didFinishResourceLoad):
+        (WebKit::WebFrameClient::didFailResourceLoad):
+        (WebKit::WebFrameClient::didLoadResourceFromMemoryCache):
+        (WebKit::WebFrameClient::didDisplayInsecureContent):
+        (WebKit::WebFrameClient::didRunInsecureContent):
+        (WebKit::WebFrameClient::allowScript):
+        (WebKit::WebFrameClient::didExhaustMemoryAvailableForScript):
+        (WebKit::WebFrameClient::didCreateScriptContext):
+        (WebKit::WebFrameClient::didDestroyScriptContext):
+        (WebKit::WebFrameClient::didCreateIsolatedScriptContext):
+        (WebKit::WebFrameClient::didChangeContentsSize):
+        (WebKit::WebFrameClient::didChangeScrollOffset):
+        (WebKit::WebFrameClient::reportFindInPageMatchCount):
+        (WebKit::WebFrameClient::reportFindInPageSelection):
+        (WebKit::WebFrameClient::~WebFrameClient):
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream WebDevTools*.h and WebDrag*.h Chromium API headers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebDevToolsAgent.h: Added.
+        (WebKit::WebDevToolsAgent::~WebDevToolsAgent):
+        * public/WebDevToolsAgentClient.h: Added.
+        (WebKit::WebDevToolsAgentClient::~WebDevToolsAgentClient):
+        * public/WebDevToolsFrontend.h: Added.
+        (WebKit::WebDevToolsFrontend::~WebDevToolsFrontend):
+        * public/WebDevToolsFrontendClient.h: Added.
+        (WebKit::WebDevToolsFrontendClient::WebDevToolsFrontendClient):
+        (WebKit::WebDevToolsFrontendClient::~WebDevToolsFrontendClient):
+        * public/WebDragData.h: Added.
+        (WebKit::WebDragData::~WebDragData):
+        (WebKit::WebDragData::WebDragData):
+        (WebKit::WebDragData::operator=):
+        (WebKit::WebDragData::isNull):
+        * public/WebDragOperation.h: Added.
+        (WebKit::):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstreaming the Chromium WebKit API: WebURL and friends.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebURL.h: Added.
+        (WebKit::WebURL::~WebURL):
+        (WebKit::WebURL::WebURL):
+        (WebKit::WebURL::operator=):
+        (WebKit::WebURL::assign):
+        (WebKit::WebURL::spec):
+        (WebKit::WebURL::parsed):
+        (WebKit::WebURL::isValid):
+        (WebKit::WebURL::isEmpty):
+        (WebKit::WebURL::isNull):
+        (WebKit::WebURL::operator GURL):
+        * public/WebURLError.h: Added.
+        (WebKit::WebURLError::WebURLError):
+        * public/WebURLLoader.h: Added.
+        (WebKit::WebURLLoader::~WebURLLoader):
+        * public/WebURLLoaderClient.h: Added.
+        (WebKit::WebURLLoaderClient::~WebURLLoaderClient):
+        * public/WebURLRequest.h: Added.
+        (WebKit::WebURLRequest::):
+        (WebKit::WebURLRequest::~WebURLRequest):
+        (WebKit::WebURLRequest::WebURLRequest):
+        (WebKit::WebURLRequest::operator=):
+        * public/WebURLResponse.h: Added.
+        (WebKit::WebURLResponse::~WebURLResponse):
+        (WebKit::WebURLResponse::WebURLResponse):
+        (WebKit::WebURLResponse::operator=):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstreaming the Chromium WebKit API: WebVector to WebWorkerClient
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebVector.h: Added.
+        (WebKit::WebVector::~WebVector):
+        (WebKit::WebVector::WebVector):
+        (WebKit::WebVector::operator=):
+        (WebKit::WebVector::assign):
+        (WebKit::WebVector::size):
+        (WebKit::WebVector::isEmpty):
+        (WebKit::WebVector::operator[]):
+        (WebKit::WebVector::data):
+        (WebKit::WebVector::swap):
+        (WebKit::WebVector::initialize):
+        (WebKit::WebVector::initializeFrom):
+        (WebKit::WebVector::destroy):
+        * public/WebView.h: Added.
+        (WebKit::WebView::~WebView):
+        * public/WebViewClient.h: Added.
+        (WebKit::WebViewClient::createView):
+        (WebKit::WebViewClient::createPopupMenu):
+        (WebKit::WebViewClient::didAddMessageToConsole):
+        (WebKit::WebViewClient::printPage):
+        (WebKit::WebViewClient::notificationPresenter):
+        (WebKit::WebViewClient::didStartLoading):
+        (WebKit::WebViewClient::didStopLoading):
+        (WebKit::WebViewClient::shouldBeginEditing):
+        (WebKit::WebViewClient::shouldEndEditing):
+        (WebKit::WebViewClient::shouldInsertNode):
+        (WebKit::WebViewClient::shouldInsertText):
+        (WebKit::WebViewClient::shouldChangeSelectedRange):
+        (WebKit::WebViewClient::shouldDeleteRange):
+        (WebKit::WebViewClient::shouldApplyStyle):
+        (WebKit::WebViewClient::isSmartInsertDeleteEnabled):
+        (WebKit::WebViewClient::isSelectTrailingWhitespaceEnabled):
+        (WebKit::WebViewClient::setInputMethodEnabled):
+        (WebKit::WebViewClient::didBeginEditing):
+        (WebKit::WebViewClient::didChangeSelection):
+        (WebKit::WebViewClient::didChangeContents):
+        (WebKit::WebViewClient::didExecuteCommand):
+        (WebKit::WebViewClient::didEndEditing):
+        (WebKit::WebViewClient::handleCurrentKeyboardEvent):
+        (WebKit::WebViewClient::spellCheck):
+        (WebKit::WebViewClient::autoCorrectWord):
+        (WebKit::WebViewClient::showSpellingUI):
+        (WebKit::WebViewClient::isShowingSpellingUI):
+        (WebKit::WebViewClient::updateSpellingUIWithMisspelledWord):
+        (WebKit::WebViewClient::runFileChooser):
+        (WebKit::WebViewClient::runModalAlertDialog):
+        (WebKit::WebViewClient::runModalConfirmDialog):
+        (WebKit::WebViewClient::runModalPromptDialog):
+        (WebKit::WebViewClient::runModalBeforeUnloadDialog):
+        (WebKit::WebViewClient::setStatusText):
+        (WebKit::WebViewClient::setMouseOverURL):
+        (WebKit::WebViewClient::setKeyboardFocusURL):
+        (WebKit::WebViewClient::setToolTipText):
+        (WebKit::WebViewClient::showContextMenu):
+        (WebKit::WebViewClient::startDragging):
+        (WebKit::WebViewClient::acceptsLoadDrops):
+        (WebKit::WebViewClient::focusNext):
+        (WebKit::WebViewClient::focusPrevious):
+        (WebKit::WebViewClient::navigateBackForwardSoon):
+        (WebKit::WebViewClient::historyBackListCount):
+        (WebKit::WebViewClient::historyForwardListCount):
+        (WebKit::WebViewClient::didAddHistoryItem):
+        (WebKit::WebViewClient::focusAccessibilityObject):
+        (WebKit::WebViewClient::didUpdateInspectorSettings):
+        (WebKit::WebViewClient::queryAutofillSuggestions):
+        (WebKit::WebViewClient::removeAutofillSuggestions):
+        (WebKit::WebViewClient::~WebViewClient):
+        * public/WebWidget.h: Added.
+        (WebKit::WebWidget::~WebWidget):
+        * public/WebWidgetClient.h: Added.
+        (WebKit::WebWidgetClient::didInvalidateRect):
+        (WebKit::WebWidgetClient::didScrollRect):
+        (WebKit::WebWidgetClient::didFocus):
+        (WebKit::WebWidgetClient::didBlur):
+        (WebKit::WebWidgetClient::didChangeCursor):
+        (WebKit::WebWidgetClient::closeWidgetSoon):
+        (WebKit::WebWidgetClient::show):
+        (WebKit::WebWidgetClient::runModal):
+        (WebKit::WebWidgetClient::windowRect):
+        (WebKit::WebWidgetClient::setWindowRect):
+        (WebKit::WebWidgetClient::windowResizerRect):
+        (WebKit::WebWidgetClient::rootWindowRect):
+        (WebKit::WebWidgetClient::screenInfo):
+        (WebKit::WebWidgetClient::~WebWidgetClient):
+        * public/WebWorker.h: Added.
+        (WebKit::WebWorker::~WebWorker):
+        * public/WebWorkerClient.h: Added.
+        (WebKit::WebWorkerClient::~WebWorkerClient):
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream WebData*.h Chromium API files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebData.h: Added.
+        (WebKit::WebData::~WebData):
+        (WebKit::WebData::WebData):
+        (WebKit::WebData::operator=):
+        (WebKit::WebData::isEmpty):
+        (WebKit::WebData::isNull):
+        * public/WebDataSource.h: Added.
+        (WebKit::WebDataSource::ExtraData::~ExtraData):
+        (WebKit::WebDataSource::~WebDataSource):
+        * public/WebDatabase.h: Added.
+        (WebKit::WebDatabase::WebDatabase):
+        (WebKit::WebDatabase::~WebDatabase):
+        (WebKit::WebDatabase::operator=):
+        (WebKit::WebDatabase::isNull):
+        * public/WebDatabaseObserver.h: Added.
+        (WebKit::WebDatabaseObserver::~WebDatabaseObserver):
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream the last of the Chromium API WebC*.h files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebConsoleMessage.h: Added.
+        (WebKit::WebConsoleMessage::):
+        (WebKit::WebConsoleMessage::WebConsoleMessage):
+        * public/WebContextMenuData.h: Added.
+        (WebKit::WebContextMenuData::):
+        * public/WebCookie.h: Added.
+        (WebKit::WebCookie::WebCookie):
+        * public/WebCrossOriginPreflightResultCache.h: Added.
+        * public/WebCursorInfo.h: Added.
+        (WebKit::WebCursorInfo::):
+        (WebKit::WebCursorInfo::WebCursorInfo):
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        More WebC*.h upstreaming.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebCString.h: Added.
+        (WebKit::WebCString::~WebCString):
+        (WebKit::WebCString::WebCString):
+        (WebKit::WebCString::operator=):
+        (WebKit::WebCString::isEmpty):
+        (WebKit::WebCString::isNull):
+        (WebKit::WebCString::operator std::string):
+        (WebKit::WebCString::fromUTF16):
+        * public/WebColorName.h: Added.
+        (WebKit::):
+        * public/WebCommon.h: Added.
+        * public/WebCommonWorkerClient.h: Added.
+        (WebKit::WebCommonWorkerClient::~WebCommonWorkerClient):
+        * public/WebCompositionCommand.h: Added.
+        (WebKit::):
+
+2009-11-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstreaming the Chromium WebKit API: WebNode.h and friends are thin wrappers around WebCore::Nodes
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * public/WebElement.h: Added.
+        (WebKit::WebElement::WebElement):
+        (WebKit::WebElement::operator=):
+        (WebKit::WebElement::assign):
+        * public/WebFormElement.h: Added.
+        (WebKit::WebFormElement::~WebFormElement):
+        (WebKit::WebFormElement::WebFormElement):
+        (WebKit::WebFormElement::operator=):
+        (WebKit::WebFormElement::assign):
+        * public/WebInputElement.h: Added.
+        (WebKit::WebInputElement::WebInputElement):
+        (WebKit::WebInputElement::operator=):
+        (WebKit::WebInputElement::assign):
+        * public/WebNode.h: Added.
+        (WebKit::WebNode::~WebNode):
+        (WebKit::WebNode::WebNode):
+        (WebKit::WebNode::operator=):
+        (WebKit::WebNode::isNull):
+        (WebKit::WebNode::toElement):
+        (WebKit::WebNode::unwrap):
+        (WebKit::WebNode::constUnwrap):
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebKit Chromium API upstreaming, WebBindings.h through WebColor.h.
+
+        * public/WebBindings.h: Added.
+        * public/WebCache.h: Added.
+        * public/WebCanvas.h: Added.
+        * public/WebClipboard.h: Added.
+        (WebKit::WebClipboard::):
+        (WebKit::WebClipboard::~WebClipboard):
+        * public/WebColor.h: Added.
+
+2009-11-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Starting upstreaming the Chromium WebKit API.  public/ contains header files only.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28394
+
+        * ChangeLog: First!!
+        * public: Added.
+        * public/WebAccessibilityCache.h: Added.
+        (WebKit::WebAccessibilityCache::WebAccessibilityCache):
+        (WebKit::WebAccessibilityCache::~WebAccessibilityCache):
+        * public/WebAccessibilityObject.h: Added.
+        (WebKit::WebAccessibilityObject::~WebAccessibilityObject):
+        (WebKit::WebAccessibilityObject::WebAccessibilityObject):
+        (WebKit::WebAccessibilityObject::operator=):
+        (WebKit::WebAccessibilityObject::isNull):
+        * public/WebAccessibilityRole.h: Added.
+        (WebKit::):
+        * public/WebApplicationCacheHost.h: Added.
+        (WebKit::WebApplicationCacheHost::):
+        (WebKit::WebApplicationCacheHost::~WebApplicationCacheHost):
+        * public/WebApplicationCacheHostClient.h: Added.
+        (WebKit::WebApplicationCacheHostClient::~WebApplicationCacheHostClient):
diff --git a/WebKit/chromium/DEPS b/WebKit/chromium/DEPS
index 5f5b9b8..fc90187 100644
--- a/WebKit/chromium/DEPS
+++ b/WebKit/chromium/DEPS
@@ -35,18 +35,19 @@ vars = {
   'chromium_deps_svn': 'http://src.chromium.org/svn/trunk/deps/third_party',
 
   # Dependencies' revisions to use:
-  'chromium_rev': '28710',
-  'google-url_rev': '119',
-  'gtest_rev': '329',
-  'gyp_rev': '685',
-  'icu_rev': '27687',
+  'chromium_rev': '31834',
+  'google-url_rev': '120',
+  'gtest_rev': '336',
+  'gyp_rev': '751',
+  'icu_rev': '31724',
   'openvcdiff_rev': '28',
-  'skia_rev': '376',
-  'v8_rev': '3030',
+  'ots_rev': '19',
+  'skia_rev': '424',
+  'v8_rev': '3276',
 
   # Windows:
   'cygwin_rev': '11984',
-  'ffmpeg_ia32_rev': '28488',
+  'ffmpeg_ia32_rev': '30374',
   'pthreads-win32_rev': '26716',
   'python_24_rev': '22967',
 }
@@ -55,8 +56,6 @@ deps = {
   # build tools
   'build':
     Var('chromium_svn')+'/build@'+Var('chromium_rev'),
-  'webkit/build':
-      Var('chromium_svn')+'/webkit/build@'+Var('chromium_rev'),
   'tools/gyp':
     'http://gyp.googlecode.com/svn/trunk@'+Var('gyp_rev'),
 
@@ -120,6 +119,9 @@ deps = {
   'third_party/npapi':
     Var('chromium_svn')+'/third_party/npapi@'+Var('chromium_rev'),
 
+  'third_party/ots':
+    'http://ots.googlecode.com/svn/trunk@'+Var('ots_rev'),
+
   'third_party/sqlite':
     Var('chromium_svn')+'/third_party/sqlite@'+Var('chromium_rev'),
 
@@ -141,6 +143,14 @@ deps_os = {
     'third_party/pthreads-win32':
       Var('chromium_deps_svn')+'/pthreads-win32@'+Var('pthreads-win32_rev'),
   },
+  'unix': {
+    # Linux, actually.
+    'third_party/harfbuzz':
+      Var('chromium_svn')+'/third_party/harfbuzz@'+Var('chromium_rev'),
+
+    'tools/xdisplaycheck':
+      Var('chromium_svn')+'/tools/xdisplaycheck@'+Var('chromium_rev'),
+  },
 }
 
 skip_child_includes = [
diff --git a/WebKit/chromium/README b/WebKit/chromium/README
new file mode 100644
index 0000000..9173454
--- /dev/null
+++ b/WebKit/chromium/README
@@ -0,0 +1,41 @@
+This directory contains the Chromium WebKit API.
+
+
+OVERVIEW
+
+  The Chromium WebKit API provides a stable interface to WebCore without
+  revealing any of the WebCore or WTF types to the consumer.
+
+  The 'public' directory contains the API headers, and the 'src' directory
+  contains the API implementation.  The API is intended to be used either as a
+  shared or static library.
+
+
+COMPATIBILITY
+
+  No attempt is made to support runtime compatibility in a shared library
+  build.  Instead, the API is intended to support backwards compatibility at
+  build time.  C++ symbols are allowed in other words.
+
+
+DEFINES
+
+  WEBKIT_IMPLEMENTATION is defined when building the 'src' directory.
+  Consumers should not define this macro.
+
+  WEBKIT_DLL is defined when building as a shared library.  This should be
+  defined when building the 'src' directory, and it should also be defined by
+  the consumer to ensure proper linkage to the shared library.
+
+
+BASIC TYPES
+
+  Use of STL is prohibited except in cases where it would be allowed in
+  WebCore.  This includes non-allocating uses: algorithms, numeric limits, etc.
+  WTF container classes should be used in the implementation of this API.
+
+  The API includes some usage of WebCore types when WEBKIT_IMPLEMENTATION is
+  defined.  This is only done for the convenience to the implementation, and
+  should not be considered part of the Chromium WebKit API.  Similarly, STL
+  types are assumed when WEBKIT_IMPLEMENTATION is not defined, which is done
+  for the convenience of the consumer.
diff --git a/WebKit/chromium/WebKit.gyp b/WebKit/chromium/WebKit.gyp
new file mode 100644
index 0000000..c41bf5b
--- /dev/null
+++ b/WebKit/chromium/WebKit.gyp
@@ -0,0 +1,403 @@
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#         * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#         * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#         * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+{
+    'includes': [
+        'features.gypi',
+    ],
+    'variables': {
+        'conditions': [
+            # Location of the chromium src directory and target type is different
+            # if webkit is built inside chromium or as standalone project.
+            ['inside_chromium_build==0', {
+                # Webkit is being built outside of the full chromium project.
+                # e.g. via build-webkit --chromium
+                'chromium_src_dir': '.',
+                # FIXME: To enable shared_library in linux all code (including
+                # dependencies) must be complied with -fPIC flag. That is
+                # pending on changes in gyp.
+                'webkit_target_type': 'shared_library',
+            },{
+                # WebKit is checked out in src/chromium/third_party/WebKit
+                'chromium_src_dir': '../../../..',
+                'webkit_target_type': 'static_library',
+            }],
+            # We can't turn on warnings on Windows and Linux until we upstream the
+            # WebKit API.
+            ['OS=="mac"', {
+                'chromium_code': 1,
+            }],
+            # FIXME: To enable shared_library in linux all code (including
+            # dependencies) must be complied with -fPIC flag. That is
+            # pending on changes in gyp.
+            ['OS=="linux" or OS=="freebsd"', {
+              'webkit_target_type': 'static_library',
+            }],
+        ],
+    },
+    'targets': [
+        {
+            'target_name': 'webkit',
+            'type': '<(webkit_target_type)',
+            'msvs_guid': '5ECEC9E5-8F23-47B6-93E0-C3B328B3BE65',
+            'dependencies': [
+                '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
+            ],
+            'include_dirs': [
+                'public',
+                'src',
+            ],
+            'defines': [
+                'WEBKIT_IMPLEMENTATION',
+            ],
+            'sources': [
+                'public/gtk/WebInputEventFactory.h',
+                'public/linux/WebFontRendering.h',
+                'public/x11/WebScreenInfoFactory.h',
+                'public/mac/WebInputEventFactory.h',
+                'public/mac/WebScreenInfoFactory.h',
+                'public/WebAccessibilityCache.h',
+                'public/WebAccessibilityObject.h',
+                'public/WebAccessibilityRole.h',
+                'public/WebApplicationCacheHost.h',
+                'public/WebApplicationCacheHostClient.h',
+                'public/WebBindings.h',
+                'public/WebCache.h',
+                'public/WebCanvas.h',
+                'public/WebClipboard.h',
+                'public/WebColor.h',
+                'public/WebColorName.h',
+                'public/WebCommon.h',
+                'public/WebCommonWorkerClient.h',
+                'public/WebCompositionCommand.h',
+                'public/WebConsoleMessage.h',
+                'public/WebContextMenuData.h',
+                'public/WebCookie.h',
+                'public/WebCrossOriginPreflightResultCache.h',
+                'public/WebCString.h',
+                'public/WebCursorInfo.h',
+                'public/WebData.h',
+                'public/WebDatabase.h',
+                'public/WebDatabaseObserver.h',
+                'public/WebDataSource.h',
+                'public/WebDevToolsAgent.h',
+                'public/WebDevToolsAgentClient.h',
+                'public/WebDevToolsFrontend.h',
+                'public/WebDevToolsFrontendClient.h',
+                'public/WebDevToolsMessageData.h',
+                'public/WebDragData.h',
+                'public/WebEditingAction.h',
+                'public/WebElement.h',
+                'public/WebFileChooserCompletion.h',
+                'public/WebFindOptions.h',
+                'public/WebFrame.h',
+                'public/WebFrameClient.h',
+                'public/WebFontCache.h',
+                'public/WebFormElement.h',
+                'public/WebHistoryItem.h',
+                'public/WebHTTPBody.h',
+                'public/WebImage.h',
+                'public/WebInputElement.h',
+                'public/WebInputEvent.h',
+                'public/WebKit.h',
+                'public/WebKitClient.h',
+                'public/WebLocalizedString.h',
+                'public/WebMediaPlayer.h',
+                'public/WebMediaPlayerAction.h',
+                'public/WebMediaPlayerClient.h',
+                'public/WebMenuItemInfo.h',
+                'public/WebMessagePortChannel.h',
+                'public/WebMessagePortChannelClient.h',
+                'public/WebMimeRegistry.h',
+                'public/WebNavigationType.h',
+                'public/WebNode.h',
+                'public/WebNonCopyable.h',
+                'public/WebNotification.h',
+                'public/WebNotificationPresenter.h',
+                'public/WebNotificationPermissionCallback.h',
+                'public/WebPasswordAutocompleteListener.h',
+                'public/WebPasswordFormData.h',
+                'public/WebPlugin.h',
+                'public/WebPluginContainer.h',
+                'public/WebPluginListBuilder.h',
+                'public/WebPoint.h',
+                'public/WebPopupMenu.h',
+                'public/WebPopupMenuInfo.h',
+                'public/WebRange.h',
+                'public/WebRect.h',
+                'public/WebRegularExpression.h',
+                'public/WebRuntimeFeatures.h',
+                'public/WebScreenInfo.h',
+                'public/WebScriptController.h',
+                'public/WebScriptSource.h',
+                'public/WebSearchableFormData.h',
+                'public/WebSecurityOrigin.h',
+                'public/WebSecurityPolicy.h',
+                'public/WebSettings.h',
+                'public/WebSharedWorker.h',
+                'public/WebSharedWorkerRepository.h',
+                'public/WebSize.h',
+                'public/WebSocketStreamError.h',
+                'public/WebSocketStreamHandle.h',
+                'public/WebSocketStreamHandleClient.h',
+                'public/WebStorageArea.h',
+                'public/WebStorageEventDispatcher.h',
+                'public/WebStorageNamespace.h',
+                'public/WebString.h',
+                'public/WebTextAffinity.h',
+                'public/WebTextCaseSensitivity.h',
+                'public/WebTextDirection.h',
+                'public/WebURL.h',
+                'public/WebURLError.h',
+                'public/WebURLLoader.h',
+                'public/WebURLLoaderClient.h',
+                'public/WebURLRequest.h',
+                'public/WebURLResponse.h',
+                'public/WebVector.h',
+                'public/WebView.h',
+                'public/WebViewClient.h',
+                'public/WebWidget.h',
+                'public/WebWidgetClient.h',
+                'public/WebWorker.h',
+                'public/WebWorkerClient.h',
+                'public/win/WebInputEventFactory.h',
+                'public/win/WebSandboxSupport.h',
+                'public/win/WebScreenInfoFactory.h',
+                'public/win/WebScreenInfoFactory.h',
+                'src/ApplicationCacheHost.cpp',
+                'src/AssertMatchingEnums.cpp',
+                'src/AutocompletePopupMenuClient.cpp',
+                'src/AutocompletePopupMenuClient.h',
+                'src/BackForwardListClientImpl.cpp',
+                'src/BackForwardListClientImpl.h',
+                'src/ChromeClientImpl.cpp',
+                'src/ChromeClientImpl.h',
+                'src/ChromiumBridge.cpp',
+                'src/ChromiumCurrentTime.cpp',
+                'src/ChromiumThreading.cpp',
+                'src/ContextMenuClientImpl.cpp',
+                'src/ContextMenuClientImpl.h',
+                'src/DatabaseObserver.cpp',
+                'src/DOMUtilitiesPrivate.cpp',
+                'src/DOMUtilitiesPrivate.h',
+                'src/DragClientImpl.cpp',
+                'src/DragClientImpl.h',
+                'src/EditorClientImpl.cpp',
+                'src/EditorClientImpl.h',
+                'src/FrameLoaderClientImpl.cpp',
+                'src/FrameLoaderClientImpl.h',
+                'src/gtk/WebFontInfo.cpp',
+                'src/gtk/WebFontInfo.h',
+                'src/gtk/WebInputEventFactory.cpp',
+                'src/InspectorClientImpl.cpp',
+                'src/InspectorClientImpl.h',
+                'src/linux/WebFontRendering.cpp',
+                'src/x11/WebScreenInfoFactory.cpp',
+                'src/mac/WebInputEventFactory.mm',
+                'src/mac/WebScreenInfoFactory.mm',
+                'src/LocalizedStrings.cpp',
+                'src/MediaPlayerPrivateChromium.cpp',
+                'src/NotificationPresenterImpl.h',
+                'src/NotificationPresenterImpl.cpp',
+                'src/PlatformMessagePortChannel.cpp',
+                'src/PlatformMessagePortChannel.h',
+                'src/ResourceHandle.cpp',
+                'src/SharedWorkerRepository.cpp',
+                'src/SocketStreamHandle.cpp',
+                'src/StorageAreaProxy.cpp',
+                'src/StorageAreaProxy.h',
+                'src/StorageEventDispatcherChromium.cpp',
+                'src/StorageEventDispatcherImpl.cpp',
+                'src/StorageEventDispatcherImpl.h',
+                'src/StorageNamespaceProxy.cpp',
+                'src/StorageNamespaceProxy.h',
+                'src/TemporaryGlue.h',
+                'src/WebAccessibilityCache.cpp',
+                'src/WebAccessibilityCacheImpl.cpp',
+                'src/WebAccessibilityCacheImpl.h',
+                'src/WebAccessibilityObject.cpp',
+                'src/WebBindings.cpp',
+                'src/WebCache.cpp',
+                'src/WebColor.cpp',
+                'src/WebCrossOriginPreflightResultCache.cpp',
+                'src/WebCString.cpp',
+                'src/WebCursorInfo.cpp',
+                'src/WebData.cpp',
+                'src/WebDatabase.cpp',
+                'src/WebDataSourceImpl.cpp',
+                'src/WebDataSourceImpl.h',
+                'src/WebDragData.cpp',
+                'src/WebElement.cpp',
+                'src/WebFileChooserCompletionImpl.cpp',
+                'src/WebFileChooserCompletionImpl.h',
+                'src/WebFontCache.cpp',
+                'src/WebFormElement.cpp',
+                'src/WebFrameImpl.cpp',
+                'src/WebFrameImpl.h',
+                'src/WebHistoryItem.cpp',
+                'src/WebHTTPBody.cpp',
+                'src/WebImageCG.cpp',
+                'src/WebImageSkia.cpp',
+                'src/WebInputElement.cpp',
+                'src/WebInputEvent.cpp',
+                'src/WebInputEventConversion.cpp',
+                'src/WebInputEventConversion.h',
+                'src/WebKit.cpp',
+                'src/WebMediaPlayerClientImpl.cpp',
+                'src/WebMediaPlayerClientImpl.h',
+                'src/WebNode.cpp',
+                'src/WebNotification.cpp',
+                'src/WebPasswordFormData.cpp',
+                'src/WebPasswordFormUtils.cpp',
+                'src/WebPasswordFormUtils.h',
+                'src/WebPluginContainerImpl.h',
+                'src/WebPluginContainerImpl.cpp',
+                'src/WebPluginListBuilderImpl.cpp',
+                'src/WebPluginListBuilderImpl.h',
+                'src/WebPluginLoadObserver.cpp',
+                'src/WebPluginLoadObserver.h',
+                'src/WebPopupMenuImpl.cpp',
+                'src/WebPopupMenuImpl.h',
+                'src/WebRange.cpp',
+                'src/WebRegularExpression.cpp',
+                'src/WebRuntimeFeatures.cpp',
+                'src/WebScriptController.cpp',
+                'src/WebSearchableFormData.cpp',
+                'src/WebSecurityOrigin.cpp',
+                'src/WebSecurityPolicy.cpp',
+                'src/WebSettingsImpl.cpp',
+                'src/WebSettingsImpl.h',
+                'src/WebSharedWorkerImpl.cpp',
+                'src/WebSharedWorkerImpl.h',
+                'src/WebStorageAreaImpl.cpp',
+                'src/WebStorageAreaImpl.h',
+                'src/WebStorageEventDispatcherImpl.cpp',
+                'src/WebStorageEventDispatcherImpl.h',
+                'src/WebStorageNamespaceImpl.cpp',
+                'src/WebStorageNamespaceImpl.h',
+                'src/WebString.cpp',
+                'src/WebURL.cpp',
+                'src/WebURLRequest.cpp',
+                'src/WebURLRequestPrivate.h',
+                'src/WebURLResponse.cpp',
+                'src/WebURLResponsePrivate.h',
+                'src/WebURLError.cpp',
+                'src/WebViewImpl.cpp',
+                'src/WebViewImpl.h',
+                'src/WebWorkerBase.cpp',
+                'src/WebWorkerBase.h',
+                'src/WebWorkerClientImpl.cpp',
+                'src/WebWorkerClientImpl.h',
+                'src/WebWorkerImpl.cpp',
+                'src/WebWorkerImpl.h',
+                'src/WrappedResourceRequest.h',
+                'src/WrappedResourceResponse.h',
+                'src/win/WebInputEventFactory.cpp',
+                'src/win/WebScreenInfoFactory.cpp',
+            ],
+            'conditions': [
+                ['OS=="linux" or OS=="freebsd"', {
+                    'dependencies': [
+                        '<(chromium_src_dir)/build/linux/system.gyp:fontconfig',
+                        '<(chromium_src_dir)/build/linux/system.gyp:gtk',
+                        '<(chromium_src_dir)/build/linux/system.gyp:x11',
+                    ],
+                    'include_dirs': [
+                        'public/x11',
+                        'public/gtk',
+                        'public/linux',
+                    ],
+                }, { # else: OS!="linux" and OS!="freebsd"
+                    'sources/': [
+                        ['exclude', '/gtk/'],
+                        ['exclude', '/x11/'],
+                        ['exclude', '/linux/'],
+                    ],
+                }],
+                ['OS=="mac"', {
+                    'include_dirs': [
+                        'public/mac',
+                    ],
+                    'sources/': [
+                        ['exclude', 'Skia\\.cpp$'],
+                    ],
+                }, { # else: OS!="mac"
+                    'sources/': [
+                        ['exclude', '/mac/'],
+                        ['exclude', 'CG\\.cpp$'],
+                    ],
+                }],
+                ['OS=="win"', {
+                    'include_dirs': [
+                        'public/win',
+                    ],
+                }, { # else: OS!="win"
+                    'sources/': [['exclude', '/win/']],
+                }],
+                ['"ENABLE_3D_CANVAS=1" in feature_defines', {
+                    # Conditionally compile in GLEW and our GraphicsContext3D implementation.
+                    'sources+': [
+                        'src/GraphicsContext3D.cpp',
+                        '<(chromium_src_dir)/third_party/glew/src/glew.c'
+                    ],
+                    'include_dirs+': [
+                        '<(chromium_src_dir)/third_party/glew/include'
+                    ],
+                    'defines+': [
+                        'GLEW_STATIC=1',
+                        'GLEW_NO_GLU=1',
+                    ],
+                    'conditions': [
+                        ['OS=="win"', {
+                            'link_settings': {
+                                'libraries': [
+                                    '-lopengl32.lib',
+                                ],
+                            },
+                        }],
+                        ['OS=="mac"', {
+                            'link_settings': {
+                                'libraries': [
+                                    '$(SDKROOT)/System/Library/Frameworks/OpenGL.framework',
+                                ],
+                            },
+                        }],
+                    ],
+                }],
+            ],
+        },
+    ], # targets
+}
+
+# Local Variables:
+# tab-width:2
+# indent-tabs-mode:nil
+# End:
+# vim: set expandtab tabstop=2 shiftwidth=2:
diff --git a/WebKit/chromium/features.gypi b/WebKit/chromium/features.gypi
index e3bc7d3..8dd0d0d 100644
--- a/WebKit/chromium/features.gypi
+++ b/WebKit/chromium/features.gypi
@@ -46,10 +46,12 @@
         'ENABLE_OFFLINE_WEB_APPLICATIONS=1',
         'ENABLE_DASHBOARD_SUPPORT=0',
         'ENABLE_DOM_STORAGE=1',
+        'ENABLE_GEOLOCATION=1',
         'ENABLE_JAVASCRIPT_DEBUGGER=0',
         'ENABLE_JSC_MULTIPLE_THREADS=0',
         'ENABLE_ICONDATABASE=0',
         'ENABLE_NOTIFICATIONS=1',
+        'ENABLE_OPENTYPE_SANITIZER=1',
         'ENABLE_ORIENTATION_EVENTS=0',
         'ENABLE_XSLT=1',
         'ENABLE_XPATH=1',
@@ -61,7 +63,7 @@
         'ENABLE_SVG_FOREIGN_OBJECT=1',
         'ENABLE_SVG_FONTS=1',
         'ENABLE_VIDEO=1',
-	'ENABLE_WEB_SOCKETS=1',
+        'ENABLE_WEB_SOCKETS=1',
         'ENABLE_WORKERS=1',
       ],
     },
diff --git a/WebKit/chromium/gyp_webkit b/WebKit/chromium/gyp_webkit
index 810af54..ef18239 100644
--- a/WebKit/chromium/gyp_webkit
+++ b/WebKit/chromium/gyp_webkit
@@ -32,6 +32,7 @@
 
 import glob
 import os
+import platform
 import shlex
 import sys
 
@@ -76,6 +77,10 @@ if __name__ == '__main__':
   # Add includes.
   args.extend(['-I' + i for i in additional_include_files(args)])
 
+  # On linux, we want gyp to output a makefile (default is scons).
+  if (platform.system() == 'Linux'):
+    args.extend(['-fmake'])
+
   # Other command args:
   args.extend([
                # gyp variable defines.
@@ -87,7 +92,7 @@ if __name__ == '__main__':
                '--depth=./',
 
                # gyp file to execute.
-               'webkit.gyp'])
+               'WebKit.gyp'])
 
   print 'Updating webkit projects from gyp files...'
   sys.stdout.flush()
diff --git a/WebKit/chromium/public/WebAccessibilityCache.h b/WebKit/chromium/public/WebAccessibilityCache.h
new file mode 100644
index 0000000..94704a0
--- /dev/null
+++ b/WebKit/chromium/public/WebAccessibilityCache.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebAccessibilityCache_h
+#define WebAccessibilityCache_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebView;
+class WebAccessibilityObject;
+
+class WebAccessibilityCache {
+public:
+    WebAccessibilityCache() {}
+    virtual ~WebAccessibilityCache() {}
+
+    static WebAccessibilityCache* create();
+    static void enableAccessibility();
+
+    virtual void initialize(WebView* view) = 0;
+    virtual bool isInitialized() const = 0;
+
+    virtual WebAccessibilityObject getObjectById(int) = 0;
+    virtual bool isValidId(int) const = 0;
+    virtual int addOrGetId(const WebAccessibilityObject& object) = 0;
+
+    virtual void remove(int) = 0;
+    virtual void clear() = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebAccessibilityObject.h b/WebKit/chromium/public/WebAccessibilityObject.h
new file mode 100644
index 0000000..d32c548
--- /dev/null
+++ b/WebKit/chromium/public/WebAccessibilityObject.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebAccessibilityObject_h
+#define WebAccessibilityObject_h
+
+#include "WebAccessibilityRole.h"
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class AccessibilityObject; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebAccessibilityObjectPrivate;
+class WebString;
+struct WebPoint;
+struct WebRect;
+
+// A container for passing around a reference to AccessibilityObject.
+class WebAccessibilityObject {
+public:
+    ~WebAccessibilityObject() { reset(); }
+
+    WebAccessibilityObject() : m_private(0) { }
+    WebAccessibilityObject(const WebAccessibilityObject& o) : m_private(0) { assign(o); }
+    WebAccessibilityObject& operator=(const WebAccessibilityObject& o)
+    {
+        assign(o);
+        return *this;
+    }
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebAccessibilityObject&);
+
+    bool isNull() const { return !m_private; }
+
+    WebString accessibilityDescription() const;
+    WebString actionVerb() const;
+    bool canSetFocusAttribute() const;
+    bool canSetValueAttribute() const;
+
+    unsigned childCount() const;
+
+    WebAccessibilityObject childAt(unsigned) const;
+    WebAccessibilityObject firstChild() const;
+    WebAccessibilityObject focusedChild() const;
+    WebAccessibilityObject lastChild() const;
+    WebAccessibilityObject nextSibling() const;
+    WebAccessibilityObject parentObject() const;
+    WebAccessibilityObject previousSibling() const;
+
+    bool isAnchor() const;
+    bool isChecked() const;
+    bool isFocused() const;
+    bool isEnabled() const;
+    bool isHovered() const;
+    bool isIndeterminate() const;
+    bool isMultiSelect() const;
+    bool isOffScreen() const;
+    bool isPasswordField() const;
+    bool isPressed() const;
+    bool isReadOnly() const;
+    bool isVisited() const;
+
+    WebRect boundingBoxRect() const;
+    WebString helpText() const;
+    WebAccessibilityObject hitTest(const WebPoint&) const;
+    WebString keyboardShortcut() const;
+    bool performDefaultAction() const;
+    WebAccessibilityRole roleValue() const;
+    WebString stringValue() const;
+    WebString title() const;
+
+#if WEBKIT_IMPLEMENTATION
+    WebAccessibilityObject(const WTF::PassRefPtr<WebCore::AccessibilityObject>&);
+    WebAccessibilityObject& operator=(const WTF::PassRefPtr<WebCore::AccessibilityObject>&);
+    operator WTF::PassRefPtr<WebCore::AccessibilityObject>() const;
+#endif
+
+private:
+    void assign(WebAccessibilityObjectPrivate*);
+    WebAccessibilityObjectPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebAccessibilityRole.h b/WebKit/chromium/public/WebAccessibilityRole.h
new file mode 100644
index 0000000..e836c56
--- /dev/null
+++ b/WebKit/chromium/public/WebAccessibilityRole.h
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebAccessibilityRole_h
+#define WebAccessibilityRole_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+// These values must match WebCore::AccessibilityRole values
+enum WebAccessibilityRole {
+    WebAccessibilityRoleUnknown = 1,
+    WebAccessibilityRoleButton,
+    WebAccessibilityRoleRadioButton,
+    WebAccessibilityRoleCheckBox,
+    WebAccessibilityRoleSlider,
+    WebAccessibilityRoleTabGroup,
+    WebAccessibilityRoleTextField,
+    WebAccessibilityRoleStaticText,
+    WebAccessibilityRoleTextArea,
+    WebAccessibilityRoleScrollArea,
+    WebAccessibilityRolePopUpButton,
+    WebAccessibilityRoleMenuButton,
+    WebAccessibilityRoleTable,
+    WebAccessibilityRoleApplication,
+    WebAccessibilityRoleGroup,
+    WebAccessibilityRoleRadioGroup,
+    WebAccessibilityRoleList,
+    WebAccessibilityRoleScrollBar,
+    WebAccessibilityRoleValueIndicator,
+    WebAccessibilityRoleImage,
+    WebAccessibilityRoleMenuBar,
+    WebAccessibilityRoleMenu,
+    WebAccessibilityRoleMenuItem,
+    WebAccessibilityRoleColumn,
+    WebAccessibilityRoleRow,
+    WebAccessibilityRoleToolbar,
+    WebAccessibilityRoleBusyIndicator,
+    WebAccessibilityRoleProgressIndicator,
+    WebAccessibilityRoleWindow,
+    WebAccessibilityRoleDrawer,
+    WebAccessibilityRoleSystemWide,
+    WebAccessibilityRoleOutline,
+    WebAccessibilityRoleIncrementor,
+    WebAccessibilityRoleBrowser,
+    WebAccessibilityRoleComboBox,
+    WebAccessibilityRoleSplitGroup,
+    WebAccessibilityRoleSplitter,
+    WebAccessibilityRoleColorWell,
+    WebAccessibilityRoleGrowArea,
+    WebAccessibilityRoleSheet,
+    WebAccessibilityRoleHelpTag,
+    WebAccessibilityRoleMatte,
+    WebAccessibilityRoleRuler,
+    WebAccessibilityRoleRulerMarker,
+    WebAccessibilityRoleLink,
+    WebAccessibilityRoleDisclosureTriangle,
+    WebAccessibilityRoleGrid,
+    WebAccessibilityRoleCell,
+    WebAccessibilityRoleColumnHeader,
+    WebAccessibilityRoleRowHeader,
+
+    WebAccessibilityRoleWebCoreLink,
+    WebAccessibilityRoleImageMapLink,
+    WebAccessibilityRoleImageMap,
+    WebAccessibilityRoleListMarker,
+    WebAccessibilityRoleWebArea,
+    WebAccessibilityRoleHeading,
+    WebAccessibilityRoleListBox,
+    WebAccessibilityRoleListBoxOption,
+    WebAccessibilityRoleTableHeaderContainer,
+    WebAccessibilityRoleDefinitionListTerm,
+    WebAccessibilityRoleDefinitionListDefinition,
+    WebAccessibilityRoleAnnotation,
+    WebAccessibilityRoleSliderThumb,
+    WebAccessibilityRoleIgnored,
+    WebAccessibilityRoleTab,
+    WebAccessibilityRoleTabList,
+    WebAccessibilityRoleTabPanel,
+    WebAccessibilityRoleTreeRole,
+    WebAccessibilityRoleTreeItemRole,
+    WebAccessibilityRoleDirectory,
+
+    WebAccessibilityRoleLandmarkApplication,
+    WebAccessibilityRoleLandmarkBanner,
+    WebAccessibilityRoleLandmarkComplementary,
+    WebAccessibilityRoleLandmarkContentInfo,
+    WebAccessibilityRoleLandmarkMain,
+    WebAccessibilityRoleLandmarkNavigation,
+    WebAccessibilityRoleLandmarkSearch,
+
+    WebAccessibilityRoleApplicationAlert,
+    WebAccessibilityRoleApplicationAlertDialog,
+    WebAccessibilityRoleApplicationDialog,
+    WebAccessibilityRoleApplicationLog,
+    WebAccessibilityRoleApplicationMarquee,
+    WebAccessibilityRoleApplicationStatus,
+    WebAccessibilityRoleApplicationTimer,
+
+    WebAccessibilityRoleDocument,
+    WebAccessibilityRoleDocumentArticle,
+    WebAccessibilityRoleDocumentMath,
+    WebAccessibilityRoleDocumentNote,
+    WebAccessibilityRoleDocumentRegion,
+
+    WebAccessibilityRoleUserInterfaceTooltip
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebApplicationCacheHost.h b/WebKit/chromium/public/WebApplicationCacheHost.h
new file mode 100644
index 0000000..7c5dafe
--- /dev/null
+++ b/WebKit/chromium/public/WebApplicationCacheHost.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebApplicationCacheHost_h
+#define WebApplicationCacheHost_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebApplicationCacheHostClient;
+class WebURL;
+class WebURLRequest;
+class WebURLResponse;
+struct WebURLError;
+
+// This interface is used by webkit to call out to the embedder. Webkit uses
+// the WebKitClient::createApplicationCacheHost method to create instances,
+// and calls delete when the instance is no longer needed.
+class WebApplicationCacheHost {
+public:
+    // These values must match WebCore::ApplicationCacheHost::Status values
+    enum Status {
+        Uncached,
+        Idle,
+        Checking,
+        Downloading,
+        UpdateReady,
+        Obsolete
+    };
+
+    // These values must match WebCore::ApplicationCacheHost::EventID values
+    enum EventID {
+        CheckingEvent,
+        ErrorEvent,
+        NoUpdateEvent,
+        DownloadingEvent,
+        ProgressEvent,
+        UpdateReadyEvent,
+        CachedEvent,
+        ObsoleteEvent
+    };
+
+    virtual ~WebApplicationCacheHost() { }
+
+    // Called for every request made within the context.
+    virtual void willStartMainResourceRequest(WebURLRequest&) = 0;
+    virtual void willStartSubResourceRequest(WebURLRequest&) = 0;
+
+    // One or the other selectCache methods is called after having parsed the <html> tag.
+    // The latter returns false if the current document has been identified as a "foreign"
+    // entry, in which case the frame navigation will be restarted by webkit.
+    virtual void selectCacheWithoutManifest() = 0;
+    virtual bool selectCacheWithManifest(const WebURL& manifestURL) = 0;
+
+    // Called as the main resource is retrieved.
+    virtual void didReceiveResponseForMainResource(const WebURLResponse&) = 0;
+    virtual void didReceiveDataForMainResource(const char* data, int len) = 0;
+    virtual void didFinishLoadingMainResource(bool success) = 0;
+
+    // Called on behalf of the scriptable interface.
+    virtual Status status() = 0;
+    virtual bool startUpdate() = 0;
+    virtual bool swapCache() = 0;
+};
+
+}  // namespace WebKit
+
+#endif  // WebApplicationCacheHost_h
+
diff --git a/WebKit/chromium/public/WebApplicationCacheHostClient.h b/WebKit/chromium/public/WebApplicationCacheHostClient.h
new file mode 100644
index 0000000..4e830e3
--- /dev/null
+++ b/WebKit/chromium/public/WebApplicationCacheHostClient.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebApplicationCacheHostClient_h
+#define WebApplicationCacheHostClient_h
+
+#include "WebApplicationCacheHost.h"
+#include "WebCommon.h"
+
+namespace WebKit {
+
+// This interface is used by the embedder to call into webkit.
+class WebApplicationCacheHostClient {
+public:
+    // Called to fire the event in the scriptable interface.
+    virtual void notifyEventListener(WebApplicationCacheHost::EventID) = 0;
+
+protected:
+    // Should not be deleted by the embedder.
+    virtual ~WebApplicationCacheHostClient() { }
+};
+
+}  // namespace WebKit
+
+#endif  // WebApplicationCacheHostClient_h
+
diff --git a/WebKit/chromium/public/WebBindings.h b/WebKit/chromium/public/WebBindings.h
new file mode 100644
index 0000000..4e66a8f
--- /dev/null
+++ b/WebKit/chromium/public/WebBindings.h
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebBindings_h
+#define WebBindings_h
+
+#include "WebCommon.h"
+#include <bindings/npruntime.h>
+
+namespace WebKit {
+
+class WebDragData;
+class WebRange;
+
+// A haphazard collection of functions for dealing with plugins.
+class WebBindings {
+public:
+    // NPN Functions ------------------------------------------------------
+    // These are all defined in npruntime.h and are well documented.
+
+    // NPN_Construct
+    WEBKIT_API static bool construct(NPP, NPObject*, const NPVariant* args, uint32_t argCount, NPVariant* result);
+
+    // NPN_CreateObject
+    WEBKIT_API static NPObject* createObject(NPP, NPClass*);
+
+    // NPN_Enumerate
+    WEBKIT_API static bool enumerate(NPP, NPObject*, NPIdentifier**, uint32_t* count);
+
+    // NPN_Evaluate
+    WEBKIT_API static bool evaluate(NPP, NPObject*, NPString* script, NPVariant* result);
+
+    // NPN_EvaluateHelper
+    WEBKIT_API static bool evaluateHelper(NPP, bool popupsAllowed, NPObject*, NPString* script, NPVariant* result);
+
+    // NPN_GetIntIdentifier
+    WEBKIT_API static NPIdentifier getIntIdentifier(int32_t number);
+
+    // NPN_GetProperty
+    WEBKIT_API static bool getProperty(NPP, NPObject*, NPIdentifier propertyName, NPVariant *result);
+
+    // NPN_GetStringIdentifier
+    WEBKIT_API static NPIdentifier getStringIdentifier(const NPUTF8* string);
+
+    // NPN_GetStringIdentifiers
+    WEBKIT_API static void getStringIdentifiers(const NPUTF8** names, int32_t nameCount, NPIdentifier*);
+
+    // NPN_HasMethod
+    WEBKIT_API static bool hasMethod(NPP, NPObject*, NPIdentifier methodName);
+
+    // NPN_HasProperty
+    WEBKIT_API static bool hasProperty(NPP, NPObject*, NPIdentifier propertyName);
+
+    // NPN_IdentifierIsString
+    WEBKIT_API static bool identifierIsString(NPIdentifier);
+
+    // NPN_InitializeVariantWithStringCopy (though sometimes prefixed with an underscore)
+    WEBKIT_API static void initializeVariantWithStringCopy(NPVariant*, const NPString*);
+
+    // NPN_IntFromIdentifier
+    WEBKIT_API static int32_t intFromIdentifier(NPIdentifier);
+
+    // NPN_Invoke
+    WEBKIT_API static bool invoke(NPP, NPObject*, NPIdentifier methodName, const NPVariant* args, uint32_t count, NPVariant* result);
+
+    // NPN_InvokeDefault
+    WEBKIT_API static bool invokeDefault(NPP, NPObject*, const NPVariant* args, uint32_t count, NPVariant* result);
+
+    // NPN_ReleaseObject
+    WEBKIT_API static void releaseObject(NPObject*);
+
+    // NPN_ReleaseVariantValue
+    WEBKIT_API static void releaseVariantValue(NPVariant*);
+
+    // NPN_RemoveProperty
+    WEBKIT_API static bool removeProperty(NPP, NPObject*, NPIdentifier);
+
+    // NPN_RetainObject
+    WEBKIT_API static NPObject* retainObject(NPObject*);
+
+    // NPN_SetException
+    WEBKIT_API static void setException(NPObject*, const NPUTF8* message);
+
+    // NPN_SetProperty
+    WEBKIT_API static bool setProperty(NPP, NPObject*, NPIdentifier, const NPVariant*);
+
+    // _NPN_UnregisterObject
+    WEBKIT_API static void unregisterObject(NPObject*);
+
+    // NPN_UTF8FromIdentifier
+    WEBKIT_API static NPUTF8* utf8FromIdentifier(NPIdentifier);
+
+    // Miscellaneous utility functions ------------------------------------
+
+    // Complement to NPN_Get___Identifier functions.  Extracts data from the NPIdentifier data
+    // structure.  If isString is true upon return, string will be set but number's value is
+    // undefined.  If iString is false, the opposite is true.
+    WEBKIT_API static void extractIdentifierData(const NPIdentifier&, const NPUTF8*& string, int32_t& number, bool& isString);
+
+    // Return true (success) if the given npobj is the current drag event in browser dispatch,
+    // and is accessible based on context execution frames and their security origins and
+    // WebKit clipboard access policy. If so, return the event id and the clipboard data (WebDragData).
+    // This only works with V8.  If compiled without V8, it'll always return false.
+    WEBKIT_API static bool getDragData(NPObject* event, int* eventId, WebDragData*);
+
+    // Invoke the event access policy checks listed above with GetDragData().  No need for clipboard
+    // data or event_id outputs, just confirm the given npobj is the current & accessible drag event.
+    // This only works with V8.  If compiled without V8, it'll always return false.
+    WEBKIT_API static bool isDragEvent(NPObject* event);
+
+    // Return true (success) if the given npobj is a range object.
+    // If so, return that range as a WebRange object.
+    WEBKIT_API static bool getRange(NPObject* range, WebRange*);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebCString.h b/WebKit/chromium/public/WebCString.h
new file mode 100644
index 0000000..434cb06
--- /dev/null
+++ b/WebKit/chromium/public/WebCString.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCString_h
+#define WebCString_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class CString; }
+#else
+#include <string>
+#endif
+
+namespace WebKit {
+
+class WebCStringPrivate;
+class WebString;
+
+// A single-byte string container with unspecified encoding.  It is
+// inexpensive to copy a WebCString object.
+//
+// WARNING: It is not safe to pass a WebCString across threads!!!
+//
+class WebCString {
+public:
+    ~WebCString() { reset(); }
+
+    WebCString() : m_private(0) { }
+
+    WebCString(const char* data, size_t len) : m_private(0)
+    {
+        assign(data, len);
+    }
+
+    WebCString(const WebCString& s) : m_private(0) { assign(s); }
+
+    WebCString& operator=(const WebCString& s)
+    {
+        assign(s);
+        return *this;
+    }
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebCString&);
+    WEBKIT_API void assign(const char* data, size_t len);
+
+    WEBKIT_API size_t length() const;
+    WEBKIT_API const char* data() const;
+
+    bool isEmpty() const { return !length(); }
+    bool isNull() const { return !m_private; }
+
+    WEBKIT_API WebString utf16() const;
+
+    WEBKIT_API static WebCString fromUTF16(const WebUChar* data, size_t length);
+    WEBKIT_API static WebCString fromUTF16(const WebUChar* data);
+
+#if WEBKIT_IMPLEMENTATION
+    WebCString(const WebCore::CString&);
+    WebCString& operator=(const WebCore::CString&);
+    operator WebCore::CString() const;
+#else
+    WebCString(const std::string& s) : m_private(0)
+    {
+        assign(s.data(), s.length());
+    }
+
+    WebCString& operator=(const std::string& s)
+    {
+        assign(s.data(), s.length());
+        return *this;
+    }
+
+    operator std::string() const
+    {
+        size_t len = length();
+        return len ? std::string(data(), len) : std::string();
+    }
+
+    template <class UTF16String>
+    static WebCString fromUTF16(const UTF16String& s)
+    {
+        return fromUTF16(s.data(), s.length());
+    }
+#endif
+
+private:
+    void assign(WebCStringPrivate*);
+    WebCStringPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebCache.h b/WebKit/chromium/public/WebCache.h
new file mode 100644
index 0000000..433eb1a
--- /dev/null
+++ b/WebKit/chromium/public/WebCache.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCache_h
+#define WebCache_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+// An interface to query and configure WebKit's resource cache.
+class WebCache {
+public:
+    struct UsageStats {
+        // Capacities.
+        size_t minDeadCapacity;
+        size_t maxDeadCapacity;
+        size_t capacity;
+        // Utilization.
+        size_t liveSize;
+        size_t deadSize;
+    };
+
+    // A struct mirroring WebCore::Cache::TypeStatistic.
+    struct ResourceTypeStat {
+        size_t count;
+        size_t size;
+        size_t liveSize;
+        size_t decodedSize;
+    };
+
+    // A struct mirroring WebCore::Cache::Statistics.
+    struct ResourceTypeStats {
+        ResourceTypeStat images;
+        ResourceTypeStat cssStyleSheets;
+        ResourceTypeStat scripts;
+        ResourceTypeStat xslStyleSheets;
+        ResourceTypeStat fonts;
+    };
+
+    // Sets the capacities of the resource cache, evicting objects as necessary.
+    WEBKIT_API static void setCapacities(size_t minDeadCapacity,
+                                         size_t maxDeadCapacity,
+                                         size_t capacity);
+
+    // Clears the cache (as much as possible; some resources may not be
+    // cleared if they are actively referenced).
+    WEBKIT_API static void clear();
+
+    // Gets the usage statistics from the resource cache.
+    WEBKIT_API static void getUsageStats(UsageStats*);
+
+    // Get usage stats about the resource cache.
+    WEBKIT_API static void getResourceTypeStats(ResourceTypeStats*);
+
+private:
+    WebCache();  // Not intended to be instanced.
+};
+
+}  // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebCanvas.h b/WebKit/chromium/public/WebCanvas.h
new file mode 100644
index 0000000..4675487
--- /dev/null
+++ b/WebKit/chromium/public/WebCanvas.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCanvas_h
+#define WebCanvas_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_USING_SKIA
+namespace skia { class PlatformCanvas; }
+#elif WEBKIT_USING_CG
+struct CGContext;
+#endif
+
+namespace WebKit {
+
+#if WEBKIT_USING_SKIA
+typedef skia::PlatformCanvas WebCanvas;
+#elif WEBKIT_USING_CG
+typedef struct CGContext WebCanvas;
+#else
+#error "Need to define WebCanvas"
+#endif
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebClipboard.h b/WebKit/chromium/public/WebClipboard.h
new file mode 100644
index 0000000..68e22b5
--- /dev/null
+++ b/WebKit/chromium/public/WebClipboard.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebClipboard_h
+#define WebClipboard_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebImage;
+class WebString;
+class WebURL;
+
+class WebClipboard {
+public:
+    enum Format {
+        FormatHTML,
+        FormatBookmark,
+        FormatSmartPaste
+    };
+
+    enum Buffer {
+        BufferStandard,
+        // Used on platforms like the X Window System that treat selection
+        // as a type of clipboard.
+        BufferSelection
+    };
+
+    virtual bool isFormatAvailable(Format, Buffer) = 0;
+
+    virtual WebString readPlainText(Buffer) = 0;
+    virtual WebString readHTML(Buffer, WebURL*) = 0;
+
+    virtual void writePlainText(const WebString&) = 0;
+    virtual void writeHTML(
+        const WebString& htmlText, const WebURL&,
+        const WebString& plainText, bool writeSmartPaste) = 0;
+    virtual void writeURL(
+        const WebURL&, const WebString& title) = 0;
+    virtual void writeImage(
+        const WebImage&, const WebURL&, const WebString& title) = 0;
+
+protected:
+    ~WebClipboard() {}
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebColor.h b/WebKit/chromium/public/WebColor.h
new file mode 100644
index 0000000..034f8db
--- /dev/null
+++ b/WebKit/chromium/public/WebColor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebColor_h
+#define WebColor_h
+
+#include "WebColorName.h"
+#include "WebCommon.h"
+
+namespace WebKit {
+
+typedef unsigned WebColor;  // RGBA quad. Equivalent to SkColor.
+
+// Sets the values of a set of named colors.
+WEBKIT_API void setNamedColors(const WebColorName*, const WebColor*, size_t length);
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebColorName.h b/WebKit/chromium/public/WebColorName.h
new file mode 100644
index 0000000..f97ed26
--- /dev/null
+++ b/WebKit/chromium/public/WebColorName.h
@@ -0,0 +1,71 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef WebColorName_h
+#define WebColorName_h
+
+namespace WebKit {
+
+enum WebColorName {
+    WebColorActiveBorder,
+    WebColorActiveCaption,
+    WebColorAppworkspace,
+    WebColorBackground,
+    WebColorButtonFace,
+    WebColorButtonHighlight,
+    WebColorButtonShadow,
+    WebColorButtonText,
+    WebColorCaptionText,
+    WebColorGrayText,
+    WebColorHighlight,
+    WebColorHighlightText,
+    WebColorInactiveBorder,
+    WebColorInactiveCaption,
+    WebColorInactiveCaptionText,
+    WebColorInfoBackground,
+    WebColorInfoText,
+    WebColorMenu,
+    WebColorMenuText,
+    WebColorScrollbar,
+    WebColorText,
+    WebColorThreedDarkShadow,
+    WebColorThreedShadow,
+    WebColorThreedFace,
+    WebColorThreedHighlight,
+    WebColorThreedLightShadow,
+    WebColorWebkitFocusRingColor,
+    WebColorWindow,
+    WebColorWindowFrame,
+    WebColorWindowText
+};
+
+}  // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebCommon.h b/WebKit/chromium/public/WebCommon.h
new file mode 100644
index 0000000..d347ea6
--- /dev/null
+++ b/WebKit/chromium/public/WebCommon.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCommon_h
+#define WebCommon_h
+
+// -----------------------------------------------------------------------------
+// Default configuration
+
+#if !defined(WEBKIT_IMPLEMENTATION)
+    #define WEBKIT_IMPLEMENTATION 0
+#endif
+
+#if !defined(WEBKIT_USING_SKIA)
+    #if !defined(__APPLE__)
+        #define WEBKIT_USING_SKIA 1
+    #else
+        #define WEBKIT_USING_SKIA 0
+    #endif
+#endif
+
+#if !defined(WEBKIT_USING_CG)
+    #if defined(__APPLE__)
+        #define WEBKIT_USING_CG 1
+    #else
+        #define WEBKIT_USING_CG 0
+    #endif
+#endif
+
+#if !defined(WEBKIT_USING_V8)
+    #define WEBKIT_USING_V8 1
+#endif
+
+#if !defined(WEBKIT_USING_JSC)
+    #define WEBKIT_USING_JSC 0
+#endif
+
+// -----------------------------------------------------------------------------
+// Exported symbols need to be annotated with WEBKIT_API
+
+#if defined(WIN32) && defined(WEBKIT_DLL)
+    #if defined(WEBKIT_IMPLEMENTATION)
+        #define WEBKIT_API __declspec(dllexport)
+    #else
+        #define WEBKIT_API __declspec(dllimport)
+    #endif
+#else
+    #define WEBKIT_API
+#endif
+
+// -----------------------------------------------------------------------------
+// Basic types
+
+#include <stddef.h> // For size_t
+
+namespace WebKit {
+
+    // UTF-16 character type
+#if defined(WIN32)
+typedef wchar_t WebUChar;
+#else
+typedef unsigned short WebUChar;
+#endif
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebCommonWorkerClient.h b/WebKit/chromium/public/WebCommonWorkerClient.h
new file mode 100644
index 0000000..771ffff
--- /dev/null
+++ b/WebKit/chromium/public/WebCommonWorkerClient.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCommonWorkerClient_h
+#define WebCommonWorkerClient_h
+
+namespace WebKit {
+
+class WebNotificationPresenter;
+class WebString;
+class WebWorker;
+class WebWorkerClient;
+
+// Provides an interface back to the in-page script object for a worker.
+// This interface contains common APIs used by both shared and dedicated
+// workers.
+// All functions are expected to be called back on the thread that created
+// the Worker object, unless noted.
+class WebCommonWorkerClient {
+public:
+    virtual void postExceptionToWorkerObject(
+        const WebString& errorString, int lineNumber,
+        const WebString& sourceURL) = 0;
+
+    virtual void postConsoleMessageToWorkerObject(
+        int destinationIdentifier,
+        int sourceIdentifier,
+        int messageType,
+        int messageLevel,
+        const WebString& message,
+        int lineNumber,
+        const WebString& sourceURL) = 0;
+
+    virtual void workerContextClosed() = 0;
+    virtual void workerContextDestroyed() = 0;
+
+    // Returns the notification presenter for this worker context.  Pointer
+    // is owned by the object implementing WebCommonWorkerClient.
+    virtual WebNotificationPresenter* notificationPresenter() = 0;
+
+    // This can be called on any thread to create a nested WebWorker.
+    // WebSharedWorkers are not instantiated via this API - instead
+    // they are created via the WebSharedWorkerRepository.
+    virtual WebWorker* createWorker(WebWorkerClient* client) = 0;
+
+protected:
+    ~WebCommonWorkerClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebCompositionCommand.h b/WebKit/chromium/public/WebCompositionCommand.h
new file mode 100644
index 0000000..fa89529
--- /dev/null
+++ b/WebKit/chromium/public/WebCompositionCommand.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCompositionCommand_h
+#define WebCompositionCommand_h
+
+namespace WebKit {
+
+enum WebCompositionCommand {
+    WebCompositionCommandDiscard,
+    WebCompositionCommandSet,
+    WebCompositionCommandConfirm,
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebConsoleMessage.h b/WebKit/chromium/public/WebConsoleMessage.h
new file mode 100644
index 0000000..d7a0ead
--- /dev/null
+++ b/WebKit/chromium/public/WebConsoleMessage.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebConsoleMessage_h
+#define WebConsoleMessage_h
+
+#include "WebString.h"
+
+namespace WebKit {
+
+struct WebConsoleMessage {
+    enum Level {
+        LevelTip,
+        LevelLog,
+        LevelWarning,
+        LevelError
+    };
+
+    Level level;
+    WebString text;
+
+    WebConsoleMessage()
+        : level(LevelLog) { }
+    WebConsoleMessage(Level level, const WebString& text)
+        : level(LevelLog)
+        , text(text) { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebContextMenuData.h b/WebKit/chromium/public/WebContextMenuData.h
new file mode 100644
index 0000000..b4acb1c
--- /dev/null
+++ b/WebKit/chromium/public/WebContextMenuData.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebContextMenuData_h
+#define WebContextMenuData_h
+
+#include "WebMenuItemInfo.h"
+#include "WebPoint.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebVector.h"
+
+namespace WebKit {
+
+// This struct is passed to WebViewClient::ShowContextMenu.
+struct WebContextMenuData {
+    enum MediaType {
+        // No special node is in context.
+        MediaTypeNone,
+        // An image node is selected.
+        MediaTypeImage,
+        // A video node is selected.
+        MediaTypeVideo,
+        // An audio node is selected.
+        MediaTypeAudio,
+    };
+    // The type of media the context menu is being invoked on.
+    MediaType mediaType;
+
+    // The x and y position of the mouse pointer (relative to the webview).
+    WebPoint mousePosition;
+
+    // The absolute URL of the link that is in context.
+    WebURL linkURL;
+
+    // The absolute URL of the image/video/audio that is in context.
+    WebURL srcURL;
+
+    // The absolute URL of the page in context.
+    WebURL pageURL;
+
+    // The absolute URL of the subframe in context.
+    WebURL frameURL;
+
+    // The encoding for the frame in context.
+    WebString frameEncoding;
+
+    enum MediaFlags {
+        MediaNone = 0x0,
+        MediaInError = 0x1,
+        MediaPaused = 0x2,
+        MediaMuted = 0x4,
+        MediaLoop = 0x8,
+        MediaCanSave = 0x10,
+        MediaHasAudio = 0x20,
+    };
+
+    // Extra attributes describing media elements.
+    int mediaFlags;
+
+    // The raw text of the selection in context.
+    WebString selectedText;
+
+    // Whether spell checking is enabled.
+    bool isSpellCheckingEnabled;
+
+    // The editable (possibily) misspelled word.
+    WebString misspelledWord;
+
+    // Whether context is editable.
+    bool isEditable;
+
+    enum EditFlags {
+        CanDoNone = 0x0,
+        CanUndo = 0x1,
+        CanRedo = 0x2,
+        CanCut = 0x4,
+        CanCopy = 0x8,
+        CanPaste = 0x10,
+        CanDelete = 0x20,
+        CanSelectAll = 0x40,
+    };
+
+    // Which edit operations are available in the context.
+    int editFlags;
+
+    // Security information for the context.
+    WebCString securityInfo;
+
+    // Custom context menu items provided by the WebCore internals.
+    WebVector<WebMenuItemInfo> customItems;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebCookie.h b/WebKit/chromium/public/WebCookie.h
new file mode 100644
index 0000000..81cb361
--- /dev/null
+++ b/WebKit/chromium/public/WebCookie.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCookie_h
+#define WebCookie_h
+
+#include "WebCommon.h"
+#include "WebString.h"
+
+namespace WebKit {
+
+class WebString;
+
+// A cookie.
+//
+struct WebCookie {
+    WebCookie()
+        : expires(0)
+        , httpOnly(false)
+        , secure(false)
+        , session(false)
+    {
+    }
+
+    WebCookie(const WebString& name, const WebString& value, const WebString& domain,
+              const WebString& path, double expires, bool httpOnly, bool secure, bool session)
+        : name(name)
+        , value(value)
+        , domain(domain)
+        , path(path)
+        , expires(expires)
+        , httpOnly(httpOnly)
+        , secure(secure)
+        , session(session)
+    {
+    }
+
+    WebString name;
+    WebString value;
+    WebString domain;
+    WebString path;
+    double expires;
+    bool httpOnly;
+    bool secure;
+    bool session;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebCrossOriginPreflightResultCache.h b/WebKit/chromium/public/WebCrossOriginPreflightResultCache.h
new file mode 100644
index 0000000..62827f7
--- /dev/null
+++ b/WebKit/chromium/public/WebCrossOriginPreflightResultCache.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCrossOriginPreflightResultCache_h
+#define WebCrossOriginPreflightResultCache_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+// An interface to configure WebKit's cross-origin preflight result cache.
+class WebCrossOriginPreflightResultCache {
+public:
+    // Clears the cache.
+    WEBKIT_API static void clear();
+
+private:
+    WebCrossOriginPreflightResultCache();  // Not intended to be instanced.
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebCursorInfo.h b/WebKit/chromium/public/WebCursorInfo.h
new file mode 100644
index 0000000..8926e5c
--- /dev/null
+++ b/WebKit/chromium/public/WebCursorInfo.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCursorInfo_h
+#define WebCursorInfo_h
+
+#include "WebImage.h"
+#include "WebPoint.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class Cursor; }
+#endif
+
+#ifdef WIN32
+typedef struct HICON__* HICON;
+typedef HICON HCURSOR;
+#endif
+
+namespace WebKit {
+
+struct WebCursorInfo {
+    enum Type {
+        TypePointer,
+        TypeCross,
+        TypeHand,
+        TypeIBeam,
+        TypeWait,
+        TypeHelp,
+        TypeEastResize,
+        TypeNorthResize,
+        TypeNorthEastResize,
+        TypeNorthWestResize,
+        TypeSouthResize,
+        TypeSouthEastResize,
+        TypeSouthWestResize,
+        TypeWestResize,
+        TypeNorthSouthResize,
+        TypeEastWestResize,
+        TypeNorthEastSouthWestResize,
+        TypeNorthWestSouthEastResize,
+        TypeColumnResize,
+        TypeRowResize,
+        TypeMiddlePanning,
+        TypeEastPanning,
+        TypeNorthPanning,
+        TypeNorthEastPanning,
+        TypeNorthWestPanning,
+        TypeSouthPanning,
+        TypeSouthEastPanning,
+        TypeSouthWestPanning,
+        TypeWestPanning,
+        TypeMove,
+        TypeVerticalText,
+        TypeCell,
+        TypeContextMenu,
+        TypeAlias,
+        TypeProgress,
+        TypeNoDrop,
+        TypeCopy,
+        TypeNone,
+        TypeNotAllowed,
+        TypeZoomIn,
+        TypeZoomOut,
+        TypeCustom
+    };
+
+    Type type;
+    WebPoint hotSpot;
+    WebImage customImage;
+
+#ifdef WIN32
+    // On Windows, TypeCustom may alternatively reference an externally
+    // defined HCURSOR.  If type is TypeCustom and externalHandle is non-
+    // null, then customData should be ignored.  The WebCursorInfo is not
+    // responsible for managing the lifetime of this cursor handle.
+    HCURSOR externalHandle;
+#endif
+
+    explicit WebCursorInfo(Type type = TypePointer)
+        : type(type)
+    {
+#ifdef WIN32
+        externalHandle = 0;
+#endif
+    }
+
+#if WEBKIT_IMPLEMENTATION
+    explicit WebCursorInfo(const WebCore::Cursor&);
+#endif
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebData.h b/WebKit/chromium/public/WebData.h
new file mode 100644
index 0000000..5874bed
--- /dev/null
+++ b/WebKit/chromium/public/WebData.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebData_h
+#define WebData_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class SharedBuffer; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebDataPrivate;
+
+// A container for raw bytes.  It is inexpensive to copy a WebData object.
+//
+// WARNING: It is not safe to pass a WebData across threads!!!
+//
+class WebData {
+public:
+    ~WebData() { reset(); }
+
+    WebData() : m_private(0) { }
+
+    WebData(const char* data, size_t size) : m_private(0)
+    {
+        assign(data, size);
+    }
+
+    template <int N>
+    WebData(const char (&data)[N]) : m_private(0)
+    {
+        assign(data, N - 1);
+    }
+
+    WebData(const WebData& d) : m_private(0) { assign(d); }
+
+    WebData& operator=(const WebData& d)
+    {
+        assign(d);
+        return *this;
+    }
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebData&);
+    WEBKIT_API void assign(const char* data, size_t size);
+
+    WEBKIT_API size_t size() const;
+    WEBKIT_API const char* data() const;
+
+    bool isEmpty() const { return !size(); }
+    bool isNull() const { return !m_private; }
+
+#if WEBKIT_IMPLEMENTATION
+    WebData(const WTF::PassRefPtr<WebCore::SharedBuffer>&);
+    WebData& operator=(const WTF::PassRefPtr<WebCore::SharedBuffer>&);
+    operator WTF::PassRefPtr<WebCore::SharedBuffer>() const;
+#else
+    template <class C>
+    WebData(const C& c) : m_private(0)
+    {
+        assign(c.data(), c.size());
+    }
+
+    template <class C>
+    WebData& operator=(const C& c)
+    {
+        assign(c.data(), c.size());
+        return *this;
+    }
+#endif
+
+private:
+    void assign(WebDataPrivate*);
+    WebDataPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDataSource.h b/WebKit/chromium/public/WebDataSource.h
new file mode 100644
index 0000000..3a83341
--- /dev/null
+++ b/WebKit/chromium/public/WebDataSource.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDataSource_h
+#define WebDataSource_h
+
+#include "WebCommon.h"
+#include "WebNavigationType.h"
+
+namespace WebKit {
+
+class WebString;
+class WebURL;
+class WebURLRequest;
+class WebURLResponse;
+template <typename T> class WebVector;
+
+class WebDataSource {
+public:
+    class ExtraData {
+    public:
+        virtual ~ExtraData() { }
+    };
+
+    // Returns the original request that resulted in this datasource.
+    virtual const WebURLRequest& originalRequest() const = 0;
+
+    // Returns the request corresponding to this datasource.  It may
+    // include additional request headers added by WebKit that were not
+    // present in the original request.  This request may also correspond
+    // to a location specified by a redirect that was followed.
+    virtual const WebURLRequest& request() const = 0;
+
+    // Returns the response associated with this datasource.
+    virtual const WebURLResponse& response() const = 0;
+
+    // When this datasource was created as a result of WebFrame::loadData,
+    // there may be an associated unreachableURL.
+    virtual bool hasUnreachableURL() const = 0;
+    virtual WebURL unreachableURL() const = 0;
+
+    // Returns all redirects that occurred (both client and server) before
+    // at last committing the current page.  This will contain one entry
+    // for each intermediate URL, and one entry for the last URL (so if
+    // there are no redirects, it will contain exactly the current URL, and
+    // if there is one redirect, it will contain the source and destination
+    // URL).
+    virtual void redirectChain(WebVector<WebURL>&) const = 0;
+
+    // Returns the title for the current page.
+    virtual WebString pageTitle() const = 0;
+
+    // The type of navigation that triggered the creation of this datasource.
+    virtual WebNavigationType navigationType() const = 0;
+
+    // The time in seconds (since the epoch) of the event that triggered
+    // the creation of this datasource.  Returns 0 if unknown.
+    virtual double triggeringEventTime() const = 0;
+
+    // Extra data associated with this datasource.  If non-null, the extra
+    // data pointer will be deleted when the datasource is destroyed.
+    // Setting the extra data pointer will cause any existing non-null
+    // extra data pointer to be deleted.
+    virtual ExtraData* extraData() const = 0;
+    virtual void setExtraData(ExtraData*) = 0;
+
+protected:
+    ~WebDataSource() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDatabase.h b/WebKit/chromium/public/WebDatabase.h
new file mode 100644
index 0000000..179e828
--- /dev/null
+++ b/WebKit/chromium/public/WebDatabase.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDatabase_h
+#define WebDatabase_h
+
+#include "WebCommon.h"
+#include "WebSecurityOrigin.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class Database; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebDatabaseObserver;
+class WebDatabasePrivate;
+class WebString;
+
+class WebDatabase {
+public:
+    WebDatabase() : m_private(0) { }
+    WebDatabase(const WebDatabase& d) : m_private(0) { assign(d); }
+    ~WebDatabase() { reset(); }
+
+    WebDatabase& operator=(const WebDatabase& d)
+    {
+        assign(d);
+        return *this;
+    }
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebDatabase&);
+    bool isNull() const { return !m_private; }
+
+    WEBKIT_API WebString name() const;
+    WEBKIT_API WebString displayName() const;
+    WEBKIT_API unsigned long estimatedSize() const;
+    WEBKIT_API WebSecurityOrigin securityOrigin() const;
+
+    WEBKIT_API static void setObserver(WebDatabaseObserver*);
+    WEBKIT_API static WebDatabaseObserver* observer();
+
+    WEBKIT_API static void updateDatabaseSize(
+        const WebString& originIdentifier, const WebString& databaseName,
+        unsigned long long databaseSize, unsigned long long spaceAvailable);
+
+#if WEBKIT_IMPLEMENTATION
+    WebDatabase(const WTF::PassRefPtr<WebCore::Database>&);
+    WebDatabase& operator=(const WTF::PassRefPtr<WebCore::Database>&);
+    operator WTF::PassRefPtr<WebCore::Database>() const;
+#endif
+
+private:
+    void assign(WebDatabasePrivate*);
+
+    WebDatabasePrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDatabaseObserver.h b/WebKit/chromium/public/WebDatabaseObserver.h
new file mode 100644
index 0000000..da85c93
--- /dev/null
+++ b/WebKit/chromium/public/WebDatabaseObserver.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDatabaseObserver_h
+#define WebDatabaseObserver_h
+
+namespace WebKit {
+class WebDatabase;
+
+class WebDatabaseObserver {
+public:
+    virtual void databaseOpened(const WebDatabase&) = 0;
+    virtual void databaseModified(const WebDatabase&) = 0;
+    virtual void databaseClosed(const WebDatabase&) = 0;
+protected:
+    ~WebDatabaseObserver() {}
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDevToolsAgent.h b/WebKit/chromium/public/WebDevToolsAgent.h
new file mode 100644
index 0000000..9c27628
--- /dev/null
+++ b/WebKit/chromium/public/WebDevToolsAgent.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDevToolsAgent_h
+#define WebDevToolsAgent_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+class WebDevToolsAgentClient;
+class WebFrame;
+class WebString;
+class WebURLRequest;
+class WebURLResponse;
+class WebView;
+struct WebDevToolsMessageData;
+struct WebPoint;
+struct WebURLError;
+
+class WebDevToolsAgent {
+public:
+    WEBKIT_API static WebDevToolsAgent* create(WebView*, WebDevToolsAgentClient*);
+
+    virtual ~WebDevToolsAgent() {}
+
+    virtual void attach() = 0;
+    virtual void detach() = 0;
+
+    virtual void didNavigate() = 0;
+
+    // TODO(32320): remove this method from API.
+    virtual void dispatchMessageFromFrontend(const WebString& className,
+                                             const WebString& methodName,
+                                             const WebString& param1,
+                                             const WebString& param2,
+                                             const WebString& param3) = 0;
+    virtual void dispatchMessageFromFrontend(const WebDevToolsMessageData&) = 0;
+
+    virtual void inspectElementAt(const WebPoint&) = 0;
+
+    virtual void setRuntimeFeatureEnabled(const WebString& feature, bool enabled) = 0;
+
+    // Exposed for LayoutTestController.
+    virtual void evaluateInWebInspector(long callId, const WebString& script) = 0;
+    virtual void setTimelineProfilingEnabled(bool enabled) = 0;
+
+    // Asynchronously executes debugger command in the render thread.
+    // |callerIdentifier| will be used for sending response.
+    WEBKIT_API static void executeDebuggerCommand(
+        const WebString& command, int callerIdentifier);
+
+    // Asynchronously request debugger to pause immediately.
+    WEBKIT_API static void debuggerPauseScript();
+
+    // TODO(32320): remove this method from API.
+    WEBKIT_API static bool dispatchMessageFromFrontendOnIOThread(const WebString& className,
+                                                                 const WebString& methodName,
+                                                                 const WebString& param1,
+                                                                 const WebString& param2,
+                                                                 const WebString& param3);
+    WEBKIT_API static bool dispatchMessageFromFrontendOnIOThread(const WebDevToolsMessageData&);
+
+    typedef void (*MessageLoopDispatchHandler)();
+
+    // Installs dispatch handle that is going to be called periodically
+    // while on a breakpoint.
+    WEBKIT_API static void setMessageLoopDispatchHandler(MessageLoopDispatchHandler);
+
+    virtual void identifierForInitialRequest(unsigned long resourceId, WebFrame*, const WebURLRequest&) = 0;
+    virtual void willSendRequest(unsigned long resourceId, const WebURLRequest&) = 0;
+    virtual void didReceiveData(unsigned long resourceId, int length) = 0;
+    virtual void didReceiveResponse(unsigned long resourceId, const WebURLResponse&) = 0;
+    virtual void didFinishLoading(unsigned long resourceId) = 0;
+    virtual void didFailLoading(unsigned long resourceId, const WebURLError&) = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDevToolsAgentClient.h b/WebKit/chromium/public/WebDevToolsAgentClient.h
new file mode 100644
index 0000000..ec51654
--- /dev/null
+++ b/WebKit/chromium/public/WebDevToolsAgentClient.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDevToolsAgentClient_h
+#define WebDevToolsAgentClient_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+class WebString;
+struct WebDevToolsMessageData;
+
+class WebDevToolsAgentClient {
+public:
+    // TODO(32320): remove this method from API.
+    virtual void sendMessageToFrontend(const WebString& className,
+                                       const WebString& methodName,
+                                       const WebString& param1,
+                                       const WebString& param2,
+                                       const WebString& param3) {}
+    virtual void sendMessageToFrontend(const WebDevToolsMessageData&) { }
+
+    // Invalidates widget which leads to the repaint.
+    virtual void forceRepaint() { }
+
+    // Returns the identifier of the entity hosting this agent.
+    virtual int hostIdentifier() { return -1; }
+
+    // Notifies host upon runtime feature being enabled/disabled.
+    virtual void runtimeFeatureStateChanged(const WebString& feature, bool enabled) { }
+
+    // TODO(32320): remove this method from API.
+    WEBKIT_API static void sendMessageToFrontendOnIOThread(const WebString& className,
+                                                           const WebString& methodName,
+                                                           const WebString& param1,
+                                                           const WebString& param2,
+                                                           const WebString& param3);
+    WEBKIT_API static void sendMessageToFrontendOnIOThread(const WebDevToolsMessageData&);
+
+protected:
+    ~WebDevToolsAgentClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDevToolsFrontend.h b/WebKit/chromium/public/WebDevToolsFrontend.h
new file mode 100644
index 0000000..b7d7189
--- /dev/null
+++ b/WebKit/chromium/public/WebDevToolsFrontend.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDevToolsFrontend_h
+#define WebDevToolsFrontend_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebDevToolsFrontendClient;
+class WebString;
+class WebView;
+struct WebDevToolsMessageData;
+
+// WebDevToolsFrontend represents DevTools client sitting in the Glue. It provides
+// direct and delegate Apis to the host.
+class WebDevToolsFrontend {
+public:
+    WEBKIT_API static WebDevToolsFrontend* create(WebView* view,
+                                                  WebDevToolsFrontendClient* client,
+                                                  const WebString& applicationLocale);
+
+    virtual ~WebDevToolsFrontend() {}
+
+    virtual void dispatchMessageFromAgent(const WebString& className,
+                                          const WebString& methodName,
+                                          const WebString& param1,
+                                          const WebString& param2,
+                                          const WebString& param3) = 0;
+    virtual void dispatchMessageFromAgent(const WebDevToolsMessageData&) = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDevToolsFrontendClient.h b/WebKit/chromium/public/WebDevToolsFrontendClient.h
new file mode 100644
index 0000000..2f74a8c
--- /dev/null
+++ b/WebKit/chromium/public/WebDevToolsFrontendClient.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDevToolsFrontendClient_h
+#define WebDevToolsFrontendClient_h
+
+namespace WebKit {
+
+class WebString;
+struct WebDevToolsMessageData;
+
+class WebDevToolsFrontendClient {
+public:
+    WebDevToolsFrontendClient() {}
+
+    virtual void sendMessageToAgent(const WebString& className,
+                                    const WebString& methodName,
+                                    const WebString& param1,
+                                    const WebString& param2,
+                                    const WebString& param3) {};
+    virtual void sendMessageToAgent(const WebDevToolsMessageData&) {};
+    virtual void sendDebuggerCommandToAgent(const WebString& command) {};
+    virtual void sendDebuggerPauseScript() {}
+
+    virtual void activateWindow() {};
+    virtual void closeWindow() {};
+    virtual void dockWindow() {};
+    virtual void undockWindow() {};
+
+protected:
+    virtual ~WebDevToolsFrontendClient() {}
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDevToolsMessageData.h b/WebKit/chromium/public/WebDevToolsMessageData.h
new file mode 100644
index 0000000..9bf9acd
--- /dev/null
+++ b/WebKit/chromium/public/WebDevToolsMessageData.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDevToolsMessageData_h
+#define WebDevToolsMessageData_h
+
+#include "WebCommon.h"
+#include "WebString.h"
+#include "WebVector.h"
+
+namespace WebKit {
+
+struct WebDevToolsMessageData {
+    WebString className;
+    WebString methodName;
+    WebVector<WebString> arguments;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDragData.h b/WebKit/chromium/public/WebDragData.h
new file mode 100644
index 0000000..f7a165d
--- /dev/null
+++ b/WebKit/chromium/public/WebDragData.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDragData_h
+#define WebDragData_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class ChromiumDataObject; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebData;
+class WebDragDataPrivate;
+class WebString;
+class WebURL;
+template <typename T> class WebVector;
+
+// Holds data that may be exchanged through a drag-n-drop operation.  It is
+// inexpensive to copy a WebDragData object.
+class WebDragData {
+public:
+    ~WebDragData() { reset(); }
+
+    WebDragData() : m_private(0) { }
+    WebDragData(const WebDragData& d) : m_private(0) { assign(d); }
+    WebDragData& operator=(const WebDragData& d)
+    {
+        assign(d);
+        return *this;
+    }
+
+    WEBKIT_API void initialize();
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebDragData&);
+
+    bool isNull() const { return !m_private; }
+
+    WEBKIT_API WebURL url() const;
+    WEBKIT_API void setURL(const WebURL&);
+
+    WEBKIT_API WebString urlTitle() const;
+    WEBKIT_API void setURLTitle(const WebString&);
+
+    WEBKIT_API WebString fileExtension() const;
+    WEBKIT_API void setFileExtension(const WebString&);
+
+    WEBKIT_API bool hasFileNames() const;
+    WEBKIT_API void fileNames(WebVector<WebString>&) const;
+    WEBKIT_API void setFileNames(const WebVector<WebString>&);
+    WEBKIT_API void appendToFileNames(const WebString&);
+
+    WEBKIT_API WebString plainText() const;
+    WEBKIT_API void setPlainText(const WebString&);
+
+    WEBKIT_API WebString htmlText() const;
+    WEBKIT_API void setHTMLText(const WebString&);
+
+    WEBKIT_API WebURL htmlBaseURL() const;
+    WEBKIT_API void setHTMLBaseURL(const WebURL&);
+
+    WEBKIT_API WebString fileContentFileName() const;
+    WEBKIT_API void setFileContentFileName(const WebString&);
+
+    WEBKIT_API WebData fileContent() const;
+    WEBKIT_API void setFileContent(const WebData&);
+
+#if WEBKIT_IMPLEMENTATION
+    WebDragData(const WTF::PassRefPtr<WebCore::ChromiumDataObject>&);
+    WebDragData& operator=(const WTF::PassRefPtr<WebCore::ChromiumDataObject>&);
+    operator WTF::PassRefPtr<WebCore::ChromiumDataObject>() const;
+#endif
+
+private:
+    void assign(WebDragDataPrivate*);
+    void ensureMutable();
+    WebDragDataPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebDragOperation.h b/WebKit/chromium/public/WebDragOperation.h
new file mode 100644
index 0000000..050b74f
--- /dev/null
+++ b/WebKit/chromium/public/WebDragOperation.h
@@ -0,0 +1,59 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef WebDragOperation_h
+#define WebDragOperation_h
+
+#include <limits.h>
+
+namespace WebKit {
+
+// "Verb" of a drag-and-drop operation as negotiated between the source and
+// destination.
+// (These constants match their equivalents in WebCore's DragActions.h and
+// should not be renumbered.)
+enum WebDragOperation {
+    WebDragOperationNone    = 0,
+    WebDragOperationCopy    = 1,
+    WebDragOperationLink    = 2,
+    WebDragOperationGeneric = 4,
+    WebDragOperationPrivate = 8,
+    WebDragOperationMove    = 16,
+    WebDragOperationDelete  = 32,
+    WebDragOperationEvery   = UINT_MAX
+};
+
+// Alternate typedef to make it clear when this is being used as a mask
+// with potentially multiple value bits set.
+typedef WebDragOperation WebDragOperationsMask;
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebEditingAction.h b/WebKit/chromium/public/WebEditingAction.h
new file mode 100644
index 0000000..4e76100
--- /dev/null
+++ b/WebKit/chromium/public/WebEditingAction.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebEditingAction_h
+#define WebEditingAction_h
+
+namespace WebKit {
+
+enum WebEditingAction {
+    WebEditingActionTyped,
+    WebEditingActionPasted,
+    WebEditingActionDropped,
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebElement.h b/WebKit/chromium/public/WebElement.h
new file mode 100644
index 0000000..d7a2cbf
--- /dev/null
+++ b/WebKit/chromium/public/WebElement.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebElement_h
+#define WebElement_h
+
+#include "WebNode.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class Element; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+    // Provides readonly access to some properties of a DOM element node.
+    class WebElement : public WebNode {
+    public:
+        WebElement() : WebNode() { }
+        WebElement(const WebElement& e) : WebNode(e) { }
+
+        WebElement& operator=(const WebElement& e) { WebNode::assign(e); return *this; }
+        WEBKIT_API void assign(const WebElement& e) { WebNode::assign(e); }
+
+#if WEBKIT_IMPLEMENTATION
+        WebElement(const WTF::PassRefPtr<WebCore::Element>&);
+        WebElement& operator=(const WTF::PassRefPtr<WebCore::Element>&);
+        operator WTF::PassRefPtr<WebCore::Element>() const;
+#endif
+    };
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebFileChooserCompletion.h b/WebKit/chromium/public/WebFileChooserCompletion.h
new file mode 100644
index 0000000..14bace4
--- /dev/null
+++ b/WebKit/chromium/public/WebFileChooserCompletion.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFileChooserCompletion_h
+#define WebFileChooserCompletion_h
+
+namespace WebKit {
+
+class WebString;
+template <typename T> class WebVector;
+
+// Gets called back when WebViewClient finished choosing a file.
+class WebFileChooserCompletion {
+public:
+    // Called with zero or more file names. Zero-lengthed vector means that
+    // the user cancelled or that file choosing failed. The callback instance
+    // is destroyed when this method is called.
+    virtual void didChooseFile(const WebVector<WebString>& fileNames) = 0;
+protected:
+    virtual ~WebFileChooserCompletion() {}
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebFindOptions.h b/WebKit/chromium/public/WebFindOptions.h
new file mode 100644
index 0000000..93d48d3
--- /dev/null
+++ b/WebKit/chromium/public/WebFindOptions.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFindOptions_h
+#define WebFindOptions_h
+
+#include "WebString.h"
+
+namespace WebKit {
+
+// Options used when performing a find-in-page query.
+struct WebFindOptions {
+    // Whether to search forward or backward within the page.
+    bool forward;
+
+    // Whether search should be case-sensitive.
+    bool matchCase;
+
+    // Whether this operation is the first request or a follow-up.
+    bool findNext;
+
+    WebFindOptions()
+        : forward(true)
+        , matchCase(false)
+        , findNext(false) { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebFontCache.h b/WebKit/chromium/public/WebFontCache.h
new file mode 100644
index 0000000..05aadc7
--- /dev/null
+++ b/WebKit/chromium/public/WebFontCache.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFontCache_h
+#define WebFontCache_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+// An interface to query and configure WebKit's font cache.
+class WebFontCache {
+public:
+    // Returns the number of items in the font data cache.
+    WEBKIT_API static size_t fontDataCount();
+
+    // Returns the number of inactive items in the font data cache.
+    WEBKIT_API static size_t inactiveFontDataCount();
+
+    // Clears the cache.
+    WEBKIT_API static void clear();
+
+private:
+    WebFontCache();  // Not intended to be instanced.
+};
+
+}  // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebFormElement.h b/WebKit/chromium/public/WebFormElement.h
new file mode 100644
index 0000000..27a1edb
--- /dev/null
+++ b/WebKit/chromium/public/WebFormElement.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFormElement_h
+#define WebFormElement_h
+
+#include "WebElement.h"
+#include "WebInputElement.h"
+#include "WebVector.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class HTMLFormElement; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+    // A container for passing around a reference to a form element.  Provides
+    // some information about the form.
+    class WebFormElement : public WebElement {
+    public:
+        ~WebFormElement() { reset(); }
+
+        WebFormElement() : WebElement() { }
+        WebFormElement(const WebFormElement& e) : WebElement(e) { }
+
+        WebElement& operator=(const WebFormElement& e) { WebElement::assign(e); return *this; }
+        WEBKIT_API void assign(const WebFormElement& e) { WebElement::assign(e); }
+
+#if WEBKIT_IMPLEMENTATION
+        WebFormElement(const WTF::PassRefPtr<WebCore::HTMLFormElement>&);
+        WebFormElement& operator=(const WTF::PassRefPtr<WebCore::HTMLFormElement>&);
+        operator WTF::PassRefPtr<WebCore::HTMLFormElement>() const;
+#endif
+
+        WEBKIT_API bool autoComplete() const;
+        WEBKIT_API WebString action() const;
+        WEBKIT_API WebString name() const;
+        WEBKIT_API WebString method() const;
+        WEBKIT_API void submit();
+        // FIXME: Deprecate and replace with WebVector<WebElement>.
+        WEBKIT_API void getNamedElements(const WebString&, WebVector<WebNode>&);
+        WEBKIT_API void getInputElements(WebVector<WebInputElement>&) const;
+    };
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebFrame.h b/WebKit/chromium/public/WebFrame.h
new file mode 100644
index 0000000..44b57aa
--- /dev/null
+++ b/WebKit/chromium/public/WebFrame.h
@@ -0,0 +1,469 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFrame_h
+#define WebFrame_h
+
+#include "WebCanvas.h"
+#include "WebURL.h"
+
+struct NPObject;
+
+#if WEBKIT_USING_V8
+namespace v8 {
+class Context;
+template <class T> class Local;
+}
+#endif
+
+namespace WebKit {
+
+class WebData;
+class WebDataSource;
+class WebFormElement;
+class WebHistoryItem;
+class WebInputElement;
+class WebPasswordAutocompleteListener;
+class WebRange;
+class WebSecurityOrigin;
+class WebString;
+class WebURL;
+class WebURLRequest;
+class WebView;
+struct WebConsoleMessage;
+struct WebFindOptions;
+struct WebRect;
+struct WebScriptSource;
+struct WebSize;
+template <typename T> class WebVector;
+
+class WebFrame {
+public:
+    // The two functions below retrieve the WebFrame instances relating the
+    // currently executing JavaScript.  Since JavaScript can make function
+    // calls across frames, though, we need to be more precise.
+    //
+    // For example, imagine that a JS function in frame A calls a function
+    // in frame B, which calls native code, which wants to know what the
+    // 'active' frame is.
+    //
+    // The 'entered context' is the context where execution first entered
+    // the script engine; the context that is at the bottom of the JS
+    // function stack.  frameForEnteredContext() would return frame A in
+    // our example.
+    //
+    // The 'current context' is the context the JS engine is currently
+    // inside of; the context that is at the top of the JS function stack.
+    // frameForCurrentContext() would return frame B in our example.
+    WEBKIT_API static WebFrame* frameForEnteredContext();
+    WEBKIT_API static WebFrame* frameForCurrentContext();
+
+
+    // Basic properties ---------------------------------------------------
+
+    // The name of this frame.
+    virtual WebString name() const = 0;
+
+    // The url of the document loaded in this frame.  This is equivalent to
+    // dataSource()->request().url().
+    virtual WebURL url() const = 0;
+
+    // The url of the favicon (if any) specified by the document loaded in
+    // this frame.
+    virtual WebURL favIconURL() const = 0;
+
+    // The url of the OpenSearch Desription Document (if any) specified by
+    // the document loaded in this frame.
+    virtual WebURL openSearchDescriptionURL() const = 0;
+
+
+    // Geometry -----------------------------------------------------------
+
+    // NOTE: These routines do not force page layout so their results may
+    // not be accurate if the page layout is out-of-date.
+
+    // The scroll offset from the top-left corner of the frame in pixels.
+    virtual WebSize scrollOffset() const = 0;
+
+    // The size of the contents area.
+    virtual WebSize contentsSize() const = 0;
+
+    // Returns the minimum preferred width of the content contained in the
+    // current document.
+    virtual int contentsPreferredWidth() const = 0;
+
+    // Returns the scroll height of the document element. This is
+    // equivalent to the DOM property of the same name, and is the minimum
+    // height required to display the document without scrollbars.
+    virtual int documentElementScrollHeight() const = 0;
+
+    // Returns true if the contents (minus scrollbars) has non-zero area.
+    virtual bool hasVisibleContent() const = 0;
+
+
+    // Hierarchy ----------------------------------------------------------
+
+    // Returns the containing view.
+    virtual WebView* view() const = 0;
+
+    // Returns the frame that opened this frame or 0 if there is none.
+    virtual WebFrame* opener() const = 0;
+
+    // Returns the parent frame or 0 if this is a top-most frame.
+    virtual WebFrame* parent() const = 0;
+
+    // Returns the top-most frame in the hierarchy containing this frame.
+    virtual WebFrame* top() const = 0;
+
+    // Returns the first/last child frame.
+    virtual WebFrame* firstChild() const = 0;
+    virtual WebFrame* lastChild() const = 0;
+
+    // Returns the next/previous sibling frame.
+    virtual WebFrame* nextSibling() const = 0;
+    virtual WebFrame* previousSibling() const = 0;
+
+    // Returns the next/previous frame in "frame traversal order"
+    // optionally wrapping around.
+    virtual WebFrame* traverseNext(bool wrap) const = 0;
+    virtual WebFrame* traversePrevious(bool wrap) const = 0;
+
+    // Returns the child frame identified by the given name.
+    virtual WebFrame* findChildByName(const WebString& name) const = 0;
+
+    // Returns the child frame identified by the given xpath expression.
+    virtual WebFrame* findChildByExpression(const WebString& xpath) const = 0;
+
+
+    // Content ------------------------------------------------------------
+
+    virtual void forms(WebVector<WebFormElement>&) const = 0;
+
+
+    // Scripting ----------------------------------------------------------
+
+    // Returns the security origin of the current document.
+    virtual WebSecurityOrigin securityOrigin() const = 0;
+
+    // This grants the currently loaded document access to all security
+    // origins (including file URLs).  Use with care.  The access is
+    // revoked when a new document is loaded into this frame.
+    virtual void grantUniversalAccess() = 0;
+
+    // Returns a NPObject corresponding to this frame's DOMWindow.
+    virtual NPObject* windowObject() const = 0;
+
+    // Binds a NPObject as a property of this frame's DOMWindow.
+    virtual void bindToWindowObject(const WebString& name, NPObject*) = 0;
+
+    // Executes script in the context of the current page.
+    virtual void executeScript(const WebScriptSource&) = 0;
+
+    // Executes script in a new context associated with the frame. The
+    // script gets its own global scope and its own prototypes for
+    // intrinsic JS objects (String, Array, and so-on). It shares the
+    // wrappers for all DOM nodes and DOM constructors.  extensionGroup is
+    // an embedder-provided specifier that controls which v8 extensions are
+    // loaded into the new context - see WebKit::registerExtension for the
+    // corresponding specifier.
+    virtual void executeScriptInNewContext(const WebScriptSource* sources,
+                                           unsigned numSources,
+                                           int extensionGroup) = 0;
+
+    // Executes JavaScript in a new world associated with the web frame.
+    // The script gets its own global scope and its own prototypes for
+    // intrinsic JavaScript objects (String, Array, and so-on). It also
+    // gets its own wrappers for all DOM nodes and DOM constructors.
+    // extensionGroup is an embedder-provided specifier that controls which
+    // v8 extensions are loaded into the new context - see
+    // WebKit::registerExtension for the corresponding specifier.
+    virtual void executeScriptInIsolatedWorld(
+        int worldId, const WebScriptSource* sources, unsigned numSources,
+        int extensionGroup) = 0;
+
+    // Logs to the console associated with this frame.
+    virtual void addMessageToConsole(const WebConsoleMessage&) = 0;
+
+    // Calls window.gc() if it is defined.
+    virtual void collectGarbage() = 0;
+
+#if WEBKIT_USING_V8
+    // Returns the V8 context for this frame, or an empty handle if there
+    // is none.
+    virtual v8::Local<v8::Context> mainWorldScriptContext() const = 0;
+#endif
+
+
+    // Styling -------------------------------------------------------------
+
+    // Insert the given text as a STYLE element at the beginning of the
+    // document. |elementId| can be empty, but if specified then it is used
+    // as the id for the newly inserted element (replacing an existing one
+    // with the same id, if any).
+    virtual bool insertStyleText(const WebString& styleText,
+                                 const WebString& elementId) = 0;
+
+
+    // Navigation ----------------------------------------------------------
+
+    // Reload the current document.
+    virtual void reload() = 0;
+
+    // Load the given URL.
+    virtual void loadRequest(const WebURLRequest&) = 0;
+
+    // Load the given history state, corresponding to a back/forward
+    // navigation.
+    virtual void loadHistoryItem(const WebHistoryItem&) = 0;
+
+    // Loads the given data with specific mime type and optional text
+    // encoding.  For HTML data, baseURL indicates the security origin of
+    // the document and is used to resolve links.  If specified,
+    // unreachableURL is reported via WebDataSource::unreachableURL.  If
+    // replace is false, then this data will be loaded as a normal
+    // navigation.  Otherwise, the current history item will be replaced.
+    virtual void loadData(const WebData& data,
+                          const WebString& mimeType,
+                          const WebString& textEncoding,
+                          const WebURL& baseURL,
+                          const WebURL& unreachableURL = WebURL(),
+                          bool replace = false) = 0;
+
+    // This method is short-hand for calling LoadData, where mime_type is
+    // "text/html" and text_encoding is "UTF-8".
+    virtual void loadHTMLString(const WebData& html,
+                                const WebURL& baseURL,
+                                const WebURL& unreachableURL = WebURL(),
+                                bool replace = false) = 0;
+
+    // Returns true if the current frame is busy loading content.
+    virtual bool isLoading() const = 0;
+
+    // Stops any pending loads on the frame and its children.
+    virtual void stopLoading() = 0;
+
+    // Returns the data source that is currently loading.  May be null.
+    virtual WebDataSource* provisionalDataSource() const = 0;
+
+    // Returns the data source that is currently loaded.
+    virtual WebDataSource* dataSource() const = 0;
+
+    // Returns the previous history item.  Check WebHistoryItem::isNull()
+    // before using.
+    virtual WebHistoryItem previousHistoryItem() const = 0;
+
+    // Returns the current history item.  Check WebHistoryItem::isNull()
+    // before using.
+    virtual WebHistoryItem currentHistoryItem() const = 0;
+
+    // View-source rendering mode.  Set this before loading an URL to cause
+    // it to be rendered in view-source mode.
+    virtual void enableViewSourceMode(bool) = 0;
+    virtual bool isViewSourceModeEnabled() const = 0;
+
+    // Sets the referrer for the given request to be the specified URL or
+    // if that is null, then it sets the referrer to the referrer that the
+    // frame would use for subresources.  NOTE: This method also filters
+    // out invalid referrers (e.g., it is invalid to send a HTTPS URL as
+    // the referrer for a HTTP request).
+    virtual void setReferrerForRequest(WebURLRequest&, const WebURL&) = 0;
+
+    // Called to associate the WebURLRequest with this frame.  The request
+    // will be modified to inherit parameters that allow it to be loaded.
+    // This method ends up triggering WebFrameClient::willSendRequest.
+    virtual void dispatchWillSendRequest(WebURLRequest&) = 0;
+
+    // Called from within WebFrameClient::didReceiveDocumentData to commit
+    // data for the frame that will be used to construct the frame's
+    // document.
+    virtual void commitDocumentData(const char* data, size_t length) = 0;
+
+    // Returns the number of registered unload listeners.
+    virtual unsigned unloadListenerCount() const = 0;
+
+    // Returns true if a user gesture is currently being processed.
+    virtual bool isProcessingUserGesture() const = 0;
+
+    // Returns true if this frame is in the process of opening a new frame
+    // with a suppressed opener.
+    virtual bool willSuppressOpenerInNewFrame() const = 0;
+
+
+    // Editing -------------------------------------------------------------
+
+    // Replaces the selection with the given text.
+    virtual void replaceSelection(const WebString& text) = 0;
+
+    virtual void insertText(const WebString& text) = 0;
+
+    virtual void setMarkedText(const WebString& text, unsigned location, unsigned length) = 0;
+    virtual void unmarkText() = 0;
+    virtual bool hasMarkedText() const = 0;
+
+    virtual WebRange markedRange() const = 0;
+
+    // Supports commands like Undo, Redo, Cut, Copy, Paste, SelectAll,
+    // Unselect, etc. See EditorCommand.cpp for the full list of supported
+    // commands.
+    virtual bool executeCommand(const WebString&) = 0;
+    virtual bool executeCommand(const WebString&, const WebString& value) = 0;
+    virtual bool isCommandEnabled(const WebString&) const = 0;
+
+    // Spell-checking support.
+    virtual void enableContinuousSpellChecking(bool) = 0;
+    virtual bool isContinuousSpellCheckingEnabled() const = 0;
+
+
+    // Selection -----------------------------------------------------------
+
+    virtual bool hasSelection() const = 0;
+
+    virtual WebRange selectionRange() const = 0;
+
+    virtual WebString selectionAsText() const = 0;
+    virtual WebString selectionAsMarkup() const = 0;
+
+
+    // Printing ------------------------------------------------------------
+
+    // Reformats the WebFrame for printing.  pageSize is the page size in
+    // pixels.  Returns the number of pages that can be printed at the
+    // given page size.
+    virtual int printBegin(const WebSize& pageSize) = 0;
+
+    // Returns the page shrinking factor calculated by webkit (usually
+    // between 1/1.25 and 1/2). Returns 0 if the page number is invalid or
+    // not in printing mode.
+    virtual float getPrintPageShrink(int page) = 0;
+
+    // Prints one page, and returns the calculated page shrinking factor
+    // (usually between 1/1.25 and 1/2).  Returns 0 if the page number is
+    // invalid or not in printing mode.
+    virtual float printPage(int pageToPrint, WebCanvas*) = 0;
+
+    // Reformats the WebFrame for screen display.
+    virtual void printEnd() = 0;
+
+
+    // Find-in-page --------------------------------------------------------
+
+    // Searches a frame for a given string.
+    //
+    // If a match is found, this function will select it (scrolling down to
+    // make it visible if needed) and fill in selectionRect with the
+    // location of where the match was found (in window coordinates).
+    //
+    // If no match is found, this function clears all tickmarks and
+    // highlighting.
+    //
+    // Returns true if the search string was found, false otherwise.
+    virtual bool find(int identifier,
+                      const WebString& searchText,
+                      const WebFindOptions& options,
+                      bool wrapWithinFrame,
+                      WebRect* selectionRect) = 0;
+
+    // Notifies the frame that we are no longer interested in searching.
+    // This will abort any asynchronous scoping effort already under way
+    // (see the function scopeStringMatches for details) and erase all
+    // tick-marks and highlighting from the previous search.  If
+    // clearSelection is true, it will also make sure the end state for the
+    // find operation does not leave a selection.  This can occur when the
+    // user clears the search string but does not close the find box.
+    virtual void stopFinding(bool clearSelection) = 0;
+
+    // Counts how many times a particular string occurs within the frame.
+    // It also retrieves the location of the string and updates a vector in
+    // the frame so that tick-marks and highlighting can be drawn.  This
+    // function does its work asynchronously, by running for a certain
+    // time-slice and then scheduling itself (co-operative multitasking) to
+    // be invoked later (repeating the process until all matches have been
+    // found).  This allows multiple frames to be searched at the same time
+    // and provides a way to cancel at any time (see
+    // cancelPendingScopingEffort).  The parameter searchText specifies
+    // what to look for and |reset| signals whether this is a brand new
+    // request or a continuation of the last scoping effort.
+    virtual void scopeStringMatches(int identifier,
+                                    const WebString& searchText,
+                                    const WebFindOptions& options,
+                                    bool reset) = 0;
+
+    // Cancels any outstanding requests for scoping string matches on a frame.
+    virtual void cancelPendingScopingEffort() = 0;
+
+    // This function is called on the main frame during the scoping effort
+    // to keep a running tally of the accumulated total match-count for all
+    // frames.  After updating the count it will notify the WebViewClient
+    // about the new count.
+    virtual void increaseMatchCount(int count, int identifier) = 0;
+
+    // This function is called on the main frame to reset the total number
+    // of matches found during the scoping effort.
+    virtual void resetMatchCount() = 0;
+
+    // Password autocompletion ---------------------------------------------
+
+    // Registers a listener for the specified user name input element. The
+    // listener will receive notifications for blur and when autocomplete
+    // should be triggered.
+    // The WebFrame becomes the owner of the passed listener.
+    virtual void registerPasswordListener(
+        WebInputElement,
+        WebPasswordAutocompleteListener*) = 0;
+
+    // Utility -------------------------------------------------------------
+
+    // Given a relative URL, returns an absolute URL by resolving the URL
+    // relative to the base URL of the frame's document.  This uses the
+    // same algorithm that WebKit uses to resolve hyperlinks found in a
+    // HTML document.
+    virtual WebURL completeURL(const WebString&) const = 0;
+
+    // Returns the contents of this frame as a string.  If the text is
+    // longer than maxChars, it will be clipped to that length.  WARNING:
+    // This function may be slow depending on the number of characters
+    // retrieved and page complexity.  For a typically sized page, expect
+    // it to take on the order of milliseconds.
+    //
+    // If there is room, subframe text will be recursively appended. Each
+    // frame will be separated by an empty line.
+    virtual WebString contentAsText(size_t maxChars) const = 0;
+
+    // Returns HTML text for the contents of this frame.  This is generated
+    // from the DOM.
+    virtual WebString contentAsMarkup() const = 0;
+
+protected:
+    ~WebFrame() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebFrameClient.h b/WebKit/chromium/public/WebFrameClient.h
new file mode 100644
index 0000000..297eb62
--- /dev/null
+++ b/WebKit/chromium/public/WebFrameClient.h
@@ -0,0 +1,290 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFrameClient_h
+#define WebFrameClient_h
+
+#include "WebCommon.h"
+#include "WebNavigationPolicy.h"
+#include "WebNavigationType.h"
+#include "WebURLError.h"
+
+namespace WebKit {
+
+class WebDataSource;
+class WebFormElement;
+class WebFrame;
+class WebMediaPlayer;
+class WebMediaPlayerClient;
+class WebNode;
+class WebPlugin;
+class WebSecurityOrigin;
+class WebSharedWorker;
+class WebString;
+class WebURL;
+class WebURLRequest;
+class WebURLResponse;
+class WebWorker;
+class WebWorkerClient;
+struct WebPluginParams;
+struct WebRect;
+struct WebSize;
+struct WebURLError;
+
+class WebFrameClient {
+public:
+    // Factory methods -----------------------------------------------------
+
+    // May return null.
+    virtual WebPlugin* createPlugin(WebFrame*, const WebPluginParams&) { return 0; }
+
+    // May return null.
+    virtual WebWorker* createWorker(WebFrame*, WebWorkerClient*) { return 0; }
+
+    // May return null.
+    virtual WebSharedWorker* createSharedWorker(WebFrame*, const WebURL&, const WebString&, unsigned long long) { return 0; }
+
+    // May return null.
+    virtual WebMediaPlayer* createMediaPlayer(WebFrame*, WebMediaPlayerClient*) { return 0; }
+
+
+    // General notifications -----------------------------------------------
+
+    // This frame is about to be closed.
+    virtual void willClose(WebFrame*) { }
+
+
+    // Load commands -------------------------------------------------------
+
+    // The client should handle the navigation externally.
+    virtual void loadURLExternally(
+        WebFrame*, const WebURLRequest&, WebNavigationPolicy) { }
+
+
+    // Navigational queries ------------------------------------------------
+
+    // The client may choose to alter the navigation policy.  Otherwise,
+    // defaultPolicy should just be returned.
+    virtual WebNavigationPolicy decidePolicyForNavigation(
+        WebFrame*, const WebURLRequest&, WebNavigationType,
+        const WebNode& originatingNode,
+        WebNavigationPolicy defaultPolicy, bool isRedirect) { return defaultPolicy; }
+
+    // Query if the specified request can be handled.
+    virtual bool canHandleRequest(
+        WebFrame*, const WebURLRequest& request) { return true; }
+
+    // Returns an error corresponding to canHandledRequest() returning false.
+    virtual WebURLError cannotHandleRequestError(
+        WebFrame*, const WebURLRequest& request) { return WebURLError(); }
+
+    // Returns an error corresponding to a user cancellation event.
+    virtual WebURLError cancelledError(
+        WebFrame*, const WebURLRequest& request) { return WebURLError(); }
+
+    // Notify that a URL cannot be handled.
+    virtual void unableToImplementPolicyWithError(
+        WebFrame*, const WebURLError&) { }
+
+
+    // Navigational notifications ------------------------------------------
+
+    // A form submission is about to occur.
+    virtual void willSubmitForm(WebFrame*, const WebFormElement&) { }
+
+    // A client-side redirect will occur.  This may correspond to a <META
+    // refresh> or some script activity.
+    virtual void willPerformClientRedirect(
+        WebFrame*, const WebURL& from, const WebURL& to,
+        double interval, double fireTime) { }
+
+    // A client-side redirect was cancelled.
+    virtual void didCancelClientRedirect(WebFrame*) { }
+
+    // A client-side redirect completed.
+    virtual void didCompleteClientRedirect(WebFrame*, const WebURL& fromURL) { }
+
+    // A datasource has been created for a new navigation.  The given
+    // datasource will become the provisional datasource for the frame.
+    virtual void didCreateDataSource(WebFrame*, WebDataSource*) { }
+
+    // A new provisional load has been started.
+    virtual void didStartProvisionalLoad(WebFrame*) { }
+
+    // The provisional load was redirected via a HTTP 3xx response.
+    virtual void didReceiveServerRedirectForProvisionalLoad(WebFrame*) { }
+
+    // The provisional load failed.
+    virtual void didFailProvisionalLoad(WebFrame*, const WebURLError&) { }
+
+    // Notifies the client to commit data for the given frame.  The client
+    // may optionally prevent default processing by setting preventDefault
+    // to true before returning.  If default processing is prevented, then
+    // it is up to the client to manually call commitDocumentData on the
+    // WebFrame.  It is only valid to call commitDocumentData within a call
+    // to didReceiveDocumentData.  If commitDocumentData is not called,
+    // then an empty document will be loaded.
+    virtual void didReceiveDocumentData(
+        WebFrame*, const char* data, size_t length, bool& preventDefault) { }
+
+    // The provisional datasource is now committed.  The first part of the
+    // response body has been received, and the encoding of the response
+    // body is known.
+    virtual void didCommitProvisionalLoad(WebFrame*, bool isNewNavigation) { }
+
+    // The window object for the frame has been cleared of any extra
+    // properties that may have been set by script from the previously
+    // loaded document.
+    virtual void didClearWindowObject(WebFrame*) { }
+
+    // The document element has been created.
+    virtual void didCreateDocumentElement(WebFrame*) { }
+
+    // The page title is available.
+    virtual void didReceiveTitle(WebFrame*, const WebString& title) { }
+
+    // The frame's document finished loading.
+    virtual void didFinishDocumentLoad(WebFrame*) { }
+
+    // The 'load' event was dispatched.
+    virtual void didHandleOnloadEvents(WebFrame*) { }
+
+    // The frame's document or one of its subresources failed to load.
+    virtual void didFailLoad(WebFrame*, const WebURLError&) { }
+
+    // The frame's document and all of its subresources succeeded to load.
+    virtual void didFinishLoad(WebFrame*) { }
+
+    // The navigation resulted in scrolling the page to a named anchor instead
+    // of downloading a new document.
+    virtual void didChangeLocationWithinPage(WebFrame*, bool isNewNavigation) { }
+
+    // Called upon update to scroll position, document state, and other
+    // non-navigational events related to the data held by WebHistoryItem.
+    // WARNING: This method may be called very frequently.
+    virtual void didUpdateCurrentHistoryItem(WebFrame*) { }
+
+
+    // Low-level resource notifications ------------------------------------
+
+    // An identifier was assigned to the specified request.  The client
+    // should remember this association if interested in subsequent events.
+    virtual void assignIdentifierToRequest(
+        WebFrame*, unsigned identifier, const WebURLRequest&) { }
+
+    // A request is about to be sent out, and the client may modify it.  Request
+    // is writable, and changes to the URL, for example, will change the request
+    // made.  If this request is the result of a redirect, then redirectResponse
+    // will be non-null and contain the response that triggered the redirect.
+    virtual void willSendRequest(
+        WebFrame*, unsigned identifier, WebURLRequest&,
+        const WebURLResponse& redirectResponse) { }
+
+    // Response headers have been received for the resource request given
+    // by identifier.
+    virtual void didReceiveResponse(
+        WebFrame*, unsigned identifier, const WebURLResponse&) { }
+
+    // The resource request given by identifier succeeded.
+    virtual void didFinishResourceLoad(
+        WebFrame*, unsigned identifier) { }
+
+    // The resource request given by identifier failed.
+    virtual void didFailResourceLoad(
+        WebFrame*, unsigned identifier, const WebURLError&) { }
+
+    // The specified request was satified from WebCore's memory cache.
+    virtual void didLoadResourceFromMemoryCache(
+        WebFrame*, const WebURLRequest&, const WebURLResponse&) { }
+
+    // This frame has displayed inactive content (such as an image) from an
+    // insecure source.  Inactive content cannot spread to other frames.
+    virtual void didDisplayInsecureContent(WebFrame*) { }
+
+    // The indicated security origin has run active content (such as a
+    // script) from an insecure source.  Note that the insecure content can
+    // spread to other frames in the same origin.
+    virtual void didRunInsecureContent(WebFrame*, const WebSecurityOrigin&) { }
+
+
+    // Script notifications ------------------------------------------------
+
+    // Controls whether scripts are allowed to execute for this frame.
+    virtual bool allowScript(WebFrame*, bool enabledPerSettings) { return enabledPerSettings; }
+
+    // Script in the page tried to allocate too much memory.
+    virtual void didExhaustMemoryAvailableForScript(WebFrame*) { }
+
+    // Notifies that a new script context has been created for this frame.
+    // This is similar to didClearWindowObject but only called once per
+    // frame context.
+    virtual void didCreateScriptContext(WebFrame*) { }
+
+    // Notifies that this frame's script context has been destroyed.
+    virtual void didDestroyScriptContext(WebFrame*) { }
+
+    // Notifies that a garbage-collected context was created - content
+    // scripts.
+    virtual void didCreateIsolatedScriptContext(WebFrame*) { }
+
+
+    // Geometry notifications ----------------------------------------------
+
+    // The size of the content area changed.
+    virtual void didChangeContentsSize(WebFrame*, const WebSize&) { }
+
+    // The main frame scrolled.
+    virtual void didChangeScrollOffset(WebFrame*) { }
+
+
+    // Find-in-page notifications ------------------------------------------
+
+    // Notifies how many matches have been found so far, for a given
+    // identifier.  |finalUpdate| specifies whether this is the last update
+    // (all frames have completed scoping).
+    virtual void reportFindInPageMatchCount(
+        int identifier, int count, bool finalUpdate) { }
+
+    // Notifies what tick-mark rect is currently selected.   The given
+    // identifier lets the client know which request this message belongs
+    // to, so that it can choose to ignore the message if it has moved on
+    // to other things.  The selection rect is expected to have coordinates
+    // relative to the top left corner of the web page area and represent
+    // where on the screen the selection rect is currently located.
+    virtual void reportFindInPageSelection(
+        int identifier, int activeMatchOrdinal, const WebRect& selection) { }
+
+protected:
+    ~WebFrameClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebHTTPBody.h b/WebKit/chromium/public/WebHTTPBody.h
new file mode 100644
index 0000000..43f51a6
--- /dev/null
+++ b/WebKit/chromium/public/WebHTTPBody.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebHTTPBody_h
+#define WebHTTPBody_h
+
+#include "WebData.h"
+#include "WebNonCopyable.h"
+#include "WebString.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class FormData; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebHTTPBodyPrivate;
+
+class WebHTTPBody {
+public:
+    struct Element {
+        enum { TypeData, TypeFile } type;
+        WebData data;
+        WebString filePath;
+    };
+
+    ~WebHTTPBody() { reset(); }
+
+    WebHTTPBody() : m_private(0) { }
+    WebHTTPBody(const WebHTTPBody& b) : m_private(0) { assign(b); }
+    WebHTTPBody& operator=(const WebHTTPBody& b)
+    {
+        assign(b);
+        return *this;
+    }
+
+    WEBKIT_API void initialize();
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebHTTPBody&);
+
+    bool isNull() const { return !m_private; }
+
+    // Returns the number of elements comprising the http body.
+    WEBKIT_API size_t elementCount() const;
+
+    // Sets the values of the element at the given index.  Returns false if
+    // index is out of bounds.
+    WEBKIT_API bool elementAt(size_t index, Element&) const;
+
+    // Append to the list of elements.
+    WEBKIT_API void appendData(const WebData&);
+    WEBKIT_API void appendFile(const WebString&);
+
+    // Identifies a particular form submission instance.  A value of 0 is
+    // used to indicate an unspecified identifier.
+    WEBKIT_API long long identifier() const;
+    WEBKIT_API void setIdentifier(long long);
+
+#if WEBKIT_IMPLEMENTATION
+    WebHTTPBody(const WTF::PassRefPtr<WebCore::FormData>&);
+    WebHTTPBody& operator=(const WTF::PassRefPtr<WebCore::FormData>&);
+    operator WTF::PassRefPtr<WebCore::FormData>() const;
+#endif
+
+private:
+    void assign(WebHTTPBodyPrivate*);
+    void ensureMutable();
+    WebHTTPBodyPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebHTTPHeaderVisitor.h b/WebKit/chromium/public/WebHTTPHeaderVisitor.h
new file mode 100644
index 0000000..2ca86c0
--- /dev/null
+++ b/WebKit/chromium/public/WebHTTPHeaderVisitor.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebHTTPHeaderVisitor_h
+#define WebHTTPHeaderVisitor_h
+
+namespace WebKit {
+
+class WebString;
+
+class WebHTTPHeaderVisitor {
+public:
+    virtual void visitHeader(const WebString& name, const WebString& value) = 0;
+
+protected:
+    ~WebHTTPHeaderVisitor() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebHistoryItem.h b/WebKit/chromium/public/WebHistoryItem.h
new file mode 100644
index 0000000..f15a62c
--- /dev/null
+++ b/WebKit/chromium/public/WebHistoryItem.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebHistoryItem_h
+#define WebHistoryItem_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class HistoryItem; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebHistoryItemPrivate;
+class WebHTTPBody;
+class WebString;
+struct WebPoint;
+template <typename T> class WebVector;
+
+// Represents a frame-level navigation entry in session history.  A
+// WebHistoryItem is a node in a tree.
+//
+// Copying a WebHistoryItem is cheap.
+//
+class WebHistoryItem {
+public:
+    ~WebHistoryItem() { reset(); }
+
+    WebHistoryItem() : m_private(0) { }
+    WebHistoryItem(const WebHistoryItem& h) : m_private(0) { assign(h); }
+    WebHistoryItem& operator=(const WebHistoryItem& h)
+    {
+        assign(h);
+        return *this;
+    }
+
+    WEBKIT_API void initialize();
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebHistoryItem&);
+
+    bool isNull() const { return !m_private; }
+
+    WEBKIT_API WebString urlString() const;
+    WEBKIT_API void setURLString(const WebString&);
+
+    WEBKIT_API WebString originalURLString() const;
+    WEBKIT_API void setOriginalURLString(const WebString&);
+
+    WEBKIT_API WebString referrer() const;
+    WEBKIT_API void setReferrer(const WebString&);
+
+    WEBKIT_API WebString target() const;
+    WEBKIT_API void setTarget(const WebString&);
+
+    WEBKIT_API WebString parent() const;
+    WEBKIT_API void setParent(const WebString&);
+
+    WEBKIT_API WebString title() const;
+    WEBKIT_API void setTitle(const WebString&);
+
+    WEBKIT_API WebString alternateTitle() const;
+    WEBKIT_API void setAlternateTitle(const WebString&);
+
+    WEBKIT_API double lastVisitedTime() const;
+    WEBKIT_API void setLastVisitedTime(double);
+
+    WEBKIT_API WebPoint scrollOffset() const;
+    WEBKIT_API void setScrollOffset(const WebPoint&);
+
+    WEBKIT_API bool isTargetItem() const;
+    WEBKIT_API void setIsTargetItem(bool);
+
+    WEBKIT_API int visitCount() const;
+    WEBKIT_API void setVisitCount(int);
+
+    WEBKIT_API WebVector<WebString> documentState() const;
+    WEBKIT_API void setDocumentState(const WebVector<WebString>&);
+
+    WEBKIT_API WebString httpContentType() const;
+    WEBKIT_API void setHTTPContentType(const WebString&);
+
+    WEBKIT_API WebHTTPBody httpBody() const;
+    WEBKIT_API void setHTTPBody(const WebHTTPBody&);
+
+    WEBKIT_API WebVector<WebHistoryItem> children() const;
+    WEBKIT_API void setChildren(const WebVector<WebHistoryItem>&);
+    WEBKIT_API void appendToChildren(const WebHistoryItem&);
+
+#if WEBKIT_IMPLEMENTATION
+    WebHistoryItem(const WTF::PassRefPtr<WebCore::HistoryItem>&);
+    WebHistoryItem& operator=(const WTF::PassRefPtr<WebCore::HistoryItem>&);
+    operator WTF::PassRefPtr<WebCore::HistoryItem>() const;
+#endif
+
+private:
+    void assign(WebHistoryItemPrivate*);
+    void ensureMutable();
+    WebHistoryItemPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebImage.h b/WebKit/chromium/public/WebImage.h
new file mode 100644
index 0000000..a7b6f8c
--- /dev/null
+++ b/WebKit/chromium/public/WebImage.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebImage_h
+#define WebImage_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_USING_SKIA
+#include <SkBitmap.h>
+#elif WEBKIT_USING_CG
+typedef struct CGImage* CGImageRef;
+#endif
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class Image; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebData;
+struct WebSize;
+
+// A container for an ARGB bitmap.
+class WebImage {
+public:
+    ~WebImage() { reset(); }
+
+    WebImage() { init(); }
+    WebImage(const WebImage& image)
+    {
+        init();
+        assign(image);
+    }
+
+    WebImage& operator=(const WebImage& image)
+    {
+        assign(image);
+        return *this;
+    }
+
+    // Decodes the given image data.  If the image has multiple frames,
+    // then the frame whose size is desiredSize is returned.  Otherwise,
+    // the first frame is returned.
+    WEBKIT_API static WebImage fromData(const WebData&, const WebSize& desiredSize);
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebImage&);
+
+    WEBKIT_API bool isNull() const;
+    WEBKIT_API WebSize size() const;
+
+#if WEBKIT_IMPLEMENTATION
+    WebImage(const WTF::PassRefPtr<WebCore::Image>&);
+    WebImage& operator=(const WTF::PassRefPtr<WebCore::Image>&);
+#endif
+
+#if WEBKIT_USING_SKIA
+    WebImage(const SkBitmap& bitmap) : m_bitmap(bitmap) { }
+
+    WebImage& operator=(const SkBitmap& bitmap)
+    {
+        m_bitmap = bitmap;
+        return *this;
+    }
+
+    SkBitmap& getSkBitmap() { return m_bitmap; }
+    const SkBitmap& getSkBitmap() const { return m_bitmap; }
+
+private:
+    void init() { }
+    SkBitmap m_bitmap;
+
+#elif WEBKIT_USING_CG
+    WebImage(CGImageRef imageRef)
+    {
+        init();
+        assign(imageRef);
+    }
+
+    WebImage& operator=(CGImageRef imageRef)
+    {
+        assign(imageRef);
+        return *this;
+    }
+
+    CGImageRef getCGImageRef() const { return m_imageRef; }
+
+private:
+    void init() { m_imageRef = 0; }
+    void assign(CGImageRef);
+    CGImageRef m_imageRef;
+#endif
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebInputElement.h b/WebKit/chromium/public/WebInputElement.h
new file mode 100644
index 0000000..75e44b9
--- /dev/null
+++ b/WebKit/chromium/public/WebInputElement.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebInputElement_h
+#define WebInputElement_h
+
+#include "WebElement.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class HTMLInputElement; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+    // Provides readonly access to some properties of a DOM input element node.
+    class WebInputElement : public WebElement {
+    public:
+        WebInputElement() : WebElement() { }
+        WebInputElement(const WebInputElement& n) : WebElement(n) { }
+
+        WebInputElement& operator=(const WebInputElement& n) { WebElement::assign(n); return *this; }
+        WEBKIT_API void assign(const WebInputElement& n) { WebElement::assign(n); }
+
+#if WEBKIT_IMPLEMENTATION
+        WebInputElement(const WTF::PassRefPtr<WebCore::HTMLInputElement>&);
+        WebInputElement& operator=(const WTF::PassRefPtr<WebCore::HTMLInputElement>&);
+        operator WTF::PassRefPtr<WebCore::HTMLInputElement>() const;
+#endif
+
+        enum InputType {
+            Text = 0,
+            Password,
+            IsIndex,
+            CheckBox,
+            Radio,
+            Submit,
+            Reset,
+            File,
+            Hidden,
+            Image,
+            Button,
+            Search,
+            Range,
+            Email,
+            Number,
+            Telephone,
+            URL,
+            Color,
+            Date,
+            DateTime,
+            DateTimeLocal,
+            Month,
+            Time,
+            Week
+        };
+        
+        WEBKIT_API bool isEnabledFormControl() const;
+        WEBKIT_API InputType inputType() const;
+        WEBKIT_API WebString formControlType() const;
+        WEBKIT_API void setActivatedSubmit(bool);
+        WEBKIT_API void setValue(const WebString& value);
+        WEBKIT_API WebString value() const;
+        WEBKIT_API void setAutofilled(bool);
+        WEBKIT_API void dispatchFormControlChangeEvent();
+        WEBKIT_API void setSelectionRange(int, int);
+        WEBKIT_API WebString name() const;
+        // Returns the name that should be used for the specified |element| when
+        // storing autofill data.  This is either the field name or its id, an empty
+        // string if it has no name and no id.
+        WEBKIT_API WebString nameForAutofill() const;
+        
+    };
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebInputEvent.h b/WebKit/chromium/public/WebInputEvent.h
new file mode 100644
index 0000000..983aa2a
--- /dev/null
+++ b/WebKit/chromium/public/WebInputEvent.h
@@ -0,0 +1,260 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebInputEvent_h
+#define WebInputEvent_h
+
+#include "WebCommon.h"
+
+#include <string.h>
+
+namespace WebKit {
+
+// The classes defined in this file are intended to be used with
+// WebWidget's handleInputEvent method.  These event types are cross-
+// platform and correspond closely to WebCore's Platform*Event classes.
+//
+// WARNING! These classes must remain PODs (plain old data).  They are
+// intended to be "serializable" by copying their raw bytes, so they must
+// not contain any non-bit-copyable member variables!
+
+// WebInputEvent --------------------------------------------------------------
+
+class WebInputEvent {
+public:
+    WebInputEvent(unsigned sizeParam = sizeof(WebInputEvent))
+        : size(sizeParam)
+        , type(Undefined)
+        , modifiers(0)
+        , timeStampSeconds(0.0) { }
+
+    // When we use an input method (or an input method editor), we receive
+    // two events for a keypress. The former event is a keydown, which
+    // provides a keycode, and the latter is a textinput, which provides
+    // a character processed by an input method. (The mapping from a
+    // keycode to a character code is not trivial for non-English
+    // keyboards.)
+    // To support input methods, Safari sends keydown events to WebKit for
+    // filtering. WebKit sends filtered keydown events back to Safari,
+    // which sends them to input methods.
+    // Unfortunately, it is hard to apply this design to Chrome because of
+    // our multiprocess architecture. An input method is running in a
+    // browser process. On the other hand, WebKit is running in a renderer
+    // process. So, this design results in increasing IPC messages.
+    // To support input methods without increasing IPC messages, Chrome
+    // handles keyboard events in a browser process and send asynchronous
+    // input events (to be translated to DOM events) to a renderer
+    // process.
+    // This design is mostly the same as the one of Windows and Mac Carbon.
+    // So, for what it's worth, our Linux and Mac front-ends emulate our
+    // Windows front-end. To emulate our Windows front-end, we can share
+    // our back-end code among Windows, Linux, and Mac.
+    // TODO(hbono): Issue 18064: remove the KeyDown type since it isn't
+    // used in Chrome any longer.
+
+    enum Type {
+        Undefined = -1,
+
+        // WebMouseEvent
+        MouseDown,
+        MouseUp,
+        MouseMove,
+        MouseEnter,
+        MouseLeave,
+
+        // WebMouseWheelEvent
+        MouseWheel,
+
+        // WebKeyboardEvent
+        RawKeyDown,
+        KeyDown,
+        KeyUp,
+        Char
+    };
+
+    enum Modifiers {
+        // modifiers for all events:
+        ShiftKey         = 1 << 0,
+        ControlKey       = 1 << 1,
+        AltKey           = 1 << 2,
+        MetaKey          = 1 << 3,
+
+        // modifiers for keyboard events:
+        IsKeyPad         = 1 << 4,
+        IsAutoRepeat     = 1 << 5,
+
+        // modifiers for mouse events:
+        LeftButtonDown   = 1 << 6,
+        MiddleButtonDown = 1 << 7,
+        RightButtonDown  = 1 << 8,
+    };
+
+    unsigned size;   // The size of this structure, for serialization.
+    Type type;
+    int modifiers;
+    double timeStampSeconds;   // Seconds since epoch.
+
+    // Returns true if the WebInputEvent |type| is a keyboard event.
+    static bool isKeyboardEventType(int type)
+    {
+        return type == RawKeyDown
+            || type == KeyDown
+            || type == KeyUp
+            || type == Char;
+    }
+};
+
+// WebKeyboardEvent -----------------------------------------------------------
+
+class WebKeyboardEvent : public WebInputEvent {
+public:
+    // Caps on string lengths so we can make them static arrays and keep
+    // them PODs.
+    static const size_t textLengthCap = 4;
+
+    // http://www.w3.org/TR/DOM-Level-3-Events/keyset.html lists the
+    // identifiers.  The longest is 18 characters, so we round up to the
+    // next multiple of 4.
+    static const size_t keyIdentifierLengthCap = 20;
+
+    // |windowsKeyCode| is the Windows key code associated with this key
+    // event.  Sometimes it's direct from the event (i.e. on Windows),
+    // sometimes it's via a mapping function.  If you want a list, see
+    // WebCore/platform/chromium/KeyboardCodes* .
+    int windowsKeyCode;
+
+    // The actual key code genenerated by the platform.  The DOM spec runs
+    // on Windows-equivalent codes (thus |windowsKeyCode| above) but it
+    // doesn't hurt to have this one around.
+    int nativeKeyCode;
+
+    // |text| is the text generated by this keystroke.  |unmodifiedText| is
+    // |text|, but unmodified by an concurrently-held modifiers (except
+    // shift).  This is useful for working out shortcut keys.  Linux and
+    // Windows guarantee one character per event.  The Mac does not, but in
+    // reality that's all it ever gives.  We're generous, and cap it a bit
+    // longer.
+    WebUChar text[textLengthCap];
+    WebUChar unmodifiedText[textLengthCap];
+
+    // This is a string identifying the key pressed.
+    char keyIdentifier[keyIdentifierLengthCap];
+
+    // This identifies whether this event was tagged by the system as being
+    // a "system key" event (see
+    // http://msdn.microsoft.com/en-us/library/ms646286(VS.85).aspx for
+    // details).  Other platforms don't have this concept, but it's just
+    // easier to leave it always false than ifdef.
+    // int is used instead of bool to ensure the size of this structure is
+    // strictly aligned to a factor of 4 bytes, otherwise memory check tools
+    // like valgrind may complain about uninitialized memory usage when
+    // transfering it over the wire.
+    int isSystemKey;
+
+    WebKeyboardEvent(unsigned sizeParam = sizeof(WebKeyboardEvent))
+        : WebInputEvent(sizeParam)
+        , windowsKeyCode(0)
+        , nativeKeyCode(0)
+        , isSystemKey(false)
+    {
+        memset(&text, 0, sizeof(text));
+        memset(&unmodifiedText, 0, sizeof(unmodifiedText));
+        memset(&keyIdentifier, 0, sizeof(keyIdentifier));
+    }
+
+    // Sets keyIdentifier based on the value of windowsKeyCode.  This is
+    // handy for generating synthetic keyboard events.
+    WEBKIT_API void setKeyIdentifierFromWindowsKeyCode();
+};
+
+// WebMouseEvent --------------------------------------------------------------
+
+class WebMouseEvent : public WebInputEvent {
+public:
+    // These values defined for WebCore::MouseButton
+    enum Button {
+        ButtonNone = -1,
+        ButtonLeft,
+        ButtonMiddle,
+        ButtonRight
+    };
+
+    Button button;
+    int x;
+    int y;
+    int windowX;
+    int windowY;
+    int globalX;
+    int globalY;
+    int clickCount;
+
+    WebMouseEvent(unsigned sizeParam = sizeof(WebMouseEvent))
+        : WebInputEvent(sizeParam)
+        , button(ButtonNone)
+        , x(0)
+        , y(0)
+        , windowX(0)
+        , windowY(0)
+        , globalX(0)
+        , globalY(0)
+        , clickCount(0)
+    {
+    }
+};
+
+// WebMouseWheelEvent ---------------------------------------------------------
+
+class WebMouseWheelEvent : public WebMouseEvent {
+public:
+    float deltaX;
+    float deltaY;
+    float wheelTicksX;
+    float wheelTicksY;
+
+    // int is used instead of bool to ensure the size of this structure is
+    // strictly aligned to a factor of 4 bytes, otherwise memory check tools
+    // like valgrind may complain about uninitialized memory usage when
+    // transfering it over the wire.
+    int scrollByPage;
+
+    WebMouseWheelEvent(unsigned sizeParam = sizeof(WebMouseWheelEvent))
+        : WebMouseEvent(sizeParam)
+        , deltaX(0.0f)
+        , deltaY(0.0f)
+        , wheelTicksX(0.0f)
+        , wheelTicksY(0.0f)
+        , scrollByPage(false)
+    {
+    }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebKit.h b/WebKit/chromium/public/WebKit.h
new file mode 100644
index 0000000..b9e6407
--- /dev/null
+++ b/WebKit/chromium/public/WebKit.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebKit_h
+#define WebKit_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebKitClient;
+
+// Must be called on the thread that will be the main WebKit thread before
+// using any other WebKit APIs.  The provided WebKitClient must be non-null
+// and must remain valid until the current thread calls shutdown.
+WEBKIT_API void initialize(WebKitClient*);
+
+// Once shutdown, the WebKitClient passed to initialize will no longer be
+// accessed.  No other WebKit objects should be in use when this function
+// is called.  Any background threads created by WebKit are promised to be
+// terminated by the time this function returns.
+WEBKIT_API void shutdown();
+
+// Returns the WebKitClient instance passed to initialize.
+WEBKIT_API WebKitClient* webKitClient();
+
+// Alters the rendering of content to conform to a fixed set of rules.
+WEBKIT_API void setLayoutTestMode(bool);
+WEBKIT_API bool layoutTestMode();
+
+// Purge the plugin list cache. If |reloadPages| is true, any pages
+// containing plugins will be reloaded after refreshing the plugin list.
+WEBKIT_API void resetPluginCache(bool reloadPages);
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebKitClient.h b/WebKit/chromium/public/WebKitClient.h
new file mode 100644
index 0000000..2a00a9a
--- /dev/null
+++ b/WebKit/chromium/public/WebKitClient.h
@@ -0,0 +1,277 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebKitClient_h
+#define WebKitClient_h
+
+#include "WebCommon.h"
+#include "WebData.h"
+#include "WebLocalizedString.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebVector.h"
+
+#include <time.h>
+
+#ifdef WIN32
+typedef void *HANDLE;
+#endif
+
+namespace WebKit {
+
+class WebApplicationCacheHost;
+class WebApplicationCacheHostClient;
+class WebClipboard;
+class WebMessagePortChannel;
+class WebMimeRegistry;
+class WebPluginListBuilder;
+class WebSandboxSupport;
+class WebSharedWorkerRepository;
+class WebSocketStreamHandle;
+class WebStorageNamespace;
+class WebThemeEngine;
+class WebURLLoader;
+struct WebCookie;
+struct WebPluginInfo;
+template <typename T> class WebVector;
+
+class WebKitClient {
+public:
+    // Must return non-null.
+    virtual WebClipboard* clipboard() { return 0; }
+
+    // Must return non-null.
+    virtual WebMimeRegistry* mimeRegistry() { return 0; }
+
+    // May return null if sandbox support is not necessary
+    virtual WebSandboxSupport* sandboxSupport() { return 0; }
+
+    // May return null on some platforms.
+    virtual WebThemeEngine* themeEngine() { return 0; }
+
+
+    // Application Cache --------------------------------------------
+
+    // May return null if the process type doesn't involve appcaching.
+    virtual WebApplicationCacheHost* createApplicationCacheHost(WebApplicationCacheHostClient*) { return 0; }
+
+
+    // DOM Storage --------------------------------------------------
+
+    // Return a LocalStorage namespace that corresponds to the following path.
+    virtual WebStorageNamespace* createLocalStorageNamespace(const WebString& path, unsigned quota) { return 0; }
+
+    // Return a new SessionStorage namespace.
+    virtual WebStorageNamespace* createSessionStorageNamespace() { return 0; }
+
+    // Called when storage events fire.
+    virtual void dispatchStorageEvent(const WebString& key, const WebString& oldValue,
+                                      const WebString& newValue, const WebString& origin,
+                                      const WebURL& url, bool isLocalStorage) { }
+
+
+    // File ----------------------------------------------------------------
+
+    // Various file/directory related functions.  These map 1:1 with
+    // functions in WebCore's FileSystem.h.
+    virtual bool fileExists(const WebString& path) { return false; }
+    virtual bool deleteFile(const WebString& path) { return false; }
+    virtual bool deleteEmptyDirectory(const WebString& path) { return false; }
+    virtual bool getFileSize(const WebString& path, long long& result) { return false; }
+    virtual bool getFileModificationTime(const WebString& path, time_t& result) { return false; }
+    virtual WebString directoryName(const WebString& path) { return WebString(); }
+    virtual WebString pathByAppendingComponent(const WebString& path, const WebString& component) { return WebString(); }
+    virtual bool makeAllDirectories(const WebString& path) { return false; }
+    virtual WebString getAbsolutePath(const WebString& path) { return WebString(); }
+    virtual bool isDirectory(const WebString& path) { return false; }
+    virtual WebURL filePathToURL(const WebString& path) { return WebURL(); }
+
+
+    // History -------------------------------------------------------------
+
+    // Returns the hash for the given canonicalized URL for use in visited
+    // link coloring.
+    virtual unsigned long long visitedLinkHash(
+        const char* canonicalURL, size_t length) { return 0; }
+
+    // Returns whether the given link hash is in the user's history.  The
+    // hash must have been generated by calling VisitedLinkHash().
+    virtual bool isLinkVisited(unsigned long long linkHash) { return false; }
+
+
+    // Database ------------------------------------------------------------
+
+#ifdef WIN32
+    typedef HANDLE FileHandle;
+#else
+    typedef int FileHandle;
+#endif
+
+    // Opens a database file; dirHandle should be 0 if the caller does not need
+    // a handle to the directory containing this file
+    virtual FileHandle databaseOpenFile(
+        const WebString& vfsFileName, int desiredFlags, FileHandle* dirHandle) { return FileHandle(); }
+
+    // Deletes a database file and returns the error code
+    virtual int databaseDeleteFile(const WebString& vfsFileName, bool syncDir) { return 0; }
+
+    // Returns the attributes of the given database file
+    virtual long databaseGetFileAttributes(const WebString& vfsFileName) { return 0; }
+
+    // Returns the size of the given database file
+    virtual long long databaseGetFileSize(const WebString& vfsFileName) { return 0; }
+
+
+    // Keygen --------------------------------------------------------------
+
+    // Handle the <keygen> tag for generating client certificates
+    // Returns a base64 encoded signed copy of a public key from a newly
+    // generated key pair and the supplied challenge string. keySizeindex
+    // specifies the strength of the key.
+    virtual WebString signedPublicKeyAndChallengeString(unsigned keySizeIndex,
+                                                        const WebKit::WebString& challenge,
+                                                        const WebKit::WebURL& url) { return WebString(); }
+
+
+
+    // Memory --------------------------------------------------------------
+
+    // Returns the current space allocated for the pagefile, in MB.
+    // That is committed size for Windows and virtual memory size for POSIX
+    virtual size_t memoryUsageMB() { return 0; }
+
+
+    // Message Ports -------------------------------------------------------
+
+    // Creates a Message Port Channel.  This can be called on any thread.
+    // The returned object should only be used on the thread it was created on.
+    virtual WebMessagePortChannel* createMessagePortChannel() { return 0; }
+
+
+    // Network -------------------------------------------------------------
+
+    virtual void setCookies(
+        const WebURL& url, const WebURL& policyURL, const WebString& cookies) { }
+    virtual WebString cookies(const WebURL& url, const WebURL& policyURL) { return WebString(); }
+    virtual bool rawCookies(const WebURL& url, const WebURL& policyURL, WebVector<WebCookie>*) { return false; }
+    virtual void deleteCookie(const WebURL& url, const WebString& cookieName) { }
+
+    // A suggestion to prefetch IP information for the given hostname.
+    virtual void prefetchHostName(const WebString&) { }
+
+    // Returns a new WebURLLoader instance.
+    virtual WebURLLoader* createURLLoader() { return 0; }
+
+    // Returns a new WebSocketStreamHandle instance.
+    virtual WebSocketStreamHandle* createSocketStreamHandle() { return 0; }
+
+    // Returns the User-Agent string that should be used for the given URL.
+    virtual WebString userAgent(const WebURL&) { return WebString(); }
+
+
+    // Plugins -------------------------------------------------------------
+
+    // If refresh is true, then cached information should not be used to
+    // satisfy this call.
+    virtual void getPluginList(bool refresh, WebPluginListBuilder*) { };
+
+
+    // Profiling -----------------------------------------------------------
+
+    virtual void decrementStatsCounter(const char* name) { };
+    virtual void incrementStatsCounter(const char* name) { };
+
+    // An event is identified by the pair (name, id).  The extra parameter
+    // specifies additional data to log with the event.
+    virtual void traceEventBegin(const char* name, void* id, const char* extra) { };
+    virtual void traceEventEnd(const char* name, void* id, const char* extra) { };
+
+    // Generic callback for reporting histogram data. Range is identified by the min, max pair.
+    // By default, histogram is exponential, so that min=1, max=1000000, bucketCount=50 would do. Setting
+    // linear to true would require bucket count to cover whole min-max range.
+    virtual void histogramCounts(const WebString& name, int sample, int min, int max, int bucketCount, bool linear) { };
+
+
+    // Resources -----------------------------------------------------------
+
+    // Returns a blob of data corresponding to the named resource.
+    virtual WebData loadResource(const char* name) { return WebData(); }
+
+    // Returns a localized string resource (with an optional numeric
+    // parameter value).
+    virtual WebString queryLocalizedString(WebLocalizedString::Name) { return WebString(); }
+    virtual WebString queryLocalizedString(WebLocalizedString::Name, int numericValue) { return WebString(); }
+
+
+    // Sandbox ------------------------------------------------------------
+
+    // In some browsers, a "sandbox" restricts what operations a program
+    // is allowed to preform.  Such operations are typically abstracted out
+    // via this API, but sometimes (like in HTML 5 database opening) WebKit
+    // needs to behave differently based on whether it's restricted or not.
+    // In these cases (and these cases only) you can call this function.
+    // It's OK for this value to be conservitive (i.e. true even if the
+    // sandbox isn't active).
+    virtual bool sandboxEnabled() { return false; }
+
+
+    // Shared Workers ------------------------------------------------------
+
+    virtual WebSharedWorkerRepository* sharedWorkerRepository() { return 0; }
+
+    // Sudden Termination --------------------------------------------------
+
+    // Disable/Enable sudden termination.
+    virtual void suddenTerminationChanged(bool enabled) { }
+
+
+    // System --------------------------------------------------------------
+
+    // Returns a value such as "en-US".
+    virtual WebString defaultLocale() { return WebString(); }
+
+    // Wall clock time in seconds since the epoch.
+    virtual double currentTime() { return 0; }
+
+    // Delayed work is driven by a shared timer.
+    virtual void setSharedTimerFiredFunction(void (*func)()) { }
+    virtual void setSharedTimerFireTime(double fireTime) { }
+    virtual void stopSharedTimer() { }
+
+    // Callable from a background WebKit thread.
+    virtual void callOnMainThread(void (*func)()) { }
+
+protected:
+    ~WebKitClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebLocalizedString.h b/WebKit/chromium/public/WebLocalizedString.h
new file mode 100644
index 0000000..99a7d23
--- /dev/null
+++ b/WebKit/chromium/public/WebLocalizedString.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebLocalizedString_h
+#define WebLocalizedString_h
+
+namespace WebKit {
+
+struct WebLocalizedString {
+    enum Name {
+        SubmitButtonDefaultLabel,
+        InputElementAltText,
+        ResetButtonDefaultLabel,
+        FileButtonChooseFileLabel,
+        FileButtonNoFileSelectedLabel,
+        MultipleFileUploadText,
+        SearchableIndexIntroduction,
+        SearchMenuNoRecentSearchesText,
+        SearchMenuRecentSearchesText,
+        SearchMenuClearRecentSearchesText,
+        AXWebAreaText,
+        AXLinkText,
+        AXListMarkerText,
+        AXImageMapText,
+        AXHeadingText,
+        AXButtonActionVerb,
+        AXRadioButtonActionVerb,
+        AXTextFieldActionVerb,
+        AXCheckedCheckBoxActionVerb,
+        AXUncheckedCheckBoxActionVerb,
+        AXLinkActionVerb,
+        KeygenMenuHighGradeKeySize,
+        KeygenMenuMediumGradeKeySize,
+    };
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebMediaPlayer.h b/WebKit/chromium/public/WebMediaPlayer.h
new file mode 100644
index 0000000..0b658f9
--- /dev/null
+++ b/WebKit/chromium/public/WebMediaPlayer.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMediaPlayer_h
+#define WebMediaPlayer_h
+
+#include "WebCanvas.h"
+#include "WebVector.h"
+
+namespace WebKit {
+
+class WebMediaPlayerClient;
+class WebURL;
+struct WebRect;
+struct WebSize;
+
+struct WebTimeRange {
+    WebTimeRange() : start(0), end(0) {}
+    WebTimeRange(float s, float e) : start(s), end(e) {}
+
+    float start;
+    float end;
+};
+
+typedef WebVector<WebTimeRange> WebTimeRanges;
+
+class WebMediaPlayer {
+public:
+    enum NetworkState {
+        Empty,
+        Idle,
+        Loading,
+        Loaded,
+        FormatError,
+        NetworkError,
+        DecodeError,
+    };
+
+    enum ReadyState {
+        HaveNothing,
+        HaveMetadata,
+        HaveCurrentData,
+        HaveFutureData,
+        HaveEnoughData,
+    };
+
+    enum MovieLoadType {
+        Unknown,
+        Download,
+        StoredStream,
+        LiveStream,
+    };
+
+    virtual ~WebMediaPlayer() {}
+
+    virtual void load(const WebURL&) = 0;
+    virtual void cancelLoad() = 0;
+
+    // Playback controls.
+    virtual void play() = 0;
+    virtual void pause() = 0;
+    virtual bool supportsFullscreen() const = 0;
+    virtual bool supportsSave() const = 0;
+    virtual void seek(float seconds) = 0;
+    virtual void setEndTime(float seconds) = 0;
+    virtual void setRate(float) = 0;
+    virtual void setVolume(float) = 0;
+    virtual void setVisible(bool) = 0;
+    virtual bool setAutoBuffer(bool) = 0;
+    virtual bool totalBytesKnown() = 0;
+    virtual const WebTimeRanges& buffered() const = 0;
+    virtual float maxTimeSeekable() const = 0;
+
+    virtual void setSize(const WebSize&) = 0;
+
+    virtual void paint(WebCanvas*, const WebRect&) = 0;
+
+    // True if the loaded media has a playable video/audio track.
+    virtual bool hasVideo() const = 0;
+    virtual bool hasAudio() const = 0;
+
+    // Dimension of the video.
+    virtual WebSize naturalSize() const = 0;
+
+    // Getters of playback state.
+    virtual bool paused() const = 0;
+    virtual bool seeking() const = 0;
+    virtual float duration() const = 0;
+    virtual float currentTime() const = 0;
+
+    // Get rate of loading the resource.
+    virtual int dataRate() const = 0;
+
+    // Internal states of loading and network.
+    virtual NetworkState networkState() const = 0;
+    virtual ReadyState readyState() const = 0;
+
+    virtual unsigned long long bytesLoaded() const = 0;
+    virtual unsigned long long totalBytes() const = 0;
+
+    virtual bool hasSingleSecurityOrigin() const = 0;
+    virtual MovieLoadType movieLoadType() const = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebMediaPlayerAction.h b/WebKit/chromium/public/WebMediaPlayerAction.h
new file mode 100644
index 0000000..3aede25
--- /dev/null
+++ b/WebKit/chromium/public/WebMediaPlayerAction.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMediaPlayerAction_h
+#define WebMediaPlayerAction_h
+
+namespace WebKit {
+
+struct WebMediaPlayerAction {
+    enum Type {
+        Unknown,
+        Play,
+        Mute,
+        Loop
+    };
+
+    Type type;
+    bool enable;
+
+    WebMediaPlayerAction()
+        : type(Unknown), enable(false) { }
+    WebMediaPlayerAction(Type type, bool enable)
+        : type(type), enable(enable) { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebMediaPlayerClient.h b/WebKit/chromium/public/WebMediaPlayerClient.h
new file mode 100644
index 0000000..558fb4a
--- /dev/null
+++ b/WebKit/chromium/public/WebMediaPlayerClient.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMediaPlayerClient_h
+#define WebMediaPlayerClient_h
+
+namespace WebKit {
+
+class WebRequest;
+class WebURL;
+
+class WebMediaPlayerClient {
+public:
+    virtual void networkStateChanged() = 0;
+    virtual void readyStateChanged() = 0;
+    virtual void volumeChanged() = 0;
+    virtual void timeChanged() = 0;
+    virtual void repaint() = 0;
+    virtual void durationChanged() = 0;
+    virtual void rateChanged() = 0;
+    virtual void sizeChanged() = 0;
+    virtual void sawUnsupportedTracks() = 0;
+
+protected:
+    ~WebMediaPlayerClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebMenuItemInfo.h b/WebKit/chromium/public/WebMenuItemInfo.h
new file mode 100644
index 0000000..d513e66
--- /dev/null
+++ b/WebKit/chromium/public/WebMenuItemInfo.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMenuItemInfo_h
+#define WebMenuItemInfo_h
+
+#include "WebCommon.h"
+#include "WebString.h"
+#include "WebVector.h"
+
+namespace WebKit {
+
+struct WebMenuItemInfo {
+    enum Type {
+        Option,
+        CheckableOption,
+        Group,
+        Separator,
+    };
+    WebString label;
+    Type type;
+    unsigned action;
+    bool enabled;
+    bool checked;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebMessagePortChannel.h b/WebKit/chromium/public/WebMessagePortChannel.h
new file mode 100644
index 0000000..288bd55
--- /dev/null
+++ b/WebKit/chromium/public/WebMessagePortChannel.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMessagePortChannel_h
+#define WebMessagePortChannel_h
+
+#include "WebCommon.h"
+#include "WebVector.h"
+
+namespace WebKit {
+
+class WebMessagePortChannelClient;
+class WebString;
+
+typedef WebVector<class WebMessagePortChannel*> WebMessagePortChannelArray;
+
+// Provides an interface to a Message Port Channel implementation.  The object owns itself and
+// is signalled that its not needed anymore with the destroy() call.
+class WebMessagePortChannel {
+public:
+    virtual void setClient(WebMessagePortChannelClient*) = 0;
+    virtual void destroy() = 0;
+    // WebKit versions of WebCore::MessagePortChannel.
+    virtual void entangle(WebMessagePortChannel*) = 0;
+    // Callee receives ownership of the passed vector.
+    virtual void postMessage(const WebString&, WebMessagePortChannelArray*) = 0;
+    virtual bool tryGetMessage(WebString*, WebMessagePortChannelArray&) = 0;
+
+protected:
+    ~WebMessagePortChannel() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebMessagePortChannelClient.h b/WebKit/chromium/public/WebMessagePortChannelClient.h
new file mode 100644
index 0000000..0b85bb3
--- /dev/null
+++ b/WebKit/chromium/public/WebMessagePortChannelClient.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMessagePortChannelClient_h
+#define WebMessagePortChannelClient_h
+
+namespace WebKit {
+
+// Provides an interface for users of WebMessagePortChannel to be notified
+// when messages are available.
+class WebMessagePortChannelClient {
+public:
+    // Alerts that new messages have arrived, which are retrieved by calling
+    // WebMessagePortChannel::tryGetMessage.  Note that this may be called
+    // on any thread.
+    virtual void messageAvailable() = 0;
+
+protected:
+    ~WebMessagePortChannelClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebMimeRegistry.h b/WebKit/chromium/public/WebMimeRegistry.h
new file mode 100644
index 0000000..425753e
--- /dev/null
+++ b/WebKit/chromium/public/WebMimeRegistry.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMimeRegistry_h
+#define WebMimeRegistry_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebString;
+
+class WebMimeRegistry {
+public:
+    enum SupportsType { IsNotSupported, IsSupported, MayBeSupported };
+
+    virtual SupportsType supportsMIMEType(const WebString& mimeType) = 0;
+    virtual SupportsType supportsImageMIMEType(const WebString& mimeType) = 0;
+    virtual SupportsType supportsJavaScriptMIMEType(const WebString& mimeType) = 0;
+    virtual SupportsType supportsMediaMIMEType(const WebString& mimeType,
+                                               const WebString& codecs) = 0;
+    virtual SupportsType supportsNonImageMIMEType(const WebString& mimeType) = 0;
+
+    virtual WebString mimeTypeForExtension(const WebString& fileExtension) = 0;
+    virtual WebString mimeTypeFromFile(const WebString& filePath) = 0;
+    virtual WebString preferredExtensionForMIMEType(const WebString& mimeType) = 0;
+
+protected:
+    ~WebMimeRegistry() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebNavigationPolicy.h b/WebKit/chromium/public/WebNavigationPolicy.h
new file mode 100644
index 0000000..54bee9d
--- /dev/null
+++ b/WebKit/chromium/public/WebNavigationPolicy.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNavigationPolicy_h
+#define WebNavigationPolicy_h
+
+namespace WebKit {
+
+enum WebNavigationPolicy {
+    WebNavigationPolicyIgnore,
+    WebNavigationPolicyDownload,
+    WebNavigationPolicyCurrentTab,
+    WebNavigationPolicyNewBackgroundTab,
+    WebNavigationPolicyNewForegroundTab,
+    WebNavigationPolicyNewWindow,
+    WebNavigationPolicyNewPopup,
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebNavigationType.h b/WebKit/chromium/public/WebNavigationType.h
new file mode 100644
index 0000000..8ca8dc6
--- /dev/null
+++ b/WebKit/chromium/public/WebNavigationType.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNavigationType_h
+#define WebNavigationType_h
+
+namespace WebKit {
+
+enum WebNavigationType {
+    WebNavigationTypeLinkClicked,
+    WebNavigationTypeFormSubmitted,
+    WebNavigationTypeBackForward,
+    WebNavigationTypeReload,
+    WebNavigationTypeFormResubmitted,
+    WebNavigationTypeOther
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebNode.h b/WebKit/chromium/public/WebNode.h
new file mode 100644
index 0000000..03afa90
--- /dev/null
+++ b/WebKit/chromium/public/WebNode.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNode_h
+#define WebNode_h
+
+#include "WebCommon.h"
+#include "WebString.h"
+
+namespace WebCore { class Node; }
+#if WEBKIT_IMPLEMENTATION
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+class WebFrame;
+
+// Provides readonly access to some properties of a DOM node.
+class WebNode {
+public:
+    virtual ~WebNode() { reset(); }
+
+    WebNode() : m_private(0) { }
+    WebNode(const WebNode& n) : m_private(0) { assign(n); }
+    WebNode& operator=(const WebNode& n)
+    {
+        assign(n);
+        return *this;
+    }
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebNode&);
+
+    bool isNull() const { return !m_private; }
+
+#if WEBKIT_IMPLEMENTATION
+    WebNode(const WTF::PassRefPtr<WebCore::Node>&);
+    WebNode& operator=(const WTF::PassRefPtr<WebCore::Node>&);
+    operator WTF::PassRefPtr<WebCore::Node>() const;
+#endif
+
+    WEBKIT_API WebNode parentNode() const;
+    WEBKIT_API WebString nodeName() const;
+    WEBKIT_API WebFrame* frame() const;
+
+    template<typename T> T toElement()
+    {
+        T res;
+        res.m_private = m_private;
+        return res;
+    }
+
+protected:
+    typedef WebCore::Node WebNodePrivate;
+    void assign(WebNodePrivate*);
+    WebNodePrivate* m_private;
+    
+    template<typename T> T* unwrap()
+    {
+        return static_cast<T*>(m_private);
+    }
+
+    template<typename T> const T* constUnwrap() const
+    {
+        return static_cast<const T*>(m_private);
+    }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebNonCopyable.h b/WebKit/chromium/public/WebNonCopyable.h
new file mode 100644
index 0000000..b0bd456
--- /dev/null
+++ b/WebKit/chromium/public/WebNonCopyable.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNonCopyable_h
+#define WebNonCopyable_h
+
+namespace WebKit {
+
+// A base class to extend from if you do not support copying.
+class WebNonCopyable {
+protected:
+    WebNonCopyable() { }
+    ~WebNonCopyable() { }
+
+private:
+    WebNonCopyable(const WebNonCopyable&);
+    WebNonCopyable& operator=(const WebNonCopyable&);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebNotification.h b/WebKit/chromium/public/WebNotification.h
new file mode 100644
index 0000000..1a41252
--- /dev/null
+++ b/WebKit/chromium/public/WebNotification.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNotification_h
+#define WebNotification_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class Notification; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebNotificationPrivate;
+class WebURL;
+class WebString;
+
+// Represents access to a desktop notification.
+class WebNotification {
+public:
+    WebNotification() : m_private(0) { }
+    WebNotification(const WebNotification& other) : m_private(0) { assign(other); }
+
+    ~WebNotification() { reset(); }
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebNotification&);
+
+    WebNotification& operator=(const WebNotification& other)
+    {
+        assign(other);
+        return *this;
+    }
+
+    // Operators required to put WebNotification in an ordered map.
+    bool equals(const WebNotification& other) const { return m_private == other.m_private; }
+    bool lessThan(const WebNotification& other) const;
+
+    // Is the notification HTML vs. icon-title-text?
+    WEBKIT_API bool isHTML() const;
+
+    // If HTML, the URL which contains the contents of the notification.
+    WEBKIT_API WebURL url() const;
+
+    // If not HTML, the parameters for the icon-title-text notification.
+    WEBKIT_API WebString icon() const;
+    WEBKIT_API WebString title() const;
+    WEBKIT_API WebString body() const;
+
+    // Called to indicate the notification has been displayed.
+    WEBKIT_API void dispatchDisplayEvent();
+
+    // Called to indicate an error has occurred with this notification.
+    WEBKIT_API void dispatchErrorEvent(const WebString& errorMessage);
+
+    // Called to indicate the notification has been closed.  If it was
+    // closed by the user (as opposed to automatically by the system),
+    // the byUser parameter will be true.
+    WEBKIT_API void dispatchCloseEvent(bool byUser);
+
+#if WEBKIT_IMPLEMENTATION
+    WebNotification(const WTF::PassRefPtr<WebCore::Notification>&);
+    WebNotification& operator=(const WTF::PassRefPtr<WebCore::Notification>&);
+    operator WTF::PassRefPtr<WebCore::Notification>() const;
+#endif
+
+private:
+    void assign(WebNotificationPrivate*);
+    WebNotificationPrivate* m_private;
+};
+
+inline bool operator==(const WebNotification& a, const WebNotification& b)
+{
+    return a.equals(b);
+}
+
+inline bool operator!=(const WebNotification& a, const WebNotification& b)
+{
+    return !a.equals(b);
+}
+
+inline bool operator<(const WebNotification& a, const WebNotification& b)
+{
+    return a.lessThan(b);
+}
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebNotificationPermissionCallback.h b/WebKit/chromium/public/WebNotificationPermissionCallback.h
new file mode 100644
index 0000000..07e85ee
--- /dev/null
+++ b/WebKit/chromium/public/WebNotificationPermissionCallback.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNotificationPermissionCallback_h
+#define WebNotificationPermissionCallback_h
+
+namespace WebKit {
+
+// Callback object used with WebNotificationPresenter.
+class WebNotificationPermissionCallback {
+public:
+    // Method to be invoked when the async permission request involving
+    // this object has been completed.
+    virtual void permissionRequestComplete() = 0;
+
+protected:
+    // This object is to be destroyed after the callback is invoked;
+    // it should not be directly destroyed.
+    ~WebNotificationPermissionCallback() {}
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebNotificationPresenter.h b/WebKit/chromium/public/WebNotificationPresenter.h
new file mode 100644
index 0000000..653b142
--- /dev/null
+++ b/WebKit/chromium/public/WebNotificationPresenter.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNotificationPresenter_h
+#define WebNotificationPresenter_h
+
+#include "WebString.h"
+
+namespace WebKit {
+
+class WebNotification;
+class WebNotificationPermissionCallback;
+
+// Provides the services to show desktop notifications to the user.
+class WebNotificationPresenter {
+public:
+    enum Permission {
+        PermissionAllowed,     // User has allowed permission to the origin.
+        PermissionNotAllowed,  // User has not taken an action on the origin (defaults to not allowed).
+        PermissionDenied       // User has explicitly denied permission from the origin.
+    };
+
+    // Shows a notification.
+    virtual bool show(const WebNotification&) = 0;
+
+    // Cancels a notification previously shown, and removes it if being shown.
+    virtual void cancel(const WebNotification&) = 0;
+
+    // Indiciates that the notification object subscribed to events for a previously shown notification is
+    // being destroyed.  Does _not_ remove the notification if being shown, but detaches it from receiving events.
+    virtual void objectDestroyed(const WebNotification&) = 0;
+
+    // Checks the permission level of a given origin.
+    virtual Permission checkPermission(const WebString& origin) = 0;
+
+    // Requests permission for a given origin.  This operation is asynchronous and the callback provided
+    // will be invoked when the permission decision is made.  Callback pointer must remain
+    // valid until called.
+    virtual void requestPermission(const WebString& origin, WebNotificationPermissionCallback* callback) = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebPasswordAutocompleteListener.h b/WebKit/chromium/public/WebPasswordAutocompleteListener.h
new file mode 100644
index 0000000..db6589d
--- /dev/null
+++ b/WebKit/chromium/public/WebPasswordAutocompleteListener.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPasswordAutocompleteListener_h
+#define WebPasswordAutocompleteListener_h
+
+namespace WebKit {
+class WebString;
+
+class WebPasswordAutocompleteListener {
+public:
+    virtual ~WebPasswordAutocompleteListener() {}
+
+    virtual void didBlurInputElement(
+        const WebString& userInput) = 0;
+
+    virtual void performInlineAutocomplete(
+        const WebString& userInput,
+        bool backSpaceOrDeletePressed,
+        bool showSuggestions) = 0;
+};
+
+} // namespace WebKit
+
+
+#endif
diff --git a/WebKit/chromium/public/WebPasswordFormData.h b/WebKit/chromium/public/WebPasswordFormData.h
new file mode 100644
index 0000000..e1804d1
--- /dev/null
+++ b/WebKit/chromium/public/WebPasswordFormData.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPasswordFormData_h
+#define WebPasswordFormData_h
+
+#include "WebFormElement.h"
+#include "WebString.h"
+#include "WebURL.h"
+
+namespace WebKit {
+
+struct WebPasswordFormData {
+    // If the provided form is suitable for password completion, isValid() will
+    // return true;
+    WebPasswordFormData(const WebFormElement&);
+
+    // If creation failed, return false.
+    bool isValid() const { return action.isValid(); }
+
+    // The action target of the form. This is the primary data used by the
+    // PasswordManager for form autofill; that is, the action of the saved
+    // credentials must match the action of the form on the page to be autofilled.
+    // If this is empty / not available, it will result in a "restricted"
+    // IE-like autofill policy, where we wait for the user to type in his
+    // username before autofilling the password. In these cases, after successful
+    // login the action URL will automatically be assigned by the
+    // PasswordManager.
+    //
+    // When parsing an HTML form, this must always be set.
+    WebURL action;
+
+    // The "Realm" for the sign-on (scheme, host, port for SCHEME_HTML, and
+    // contains the HTTP realm for dialog-based forms).
+    // The signon_realm is effectively the primary key used for retrieving
+    // data from the database, so it must not be empty.
+    WebString signonRealm;
+
+    // The URL (minus query parameters) containing the form. This is the primary
+    // data used by the PasswordManager to decide (in longest matching prefix
+    // fashion) whether or not a given PasswordForm result from the database is a
+    // good fit for a particular form on a page, so it must not be empty.
+    WebURL origin;
+
+    // The name of the submit button used. Optional; only used in scoring
+    // of PasswordForm results from the database to make matches as tight as
+    // possible.
+    //
+    // When parsing an HTML form, this must always be set.
+    WebString submitElement;
+
+    // The name of the username input element. Optional (improves scoring).
+    //
+    // When parsing an HTML form, this must always be set.
+    WebString userNameElement;
+
+    // The username. Optional.
+    //
+    // When parsing an HTML form, this is typically empty unless the site
+    // has implemented some form of autofill.
+    WebString userNameValue;
+
+    // The name of the password input element, Optional (improves scoring).
+    //
+    // When parsing an HTML form, this must always be set.
+    WebString passwordElement;
+
+    // The password. Required.
+    //
+    // When parsing an HTML form, this is typically empty.
+    WebString passwordValue;
+
+    // If the form was a change password form, the name of the
+    // 'old password' input element. Optional.
+    WebString oldPasswordElement;
+
+    // The old password. Optional.
+    WebString oldPasswordValue;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebPlugin.h b/WebKit/chromium/public/WebPlugin.h
new file mode 100644
index 0000000..5097265
--- /dev/null
+++ b/WebKit/chromium/public/WebPlugin.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPlugin_h
+#define WebPlugin_h
+
+#include "WebCanvas.h"
+
+struct NPObject;
+
+namespace WebKit {
+
+class WebDataSource;
+class WebFrame;
+class WebInputEvent;
+class WebPluginContainer;
+class WebURL;
+class WebURLResponse;
+struct WebCursorInfo;
+struct WebPluginParams;
+struct WebRect;
+struct WebURLError;
+template <typename T> class WebVector;
+
+class WebPlugin {
+public:
+    virtual bool initialize(WebPluginContainer*) = 0;
+    virtual void destroy() = 0;
+
+    virtual NPObject* scriptableObject() = 0;
+
+    virtual void paint(WebCanvas*, const WebRect&) = 0;
+
+    // Coordinates are relative to the containing window.
+    virtual void updateGeometry(
+        const WebRect& frameRect, const WebRect& clipRect,
+        const WebVector<WebRect>& cutOutsRects, bool isVisible) = 0;
+
+    virtual void updateFocus(bool) = 0;
+    virtual void updateVisibility(bool) = 0;
+
+    virtual bool acceptsInputEvents() = 0;
+    virtual bool handleInputEvent(const WebInputEvent&, WebCursorInfo&) = 0;
+
+    virtual void didReceiveResponse(const WebURLResponse&) = 0;
+    virtual void didReceiveData(const char* data, int dataLength) = 0;
+    virtual void didFinishLoading() = 0;
+    virtual void didFailLoading(const WebURLError&) = 0;
+
+    // Called in response to WebPluginContainer::loadFrameRequest
+    virtual void didFinishLoadingFrameRequest(
+        const WebURL&, void* notifyData) = 0;
+    virtual void didFailLoadingFrameRequest(
+        const WebURL&, void* notifyData, const WebURLError&) = 0;
+
+protected:
+    ~WebPlugin() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebPluginContainer.h b/WebKit/chromium/public/WebPluginContainer.h
new file mode 100644
index 0000000..41e304e
--- /dev/null
+++ b/WebKit/chromium/public/WebPluginContainer.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPluginContainer_h
+#define WebPluginContainer_h
+
+struct NPObject;
+
+namespace WebKit {
+
+class WebString;
+class WebURL;
+class WebURLRequest;
+struct WebRect;
+
+class WebPluginContainer {
+public:
+    virtual void invalidate() = 0;
+    virtual void invalidateRect(const WebRect&) = 0;
+
+    // Causes the container to report its current geometry via
+    // WebPlugin::updateGeometry.
+    virtual void reportGeometry() = 0;
+
+    // Drop any references to script objects allocated by the plugin.
+    // These are objects derived from WebPlugin::scriptableObject.  This is
+    // called when the plugin is being destroyed or if it needs to be
+    // re-initialized.
+    virtual void clearScriptObjects() = 0;
+
+    // Returns the scriptable object associated with the DOM element
+    // containing the plugin.
+    virtual NPObject* scriptableObjectForElement() = 0;
+
+    // Executes a "javascript:" URL on behalf of the plugin in the context
+    // of the frame containing the plugin.  Returns the result of script
+    // execution, if any.
+    virtual WebString executeScriptURL(const WebURL&, bool popupsAllowed) = 0;
+
+    // Loads an URL in the specified frame (or the frame containing this
+    // plugin if target is empty).  If notifyNeeded is true, then upon
+    // completion, WebPlugin::didFinishLoadingFrameRequest is called if the
+    // load was successful or WebPlugin::didFailLoadingFrameRequest is
+    // called if the load failed.  The given notifyData is passed along to
+    // the callback.
+    virtual void loadFrameRequest(
+        const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData) = 0;
+
+protected:
+    ~WebPluginContainer() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebPluginListBuilder.h b/WebKit/chromium/public/WebPluginListBuilder.h
new file mode 100644
index 0000000..4bd427d
--- /dev/null
+++ b/WebKit/chromium/public/WebPluginListBuilder.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPluginListBuilder_h
+#define WebPluginListBuilder_h
+
+namespace WebKit {
+
+class WebString;
+
+// An interface for building a list of known plugins.
+class WebPluginListBuilder {
+public:
+    virtual void addPlugin(
+        const WebString& name, const WebString& description,
+        const WebString& fileName) = 0;
+
+    virtual void addMediaTypeToLastPlugin(
+        const WebString& name, const WebString& description) = 0;
+
+    virtual void addFileExtensionToLastMediaType(
+        const WebString& fileExtension) = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebPluginParams.h b/WebKit/chromium/public/WebPluginParams.h
new file mode 100644
index 0000000..5d03204
--- /dev/null
+++ b/WebKit/chromium/public/WebPluginParams.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPluginParams_h
+#define WebPluginParams_h
+
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebVector.h"
+
+namespace WebKit {
+
+struct WebPluginParams {
+    WebURL url;
+    WebString mimeType;
+    WebVector<WebString> attributeNames;
+    WebVector<WebString> attributeValues;
+    bool loadManually;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebPoint.h b/WebKit/chromium/public/WebPoint.h
new file mode 100644
index 0000000..d1abe02
--- /dev/null
+++ b/WebKit/chromium/public/WebPoint.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPoint_h
+#define WebPoint_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+#include "IntPoint.h"
+#else
+#include <base/gfx/rect.h>
+#endif
+
+namespace WebKit {
+
+struct WebPoint {
+    int x;
+    int y;
+
+    WebPoint()
+        : x(0)
+        , y(0)
+    {
+    }
+
+    WebPoint(int x, int y)
+        : x(x)
+        , y(y)
+    {
+    }
+
+#if WEBKIT_IMPLEMENTATION
+    WebPoint(const WebCore::IntPoint& p)
+        : x(p.x())
+        , y(p.y())
+    {
+    }
+
+    WebPoint& operator=(const WebCore::IntPoint& p)
+    {
+        x = p.x();
+        y = p.y();
+        return *this;
+    }
+
+    operator WebCore::IntPoint() const
+    {
+        return WebCore::IntPoint(x, y);
+    }
+#else
+    WebPoint(const gfx::Point& p)
+        : x(p.x())
+        , y(p.y())
+    {
+    }
+
+    WebPoint& operator=(const gfx::Point& p)
+    {
+        x = p.x();
+        y = p.y();
+        return *this;
+    }
+
+    operator gfx::Point() const
+    {
+        return gfx::Point(x, y);
+    }
+#endif
+};
+
+inline bool operator==(const WebPoint& a, const WebPoint& b)
+{
+    return a.x == b.x && a.y == b.y;
+}
+
+inline bool operator!=(const WebPoint& a, const WebPoint& b)
+{
+    return !(a == b);
+}
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebPopupMenu.h b/WebKit/chromium/public/WebPopupMenu.h
new file mode 100644
index 0000000..c2cdec3
--- /dev/null
+++ b/WebKit/chromium/public/WebPopupMenu.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPopupMenu_h
+#define WebPopupMenu_h
+
+#include "WebCommon.h"
+#include "WebWidget.h"
+
+namespace WebKit {
+
+class WebWidgetClient;
+
+class WebPopupMenu : public WebWidget {
+public:
+    WEBKIT_API static WebPopupMenu* create(WebWidgetClient*);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebPopupMenuInfo.h b/WebKit/chromium/public/WebPopupMenuInfo.h
new file mode 100644
index 0000000..876842d
--- /dev/null
+++ b/WebKit/chromium/public/WebPopupMenuInfo.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPopupMenuInfo_h
+#define WebPopupMenuInfo_h
+
+#include "WebMenuItemInfo.h"
+#include "WebVector.h"
+
+namespace WebKit {
+
+// Describes the contents of a popup menu.
+struct WebPopupMenuInfo {
+    // FIXME: migrate clients to WebMenuItemInfo and remove this temporary Item typedef.
+    typedef WebMenuItemInfo Item;
+    int itemHeight;
+    int selectedIndex;
+    WebVector<WebMenuItemInfo> items;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebRange.h b/WebKit/chromium/public/WebRange.h
new file mode 100644
index 0000000..89fc8f6
--- /dev/null
+++ b/WebKit/chromium/public/WebRange.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRange_h
+#define WebRange_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class Range; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebNode;
+class WebRangePrivate;
+class WebString;
+
+// Provides readonly access to some properties of a DOM range.
+class WebRange {
+public:
+    ~WebRange() { reset(); }
+
+    WebRange() : m_private(0) { }
+    WebRange(const WebRange& r) : m_private(0) { assign(r); }
+    WebRange& operator=(const WebRange& r)
+    {
+        assign(r);
+        return *this;
+    }
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebRange&);
+
+    bool isNull() const { return !m_private; }
+
+    WEBKIT_API int startOffset() const;
+    WEBKIT_API int endOffset() const;
+    WEBKIT_API WebNode startContainer(int& exceptionCode) const;
+    WEBKIT_API WebNode endContainer(int& exceptionCode) const;
+
+    WEBKIT_API WebString toHTMLText() const;
+    WEBKIT_API WebString toPlainText() const;
+
+#if WEBKIT_IMPLEMENTATION
+    WebRange(const WTF::PassRefPtr<WebCore::Range>&);
+    WebRange& operator=(const WTF::PassRefPtr<WebCore::Range>&);
+    operator WTF::PassRefPtr<WebCore::Range>() const;
+#endif
+
+private:
+    void assign(WebRangePrivate*);
+    WebRangePrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebRect.h b/WebKit/chromium/public/WebRect.h
new file mode 100644
index 0000000..ed5a7d1
--- /dev/null
+++ b/WebKit/chromium/public/WebRect.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRect_h
+#define WebRect_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+#include "IntRect.h"
+#else
+#include <base/gfx/rect.h>
+#endif
+
+namespace WebKit {
+
+struct WebRect {
+    int x;
+    int y;
+    int width;
+    int height;
+
+    bool isEmpty() const { return width <= 0 || height <= 0; }
+
+    WebRect()
+        : x(0)
+        , y(0)
+        , width(0)
+        , height(0)
+    {
+    }
+
+    WebRect(int x, int y, int width, int height)
+        : x(x)
+        , y(y)
+        , width(width)
+        , height(height)
+    {
+    }
+
+#if WEBKIT_IMPLEMENTATION
+    WebRect(const WebCore::IntRect& r)
+        : x(r.x())
+        , y(r.y())
+        , width(r.width())
+        , height(r.height())
+    {
+    }
+
+    WebRect& operator=(const WebCore::IntRect& r)
+    {
+        x = r.x();
+        y = r.y();
+        width = r.width();
+        height = r.height();
+        return *this;
+    }
+
+    operator WebCore::IntRect() const
+    {
+        return WebCore::IntRect(x, y, width, height);
+    }
+#else
+    WebRect(const gfx::Rect& r)
+        : x(r.x())
+        , y(r.y())
+        , width(r.width())
+        , height(r.height())
+    {
+    }
+
+    WebRect& operator=(const gfx::Rect& r)
+    {
+        x = r.x();
+        y = r.y();
+        width = r.width();
+        height = r.height();
+        return *this;
+    }
+
+    operator gfx::Rect() const
+    {
+        return gfx::Rect(x, y, width, height);
+    }
+#endif
+};
+
+inline bool operator==(const WebRect& a, const WebRect& b)
+{
+    return a.x == b.x && a.y == b.y && a.width == b.width && a.height == b.height;
+}
+
+inline bool operator!=(const WebRect& a, const WebRect& b)
+{
+    return !(a == b);
+}
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebRegularExpression.h b/WebKit/chromium/public/WebRegularExpression.h
new file mode 100644
index 0000000..bdf72d8
--- /dev/null
+++ b/WebKit/chromium/public/WebRegularExpression.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRegularExpression_h
+#define WebRegularExpression_h
+
+#include "WebCommon.h"
+#include "WebNonCopyable.h"
+#include "WebTextCaseSensitivity.h"
+
+namespace WebKit {
+
+class WebRegularExpressionPrivate;
+class WebString;
+
+class WebRegularExpression : public WebNonCopyable {
+public:
+    WEBKIT_API WebRegularExpression(const WebString& pattern, WebTextCaseSensitivity);
+    WEBKIT_API ~WebRegularExpression();
+
+    WEBKIT_API int match(const WebString&, int startFrom = 0, int* matchLength = 0) const;
+
+private:
+    WebRegularExpressionPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebRuntimeFeatures.h b/WebKit/chromium/public/WebRuntimeFeatures.h
new file mode 100644
index 0000000..eb6b2da
--- /dev/null
+++ b/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebRuntimeFeatures_h
+#define WebRuntimeFeatures_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+// This class is used to enable runtime features of WebKit.  It is unspecified
+// whether a feature is enabled by default.  In the future, a feature may be
+// promoted from disabled by default to enabled by default once it reaches a
+// certain level of maturity.
+class WebRuntimeFeatures {
+public:
+    WEBKIT_API static void enableDatabase(bool);
+    WEBKIT_API static bool isDatabaseEnabled();
+
+    WEBKIT_API static void enableLocalStorage(bool);
+    WEBKIT_API static bool isLocalStorageEnabled();
+
+    WEBKIT_API static void enableSessionStorage(bool);
+    WEBKIT_API static bool isSessionStorageEnabled();
+
+    WEBKIT_API static void enableMediaPlayer(bool);
+    WEBKIT_API static bool isMediaPlayerEnabled();
+
+    WEBKIT_API static void enableSockets(bool);
+    WEBKIT_API static bool isSocketsEnabled();
+
+    WEBKIT_API static void enableNotifications(bool);
+    WEBKIT_API static bool isNotificationsEnabled();
+
+    WEBKIT_API static void enableApplicationCache(bool);
+    WEBKIT_API static bool isApplicationCacheEnabled();
+
+private:
+    WebRuntimeFeatures();
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebScreenInfo.h b/WebKit/chromium/public/WebScreenInfo.h
new file mode 100644
index 0000000..d3d268a
--- /dev/null
+++ b/WebKit/chromium/public/WebScreenInfo.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScreenInfo_h
+#define WebScreenInfo_h
+
+#include "WebRect.h"
+
+namespace WebKit {
+
+struct WebScreenInfo {
+    // The screen depth in bits per pixel
+    int depth;
+
+    // The bits per colour component. This assumes that the colours are balanced
+    // equally.
+    int depthPerComponent;
+
+    // This can be true for black and white printers
+    bool isMonochrome;
+
+    // This is set from the rcMonitor member of MONITORINFOEX, to whit:
+    //   "A RECT structure that specifies the display monitor rectangle,
+    //   expressed in virtual-screen coordinates. Note that if the monitor
+    //   is not the primary display monitor, some of the rectangle's
+    //   coordinates may be negative values."
+    WebRect rect;
+
+    // This is set from the rcWork member of MONITORINFOEX, to whit:
+    //   "A RECT structure that specifies the work area rectangle of the
+    //   display monitor that can be used by applications, expressed in
+    //   virtual-screen coordinates. Windows uses this rectangle to
+    //   maximize an application on the monitor. The rest of the area in
+    //   rcMonitor contains system windows such as the task bar and side
+    //   bars. Note that if the monitor is not the primary display monitor,
+    //   some of the rectangle's coordinates may be negative values".
+    WebRect availableRect;
+
+    WebScreenInfo()
+        : depth(0)
+        , depthPerComponent(0)
+        , isMonochrome(false) { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebScriptController.h b/WebKit/chromium/public/WebScriptController.h
new file mode 100644
index 0000000..54bb08a
--- /dev/null
+++ b/WebKit/chromium/public/WebScriptController.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScriptController_h
+#define WebScriptController_h
+
+#include "WebCommon.h"
+
+namespace v8 {
+class Extension;
+}
+
+namespace WebKit {
+
+class WebString;
+
+class WebScriptController {
+public:
+    // Registers a v8 extension to be available on webpages. The three forms
+    // offer various restrictions on what types of contexts the extension is
+    // loaded into. If a scheme is provided, only pages whose URL has the given
+    // scheme will match. If extensionGroup is provided, the extension will only
+    // be loaded into scripts run via WebFrame::ExecuteInNewWorld with the
+    // matching group.
+    // Will only affect v8 contexts initialized after this call. Takes ownership
+    // of the v8::Extension object passed.
+    WEBKIT_API static void registerExtension(v8::Extension*);
+    WEBKIT_API static void registerExtension(v8::Extension*,
+                                             const WebString& schemeRestriction);
+    WEBKIT_API static void registerExtension(v8::Extension*, int extensionGroup);
+
+    // Enables special settings which are only applicable if V8 is executed
+    // in the single thread which must be the main thread.
+    // FIXME: make a try to dynamically detect when this condition is broken
+    // and automatically switch off single thread mode.
+    WEBKIT_API static void enableV8SingleThreadMode();
+
+    // Process any pending JavaScript console messages.
+    WEBKIT_API static void flushConsoleMessages();
+
+private:
+    WebScriptController();
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebScriptSource.h b/WebKit/chromium/public/WebScriptSource.h
new file mode 100644
index 0000000..344815b
--- /dev/null
+++ b/WebKit/chromium/public/WebScriptSource.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScriptSource_h
+#define WebScriptSource_h
+
+#include "WebString.h"
+#include "WebURL.h"
+
+namespace WebKit {
+
+struct WebScriptSource {
+    WebString code;
+    WebURL url;
+    int startLine;
+
+    WebScriptSource(const WebString& code)
+        : code(code), startLine(1) { }
+    WebScriptSource(const WebString& code, const WebURL& url)
+        : code(code), url(url), startLine(1) { }
+    WebScriptSource(const WebString& code, const WebURL& url, int startLine)
+        : code(code), url(url), startLine(startLine) { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebSearchableFormData.h b/WebKit/chromium/public/WebSearchableFormData.h
new file mode 100644
index 0000000..e453387
--- /dev/null
+++ b/WebKit/chromium/public/WebSearchableFormData.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSearchableFormData_h
+#define WebSearchableFormData_h
+
+#include "WebString.h"
+#include "WebURL.h"
+
+namespace WebKit {
+class WebFormElement;
+
+// SearchableFormData encapsulates a URL and encoding of an INPUT field that
+// corresponds to a searchable form request.
+class WebSearchableFormData {
+public:
+    // If the provided form is suitable for automated searching, isValid()
+    // will return false.
+    WebSearchableFormData(const WebFormElement&);
+
+    bool isValid() { return m_url.isValid(); }
+
+    // URL for the searchable form request.
+    const WebURL& url() const
+    {
+        return m_url;
+    }
+
+    // Encoding used to encode the form parameters; never empty.
+    const WebString& encoding() const
+    {
+        return m_encoding;
+    }
+
+private:
+    WebURL m_url;
+    WebString m_encoding;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebSecurityOrigin.h b/WebKit/chromium/public/WebSecurityOrigin.h
new file mode 100644
index 0000000..d04fbc6
--- /dev/null
+++ b/WebKit/chromium/public/WebSecurityOrigin.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSecurityOrigin_h
+#define WebSecurityOrigin_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class SecurityOrigin; }
+namespace WTF { template <typename T> class PassRefPtr; }
+#endif
+
+namespace WebKit {
+
+class WebSecurityOriginPrivate;
+class WebString;
+
+class WebSecurityOrigin {
+public:
+    ~WebSecurityOrigin() { reset(); }
+
+    WebSecurityOrigin() : m_private(0) { }
+    WebSecurityOrigin(const WebSecurityOrigin& s) : m_private(0) { assign(s); }
+    WebSecurityOrigin& operator=(const WebSecurityOrigin& s)
+    {
+        assign(s);
+        return *this;
+    }
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebSecurityOrigin&);
+
+    bool isNull() const { return !m_private; }
+
+    WEBKIT_API WebString protocol() const;
+    WEBKIT_API WebString host() const;
+    WEBKIT_API unsigned short port() const;
+
+    // The empty WebSecurityOrigin is the least privileged WebSecurityOrigin.
+    WEBKIT_API bool isEmpty() const;
+
+    // Returns a string representation of the WebSecurityOrigin.  The empty
+    // WebSecurityOrigin is represented by "null".  The representation of a
+    // non-empty WebSecurityOrigin resembles a standard URL.
+    WEBKIT_API WebString toString() const;
+
+    // Returns a string representation of this WebSecurityOrigin that can
+    // be used as a file.  Should be used in storage APIs only.
+    WEBKIT_API WebString databaseIdentifier();
+
+#if WEBKIT_IMPLEMENTATION
+    WebSecurityOrigin(const WTF::PassRefPtr<WebCore::SecurityOrigin>&);
+    WebSecurityOrigin& operator=(const WTF::PassRefPtr<WebCore::SecurityOrigin>&);
+    operator WTF::PassRefPtr<WebCore::SecurityOrigin>() const;
+#endif
+
+private:
+    void assign(WebSecurityOriginPrivate*);
+    WebSecurityOriginPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebSecurityPolicy.h b/WebKit/chromium/public/WebSecurityPolicy.h
new file mode 100644
index 0000000..47dfe87
--- /dev/null
+++ b/WebKit/chromium/public/WebSecurityPolicy.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSecurityPolicy_h
+#define WebSecurityPolicy_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebString;
+class WebURL;
+
+class WebSecurityPolicy {
+public:
+    // Registers a URL scheme to be treated as a local scheme (i.e., with the
+    // same security rules as those applied to "file" URLs).  This means that
+    // normal pages cannot link to or access URLs of this scheme.
+    WEBKIT_API static void registerURLSchemeAsLocal(const WebString&);
+
+    // Registers a URL scheme to be treated as a noAccess scheme.  This means
+    // that pages loaded with this URL scheme cannot access pages loaded with
+    // any other URL scheme.
+    WEBKIT_API static void registerURLSchemeAsNoAccess(const WebString&);
+
+    // Support for whitelisting access to origins beyond the same-origin policy.
+    WEBKIT_API static void whiteListAccessFromOrigin(
+        const WebURL& sourceOrigin, const WebString& destinationProtocol,
+        const WebString& destinationHost, bool allowDestinationSubdomains);
+    WEBKIT_API static void resetOriginAccessWhiteLists();
+
+private:
+    WebSecurityPolicy();
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebSettings.h b/WebKit/chromium/public/WebSettings.h
new file mode 100644
index 0000000..da36806
--- /dev/null
+++ b/WebKit/chromium/public/WebSettings.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSettings_h
+#define WebSettings_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebString;
+class WebURL;
+
+// WebSettings is owned by the WebView and allows code to modify the settings for
+// the WebView's page without any knowledge of WebCore itself.  For the most part,
+// these functions have a 1:1 mapping with the methods in WebCore/page/settings.h.
+class WebSettings {
+public:
+    virtual void setStandardFontFamily(const WebString&) = 0;
+    virtual void setFixedFontFamily(const WebString&) = 0;
+    virtual void setSerifFontFamily(const WebString&) = 0;
+    virtual void setSansSerifFontFamily(const WebString&) = 0;
+    virtual void setCursiveFontFamily(const WebString&) = 0;
+    virtual void setFantasyFontFamily(const WebString&) = 0;
+    virtual void setDefaultFontSize(int) = 0;
+    virtual void setDefaultFixedFontSize(int) = 0;
+    virtual void setMinimumFontSize(int) = 0;
+    virtual void setMinimumLogicalFontSize(int) = 0;
+    virtual void setDefaultTextEncodingName(const WebString&) = 0;
+    virtual void setJavaScriptEnabled(bool) = 0;
+    virtual void setWebSecurityEnabled(bool) = 0;
+    virtual void setJavaScriptCanOpenWindowsAutomatically(bool) = 0;
+    virtual void setLoadsImagesAutomatically(bool) = 0;
+    virtual void setPluginsEnabled(bool) = 0;
+    virtual void setDOMPasteAllowed(bool) = 0;
+    virtual void setDeveloperExtrasEnabled(bool) = 0;
+    virtual void setNeedsSiteSpecificQuirks(bool) = 0;
+    virtual void setShrinksStandaloneImagesToFit(bool) = 0;
+    virtual void setUsesEncodingDetector(bool) = 0;
+    virtual void setTextAreasAreResizable(bool) = 0;
+    virtual void setJavaEnabled(bool) = 0;
+    virtual void setAllowScriptsToCloseWindows(bool) = 0;
+    virtual void setUserStyleSheetLocation(const WebURL&) = 0;
+    virtual void setUsesPageCache(bool) = 0;
+    virtual void setDownloadableBinaryFontsEnabled(bool) = 0;
+    virtual void setXSSAuditorEnabled(bool) = 0;
+    virtual void setLocalStorageEnabled(bool) = 0;
+    virtual void setEditableLinkBehaviorNeverLive() = 0;
+    virtual void setFontRenderingModeNormal() = 0;
+    virtual void setShouldPaintCustomScrollbars(bool) = 0;
+    virtual void setDatabasesEnabled(bool) = 0;
+    virtual void setAllowUniversalAccessFromFileURLs(bool) = 0;
+    virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded() = 0;
+    virtual void setOfflineWebApplicationCacheEnabled(bool) = 0;
+    virtual void setExperimentalWebGLEnabled(bool) = 0;
+    virtual void setGeolocationEnabled(bool) = 0;
+
+protected:
+    ~WebSettings() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebSharedWorker.h b/WebKit/chromium/public/WebSharedWorker.h
new file mode 100644
index 0000000..4ac7639
--- /dev/null
+++ b/WebKit/chromium/public/WebSharedWorker.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSharedWorker_h
+#define WebSharedWorker_h
+
+#include "WebCommon.h"
+
+namespace WebCore {
+class ScriptExecutionContext;
+}
+
+namespace WebKit {
+
+class WebString;
+class WebMessagePortChannel;
+class WebCommonWorkerClient;
+class WebURL;
+
+// This is the interface to a SharedWorker thread.
+// Since SharedWorkers communicate entirely through MessagePorts this interface only contains APIs for starting up a SharedWorker.
+class WebSharedWorker {
+public:
+    // Invoked from the worker thread to instantiate a WebSharedWorker that interacts with the WebKit worker components.
+    WEBKIT_API static WebSharedWorker* create(WebCommonWorkerClient*);
+
+    virtual ~WebSharedWorker() {};
+
+    // Returns false if the thread hasn't been started yet (script loading has not taken place).
+    // FIXME(atwilson): Remove this when we move the initial script loading into the worker process.
+    virtual bool isStarted() = 0;
+
+    virtual void startWorkerContext(const WebURL& scriptURL,
+                                    const WebString& name,
+                                    const WebString& userAgent,
+                                    const WebString& sourceCode) = 0;
+    class ConnectListener {
+    public:
+        // Invoked once the connect event has been sent so the caller can free this object.
+        virtual void connected() = 0;
+    };
+
+    // Sends a connect event to the SharedWorker context. The listener is invoked when this async operation completes.
+    virtual void connect(WebMessagePortChannel*, ConnectListener*) = 0;
+
+    // Invoked to shutdown the worker when there are no more associated documents.
+    virtual void terminateWorkerContext() = 0;
+
+    // Notification when the WebCommonWorkerClient is destroyed.
+    virtual void clientDestroyed() = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebSharedWorkerRepository.h b/WebKit/chromium/public/WebSharedWorkerRepository.h
new file mode 100644
index 0000000..9fe6890
--- /dev/null
+++ b/WebKit/chromium/public/WebSharedWorkerRepository.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSharedWorkerRepository_h
+#define WebSharedWorkerRepository_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebString;
+class WebSharedWorker;
+class WebURL;
+
+class WebSharedWorkerRepository {
+public:
+    // Unique identifier for the parent document of a worker (unique within a given process).
+    typedef unsigned long long DocumentID;
+
+    // Tracks a newly-created SharedWorker via the repository.
+    virtual void addSharedWorker(WebSharedWorker*, DocumentID) = 0;
+
+    // Invoked when a document has been detached. DocumentID can be re-used after documentDetached() is invoked.
+    virtual void documentDetached(DocumentID) = 0;
+
+    // Returns true if the passed document is associated with any SharedWorkers.
+    virtual bool hasSharedWorkers(DocumentID) = 0;
+};
+
+} // namespace WebKit
+
+#endif // WebSharedWorkerRepository_h
diff --git a/WebKit/chromium/public/WebSize.h b/WebKit/chromium/public/WebSize.h
new file mode 100644
index 0000000..bb88633
--- /dev/null
+++ b/WebKit/chromium/public/WebSize.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSize_h
+#define WebSize_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+#include "IntSize.h"
+#else
+#include <base/gfx/rect.h>
+#endif
+
+namespace WebKit {
+
+struct WebSize {
+    int width;
+    int height;
+
+    bool isEmpty() const { return width <= 0 || height <= 0; }
+
+    WebSize()
+        : width(0)
+        , height(0)
+    {
+    }
+
+    WebSize(int width, int height)
+        : width(width)
+        , height(height)
+    {
+    }
+
+#if WEBKIT_IMPLEMENTATION
+    WebSize(const WebCore::IntSize& s)
+        : width(s.width())
+        , height(s.height())
+    {
+    }
+
+    WebSize& operator=(const WebCore::IntSize& s)
+    {
+        width = s.width();
+        height = s.height();
+        return *this;
+    }
+
+    operator WebCore::IntSize() const
+    {
+        return WebCore::IntSize(width, height);
+    }
+#else
+    WebSize(const gfx::Size& s)
+        : width(s.width())
+        , height(s.height())
+    {
+    }
+
+    WebSize& operator=(const gfx::Size& s)
+    {
+        width = s.width();
+        height = s.height();
+        return *this;
+    }
+
+    operator gfx::Size() const
+    {
+        return gfx::Size(width, height);
+    }
+#endif
+};
+
+inline bool operator==(const WebSize& a, const WebSize& b)
+{
+    return a.width == b.width && a.height == b.height;
+}
+
+inline bool operator!=(const WebSize& a, const WebSize& b)
+{
+    return !(a == b);
+}
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebSocketStreamError.h b/WebKit/chromium/public/WebSocketStreamError.h
new file mode 100644
index 0000000..f52869b
--- /dev/null
+++ b/WebKit/chromium/public/WebSocketStreamError.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketStreamError_h
+#define WebSocketStreamError_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebSocketStreamError {
+public:
+    // FIXME: Define SocketStream Error codes and accessor methods.
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebSocketStreamHandle.h b/WebKit/chromium/public/WebSocketStreamHandle.h
new file mode 100644
index 0000000..ededa0e
--- /dev/null
+++ b/WebKit/chromium/public/WebSocketStreamHandle.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketStreamHandle_h
+#define WebSocketStreamHandle_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebData;
+class WebSocketStreamHandleClient;
+class WebURL;
+
+class WebSocketStreamHandle {
+public:
+    virtual ~WebSocketStreamHandle() { }
+
+    // Connect new socket stream asynchronously.
+    virtual void connect(const WebURL&, WebSocketStreamHandleClient*) = 0;
+
+    // Send web socket frame data on the socket stream.
+    virtual bool send(const WebData&) = 0;
+
+    // Close the socket stream.
+    virtual void close() = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebSocketStreamHandleClient.h b/WebKit/chromium/public/WebSocketStreamHandleClient.h
new file mode 100644
index 0000000..82f328c
--- /dev/null
+++ b/WebKit/chromium/public/WebSocketStreamHandleClient.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketStreamHandleClient_h
+#define WebSocketStreamHandleClient_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebData;
+class WebSocketStreamError;
+class WebSocketStreamHandle;
+class WebURL;
+
+class WebSocketStreamHandleClient {
+public:
+
+    // Called when Socket Stream is opened.
+    virtual void didOpenStream(WebSocketStreamHandle*, int /* maxPendingSendAllowed */) = 0;
+
+    // Called when |amountSent| bytes are sent.
+    virtual void didSendData(WebSocketStreamHandle*, int /* amountSent */) = 0;
+
+    // Called when data are received.
+    virtual void didReceiveData(WebSocketStreamHandle*, const WebData&) = 0;
+
+    // Called when Socket Stream is closed.
+    virtual void didClose(WebSocketStreamHandle*) = 0;
+
+    // Called when Socket Stream has an error.
+    virtual void didFail(WebSocketStreamHandle*, const WebSocketStreamError&) = 0;
+
+    // FIXME: auth challenge for proxy
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebStorageArea.h b/WebKit/chromium/public/WebStorageArea.h
new file mode 100644
index 0000000..71dc7a5
--- /dev/null
+++ b/WebKit/chromium/public/WebStorageArea.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStorageArea_h
+#define WebStorageArea_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebString;
+class WebURL;
+
+// In WebCore, there's one distinct StorageArea per origin per StorageNamespace. This
+// class wraps a StorageArea.  All the methods have obvious connections to the spec:
+// http://dev.w3.org/html5/webstorage/
+class WebStorageArea {
+public:
+    virtual ~WebStorageArea() { }
+
+    // The number of key/value pairs in the storage area.
+    virtual unsigned length() = 0;
+
+    // Get a value for a specific key. Valid key indices are 0 through length() - 1.
+    // Indexes may change on any set/removeItem call. Will return null if the index
+    // provided is out of range.
+    virtual WebString key(unsigned index) = 0;
+
+    // Get the value that corresponds to a specific key. This returns null if there is
+    // no entry for that key.
+    virtual WebString getItem(const WebString& key) = 0;
+
+    // Set the value that corresponds to a specific key. QuotaException is set if we've
+    // the StorageArea would have exceeded its quota. The value is NOT set when there's
+    // an exception.  url is the url that should be used if a storage event fires.
+    virtual void setItem(const WebString& key, const WebString& value, const WebURL& url, bool& quotaException) = 0;
+
+    // Remove the value associated with a particular key.  url is the url that should be used
+    // if a storage event fires.
+    virtual void removeItem(const WebString& key, const WebURL& url) = 0;
+
+    // Clear all key/value pairs.  url is the url that should be used if a storage event fires.
+    virtual void clear(const WebURL& url) = 0;
+};
+
+} // namespace WebKit
+
+#endif // WebStorageArea_h
diff --git a/WebKit/chromium/public/WebStorageEventDispatcher.h b/WebKit/chromium/public/WebStorageEventDispatcher.h
new file mode 100644
index 0000000..57750e8
--- /dev/null
+++ b/WebKit/chromium/public/WebStorageEventDispatcher.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStorageEventDispatcher_h
+#define WebStorageEventDispatcher_h
+
+#include "WebString.h"
+
+namespace WebKit {
+
+class WebURL;
+
+// This is used to dispatch storage events to all pages.
+// FIXME: Make this (or something) work for SessionStorage!
+class WebStorageEventDispatcher {
+public:
+    static WebStorageEventDispatcher* create();
+
+    virtual ~WebStorageEventDispatcher() { }
+
+    // Dispatch the actual event.  Doesn't yet work for SessionStorage.
+    virtual void dispatchStorageEvent(const WebString& key, const WebString& oldValue,
+                                      const WebString& newValue, const WebString& origin,
+                                      const WebURL& url, bool isLocalStorage) = 0;
+};
+
+} // namespace WebKit
+
+#endif // WebStorageEventDispatcher_h
diff --git a/WebKit/chromium/public/WebStorageNamespace.h b/WebKit/chromium/public/WebStorageNamespace.h
new file mode 100644
index 0000000..da92a77
--- /dev/null
+++ b/WebKit/chromium/public/WebStorageNamespace.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStorageNamespace_h
+#define WebStorageNamespace_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebStorageArea;
+class WebString;
+
+// WebStorageNamespace represents a collection of StorageAreas. Typically, you'll have
+// multiple StorageNamespaces to represent the SessionStorage for each tab and a single
+// StorageNamespace to represent LocalStorage for the entire browser.
+class WebStorageNamespace {
+public:
+    // Create a new WebStorageNamespace. LocalStorageNamespaces require a path to specify
+    // where the SQLite databases that make LocalStorage data persistent are located.
+    // If path is empty, data will not persist. You should call delete on the returned
+    // object when you're finished.
+    WEBKIT_API static WebStorageNamespace* createLocalStorageNamespace(const WebString& backingDirectoryPath, unsigned quota);
+    WEBKIT_API static WebStorageNamespace* createSessionStorageNamespace();
+
+    static const unsigned noQuota = UINT_MAX;
+
+    virtual ~WebStorageNamespace() { }
+
+    // Create a new WebStorageArea object. Two subsequent calls with the same origin
+    // will return two different WebStorageArea objects that share the same backing store.
+    // You should call delete on the returned object when you're finished.
+    virtual WebStorageArea* createStorageArea(const WebString& origin) = 0;
+
+    // Copy a StorageNamespace. This only makes sense in the case of SessionStorage.
+    virtual WebStorageNamespace* copy() = 0;
+
+    // Shutdown the StorageNamespace. Write all StorageArea's to disk and disallow new
+    // write activity.
+    virtual void close() = 0;
+};
+
+} // namespace WebKit
+
+#endif // WebStorageNamespace_h
diff --git a/WebKit/chromium/public/WebString.h b/WebKit/chromium/public/WebString.h
new file mode 100644
index 0000000..d9b66b2
--- /dev/null
+++ b/WebKit/chromium/public/WebString.h
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebString_h
+#define WebString_h
+
+#include "WebCommon.h"
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore {
+class String;
+class AtomicString;
+}
+#else
+#include <base/nullable_string16.h>
+#include <base/string16.h>
+#endif
+
+namespace WebKit {
+
+class WebCString;
+class WebStringPrivate;
+
+// A UTF-16 string container.  It is inexpensive to copy a WebString
+// object.
+//
+// WARNING: It is not safe to pass a WebString across threads!!!
+//
+class WebString {
+public:
+    ~WebString() { reset(); }
+
+    WebString() : m_private(0) { }
+
+    WebString(const WebUChar* data, size_t len) : m_private(0)
+    {
+        assign(data, len);
+    }
+
+    WebString(const WebString& s) : m_private(0) { assign(s); }
+
+    WebString& operator=(const WebString& s)
+    {
+        assign(s);
+        return *this;
+    }
+
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebString&);
+    WEBKIT_API void assign(const WebUChar* data, size_t len);
+
+    WEBKIT_API size_t length() const;
+    WEBKIT_API const WebUChar* data() const;
+
+    bool isEmpty() const { return !length(); }
+    bool isNull() const { return !m_private; }
+
+    WEBKIT_API WebCString utf8() const;
+
+    WEBKIT_API static WebString fromUTF8(const char* data, size_t length);
+    WEBKIT_API static WebString fromUTF8(const char* data);
+
+#if WEBKIT_IMPLEMENTATION
+    WebString(const WebCore::String&);
+    WebString& operator=(const WebCore::String&);
+    operator WebCore::String() const;
+
+    WebString(const WebCore::AtomicString&);
+    WebString& operator=(const WebCore::AtomicString&);
+    operator WebCore::AtomicString() const;
+#else
+    WebString(const string16& s) : m_private(0)
+    {
+        assign(s.data(), s.length());
+    }
+
+    WebString& operator=(const string16& s)
+    {
+        assign(s.data(), s.length());
+        return *this;
+    }
+
+    operator string16() const
+    {
+        size_t len = length();
+        return len ? string16(data(), len) : string16();
+    }
+
+    WebString(const NullableString16& s) : m_private(0)
+    {
+        if (s.is_null())
+            assign(0);
+        else
+            assign(s.string().data(), s.string().length());
+    }
+
+    WebString& operator=(const NullableString16& s)
+    {
+        if (s.is_null())
+            assign(0);
+        else
+            assign(s.string().data(), s.string().length());
+        return *this;
+    }
+
+    operator NullableString16() const
+    {
+        if (!m_private)
+            return NullableString16(string16(), true);
+        size_t len = length();
+        return NullableString16(len ? string16(data(), len) : string16(), false);
+    }
+
+    template <class UTF8String>
+    static WebString fromUTF8(const UTF8String& s)
+    {
+        return fromUTF8(s.data(), s.length());
+    }
+#endif
+
+private:
+    void assign(WebStringPrivate*);
+    WebStringPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebTextAffinity.h b/WebKit/chromium/public/WebTextAffinity.h
new file mode 100644
index 0000000..1224f61
--- /dev/null
+++ b/WebKit/chromium/public/WebTextAffinity.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebTextAffinity_h
+#define WebTextAffinity_h
+
+namespace WebKit {
+
+// These constants specify the preferred direction of selection.
+enum WebTextAffinity {
+    WebTextAffinityUpstream,   // The selection is moving toward the top of the document.
+    WebTextAffinityDownstream, // The selection is moving toward the bottom of the document.
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebTextCaseSensitivity.h b/WebKit/chromium/public/WebTextCaseSensitivity.h
new file mode 100644
index 0000000..ae5860c
--- /dev/null
+++ b/WebKit/chromium/public/WebTextCaseSensitivity.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebTextCaseSensitivity_h
+#define WebTextCaseSensitivity_h
+
+namespace WebKit {
+
+// These constants specify the preferred case sensitivity.
+enum WebTextCaseSensitivity {
+    WebTextCaseSensitive,   // String matching is case-sensitive.
+    WebTextCaseInsensitive, // String matching is case-insensitive.
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebTextDirection.h b/WebKit/chromium/public/WebTextDirection.h
new file mode 100644
index 0000000..3d51296
--- /dev/null
+++ b/WebKit/chromium/public/WebTextDirection.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebTextDirection_h
+#define WebTextDirection_h
+
+namespace WebKit {
+
+// Represents text directions (or writing directions) of a DOM node.
+enum WebTextDirection {
+    WebTextDirectionDefault,  // Natural writing direction ("inherit")
+    WebTextDirectionLeftToRight,
+    WebTextDirectionRightToLeft,
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebURL.h b/WebKit/chromium/public/WebURL.h
new file mode 100644
index 0000000..78a16a8
--- /dev/null
+++ b/WebKit/chromium/public/WebURL.h
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebURL_h
+#define WebURL_h
+
+#include "WebCString.h"
+#include <googleurl/src/url_parse.h>
+
+#if WEBKIT_IMPLEMENTATION
+namespace WebCore { class KURL; }
+#else
+#include <googleurl/src/gurl.h>
+#endif
+
+namespace WebKit {
+
+class WebURL {
+public:
+    ~WebURL()
+    {
+    }
+
+    WebURL() : m_isValid(false)
+    {
+    }
+
+    WebURL(const WebCString& spec, const url_parse::Parsed& parsed, bool isValid)
+        : m_spec(spec)
+        , m_parsed(parsed)
+        , m_isValid(isValid)
+    {
+    }
+
+    WebURL(const WebURL& s)
+        : m_spec(s.m_spec)
+        , m_parsed(s.m_parsed)
+        , m_isValid(s.m_isValid)
+    {
+    }
+
+    WebURL& operator=(const WebURL& s)
+    {
+        m_spec = s.m_spec;
+        m_parsed = s.m_parsed;
+        m_isValid = s.m_isValid;
+        return *this;
+    }
+
+    void assign(const WebCString& spec, const url_parse::Parsed& parsed, bool isValid)
+    {
+        m_spec = spec;
+        m_parsed = parsed;
+        m_isValid = isValid;
+    }
+
+    const WebCString& spec() const
+    {
+        return m_spec;
+    }
+
+    const url_parse::Parsed& parsed() const
+    {
+        return m_parsed;
+    }
+
+    bool isValid() const
+    {
+        return m_isValid;
+    }
+
+    bool isEmpty() const
+    {
+        return m_spec.isEmpty();
+    }
+
+    bool isNull() const
+    {
+        return m_spec.isEmpty();
+    }
+
+#if WEBKIT_IMPLEMENTATION
+    WebURL(const WebCore::KURL&);
+    WebURL& operator=(const WebCore::KURL&);
+    operator WebCore::KURL() const;
+#else
+    WebURL(const GURL& g)
+        : m_spec(g.possibly_invalid_spec())
+        , m_parsed(g.parsed_for_possibly_invalid_spec())
+        , m_isValid(g.is_valid())
+    {
+    }
+
+    WebURL& operator=(const GURL& g)
+    {
+        m_spec = g.possibly_invalid_spec();
+        m_parsed = g.parsed_for_possibly_invalid_spec();
+        m_isValid = g.is_valid();
+        return *this;
+    }
+
+    operator GURL() const
+    {
+        return isNull() ? GURL() : GURL(m_spec.data(), m_spec.length(), m_parsed, m_isValid);
+    }
+#endif
+
+private:
+    WebCString m_spec;  // UTF-8 encoded
+    url_parse::Parsed m_parsed;
+    bool m_isValid;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebURLError.h b/WebKit/chromium/public/WebURLError.h
new file mode 100644
index 0000000..de88e3e
--- /dev/null
+++ b/WebKit/chromium/public/WebURLError.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebURLError_h
+#define WebURLError_h
+
+#include "WebString.h"
+#include "WebURL.h"
+
+#if defined(WEBKIT_IMPLEMENTATION)
+namespace WebCore { class ResourceError; }
+#endif
+
+namespace WebKit {
+
+struct WebURLError {
+    // A namespace for "reason" to support various layers generating
+    // resource errors.  WebKit does not care about the value of this
+    // string as it will just be passed via callbacks to the consumer.
+    WebString domain;
+
+    // A numeric error code detailing the reason for this error.  A value
+    // of 0 means no error.  WebKit does not interpret the meaning of other
+    // values and normally just forwards this error information back to the
+    // embedder (see for example WebFrameClient).
+    int reason;
+
+    // The url that failed to load.
+    WebURL unreachableURL;
+
+    WebURLError() : reason(0) { }
+
+#if defined(WEBKIT_IMPLEMENTATION)
+    WebURLError(const WebCore::ResourceError&);
+    WebURLError& operator=(const WebCore::ResourceError&);
+    operator WebCore::ResourceError() const;
+#endif
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebURLLoader.h b/WebKit/chromium/public/WebURLLoader.h
new file mode 100644
index 0000000..54d105e
--- /dev/null
+++ b/WebKit/chromium/public/WebURLLoader.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebURLLoader_h
+#define WebURLLoader_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+class WebData;
+class WebURLLoaderClient;
+class WebURLRequest;
+class WebURLResponse;
+struct WebURLError;
+
+class WebURLLoader {
+public:
+    // The WebURLLoader may be deleted in a call to its client.
+    virtual ~WebURLLoader() {}
+
+    // Load the request synchronously, returning results directly to the
+    // caller upon completion.  There is no mechanism to interrupt a
+    // synchronous load!!
+    virtual void loadSynchronously(const WebURLRequest&,
+        WebURLResponse&, WebURLError&, WebData& data) = 0;
+
+    // Load the request asynchronously, sending notifications to the given
+    // client.  The client will receive no further notifications if the
+    // loader is disposed before it completes its work.
+    virtual void loadAsynchronously(const WebURLRequest&,
+        WebURLLoaderClient*) = 0;
+
+    // Cancels an asynchronous load.  This will appear as a load error to
+    // the client.
+    virtual void cancel() = 0;
+
+    // Suspends/resumes an asynchronous load.
+    virtual void setDefersLoading(bool) = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebURLLoaderClient.h b/WebKit/chromium/public/WebURLLoaderClient.h
new file mode 100644
index 0000000..03b2c54
--- /dev/null
+++ b/WebKit/chromium/public/WebURLLoaderClient.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebURLLoaderClient_h
+#define WebURLLoaderClient_h
+
+namespace WebKit {
+
+class WebURLLoader;
+class WebURLRequest;
+class WebURLResponse;
+struct WebURLError;
+
+class WebURLLoaderClient {
+public:
+    // Called when following a redirect.  |newRequest| contains the request
+    // generated by the redirect.  The client may modify |newRequest|.
+    virtual void willSendRequest(
+        WebURLLoader*, WebURLRequest& newRequest, const WebURLResponse& redirectResponse) = 0;
+
+    // Called to report upload progress.  The bytes reported correspond to
+    // the HTTP message body.
+    virtual void didSendData(
+        WebURLLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent) = 0;
+
+    // Called when response headers are received.
+    virtual void didReceiveResponse(WebURLLoader*, const WebURLResponse&) = 0;
+
+    // Called when a chunk of response data is received.
+    virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength) = 0;
+
+    // Called when the load completes successfully.
+    virtual void didFinishLoading(WebURLLoader*) = 0;
+
+    // Called when the load completes with an error.
+    virtual void didFail(WebURLLoader*, const WebURLError&) = 0;
+
+protected:
+    ~WebURLLoaderClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebURLRequest.h b/WebKit/chromium/public/WebURLRequest.h
new file mode 100644
index 0000000..41443b4
--- /dev/null
+++ b/WebKit/chromium/public/WebURLRequest.h
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebURLRequest_h
+#define WebURLRequest_h
+
+#include "WebCommon.h"
+#include "WebHTTPBody.h"
+
+#if defined(WEBKIT_IMPLEMENTATION)
+namespace WebCore { class ResourceRequest; }
+#endif
+
+namespace WebKit {
+
+class WebCString;
+class WebHTTPBody;
+class WebHTTPHeaderVisitor;
+class WebString;
+class WebURL;
+class WebURLRequestPrivate;
+
+class WebURLRequest {
+public:
+    enum CachePolicy {
+        UseProtocolCachePolicy,  // normal load
+        ReloadIgnoringCacheData, // reload
+        ReturnCacheDataElseLoad, // back/forward or encoding change - allow stale data
+        ReturnCacheDataDontLoad, // results of a post - allow stale data and only use cache
+    };
+
+    enum TargetType {
+        TargetIsMainFrame = 0,
+        TargetIsSubFrame = 1,   // Temporary for backward compatibility.
+        TargetIsSubframe = 1,
+        TargetIsSubResource = 2,  // Temporary for backward comptibility.
+        TargetIsSubresource = 2,
+        TargetIsStyleSheet = 3,
+        TargetIsScript = 4,
+        TargetIsFontResource = 5,
+        TargetIsImage = 6,
+        TargetIsObject = 7,
+        TargetIsMedia = 8
+    };
+
+    ~WebURLRequest() { reset(); }
+
+    WebURLRequest() : m_private(0) { }
+    WebURLRequest(const WebURLRequest& r) : m_private(0) { assign(r); }
+    WebURLRequest& operator=(const WebURLRequest& r)
+    {
+        assign(r);
+        return *this;
+    }
+
+    explicit WebURLRequest(const WebURL& url) : m_private(0)
+    {
+        initialize();
+        setURL(url);
+    }
+
+    WEBKIT_API void initialize();
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebURLRequest&);
+
+    WEBKIT_API bool isNull() const;
+
+    WEBKIT_API WebURL url() const;
+    WEBKIT_API void setURL(const WebURL&);
+
+    // Used to implement third-party cookie blocking.
+    WEBKIT_API WebURL firstPartyForCookies() const;
+    WEBKIT_API void setFirstPartyForCookies(const WebURL&);
+
+    WEBKIT_API bool allowCookies() const;
+    WEBKIT_API void setAllowCookies(bool allowCookies);
+
+    // Controls whether user name, password, and cookies may be sent with the
+    // request. (If false, this overrides allowCookies.)
+    WEBKIT_API bool allowStoredCredentials() const;
+    WEBKIT_API void setAllowStoredCredentials(bool allowStoredCredentials);
+
+    WEBKIT_API CachePolicy cachePolicy() const;
+    WEBKIT_API void setCachePolicy(CachePolicy);
+
+    WEBKIT_API WebString httpMethod() const;
+    WEBKIT_API void setHTTPMethod(const WebString&);
+
+    WEBKIT_API WebString httpHeaderField(const WebString& name) const;
+    WEBKIT_API void setHTTPHeaderField(const WebString& name, const WebString& value);
+    WEBKIT_API void addHTTPHeaderField(const WebString& name, const WebString& value);
+    WEBKIT_API void clearHTTPHeaderField(const WebString& name);
+    WEBKIT_API void visitHTTPHeaderFields(WebHTTPHeaderVisitor*) const;
+
+    WEBKIT_API WebHTTPBody httpBody() const;
+    WEBKIT_API void setHTTPBody(const WebHTTPBody&);
+
+    // Controls whether upload progress events are generated when a request
+    // has a body.
+    WEBKIT_API bool reportUploadProgress() const;
+    WEBKIT_API void setReportUploadProgress(bool);
+
+    WEBKIT_API TargetType targetType() const;
+    WEBKIT_API void setTargetType(TargetType);
+
+    // A consumer controlled value intended to be used to identify the
+    // requestor.
+    WEBKIT_API int requestorID() const;
+    WEBKIT_API void setRequestorID(int);
+
+    // A consumer controlled value intended to be used to identify the
+    // process of the requestor.
+    WEBKIT_API int requestorProcessID() const;
+    WEBKIT_API void setRequestorProcessID(int);
+
+    // Allows the request to be matched up with its app cache host.
+    WEBKIT_API int appCacheHostID() const;
+    WEBKIT_API void setAppCacheHostID(int id);
+
+#if defined(WEBKIT_IMPLEMENTATION)
+    WebCore::ResourceRequest& toMutableResourceRequest();
+    const WebCore::ResourceRequest& toResourceRequest() const;
+#endif
+
+protected:
+    void assign(WebURLRequestPrivate*);
+
+private:
+    WebURLRequestPrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebURLResponse.h b/WebKit/chromium/public/WebURLResponse.h
new file mode 100644
index 0000000..cdac83c
--- /dev/null
+++ b/WebKit/chromium/public/WebURLResponse.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebURLResponse_h
+#define WebURLResponse_h
+
+#include "WebCommon.h"
+
+#if defined(WEBKIT_IMPLEMENTATION)
+namespace WebCore { class ResourceResponse; }
+#endif
+
+namespace WebKit {
+
+class WebCString;
+class WebHTTPHeaderVisitor;
+class WebString;
+class WebURL;
+class WebURLResponsePrivate;
+
+class WebURLResponse {
+public:
+    ~WebURLResponse() { reset(); }
+
+    WebURLResponse() : m_private(0) { }
+    WebURLResponse(const WebURLResponse& r) : m_private(0) { assign(r); }
+    WebURLResponse& operator=(const WebURLResponse& r)
+    {
+        assign(r);
+        return *this;
+    }
+
+    explicit WebURLResponse(const WebURL& url) : m_private(0)
+    {
+        initialize();
+        setURL(url);
+    }
+
+    WEBKIT_API void initialize();
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebURLResponse&);
+
+    WEBKIT_API bool isNull() const;
+
+    WEBKIT_API WebURL url() const;
+    WEBKIT_API void setURL(const WebURL&);
+
+    WEBKIT_API WebString mimeType() const;
+    WEBKIT_API void setMIMEType(const WebString&);
+
+    WEBKIT_API long long expectedContentLength() const;
+    WEBKIT_API void setExpectedContentLength(long long);
+
+    WEBKIT_API WebString textEncodingName() const;
+    WEBKIT_API void setTextEncodingName(const WebString&);
+
+    WEBKIT_API WebString suggestedFileName() const;
+    WEBKIT_API void setSuggestedFileName(const WebString&);
+
+    WEBKIT_API int httpStatusCode() const;
+    WEBKIT_API void setHTTPStatusCode(int);
+
+    WEBKIT_API WebString httpStatusText() const;
+    WEBKIT_API void setHTTPStatusText(const WebString&);
+
+    WEBKIT_API WebString httpHeaderField(const WebString& name) const;
+    WEBKIT_API void setHTTPHeaderField(const WebString& name, const WebString& value);
+    WEBKIT_API void addHTTPHeaderField(const WebString& name, const WebString& value);
+    WEBKIT_API void clearHTTPHeaderField(const WebString& name);
+    WEBKIT_API void visitHTTPHeaderFields(WebHTTPHeaderVisitor*) const;
+
+    WEBKIT_API double lastModifiedDate() const;
+    WEBKIT_API void setLastModifiedDate(double);
+
+    WEBKIT_API bool isContentFiltered() const;
+    WEBKIT_API void setIsContentFiltered(bool);
+
+    WEBKIT_API long long appCacheID() const;
+    WEBKIT_API void setAppCacheID(long long);
+
+    WEBKIT_API WebURL appCacheManifestURL() const;
+    WEBKIT_API void setAppCacheManifestURL(const WebURL&);
+
+    // A consumer controlled value intended to be used to record opaque
+    // security info related to this request.
+    WEBKIT_API WebCString securityInfo() const;
+    WEBKIT_API void setSecurityInfo(const WebCString&);
+
+#if defined(WEBKIT_IMPLEMENTATION)
+    WebCore::ResourceResponse& toMutableResourceResponse();
+    const WebCore::ResourceResponse& toResourceResponse() const;
+#endif
+
+protected:
+    void assign(WebURLResponsePrivate*);
+
+private:
+    WebURLResponsePrivate* m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebVector.h b/WebKit/chromium/public/WebVector.h
new file mode 100644
index 0000000..d1f99b4
--- /dev/null
+++ b/WebKit/chromium/public/WebVector.h
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebVector_h
+#define WebVector_h
+
+#include "WebCommon.h"
+
+#include <algorithm>
+
+namespace WebKit {
+
+// A simple vector class.
+//
+// Sample usage:
+//
+//   void Foo(WebVector<int>& result)
+//   {
+//       WebVector<int> data(10);
+//       for (size_t i = 0; i < data.size(); ++i)
+//           data[i] = ...
+//       result.swap(data);
+//   }
+//
+// It is also possible to assign from other types of random access
+// containers:
+//
+//   void Foo(const std::vector<std::string>& input)
+//   {
+//       WebVector<WebCString> cstrings = input;
+//       ...
+//   }
+//
+template <typename T>
+class WebVector {
+public:
+    typedef T ValueType;
+
+    ~WebVector()
+    {
+        destroy();
+    }
+
+    explicit WebVector(size_t size = 0)
+    {
+        initialize(size);
+    }
+
+    WebVector(const WebVector<T>& other)
+    {
+        initializeFrom(other.m_ptr, other.m_size);
+    }
+
+    template <typename C>
+    WebVector(const C& other)
+    {
+        initializeFrom(other.size() ? &other[0] : 0, other.size());
+    }
+
+    template <typename C>
+    WebVector<T>& operator=(const C& other)
+    {
+        if (this != reinterpret_cast<const WebVector<T>*>(&other))
+            assign(other);
+        return *this;
+    }
+
+    template <typename C>
+    void assign(const C& other)
+    {
+        assign(other.size() ? &other[0] : 0, other.size());
+    }
+
+    template <typename U>
+    void assign(const U* values, size_t size)
+    {
+        destroy();
+        initializeFrom(values, size);
+    }
+
+    size_t size() const { return m_size; }
+    bool isEmpty() const { return !m_size; }
+
+    T& operator[](size_t i) { return m_ptr[i]; }
+    const T& operator[](size_t i) const { return m_ptr[i]; }
+
+    T* data() { return m_ptr; }
+    const T* data() const { return m_ptr; }
+
+    void swap(WebVector<T>& other)
+    {
+        std::swap(m_ptr, other.m_ptr);
+        std::swap(m_size, other.m_size);
+    }
+
+private:
+    void initialize(size_t size)
+    {
+        m_size = size;
+        if (!m_size)
+            m_ptr = 0;
+        else {
+            m_ptr = static_cast<T*>(::operator new(sizeof(T) * m_size));
+            for (size_t i = 0; i < m_size; ++i)
+                new (&m_ptr[i]) T();
+        }
+    }
+
+    template <typename U>
+    void initializeFrom(const U* values, size_t size)
+    {
+        m_size = size;
+        if (!m_size)
+            m_ptr = 0;
+        else {
+            m_ptr = static_cast<T*>(::operator new(sizeof(T) * m_size));
+            for (size_t i = 0; i < m_size; ++i)
+                new (&m_ptr[i]) T(values[i]);
+        }
+    }
+
+    void destroy()
+    {
+        for (size_t i = 0; i < m_size; ++i)
+            m_ptr[i].~T();
+        ::operator delete(m_ptr);
+    }
+
+    T* m_ptr;
+    size_t m_size;
+};
+
+}  // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebView.h b/WebKit/chromium/public/WebView.h
new file mode 100644
index 0000000..5e1f15d
--- /dev/null
+++ b/WebKit/chromium/public/WebView.h
@@ -0,0 +1,265 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebView_h
+#define WebView_h
+
+#include "WebDragOperation.h"
+#include "WebWidget.h"
+
+namespace WebKit {
+
+class WebAccessibilityObject;
+class WebDevToolsAgent;
+class WebDragData;
+class WebFrame;
+class WebFrameClient;
+class WebNode;
+class WebSettings;
+class WebString;
+class WebViewClient;
+struct WebMediaPlayerAction;
+struct WebPoint;
+template <typename T> class WebVector;
+
+class WebView : public WebWidget {
+public:
+    // Initialization ------------------------------------------------------
+
+    // Creates a WebView that is NOT yet initialized.  You will need to
+    // call initializeMainFrame to finish the initialization.  It is valid
+    // to pass a null WebViewClient pointer.
+    WEBKIT_API static WebView* create(WebViewClient*);
+
+    // After creating a WebView, you should immediately call this method.
+    // You can optionally modify the settings before calling this method.
+    // The WebFrameClient will receive events for the main frame and any
+    // child frames.  It is valid to pass a null WebFrameClient pointer.
+    virtual void initializeMainFrame(WebFrameClient*) = 0;
+
+
+    // Options -------------------------------------------------------------
+
+    // The returned pointer is valid for the lifetime of the WebView.
+    virtual WebSettings* settings() = 0;
+
+    // Corresponds to the encoding of the main frame.  Setting the page
+    // encoding may cause the main frame to reload.
+    virtual WebString pageEncoding() const = 0;
+    virtual void setPageEncoding(const WebString&) = 0;
+
+    // Makes the WebView transparent.  This is useful if you want to have
+    // some custom background rendered behind it.
+    virtual bool isTransparent() const = 0;
+    virtual void setIsTransparent(bool) = 0;
+
+    // Controls whether pressing Tab key advances focus to links.
+    virtual bool tabsToLinks() const = 0;
+    virtual void setTabsToLinks(bool) = 0;
+
+    // Method that controls whether pressing Tab key cycles through page
+    // elements or inserts a '\t' char in the focused text area.
+    virtual bool tabKeyCyclesThroughElements() const = 0;
+    virtual void setTabKeyCyclesThroughElements(bool) = 0;
+
+    // Controls the WebView's active state, which may affect the rendering
+    // of elements on the page (i.e., tinting of input elements).
+    virtual bool isActive() const = 0;
+    virtual void setIsActive(bool) = 0;
+
+
+    // Closing -------------------------------------------------------------
+
+    // Runs beforeunload handlers for the current page, returning false if
+    // any handler suppressed unloading.
+    virtual bool dispatchBeforeUnloadEvent() = 0;
+
+    // Runs unload handlers for the current page.
+    virtual void dispatchUnloadEvent() = 0;
+
+
+    // Frames --------------------------------------------------------------
+
+    virtual WebFrame* mainFrame() = 0;
+
+    // Returns the frame identified by the given name.  This method
+    // supports pseudo-names like _self, _top, and _blank.  It traverses
+    // the entire frame tree containing this tree looking for a frame that
+    // matches the given name.  If the optional relativeToFrame parameter
+    // is specified, then the search begins with the given frame and its
+    // children.
+    virtual WebFrame* findFrameByName(
+        const WebString& name, WebFrame* relativeToFrame = 0) = 0;
+
+
+    // Focus ---------------------------------------------------------------
+
+    virtual WebFrame* focusedFrame() = 0;
+    virtual void setFocusedFrame(WebFrame*) = 0;
+
+    // Focus the first (last if reverse is true) focusable node.
+    virtual void setInitialFocus(bool reverse) = 0;
+
+    // Clears the focused node (and selection if a text field is focused)
+    // to ensure that a text field on the page is not eating keystrokes we
+    // send it.
+    virtual void clearFocusedNode() = 0;
+
+
+    // Zoom ----------------------------------------------------------------
+
+    // Returns the current zoom level.  0 is "original size", and each increment
+    // above or below represents zooming 20% larger or smaller to limits of 300%
+    // and 50% of original size, respectively.
+    virtual int zoomLevel() = 0;
+
+    // Changes the zoom level to the specified level, clamping at the limits
+    // noted above, and returns the current zoom level after applying the
+    // change.
+    //
+    // If |textOnly| is set, only the text will be zoomed; otherwise the entire
+    // page will be zoomed. You can only have either text zoom or full page zoom
+    // at one time.  Changing the mode while the page is zoomed will have odd
+    // effects.
+    virtual int setZoomLevel(bool textOnly, int zoomLevel) = 0;
+
+
+    // Media ---------------------------------------------------------------
+
+    // Performs the specified action on the node at the given location.
+    virtual void performMediaPlayerAction(
+        const WebMediaPlayerAction&, const WebPoint& location) = 0;
+
+
+    // Data exchange -------------------------------------------------------
+
+    // Copy to the clipboard the image located at a particular point in the
+    // WebView (if there is such an image)
+    virtual void copyImageAt(const WebPoint&) = 0;
+
+    // Notifies the WebView that a drag has terminated.
+    virtual void dragSourceEndedAt(
+        const WebPoint& clientPoint, const WebPoint& screenPoint,
+        WebDragOperation operation) = 0;
+
+    // Notfies the WebView that the system drag and drop operation has ended.
+    virtual void dragSourceSystemDragEnded() = 0;
+
+    // Callback methods when a drag-and-drop operation is trying to drop
+    // something on the WebView.
+    virtual WebDragOperation dragTargetDragEnter(
+        const WebDragData&, int identity,
+        const WebPoint& clientPoint, const WebPoint& screenPoint,
+        WebDragOperationsMask operationsAllowed) = 0;
+    virtual WebDragOperation dragTargetDragOver(
+        const WebPoint& clientPoint, const WebPoint& screenPoint,
+        WebDragOperationsMask operationsAllowed) = 0;
+    virtual void dragTargetDragLeave() = 0;
+    virtual void dragTargetDrop(
+        const WebPoint& clientPoint, const WebPoint& screenPoint) = 0;
+
+    virtual int dragIdentity() = 0;
+
+    // Helper method for drag and drop target operations: override the
+    // default drop effect with either a "copy" (accept true) or "none"
+    // (accept false) effect.  Return true on success.
+    virtual bool setDropEffect(bool accept) = 0;
+
+
+    // Support for resource loading initiated by plugins -------------------
+
+    // Returns next unused request identifier which is unique within the
+    // parent Page.
+    virtual unsigned long createUniqueIdentifierForRequest() = 0;
+
+
+    // Developer tools -----------------------------------------------------
+
+    // Inspect a particular point in the WebView.  (x = -1 || y = -1) is a
+    // special case, meaning inspect the current page and not a specific
+    // point.
+    virtual void inspectElementAt(const WebPoint&) = 0;
+
+    // Settings used by the inspector.
+    virtual WebString inspectorSettings() const = 0;
+    virtual void setInspectorSettings(const WebString&) = 0;
+
+    // The embedder may optionally engage a WebDevToolsAgent.  This may only
+    // be set once per WebView.
+    virtual WebDevToolsAgent* devToolsAgent() = 0;
+    virtual void setDevToolsAgent(WebDevToolsAgent*) = 0;
+
+
+    // Accessibility -------------------------------------------------------
+
+    // Returns the accessibility object for this view.
+    virtual WebAccessibilityObject accessibilityObject() = 0;
+
+
+    // Autofill ------------------------------------------------------------
+
+    // Notifies the WebView that autofill suggestions are available for a node.
+    virtual void applyAutofillSuggestions(
+        const WebNode&,
+        const WebVector<WebString>& suggestions,
+        int defaultSuggestionIndex) = 0;
+
+    // Hides the autofill popup if any are showing.
+    virtual void hideAutofillPopup() = 0;
+
+
+    // Context menu --------------------------------------------------------
+
+    virtual void performCustomContextMenuAction(unsigned action) = 0;
+
+
+    // Visited link state --------------------------------------------------
+
+    // Tells all WebView instances to update the visited link state for the
+    // specified hash.
+    WEBKIT_API static void updateVisitedLinkState(unsigned long long hash);
+
+    // Tells all WebView instances to update the visited state for all
+    // their links.
+    WEBKIT_API static void resetVisitedLinkState();
+
+
+    // Scrollbar colors ----------------------------------------------------
+    virtual void setScrollbarColors(unsigned inactiveColor,
+                                    unsigned activeColor,
+                                    unsigned trackColor) = 0;
+
+protected:
+    ~WebView() {}
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebViewClient.h b/WebKit/chromium/public/WebViewClient.h
new file mode 100644
index 0000000..2e2f953
--- /dev/null
+++ b/WebKit/chromium/public/WebViewClient.h
@@ -0,0 +1,278 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebViewClient_h
+#define WebViewClient_h
+
+#include "WebDragOperation.h"
+#include "WebEditingAction.h"
+#include "WebFileChooserCompletion.h"
+#include "WebString.h"
+#include "WebTextAffinity.h"
+#include "WebTextDirection.h"
+#include "WebWidgetClient.h"
+
+namespace WebKit {
+
+class WebAccessibilityObject;
+class WebDragData;
+class WebFileChooserCompletion;
+class WebFrame;
+class WebNode;
+class WebNotificationPresenter;
+class WebRange;
+class WebURL;
+class WebView;
+class WebWidget;
+struct WebConsoleMessage;
+struct WebContextMenuData;
+struct WebPoint;
+struct WebPopupMenuInfo;
+
+// Since a WebView is a WebWidget, a WebViewClient is a WebWidgetClient.
+// Virtual inheritance allows an implementation of WebWidgetClient to be
+// easily reused as part of an implementation of WebViewClient.
+class WebViewClient : virtual public WebWidgetClient {
+public:
+    // Factory methods -----------------------------------------------------
+
+    // Create a new related WebView.
+    virtual WebView* createView(WebFrame* creator) { return 0; }
+
+    // Create a new WebPopupMenu.  In the second form, the client is
+    // responsible for rendering the contents of the popup menu.
+    virtual WebWidget* createPopupMenu(bool activatable) { return 0; }
+    virtual WebWidget* createPopupMenu(const WebPopupMenuInfo&) { return 0; }
+
+
+    // Misc ----------------------------------------------------------------
+
+    // A new message was added to the console.
+    virtual void didAddMessageToConsole(
+        const WebConsoleMessage&, const WebString& sourceName, unsigned sourceLine) { }
+
+    // Called when script in the page calls window.print().  If frame is
+    // non-null, then it selects a particular frame, including its
+    // children, to print.  Otherwise, the main frame and its children
+    // should be printed.
+    virtual void printPage(WebFrame*) { }
+
+    // Called to retrieve the provider of desktop notifications.
+    virtual WebNotificationPresenter* notificationPresenter() { return 0; }
+
+
+    // Navigational --------------------------------------------------------
+
+    // These notifications bracket any loading that occurs in the WebView.
+    virtual void didStartLoading() { }
+    virtual void didStopLoading() { }
+
+
+    // Editing -------------------------------------------------------------
+
+    // These methods allow the client to intercept and overrule editing
+    // operations.
+    virtual bool shouldBeginEditing(const WebRange&) { return true; }
+    virtual bool shouldEndEditing(const WebRange&) { return true; }
+    virtual bool shouldInsertNode(
+        const WebNode&, const WebRange&, WebEditingAction) { return true; }
+    virtual bool shouldInsertText(
+        const WebString&, const WebRange&, WebEditingAction) { return true; }
+    virtual bool shouldChangeSelectedRange(
+        const WebRange& from, const WebRange& to, WebTextAffinity,
+        bool stillSelecting) { return true; }
+    virtual bool shouldDeleteRange(const WebRange&) { return true; }
+    virtual bool shouldApplyStyle(const WebString& style, const WebRange&) { return true; }
+
+    virtual bool isSmartInsertDeleteEnabled() { return true; }
+    virtual bool isSelectTrailingWhitespaceEnabled() { return true; }
+    virtual void setInputMethodEnabled(bool enabled) { }
+
+    virtual void didBeginEditing() { }
+    virtual void didChangeSelection(bool isSelectionEmpty) { }
+    virtual void didChangeContents() { }
+    virtual void didExecuteCommand(const WebString& commandName) { }
+    virtual void didEndEditing() { }
+
+    // This method is called in response to WebView's handleInputEvent()
+    // when the default action for the current keyboard event is not
+    // suppressed by the page, to give the embedder a chance to handle
+    // the keyboard event specially.
+    //
+    // Returns true if the keyboard event was handled by the embedder,
+    // indicating that the default action should be suppressed.
+    virtual bool handleCurrentKeyboardEvent() { return false; }
+
+
+    // Spellchecker --------------------------------------------------------
+
+    // The client should perform spell-checking on the given text.  If the
+    // text contains a misspelled word, then upon return misspelledOffset
+    // will point to the start of the misspelled word, and misspelledLength
+    // will indicates its length.  Otherwise, if there was not a spelling
+    // error, then upon return misspelledLength is 0.
+    virtual void spellCheck(
+        const WebString& text, int& misspelledOffset, int& misspelledLength) { }
+
+    // Computes an auto-corrected replacement for a misspelled word.  If no
+    // replacement is found, then an empty string is returned.
+    virtual WebString autoCorrectWord(const WebString& misspelledWord) { return WebString(); }
+
+    // Show or hide the spelling UI.
+    virtual void showSpellingUI(bool show) { }
+
+    // Returns true if the spelling UI is showing.
+    virtual bool isShowingSpellingUI() { return false; }
+
+    // Update the spelling UI with the given word.
+    virtual void updateSpellingUIWithMisspelledWord(const WebString& word) { }
+
+
+    // Dialogs -------------------------------------------------------------
+
+    // This method returns immediately after showing the dialog. When the
+    // dialog is closed, it should call the WebFileChooserCompletion to
+    // pass the results of the dialog. Returns false if
+    // WebFileChooseCompletion will never be called.
+    virtual bool runFileChooser(
+        bool multiSelect, const WebString& title,
+        const WebString& initialValue, WebFileChooserCompletion*) { return false; }
+
+    // Displays a modal alert dialog containing the given message.  Returns
+    // once the user dismisses the dialog.
+    virtual void runModalAlertDialog(
+        WebFrame*, const WebString& message) { }
+
+    // Displays a modal confirmation dialog with the given message as
+    // description and OK/Cancel choices.  Returns true if the user selects
+    // 'OK' or false otherwise.
+    virtual bool runModalConfirmDialog(
+        WebFrame*, const WebString& message) { return false; }
+
+    // Displays a modal input dialog with the given message as description
+    // and OK/Cancel choices.  The input field is pre-filled with
+    // defaultValue.  Returns true if the user selects 'OK' or false
+    // otherwise.  Upon returning true, actualValue contains the value of
+    // the input field.
+    virtual bool runModalPromptDialog(
+        WebFrame*, const WebString& message, const WebString& defaultValue,
+        WebString* actualValue) { return false; }
+
+    // Displays a modal confirmation dialog containing the given message as
+    // description and OK/Cancel choices, where 'OK' means that it is okay
+    // to proceed with closing the view.  Returns true if the user selects
+    // 'OK' or false otherwise.
+    virtual bool runModalBeforeUnloadDialog(
+        WebFrame*, const WebString& message) { return true; }
+
+
+    // UI ------------------------------------------------------------------
+
+    // Called when script modifies window.status
+    virtual void setStatusText(const WebString&) { }
+
+    // Called when hovering over an anchor with the given URL.
+    virtual void setMouseOverURL(const WebURL&) { }
+
+    // Called when keyboard focus switches to an anchor with the given URL.
+    virtual void setKeyboardFocusURL(const WebURL&) { }
+
+    // Called when a tooltip should be shown at the current cursor position.
+    virtual void setToolTipText(const WebString&, WebTextDirection hint) { }
+
+    // Shows a context menu with commands relevant to a specific element on
+    // the given frame. Additional context data is supplied.
+    virtual void showContextMenu(WebFrame*, const WebContextMenuData&) { }
+
+    // Called when a drag-n-drop operation should begin.
+    virtual void startDragging(
+        const WebPoint& from, const WebDragData&, WebDragOperationsMask) { }
+
+    // Called to determine if drag-n-drop operations may initiate a page
+    // navigation.
+    virtual bool acceptsLoadDrops() { return true; }
+
+    // Take focus away from the WebView by focusing an adjacent UI element
+    // in the containing window.
+    virtual void focusNext() { }
+    virtual void focusPrevious() { }
+
+
+    // Session history -----------------------------------------------------
+
+    // Tells the embedder to navigate back or forward in session history by
+    // the given offset (relative to the current position in session
+    // history).
+    virtual void navigateBackForwardSoon(int offset) { }
+
+    // Returns the number of history items before/after the current
+    // history item.
+    virtual int historyBackListCount() { return 0; }
+    virtual int historyForwardListCount() { return 0; }
+
+    // Called to notify the embedder when a new history item is added.
+    virtual void didAddHistoryItem() { }
+
+
+    // Accessibility -------------------------------------------------------
+
+    // Notifies embedder that the focus has changed to the given
+    // accessibility object.
+    virtual void focusAccessibilityObject(const WebAccessibilityObject&) { }
+
+
+    // Developer tools -----------------------------------------------------
+
+    // Called to notify the client that the inspector's settings were
+    // changed and should be saved.  See WebView::inspectorSettings.
+    virtual void didUpdateInspectorSettings() { }
+
+
+    // Autofill ------------------------------------------------------------
+
+    // Queries the browser for suggestions to be shown for the form text
+    // field named |name|.  |value| is the text entered by the user so
+    // far and the WebNode corresponds to the input field.
+    virtual void queryAutofillSuggestions(const WebNode&,
+                                          const WebString& name,
+                                          const WebString& value) { }
+
+    // Instructs the browser to remove the autofill entry specified from
+    // its DB.
+    virtual void removeAutofillSuggestions(const WebString& name,
+                                           const WebString& value) { }
+
+protected:
+    ~WebViewClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebWidget.h b/WebKit/chromium/public/WebWidget.h
new file mode 100644
index 0000000..9dfeefc
--- /dev/null
+++ b/WebKit/chromium/public/WebWidget.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebWidget_h
+#define WebWidget_h
+
+#include "WebCanvas.h"
+#include "WebCommon.h"
+#include "WebCompositionCommand.h"
+#include "WebTextDirection.h"
+
+namespace WebKit {
+
+class WebInputEvent;
+class WebString;
+struct WebRect;
+struct WebSize;
+
+class WebWidget {
+public:
+    // This method closes and deletes the WebWidget.
+    virtual void close() = 0;
+
+    // Returns the current size of the WebWidget.
+    virtual WebSize size() = 0;
+
+    // Called to resize the WebWidget.
+    virtual void resize(const WebSize&) = 0;
+
+    // Called to layout the WebWidget.  This MUST be called before Paint,
+    // and it may result in calls to WebWidgetClient::didInvalidateRect.
+    virtual void layout() = 0;
+
+    // Called to paint the specified region of the WebWidget onto the given
+    // canvas.  You MUST call Layout before calling this method.  It is
+    // okay to call paint multiple times once layout has been called,
+    // assuming no other changes are made to the WebWidget (e.g., once
+    // events are processed, it should be assumed that another call to
+    // layout is warranted before painting again).
+    virtual void paint(WebCanvas*, const WebRect&) = 0;
+
+    // Called to inform the WebWidget of an input event.  Returns true if
+    // the event has been processed, false otherwise.
+    virtual bool handleInputEvent(const WebInputEvent&) = 0;
+
+    // Called to inform the WebWidget that mouse capture was lost.
+    virtual void mouseCaptureLost() = 0;
+
+    // Called to inform the WebWidget that it has gained or lost keyboard focus.
+    virtual void setFocus(bool) = 0;
+
+    // Called to inform the WebWidget of a composition event.
+    virtual bool handleCompositionEvent(WebCompositionCommand command,
+                                        int cursorPosition,
+                                        int targetStart,
+                                        int targetEnd,
+                                        const WebString& text) = 0;
+
+    // Retrieve the status of this WebWidget required by IME APIs.  Upon
+    // success enabled and caretBounds are set.
+    virtual bool queryCompositionStatus(bool* enabled, WebRect* caretBounds) = 0;
+
+    // Changes the text direction of the selected input node.
+    virtual void setTextDirection(WebTextDirection) = 0;
+
+protected:
+    ~WebWidget() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebWidgetClient.h b/WebKit/chromium/public/WebWidgetClient.h
new file mode 100644
index 0000000..06d9eba
--- /dev/null
+++ b/WebKit/chromium/public/WebWidgetClient.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebWidgetClient_h
+#define WebWidgetClient_h
+
+#include "WebCommon.h"
+#include "WebNavigationPolicy.h"
+#include "WebRect.h"
+#include "WebScreenInfo.h"
+
+namespace WebKit {
+
+class WebWidget;
+struct WebCursorInfo;
+
+class WebWidgetClient {
+public:
+    // Called when a region of the WebWidget needs to be re-painted.
+    virtual void didInvalidateRect(const WebRect&) { }
+
+    // Called when a region of the WebWidget, given by clipRect, should be
+    // scrolled by the specified dx and dy amounts.
+    virtual void didScrollRect(int dx, int dy, const WebRect& clipRect) { }
+
+    // Called when the widget acquires or loses focus, respectively.
+    virtual void didFocus() { }
+    virtual void didBlur() { }
+
+    // Called when the cursor for the widget changes.
+    virtual void didChangeCursor(const WebCursorInfo&) { }
+
+    // Called when the widget should be closed.  WebWidget::close() should
+    // be called asynchronously as a result of this notification.
+    virtual void closeWidgetSoon() { }
+
+    // Called to show the widget according to the given policy.
+    virtual void show(WebNavigationPolicy) { }
+
+    // Called to block execution of the current thread until the widget is
+    // closed.
+    virtual void runModal() { }
+
+    // Called to get/set the position of the widget in screen coordinates.
+    virtual WebRect windowRect() { return WebRect(); }
+    virtual void setWindowRect(const WebRect&) { }
+
+    // Called to get the position of the resizer rect in window coordinates.
+    virtual WebRect windowResizerRect() { return WebRect(); }
+
+    // Called to get the position of the root window containing the widget
+    // in screen coordinates.
+    virtual WebRect rootWindowRect() { return WebRect(); }
+
+    // Called to query information about the screen where this widget is
+    // displayed.
+    virtual WebScreenInfo screenInfo() { return WebScreenInfo(); }
+
+protected:
+    ~WebWidgetClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebWorker.h b/WebKit/chromium/public/WebWorker.h
new file mode 100644
index 0000000..9397bcd
--- /dev/null
+++ b/WebKit/chromium/public/WebWorker.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebWorker_h
+#define WebWorker_h
+
+#include "WebMessagePortChannel.h"
+
+namespace WebKit {
+
+class WebString;
+class WebURL;
+class WebWorkerClient;
+
+// Provides an interface to the script execution context for a worker.
+class WebWorker {
+public:
+    // Instantiates a built-in WebWorker.
+    WEBKIT_API static WebWorker* create(WebWorkerClient*);
+
+    virtual ~WebWorker() { }
+    virtual void startWorkerContext(const WebURL& scriptURL,
+                                    const WebString& userAgent,
+                                    const WebString& sourceCode) = 0;
+    virtual void terminateWorkerContext() = 0;
+    virtual void postMessageToWorkerContext(
+        const WebString&,
+        const WebMessagePortChannelArray&) = 0;
+    virtual void workerObjectDestroyed() = 0;
+    virtual void clientDestroyed() = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebWorkerClient.h b/WebKit/chromium/public/WebWorkerClient.h
new file mode 100644
index 0000000..eb2e63e
--- /dev/null
+++ b/WebKit/chromium/public/WebWorkerClient.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebWorkerClient_h
+#define WebWorkerClient_h
+
+#include "WebCommonWorkerClient.h"
+#include "WebMessagePortChannel.h"
+
+namespace WebKit {
+
+class WebNotificationPresenter;
+class WebString;
+class WebWorker;
+
+// Provides an interface back to the in-page script object for a worker.
+// All functions are expected to be called back on the thread that created
+// the Worker object, unless noted.
+class WebWorkerClient : public WebCommonWorkerClient {
+public:
+    virtual void postMessageToWorkerObject(
+        const WebString&,
+        const WebMessagePortChannelArray&) = 0;
+
+    virtual void confirmMessageFromWorkerObject(bool hasPendingActivity) = 0;
+    virtual void reportPendingActivity(bool hasPendingActivity) = 0;
+
+protected:
+    ~WebWorkerClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/gtk/WebFontInfo.h b/WebKit/chromium/public/gtk/WebFontInfo.h
new file mode 100644
index 0000000..ad37680
--- /dev/null
+++ b/WebKit/chromium/public/gtk/WebFontInfo.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFontInfo_h
+#define WebFontInfo_h
+
+#include "../WebCString.h"
+
+#include <string.h>
+#include <unistd.h>
+
+namespace WebKit {
+
+class WebFontInfo {
+public:
+    // Return a font family which provides glyphs for the Unicode code points
+    // specified by |utf16|
+    //   characters: a native-endian UTF16 string
+    //   numCharacters: the number of 16-bit words in |utf16|
+    //
+    // Returns: the font family or an empty string if the request could not be
+    // satisfied.
+    WEBKIT_API static WebCString familyForChars(const WebUChar* characters, size_t numCharacters);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/gtk/WebInputEventFactory.h b/WebKit/chromium/public/gtk/WebInputEventFactory.h
new file mode 100644
index 0000000..463bd28
--- /dev/null
+++ b/WebKit/chromium/public/gtk/WebInputEventFactory.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebInputEventFactory_h
+#define WebInputEventFactory_h
+
+#include "../WebCommon.h"
+
+typedef struct _GdkEventButton GdkEventButton;
+typedef struct _GdkEventMotion GdkEventMotion;
+typedef struct _GdkEventCrossing GdkEventCrossing;
+typedef struct _GdkEventScroll GdkEventScroll;
+typedef struct _GdkEventKey GdkEventKey;
+
+namespace WebKit {
+
+class WebKeyboardEvent;
+class WebMouseEvent;
+class WebMouseWheelEvent;
+
+class WebInputEventFactory {
+public:
+    WEBKIT_API static WebKeyboardEvent keyboardEvent(const GdkEventKey*);
+    WEBKIT_API static WebKeyboardEvent keyboardEvent(wchar_t character, int state, double timeStampSeconds);
+    WEBKIT_API static WebMouseEvent mouseEvent(const GdkEventButton*);
+    WEBKIT_API static WebMouseEvent mouseEvent(const GdkEventMotion*);
+    WEBKIT_API static WebMouseEvent mouseEvent(const GdkEventCrossing*);
+    WEBKIT_API static WebMouseWheelEvent mouseWheelEvent(const GdkEventScroll*);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/gtk/WebScreenInfoFactory.h b/WebKit/chromium/public/gtk/WebScreenInfoFactory.h
new file mode 100644
index 0000000..c964741
--- /dev/null
+++ b/WebKit/chromium/public/gtk/WebScreenInfoFactory.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScreenInfoFactory_h
+#define WebScreenInfoFactory_h
+
+#include "../WebCommon.h"
+
+typedef struct _GtkWidget GtkWidget;
+
+namespace WebKit {
+
+struct WebScreenInfo;
+
+class WebScreenInfoFactory {
+public:
+    WEBKIT_API static WebScreenInfo screenInfo(GtkWidget*);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/linux/WebFontRendering.h b/WebKit/chromium/public/linux/WebFontRendering.h
new file mode 100644
index 0000000..9b61bdc
--- /dev/null
+++ b/WebKit/chromium/public/linux/WebFontRendering.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFontRendering_h
+#define WebFontRendering_h
+
+#include "../WebCommon.h"
+#include <SkFontHost.h>
+#include <SkPaint.h>
+
+namespace WebKit {
+
+class WebFontRendering {
+public:
+    // Set global font renderering preferences.
+
+    WEBKIT_API static void setHinting(SkPaint::Hinting);
+    WEBKIT_API static void setAntiAlias(bool on);
+    WEBKIT_API static void setSubpixelGlyphs(bool on);
+    WEBKIT_API static void setLCDOrder(SkFontHost::LCDOrder);
+    WEBKIT_API static void setLCDOrientation(SkFontHost::LCDOrientation);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/linux/WebSandboxSupport.h b/WebKit/chromium/public/linux/WebSandboxSupport.h
new file mode 100644
index 0000000..5edceb2
--- /dev/null
+++ b/WebKit/chromium/public/linux/WebSandboxSupport.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSandboxSupport_h
+#define WebSandboxSupport_h
+
+#include "../WebCommon.h"
+#include "../WebString.h"
+
+namespace WebKit {
+
+// Put methods here that are required due to sandbox restrictions.
+class WebSandboxSupport {
+public:
+    // Fonts ---------------------------------------------------------------
+
+    // Get a font family which contains glyphs for the given Unicode
+    // code-points.
+    //   characters: a UTF-16 encoded string
+    //   numCharacters: the number of 16-bit words in |characters|
+    //
+    // Returns a string with the font family on an empty string if the
+    // request cannot be satisfied.
+    virtual WebString getFontFamilyForCharacters(const WebUChar* characters, size_t numCharacters) = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/mac/WebInputEventFactory.h b/WebKit/chromium/public/mac/WebInputEventFactory.h
new file mode 100644
index 0000000..cbf213c
--- /dev/null
+++ b/WebKit/chromium/public/mac/WebInputEventFactory.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebInputEventFactory_h
+#define WebInputEventFactory_h
+
+#include "../WebCommon.h"
+
+#ifdef __OBJC__
+@class NSEvent;
+@class NSView;
+#else
+class NSEvent;
+class NSView;
+#endif
+
+namespace WebKit {
+
+class WebKeyboardEvent;
+class WebMouseEvent;
+class WebMouseWheelEvent;
+
+class WebInputEventFactory {
+public:
+    WEBKIT_API static WebKeyboardEvent keyboardEvent(NSEvent*);
+    WEBKIT_API static WebKeyboardEvent keyboardEvent(wchar_t character, int modifiers, double timeStampSeconds);
+    WEBKIT_API static WebMouseEvent mouseEvent(NSEvent*, NSView*);
+    WEBKIT_API static WebMouseWheelEvent mouseWheelEvent(NSEvent*, NSView*);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/mac/WebScreenInfoFactory.h b/WebKit/chromium/public/mac/WebScreenInfoFactory.h
new file mode 100644
index 0000000..485e77f
--- /dev/null
+++ b/WebKit/chromium/public/mac/WebScreenInfoFactory.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScreenInfoFactory_h
+#define WebScreenInfoFactory_h
+
+#include "../WebCommon.h"
+
+#ifdef __OBJC__
+@class NSView;
+#else
+class NSView;
+#endif
+
+namespace WebKit {
+
+struct WebScreenInfo;
+
+class WebScreenInfoFactory {
+public:
+    WEBKIT_API static WebScreenInfo screenInfo(NSView*);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/win/WebInputEventFactory.h b/WebKit/chromium/public/win/WebInputEventFactory.h
new file mode 100644
index 0000000..ae02464
--- /dev/null
+++ b/WebKit/chromium/public/win/WebInputEventFactory.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebInputEventFactory_h
+#define WebInputEventFactory_h
+
+#include "../WebCommon.h"
+
+#include <windows.h>
+
+namespace WebKit {
+
+class WebKeyboardEvent;
+class WebMouseEvent;
+class WebMouseWheelEvent;
+
+class WebInputEventFactory {
+public:
+    WEBKIT_API static WebKeyboardEvent keyboardEvent(HWND, UINT, WPARAM, LPARAM);
+    WEBKIT_API static WebMouseEvent mouseEvent(HWND, UINT, WPARAM, LPARAM);
+    WEBKIT_API static WebMouseWheelEvent mouseWheelEvent(HWND, UINT, WPARAM, LPARAM);
+
+    // Windows only provides information on whether a click was a single or
+    // double click, while we need to know the click count past two. The
+    // WebInputEventFactory keeps internal state to allow it to synthesize
+    // that information. In some cases, like fast-running tests, that
+    // information is known to be stale and needs to be reset; that is the
+    // function of resetLastClickState().
+    WEBKIT_API static void resetLastClickState();
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/win/WebSandboxSupport.h b/WebKit/chromium/public/win/WebSandboxSupport.h
new file mode 100644
index 0000000..88d5362
--- /dev/null
+++ b/WebKit/chromium/public/win/WebSandboxSupport.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSandboxSupport_h
+#define WebSandboxSupport_h
+
+typedef struct HFONT__* HFONT;
+
+namespace WebKit {
+
+// Put methods here that are required due to sandbox restrictions.
+class WebSandboxSupport {
+public:
+    // Sometimes a Win32 API call will fail because a font is not loaded,
+    // and due to sandbox restrictions, the current process may be unable
+    // to access the filesystem to load the font.  So, this call serves as
+    // a failover to ask the embedder to try some other way to load the
+    // font (usually by delegating to an empowered process to have it load
+    // the font).  Returns true if the font was successfully loaded.
+    virtual bool ensureFontLoaded(HFONT) = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/win/WebScreenInfoFactory.h b/WebKit/chromium/public/win/WebScreenInfoFactory.h
new file mode 100644
index 0000000..a7040ea
--- /dev/null
+++ b/WebKit/chromium/public/win/WebScreenInfoFactory.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScreenInfoFactory_h
+#define WebScreenInfoFactory_h
+
+#include "../WebCommon.h"
+
+typedef struct HWND__* HWND;
+
+namespace WebKit {
+
+struct WebScreenInfo;
+
+class WebScreenInfoFactory {
+public:
+    WEBKIT_API static WebScreenInfo screenInfo(HWND);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/win/WebThemeEngine.h b/WebKit/chromium/public/win/WebThemeEngine.h
new file mode 100644
index 0000000..b563608
--- /dev/null
+++ b/WebKit/chromium/public/win/WebThemeEngine.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebThemeEngine_h
+#define WebThemeEngine_h
+
+#include "../WebCanvas.h"
+#include "../WebColor.h"
+
+namespace WebKit {
+
+struct WebRect;
+
+// The part and state parameters correspond to values defined by the
+// Windows Theme API (see
+// http://msdn.microsoft.com/en-us/library/bb773187(VS.85).aspx ).
+// The classicState parameter corresponds to the uState
+// parameter of the Windows DrawFrameControl() function.
+// See the definitions in <vsstyle.h> and <winuser.h>.
+class WebThemeEngine {
+public:
+    virtual void paintButton(
+        WebCanvas*, int part, int state, int classicState,
+        const WebRect&) = 0;
+
+    virtual void paintMenuList(
+        WebCanvas*, int part, int state, int classicState,
+        const WebRect&) = 0;
+
+    virtual void paintScrollbarArrow(
+        WebCanvas*, int state, int classicState,
+        const WebRect&) = 0;
+
+    virtual void paintScrollbarThumb(
+        WebCanvas*, int part, int state, int classicState,
+        const WebRect&) = 0;
+
+    virtual void paintScrollbarTrack(
+        WebCanvas*, int part, int state, int classicState,
+        const WebRect&, const WebRect& alignRect) = 0;
+
+    virtual void paintTextField(
+        WebCanvas*, int part, int state, int classicState,
+        const WebRect&, WebColor, bool fillContentArea, bool drawEdges) = 0;
+
+    virtual void paintTrackbar(
+        WebCanvas*, int part, int state, int classicState,
+        const WebRect&) = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/x11/WebScreenInfoFactory.h b/WebKit/chromium/public/x11/WebScreenInfoFactory.h
new file mode 100644
index 0000000..5e30da8
--- /dev/null
+++ b/WebKit/chromium/public/x11/WebScreenInfoFactory.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScreenInfoFactory_h
+#define WebScreenInfoFactory_h
+
+#include "../WebCommon.h"
+
+typedef struct _XDisplay Display;
+
+namespace WebKit {
+
+struct WebScreenInfo;
+
+class WebScreenInfoFactory {
+public:
+    WEBKIT_API static WebScreenInfo screenInfo(Display*, int screenNumber);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/ApplicationCacheHost.cpp b/WebKit/chromium/src/ApplicationCacheHost.cpp
new file mode 100644
index 0000000..ef8f860
--- /dev/null
+++ b/WebKit/chromium/src/ApplicationCacheHost.cpp
@@ -0,0 +1,256 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ApplicationCacheHost.h"
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+
+#include "DocumentLoader.h"
+#include "DOMApplicationCache.h"
+#include "Frame.h"
+#include "Settings.h"
+#include "WebApplicationCacheHost.h"
+#include "WebApplicationCacheHostClient.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebURL.h"
+#include "WebURLError.h"
+#include "WebURLResponse.h"
+#include "WrappedResourceRequest.h"
+#include "WrappedResourceResponse.h"
+
+using namespace WebKit;
+
+namespace WebCore {
+
+// ApplicationCacheHostInternal -----------------------------------------------
+
+class ApplicationCacheHostInternal : public WebApplicationCacheHostClient {
+public:
+    ApplicationCacheHostInternal(ApplicationCacheHost* host)
+        : m_innerHost(host)
+    {
+        m_outerHost.set(WebKit::webKitClient()->createApplicationCacheHost(this));
+    }
+
+    virtual void notifyEventListener(WebApplicationCacheHost::EventID eventID)
+    {
+        m_innerHost->notifyDOMApplicationCache(
+            static_cast<ApplicationCacheHost::EventID>(eventID));
+    }
+
+    ApplicationCacheHost* m_innerHost;
+    OwnPtr<WebApplicationCacheHost> m_outerHost;
+};
+
+// ApplicationCacheHost -------------------------------------------------------
+// We provide a custom implementation of this class that calls out to the
+// embedding application instead of using WebCore's built in appcache system.
+// This file replaces webcore/appcache/ApplicationCacheHost.cpp in our build.
+
+ApplicationCacheHost::ApplicationCacheHost(DocumentLoader* documentLoader)
+    : m_domApplicationCache(0)
+    , m_documentLoader(documentLoader)
+{
+    ASSERT(m_documentLoader);
+}
+
+ApplicationCacheHost::~ApplicationCacheHost()
+{
+}
+
+void ApplicationCacheHost::maybeLoadMainResource(ResourceRequest& request, SubstituteData&)
+{
+    // We defer creating the outer host object to avoid spurious creation/destruction
+    // around creating empty documents. At this point, we're initiating a main resource
+    // load for the document, so its for real.
+
+    if (!isApplicationCacheEnabled())
+        return;
+
+    m_internal.set(new ApplicationCacheHostInternal(this));
+    if (m_internal->m_outerHost) {
+        WrappedResourceRequest wrapped(request);
+        m_internal->m_outerHost->willStartMainResourceRequest(wrapped);
+    } else
+        m_internal.clear();
+
+    // NOTE: The semantics of this method, and others in this interface, are subtly different
+    // than the method names would suggest. For example, in this method never returns an appcached
+    // response in the SubstituteData out argument, instead we return the appcached response thru
+    // the usual resource loading pipeline.
+}
+
+void ApplicationCacheHost::selectCacheWithoutManifest()
+{
+    if (m_internal)
+        m_internal->m_outerHost->selectCacheWithoutManifest();
+}
+
+void ApplicationCacheHost::selectCacheWithManifest(const KURL& manifestURL)
+{
+    if (m_internal) {
+        if (!m_internal->m_outerHost->selectCacheWithManifest(manifestURL)) {
+            // It's a foreign entry, restart the current navigation from the top
+            // of the navigation algorithm. The navigation will not result in the
+            // same resource being loaded, because "foreign" entries are never picked
+            // during navigation.
+            // see WebCore::ApplicationCacheGroup::selectCache()
+            const KURL& docURL = m_documentLoader->frame()->document()->url();
+            String referrer = m_documentLoader->frameLoader()->referrer();
+            m_documentLoader->frame()->redirectScheduler()->scheduleLocationChange(docURL, referrer);
+        }
+    }
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForMainResponse(const ResourceRequest&, const ResourceResponse& response)
+{
+    if (m_internal) {
+        WrappedResourceResponse wrapped(response);
+        m_internal->m_outerHost->didReceiveResponseForMainResource(wrapped);
+    }
+    return false;
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForMainError(const ResourceRequest&, const ResourceError& error)
+{
+    // N/A to the chromium port
+    return false;
+}
+
+void ApplicationCacheHost::mainResourceDataReceived(const char* data, int length, long long, bool)
+{
+    if (m_internal)
+        m_internal->m_outerHost->didReceiveDataForMainResource(data, length);
+}
+
+void ApplicationCacheHost::failedLoadingMainResource()
+{
+    if (m_internal)
+        m_internal->m_outerHost->didFinishLoadingMainResource(false);
+}
+
+void ApplicationCacheHost::finishedLoadingMainResource()
+{
+    if (m_internal)
+        m_internal->m_outerHost->didFinishLoadingMainResource(true);
+}
+
+bool ApplicationCacheHost::maybeLoadResource(ResourceLoader*, ResourceRequest& request, const KURL&)
+{
+    // FIXME: look into the purpose of the unused KURL& originalURL parameter
+    if (m_internal) {
+        WrappedResourceRequest wrapped(request);
+        m_internal->m_outerHost->willStartSubResourceRequest(wrapped);
+    }
+    return false;
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForRedirect(ResourceLoader*, ResourceRequest&, const ResourceResponse&)
+{
+    // N/A to the chromium port
+    return false;
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForResponse(ResourceLoader*, const ResourceResponse&)
+{
+    // N/A to the chromium port
+    return false;
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForError(ResourceLoader*, const ResourceError&)
+{
+    // N/A to the chromium port
+    return false;
+}
+
+bool ApplicationCacheHost::maybeLoadSynchronously(ResourceRequest& request, ResourceError&, ResourceResponse&, Vector<char>&)
+{
+    if (m_internal) {
+        WrappedResourceRequest wrapped(request);
+        m_internal->m_outerHost->willStartSubResourceRequest(wrapped);
+    }
+    return false;
+}
+
+void ApplicationCacheHost::maybeLoadFallbackSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>&)
+{
+    // N/A to the chromium port
+}
+
+bool ApplicationCacheHost::canCacheInPageCache() const
+{
+    // N/A to the chromium port which doesn't use the page cache.
+    return false;
+}
+
+void ApplicationCacheHost::setDOMApplicationCache(DOMApplicationCache* domApplicationCache)
+{
+    ASSERT(!m_domApplicationCache || !domApplicationCache);
+    m_domApplicationCache = domApplicationCache;
+}
+
+void ApplicationCacheHost::notifyDOMApplicationCache(EventID id)
+{
+    if (m_domApplicationCache) {
+        ExceptionCode ec = 0;
+        m_domApplicationCache->dispatchEvent(
+            Event::create(DOMApplicationCache::toEventType(id), false, false),
+            ec);
+        ASSERT(!ec);
+    }
+}
+
+ApplicationCacheHost::Status ApplicationCacheHost::status() const
+{
+    return m_internal ? static_cast<Status>(m_internal->m_outerHost->status()) : UNCACHED;
+}
+
+bool ApplicationCacheHost::update()
+{
+    return m_internal ? m_internal->m_outerHost->startUpdate() : false;
+}
+
+bool ApplicationCacheHost::swapCache()
+{
+    return m_internal ? m_internal->m_outerHost->swapCache() : false;
+}
+
+bool ApplicationCacheHost::isApplicationCacheEnabled()
+{
+    ASSERT(m_documentLoader->frame());
+    return m_documentLoader->frame()->settings()
+           && m_documentLoader->frame()->settings()->offlineWebApplicationCacheEnabled();
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/WebKit/chromium/src/AssertMatchingEnums.cpp b/WebKit/chromium/src/AssertMatchingEnums.cpp
new file mode 100644
index 0000000..35e2057
--- /dev/null
+++ b/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -0,0 +1,279 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Use this file to assert that various WebKit API enum values continue
+// matching WebCore defined enum values.
+
+#include "config.h"
+
+#include "AccessibilityObject.h"
+#include "ApplicationCacheHost.h"
+#include "EditorInsertAction.h"
+#include "HTMLInputElement.h"
+#include "MediaPlayer.h"
+#include "NotificationPresenter.h"
+#include "PasteboardPrivate.h"
+#include "PlatformCursor.h"
+#include "StringImpl.h"
+#include "TextAffinity.h"
+#include "WebAccessibilityObject.h"
+#include "WebApplicationCacheHost.h"
+#include "WebClipboard.h"
+#include "WebCursorInfo.h"
+#include "WebEditingAction.h"
+#include "WebInputElement.h"
+#include "WebMediaPlayer.h"
+#include "WebNotificationPresenter.h"
+#include "WebTextAffinity.h"
+#include "WebTextCaseSensitivity.h"
+#include <wtf/Assertions.h>
+
+#define COMPILE_ASSERT_MATCHING_ENUM(webkit_name, webcore_name) \
+    COMPILE_ASSERT(int(WebKit::webkit_name) == int(WebCore::webcore_name), mismatching_enums)
+
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleUnknown, UnknownRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleButton, ButtonRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleRadioButton, RadioButtonRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleCheckBox, CheckBoxRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleSlider, SliderRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTabGroup, TabGroupRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTextField, TextFieldRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleStaticText, StaticTextRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTextArea, TextAreaRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleScrollArea, ScrollAreaRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRolePopUpButton, PopUpButtonRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleMenuButton, MenuButtonRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTable, TableRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleApplication, ApplicationRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleGroup, GroupRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleRadioGroup, RadioGroupRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleList, ListRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleScrollBar, ScrollBarRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleValueIndicator, ValueIndicatorRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleImage, ImageRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleMenuBar, MenuBarRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleMenu, MenuRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleMenuItem, MenuItemRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleColumn, ColumnRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleRow, RowRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleToolbar, ToolbarRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleBusyIndicator, BusyIndicatorRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleProgressIndicator, ProgressIndicatorRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleWindow, WindowRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDrawer, DrawerRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleSystemWide, SystemWideRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleOutline, OutlineRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleIncrementor, IncrementorRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleBrowser, BrowserRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleComboBox, ComboBoxRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleSplitGroup, SplitGroupRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleSplitter, SplitterRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleColorWell, ColorWellRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleGrowArea, GrowAreaRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleSheet, SheetRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleHelpTag, HelpTagRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleMatte, MatteRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleRuler, RulerRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleRulerMarker, RulerMarkerRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLink, LinkRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDisclosureTriangle, DisclosureTriangleRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleGrid, GridRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleCell, CellRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleColumnHeader, ColumnHeaderRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleRowHeader, RowHeaderRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleWebCoreLink, WebCoreLinkRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleImageMapLink, ImageMapLinkRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleImageMap, ImageMapRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleListMarker, ListMarkerRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleWebArea, WebAreaRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleHeading, HeadingRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleListBox, ListBoxRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleListBoxOption, ListBoxOptionRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTableHeaderContainer, TableHeaderContainerRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDefinitionListTerm, DefinitionListTermRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDefinitionListDefinition, DefinitionListDefinitionRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleAnnotation, AnnotationRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleSliderThumb, SliderThumbRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleIgnored, IgnoredRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTab, TabRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTabList, TabListRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTabPanel, TabPanelRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTreeRole, TreeRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTreeItemRole, TreeItemRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDirectory, DirectoryRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkApplication, LandmarkApplicationRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkBanner, LandmarkBannerRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkComplementary, LandmarkComplementaryRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkContentInfo, LandmarkContentInfoRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkMain, LandmarkMainRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkNavigation, LandmarkNavigationRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkSearch, LandmarkSearchRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleApplicationAlert, ApplicationAlertRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleApplicationAlertDialog, ApplicationAlertDialogRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleApplicationDialog, ApplicationDialogRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleApplicationLog, ApplicationLogRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleApplicationMarquee, ApplicationMarqueeRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleApplicationStatus, ApplicationStatusRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleApplicationTimer, ApplicationTimerRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDocument, DocumentRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDocumentArticle, DocumentArticleRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDocumentMath, DocumentMathRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDocumentNote, DocumentNoteRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDocumentRegion, DocumentRegionRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleUserInterfaceTooltip, UserInterfaceTooltipRole);
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::Uncached, ApplicationCacheHost::UNCACHED);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::Idle, ApplicationCacheHost::IDLE);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::Checking, ApplicationCacheHost::CHECKING);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::Downloading, ApplicationCacheHost::DOWNLOADING);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::UpdateReady, ApplicationCacheHost::UPDATEREADY);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::Obsolete, ApplicationCacheHost::OBSOLETE);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::CheckingEvent, ApplicationCacheHost::CHECKING_EVENT);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::ErrorEvent, ApplicationCacheHost::ERROR_EVENT);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::NoUpdateEvent, ApplicationCacheHost::NOUPDATE_EVENT);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::DownloadingEvent, ApplicationCacheHost::DOWNLOADING_EVENT);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::ProgressEvent, ApplicationCacheHost::PROGRESS_EVENT);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::UpdateReadyEvent, ApplicationCacheHost::UPDATEREADY_EVENT);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::CachedEvent, ApplicationCacheHost::CACHED_EVENT);
+COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::ObsoleteEvent, ApplicationCacheHost::OBSOLETE_EVENT);
+#endif
+
+COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::FormatHTML, PasteboardPrivate::HTMLFormat);
+COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::FormatBookmark, PasteboardPrivate::BookmarkFormat);
+COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::FormatSmartPaste, PasteboardPrivate::WebSmartPasteFormat);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::BufferStandard, PasteboardPrivate::StandardBuffer);
+COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::BufferSelection, PasteboardPrivate::SelectionBuffer);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypePointer, PlatformCursor::TypePointer);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCross, PlatformCursor::TypeCross);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeHand, PlatformCursor::TypeHand);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeIBeam, PlatformCursor::TypeIBeam);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeWait, PlatformCursor::TypeWait);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeHelp, PlatformCursor::TypeHelp);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeEastResize, PlatformCursor::TypeEastResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthResize, PlatformCursor::TypeNorthResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthEastResize, PlatformCursor::TypeNorthEastResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthWestResize, PlatformCursor::TypeNorthWestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthResize, PlatformCursor::TypeSouthResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthEastResize, PlatformCursor::TypeSouthEastResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthWestResize, PlatformCursor::TypeSouthWestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeWestResize, PlatformCursor::TypeWestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthSouthResize, PlatformCursor::TypeNorthSouthResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeEastWestResize, PlatformCursor::TypeEastWestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthEastSouthWestResize, PlatformCursor::TypeNorthEastSouthWestResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthWestSouthEastResize, PlatformCursor::TypeNorthWestSouthEastResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeColumnResize, PlatformCursor::TypeColumnResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeRowResize, PlatformCursor::TypeRowResize);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeMiddlePanning, PlatformCursor::TypeMiddlePanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeEastPanning, PlatformCursor::TypeEastPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthPanning, PlatformCursor::TypeNorthPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthEastPanning, PlatformCursor::TypeNorthEastPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNorthWestPanning, PlatformCursor::TypeNorthWestPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthPanning, PlatformCursor::TypeSouthPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthEastPanning, PlatformCursor::TypeSouthEastPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeSouthWestPanning, PlatformCursor::TypeSouthWestPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeWestPanning, PlatformCursor::TypeWestPanning);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeMove, PlatformCursor::TypeMove);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeVerticalText, PlatformCursor::TypeVerticalText);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCell, PlatformCursor::TypeCell);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeContextMenu, PlatformCursor::TypeContextMenu);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeAlias, PlatformCursor::TypeAlias);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeProgress, PlatformCursor::TypeProgress);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNoDrop, PlatformCursor::TypeNoDrop);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCopy, PlatformCursor::TypeCopy);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNone, PlatformCursor::TypeNone);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeNotAllowed, PlatformCursor::TypeNotAllowed);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeZoomIn, PlatformCursor::TypeZoomIn);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeZoomOut, PlatformCursor::TypeZoomOut);
+COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCustom, PlatformCursor::TypeCustom);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebEditingActionTyped, EditorInsertActionTyped);
+COMPILE_ASSERT_MATCHING_ENUM(WebEditingActionPasted, EditorInsertActionPasted);
+COMPILE_ASSERT_MATCHING_ENUM(WebEditingActionDropped, EditorInsertActionDropped);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Text, HTMLInputElement::TEXT);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Password, HTMLInputElement::PASSWORD);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::IsIndex, HTMLInputElement::ISINDEX);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::CheckBox, HTMLInputElement::CHECKBOX);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Radio, HTMLInputElement::RADIO);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Submit, HTMLInputElement::SUBMIT);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Reset, HTMLInputElement::RESET);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::File, HTMLInputElement::FILE);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Hidden, HTMLInputElement::HIDDEN);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Image, HTMLInputElement::IMAGE);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Button, HTMLInputElement::BUTTON);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Search, HTMLInputElement::SEARCH);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Range, HTMLInputElement::RANGE);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Email, HTMLInputElement::EMAIL);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Number, HTMLInputElement::NUMBER);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Telephone, HTMLInputElement::TELEPHONE);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::URL, HTMLInputElement::URL);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Color, HTMLInputElement::COLOR);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Date, HTMLInputElement::DATE);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::DateTime, HTMLInputElement::DATETIME);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::DateTimeLocal, HTMLInputElement::DATETIMELOCAL);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Month, HTMLInputElement::MONTH);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Time, HTMLInputElement::TIME);
+COMPILE_ASSERT_MATCHING_ENUM(WebInputElement::Week, HTMLInputElement::WEEK);
+
+#if ENABLE(VIDEO)
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::Empty, MediaPlayer::Empty);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::Idle, MediaPlayer::Idle);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::Loading, MediaPlayer::Loading);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::Loaded, MediaPlayer::Loaded);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::FormatError, MediaPlayer::FormatError);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::NetworkError, MediaPlayer::NetworkError);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::DecodeError, MediaPlayer::DecodeError);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::HaveNothing, MediaPlayer::HaveNothing);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::HaveMetadata, MediaPlayer::HaveMetadata);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::HaveCurrentData, MediaPlayer::HaveCurrentData);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::HaveFutureData, MediaPlayer::HaveFutureData);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::HaveEnoughData, MediaPlayer::HaveEnoughData);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::Unknown, MediaPlayer::Unknown);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::Download, MediaPlayer::Download);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::StoredStream, MediaPlayer::StoredStream);
+COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::LiveStream, MediaPlayer::LiveStream);
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionAllowed, NotificationPresenter::PermissionAllowed);
+COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionNotAllowed, NotificationPresenter::PermissionNotAllowed);
+COMPILE_ASSERT_MATCHING_ENUM(WebNotificationPresenter::PermissionDenied, NotificationPresenter::PermissionDenied);
+#endif
+
+COMPILE_ASSERT_MATCHING_ENUM(WebTextAffinityUpstream, UPSTREAM);
+COMPILE_ASSERT_MATCHING_ENUM(WebTextAffinityDownstream, DOWNSTREAM);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebTextCaseSensitive, TextCaseSensitive);
+COMPILE_ASSERT_MATCHING_ENUM(WebTextCaseInsensitive, TextCaseInsensitive);
diff --git a/WebKit/chromium/src/AutocompletePopupMenuClient.cpp b/WebKit/chromium/src/AutocompletePopupMenuClient.cpp
new file mode 100644
index 0000000..62d4dff
--- /dev/null
+++ b/WebKit/chromium/src/AutocompletePopupMenuClient.cpp
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AutocompletePopupMenuClient.h"
+
+#include "CSSStyleSelector.h"
+#include "CSSValueKeywords.h"
+#include "FrameView.h"
+#include "HTMLInputElement.h"
+#include "RenderTheme.h"
+#include "WebVector.h"
+#include "WebViewImpl.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+AutocompletePopupMenuClient::AutocompletePopupMenuClient(WebViewImpl* webView)
+    : m_textField(0)
+    , m_selectedIndex(0)
+    , m_webView(webView)
+{
+}
+
+AutocompletePopupMenuClient::~AutocompletePopupMenuClient()
+{
+}
+
+void AutocompletePopupMenuClient::initialize(
+    HTMLInputElement* textField,
+    const WebVector<WebString>& suggestions,
+    int defaultSuggestionIndex)
+{
+    ASSERT(defaultSuggestionIndex < static_cast<int>(suggestions.size()));
+    m_textField = textField;
+    m_selectedIndex = defaultSuggestionIndex;
+    setSuggestions(suggestions);
+
+    FontDescription fontDescription;
+    m_webView->theme()->systemFont(CSSValueWebkitControl, fontDescription);
+    // Use a smaller font size to match IE/Firefox.
+    // FIXME: http://crbug.com/7376 use the system size instead of a
+    //        fixed font size value.
+    fontDescription.setComputedSize(12.0);
+    Font font(fontDescription, 0, 0);
+    font.update(textField->document()->styleSelector()->fontSelector());
+    // The direction of text in popup menu is set the same as the direction of
+    // the input element: textField.
+    m_style.set(new PopupMenuStyle(Color::black, Color::white, font, true,
+                                   Length(WebCore::Fixed),
+                                   textField->renderer()->style()->direction()));
+}
+
+void AutocompletePopupMenuClient::valueChanged(unsigned listIndex, bool fireEvents)
+{
+    m_textField->setValue(m_suggestions[listIndex]);
+    EditorClientImpl* editor =
+        static_cast<EditorClientImpl*>(m_webView->page()->editorClient());
+    ASSERT(editor);
+    editor->onAutofillSuggestionAccepted(
+        static_cast<HTMLInputElement*>(m_textField.get()));
+}
+
+String AutocompletePopupMenuClient::itemText(unsigned listIndex) const
+{
+    return m_suggestions[listIndex];
+}
+
+PopupMenuStyle AutocompletePopupMenuClient::itemStyle(unsigned listIndex) const
+{
+    return *m_style;
+}
+
+PopupMenuStyle AutocompletePopupMenuClient::menuStyle() const
+{
+    return *m_style;
+}
+
+int AutocompletePopupMenuClient::clientPaddingLeft() const
+{
+    // Bug http://crbug.com/7708 seems to indicate the style can be 0.
+    RenderStyle* style = textFieldStyle();
+    return style ? m_webView->theme()->popupInternalPaddingLeft(style) : 0;
+}
+
+int AutocompletePopupMenuClient::clientPaddingRight() const
+{
+    // Bug http://crbug.com/7708 seems to indicate the style can be 0.
+    RenderStyle* style = textFieldStyle();
+    return style ? m_webView->theme()->popupInternalPaddingRight(style) : 0;
+}
+
+void AutocompletePopupMenuClient::popupDidHide()
+{
+    m_webView->autoCompletePopupDidHide();
+}
+
+void AutocompletePopupMenuClient::setTextFromItem(unsigned listIndex)
+{
+    m_textField->setValue(m_suggestions[listIndex]);
+}
+
+FontSelector* AutocompletePopupMenuClient::fontSelector() const
+{
+    return m_textField->document()->styleSelector()->fontSelector();
+}
+
+HostWindow* AutocompletePopupMenuClient::hostWindow() const
+{
+    return m_textField->document()->view()->hostWindow();
+}
+
+PassRefPtr<Scrollbar> AutocompletePopupMenuClient::createScrollbar(
+    ScrollbarClient* client,
+    ScrollbarOrientation orientation,
+    ScrollbarControlSize size)
+{
+    return Scrollbar::createNativeScrollbar(client, orientation, size);
+}
+
+void AutocompletePopupMenuClient::setSuggestions(const WebVector<WebString>& suggestions)
+{
+    m_suggestions.clear();
+    for (size_t i = 0; i < suggestions.size(); ++i)
+        m_suggestions.append(suggestions[i]);
+    // Try to preserve selection if possible.
+    if (m_selectedIndex >= static_cast<int>(suggestions.size()))
+        m_selectedIndex = -1;
+}
+
+void AutocompletePopupMenuClient::removeItemAtIndex(int index)
+{
+    ASSERT(index >= 0 && index < static_cast<int>(m_suggestions.size()));
+    m_suggestions.remove(index);
+}
+
+RenderStyle* AutocompletePopupMenuClient::textFieldStyle() const
+{
+    RenderStyle* style = m_textField->computedStyle();
+    if (!style) {
+        // It seems we can only have a 0 style in a TextField if the
+        // node is detached, in which case we the popup shoud not be
+        // showing.  Please report this in http://crbug.com/7708 and
+        // include the page you were visiting.
+        ASSERT_NOT_REACHED();
+    }
+    return style;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/AutocompletePopupMenuClient.h b/WebKit/chromium/src/AutocompletePopupMenuClient.h
new file mode 100644
index 0000000..ad24e54
--- /dev/null
+++ b/WebKit/chromium/src/AutocompletePopupMenuClient.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PopupMenuClient.h"
+
+namespace WebCore {
+class HTMLInputElement;
+class PopupMenuStyle;
+class RenderStyle;
+}
+
+namespace WebKit {
+class WebString;
+class WebViewImpl;
+template <typename T> class WebVector;
+
+// AutocompletePopupMenuClient
+class AutocompletePopupMenuClient : public WebCore::PopupMenuClient {
+public:
+    AutocompletePopupMenuClient(WebViewImpl* webview);
+    ~AutocompletePopupMenuClient();
+
+    void initialize(WebCore::HTMLInputElement*,
+                    const WebVector<WebString>& suggestions,
+                    int defaultSuggestionIndex);
+
+    WebCore::HTMLInputElement* textField() const { return m_textField.get(); }
+
+    void setSuggestions(const WebVector<WebString>&);
+    void removeItemAtIndex(int index);
+
+    // WebCore::PopupMenuClient methods:
+    virtual void valueChanged(unsigned listIndex, bool fireEvents = true);
+    virtual WebCore::String itemText(unsigned listIndex) const;
+    virtual WebCore::String itemToolTip(unsigned lastIndex) const { return WebCore::String(); }
+    virtual bool itemIsEnabled(unsigned listIndex) const { return true; }
+    virtual WebCore::PopupMenuStyle itemStyle(unsigned listIndex) const;
+    virtual WebCore::PopupMenuStyle menuStyle() const;
+    virtual int clientInsetLeft() const { return 0; }
+    virtual int clientInsetRight() const { return 0; }
+    virtual int clientPaddingLeft() const;
+    virtual int clientPaddingRight() const;
+    virtual int listSize() const { return m_suggestions.size(); }
+    virtual int selectedIndex() const { return m_selectedIndex; }
+    virtual void popupDidHide();
+    virtual bool itemIsSeparator(unsigned listIndex) const { return false; }
+    virtual bool itemIsLabel(unsigned listIndex) const { return false; }
+    virtual bool itemIsSelected(unsigned listIndex) const { return false; }
+    virtual bool shouldPopOver() const { return false; }
+    virtual bool valueShouldChangeOnHotTrack() const { return false; }
+    virtual void setTextFromItem(unsigned listIndex);
+    virtual WebCore::FontSelector* fontSelector() const;
+    virtual WebCore::HostWindow* hostWindow() const;
+    virtual PassRefPtr<WebCore::Scrollbar> createScrollbar(
+        WebCore::ScrollbarClient* client,
+        WebCore::ScrollbarOrientation orientation,
+        WebCore::ScrollbarControlSize size);
+
+private:
+    WebCore::RenderStyle* textFieldStyle() const;
+
+    RefPtr<WebCore::HTMLInputElement> m_textField;
+    Vector<WebCore::String> m_suggestions;
+    int m_selectedIndex;
+    WebViewImpl* m_webView;
+    OwnPtr<WebCore::PopupMenuStyle> m_style;
+};
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/BackForwardListClientImpl.cpp b/WebKit/chromium/src/BackForwardListClientImpl.cpp
new file mode 100644
index 0000000..8feae32
--- /dev/null
+++ b/WebKit/chromium/src/BackForwardListClientImpl.cpp
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BackForwardListClientImpl.h"
+
+#include "HistoryItem.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+const char backForwardNavigationScheme[] = "chrome-back-forward";
+
+BackForwardListClientImpl::BackForwardListClientImpl(WebViewImpl* webView)
+    : m_webView(webView)
+{
+}
+
+BackForwardListClientImpl::~BackForwardListClientImpl()
+{
+}
+
+void BackForwardListClientImpl::setCurrentHistoryItem(HistoryItem* item)
+{
+    m_previousItem = m_currentItem;
+    m_currentItem = item;
+}
+
+HistoryItem* BackForwardListClientImpl::previousHistoryItem() const
+{
+    return m_previousItem.get();
+}
+
+void BackForwardListClientImpl::addItem(PassRefPtr<HistoryItem> item)
+{
+    m_previousItem = m_currentItem;
+    m_currentItem = item;
+
+    // If WebCore adds a new HistoryItem, it means this is a new navigation (ie,
+    // not a reload or back/forward).
+    m_webView->observeNewNavigation();
+
+    if (m_webView->client())
+        m_webView->client()->didAddHistoryItem();
+}
+
+void BackForwardListClientImpl::goToItem(HistoryItem* item)
+{
+    m_previousItem = m_currentItem;
+    m_currentItem = item;
+
+    if (m_pendingHistoryItem == item)
+        m_pendingHistoryItem = 0;
+}
+
+HistoryItem* BackForwardListClientImpl::currentItem()
+{
+    return m_currentItem.get();
+}
+
+HistoryItem* BackForwardListClientImpl::itemAtIndex(int index)
+{
+    if (!m_webView->client())
+        return 0;
+
+    // Since we don't keep the entire back/forward list, we have no way to
+    // properly implement this method.  We return a dummy entry instead that we
+    // intercept in our FrameLoaderClient implementation in case WebCore asks
+    // to navigate to this HistoryItem.
+
+    // FIXME: We should change WebCore to handle history.{back,forward,go}
+    // differently.  It should perhaps just ask the FrameLoaderClient to
+    // perform those navigations.
+
+    String url_string = String::format(
+        "%s://go/%d", backForwardNavigationScheme, index);
+
+    m_pendingHistoryItem =
+        HistoryItem::create(url_string, String(), 0.0);
+    return m_pendingHistoryItem.get();
+}
+
+int BackForwardListClientImpl::backListCount()
+{
+    if (!m_webView->client())
+        return 0;
+
+    return m_webView->client()->historyBackListCount();
+}
+
+int BackForwardListClientImpl::forwardListCount()
+{
+    if (!m_webView->client())
+        return 0;
+
+    return m_webView->client()->historyForwardListCount();
+}
+
+void BackForwardListClientImpl::close()
+{
+    m_currentItem = 0;
+    m_previousItem = 0;
+    m_pendingHistoryItem = 0;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/BackForwardListClientImpl.h b/WebKit/chromium/src/BackForwardListClientImpl.h
new file mode 100644
index 0000000..1d8beb0
--- /dev/null
+++ b/WebKit/chromium/src/BackForwardListClientImpl.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BackForwardListClientImpl_h
+#define BackForwardListClientImpl_h
+
+#include "BackForwardList.h"
+
+namespace WebKit {
+class WebViewImpl;
+
+extern const char backForwardNavigationScheme[];
+
+class BackForwardListClientImpl : public WebCore::BackForwardListClient {
+public:
+    BackForwardListClientImpl(WebViewImpl* webview);
+    ~BackForwardListClientImpl();
+
+    void setCurrentHistoryItem(WebCore::HistoryItem* item);
+    WebCore::HistoryItem* previousHistoryItem() const;
+
+private:
+    // WebCore::BackForwardListClient methods:
+    virtual void addItem(PassRefPtr<WebCore::HistoryItem>);
+    virtual void goToItem(WebCore::HistoryItem*);
+    virtual WebCore::HistoryItem* currentItem();
+    virtual WebCore::HistoryItem* itemAtIndex(int index);
+    virtual int backListCount();
+    virtual int forwardListCount();
+    virtual void close();
+
+    WebViewImpl* m_webView;
+
+    RefPtr<WebCore::HistoryItem> m_previousItem;
+    RefPtr<WebCore::HistoryItem> m_currentItem;
+
+    // The last history item that was accessed via itemAtIndex().  We keep track
+    // of this until goToItem() is called, so we can track the navigation.
+    RefPtr<WebCore::HistoryItem> m_pendingHistoryItem;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/ChromeClientImpl.cpp b/WebKit/chromium/src/ChromeClientImpl.cpp
new file mode 100644
index 0000000..4e20124
--- /dev/null
+++ b/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -0,0 +1,671 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ChromeClientImpl.h"
+
+#include "AccessibilityObject.h"
+#include "AXObjectCache.h"
+#include "CharacterNames.h"
+#include "Console.h"
+#include "Cursor.h"
+#include "DatabaseTracker.h"
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "FileChooser.h"
+#include "FloatRect.h"
+#include "FrameLoadRequest.h"
+#include "FrameView.h"
+#include "HitTestResult.h"
+#include "IntRect.h"
+#include "Node.h"
+#include "NotificationPresenterImpl.h"
+#include "Page.h"
+#include "PopupMenuChromium.h"
+#include "ScriptController.h"
+#if USE(V8)
+#include "V8Proxy.h"
+#endif
+#include "WebAccessibilityObject.h"
+#include "WebConsoleMessage.h"
+#include "WebCursorInfo.h"
+#include "WebFileChooserCompletionImpl.h"
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include "WebInputEvent.h"
+#include "WebKit.h"
+#include "WebPopupMenuImpl.h"
+#include "WebPopupMenuInfo.h"
+#include "WebRect.h"
+#include "WebTextDirection.h"
+#include "WebURLRequest.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+#include "WindowFeatures.h"
+#include "WrappedResourceRequest.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+ChromeClientImpl::ChromeClientImpl(WebViewImpl* webView)
+    : m_webView(webView)
+    , m_toolbarsVisible(true)
+    , m_statusbarVisible(true)
+    , m_scrollbarsVisible(true)
+    , m_menubarVisible(true)
+    , m_resizable(true)
+    , m_ignoreNextSetCursor(false)
+{
+}
+
+ChromeClientImpl::~ChromeClientImpl()
+{
+}
+
+void ChromeClientImpl::chromeDestroyed()
+{
+    // Our lifetime is bound to the WebViewImpl.
+}
+
+void ChromeClientImpl::setWindowRect(const FloatRect& r)
+{
+    if (m_webView->client())
+        m_webView->client()->setWindowRect(IntRect(r));
+}
+
+FloatRect ChromeClientImpl::windowRect()
+{
+    WebRect rect;
+    if (m_webView->client())
+        rect = m_webView->client()->rootWindowRect();
+    else {
+        // These numbers will be fairly wrong. The window's x/y coordinates will
+        // be the top left corner of the screen and the size will be the content
+        // size instead of the window size.
+        rect.width = m_webView->size().width;
+        rect.height = m_webView->size().height;
+    }
+    return FloatRect(rect);
+}
+
+FloatRect ChromeClientImpl::pageRect()
+{
+    // We hide the details of the window's border thickness from the web page by
+    // simple re-using the window position here.  So, from the point-of-view of
+    // the web page, the window has no border.
+    return windowRect();
+}
+
+float ChromeClientImpl::scaleFactor()
+{
+    // This is supposed to return the scale factor of the web page. It looks like
+    // the implementor of the graphics layer is responsible for doing most of the
+    // operations associated with scaling. However, this value is used ins some
+    // cases by WebCore. For example, this is used as a scaling factor in canvas
+    // so that things drawn in it are scaled just like the web page is.
+    //
+    // We don't currently implement scaling, so just return 1.0 (no scaling).
+    return 1.0;
+}
+
+void ChromeClientImpl::focus()
+{
+    if (!m_webView->client())
+        return;
+
+    m_webView->client()->didFocus();
+
+    // If accessibility is enabled, we should notify assistive technology that
+    // the active AccessibilityObject changed.
+    const Frame* frame = m_webView->focusedWebCoreFrame();
+    if (!frame)
+        return;
+
+    Document* doc = frame->document();
+
+    if (doc && doc->axObjectCache()->accessibilityEnabled()) {
+        Node* focusedNode = m_webView->focusedWebCoreNode();
+
+        if (!focusedNode) {
+            // Could not retrieve focused Node.
+            return;
+        }
+
+        // Retrieve the focused AccessibilityObject.
+        AccessibilityObject* focusedAccObj =
+            doc->axObjectCache()->getOrCreate(focusedNode->renderer());
+
+        // Alert assistive technology that focus changed.
+        if (focusedAccObj)
+            m_webView->client()->focusAccessibilityObject(WebAccessibilityObject(focusedAccObj));
+    }
+}
+
+void ChromeClientImpl::unfocus()
+{
+    if (m_webView->client())
+        m_webView->client()->didBlur();
+}
+
+bool ChromeClientImpl::canTakeFocus(FocusDirection)
+{
+    // For now the browser can always take focus if we're not running layout
+    // tests.
+    return !layoutTestMode();
+}
+
+void ChromeClientImpl::takeFocus(FocusDirection direction)
+{
+    if (!m_webView->client())
+        return;
+    if (direction == FocusDirectionBackward)
+        m_webView->client()->focusPrevious();
+    else
+        m_webView->client()->focusNext();
+}
+
+void ChromeClientImpl::focusedNodeChanged(Node* node)
+{
+    WebURL focus_url;
+    if (node && node->isLink()) {
+        // This HitTestResult hack is the easiest way to get a link URL out of a
+        // WebCore::Node.
+        HitTestResult hit_test(IntPoint(0, 0));
+        // This cast must be valid because of the isLink() check.
+        hit_test.setURLElement(reinterpret_cast<Element*>(node));
+        if (hit_test.isLiveLink())
+            focus_url = hit_test.absoluteLinkURL();
+    }
+    m_webView->client()->setKeyboardFocusURL(focus_url);
+}
+
+Page* ChromeClientImpl::createWindow(
+    Frame* frame, const FrameLoadRequest& r, const WindowFeatures& features)
+{
+    if (!m_webView->client())
+        return 0;
+
+    WebViewImpl* newView = static_cast<WebViewImpl*>(
+        m_webView->client()->createView(WebFrameImpl::fromFrame(frame)));
+    if (!newView)
+        return 0;
+
+    // The request is empty when we are just being asked to open a blank window.
+    // This corresponds to window.open(""), for example.
+    if (!r.resourceRequest().isEmpty()) {
+        WrappedResourceRequest request(r.resourceRequest());
+        newView->mainFrame()->loadRequest(request);
+    }
+
+    return newView->page();
+}
+
+static inline bool currentEventShouldCauseBackgroundTab(const WebInputEvent* inputEvent)
+{
+    if (!inputEvent)
+        return false;
+
+    if (inputEvent->type != WebInputEvent::MouseUp)
+        return false;
+
+    const WebMouseEvent* mouseEvent = static_cast<const WebMouseEvent*>(inputEvent);
+
+    WebNavigationPolicy policy;
+    unsigned short buttonNumber;
+    switch (mouseEvent->button) {
+    case WebMouseEvent::ButtonLeft:
+        buttonNumber = 0;
+        break;
+    case WebMouseEvent::ButtonMiddle:
+        buttonNumber = 1;
+        break;
+    case WebMouseEvent::ButtonRight:
+        buttonNumber = 2;
+        break;
+    default:
+        return false;
+    }
+    bool ctrl = mouseEvent->modifiers & WebMouseEvent::ControlKey;
+    bool shift = mouseEvent->modifiers & WebMouseEvent::ShiftKey;
+    bool alt = mouseEvent->modifiers & WebMouseEvent::AltKey;
+    bool meta = mouseEvent->modifiers & WebMouseEvent::MetaKey;
+
+    if (!WebViewImpl::navigationPolicyFromMouseEvent(buttonNumber, ctrl, shift, alt, meta, &policy))
+        return false;
+
+    return policy == WebNavigationPolicyNewBackgroundTab;
+}
+
+void ChromeClientImpl::show()
+{
+    if (!m_webView->client())
+        return;
+
+    // If our default configuration was modified by a script or wasn't
+    // created by a user gesture, then show as a popup. Else, let this
+    // new window be opened as a toplevel window.
+    bool asPopup = !m_toolbarsVisible
+        || !m_statusbarVisible
+        || !m_scrollbarsVisible
+        || !m_menubarVisible
+        || !m_resizable;
+
+    WebNavigationPolicy policy = WebNavigationPolicyNewForegroundTab;
+    if (asPopup)
+        policy = WebNavigationPolicyNewPopup;
+    if (currentEventShouldCauseBackgroundTab(WebViewImpl::currentInputEvent()))
+        policy = WebNavigationPolicyNewBackgroundTab;
+
+    m_webView->client()->show(policy);
+}
+
+bool ChromeClientImpl::canRunModal()
+{
+    return !!m_webView->client();
+}
+
+void ChromeClientImpl::runModal()
+{
+    if (m_webView->client())
+        m_webView->client()->runModal();
+}
+
+void ChromeClientImpl::setToolbarsVisible(bool value)
+{
+    m_toolbarsVisible = value;
+}
+
+bool ChromeClientImpl::toolbarsVisible()
+{
+    return m_toolbarsVisible;
+}
+
+void ChromeClientImpl::setStatusbarVisible(bool value)
+{
+    m_statusbarVisible = value;
+}
+
+bool ChromeClientImpl::statusbarVisible()
+{
+    return m_statusbarVisible;
+}
+
+void ChromeClientImpl::setScrollbarsVisible(bool value)
+{
+    m_scrollbarsVisible = value;
+    WebFrameImpl* web_frame = static_cast<WebFrameImpl*>(m_webView->mainFrame());
+    if (web_frame)
+        web_frame->setAllowsScrolling(value);
+}
+
+bool ChromeClientImpl::scrollbarsVisible()
+{
+    return m_scrollbarsVisible;
+}
+
+void ChromeClientImpl::setMenubarVisible(bool value)
+{
+    m_menubarVisible = value;
+}
+
+bool ChromeClientImpl::menubarVisible()
+{
+    return m_menubarVisible;
+}
+
+void ChromeClientImpl::setResizable(bool value)
+{
+    m_resizable = value;
+}
+
+void ChromeClientImpl::addMessageToConsole(MessageSource source,
+                                           MessageType type,
+                                           MessageLevel level,
+                                           const String& message,
+                                           unsigned lineNumber,
+                                           const String& sourceID)
+{
+    if (m_webView->client()) {
+        m_webView->client()->didAddMessageToConsole(
+            WebConsoleMessage(static_cast<WebConsoleMessage::Level>(level), message),
+            sourceID,
+            lineNumber);
+    }
+}
+
+bool ChromeClientImpl::canRunBeforeUnloadConfirmPanel()
+{
+    return !!m_webView->client();
+}
+
+bool ChromeClientImpl::runBeforeUnloadConfirmPanel(const String& message, Frame* frame)
+{
+    if (m_webView->client()) {
+        return m_webView->client()->runModalBeforeUnloadDialog(
+            WebFrameImpl::fromFrame(frame), message);
+    }
+    return false;
+}
+
+void ChromeClientImpl::closeWindowSoon()
+{
+    // Make sure this Page can no longer be found by JS.
+    m_webView->page()->setGroupName(String());
+
+    // Make sure that all loading is stopped.  Ensures that JS stops executing!
+    m_webView->mainFrame()->stopLoading();
+
+    if (m_webView->client())
+        m_webView->client()->closeWidgetSoon();
+}
+
+// Although a Frame is passed in, we don't actually use it, since we
+// already know our own m_webView.
+void ChromeClientImpl::runJavaScriptAlert(Frame* frame, const String& message)
+{
+    if (m_webView->client()) {
+#if USE(V8)
+        // Before showing the JavaScript dialog, we give the proxy implementation
+        // a chance to process any pending console messages.
+        V8Proxy::processConsoleMessages();
+#endif
+        m_webView->client()->runModalAlertDialog(
+            WebFrameImpl::fromFrame(frame), message);
+    }
+}
+
+// See comments for runJavaScriptAlert().
+bool ChromeClientImpl::runJavaScriptConfirm(Frame* frame, const String& message)
+{
+    if (m_webView->client()) {
+        return m_webView->client()->runModalConfirmDialog(
+            WebFrameImpl::fromFrame(frame), message);
+    }
+    return false;
+}
+
+// See comments for runJavaScriptAlert().
+bool ChromeClientImpl::runJavaScriptPrompt(Frame* frame,
+                                           const String& message,
+                                           const String& defaultValue,
+                                           String& result)
+{
+    if (m_webView->client()) {
+        WebString actualValue;
+        bool ok = m_webView->client()->runModalPromptDialog(
+            WebFrameImpl::fromFrame(frame),
+            message,
+            defaultValue,
+            &actualValue);
+        if (ok)
+            result = actualValue;
+        return ok;
+    }
+    return false;
+}
+
+void ChromeClientImpl::setStatusbarText(const String& message)
+{
+    if (m_webView->client())
+        m_webView->client()->setStatusText(message);
+}
+
+bool ChromeClientImpl::shouldInterruptJavaScript()
+{
+    // FIXME: implement me
+    return false;
+}
+
+bool ChromeClientImpl::tabsToLinks() const
+{
+    // Returns true if anchors should accept keyboard focus with the tab key.
+    // This method is used in a convoluted fashion by EventHandler::tabsToLinks.
+    // It's a twisted path (self-evident, but more complicated than seems
+    // necessary), but the net result is that returning true from here, on a
+    // platform other than MAC or QT, lets anchors get keyboard focus.
+    return m_webView->tabsToLinks();
+}
+
+IntRect ChromeClientImpl::windowResizerRect() const
+{
+    IntRect result;
+    if (m_webView->client())
+        result = m_webView->client()->windowResizerRect();
+    return result;
+}
+
+void ChromeClientImpl::repaint(
+    const IntRect& paintRect, bool contentChanged, bool immediate,
+    bool repaintContentOnly)
+{
+    // Ignore spurious calls.
+    if (!contentChanged || paintRect.isEmpty())
+        return;
+    if (m_webView->client())
+        m_webView->client()->didInvalidateRect(paintRect);
+}
+
+void ChromeClientImpl::scroll(
+    const IntSize& scrollDelta, const IntRect& scrollRect,
+    const IntRect& clipRect)
+{
+    if (m_webView->client()) {
+        int dx = scrollDelta.width();
+        int dy = scrollDelta.height();
+        m_webView->client()->didScrollRect(dx, dy, clipRect);
+    }
+}
+
+IntPoint ChromeClientImpl::screenToWindow(const IntPoint&) const
+{
+    notImplemented();
+    return IntPoint();
+}
+
+IntRect ChromeClientImpl::windowToScreen(const IntRect& rect) const
+{
+    IntRect screenRect(rect);
+
+    if (m_webView->client()) {
+        WebRect windowRect = m_webView->client()->windowRect();
+        screenRect.move(windowRect.x, windowRect.y);
+    }
+
+    return screenRect;
+}
+
+void ChromeClientImpl::contentsSizeChanged(Frame* frame, const IntSize& size) const
+{
+    WebFrameImpl* webframe = WebFrameImpl::fromFrame(frame);
+    if (webframe->client())
+        webframe->client()->didChangeContentsSize(webframe, size);
+}
+
+void ChromeClientImpl::scrollbarsModeDidChange() const
+{
+}
+
+void ChromeClientImpl::mouseDidMoveOverElement(
+    const HitTestResult& result, unsigned modifierFlags)
+{
+    if (!m_webView->client())
+        return;
+    // Find out if the mouse is over a link, and if so, let our UI know...
+    if (result.isLiveLink() && !result.absoluteLinkURL().string().isEmpty())
+        m_webView->client()->setMouseOverURL(result.absoluteLinkURL());
+    else
+        m_webView->client()->setMouseOverURL(WebURL());
+}
+
+void ChromeClientImpl::setToolTip(const String& tooltipText, TextDirection dir)
+{
+    if (!m_webView->client())
+        return;
+    WebTextDirection textDirection = (dir == RTL) ?
+        WebTextDirectionRightToLeft :
+        WebTextDirectionLeftToRight;
+    m_webView->client()->setToolTipText(
+        tooltipText, textDirection);
+}
+
+void ChromeClientImpl::print(Frame* frame)
+{
+    if (m_webView->client())
+        m_webView->client()->printPage(WebFrameImpl::fromFrame(frame));
+}
+
+void ChromeClientImpl::exceededDatabaseQuota(Frame* frame, const String& databaseName)
+{
+    // Chromium users cannot currently change the default quota
+}
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+void ChromeClientImpl::reachedMaxAppCacheSize(int64_t spaceNeeded)
+{
+    ASSERT_NOT_REACHED();
+}
+#endif
+
+void ChromeClientImpl::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> fileChooser)
+{
+    WebViewClient* client = m_webView->client();
+    if (!client)
+        return;
+
+    bool multipleFiles = fileChooser->allowsMultipleFiles();
+
+    WebString suggestion;
+    if (fileChooser->filenames().size() > 0)
+        suggestion = fileChooser->filenames()[0];
+
+    WebFileChooserCompletionImpl* chooserCompletion =
+        new WebFileChooserCompletionImpl(fileChooser);
+    bool ok = client->runFileChooser(multipleFiles,
+                                     WebString(),
+                                     suggestion,
+                                     chooserCompletion);
+    if (!ok) {
+        // Choosing failed, so do callback with an empty list.
+        chooserCompletion->didChooseFile(WebVector<WebString>());
+    }
+}
+
+void ChromeClientImpl::popupOpened(PopupContainer* popupContainer,
+                                   const IntRect& bounds,
+                                   bool activatable,
+                                   bool handleExternally)
+{
+    if (!m_webView->client())
+        return;
+
+    WebWidget* webwidget;
+    if (handleExternally) {
+        WebPopupMenuInfo popupInfo;
+        getPopupMenuInfo(popupContainer, &popupInfo);
+        webwidget = m_webView->client()->createPopupMenu(popupInfo);
+    } else
+        webwidget = m_webView->client()->createPopupMenu(activatable);
+
+    static_cast<WebPopupMenuImpl*>(webwidget)->Init(popupContainer, bounds);
+}
+
+void ChromeClientImpl::setCursor(const WebCursorInfo& cursor)
+{
+    if (m_ignoreNextSetCursor) {
+        m_ignoreNextSetCursor = false;
+        return;
+    }
+
+    if (m_webView->client())
+        m_webView->client()->didChangeCursor(cursor);
+}
+
+void ChromeClientImpl::setCursorForPlugin(const WebCursorInfo& cursor)
+{
+    setCursor(cursor);
+
+    // Currently, Widget::setCursor is always called after this function in
+    // EventHandler.cpp and since we don't want that we set a flag indicating
+    // that the next SetCursor call is to be ignored.
+    m_ignoreNextSetCursor = true;
+}
+
+void ChromeClientImpl::formStateDidChange(const Node* node)
+{
+    // The current history item is not updated yet.  That happens lazily when
+    // WebFrame::currentHistoryItem is requested.
+    WebFrameImpl* webframe = WebFrameImpl::fromFrame(node->document()->frame());
+    if (webframe->client())
+        webframe->client()->didUpdateCurrentHistoryItem(webframe);
+}
+
+void ChromeClientImpl::getPopupMenuInfo(PopupContainer* popupContainer,
+                                        WebPopupMenuInfo* info)
+{
+    const Vector<PopupItem*>& inputItems = popupContainer->popupData();
+
+    WebVector<WebPopupMenuInfo::Item> outputItems(inputItems.size());
+
+    for (size_t i = 0; i < inputItems.size(); ++i) {
+        const PopupItem& inputItem = *inputItems[i];
+        WebPopupMenuInfo::Item& outputItem = outputItems[i];
+
+        outputItem.label = inputItem.label;
+        outputItem.enabled = inputItem.enabled;
+
+        switch (inputItem.type) {
+        case PopupItem::TypeOption:
+            outputItem.type = WebPopupMenuInfo::Item::Option;
+            break;
+        case PopupItem::TypeGroup:
+            outputItem.type = WebPopupMenuInfo::Item::Group;
+            break;
+        case PopupItem::TypeSeparator:
+            outputItem.type = WebPopupMenuInfo::Item::Separator;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    info->itemHeight = popupContainer->menuItemHeight();
+    info->selectedIndex = popupContainer->selectedIndex();
+    info->items.swap(outputItems);
+}
+
+#if ENABLE(NOTIFICATIONS)
+NotificationPresenter* ChromeClientImpl::notificationPresenter() const
+{
+    return m_webView->notificationPresenterImpl();
+}
+#endif
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/ChromeClientImpl.h b/WebKit/chromium/src/ChromeClientImpl.h
new file mode 100644
index 0000000..5a1e9cc
--- /dev/null
+++ b/WebKit/chromium/src/ChromeClientImpl.h
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ChromeClientImpl_h
+#define ChromeClientImpl_h
+
+#include "ChromeClientChromium.h"
+
+namespace WebCore {
+class HTMLParserQuirks;
+class PopupContainer;
+class SecurityOrigin;
+struct WindowFeatures;
+}
+
+namespace WebKit {
+class WebViewImpl;
+struct WebCursorInfo;
+struct WebPopupMenuInfo;
+
+// Handles window-level notifications from WebCore on behalf of a WebView.
+class ChromeClientImpl : public WebCore::ChromeClientChromium {
+public:
+    explicit ChromeClientImpl(WebViewImpl* webView);
+    virtual ~ChromeClientImpl();
+
+    WebViewImpl* webView() const { return m_webView; }
+
+    // ChromeClient methods:
+    virtual void chromeDestroyed();
+    virtual void setWindowRect(const WebCore::FloatRect&);
+    virtual WebCore::FloatRect windowRect();
+    virtual WebCore::FloatRect pageRect();
+    virtual float scaleFactor();
+    virtual void focus();
+    virtual void unfocus();
+    virtual bool canTakeFocus(WebCore::FocusDirection);
+    virtual void takeFocus(WebCore::FocusDirection);
+    virtual void focusedNodeChanged(WebCore::Node*);
+    virtual WebCore::Page* createWindow(
+        WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&);
+    virtual void show();
+    virtual bool canRunModal();
+    virtual void runModal();
+    virtual void setToolbarsVisible(bool);
+    virtual bool toolbarsVisible();
+    virtual void setStatusbarVisible(bool);
+    virtual bool statusbarVisible();
+    virtual void setScrollbarsVisible(bool);
+    virtual bool scrollbarsVisible();
+    virtual void setMenubarVisible(bool);
+    virtual bool menubarVisible();
+    virtual void setResizable(bool);
+    virtual void addMessageToConsole(
+        WebCore::MessageSource, WebCore::MessageType, WebCore::MessageLevel,
+        const WebCore::String& message, unsigned lineNumber,
+        const WebCore::String& sourceID);
+    virtual bool canRunBeforeUnloadConfirmPanel();
+    virtual bool runBeforeUnloadConfirmPanel(
+        const WebCore::String& message, WebCore::Frame*);
+    virtual void closeWindowSoon();
+    virtual void runJavaScriptAlert(WebCore::Frame*, const WebCore::String&);
+    virtual bool runJavaScriptConfirm(WebCore::Frame*, const WebCore::String&);
+    virtual bool runJavaScriptPrompt(
+        WebCore::Frame*, const WebCore::String& message,
+        const WebCore::String& defaultValue, WebCore::String& result);
+    virtual void setStatusbarText(const WebCore::String& message);
+    virtual bool shouldInterruptJavaScript();
+    virtual bool tabsToLinks() const;
+    virtual WebCore::IntRect windowResizerRect() const;
+    virtual void repaint(
+        const WebCore::IntRect&, bool contentChanged, bool immediate = false,
+        bool repaintContentOnly = false);
+    virtual void scroll(
+        const WebCore::IntSize& scrollDelta, const WebCore::IntRect& rectToScroll,
+        const WebCore::IntRect& clipRect);
+    virtual WebCore::IntPoint screenToWindow(const WebCore::IntPoint&) const;
+    virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&) const;
+    virtual PlatformPageClient platformPageClient() const { return 0; }
+    virtual void contentsSizeChanged(WebCore::Frame*, const WebCore::IntSize&) const;
+    virtual void scrollRectIntoView(
+        const WebCore::IntRect&, const WebCore::ScrollView*) const { }
+    virtual void scrollbarsModeDidChange() const;
+    virtual void mouseDidMoveOverElement(
+        const WebCore::HitTestResult& result, unsigned modifierFlags);
+    virtual void setToolTip(const WebCore::String& tooltipText, WebCore::TextDirection);
+    virtual void print(WebCore::Frame*);
+    virtual void exceededDatabaseQuota(
+        WebCore::Frame*, const WebCore::String& databaseName);
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
+#endif
+#if ENABLE(NOTIFICATIONS)
+    virtual WebCore::NotificationPresenter* notificationPresenter() const;
+#endif
+    virtual void requestGeolocationPermissionForFrame(
+        WebCore::Frame*, WebCore::Geolocation*) { }
+    virtual void runOpenPanel(WebCore::Frame*, PassRefPtr<WebCore::FileChooser>);
+    virtual bool setCursor(WebCore::PlatformCursorHandle) { return false; }
+    virtual void formStateDidChange(const WebCore::Node*);
+    virtual PassOwnPtr<WebCore::HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
+
+    // ChromeClientChromium methods:
+    virtual void popupOpened(WebCore::PopupContainer* popupContainer,
+                             const WebCore::IntRect& bounds,
+                             bool activatable,
+                             bool handleExternally);
+
+    // ChromeClientImpl:
+    void setCursor(const WebCursorInfo& cursor);
+    void setCursorForPlugin(const WebCursorInfo& cursor);
+
+private:
+    void getPopupMenuInfo(WebCore::PopupContainer*, WebPopupMenuInfo*);
+
+    WebViewImpl* m_webView;  // weak pointer
+    bool m_toolbarsVisible;
+    bool m_statusbarVisible;
+    bool m_scrollbarsVisible;
+    bool m_menubarVisible;
+    bool m_resizable;
+    // Set to true if the next SetCursor is to be ignored.
+    bool m_ignoreNextSetCursor;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/ChromiumBridge.cpp b/WebKit/chromium/src/ChromiumBridge.cpp
new file mode 100644
index 0000000..93d92ba
--- /dev/null
+++ b/WebKit/chromium/src/ChromiumBridge.cpp
@@ -0,0 +1,689 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ChromiumBridge.h"
+
+#include <googleurl/src/url_util.h>
+
+#include "ChromeClientImpl.h"
+#include "WebClipboard.h"
+#include "WebCookie.h"
+#include "WebCursorInfo.h"
+#include "WebData.h"
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include "WebImage.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebMimeRegistry.h"
+#include "WebPluginContainerImpl.h"
+#include "WebPluginListBuilderImpl.h"
+#include "WebScreenInfo.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebVector.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+#include "WebWorkerClientImpl.h"
+
+#if PLATFORM(WIN_OS)
+#include "WebRect.h"
+#include "WebSandboxSupport.h"
+#include "WebThemeEngine.h"
+#endif
+
+#if PLATFORM(LINUX)
+#include "WebSandboxSupport.h"
+#include "WebFontInfo.h"
+#endif
+
+#if WEBKIT_USING_SKIA
+#include "NativeImageSkia.h"
+#endif
+
+#include "BitmapImage.h"
+#include "Cookie.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "KURL.h"
+#include "NotImplemented.h"
+#include "PlatformContextSkia.h"
+#include "PluginData.h"
+#include "Worker.h"
+#include "WorkerContextProxy.h"
+#include <wtf/Assertions.h>
+
+// We are part of the WebKit implementation.
+using namespace WebKit;
+
+namespace WebCore {
+
+static ChromeClientImpl* toChromeClientImpl(Widget* widget)
+{
+    FrameView* view;
+    if (widget->isFrameView())
+        view = static_cast<FrameView*>(widget);
+    else if (widget->parent() && widget->parent()->isFrameView())
+        view = static_cast<FrameView*>(widget->parent());
+    else
+        return 0;
+
+    Page* page = view->frame() ? view->frame()->page() : 0;
+    if (!page)
+        return 0;
+
+    return static_cast<ChromeClientImpl*>(page->chrome()->client());
+}
+
+static WebWidgetClient* toWebWidgetClient(Widget* widget)
+{
+    ChromeClientImpl* chromeClientImpl = toChromeClientImpl(widget);
+    if (!chromeClientImpl || !chromeClientImpl->webView())
+        return 0;
+    return chromeClientImpl->webView()->client();
+}
+
+// Clipboard ------------------------------------------------------------------
+
+bool ChromiumBridge::clipboardIsFormatAvailable(
+    PasteboardPrivate::ClipboardFormat format,
+    PasteboardPrivate::ClipboardBuffer buffer)
+{
+    return webKitClient()->clipboard()->isFormatAvailable(
+        static_cast<WebClipboard::Format>(format),
+        static_cast<WebClipboard::Buffer>(buffer));
+}
+
+String ChromiumBridge::clipboardReadPlainText(
+    PasteboardPrivate::ClipboardBuffer buffer)
+{
+    return webKitClient()->clipboard()->readPlainText(
+        static_cast<WebClipboard::Buffer>(buffer));
+}
+
+void ChromiumBridge::clipboardReadHTML(
+    PasteboardPrivate::ClipboardBuffer buffer,
+    String* htmlText, KURL* sourceURL)
+{
+    WebURL url;
+    *htmlText = webKitClient()->clipboard()->readHTML(
+        static_cast<WebClipboard::Buffer>(buffer), &url);
+    *sourceURL = url;
+}
+
+void ChromiumBridge::clipboardWriteSelection(const String& htmlText,
+                                             const KURL& sourceURL,
+                                             const String& plainText,
+                                             bool writeSmartPaste)
+{
+    webKitClient()->clipboard()->writeHTML(
+        htmlText, sourceURL, plainText, writeSmartPaste);
+}
+
+void ChromiumBridge::clipboardWritePlainText(const String& plainText)
+{
+    webKitClient()->clipboard()->writePlainText(plainText);
+}
+
+void ChromiumBridge::clipboardWriteURL(const KURL& url, const String& title)
+{
+    webKitClient()->clipboard()->writeURL(url, title);
+}
+
+void ChromiumBridge::clipboardWriteImage(NativeImagePtr image,
+                                         const KURL& sourceURL,
+                                         const String& title)
+{
+#if WEBKIT_USING_SKIA
+    WebImage webImage(*image);
+#else
+    WebImage webImage(image);
+#endif
+    webKitClient()->clipboard()->writeImage(webImage, sourceURL, title);
+}
+
+// Cookies --------------------------------------------------------------------
+
+void ChromiumBridge::setCookies(const KURL& url,
+                                const KURL& firstPartyForCookies,
+                                const String& cookie)
+{
+    webKitClient()->setCookies(url, firstPartyForCookies, cookie);
+}
+
+String ChromiumBridge::cookies(const KURL& url,
+                               const KURL& firstPartyForCookies)
+{
+    return webKitClient()->cookies(url, firstPartyForCookies);
+}
+
+bool ChromiumBridge::rawCookies(const KURL& url, const KURL& firstPartyForCookies, Vector<Cookie>* rawCookies)
+{
+    rawCookies->clear();
+    WebVector<WebCookie> webCookies;
+    if (!webKitClient()->rawCookies(url, firstPartyForCookies, &webCookies))
+        return false;
+
+    for (unsigned i = 0; i < webCookies.size(); ++i) {
+        const WebCookie& webCookie = webCookies[i];
+        Cookie cookie(webCookie.name,
+                      webCookie.value,
+                      webCookie.domain,
+                      webCookie.path,
+                      webCookie.expires,
+                      webCookie.httpOnly,
+                      webCookie.secure,
+                      webCookie.session);
+        rawCookies->append(cookie);
+    }
+    return true;
+}
+
+void ChromiumBridge::deleteCookie(const KURL& url, const String& cookieName)
+{
+    webKitClient()->deleteCookie(url, cookieName);
+}
+
+// DNS ------------------------------------------------------------------------
+
+void ChromiumBridge::prefetchDNS(const String& hostname)
+{
+    webKitClient()->prefetchHostName(hostname);
+}
+
+// File ------------------------------------------------------------------------
+
+bool ChromiumBridge::fileExists(const String& path)
+{
+    return webKitClient()->fileExists(path);
+}
+
+bool ChromiumBridge::deleteFile(const String& path)
+{
+    return webKitClient()->deleteFile(path);
+}
+
+bool ChromiumBridge::deleteEmptyDirectory(const String& path)
+{
+    return webKitClient()->deleteEmptyDirectory(path);
+}
+
+bool ChromiumBridge::getFileSize(const String& path, long long& result)
+{
+    return webKitClient()->getFileSize(path, result);
+}
+
+bool ChromiumBridge::getFileModificationTime(const String& path, time_t& result)
+{
+    return webKitClient()->getFileModificationTime(path, result);
+}
+
+String ChromiumBridge::directoryName(const String& path)
+{
+    return webKitClient()->directoryName(path);
+}
+
+String ChromiumBridge::pathByAppendingComponent(const String& path, const String& component)
+{
+    return webKitClient()->pathByAppendingComponent(path, component);
+}
+
+bool ChromiumBridge::makeAllDirectories(const String& path)
+{
+    return webKitClient()->makeAllDirectories(path);
+}
+
+String ChromiumBridge::getAbsolutePath(const String& path)
+{
+    return webKitClient()->getAbsolutePath(path);
+}
+
+bool ChromiumBridge::isDirectory(const String& path)
+{
+    return webKitClient()->isDirectory(path);
+}
+
+KURL ChromiumBridge::filePathToURL(const String& path)
+{
+    return webKitClient()->filePathToURL(path);
+}
+
+// Font -----------------------------------------------------------------------
+
+#if PLATFORM(WIN_OS)
+bool ChromiumBridge::ensureFontLoaded(HFONT font)
+{
+    WebSandboxSupport* ss = webKitClient()->sandboxSupport();
+
+    // if there is no sandbox, then we can assume the font
+    // was able to be loaded successfully already
+    return ss ? ss->ensureFontLoaded(font) : true;
+}
+#endif
+
+#if PLATFORM(LINUX)
+String ChromiumBridge::getFontFamilyForCharacters(const UChar* characters, size_t numCharacters)
+{
+    if (webKitClient()->sandboxSupport())
+        return webKitClient()->sandboxSupport()->getFontFamilyForCharacters(characters, numCharacters);
+
+    WebCString family = WebFontInfo::familyForChars(characters, numCharacters);
+    if (family.data())
+        return WebString::fromUTF8(family.data());
+
+    return WebString();
+}
+#endif
+
+// HTML5 DB -------------------------------------------------------------------
+
+#if ENABLE(DATABASE)
+PlatformFileHandle ChromiumBridge::databaseOpenFile(const String& vfsFileName, int desiredFlags, PlatformFileHandle* dirHandle)
+{
+    return webKitClient()->databaseOpenFile(WebString(vfsFileName), desiredFlags, dirHandle);
+}
+
+int ChromiumBridge::databaseDeleteFile(const String& vfsFileName, bool syncDir)
+{
+    return webKitClient()->databaseDeleteFile(WebString(vfsFileName), syncDir);
+}
+
+long ChromiumBridge::databaseGetFileAttributes(const String& vfsFileName)
+{
+    return webKitClient()->databaseGetFileAttributes(WebString(vfsFileName));
+}
+
+long long ChromiumBridge::databaseGetFileSize(const String& vfsFileName)
+{
+    return webKitClient()->databaseGetFileSize(WebString(vfsFileName));
+}
+#endif
+
+// Keygen ---------------------------------------------------------------------
+
+String ChromiumBridge::signedPublicKeyAndChallengeString(
+    unsigned keySizeIndex, const String& challenge, const KURL& url)
+{
+    return webKitClient()->signedPublicKeyAndChallengeString(keySizeIndex,
+                                                             WebString(challenge),
+                                                             WebURL(url));
+}
+
+// Language -------------------------------------------------------------------
+
+String ChromiumBridge::computedDefaultLanguage()
+{
+    return webKitClient()->defaultLocale();
+}
+
+// LayoutTestMode -------------------------------------------------------------
+
+bool ChromiumBridge::layoutTestMode()
+{
+    return WebKit::layoutTestMode();
+}
+
+// MimeType -------------------------------------------------------------------
+
+bool ChromiumBridge::isSupportedImageMIMEType(const String& mimeType)
+{
+    return webKitClient()->mimeRegistry()->supportsImageMIMEType(mimeType)
+        != WebMimeRegistry::IsNotSupported;
+}
+
+bool ChromiumBridge::isSupportedJavaScriptMIMEType(const String& mimeType)
+{
+    return webKitClient()->mimeRegistry()->supportsJavaScriptMIMEType(mimeType)
+        != WebMimeRegistry::IsNotSupported;
+}
+
+bool ChromiumBridge::isSupportedNonImageMIMEType(const String& mimeType)
+{
+    return webKitClient()->mimeRegistry()->supportsNonImageMIMEType(mimeType)
+        != WebMimeRegistry::IsNotSupported;
+}
+
+String ChromiumBridge::mimeTypeForExtension(const String& extension)
+{
+    return webKitClient()->mimeRegistry()->mimeTypeForExtension(extension);
+}
+
+String ChromiumBridge::mimeTypeFromFile(const String& path)
+{
+    return webKitClient()->mimeRegistry()->mimeTypeFromFile(path);
+}
+
+String ChromiumBridge::preferredExtensionForMIMEType(const String& mimeType)
+{
+    return webKitClient()->mimeRegistry()->preferredExtensionForMIMEType(mimeType);
+}
+
+// Plugin ---------------------------------------------------------------------
+
+bool ChromiumBridge::plugins(bool refresh, Vector<PluginInfo*>* results)
+{
+    WebPluginListBuilderImpl builder(results);
+    webKitClient()->getPluginList(refresh, &builder);
+    return true;  // FIXME: There is no need for this function to return a value.
+}
+
+NPObject* ChromiumBridge::pluginScriptableObject(Widget* widget)
+{
+    if (!widget)
+        return 0;
+
+    ASSERT(!widget->isFrameView());
+
+    // NOTE:  We have to trust that the widget passed to us here is a
+    // WebPluginContainerImpl.  There isn't a way to dynamically verify it,
+    // since the derived class (Widget) has no identifier.
+    return static_cast<WebPluginContainerImpl*>(widget)->scriptableObject();
+}
+
+// Resources ------------------------------------------------------------------
+
+PassRefPtr<Image> ChromiumBridge::loadPlatformImageResource(const char* name)
+{
+    const WebData& resource = webKitClient()->loadResource(name);
+    if (resource.isEmpty())
+        return Image::nullImage();
+
+    RefPtr<Image> image = BitmapImage::create();
+    image->setData(resource, true);
+    return image;
+}
+
+// Sandbox --------------------------------------------------------------------
+
+bool ChromiumBridge::sandboxEnabled()
+{
+    return webKitClient()->sandboxEnabled();
+}
+
+// SharedTimers ---------------------------------------------------------------
+
+void ChromiumBridge::setSharedTimerFiredFunction(void (*func)())
+{
+    webKitClient()->setSharedTimerFiredFunction(func);
+}
+
+void ChromiumBridge::setSharedTimerFireTime(double fireTime)
+{
+    webKitClient()->setSharedTimerFireTime(fireTime);
+}
+
+void ChromiumBridge::stopSharedTimer()
+{
+    webKitClient()->stopSharedTimer();
+}
+
+// StatsCounters --------------------------------------------------------------
+
+void ChromiumBridge::decrementStatsCounter(const char* name)
+{
+    webKitClient()->decrementStatsCounter(name);
+}
+
+void ChromiumBridge::incrementStatsCounter(const char* name)
+{
+    webKitClient()->incrementStatsCounter(name);
+}
+
+// Sudden Termination ---------------------------------------------------------
+
+void ChromiumBridge::suddenTerminationChanged(bool enabled)
+{
+    webKitClient()->suddenTerminationChanged(enabled);
+}
+
+// SystemTime -----------------------------------------------------------------
+
+double ChromiumBridge::currentTime()
+{
+    return webKitClient()->currentTime();
+}
+
+// Theming --------------------------------------------------------------------
+
+#if PLATFORM(WIN_OS)
+
+void ChromiumBridge::paintButton(
+    GraphicsContext* gc, int part, int state, int classicState,
+    const IntRect& rect)
+{
+    webKitClient()->themeEngine()->paintButton(
+        gc->platformContext()->canvas(), part, state, classicState, rect);
+}
+
+void ChromiumBridge::paintMenuList(
+    GraphicsContext* gc, int part, int state, int classicState,
+    const IntRect& rect)
+{
+    webKitClient()->themeEngine()->paintMenuList(
+        gc->platformContext()->canvas(), part, state, classicState, rect);
+}
+
+void ChromiumBridge::paintScrollbarArrow(
+    GraphicsContext* gc, int state, int classicState,
+    const IntRect& rect)
+{
+    webKitClient()->themeEngine()->paintScrollbarArrow(
+        gc->platformContext()->canvas(), state, classicState, rect);
+}
+
+void ChromiumBridge::paintScrollbarThumb(
+    GraphicsContext* gc, int part, int state, int classicState,
+    const IntRect& rect)
+{
+    webKitClient()->themeEngine()->paintScrollbarThumb(
+        gc->platformContext()->canvas(), part, state, classicState, rect);
+}
+
+void ChromiumBridge::paintScrollbarTrack(
+    GraphicsContext* gc, int part, int state, int classicState,
+    const IntRect& rect, const IntRect& alignRect)
+{
+    webKitClient()->themeEngine()->paintScrollbarTrack(
+        gc->platformContext()->canvas(), part, state, classicState, rect,
+        alignRect);
+}
+
+void ChromiumBridge::paintTextField(
+    GraphicsContext* gc, int part, int state, int classicState,
+    const IntRect& rect, const Color& color, bool fillContentArea,
+    bool drawEdges)
+{
+    // Fallback to white when |color| is invalid.
+    RGBA32 backgroundColor = color.isValid() ? color.rgb() : Color::white;
+
+    webKitClient()->themeEngine()->paintTextField(
+        gc->platformContext()->canvas(), part, state, classicState, rect,
+        backgroundColor, fillContentArea, drawEdges);
+}
+
+void ChromiumBridge::paintTrackbar(
+    GraphicsContext* gc, int part, int state, int classicState,
+    const IntRect& rect)
+{
+    webKitClient()->themeEngine()->paintTrackbar(
+        gc->platformContext()->canvas(), part, state, classicState, rect);
+}
+
+#endif
+
+// Trace Event ----------------------------------------------------------------
+
+void ChromiumBridge::traceEventBegin(const char* name, void* id, const char* extra)
+{
+    webKitClient()->traceEventBegin(name, id, extra);
+}
+
+void ChromiumBridge::traceEventEnd(const char* name, void* id, const char* extra)
+{
+    webKitClient()->traceEventEnd(name, id, extra);
+}
+
+// Visited Links --------------------------------------------------------------
+
+LinkHash ChromiumBridge::visitedLinkHash(const UChar* url, unsigned length)
+{
+    url_canon::RawCanonOutput<2048> buffer;
+    url_parse::Parsed parsed;
+    if (!url_util::Canonicalize(url, length, 0, &buffer, &parsed))
+        return 0;  // Invalid URLs are unvisited.
+    return webKitClient()->visitedLinkHash(buffer.data(), buffer.length());
+}
+
+LinkHash ChromiumBridge::visitedLinkHash(const KURL& base,
+                                         const AtomicString& attributeURL)
+{
+    // Resolve the relative URL using googleurl and pass the absolute URL up to
+    // the embedder. We could create a GURL object from the base and resolve
+    // the relative URL that way, but calling the lower-level functions
+    // directly saves us the string allocation in most cases.
+    url_canon::RawCanonOutput<2048> buffer;
+    url_parse::Parsed parsed;
+
+#if USE(GOOGLEURL)
+    const CString& cstr = base.utf8String();
+    const char* data = cstr.data();
+    int length = cstr.length();
+    const url_parse::Parsed& srcParsed = base.parsed();
+#else
+    // When we're not using GoogleURL, first canonicalize it so we can resolve it
+    // below.
+    url_canon::RawCanonOutput<2048> srcCanon;
+    url_parse::Parsed srcParsed;
+    String str = base.string();
+    if (!url_util::Canonicalize(str.characters(), str.length(), 0, &srcCanon, &srcParsed))
+        return 0;
+    const char* data = srcCanon.data();
+    int length = srcCanon.length();
+#endif
+
+    if (!url_util::ResolveRelative(data, length, srcParsed, attributeURL.characters(),
+                                   attributeURL.length(), 0, &buffer, &parsed))
+        return 0;  // Invalid resolved URL.
+
+    return webKitClient()->visitedLinkHash(buffer.data(), buffer.length());
+}
+
+bool ChromiumBridge::isLinkVisited(LinkHash visitedLinkHash)
+{
+    return webKitClient()->isLinkVisited(visitedLinkHash);
+}
+
+// These are temporary methods that the WebKit layer can use to call to the
+// Glue layer. Once the Glue layer moves entirely into the WebKit layer, these
+// methods will be deleted.
+
+void ChromiumBridge::notifyJSOutOfMemory(Frame* frame)
+{
+    if (!frame)
+        return;
+
+    WebFrameImpl* webFrame = WebFrameImpl::fromFrame(frame);
+    if (!webFrame->client())
+        return;
+    webFrame->client()->didExhaustMemoryAvailableForScript(webFrame);
+}
+
+int ChromiumBridge::memoryUsageMB()
+{
+    return static_cast<int>(webKitClient()->memoryUsageMB());
+}
+
+int ChromiumBridge::screenDepth(Widget* widget)
+{
+    WebWidgetClient* client = toWebWidgetClient(widget);
+    if (!client)
+        return 0;
+    return client->screenInfo().depth;
+}
+
+int ChromiumBridge::screenDepthPerComponent(Widget* widget)
+{
+    WebWidgetClient* client = toWebWidgetClient(widget);
+    if (!client)
+        return 0;
+    return client->screenInfo().depthPerComponent;
+}
+
+bool ChromiumBridge::screenIsMonochrome(Widget* widget)
+{
+    WebWidgetClient* client = toWebWidgetClient(widget);
+    if (!client)
+        return 0;
+    return client->screenInfo().isMonochrome;
+}
+
+IntRect ChromiumBridge::screenRect(Widget* widget)
+{
+    WebWidgetClient* client = toWebWidgetClient(widget);
+    if (!client)
+        return IntRect();
+    return client->screenInfo().rect;
+}
+
+IntRect ChromiumBridge::screenAvailableRect(Widget* widget)
+{
+    WebWidgetClient* client = toWebWidgetClient(widget);
+    if (!client)
+        return IntRect();
+    return client->screenInfo().availableRect;
+}
+
+bool ChromiumBridge::popupsAllowed(NPP npp)
+{
+    // FIXME: Give the embedder a way to control this.
+    return false;
+}
+
+void ChromiumBridge::widgetSetCursor(Widget* widget, const Cursor& cursor)
+{
+    ChromeClientImpl* client = toChromeClientImpl(widget);
+    if (client)
+        client->setCursor(WebCursorInfo(cursor));
+}
+
+void ChromiumBridge::widgetSetFocus(Widget* widget)
+{
+    ChromeClientImpl* client = toChromeClientImpl(widget);
+    if (client)
+        client->focus();
+}
+
+WorkerContextProxy* WorkerContextProxy::create(Worker* worker)
+{
+    return WebWorkerClientImpl::createWorkerContextProxy(worker);
+}
+
+} // namespace WebCore
diff --git a/WebKit/chromium/src/ChromiumCurrentTime.cpp b/WebKit/chromium/src/ChromiumCurrentTime.cpp
new file mode 100644
index 0000000..1eccc41
--- /dev/null
+++ b/WebKit/chromium/src/ChromiumCurrentTime.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include <wtf/CurrentTime.h>
+
+#include "WebKit.h"
+#include "WebKitClient.h"
+
+namespace WTF {
+
+double currentTime()
+{
+    return WebKit::webKitClient()->currentTime();
+}
+
+}  // namespace WTF
diff --git a/WebKit/chromium/src/ChromiumThreading.cpp b/WebKit/chromium/src/ChromiumThreading.cpp
new file mode 100644
index 0000000..902a433
--- /dev/null
+++ b/WebKit/chromium/src/ChromiumThreading.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include <wtf/chromium/ChromiumThreading.h>
+
+#include "WebKit.h"
+#include "WebKitClient.h"
+
+#include <wtf/MainThread.h>
+
+namespace WTF {
+
+void ChromiumThreading::initializeMainThread()
+{
+}
+
+void ChromiumThreading::scheduleDispatchFunctionsOnMainThread()
+{
+    WebKit::webKitClient()->callOnMainThread(&WTF::dispatchFunctionsFromMainThread);
+}
+
+}  // namespace WTF
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.cpp b/WebKit/chromium/src/ContextMenuClientImpl.cpp
new file mode 100644
index 0000000..f23919e
--- /dev/null
+++ b/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -0,0 +1,279 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ContextMenuClientImpl.h"
+
+#include "ContextMenu.h"
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "Editor.h"
+#include "EventHandler.h"
+#include "FrameLoader.h"
+#include "FrameView.h"
+#include "HitTestResult.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "KURL.h"
+#include "MediaError.h"
+#include "PlatformString.h"
+#include "TextBreakIterator.h"
+#include "Widget.h"
+
+#include "WebContextMenuData.h"
+#include "WebDataSourceImpl.h"
+#include "WebFrameImpl.h"
+#include "WebMenuItemInfo.h"
+#include "WebPoint.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebURLResponse.h"
+#include "WebVector.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// Figure out the URL of a page or subframe. Returns |page_type| as the type,
+// which indicates page or subframe, or ContextNodeType::NONE if the URL could not
+// be determined for some reason.
+static WebURL urlFromFrame(Frame* frame)
+{
+    if (frame) {
+        DocumentLoader* dl = frame->loader()->documentLoader();
+        if (dl) {
+            WebDataSource* ds = WebDataSourceImpl::fromDocumentLoader(dl);
+            if (ds)
+                return ds->hasUnreachableURL() ? ds->unreachableURL() : ds->request().url();
+        }
+    }
+    return WebURL();
+}
+
+// Helper function to determine whether text is a single word or a sentence.
+static bool isASingleWord(const String& text)
+{
+    TextBreakIterator* it = characterBreakIterator(text.characters(), text.length());
+    return it && textBreakNext(it) == TextBreakDone;
+}
+
+// Helper function to get misspelled word on which context menu
+// is to be evolked. This function also sets the word on which context menu
+// has been evoked to be the selected word, as required. This function changes
+// the selection only when there were no selected characters.
+static String selectMisspelledWord(const ContextMenu* defaultMenu, Frame* selectedFrame)
+{
+    // First select from selectedText to check for multiple word selection.
+    String misspelledWord = selectedFrame->selectedText().stripWhiteSpace();
+
+    // If some texts were already selected, we don't change the selection.
+    if (!misspelledWord.isEmpty()) {
+        // Don't provide suggestions for multiple words.
+        if (!isASingleWord(misspelledWord))
+            return String();
+        return misspelledWord;
+    }
+
+    // Selection is empty, so change the selection to the word under the cursor.
+    HitTestResult hitTestResult = selectedFrame->eventHandler()->
+        hitTestResultAtPoint(defaultMenu->hitTestResult().point(), true);
+    Node* innerNode = hitTestResult.innerNode();
+    VisiblePosition pos(innerNode->renderer()->positionForPoint(
+        hitTestResult.localPoint()));
+
+    VisibleSelection selection;
+    if (pos.isNotNull()) {
+        selection = VisibleSelection(pos);
+        selection.expandUsingGranularity(WordGranularity);
+    }
+
+    if (selection.isRange())
+        selectedFrame->setSelectionGranularity(WordGranularity);
+
+    if (selectedFrame->shouldChangeSelection(selection))
+        selectedFrame->selection()->setSelection(selection);
+
+    misspelledWord = selectedFrame->selectedText().stripWhiteSpace();
+
+    // If misspelled word is still empty, then that portion should not be
+    // selected. Set the selection to that position only, and do not expand.
+    if (misspelledWord.isEmpty()) {
+        selection = VisibleSelection(pos);
+        selectedFrame->selection()->setSelection(selection);
+    }
+
+    return misspelledWord;
+}
+
+PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
+    ContextMenu* defaultMenu)
+{
+    // Displaying the context menu in this function is a big hack as we don't
+    // have context, i.e. whether this is being invoked via a script or in
+    // response to user input (Mouse event WM_RBUTTONDOWN,
+    // Keyboard events KeyVK_APPS, Shift+F10). Check if this is being invoked
+    // in response to the above input events before popping up the context menu.
+    if (!m_webView->contextMenuAllowed())
+        return 0;
+
+    HitTestResult r = defaultMenu->hitTestResult();
+    Frame* selectedFrame = r.innerNonSharedNode()->document()->frame();
+
+    WebContextMenuData data;
+    data.mousePosition = selectedFrame->view()->contentsToWindow(r.point());
+
+    // Links, Images, Media tags, and Image/Media-Links take preference over
+    // all else.
+    data.linkURL = r.absoluteLinkURL();
+
+    data.mediaType = WebContextMenuData::MediaTypeNone;
+    data.mediaFlags = WebContextMenuData::MediaNone;
+
+    if (!r.absoluteImageURL().isEmpty()) {
+        data.srcURL = r.absoluteImageURL();
+        data.mediaType = WebContextMenuData::MediaTypeImage;
+    } else if (!r.absoluteMediaURL().isEmpty()) {
+        data.srcURL = r.absoluteMediaURL();
+
+        // We know that if absoluteMediaURL() is not empty, then this
+        // is a media element.
+        HTMLMediaElement* mediaElement =
+            static_cast<HTMLMediaElement*>(r.innerNonSharedNode());
+        if (mediaElement->hasTagName(HTMLNames::videoTag))
+            data.mediaType = WebContextMenuData::MediaTypeVideo;
+        else if (mediaElement->hasTagName(HTMLNames::audioTag))
+            data.mediaType = WebContextMenuData::MediaTypeAudio;
+
+        if (mediaElement->error())
+            data.mediaFlags |= WebContextMenuData::MediaInError;
+        if (mediaElement->paused())
+            data.mediaFlags |= WebContextMenuData::MediaPaused;
+        if (mediaElement->muted())
+            data.mediaFlags |= WebContextMenuData::MediaMuted;
+        if (mediaElement->loop())
+            data.mediaFlags |= WebContextMenuData::MediaLoop;
+        if (mediaElement->supportsSave())
+            data.mediaFlags |= WebContextMenuData::MediaCanSave;
+        if (mediaElement->hasAudio())
+            data.mediaFlags |= WebContextMenuData::MediaHasAudio;
+    }
+    // If it's not a link, an image, a media element, or an image/media link,
+    // show a selection menu or a more generic page menu.
+    data.frameEncoding = selectedFrame->loader()->encoding();
+
+    // Send the frame and page URLs in any case.
+    data.pageURL = urlFromFrame(m_webView->mainFrameImpl()->frame());
+    if (selectedFrame != m_webView->mainFrameImpl()->frame())
+        data.frameURL = urlFromFrame(selectedFrame);
+
+    if (r.isSelected())
+        data.selectedText = selectedFrame->selectedText().stripWhiteSpace();
+
+    data.isEditable = false;
+    if (r.isContentEditable()) {
+        data.isEditable = true;
+        if (m_webView->focusedWebCoreFrame()->editor()->isContinuousSpellCheckingEnabled()) {
+            data.isSpellCheckingEnabled = true;
+            data.misspelledWord = selectMisspelledWord(defaultMenu, selectedFrame);
+        }
+    }
+
+    // Now retrieve the security info.
+    DocumentLoader* dl = selectedFrame->loader()->documentLoader();
+    WebDataSource* ds = WebDataSourceImpl::fromDocumentLoader(dl);
+    if (ds)
+        data.securityInfo = ds->response().securityInfo();
+
+    // Compute edit flags.
+    data.editFlags = WebContextMenuData::CanDoNone;
+    if (m_webView->focusedWebCoreFrame()->editor()->canUndo())
+        data.editFlags |= WebContextMenuData::CanUndo;
+    if (m_webView->focusedWebCoreFrame()->editor()->canRedo())
+        data.editFlags |= WebContextMenuData::CanRedo;
+    if (m_webView->focusedWebCoreFrame()->editor()->canCut())
+        data.editFlags |= WebContextMenuData::CanCut;
+    if (m_webView->focusedWebCoreFrame()->editor()->canCopy())
+        data.editFlags |= WebContextMenuData::CanCopy;
+    if (m_webView->focusedWebCoreFrame()->editor()->canPaste())
+        data.editFlags |= WebContextMenuData::CanPaste;
+    if (m_webView->focusedWebCoreFrame()->editor()->canDelete())
+        data.editFlags |= WebContextMenuData::CanDelete;
+    // We can always select all...
+    data.editFlags |= WebContextMenuData::CanSelectAll;
+
+    // Filter out custom menu elements and add them into the data.
+    populateCustomMenuItems(defaultMenu, &data);
+
+    WebFrame* selected_web_frame = WebFrameImpl::fromFrame(selectedFrame);
+    if (m_webView->client())
+        m_webView->client()->showContextMenu(selected_web_frame, data);
+
+    return 0;
+}
+
+void ContextMenuClientImpl::populateCustomMenuItems(WebCore::ContextMenu* defaultMenu, WebContextMenuData* data)
+{
+    Vector<WebMenuItemInfo> customItems;
+    for (size_t i = 0; i < defaultMenu->itemCount(); ++i) {
+        ContextMenuItem* inputItem = defaultMenu->itemAtIndex(i, defaultMenu->platformDescription());
+        if (inputItem->action() < ContextMenuItemBaseCustomTag || inputItem->action() >=  ContextMenuItemBaseApplicationTag)
+            continue;
+
+        WebMenuItemInfo outputItem;
+        outputItem.label = inputItem->title();
+        outputItem.enabled = inputItem->enabled();
+        outputItem.checked = inputItem->checked();
+        outputItem.action = static_cast<unsigned>(inputItem->action() - ContextMenuItemBaseCustomTag);
+        switch (inputItem->type()) {
+        case ActionType:
+            outputItem.type = WebMenuItemInfo::Option;
+            break;
+        case CheckableActionType:
+            outputItem.type = WebMenuItemInfo::CheckableOption;
+            break;
+        case SeparatorType:
+            outputItem.type = WebMenuItemInfo::Separator;
+            break;
+        case SubmenuType:
+            outputItem.type = WebMenuItemInfo::Group;
+            break;
+        }
+        customItems.append(outputItem);
+    }
+
+    WebVector<WebMenuItemInfo> outputItems(customItems.size());
+    for (size_t i = 0; i < customItems.size(); ++i)
+        outputItems[i] = customItems[i];
+    data->customItems.swap(outputItems);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.h b/WebKit/chromium/src/ContextMenuClientImpl.h
new file mode 100644
index 0000000..4191fad
--- /dev/null
+++ b/WebKit/chromium/src/ContextMenuClientImpl.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ContextMenuClientImpl_h
+#define ContextMenuClientImpl_h
+
+#include "ContextMenuClient.h"
+
+namespace WebKit {
+
+class WebViewImpl;
+struct WebContextMenuData;
+
+class ContextMenuClientImpl : public  WebCore::ContextMenuClient {
+public:
+    ContextMenuClientImpl(WebViewImpl* webView) : m_webView(webView) {}
+    virtual ~ContextMenuClientImpl() {}
+    virtual void copyImageToClipboard(const WebCore::HitTestResult&) {}
+    virtual void contextMenuDestroyed() {}
+    virtual void contextMenuItemSelected(WebCore::ContextMenuItem*, const WebCore::ContextMenu*) {}
+    virtual void downloadURL(const WebCore::KURL&) {}
+    virtual WebCore::PlatformMenuDescription getCustomMenuFromDefaultItems(WebCore::ContextMenu*);
+    virtual bool isSpeaking() { return false; }
+    virtual void lookUpInDictionary(WebCore::Frame*) {}
+    virtual void searchWithGoogle(const WebCore::Frame*) {}
+    virtual bool shouldIncludeInspectElementItem() { return false; }
+    virtual void speak(const WebCore::String&) {}
+    virtual void stopSpeaking() {}
+private:
+    void populateCustomMenuItems(WebCore::ContextMenu*, WebContextMenuData*);
+    WebViewImpl* m_webView;
+};
+
+} // namespace WebKit
+
+#endif // ContextMenuClientImpl_h
diff --git a/WebKit/chromium/src/DOMUtilitiesPrivate.cpp b/WebKit/chromium/src/DOMUtilitiesPrivate.cpp
new file mode 100644
index 0000000..ffdd85d
--- /dev/null
+++ b/WebKit/chromium/src/DOMUtilitiesPrivate.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMUtilitiesPrivate.h"
+
+#include "Element.h"
+#include "HTMLInputElement.h"
+#include "HTMLLinkElement.h"
+#include "HTMLMetaElement.h"
+#include "HTMLNames.h"
+#include "HTMLOptionElement.h"
+#include "Node.h"
+
+#include "WebInputElement.h"
+
+using namespace WebCore;
+
+namespace {
+
+template <class HTMLNodeType>
+HTMLNodeType* toHTMLElement(Node* node, const QualifiedName& name)
+{
+    if (node->isHTMLElement()
+        && static_cast<HTMLElement*>(node)->hasTagName(name)) {
+        return static_cast<HTMLNodeType*>(node);
+    }
+    return 0;
+}
+
+} // namespace
+
+namespace WebKit {
+
+HTMLInputElement* toHTMLInputElement(Node* node)
+{
+    return toHTMLElement<HTMLInputElement>(node, HTMLNames::inputTag);
+}
+
+HTMLLinkElement* toHTMLLinkElement(Node* node)
+{
+    return toHTMLElement<HTMLLinkElement>(node, HTMLNames::linkTag);
+}
+
+HTMLMetaElement* toHTMLMetaElement(Node* node)
+{
+    return toHTMLElement<HTMLMetaElement>(node, HTMLNames::metaTag);
+}
+
+HTMLOptionElement* toHTMLOptionElement(Node* node)
+{
+    return toHTMLElement<HTMLOptionElement>(node, HTMLNames::optionTag);
+}
+
+String nameOfInputElement(HTMLInputElement* element)
+{
+    return WebInputElement(element).nameForAutofill();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/DOMUtilitiesPrivate.h b/WebKit/chromium/src/DOMUtilitiesPrivate.h
new file mode 100644
index 0000000..c02bf84
--- /dev/null
+++ b/WebKit/chromium/src/DOMUtilitiesPrivate.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMUtilitiesPrivate_h
+#define DOMUtilitiesPrivate_h
+
+namespace WebCore {
+class HTMLInputElement;
+class HTMLLinkElement;
+class HTMLMetaElement;
+class HTMLOptionElement;
+class Node;
+class String;
+}
+
+// This file is an aggregate of useful WebCore operations.
+namespace WebKit {
+
+// If node is an HTML node with a tag name of name it is casted and returned.
+// If node is not an HTML node or the tag name is not name, 0 is returned.
+WebCore::HTMLInputElement* toHTMLInputElement(WebCore::Node*);
+WebCore::HTMLLinkElement* toHTMLLinkElement(WebCore::Node*);
+WebCore::HTMLMetaElement* toHTMLMetaElement(WebCore::Node*);
+WebCore::HTMLOptionElement* toHTMLOptionElement(WebCore::Node*);
+
+// FIXME: Deprecate. Use WebInputElement::nameForAutofill instead.
+WebCore::String nameOfInputElement(WebCore::HTMLInputElement*);
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/DatabaseObserver.cpp b/WebKit/chromium/src/DatabaseObserver.cpp
new file mode 100644
index 0000000..54e93e1
--- /dev/null
+++ b/WebKit/chromium/src/DatabaseObserver.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DatabaseObserver.h"
+
+#include "Database.h"
+#include "WebDatabase.h"
+#include "WebDatabaseObserver.h"
+
+using namespace WebKit;
+
+namespace WebCore {
+
+void DatabaseObserver::databaseOpened(Database* database)
+{
+    ASSERT(isMainThread());
+    WebDatabase::observer()->databaseOpened(WebDatabase(database));
+}
+
+void DatabaseObserver::databaseModified(Database* database)
+{
+    ASSERT(isMainThread());
+    WebDatabase::observer()->databaseModified(WebDatabase(database));
+}
+
+void DatabaseObserver::databaseClosed(Database* database)
+{
+    ASSERT(isMainThread());
+    WebDatabase::observer()->databaseClosed(WebDatabase(database));
+}
+
+} // namespace WebCore
diff --git a/WebKit/chromium/src/DragClientImpl.cpp b/WebKit/chromium/src/DragClientImpl.cpp
new file mode 100644
index 0000000..5d8a9c3
--- /dev/null
+++ b/WebKit/chromium/src/DragClientImpl.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DragClientImpl.h"
+
+#include "ChromiumDataObject.h"
+#include "ClipboardChromium.h"
+#include "Frame.h"
+#include "WebDragData.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void DragClientImpl::willPerformDragDestinationAction(DragDestinationAction, DragData*)
+{
+    // FIXME
+}
+
+void DragClientImpl::willPerformDragSourceAction(DragSourceAction, const IntPoint&, Clipboard*)
+{
+    // FIXME
+}
+
+DragDestinationAction DragClientImpl::actionMaskForDrag(DragData*)
+{
+    if (m_webView->client() && m_webView->client()->acceptsLoadDrops())
+        return DragDestinationActionAny;
+
+    return static_cast<DragDestinationAction>(
+        DragDestinationActionDHTML | DragDestinationActionEdit);
+}
+
+DragSourceAction DragClientImpl::dragSourceActionMaskForPoint(const IntPoint& windowPoint)
+{
+    // We want to handle drag operations for all source types.
+    return DragSourceActionAny;
+}
+
+void DragClientImpl::startDrag(DragImageRef dragImage,
+                               const IntPoint& dragImageOrigin,
+                               const IntPoint& eventPos,
+                               Clipboard* clipboard,
+                               Frame* frame,
+                               bool isLinkDrag)
+{
+    // Add a ref to the frame just in case a load occurs mid-drag.
+    RefPtr<Frame> frameProtector = frame;
+
+    WebDragData dragData = static_cast<ClipboardChromium*>(clipboard)->dataObject();
+
+    DragOperation dragOperationMask;
+    if (!clipboard->sourceOperation(dragOperationMask))
+        dragOperationMask = DragOperationEvery;
+
+    m_webView->startDragging(
+        eventPos, dragData, static_cast<WebDragOperationsMask>(dragOperationMask));
+}
+
+DragImageRef DragClientImpl::createDragImageForLink(KURL&, const String& label, Frame*)
+{
+    // FIXME
+    return 0;
+}
+
+void DragClientImpl::dragControllerDestroyed()
+{
+    // Our lifetime is bound to the WebViewImpl.
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/DragClientImpl.h b/WebKit/chromium/src/DragClientImpl.h
new file mode 100644
index 0000000..fc4c608
--- /dev/null
+++ b/WebKit/chromium/src/DragClientImpl.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DragClientImpl_h
+#define DragClientImpl_h
+
+#include "DragActions.h"
+#include "DragClient.h"
+
+namespace WebCore {
+class ClipBoard;
+class DragData;
+class IntPoint;
+class KURL;
+}
+
+namespace WebKit {
+class WebViewImpl;
+
+class DragClientImpl : public WebCore::DragClient {
+public:
+    DragClientImpl(WebViewImpl* webView) : m_webView(webView) { }
+
+    virtual void willPerformDragDestinationAction(
+        WebCore::DragDestinationAction, WebCore::DragData*);
+    virtual void willPerformDragSourceAction(
+        WebCore::DragSourceAction, const WebCore::IntPoint&, WebCore::Clipboard*);
+    virtual WebCore::DragDestinationAction actionMaskForDrag(WebCore::DragData*);
+    virtual WebCore::DragSourceAction dragSourceActionMaskForPoint(
+        const WebCore::IntPoint& windowPoint);
+    virtual void startDrag(
+        WebCore::DragImageRef dragImage,
+        const WebCore::IntPoint& dragImageOrigin,
+        const WebCore::IntPoint& eventPos,
+        WebCore::Clipboard* clipboard,
+        WebCore::Frame* frame,
+        bool isLinkDrag = false);
+    virtual WebCore::DragImageRef createDragImageForLink(
+        WebCore::KURL&, const WebCore::String& label, WebCore::Frame*);
+    virtual void dragControllerDestroyed();
+
+private:
+    WebViewImpl* m_webView;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/EditorClientImpl.cpp b/WebKit/chromium/src/EditorClientImpl.cpp
new file mode 100644
index 0000000..5db8ff7
--- /dev/null
+++ b/WebKit/chromium/src/EditorClientImpl.cpp
@@ -0,0 +1,922 @@
+/*
+ * Copyright (C) 2006, 2007 Apple, Inc.  All rights reserved.
+ * Copyright (C) 2009 Google, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EditorClientImpl.h"
+
+#include "Document.h"
+#include "EditCommand.h"
+#include "Editor.h"
+#include "EventHandler.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "KeyboardCodes.h"
+#include "KeyboardEvent.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformString.h"
+#include "RenderObject.h"
+
+#include "DOMUtilitiesPrivate.h"
+#include "WebEditingAction.h"
+#include "WebFrameImpl.h"
+#include "WebKit.h"
+#include "WebInputElement.h"
+#include "WebNode.h"
+#include "WebPasswordAutocompleteListener.h"
+#include "WebRange.h"
+#include "WebTextAffinity.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// Arbitrary depth limit for the undo stack, to keep it from using
+// unbounded memory.  This is the maximum number of distinct undoable
+// actions -- unbroken stretches of typed characters are coalesced
+// into a single action.
+static const size_t maximumUndoStackDepth = 1000;
+
+// The size above which we stop triggering autofill for an input text field
+// (so to avoid sending long strings through IPC).
+static const size_t maximumTextSizeForAutofill = 1000;
+
+EditorClientImpl::EditorClientImpl(WebViewImpl* webview)
+    : m_webView(webview)
+    , m_inRedo(false)
+    , m_backspaceOrDeletePressed(false)
+    , m_spellCheckThisFieldStatus(SpellCheckAutomatic)
+    , m_autofillTimer(this, &EditorClientImpl::doAutofill)
+{
+}
+
+EditorClientImpl::~EditorClientImpl()
+{
+}
+
+void EditorClientImpl::pageDestroyed()
+{
+    // Our lifetime is bound to the WebViewImpl.
+}
+
+bool EditorClientImpl::shouldShowDeleteInterface(HTMLElement* elem)
+{
+    // Normally, we don't care to show WebCore's deletion UI, so we only enable
+    // it if in testing mode and the test specifically requests it by using this
+    // magic class name.
+    return WebKit::layoutTestMode()
+           && elem->getAttribute(HTMLNames::classAttr) == "needsDeletionUI";
+}
+
+bool EditorClientImpl::smartInsertDeleteEnabled()
+{
+    if (m_webView->client())
+        return m_webView->client()->isSmartInsertDeleteEnabled();
+    return true;
+}
+
+bool EditorClientImpl::isSelectTrailingWhitespaceEnabled()
+{
+    if (m_webView->client())
+        return m_webView->client()->isSelectTrailingWhitespaceEnabled();
+#if PLATFORM(WIN_OS)
+    return true;
+#else
+    return false;
+#endif
+}
+
+bool EditorClientImpl::shouldSpellcheckByDefault()
+{
+    // Spellcheck should be enabled for all editable areas (such as textareas,
+    // contentEditable regions, and designMode docs), except text inputs.
+    const Frame* frame = m_webView->focusedWebCoreFrame();
+    if (!frame)
+        return false;
+    const Editor* editor = frame->editor();
+    if (!editor)
+        return false;
+    if (editor->spellCheckingEnabledInFocusedNode())
+        return true;
+    const Document* document = frame->document();
+    if (!document)
+        return false;
+    const Node* node = document->focusedNode();
+    // If |node| is null, we default to allowing spellchecking. This is done in
+    // order to mitigate the issue when the user clicks outside the textbox, as a
+    // result of which |node| becomes null, resulting in all the spell check
+    // markers being deleted. Also, the Frame will decide not to do spellchecking
+    // if the user can't edit - so returning true here will not cause any problems
+    // to the Frame's behavior.
+    if (!node)
+        return true;
+    const RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return false;
+
+    return !renderer->isTextField();
+}
+
+bool EditorClientImpl::isContinuousSpellCheckingEnabled()
+{
+    if (m_spellCheckThisFieldStatus == SpellCheckForcedOff)
+        return false;
+    if (m_spellCheckThisFieldStatus == SpellCheckForcedOn)
+        return true;
+    return shouldSpellcheckByDefault();
+}
+
+void EditorClientImpl::toggleContinuousSpellChecking()
+{
+    if (isContinuousSpellCheckingEnabled())
+        m_spellCheckThisFieldStatus = SpellCheckForcedOff;
+    else
+        m_spellCheckThisFieldStatus = SpellCheckForcedOn;
+}
+
+bool EditorClientImpl::isGrammarCheckingEnabled()
+{
+    return false;
+}
+
+void EditorClientImpl::toggleGrammarChecking()
+{
+    notImplemented();
+}
+
+int EditorClientImpl::spellCheckerDocumentTag()
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+bool EditorClientImpl::isEditable()
+{
+    return false;
+}
+
+bool EditorClientImpl::shouldBeginEditing(Range* range)
+{
+    if (m_webView->client())
+        return m_webView->client()->shouldBeginEditing(WebRange(range));
+    return true;
+}
+
+bool EditorClientImpl::shouldEndEditing(Range* range)
+{
+    if (m_webView->client())
+        return m_webView->client()->shouldEndEditing(WebRange(range));
+    return true;
+}
+
+bool EditorClientImpl::shouldInsertNode(Node* node,
+                                        Range* range,
+                                        EditorInsertAction action)
+{
+    if (m_webView->client()) {
+        return m_webView->client()->shouldInsertNode(WebNode(node),
+                                                     WebRange(range),
+                                                     static_cast<WebEditingAction>(action));
+    }
+    return true;
+}
+
+bool EditorClientImpl::shouldInsertText(const String& text,
+                                        Range* range,
+                                        EditorInsertAction action)
+{
+    if (m_webView->client()) {
+        return m_webView->client()->shouldInsertText(WebString(text),
+                                                     WebRange(range),
+                                                     static_cast<WebEditingAction>(action));
+    }
+    return true;
+}
+
+
+bool EditorClientImpl::shouldDeleteRange(Range* range)
+{
+    if (m_webView->client())
+        return m_webView->client()->shouldDeleteRange(WebRange(range));
+    return true;
+}
+
+bool EditorClientImpl::shouldChangeSelectedRange(Range* fromRange,
+                                                 Range* toRange,
+                                                 EAffinity affinity,
+                                                 bool stillSelecting)
+{
+    if (m_webView->client()) {
+        return m_webView->client()->shouldChangeSelectedRange(WebRange(fromRange),
+                                                              WebRange(toRange),
+                                                              static_cast<WebTextAffinity>(affinity),
+                                                              stillSelecting);
+    }
+    return true;
+}
+
+bool EditorClientImpl::shouldApplyStyle(CSSStyleDeclaration* style,
+                                        Range* range)
+{
+    if (m_webView->client()) {
+        // FIXME: Pass a reference to the CSSStyleDeclaration somehow.
+        return m_webView->client()->shouldApplyStyle(WebString(),
+                                                     WebRange(range));
+    }
+    return true;
+}
+
+bool EditorClientImpl::shouldMoveRangeAfterDelete(Range* range,
+                                                  Range* rangeToBeReplaced)
+{
+    return true;
+}
+
+void EditorClientImpl::didBeginEditing()
+{
+    if (m_webView->client())
+        m_webView->client()->didBeginEditing();
+}
+
+void EditorClientImpl::respondToChangedSelection()
+{
+    if (m_webView->client()) {
+        Frame* frame = m_webView->focusedWebCoreFrame();
+        if (frame)
+            m_webView->client()->didChangeSelection(!frame->selection()->isRange());
+    }
+}
+
+void EditorClientImpl::respondToChangedContents()
+{
+    if (m_webView->client())
+        m_webView->client()->didChangeContents();
+}
+
+void EditorClientImpl::didEndEditing()
+{
+    if (m_webView->client())
+        m_webView->client()->didEndEditing();
+}
+
+void EditorClientImpl::didWriteSelectionToPasteboard()
+{
+}
+
+void EditorClientImpl::didSetSelectionTypesForPasteboard()
+{
+}
+
+void EditorClientImpl::registerCommandForUndo(PassRefPtr<EditCommand> command)
+{
+    if (m_undoStack.size() == maximumUndoStackDepth)
+        m_undoStack.removeFirst(); // drop oldest item off the far end
+    if (!m_inRedo)
+        m_redoStack.clear();
+    m_undoStack.append(command);
+}
+
+void EditorClientImpl::registerCommandForRedo(PassRefPtr<EditCommand> command)
+{
+    m_redoStack.append(command);
+}
+
+void EditorClientImpl::clearUndoRedoOperations()
+{
+    m_undoStack.clear();
+    m_redoStack.clear();
+}
+
+bool EditorClientImpl::canUndo() const
+{
+    return !m_undoStack.isEmpty();
+}
+
+bool EditorClientImpl::canRedo() const
+{
+    return !m_redoStack.isEmpty();
+}
+
+void EditorClientImpl::undo()
+{
+    if (canUndo()) {
+        EditCommandStack::iterator back = --m_undoStack.end();
+        RefPtr<EditCommand> command(*back);
+        m_undoStack.remove(back);
+        command->unapply();
+        // unapply will call us back to push this command onto the redo stack.
+    }
+}
+
+void EditorClientImpl::redo()
+{
+    if (canRedo()) {
+        EditCommandStack::iterator back = --m_redoStack.end();
+        RefPtr<EditCommand> command(*back);
+        m_redoStack.remove(back);
+
+        ASSERT(!m_inRedo);
+        m_inRedo = true;
+        command->reapply();
+        // reapply will call us back to push this command onto the undo stack.
+        m_inRedo = false;
+    }
+}
+
+//
+// The below code was adapted from the WebKit file webview.cpp
+//
+
+static const unsigned CtrlKey = 1 << 0;
+static const unsigned AltKey = 1 << 1;
+static const unsigned ShiftKey = 1 << 2;
+static const unsigned MetaKey = 1 << 3;
+#if PLATFORM(DARWIN)
+// Aliases for the generic key defintions to make kbd shortcuts definitions more
+// readable on OS X.
+static const unsigned OptionKey  = AltKey;
+
+// Do not use this constant for anything but cursor movement commands. Keys
+// with cmd set have their |isSystemKey| bit set, so chances are the shortcut
+// will not be executed. Another, less important, reason is that shortcuts
+// defined in the renderer do not blink the menu item that they triggered.  See
+// http://crbug.com/25856 and the bugs linked from there for details.
+static const unsigned CommandKey = MetaKey;
+#endif
+
+// Keys with special meaning. These will be delegated to the editor using
+// the execCommand() method
+struct KeyDownEntry {
+    unsigned virtualKey;
+    unsigned modifiers;
+    const char* name;
+};
+
+struct KeyPressEntry {
+    unsigned charCode;
+    unsigned modifiers;
+    const char* name;
+};
+
+static const KeyDownEntry keyDownEntries[] = {
+    { VKEY_LEFT,   0,                  "MoveLeft"                             },
+    { VKEY_LEFT,   ShiftKey,           "MoveLeftAndModifySelection"           },
+#if PLATFORM(DARWIN)
+    { VKEY_LEFT,   OptionKey,          "MoveWordLeft"                         },
+    { VKEY_LEFT,   OptionKey | ShiftKey,
+        "MoveWordLeftAndModifySelection"                                      },
+#else
+    { VKEY_LEFT,   CtrlKey,            "MoveWordLeft"                         },
+    { VKEY_LEFT,   CtrlKey | ShiftKey,
+        "MoveWordLeftAndModifySelection"                                      },
+#endif
+    { VKEY_RIGHT,  0,                  "MoveRight"                            },
+    { VKEY_RIGHT,  ShiftKey,           "MoveRightAndModifySelection"          },
+#if PLATFORM(DARWIN)
+    { VKEY_RIGHT,  OptionKey,          "MoveWordRight"                        },
+    { VKEY_RIGHT,  OptionKey | ShiftKey,
+      "MoveWordRightAndModifySelection"                                       },
+#else
+    { VKEY_RIGHT,  CtrlKey,            "MoveWordRight"                        },
+    { VKEY_RIGHT,  CtrlKey | ShiftKey,
+      "MoveWordRightAndModifySelection"                                       },
+#endif
+    { VKEY_UP,     0,                  "MoveUp"                               },
+    { VKEY_UP,     ShiftKey,           "MoveUpAndModifySelection"             },
+    { VKEY_PRIOR,  ShiftKey,           "MovePageUpAndModifySelection"         },
+    { VKEY_DOWN,   0,                  "MoveDown"                             },
+    { VKEY_DOWN,   ShiftKey,           "MoveDownAndModifySelection"           },
+    { VKEY_NEXT,   ShiftKey,           "MovePageDownAndModifySelection"       },
+    { VKEY_PRIOR,  0,                  "MovePageUp"                           },
+    { VKEY_NEXT,   0,                  "MovePageDown"                         },
+    { VKEY_HOME,   0,                  "MoveToBeginningOfLine"                },
+    { VKEY_HOME,   ShiftKey,
+        "MoveToBeginningOfLineAndModifySelection"                             },
+#if PLATFORM(DARWIN)
+    { VKEY_LEFT,   CommandKey,         "MoveToBeginningOfLine"                },
+    { VKEY_LEFT,   CommandKey | ShiftKey,
+      "MoveToBeginningOfLineAndModifySelection"                               },
+#endif
+#if PLATFORM(DARWIN)
+    { VKEY_UP,     CommandKey,         "MoveToBeginningOfDocument"            },
+    { VKEY_UP,     CommandKey | ShiftKey,
+        "MoveToBeginningOfDocumentAndModifySelection"                         },
+#else
+    { VKEY_HOME,   CtrlKey,            "MoveToBeginningOfDocument"            },
+    { VKEY_HOME,   CtrlKey | ShiftKey,
+        "MoveToBeginningOfDocumentAndModifySelection"                         },
+#endif
+    { VKEY_END,    0,                  "MoveToEndOfLine"                      },
+    { VKEY_END,    ShiftKey,           "MoveToEndOfLineAndModifySelection"    },
+#if PLATFORM(DARWIN)
+    { VKEY_DOWN,   CommandKey,         "MoveToEndOfDocument"                  },
+    { VKEY_DOWN,   CommandKey | ShiftKey,
+        "MoveToEndOfDocumentAndModifySelection"                               },
+#else
+    { VKEY_END,    CtrlKey,            "MoveToEndOfDocument"                  },
+    { VKEY_END,    CtrlKey | ShiftKey,
+        "MoveToEndOfDocumentAndModifySelection"                               },
+#endif
+#if PLATFORM(DARWIN)
+    { VKEY_RIGHT,  CommandKey,         "MoveToEndOfLine"                      },
+    { VKEY_RIGHT,  CommandKey | ShiftKey,
+        "MoveToEndOfLineAndModifySelection"                                   },
+#endif
+    { VKEY_BACK,   0,                  "DeleteBackward"                       },
+    { VKEY_BACK,   ShiftKey,           "DeleteBackward"                       },
+    { VKEY_DELETE, 0,                  "DeleteForward"                        },
+#if PLATFORM(DARWIN)
+    { VKEY_BACK,   OptionKey,          "DeleteWordBackward"                   },
+    { VKEY_DELETE, OptionKey,          "DeleteWordForward"                    },
+#else
+    { VKEY_BACK,   CtrlKey,            "DeleteWordBackward"                   },
+    { VKEY_DELETE, CtrlKey,            "DeleteWordForward"                    },
+#endif
+    { 'B',         CtrlKey,            "ToggleBold"                           },
+    { 'I',         CtrlKey,            "ToggleItalic"                         },
+    { 'U',         CtrlKey,            "ToggleUnderline"                      },
+    { VKEY_ESCAPE, 0,                  "Cancel"                               },
+    { VKEY_OEM_PERIOD, CtrlKey,        "Cancel"                               },
+    { VKEY_TAB,    0,                  "InsertTab"                            },
+    { VKEY_TAB,    ShiftKey,           "InsertBacktab"                        },
+    { VKEY_RETURN, 0,                  "InsertNewline"                        },
+    { VKEY_RETURN, CtrlKey,            "InsertNewline"                        },
+    { VKEY_RETURN, AltKey,             "InsertNewline"                        },
+    { VKEY_RETURN, AltKey | ShiftKey,  "InsertNewline"                        },
+    { VKEY_RETURN, ShiftKey,           "InsertLineBreak"                      },
+    { VKEY_INSERT, CtrlKey,            "Copy"                                 },
+    { VKEY_INSERT, ShiftKey,           "Paste"                                },
+    { VKEY_DELETE, ShiftKey,           "Cut"                                  },
+#if !PLATFORM(DARWIN)
+    // On OS X, we pipe these back to the browser, so that it can do menu item
+    // blinking.
+    { 'C',         CtrlKey,            "Copy"                                 },
+    { 'V',         CtrlKey,            "Paste"                                },
+    { 'V',         CtrlKey | ShiftKey, "PasteAndMatchStyle"                   },
+    { 'X',         CtrlKey,            "Cut"                                  },
+    { 'A',         CtrlKey,            "SelectAll"                            },
+    { 'Z',         CtrlKey,            "Undo"                                 },
+    { 'Z',         CtrlKey | ShiftKey, "Redo"                                 },
+    { 'Y',         CtrlKey,            "Redo"                                 },
+#endif
+};
+
+static const KeyPressEntry keyPressEntries[] = {
+    { '\t',   0,                  "InsertTab"                                 },
+    { '\t',   ShiftKey,           "InsertBacktab"                             },
+    { '\r',   0,                  "InsertNewline"                             },
+    { '\r',   CtrlKey,            "InsertNewline"                             },
+    { '\r',   ShiftKey,           "InsertLineBreak"                           },
+    { '\r',   AltKey,             "InsertNewline"                             },
+    { '\r',   AltKey | ShiftKey,  "InsertNewline"                             },
+};
+
+const char* EditorClientImpl::interpretKeyEvent(const KeyboardEvent* evt)
+{
+    const PlatformKeyboardEvent* keyEvent = evt->keyEvent();
+    if (!keyEvent)
+        return "";
+
+    static HashMap<int, const char*>* keyDownCommandsMap = 0;
+    static HashMap<int, const char*>* keyPressCommandsMap = 0;
+
+    if (!keyDownCommandsMap) {
+        keyDownCommandsMap = new HashMap<int, const char*>;
+        keyPressCommandsMap = new HashMap<int, const char*>;
+
+        for (unsigned i = 0; i < arraysize(keyDownEntries); i++) {
+            keyDownCommandsMap->set(keyDownEntries[i].modifiers << 16 | keyDownEntries[i].virtualKey,
+                                    keyDownEntries[i].name);
+        }
+
+        for (unsigned i = 0; i < arraysize(keyPressEntries); i++) {
+            keyPressCommandsMap->set(keyPressEntries[i].modifiers << 16 | keyPressEntries[i].charCode,
+                                     keyPressEntries[i].name);
+        }
+    }
+
+    unsigned modifiers = 0;
+    if (keyEvent->shiftKey())
+        modifiers |= ShiftKey;
+    if (keyEvent->altKey())
+        modifiers |= AltKey;
+    if (keyEvent->ctrlKey())
+        modifiers |= CtrlKey;
+    if (keyEvent->metaKey())
+        modifiers |= MetaKey;
+
+    if (keyEvent->type() == PlatformKeyboardEvent::RawKeyDown) {
+        int mapKey = modifiers << 16 | evt->keyCode();
+        return mapKey ? keyDownCommandsMap->get(mapKey) : 0;
+    }
+
+    int mapKey = modifiers << 16 | evt->charCode();
+    return mapKey ? keyPressCommandsMap->get(mapKey) : 0;
+}
+
+bool EditorClientImpl::handleEditingKeyboardEvent(KeyboardEvent* evt)
+{
+    const PlatformKeyboardEvent* keyEvent = evt->keyEvent();
+    // do not treat this as text input if it's a system key event
+    if (!keyEvent || keyEvent->isSystemKey())
+        return false;
+
+    Frame* frame = evt->target()->toNode()->document()->frame();
+    if (!frame)
+        return false;
+
+    String commandName = interpretKeyEvent(evt);
+    Editor::Command command = frame->editor()->command(commandName);
+
+    if (keyEvent->type() == PlatformKeyboardEvent::RawKeyDown) {
+        // WebKit doesn't have enough information about mode to decide how
+        // commands that just insert text if executed via Editor should be treated,
+        // so we leave it upon WebCore to either handle them immediately
+        // (e.g. Tab that changes focus) or let a keypress event be generated
+        // (e.g. Tab that inserts a Tab character, or Enter).
+        if (command.isTextInsertion() || commandName.isEmpty())
+            return false;
+        if (command.execute(evt)) {
+            if (m_webView->client())
+                m_webView->client()->didExecuteCommand(WebString(commandName));
+            return true;
+        }
+        return false;
+    }
+
+    if (command.execute(evt)) {
+        if (m_webView->client())
+            m_webView->client()->didExecuteCommand(WebString(commandName));
+        return true;
+    }
+
+    // Here we need to filter key events.
+    // On Gtk/Linux, it emits key events with ASCII text and ctrl on for ctrl-<x>.
+    // In Webkit, EditorClient::handleKeyboardEvent in
+    // WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp drop such events.
+    // On Mac, it emits key events with ASCII text and meta on for Command-<x>.
+    // These key events should not emit text insert event.
+    // Alt key would be used to insert alternative character, so we should let
+    // through. Also note that Ctrl-Alt combination equals to AltGr key which is
+    // also used to insert alternative character.
+    // http://code.google.com/p/chromium/issues/detail?id=10846
+    // Windows sets both alt and meta are on when "Alt" key pressed.
+    // http://code.google.com/p/chromium/issues/detail?id=2215
+    // Also, we should not rely on an assumption that keyboards don't
+    // send ASCII characters when pressing a control key on Windows,
+    // which may be configured to do it so by user.
+    // See also http://en.wikipedia.org/wiki/Keyboard_Layout
+    // FIXME(ukai): investigate more detail for various keyboard layout.
+    if (evt->keyEvent()->text().length() == 1) {
+        UChar ch = evt->keyEvent()->text()[0U];
+
+        // Don't insert null or control characters as they can result in
+        // unexpected behaviour
+        if (ch < ' ')
+            return false;
+#if !PLATFORM(WIN_OS)
+        // Don't insert ASCII character if ctrl w/o alt or meta is on.
+        // On Mac, we should ignore events when meta is on (Command-<x>).
+        if (ch < 0x80) {
+            if (evt->keyEvent()->ctrlKey() && !evt->keyEvent()->altKey())
+                return false;
+#if PLATFORM(DARWIN)
+            if (evt->keyEvent()->metaKey())
+            return false;
+#endif
+        }
+#endif
+    }
+
+    if (!frame->editor()->canEdit())
+        return false;
+
+    return frame->editor()->insertText(evt->keyEvent()->text(), evt);
+}
+
+void EditorClientImpl::handleKeyboardEvent(KeyboardEvent* evt)
+{
+    if (evt->keyCode() == VKEY_DOWN
+        || evt->keyCode() == VKEY_UP) {
+        ASSERT(evt->target()->toNode());
+        showFormAutofillForNode(evt->target()->toNode());
+    }
+
+    // Give the embedder a chance to handle the keyboard event.
+    if ((m_webView->client()
+         && m_webView->client()->handleCurrentKeyboardEvent())
+        || handleEditingKeyboardEvent(evt))
+        evt->setDefaultHandled();
+}
+
+void EditorClientImpl::handleInputMethodKeydown(KeyboardEvent* keyEvent)
+{
+    // We handle IME within chrome.
+}
+
+void EditorClientImpl::textFieldDidBeginEditing(Element*)
+{
+}
+
+void EditorClientImpl::textFieldDidEndEditing(Element* element)
+{
+    // Notification that focus was lost.  Be careful with this, it's also sent
+    // when the page is being closed.
+
+    // Cancel any pending DoAutofill call.
+    m_autofillArgs.clear();
+    m_autofillTimer.stop();
+
+    // Hide any showing popup.
+    m_webView->hideAutoCompletePopup();
+
+    if (!m_webView->client())
+        return; // The page is getting closed, don't fill the password.
+
+    // Notify any password-listener of the focus change.
+    HTMLInputElement* inputElement = WebKit::toHTMLInputElement(element);
+    if (!inputElement)
+        return;
+
+    WebFrameImpl* webframe = WebFrameImpl::fromFrame(inputElement->document()->frame());
+    if (!webframe)
+        return;
+
+    WebPasswordAutocompleteListener* listener = webframe->getPasswordListener(inputElement);
+    if (!listener)
+        return;
+
+    listener->didBlurInputElement(inputElement->value());
+}
+
+void EditorClientImpl::textDidChangeInTextField(Element* element)
+{
+    ASSERT(element->hasLocalName(HTMLNames::inputTag));
+    // Note that we only show the autofill popup in this case if the caret is at
+    // the end.  This matches FireFox and Safari but not IE.
+    autofill(static_cast<HTMLInputElement*>(element), false, false,
+             true);
+}
+
+bool EditorClientImpl::showFormAutofillForNode(Node* node)
+{
+    HTMLInputElement* inputElement = WebKit::toHTMLInputElement(node);
+    if (inputElement)
+        return autofill(inputElement, true, true, false);
+    return false;
+}
+
+bool EditorClientImpl::autofill(HTMLInputElement* inputElement,
+                                bool autofillFormOnly,
+                                bool autofillOnEmptyValue,
+                                bool requireCaretAtEnd)
+{
+    // Cancel any pending DoAutofill call.
+    m_autofillArgs.clear();
+    m_autofillTimer.stop();
+
+    // Let's try to trigger autofill for that field, if applicable.
+    if (!inputElement->isEnabledFormControl() || !inputElement->isTextField()
+        || inputElement->isPasswordField()
+        || !inputElement->autoComplete())
+        return false;
+
+    WebString name = WebInputElement(inputElement).nameForAutofill();
+    if (name.isEmpty()) // If the field has no name, then we won't have values.
+        return false;
+
+    // Don't attempt to autofill with values that are too large.
+    if (inputElement->value().length() > maximumTextSizeForAutofill)
+        return false;
+
+    m_autofillArgs = new AutofillArgs();
+    m_autofillArgs->inputElement = inputElement;
+    m_autofillArgs->autofillFormOnly = autofillFormOnly;
+    m_autofillArgs->autofillOnEmptyValue = autofillOnEmptyValue;
+    m_autofillArgs->requireCaretAtEnd = requireCaretAtEnd;
+    m_autofillArgs->backspaceOrDeletePressed = m_backspaceOrDeletePressed;
+
+    if (!requireCaretAtEnd)
+        doAutofill(0);
+    else {
+        // We post a task for doing the autofill as the caret position is not set
+        // properly at this point (http://bugs.webkit.org/show_bug.cgi?id=16976)
+        // and we need it to determine whether or not to trigger autofill.
+        m_autofillTimer.startOneShot(0.0);
+    }
+    return true;
+}
+
+void EditorClientImpl::doAutofill(Timer<EditorClientImpl>* timer)
+{
+    OwnPtr<AutofillArgs> args(m_autofillArgs.release());
+    HTMLInputElement* inputElement = args->inputElement.get();
+
+    const String& value = inputElement->value();
+
+    // Enforce autofill_on_empty_value and caret_at_end.
+
+    bool isCaretAtEnd = true;
+    if (args->requireCaretAtEnd)
+        isCaretAtEnd = inputElement->selectionStart() == inputElement->selectionEnd()
+                       && inputElement->selectionEnd() == static_cast<int>(value.length());
+
+    if ((!args->autofillOnEmptyValue && value.isEmpty()) || !isCaretAtEnd) {
+        m_webView->hideAutoCompletePopup();
+        return;
+    }
+
+    // First let's see if there is a password listener for that element.
+    // We won't trigger form autofill in that case, as having both behavior on
+    // a node would be confusing.
+    WebFrameImpl* webframe = WebFrameImpl::fromFrame(inputElement->document()->frame());
+    if (!webframe)
+        return;
+    WebPasswordAutocompleteListener* listener = webframe->getPasswordListener(inputElement);
+    if (listener) {
+        if (args->autofillFormOnly)
+            return;
+
+        listener->performInlineAutocomplete(value,
+                                            args->backspaceOrDeletePressed,
+                                            true);
+        return;
+    }
+
+    // Then trigger form autofill.
+    WebString name = WebInputElement(inputElement).nameForAutofill();
+    ASSERT(static_cast<int>(name.length()) > 0);
+
+    if (m_webView->client())
+        m_webView->client()->queryAutofillSuggestions(WebNode(inputElement),
+                                                      name, WebString(value));
+}
+
+void EditorClientImpl::cancelPendingAutofill()
+{
+    m_autofillArgs.clear();
+    m_autofillTimer.stop();
+}
+
+void EditorClientImpl::onAutofillSuggestionAccepted(HTMLInputElement* textField)
+{
+    WebFrameImpl* webframe = WebFrameImpl::fromFrame(textField->document()->frame());
+    if (!webframe)
+        return;
+
+    WebPasswordAutocompleteListener* listener = webframe->getPasswordListener(textField);
+    // Password listeners need to autocomplete other fields that depend on the
+    // input element with autofill suggestions.
+    if (listener)
+        listener->performInlineAutocomplete(textField->value(), false, false);
+}
+
+bool EditorClientImpl::doTextFieldCommandFromEvent(Element* element,
+                                                   KeyboardEvent* event)
+{
+    // Remember if backspace was pressed for the autofill.  It is not clear how to
+    // find if backspace was pressed from textFieldDidBeginEditing and
+    // textDidChangeInTextField as when these methods are called the value of the
+    // input element already contains the type character.
+    m_backspaceOrDeletePressed = event->keyCode() == VKEY_BACK || event->keyCode() == VKEY_DELETE;
+
+    // The Mac code appears to use this method as a hook to implement special
+    // keyboard commands specific to Safari's auto-fill implementation.  We
+    // just return false to allow the default action.
+    return false;
+}
+
+void EditorClientImpl::textWillBeDeletedInTextField(Element*)
+{
+}
+
+void EditorClientImpl::textDidChangeInTextArea(Element*)
+{
+}
+
+void EditorClientImpl::ignoreWordInSpellDocument(const String&)
+{
+    notImplemented();
+}
+
+void EditorClientImpl::learnWord(const String&)
+{
+    notImplemented();
+}
+
+void EditorClientImpl::checkSpellingOfString(const UChar* text, int length,
+                                             int* misspellingLocation,
+                                             int* misspellingLength)
+{
+    // SpellCheckWord will write (0, 0) into the output vars, which is what our
+    // caller expects if the word is spelled correctly.
+    int spellLocation = -1;
+    int spellLength = 0;
+
+    // Check to see if the provided text is spelled correctly.
+    if (isContinuousSpellCheckingEnabled() && m_webView->client())
+        m_webView->client()->spellCheck(WebString(text, length), spellLocation, spellLength);
+    else {
+        spellLocation = 0;
+        spellLength = 0;
+    }
+
+    // Note: the Mac code checks if the pointers are null before writing to them,
+    // so we do too.
+    if (misspellingLocation)
+        *misspellingLocation = spellLocation;
+    if (misspellingLength)
+        *misspellingLength = spellLength;
+}
+
+String EditorClientImpl::getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord)
+{
+    if (!(isContinuousSpellCheckingEnabled() && m_webView->client()))
+        return String();
+
+    // Do not autocorrect words with capital letters in it except the
+    // first letter. This will remove cases changing "IMB" to "IBM".
+    for (size_t i = 1; i < misspelledWord.length(); i++) {
+        if (u_isupper(static_cast<UChar32>(misspelledWord[i])))
+            return String();
+    }
+
+    return m_webView->client()->autoCorrectWord(WebString(misspelledWord));
+}
+
+void EditorClientImpl::checkGrammarOfString(const UChar*, int length,
+                                            WTF::Vector<GrammarDetail>&,
+                                            int* badGrammarLocation,
+                                            int* badGrammarLength)
+{
+    notImplemented();
+    if (badGrammarLocation)
+        *badGrammarLocation = 0;
+    if (badGrammarLength)
+        *badGrammarLength = 0;
+}
+
+void EditorClientImpl::updateSpellingUIWithGrammarString(const String&,
+                                                         const GrammarDetail& detail)
+{
+    notImplemented();
+}
+
+void EditorClientImpl::updateSpellingUIWithMisspelledWord(const String& misspelledWord)
+{
+    if (m_webView->client())
+        m_webView->client()->updateSpellingUIWithMisspelledWord(WebString(misspelledWord));
+}
+
+void EditorClientImpl::showSpellingUI(bool show)
+{
+    if (m_webView->client())
+        m_webView->client()->showSpellingUI(show);
+}
+
+bool EditorClientImpl::spellingUIIsShowing()
+{
+    if (m_webView->client())
+        return m_webView->client()->isShowingSpellingUI();
+    return false;
+}
+
+void EditorClientImpl::getGuessesForWord(const String&,
+                                         WTF::Vector<String>& guesses)
+{
+    notImplemented();
+}
+
+void EditorClientImpl::setInputMethodState(bool enabled)
+{
+    if (m_webView->client())
+        m_webView->client()->setInputMethodEnabled(enabled);
+}
+
+} // namesace WebKit
diff --git a/WebKit/chromium/src/EditorClientImpl.h b/WebKit/chromium/src/EditorClientImpl.h
new file mode 100644
index 0000000..fd08b4d
--- /dev/null
+++ b/WebKit/chromium/src/EditorClientImpl.h
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EditorClientImpl_h
+#define EditorClientImpl_h
+
+#include "EditorClient.h"
+#include "Timer.h"
+#include <wtf/Deque.h>
+
+namespace WebCore {
+class HTMLInputElement;
+}
+
+namespace WebKit {
+class WebViewImpl;
+
+class EditorClientImpl : public WebCore::EditorClient {
+public:
+    EditorClientImpl(WebViewImpl* webView);
+
+    virtual ~EditorClientImpl();
+    virtual void pageDestroyed();
+
+    virtual bool shouldShowDeleteInterface(WebCore::HTMLElement*);
+    virtual bool smartInsertDeleteEnabled();
+    virtual bool isSelectTrailingWhitespaceEnabled();
+    virtual bool isContinuousSpellCheckingEnabled();
+    virtual void toggleContinuousSpellChecking();
+    virtual bool isGrammarCheckingEnabled();
+    virtual void toggleGrammarChecking();
+    virtual int spellCheckerDocumentTag();
+    virtual bool isEditable();
+    virtual bool shouldBeginEditing(WebCore::Range*);
+    virtual bool shouldEndEditing(WebCore::Range*);
+    virtual bool shouldInsertNode(WebCore::Node*, WebCore::Range*, WebCore::EditorInsertAction);
+    virtual bool shouldInsertText(const WebCore::String&, WebCore::Range*, WebCore::EditorInsertAction);
+    virtual bool shouldDeleteRange(WebCore::Range*);
+    virtual bool shouldChangeSelectedRange(WebCore::Range* fromRange,
+                                           WebCore::Range* toRange,
+                                           WebCore::EAffinity,
+                                           bool stillSelecting);
+    virtual bool shouldApplyStyle(WebCore::CSSStyleDeclaration*, WebCore::Range*);
+    virtual bool shouldMoveRangeAfterDelete(WebCore::Range*, WebCore::Range*);
+    virtual void didBeginEditing();
+    virtual void respondToChangedContents();
+    virtual void respondToChangedSelection();
+    virtual void didEndEditing();
+    virtual void didWriteSelectionToPasteboard();
+    virtual void didSetSelectionTypesForPasteboard();
+    virtual void registerCommandForUndo(PassRefPtr<WebCore::EditCommand>);
+    virtual void registerCommandForRedo(PassRefPtr<WebCore::EditCommand>);
+    virtual void clearUndoRedoOperations();
+    virtual bool canUndo() const;
+    virtual bool canRedo() const;
+    virtual void undo();
+    virtual void redo();
+    virtual const char* interpretKeyEvent(const WebCore::KeyboardEvent*);
+    virtual bool handleEditingKeyboardEvent(WebCore::KeyboardEvent*);
+    virtual void handleKeyboardEvent(WebCore::KeyboardEvent*);
+    virtual void handleInputMethodKeydown(WebCore::KeyboardEvent*);
+    virtual void textFieldDidBeginEditing(WebCore::Element*);
+    virtual void textFieldDidEndEditing(WebCore::Element*);
+    virtual void textDidChangeInTextField(WebCore::Element*);
+    virtual bool doTextFieldCommandFromEvent(WebCore::Element*, WebCore::KeyboardEvent*);
+    virtual void textWillBeDeletedInTextField(WebCore::Element*);
+    virtual void textDidChangeInTextArea(WebCore::Element*);
+    virtual void ignoreWordInSpellDocument(const WebCore::String&);
+    virtual void learnWord(const WebCore::String&);
+    virtual void checkSpellingOfString(const UChar*, int length,
+                                       int* misspellingLocation,
+                                       int* misspellingLength);
+    virtual void checkGrammarOfString(const UChar*, int length,
+                                      WTF::Vector<WebCore::GrammarDetail>&,
+                                      int* badGrammarLocation,
+                                      int* badGrammarLength);
+    virtual WebCore::String getAutoCorrectSuggestionForMisspelledWord(const WebCore::String&);
+    virtual void updateSpellingUIWithGrammarString(const WebCore::String&, const WebCore::GrammarDetail&);
+    virtual void updateSpellingUIWithMisspelledWord(const WebCore::String&);
+    virtual void showSpellingUI(bool show);
+    virtual bool spellingUIIsShowing();
+    virtual void getGuessesForWord(const WebCore::String& word,
+                                   WTF::Vector<WebCore::String>& guesses);
+    virtual void setInputMethodState(bool enabled);
+
+    // Shows the form autofill popup for |node| if it is an HTMLInputElement and
+    // it is empty.  This is called when you press the up or down arrow in a
+    // text-field or when clicking an already focused text-field.
+    // Returns true if the autofill popup has been scheduled to be shown, false
+    // otherwise.
+    virtual bool showFormAutofillForNode(WebCore::Node*);
+
+    // Notification that the text changed due to acceptance of a suggestion
+    // provided by an autofill popup.  Having a separate callback in this case
+    // is a simple way to break the cycle that would otherwise occur if
+    // textDidChangeInTextField was called.
+    virtual void onAutofillSuggestionAccepted(WebCore::HTMLInputElement*);
+
+private:
+    void modifySelection(WebCore::Frame*, WebCore::KeyboardEvent*);
+
+    // Triggers autofill for an input element if applicable.  This can be form
+    // autofill (via a popup-menu) or password autofill depending on the
+    // input element.  If |formAutofillOnly| is true, password autofill is not
+    // triggered.
+    // |autofillOnEmptyValue| indicates whether the autofill should be shown
+    // when the text-field is empty.
+    // If |requiresCaretAtEnd| is true, the autofill popup is only shown if the
+    // caret is located at the end of the entered text.
+    // Returns true if the autofill popup has been scheduled to be shown, false
+    // otherwise.
+    bool autofill(WebCore::HTMLInputElement*,
+                  bool formAutofillOnly, bool autofillOnEmptyValue,
+                  bool requiresCaretAtEnd);
+
+    // Called to process the autofill described by m_autofillArgs.
+    // This method is invoked asynchronously if the caret position is not
+    // reflecting the last text change yet, and we need it to decide whether or
+    // not to show the autofill popup.
+    void doAutofill(WebCore::Timer<EditorClientImpl>*);
+
+    void cancelPendingAutofill();
+
+    // Returns whether or not the focused control needs spell-checking.
+    // Currently, this function just retrieves the focused node and determines
+    // whether or not it is a <textarea> element or an element whose
+    // contenteditable attribute is true.
+    // FIXME: Bug 740540: This code just implements the default behavior
+    // proposed in this issue. We should also retrieve "spellcheck" attributes
+    // for text fields and create a flag to over-write the default behavior.
+    bool shouldSpellcheckByDefault();
+
+    WebViewImpl* m_webView;
+    bool m_inRedo;
+
+    typedef Deque<RefPtr<WebCore::EditCommand> > EditCommandStack;
+    EditCommandStack m_undoStack;
+    EditCommandStack m_redoStack;
+
+    // Whether the last entered key was a backspace.
+    bool m_backspaceOrDeletePressed;
+
+    // This flag is set to false if spell check for this editor is manually
+    // turned off. The default setting is SpellCheckAutomatic.
+    enum {
+        SpellCheckAutomatic,
+        SpellCheckForcedOn,
+        SpellCheckForcedOff
+    };
+    int m_spellCheckThisFieldStatus;
+
+    // Used to delay autofill processing.
+    WebCore::Timer<EditorClientImpl> m_autofillTimer;
+
+    struct AutofillArgs {
+        RefPtr<WebCore::HTMLInputElement> inputElement;
+        bool autofillFormOnly;
+        bool autofillOnEmptyValue;
+        bool requireCaretAtEnd;
+        bool backspaceOrDeletePressed;
+    };
+    OwnPtr<AutofillArgs> m_autofillArgs;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
new file mode 100644
index 0000000..3ca8e8d
--- /dev/null
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -0,0 +1,1469 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FrameLoaderClientImpl.h"
+
+#include "Chrome.h"
+#include "CString.h"
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "FormState.h"
+#include "FrameLoader.h"
+#include "FrameLoadRequest.h"
+#include "HitTestResult.h"
+#include "HTMLAppletElement.h"
+#include "HTMLFormElement.h"  // needed by FormState.h
+#include "HTMLNames.h"
+#include "MIMETypeRegistry.h"
+#include "MouseEvent.h"
+#include "Page.h"
+#include "PlatformString.h"
+#include "PluginData.h"
+#include "PluginDataChromium.h"
+#include "StringExtras.h"
+#include "WebDataSourceImpl.h"
+#include "WebDevToolsAgentPrivate.h"
+#include "WebFormElement.h"
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebMimeRegistry.h"
+#include "WebNode.h"
+#include "WebPlugin.h"
+#include "WebPluginContainerImpl.h"
+#include "WebPluginLoadObserver.h"
+#include "WebPluginParams.h"
+#include "WebSecurityOrigin.h"
+#include "WebURL.h"
+#include "WebURLError.h"
+#include "WebVector.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+#include "WindowFeatures.h"
+#include "WrappedResourceRequest.h"
+#include "WrappedResourceResponse.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// Domain for internal error codes.
+static const char internalErrorDomain[] = "WebKit";
+
+// An internal error code.  Used to note a policy change error resulting from
+// dispatchDecidePolicyForMIMEType not passing the PolicyUse option.
+enum {
+    PolicyChangeError = -10000,
+};
+
+FrameLoaderClientImpl::FrameLoaderClientImpl(WebFrameImpl* frame)
+    : m_webFrame(frame)
+    , m_hasRepresentation(false)
+    , m_sentInitialResponseToPlugin(false)
+    , m_nextNavigationPolicy(WebNavigationPolicyIgnore)
+{
+}
+
+FrameLoaderClientImpl::~FrameLoaderClientImpl()
+{
+}
+
+void FrameLoaderClientImpl::frameLoaderDestroyed()
+{
+    // When the WebFrame was created, it had an extra reference given to it on
+    // behalf of the Frame.  Since the WebFrame owns us, this extra ref also
+    // serves to keep us alive until the FrameLoader is done with us.  The
+    // FrameLoader calls this method when it's going away.  Therefore, we balance
+    // out that extra reference, which may cause 'this' to be deleted.
+    m_webFrame->closing();
+    m_webFrame->deref();
+}
+
+void FrameLoaderClientImpl::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*)
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didClearWindowObject(m_webFrame);
+
+    WebViewImpl* webview = m_webFrame->viewImpl();
+    if (webview->devToolsAgentPrivate())
+        webview->devToolsAgentPrivate()->didClearWindowObject(m_webFrame);
+}
+
+void FrameLoaderClientImpl::documentElementAvailable()
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didCreateDocumentElement(m_webFrame);
+}
+
+void FrameLoaderClientImpl::didCreateScriptContextForFrame()
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didCreateScriptContext(m_webFrame);
+}
+
+void FrameLoaderClientImpl::didDestroyScriptContextForFrame()
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didDestroyScriptContext(m_webFrame);
+}
+
+void FrameLoaderClientImpl::didCreateIsolatedScriptContext()
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didCreateIsolatedScriptContext(m_webFrame);
+}
+
+void FrameLoaderClientImpl::didPerformFirstNavigation() const
+{
+}
+
+void FrameLoaderClientImpl::registerForIconNotification(bool)
+{
+}
+
+void FrameLoaderClientImpl::didChangeScrollOffset()
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didChangeScrollOffset(m_webFrame);
+}
+
+bool FrameLoaderClientImpl::allowJavaScript(bool enabledPerSettings)
+{
+    if (m_webFrame->client())
+        return m_webFrame->client()->allowScript(m_webFrame, enabledPerSettings);
+
+    return enabledPerSettings;
+}
+
+bool FrameLoaderClientImpl::hasWebView() const
+{
+    return m_webFrame->viewImpl();
+}
+
+bool FrameLoaderClientImpl::hasFrameView() const
+{
+    // The Mac port has this notion of a WebFrameView, which seems to be
+    // some wrapper around an NSView.  Since our equivalent is HWND, I guess
+    // we have a "frameview" whenever we have the toplevel HWND.
+    return m_webFrame->viewImpl();
+}
+
+void FrameLoaderClientImpl::makeDocumentView()
+{
+    m_webFrame->createFrameView();
+}
+
+void FrameLoaderClientImpl::makeRepresentation(DocumentLoader*)
+{
+    m_hasRepresentation = true;
+}
+
+void FrameLoaderClientImpl::forceLayout()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::forceLayoutForNonHTML()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::setCopiesOnScroll()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::detachedFromParent2()
+{
+    // Nothing to do here.
+}
+
+void FrameLoaderClientImpl::detachedFromParent3()
+{
+    // Close down the proxy.  The purpose of this change is to make the
+    // call to ScriptController::clearWindowShell a no-op when called from
+    // Frame::pageDestroyed.  Without this change, this call to clearWindowShell
+    // will cause a crash.  If you remove/modify this, just ensure that you can
+    // go to a page and then navigate to a new page without getting any asserts
+    // or crashes.
+    m_webFrame->frame()->script()->proxy()->clearForClose();
+    
+    // Stop communicating with the WebFrameClient at this point since we are no
+    // longer associated with the Page.
+    m_webFrame->dropClient();
+}
+
+// This function is responsible for associating the |identifier| with a given
+// subresource load.  The following functions that accept an |identifier| are
+// called for each subresource, so they should not be dispatched to the
+// WebFrame.
+void FrameLoaderClientImpl::assignIdentifierToInitialRequest(
+    unsigned long identifier, DocumentLoader* loader,
+    const ResourceRequest& request)
+{
+    if (m_webFrame->client()) {
+        WrappedResourceRequest webreq(request);
+        m_webFrame->client()->assignIdentifierToRequest(
+            m_webFrame, identifier, webreq);
+    }
+}
+
+// If the request being loaded by |loader| is a frame, update the ResourceType.
+// A subresource in this context is anything other than a frame --
+// this includes images and xmlhttp requests.  It is important to note that a
+// subresource is NOT limited to stuff loaded through the frame's subresource
+// loader. Synchronous xmlhttp requests for example, do not go through the
+// subresource loader, but we still label them as TargetIsSubResource.
+//
+// The important edge cases to consider when modifying this function are
+// how synchronous resource loads are treated during load/unload threshold.
+static void setTargetTypeFromLoader(ResourceRequest& request, DocumentLoader* loader)
+{
+    if (loader == loader->frameLoader()->provisionalDocumentLoader()) {
+        ResourceRequest::TargetType type;
+        if (loader->frameLoader()->isLoadingMainFrame())
+            type = ResourceRequest::TargetIsMainFrame;
+        else
+            type = ResourceRequest::TargetIsSubframe;
+        request.setTargetType(type);
+    }
+}
+
+void FrameLoaderClientImpl::dispatchWillSendRequest(
+    DocumentLoader* loader, unsigned long identifier, ResourceRequest& request,
+    const ResourceResponse& redirectResponse)
+{
+    if (loader) {
+        // We want to distinguish between a request for a document to be loaded into
+        // the main frame, a sub-frame, or the sub-objects in that document.
+        setTargetTypeFromLoader(request, loader);
+
+        // Avoid repeating a form submission when navigating back or forward.
+        if (loader == loader->frameLoader()->provisionalDocumentLoader()
+            && request.httpMethod() == "POST"
+            && isBackForwardLoadType(loader->frameLoader()->loadType()))
+            request.setCachePolicy(ReturnCacheDataDontLoad);
+    }
+
+    // FrameLoader::loadEmptyDocumentSynchronously() creates an empty document
+    // with no URL.  We don't like that, so we'll rename it to about:blank.
+    if (request.url().isEmpty())
+        request.setURL(KURL(ParsedURLString, "about:blank"));
+    if (request.firstPartyForCookies().isEmpty())
+        request.setFirstPartyForCookies(KURL(ParsedURLString, "about:blank"));
+
+    // Give the WebFrameClient a crack at the request.
+    if (m_webFrame->client()) {
+        WrappedResourceRequest webreq(request);
+        WrappedResourceResponse webresp(redirectResponse);
+        m_webFrame->client()->willSendRequest(
+            m_webFrame, identifier, webreq, webresp);
+    }
+}
+
+bool FrameLoaderClientImpl::shouldUseCredentialStorage(
+    DocumentLoader*, unsigned long identifier)
+{
+    // FIXME
+    // Intended to pass through to a method on the resource load delegate.
+    // If implemented, that method controls whether the browser should ask the
+    // networking layer for a stored default credential for the page (say from
+    // the Mac OS keychain). If the method returns false, the user should be
+    // presented with an authentication challenge whether or not the networking
+    // layer has a credential stored.
+    // This returns true for backward compatibility: the ability to override the
+    // system credential store is new. (Actually, not yet fully implemented in
+    // WebKit, as of this writing.)
+    return true;
+}
+
+void FrameLoaderClientImpl::dispatchDidReceiveAuthenticationChallenge(
+    DocumentLoader*, unsigned long identifier, const AuthenticationChallenge&)
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::dispatchDidCancelAuthenticationChallenge(
+    DocumentLoader*, unsigned long identifier, const AuthenticationChallenge&)
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::dispatchDidReceiveResponse(DocumentLoader* loader,
+                                                       unsigned long identifier,
+                                                       const ResourceResponse& response)
+{
+    if (m_webFrame->client()) {
+        WrappedResourceResponse webresp(response);
+        m_webFrame->client()->didReceiveResponse(m_webFrame, identifier, webresp);
+    }
+}
+
+void FrameLoaderClientImpl::dispatchDidReceiveContentLength(
+    DocumentLoader* loader,
+    unsigned long identifier,
+    int lengthReceived)
+{
+}
+
+// Called when a particular resource load completes
+void FrameLoaderClientImpl::dispatchDidFinishLoading(DocumentLoader* loader,
+                                                    unsigned long identifier)
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didFinishResourceLoad(m_webFrame, identifier);
+}
+
+void FrameLoaderClientImpl::dispatchDidFailLoading(DocumentLoader* loader,
+                                                  unsigned long identifier,
+                                                  const ResourceError& error)
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didFailResourceLoad(m_webFrame, identifier, error);
+}
+
+void FrameLoaderClientImpl::dispatchDidFinishDocumentLoad()
+{
+    // A frame may be reused.  This call ensures we don't hold on to our password
+    // listeners and their associated HTMLInputElements.
+    m_webFrame->clearPasswordListeners();
+
+    if (m_webFrame->client())
+        m_webFrame->client()->didFinishDocumentLoad(m_webFrame);
+}
+
+bool FrameLoaderClientImpl::dispatchDidLoadResourceFromMemoryCache(
+    DocumentLoader* loader,
+    const ResourceRequest& request,
+    const ResourceResponse& response,
+    int length)
+{
+    if (m_webFrame->client()) {
+        WrappedResourceRequest webreq(request);
+        WrappedResourceResponse webresp(response);
+        m_webFrame->client()->didLoadResourceFromMemoryCache(
+            m_webFrame, webreq, webresp);
+    }
+    return false;  // Do not suppress remaining notifications
+}
+
+void FrameLoaderClientImpl::dispatchDidLoadResourceByXMLHttpRequest(
+    unsigned long identifier,
+    const ScriptString& source)
+{
+}
+
+void FrameLoaderClientImpl::dispatchDidHandleOnloadEvents()
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didHandleOnloadEvents(m_webFrame);
+}
+
+// Redirect Tracking
+// =================
+// We want to keep track of the chain of redirects that occur during page
+// loading. There are two types of redirects, server redirects which are HTTP
+// response codes, and client redirects which are document.location= and meta
+// refreshes.
+//
+// This outlines the callbacks that we get in different redirect situations,
+// and how each call modifies the redirect chain.
+//
+// Normal page load
+// ----------------
+//   dispatchDidStartProvisionalLoad() -> adds URL to the redirect list
+//   dispatchDidCommitLoad()           -> DISPATCHES & clears list
+//
+// Server redirect (success)
+// -------------------------
+//   dispatchDidStartProvisionalLoad()                    -> adds source URL
+//   dispatchDidReceiveServerRedirectForProvisionalLoad() -> adds dest URL
+//   dispatchDidCommitLoad()                              -> DISPATCHES
+//
+// Client redirect (success)
+// -------------------------
+//   (on page)
+//   dispatchWillPerformClientRedirect() -> saves expected redirect
+//   dispatchDidStartProvisionalLoad()   -> appends redirect source (since
+//                                          it matches the expected redirect)
+//                                          and the current page as the dest)
+//   dispatchDidCancelClientRedirect()   -> clears expected redirect
+//   dispatchDidCommitLoad()             -> DISPATCHES
+//
+// Client redirect (cancelled)
+// (e.g meta-refresh trumped by manual doc.location change, or just cancelled
+// because a link was clicked that requires the meta refresh to be rescheduled
+// (the SOURCE URL may have changed).
+// ---------------------------
+//   dispatchDidCancelClientRedirect()                 -> clears expected redirect
+//   dispatchDidStartProvisionalLoad()                 -> adds only URL to redirect list
+//   dispatchDidCommitLoad()                           -> DISPATCHES & clears list
+//   rescheduled ? dispatchWillPerformClientRedirect() -> saves expected redirect
+//               : nothing
+
+// Client redirect (failure)
+// -------------------------
+//   (on page)
+//   dispatchWillPerformClientRedirect() -> saves expected redirect
+//   dispatchDidStartProvisionalLoad()   -> appends redirect source (since
+//                                          it matches the expected redirect)
+//                                          and the current page as the dest)
+//   dispatchDidCancelClientRedirect()
+//   dispatchDidFailProvisionalLoad()
+//
+// Load 1 -> Server redirect to 2 -> client redirect to 3 -> server redirect to 4
+// ------------------------------------------------------------------------------
+//   dispatchDidStartProvisionalLoad()                    -> adds source URL 1
+//   dispatchDidReceiveServerRedirectForProvisionalLoad() -> adds dest URL 2
+//   dispatchDidCommitLoad()                              -> DISPATCHES 1+2
+//    -- begin client redirect and NEW DATA SOURCE
+//   dispatchWillPerformClientRedirect()                  -> saves expected redirect
+//   dispatchDidStartProvisionalLoad()                    -> appends URL 2 and URL 3
+//   dispatchDidReceiveServerRedirectForProvisionalLoad() -> appends destination URL 4
+//   dispatchDidCancelClientRedirect()                    -> clears expected redirect
+//   dispatchDidCommitLoad()                              -> DISPATCHES
+//
+// Interesting case with multiple location changes involving anchors.
+// Load page 1 containing future client-redirect (back to 1, e.g meta refresh) > Click
+// on a link back to the same page (i.e an anchor href) >
+// client-redirect finally fires (with new source, set to 1#anchor)
+// -----------------------------------------------------------------------------
+//   dispatchWillPerformClientRedirect(non-zero 'interval' param) -> saves expected redirect
+//   -- click on anchor href
+//   dispatchDidCancelClientRedirect()                            -> clears expected redirect
+//   dispatchDidStartProvisionalLoad()                            -> adds 1#anchor source
+//   dispatchDidCommitLoad()                                      -> DISPATCHES 1#anchor
+//   dispatchWillPerformClientRedirect()                          -> saves exp. source (1#anchor)
+//   -- redirect timer fires
+//   dispatchDidStartProvisionalLoad()                            -> appends 1#anchor (src) and 1 (dest)
+//   dispatchDidCancelClientRedirect()                            -> clears expected redirect
+//   dispatchDidCommitLoad()                                      -> DISPATCHES 1#anchor + 1
+//
+void FrameLoaderClientImpl::dispatchDidReceiveServerRedirectForProvisionalLoad()
+{
+    WebDataSourceImpl* ds = m_webFrame->provisionalDataSourceImpl();
+    if (!ds) {
+        // Got a server redirect when there is no provisional DS!
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    // The server redirect may have been blocked.
+    if (ds->request().isNull())
+        return;
+
+    // A provisional load should have started already, which should have put an
+    // entry in our redirect chain.
+    ASSERT(ds->hasRedirectChain());
+
+    // The URL of the destination is on the provisional data source. We also need
+    // to update the redirect chain to account for this addition (we do this
+    // before the callback so the callback can look at the redirect chain to see
+    // what happened).
+    ds->appendRedirect(ds->request().url());
+
+    if (m_webFrame->client())
+        m_webFrame->client()->didReceiveServerRedirectForProvisionalLoad(m_webFrame);
+}
+
+// Called on both success and failure of a client redirect.
+void FrameLoaderClientImpl::dispatchDidCancelClientRedirect()
+{
+    // No longer expecting a client redirect.
+    if (m_webFrame->client()) {
+        m_expectedClientRedirectSrc = KURL();
+        m_expectedClientRedirectDest = KURL();
+        m_webFrame->client()->didCancelClientRedirect(m_webFrame);
+    }
+
+    // No need to clear the redirect chain, since that data source has already
+    // been deleted by the time this function is called.
+}
+
+void FrameLoaderClientImpl::dispatchWillPerformClientRedirect(
+    const KURL& url,
+    double interval,
+    double fireDate)
+{
+    // Tells dispatchDidStartProvisionalLoad that if it sees this item it is a
+    // redirect and the source item should be added as the start of the chain.
+    m_expectedClientRedirectSrc = m_webFrame->url();
+    m_expectedClientRedirectDest = url;
+
+    // FIXME: bug 1135512. Webkit does not properly notify us of cancelling
+    // http > file client redirects. Since the FrameLoader's policy is to never
+    // carry out such a navigation anyway, the best thing we can do for now to
+    // not get confused is ignore this notification.
+    if (m_expectedClientRedirectDest.isLocalFile()
+        && m_expectedClientRedirectSrc.protocolInHTTPFamily()) {
+        m_expectedClientRedirectSrc = KURL();
+        m_expectedClientRedirectDest = KURL();
+        return;
+    }
+
+    if (m_webFrame->client()) {
+        m_webFrame->client()->willPerformClientRedirect(
+            m_webFrame,
+            m_expectedClientRedirectSrc,
+            m_expectedClientRedirectDest,
+            static_cast<unsigned int>(interval),
+            static_cast<unsigned int>(fireDate));
+    }
+}
+
+void FrameLoaderClientImpl::dispatchDidChangeLocationWithinPage()
+{
+    // Anchor fragment navigations are not normal loads, so we need to synthesize
+    // some events for our delegate.
+    WebViewImpl* webView = m_webFrame->viewImpl();
+
+    // Flag of whether frame loader is completed. Generate didStartLoading and
+    // didStopLoading only when loader is completed so that we don't fire
+    // them for fragment redirection that happens in window.onload handler.
+    // See https://bugs.webkit.org/show_bug.cgi?id=31838
+    bool loaderCompleted =
+        !m_webFrame->frame()->page()->mainFrame()->loader()->isLoading();
+
+    // Generate didStartLoading if loader is completed.
+    if (webView->client() && loaderCompleted)
+        webView->client()->didStartLoading();
+
+    WebDataSourceImpl* ds = m_webFrame->dataSourceImpl();
+    ASSERT(ds);  // Should not be null when navigating to a reference fragment!
+    if (ds) {
+        KURL url = ds->request().url();
+        KURL chainEnd;
+        if (ds->hasRedirectChain()) {
+            chainEnd = ds->endOfRedirectChain();
+            ds->clearRedirectChain();
+        }
+
+        // Figure out if this location change is because of a JS-initiated
+        // client redirect (e.g onload/setTimeout document.location.href=).
+        // FIXME: (bugs 1085325, 1046841) We don't get proper redirect
+        // performed/cancelled notifications across anchor navigations, so the
+        // other redirect-tracking code in this class (see
+        // dispatch*ClientRedirect() and dispatchDidStartProvisionalLoad) is
+        // insufficient to catch and properly flag these transitions. Once a
+        // proper fix for this bug is identified and applied the following
+        // block may no longer be required.
+        bool wasClientRedirect =
+            (url == m_expectedClientRedirectDest && chainEnd == m_expectedClientRedirectSrc)
+            || !m_webFrame->isProcessingUserGesture();
+
+        if (wasClientRedirect) {
+            if (m_webFrame->client())
+                m_webFrame->client()->didCompleteClientRedirect(m_webFrame, chainEnd);
+            ds->appendRedirect(chainEnd);
+            // Make sure we clear the expected redirect since we just effectively
+            // completed it.
+            m_expectedClientRedirectSrc = KURL();
+            m_expectedClientRedirectDest = KURL();
+        }
+
+        // Regardless of how we got here, we are navigating to a URL so we need to
+        // add it to the redirect chain.
+        ds->appendRedirect(url);
+    }
+
+    bool isNewNavigation;
+    webView->didCommitLoad(&isNewNavigation);
+    if (m_webFrame->client())
+        m_webFrame->client()->didChangeLocationWithinPage(m_webFrame, isNewNavigation);
+
+    // Generate didStopLoading if loader is completed.
+    if (webView->client() && loaderCompleted)
+        webView->client()->didStopLoading();
+}
+
+void FrameLoaderClientImpl::dispatchDidPushStateWithinPage()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::dispatchDidReplaceStateWithinPage()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::dispatchDidPopStateWithinPage()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::dispatchWillClose()
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->willClose(m_webFrame);
+}
+
+void FrameLoaderClientImpl::dispatchDidReceiveIcon()
+{
+    // The icon database is disabled, so this should never be called.
+    ASSERT_NOT_REACHED();
+}
+
+void FrameLoaderClientImpl::dispatchDidStartProvisionalLoad()
+{
+    // In case a redirect occurs, we need this to be set so that the redirect
+    // handling code can tell where the redirect came from. Server redirects
+    // will occur on the provisional load, so we need to keep track of the most
+    // recent provisional load URL.
+    // See dispatchDidReceiveServerRedirectForProvisionalLoad.
+    WebDataSourceImpl* ds = m_webFrame->provisionalDataSourceImpl();
+    if (!ds) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    KURL url = ds->request().url();
+
+    // Since the provisional load just started, we should have not gotten
+    // any redirects yet.
+    ASSERT(!ds->hasRedirectChain());
+
+    // If this load is what we expected from a client redirect, treat it as a
+    // redirect from that original page. The expected redirect urls will be
+    // cleared by DidCancelClientRedirect.
+    bool completingClientRedirect = false;
+    if (m_expectedClientRedirectSrc.isValid()) {
+        // m_expectedClientRedirectDest could be something like
+        // "javascript:history.go(-1)" thus we need to exclude url starts with
+        // "javascript:". See bug: 1080873
+        ASSERT(m_expectedClientRedirectDest.protocolIs("javascript")
+            || m_expectedClientRedirectDest == url);
+        ds->appendRedirect(m_expectedClientRedirectSrc);
+        completingClientRedirect = true;
+    }
+    ds->appendRedirect(url);
+
+    if (m_webFrame->client()) {
+        // Whatever information didCompleteClientRedirect contains should only
+        // be considered relevant until the next provisional load has started.
+        // So we first tell the client that the load started, and then tell it
+        // about the client redirect the load is responsible for completing.
+        m_webFrame->client()->didStartProvisionalLoad(m_webFrame);
+        if (completingClientRedirect) {
+            m_webFrame->client()->didCompleteClientRedirect(
+                m_webFrame, m_expectedClientRedirectSrc);
+        }
+    }
+}
+
+void FrameLoaderClientImpl::dispatchDidReceiveTitle(const String& title)
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didReceiveTitle(m_webFrame, title);
+}
+
+void FrameLoaderClientImpl::dispatchDidCommitLoad()
+{
+    WebViewImpl* webview = m_webFrame->viewImpl();
+    bool isNewNavigation;
+    webview->didCommitLoad(&isNewNavigation);
+
+    if (m_webFrame->client())
+        m_webFrame->client()->didCommitProvisionalLoad(m_webFrame, isNewNavigation);
+
+    if (webview->devToolsAgentPrivate())
+        webview->devToolsAgentPrivate()->didCommitProvisionalLoad(m_webFrame, isNewNavigation);
+}
+
+void FrameLoaderClientImpl::dispatchDidFailProvisionalLoad(
+    const ResourceError& error)
+{
+
+    // If a policy change occured, then we do not want to inform the plugin
+    // delegate.  See http://b/907789 for details.  FIXME: This means the
+    // plugin won't receive NPP_URLNotify, which seems like it could result in
+    // a memory leak in the plugin!!
+    if (error.domain() == internalErrorDomain
+        && error.errorCode() == PolicyChangeError) {
+        m_webFrame->didFail(cancelledError(error.failingURL()), true);
+        return;
+    }
+
+    OwnPtr<WebPluginLoadObserver> observer = pluginLoadObserver();
+    m_webFrame->didFail(error, true);
+    if (observer)
+        observer->didFailLoading(error);
+}
+
+void FrameLoaderClientImpl::dispatchDidFailLoad(const ResourceError& error)
+{
+    OwnPtr<WebPluginLoadObserver> observer = pluginLoadObserver();
+    m_webFrame->didFail(error, false);
+    if (observer)
+        observer->didFailLoading(error);
+
+    // Don't clear the redirect chain, this will happen in the middle of client
+    // redirects, and we need the context. The chain will be cleared when the
+    // provisional load succeeds or fails, not the "real" one.
+}
+
+void FrameLoaderClientImpl::dispatchDidFinishLoad()
+{
+    OwnPtr<WebPluginLoadObserver> observer = pluginLoadObserver();
+
+    if (m_webFrame->client())
+        m_webFrame->client()->didFinishLoad(m_webFrame);
+
+    if (observer)
+        observer->didFinishLoading();
+
+    // Don't clear the redirect chain, this will happen in the middle of client
+    // redirects, and we need the context. The chain will be cleared when the
+    // provisional load succeeds or fails, not the "real" one.
+}
+
+void FrameLoaderClientImpl::dispatchDidFirstLayout()
+{
+}
+
+void FrameLoaderClientImpl::dispatchDidFirstVisuallyNonEmptyLayout()
+{
+    // FIXME: called when webkit finished layout of a page that was visually non-empty.
+    // All resources have not necessarily finished loading.
+}
+
+Frame* FrameLoaderClientImpl::dispatchCreatePage()
+{
+    struct WindowFeatures features;
+    Page* newPage = m_webFrame->frame()->page()->chrome()->createWindow(
+        m_webFrame->frame(), FrameLoadRequest(), features);
+
+    // Make sure that we have a valid disposition.  This should have been set in
+    // the preceeding call to dispatchDecidePolicyForNewWindowAction.
+    ASSERT(m_nextNavigationPolicy != WebNavigationPolicyIgnore);
+    WebNavigationPolicy policy = m_nextNavigationPolicy;
+    m_nextNavigationPolicy = WebNavigationPolicyIgnore;
+
+    // createWindow can return null (e.g., popup blocker denies the window).
+    if (!newPage)
+        return 0;
+
+    WebViewImpl::fromPage(newPage)->setInitialNavigationPolicy(policy);
+    return newPage->mainFrame();
+}
+
+void FrameLoaderClientImpl::dispatchShow()
+{
+    WebViewImpl* webView = m_webFrame->viewImpl();
+    if (webView && webView->client())
+        webView->client()->show(webView->initialNavigationPolicy());
+}
+
+static bool shouldTreatAsAttachment(const ResourceResponse& response)
+{
+    const String& contentDisposition =
+        response.httpHeaderField("Content-Disposition");
+    if (contentDisposition.isEmpty())
+        return false;
+
+    // Some broken sites just send
+    // Content-Disposition: ; filename="file"
+    // screen those out here.
+    if (contentDisposition.startsWith(";"))
+        return false;
+
+    if (contentDisposition.startsWith("inline", false))
+        return false;
+
+    // Some broken sites just send
+    // Content-Disposition: filename="file"
+    // without a disposition token... screen those out.
+    if (contentDisposition.startsWith("filename", false))
+        return false;
+
+    // Also in use is Content-Disposition: name="file"
+    if (contentDisposition.startsWith("name", false))
+        return false;
+
+    // We have a content-disposition of "attachment" or unknown.
+    // RFC 2183, section 2.8 says that an unknown disposition
+    // value should be treated as "attachment"
+    return true;
+}
+
+void FrameLoaderClientImpl::dispatchDecidePolicyForMIMEType(
+     FramePolicyFunction function,
+     const String& mimeType,
+     const ResourceRequest&)
+{
+    const ResourceResponse& response =
+        m_webFrame->frame()->loader()->activeDocumentLoader()->response();
+
+    PolicyAction action;
+
+    int statusCode = response.httpStatusCode();
+    if (statusCode == 204 || statusCode == 205) {
+        // The server does not want us to replace the page contents.
+        action = PolicyIgnore;
+    } else if (shouldTreatAsAttachment(response)) {
+        // The server wants us to download instead of replacing the page contents.
+        // Downloading is handled by the embedder, but we still get the initial
+        // response so that we can ignore it and clean up properly.
+        action = PolicyIgnore;
+    } else if (!canShowMIMEType(mimeType)) {
+        // Make sure that we can actually handle this type internally.
+        action = PolicyIgnore;
+    } else {
+        // OK, we will render this page.
+        action = PolicyUse;
+    }
+
+    // NOTE: PolicyChangeError will be generated when action is not PolicyUse.
+    (m_webFrame->frame()->loader()->policyChecker()->*function)(action);
+}
+
+void FrameLoaderClientImpl::dispatchDecidePolicyForNewWindowAction(
+    FramePolicyFunction function,
+    const NavigationAction& action,
+    const ResourceRequest& request,
+    PassRefPtr<FormState> formState,
+    const String& frameName)
+{
+    WebNavigationPolicy navigationPolicy;
+    if (!actionSpecifiesNavigationPolicy(action, &navigationPolicy))
+        navigationPolicy = WebNavigationPolicyNewForegroundTab;
+
+    PolicyAction policyAction;
+    if (navigationPolicy == WebNavigationPolicyDownload)
+        policyAction = PolicyDownload;
+    else {
+        policyAction = PolicyUse;
+
+        // Remember the disposition for when dispatchCreatePage is called.  It is
+        // unfortunate that WebCore does not provide us with any context when
+        // creating or showing the new window that would allow us to avoid having
+        // to keep this state.
+        m_nextNavigationPolicy = navigationPolicy;
+    }
+    (m_webFrame->frame()->loader()->policyChecker()->*function)(policyAction);
+}
+
+void FrameLoaderClientImpl::dispatchDecidePolicyForNavigationAction(
+    FramePolicyFunction function,
+    const NavigationAction& action,
+    const ResourceRequest& request,
+    PassRefPtr<FormState> formState) {
+    PolicyAction policyAction = PolicyIgnore;
+
+    // It is valid for this function to be invoked in code paths where the
+    // the webview is closed.
+    // The null check here is to fix a crash that seems strange
+    // (see - https://bugs.webkit.org/show_bug.cgi?id=23554).
+    if (m_webFrame->client() && !request.url().isNull()) {
+      WebNavigationPolicy navigationPolicy = WebNavigationPolicyCurrentTab;
+      actionSpecifiesNavigationPolicy(action, &navigationPolicy);
+
+      // Give the delegate a chance to change the navigation policy.
+      const WebDataSourceImpl* ds = m_webFrame->provisionalDataSourceImpl();
+      if (ds) {
+          KURL url = ds->request().url();
+          if (url.protocolIs(backForwardNavigationScheme)) {
+              handleBackForwardNavigation(url);
+              navigationPolicy = WebNavigationPolicyIgnore;
+          } else {
+              bool isRedirect = ds->hasRedirectChain();
+
+              WebNavigationType webnavType =
+                  WebDataSourceImpl::toWebNavigationType(action.type());
+
+              RefPtr<Node> node;
+              for (const Event* event = action.event(); event; event = event->underlyingEvent()) {
+                  if (event->isMouseEvent()) {
+                      const MouseEvent* mouseEvent =
+                          static_cast<const MouseEvent*>(event);
+                      node = m_webFrame->frame()->eventHandler()->hitTestResultAtPoint(
+                          mouseEvent->absoluteLocation(), false).innerNonSharedNode();
+                      break;
+                  }
+              }
+              WebNode originatingNode(node);
+
+              navigationPolicy = m_webFrame->client()->decidePolicyForNavigation(
+                  m_webFrame, ds->request(), webnavType, originatingNode,
+                  navigationPolicy, isRedirect);
+          }
+      }
+
+      if (navigationPolicy == WebNavigationPolicyCurrentTab)
+          policyAction = PolicyUse;
+      else if (navigationPolicy == WebNavigationPolicyDownload)
+          policyAction = PolicyDownload;
+      else {
+          if (navigationPolicy != WebNavigationPolicyIgnore) {
+              WrappedResourceRequest webreq(request);
+              m_webFrame->client()->loadURLExternally(m_webFrame, webreq, navigationPolicy);
+          }
+          policyAction = PolicyIgnore;
+      }
+    }
+
+    (m_webFrame->frame()->loader()->policyChecker()->*function)(policyAction);
+}
+
+void FrameLoaderClientImpl::cancelPolicyCheck()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::dispatchUnableToImplementPolicy(const ResourceError& error)
+{
+    m_webFrame->client()->unableToImplementPolicyWithError(m_webFrame, error);
+}
+
+void FrameLoaderClientImpl::dispatchWillSubmitForm(FramePolicyFunction function,
+    PassRefPtr<FormState> formState)
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->willSubmitForm(m_webFrame, WebFormElement(formState->form()));
+    (m_webFrame->frame()->loader()->policyChecker()->*function)(PolicyUse);
+}
+
+void FrameLoaderClientImpl::dispatchDidLoadMainResource(DocumentLoader*)
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::revertToProvisionalState(DocumentLoader*)
+{
+    m_hasRepresentation = true;
+}
+
+void FrameLoaderClientImpl::setMainDocumentError(DocumentLoader*,
+                                                 const ResourceError& error)
+{
+    if (m_pluginWidget.get()) {
+        if (m_sentInitialResponseToPlugin) {
+            m_pluginWidget->didFailLoading(error);
+            m_sentInitialResponseToPlugin = false;
+        }
+        m_pluginWidget = 0;
+    }
+}
+
+void FrameLoaderClientImpl::postProgressStartedNotification()
+{
+    WebViewImpl* webview = m_webFrame->viewImpl();
+    if (webview && webview->client())
+        webview->client()->didStartLoading();
+}
+
+void FrameLoaderClientImpl::postProgressEstimateChangedNotification()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::postProgressFinishedNotification()
+{
+    // FIXME: why might the webview be null?  http://b/1234461
+    WebViewImpl* webview = m_webFrame->viewImpl();
+    if (webview && webview->client())
+        webview->client()->didStopLoading();
+}
+
+void FrameLoaderClientImpl::setMainFrameDocumentReady(bool ready)
+{
+    // FIXME
+}
+
+// Creates a new connection and begins downloading from that (contrast this
+// with |download|).
+void FrameLoaderClientImpl::startDownload(const ResourceRequest& request)
+{
+    if (m_webFrame->client()) {
+        WrappedResourceRequest webreq(request);
+        m_webFrame->client()->loadURLExternally(
+            m_webFrame, webreq, WebNavigationPolicyDownload);
+    }
+}
+
+void FrameLoaderClientImpl::willChangeTitle(DocumentLoader*)
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::didChangeTitle(DocumentLoader*)
+{
+    // FIXME
+}
+
+// Called whenever data is received.
+void FrameLoaderClientImpl::committedLoad(DocumentLoader* loader, const char* data, int length)
+{
+    if (!m_pluginWidget.get()) {
+        if (m_webFrame->client()) {
+            bool preventDefault = false;
+            m_webFrame->client()->didReceiveDocumentData(m_webFrame, data, length, preventDefault);
+            if (!preventDefault)
+                m_webFrame->commitDocumentData(data, length);
+        }
+    }
+
+    // If we are sending data to MediaDocument, we should stop here
+    // and cancel the request.
+    if (m_webFrame->frame()->document()
+        && m_webFrame->frame()->document()->isMediaDocument())
+        loader->cancelMainResourceLoad(pluginWillHandleLoadError(loader->response()));
+
+    // The plugin widget could have been created in the m_webFrame->DidReceiveData
+    // function.
+    if (m_pluginWidget.get()) {
+        if (!m_sentInitialResponseToPlugin) {
+            m_sentInitialResponseToPlugin = true;
+            m_pluginWidget->didReceiveResponse(
+                m_webFrame->frame()->loader()->activeDocumentLoader()->response());
+        }
+        m_pluginWidget->didReceiveData(data, length);
+    }
+}
+
+void FrameLoaderClientImpl::finishedLoading(DocumentLoader* dl)
+{
+    if (m_pluginWidget.get()) {
+        m_pluginWidget->didFinishLoading();
+        m_pluginWidget = 0;
+        m_sentInitialResponseToPlugin = false;
+    } else {
+        // This is necessary to create an empty document. See bug 634004.
+        // However, we only want to do this if makeRepresentation has been called, to
+        // match the behavior on the Mac.
+        if (m_hasRepresentation)
+            dl->frameLoader()->setEncoding("", false);
+    }
+}
+
+void FrameLoaderClientImpl::updateGlobalHistory()
+{
+}
+
+void FrameLoaderClientImpl::updateGlobalHistoryRedirectLinks()
+{
+}
+
+bool FrameLoaderClientImpl::shouldGoToHistoryItem(HistoryItem*) const
+{
+    // FIXME
+    return true;
+}
+
+void FrameLoaderClientImpl::dispatchDidAddBackForwardItem(HistoryItem*) const
+{
+}
+
+void FrameLoaderClientImpl::dispatchDidRemoveBackForwardItem(HistoryItem*) const
+{
+}
+
+void FrameLoaderClientImpl::dispatchDidChangeBackForwardIndex() const
+{
+}
+
+void FrameLoaderClientImpl::didDisplayInsecureContent()
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didDisplayInsecureContent(m_webFrame);
+}
+
+void FrameLoaderClientImpl::didRunInsecureContent(SecurityOrigin* origin)
+{
+    if (m_webFrame->client())
+        m_webFrame->client()->didRunInsecureContent(m_webFrame, WebSecurityOrigin(origin));
+}
+
+ResourceError FrameLoaderClientImpl::blockedError(const ResourceRequest&)
+{
+    // FIXME
+    return ResourceError();
+}
+
+ResourceError FrameLoaderClientImpl::cancelledError(const ResourceRequest& request)
+{
+    if (!m_webFrame->client())
+        return ResourceError();
+
+    return m_webFrame->client()->cancelledError(
+        m_webFrame, WrappedResourceRequest(request));
+}
+
+ResourceError FrameLoaderClientImpl::cannotShowURLError(const ResourceRequest& request)
+{
+    if (!m_webFrame->client())
+        return ResourceError();
+
+    return m_webFrame->client()->cannotHandleRequestError(
+        m_webFrame, WrappedResourceRequest(request));
+}
+
+ResourceError FrameLoaderClientImpl::interruptForPolicyChangeError(
+    const ResourceRequest& request)
+{
+    return ResourceError(internalErrorDomain, PolicyChangeError,
+                         request.url().string(), String());
+}
+
+ResourceError FrameLoaderClientImpl::cannotShowMIMETypeError(const ResourceResponse&)
+{
+    // FIXME
+    return ResourceError();
+}
+
+ResourceError FrameLoaderClientImpl::fileDoesNotExistError(const ResourceResponse&)
+{
+    // FIXME
+    return ResourceError();
+}
+
+ResourceError FrameLoaderClientImpl::pluginWillHandleLoadError(const ResourceResponse&)
+{
+    // FIXME
+    return ResourceError();
+}
+
+bool FrameLoaderClientImpl::shouldFallBack(const ResourceError& error)
+{
+    // This method is called when we fail to load the URL for an <object> tag
+    // that has fallback content (child elements) and is being loaded as a frame.
+    // The error parameter indicates the reason for the load failure.
+    // We should let the fallback content load only if this wasn't a cancelled
+    // request.
+    // Note: The mac version also has a case for "WebKitErrorPluginWillHandleLoad"
+    ResourceError c = cancelledError(ResourceRequest());
+    return error.errorCode() != c.errorCode() || error.domain() != c.domain();
+}
+
+bool FrameLoaderClientImpl::canHandleRequest(const ResourceRequest& request) const
+{
+    return m_webFrame->client()->canHandleRequest(
+        m_webFrame, WrappedResourceRequest(request));
+}
+
+bool FrameLoaderClientImpl::canShowMIMEType(const String& mimeType) const
+{
+    // This method is called to determine if the media type can be shown
+    // "internally" (i.e. inside the browser) regardless of whether or not the
+    // browser or a plugin is doing the rendering.
+
+    // mimeType strings are supposed to be ASCII, but if they are not for some
+    // reason, then it just means that the mime type will fail all of these "is
+    // supported" checks and go down the path of an unhandled mime type.
+    if (webKitClient()->mimeRegistry()->supportsMIMEType(mimeType) == WebMimeRegistry::IsSupported)
+        return true;
+
+    // If Chrome is started with the --disable-plugins switch, pluginData is null.
+    PluginData* pluginData = m_webFrame->frame()->page()->pluginData();
+
+    // See if the type is handled by an installed plugin, if so, we can show it.
+    // FIXME: (http://b/1085524) This is the place to stick a preference to
+    //        disable full page plugins (optionally for certain types!)
+    return !mimeType.isEmpty() && pluginData && pluginData->supportsMimeType(mimeType);
+}
+
+bool FrameLoaderClientImpl::representationExistsForURLScheme(const String&) const
+{
+    // FIXME
+    return false;
+}
+
+String FrameLoaderClientImpl::generatedMIMETypeForURLScheme(const String& scheme) const
+{
+    // This appears to generate MIME types for protocol handlers that are handled
+    // internally. The only place I can find in the WebKit code that uses this
+    // function is WebView::registerViewClass, where it is used as part of the
+    // process by which custom view classes for certain document representations
+    // are registered.
+    String mimeType("x-apple-web-kit/");
+    mimeType.append(scheme.lower());
+    return mimeType;
+}
+
+void FrameLoaderClientImpl::frameLoadCompleted()
+{
+    // FIXME: the mac port also conditionally calls setDrawsBackground:YES on
+    // it's ScrollView here.
+
+    // This comment from the Mac port:
+    // Note: Can be called multiple times.
+    // Even if already complete, we might have set a previous item on a frame that
+    // didn't do any data loading on the past transaction. Make sure to clear these out.
+
+    // FIXME: setPreviousHistoryItem() no longer exists. http://crbug.com/8566
+    // m_webFrame->frame()->loader()->setPreviousHistoryItem(0);
+}
+
+void FrameLoaderClientImpl::saveViewStateToItem(HistoryItem*)
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::restoreViewState()
+{
+    // FIXME: probably scrolls to last position when you go back or forward
+}
+
+void FrameLoaderClientImpl::provisionalLoadStarted()
+{
+    // FIXME: On mac, this does various caching stuff
+}
+
+void FrameLoaderClientImpl::didFinishLoad()
+{
+    OwnPtr<WebPluginLoadObserver> observer = pluginLoadObserver();
+    if (observer)
+        observer->didFinishLoading();
+}
+
+void FrameLoaderClientImpl::prepareForDataSourceReplacement()
+{
+    // FIXME
+}
+
+PassRefPtr<DocumentLoader> FrameLoaderClientImpl::createDocumentLoader(
+    const ResourceRequest& request,
+    const SubstituteData& data)
+{
+    RefPtr<WebDataSourceImpl> ds = WebDataSourceImpl::create(request, data);
+    if (m_webFrame->client())
+        m_webFrame->client()->didCreateDataSource(m_webFrame, ds.get());
+    return ds.release();
+}
+
+void FrameLoaderClientImpl::setTitle(const String& title, const KURL& url)
+{
+    // FIXME: inform consumer of changes to the title.
+}
+
+String FrameLoaderClientImpl::userAgent(const KURL& url)
+{
+    return webKitClient()->userAgent(url);
+}
+
+void FrameLoaderClientImpl::savePlatformDataToCachedFrame(CachedFrame*)
+{
+    // The page cache should be disabled.
+    ASSERT_NOT_REACHED();
+}
+
+void FrameLoaderClientImpl::transitionToCommittedFromCachedFrame(CachedFrame*)
+{
+    ASSERT_NOT_REACHED();
+}
+
+// Called when the FrameLoader goes into a state in which a new page load
+// will occur.
+void FrameLoaderClientImpl::transitionToCommittedForNewPage()
+{
+    makeDocumentView();
+}
+
+bool FrameLoaderClientImpl::canCachePage() const
+{
+    // Since we manage the cache, always report this page as non-cacheable to
+    // FrameLoader.
+    return false;
+}
+
+// Downloading is handled in the browser process, not WebKit. If we get to this
+// point, our download detection code in the ResourceDispatcherHost is broken!
+void FrameLoaderClientImpl::download(ResourceHandle* handle,
+                                     const ResourceRequest& request,
+                                     const ResourceRequest& initialRequest,
+                                     const ResourceResponse& response)
+{
+    ASSERT_NOT_REACHED();
+}
+
+PassRefPtr<Frame> FrameLoaderClientImpl::createFrame(
+    const KURL& url,
+    const String& name,
+    HTMLFrameOwnerElement* ownerElement,
+    const String& referrer,
+    bool allowsScrolling,
+    int marginWidth,
+    int marginHeight)
+{
+    FrameLoadRequest frameRequest(ResourceRequest(url, referrer), name);
+    return m_webFrame->createChildFrame(frameRequest, ownerElement);
+}
+
+PassRefPtr<Widget> FrameLoaderClientImpl::createPlugin(
+    const IntSize& size, // FIXME: how do we use this?
+    HTMLPlugInElement* element,
+    const KURL& url,
+    const Vector<String>& paramNames,
+    const Vector<String>& paramValues,
+    const String& mimeType,
+    bool loadManually)
+{
+#if !PLATFORM(WIN_OS)
+    // WebCore asks us to make a plugin even if we don't have a
+    // registered handler, with a comment saying it's so we can display
+    // the broken plugin icon.  In Chromium, we normally register a
+    // fallback plugin handler that allows you to install a missing
+    // plugin.  Since we don't yet have a default plugin handler, we
+    // need to return null here rather than going through all the
+    // plugin-creation IPCs only to discover we don't have a plugin
+    // registered, which causes a crash.
+    // FIXME: remove me once we have a default plugin.
+    if (objectContentType(url, mimeType) != ObjectContentNetscapePlugin)
+        return 0;
+#endif
+
+    if (!m_webFrame->client())
+        return 0;
+
+    WebPluginParams params;
+    params.url = url;
+    params.mimeType = mimeType;
+    params.attributeNames = paramNames;
+    params.attributeValues = paramValues;
+    params.loadManually = loadManually;
+
+    WebPlugin* webPlugin = m_webFrame->client()->createPlugin(m_webFrame, params);
+    if (!webPlugin)
+        return 0;
+
+    // The container takes ownership of the WebPlugin.
+    RefPtr<WebPluginContainerImpl> container =
+        WebPluginContainerImpl::create(element, webPlugin);
+
+    if (!webPlugin->initialize(container.get()))
+        return 0;
+
+    // The element might have been removed during plugin initialization!
+    if (!element->renderer())
+        return 0;
+
+    return container;
+}
+
+// This method gets called when a plugin is put in place of html content
+// (e.g., acrobat reader).
+void FrameLoaderClientImpl::redirectDataToPlugin(Widget* pluginWidget)
+{
+    m_pluginWidget = static_cast<WebPluginContainerImpl*>(pluginWidget);
+    ASSERT(m_pluginWidget.get());
+}
+
+PassRefPtr<Widget> FrameLoaderClientImpl::createJavaAppletWidget(
+    const IntSize& size,
+    HTMLAppletElement* element,
+    const KURL& /* baseURL */,
+    const Vector<String>& paramNames,
+    const Vector<String>& paramValues)
+{
+    return createPlugin(size, element, KURL(), paramNames, paramValues,
+        "application/x-java-applet", false);
+}
+
+ObjectContentType FrameLoaderClientImpl::objectContentType(
+    const KURL& url,
+    const String& explicitMimeType)
+{
+    // This code is based on Apple's implementation from
+    // WebCoreSupport/WebFrameBridge.mm.
+
+    String mimeType = explicitMimeType;
+    if (mimeType.isEmpty()) {
+        // Try to guess the MIME type based off the extension.
+        String filename = url.lastPathComponent();
+        int extensionPos = filename.reverseFind('.');
+        if (extensionPos >= 0) {
+            String extension = filename.substring(extensionPos + 1);
+            mimeType = MIMETypeRegistry::getMIMETypeForExtension(extension);
+            if (mimeType.isEmpty()) {
+                // If there's no mimetype registered for the extension, check to see
+                // if a plugin can handle the extension.
+                mimeType = getPluginMimeTypeFromExtension(extension);
+            }
+        }
+
+        if (mimeType.isEmpty())
+            return ObjectContentFrame;
+    }
+
+    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
+        return ObjectContentImage;
+
+    // If Chrome is started with the --disable-plugins switch, pluginData is 0.
+    PluginData* pluginData = m_webFrame->frame()->page()->pluginData();
+    if (pluginData && pluginData->supportsMimeType(mimeType))
+        return ObjectContentNetscapePlugin;
+
+    if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
+        return ObjectContentFrame;
+
+    return ObjectContentNone;
+}
+
+String FrameLoaderClientImpl::overrideMediaType() const
+{
+    // FIXME
+    return String();
+}
+
+bool FrameLoaderClientImpl::actionSpecifiesNavigationPolicy(
+    const NavigationAction& action,
+    WebNavigationPolicy* policy)
+{
+    if ((action.type() != NavigationTypeLinkClicked) || !action.event()->isMouseEvent())
+        return false;
+
+    const MouseEvent* event = static_cast<const MouseEvent*>(action.event());
+    return WebViewImpl::navigationPolicyFromMouseEvent(
+        event->button(), event->ctrlKey(), event->shiftKey(), event->altKey(),
+        event->metaKey(), policy);
+}
+
+void FrameLoaderClientImpl::handleBackForwardNavigation(const KURL& url)
+{
+    ASSERT(url.protocolIs(backForwardNavigationScheme));
+
+    bool ok;
+    int offset = url.lastPathComponent().toIntStrict(&ok);
+    if (!ok)
+        return;
+
+    WebViewImpl* webview = m_webFrame->viewImpl();
+    if (webview->client())
+        webview->client()->navigateBackForwardSoon(offset);
+}
+
+PassOwnPtr<WebPluginLoadObserver> FrameLoaderClientImpl::pluginLoadObserver()
+{
+    WebDataSourceImpl* ds = WebDataSourceImpl::fromDocumentLoader(
+        m_webFrame->frame()->loader()->activeDocumentLoader());
+    return ds->releasePluginLoadObserver();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.h b/WebKit/chromium/src/FrameLoaderClientImpl.h
new file mode 100644
index 0000000..4ddfe5f
--- /dev/null
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FrameLoaderClientImpl_h
+#define FrameLoaderClientImpl_h
+
+// FIXME: remove this relative path once consumers from glue are removed.
+#include "../public/WebNavigationPolicy.h"
+#include "FrameLoaderClient.h"
+#include "KURL.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/RefPtr.h>
+
+
+namespace WebKit {
+
+class WebFrameImpl;
+class WebPluginContainerImpl;
+class WebPluginLoadObserver;
+
+class FrameLoaderClientImpl : public WebCore::FrameLoaderClient {
+public:
+    FrameLoaderClientImpl(WebFrameImpl* webFrame);
+    ~FrameLoaderClientImpl();
+
+    WebFrameImpl* webFrame() const { return m_webFrame; }
+
+    // WebCore::FrameLoaderClient ----------------------------------------------
+
+    virtual void frameLoaderDestroyed();
+
+    // Notifies the WebView delegate that the JS window object has been cleared,
+    // giving it a chance to bind native objects to the window before script
+    // parsing begins.
+    virtual void dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*);
+    virtual void documentElementAvailable();
+
+    // A frame's V8 context was created or destroyed.
+    virtual void didCreateScriptContextForFrame();
+    virtual void didDestroyScriptContextForFrame();
+
+    // A context untied to a frame was created (through evaluateInNewContext).
+    // This context is not tied to the lifetime of its frame, and is destroyed
+    // in garbage collection.
+    virtual void didCreateIsolatedScriptContext();
+
+    virtual bool hasWebView() const;
+    virtual bool hasFrameView() const;
+    virtual void makeRepresentation(WebCore::DocumentLoader*);
+    virtual void forceLayout();
+    virtual void forceLayoutForNonHTML();
+    virtual void setCopiesOnScroll();
+    virtual void detachedFromParent2();
+    virtual void detachedFromParent3();
+    virtual void assignIdentifierToInitialRequest(unsigned long identifier, WebCore::DocumentLoader*, const WebCore::ResourceRequest&);
+    virtual void dispatchWillSendRequest(WebCore::DocumentLoader*, unsigned long identifier, WebCore::ResourceRequest&, const WebCore::ResourceResponse& redirectResponse);
+    virtual bool shouldUseCredentialStorage(WebCore::DocumentLoader*, unsigned long identifier);
+    virtual void dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::AuthenticationChallenge&);
+    virtual void dispatchDidCancelAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::AuthenticationChallenge&);
+    virtual void dispatchDidReceiveResponse(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceResponse&);
+    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int lengthReceived);
+    virtual void dispatchDidFinishLoading(WebCore::DocumentLoader*, unsigned long identifier);
+    virtual void dispatchDidFailLoading(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceError&);
+    virtual bool dispatchDidLoadResourceFromMemoryCache(WebCore::DocumentLoader*, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&, int length);
+    virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long identifier, const WebCore::ScriptString&);
+    virtual void dispatchDidHandleOnloadEvents();
+    virtual void dispatchDidReceiveServerRedirectForProvisionalLoad();
+    virtual void dispatchDidCancelClientRedirect();
+    virtual void dispatchWillPerformClientRedirect(const WebCore::KURL&, double interval, double fireDate);
+    virtual void dispatchDidChangeLocationWithinPage();
+    virtual void dispatchDidPushStateWithinPage();
+    virtual void dispatchDidReplaceStateWithinPage();
+    virtual void dispatchDidPopStateWithinPage();
+    virtual void dispatchWillClose();
+    virtual void dispatchDidReceiveIcon();
+    virtual void dispatchDidStartProvisionalLoad();
+    virtual void dispatchDidReceiveTitle(const WebCore::String& title);
+    virtual void dispatchDidCommitLoad();
+    virtual void dispatchDidFailProvisionalLoad(const WebCore::ResourceError&);
+    virtual void dispatchDidFailLoad(const WebCore::ResourceError&);
+    virtual void dispatchDidFinishDocumentLoad();
+    virtual void dispatchDidFinishLoad();
+    virtual void dispatchDidFirstLayout();
+    virtual void dispatchDidFirstVisuallyNonEmptyLayout();
+    virtual WebCore::Frame* dispatchCreatePage();
+    virtual void dispatchShow();
+    virtual void dispatchDecidePolicyForMIMEType(WebCore::FramePolicyFunction function, const WebCore::String& mime_type, const WebCore::ResourceRequest&);
+    virtual void dispatchDecidePolicyForNewWindowAction(WebCore::FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState> form_state, const WebCore::String& frame_name);
+    virtual void dispatchDecidePolicyForNavigationAction(WebCore::FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState> form_state);
+    virtual void cancelPolicyCheck();
+    virtual void dispatchUnableToImplementPolicy(const WebCore::ResourceError&);
+    virtual void dispatchWillSubmitForm(WebCore::FramePolicyFunction, PassRefPtr<WebCore::FormState>);
+    virtual void dispatchDidLoadMainResource(WebCore::DocumentLoader*);
+    virtual void revertToProvisionalState(WebCore::DocumentLoader*);
+    virtual void setMainDocumentError(WebCore::DocumentLoader*, const WebCore::ResourceError&);
+    virtual void willChangeEstimatedProgress() { }
+    virtual void didChangeEstimatedProgress() { }
+    virtual void postProgressStartedNotification();
+    virtual void postProgressEstimateChangedNotification();
+    virtual void postProgressFinishedNotification();
+    virtual void setMainFrameDocumentReady(bool);
+    virtual void startDownload(const WebCore::ResourceRequest&);
+    virtual void willChangeTitle(WebCore::DocumentLoader*);
+    virtual void didChangeTitle(WebCore::DocumentLoader*);
+    virtual void committedLoad(WebCore::DocumentLoader*, const char*, int);
+    virtual void finishedLoading(WebCore::DocumentLoader*);
+    virtual void updateGlobalHistory();
+    virtual void updateGlobalHistoryRedirectLinks();
+    virtual bool shouldGoToHistoryItem(WebCore::HistoryItem*) const;
+    virtual void dispatchDidAddBackForwardItem(WebCore::HistoryItem*) const;
+    virtual void dispatchDidRemoveBackForwardItem(WebCore::HistoryItem*) const;
+    virtual void dispatchDidChangeBackForwardIndex() const;
+    virtual void didDisplayInsecureContent();
+    virtual void didRunInsecureContent(WebCore::SecurityOrigin*);
+    virtual WebCore::ResourceError blockedError(const WebCore::ResourceRequest&);
+    virtual WebCore::ResourceError cancelledError(const WebCore::ResourceRequest&);
+    virtual WebCore::ResourceError cannotShowURLError(const WebCore::ResourceRequest&);
+    virtual WebCore::ResourceError interruptForPolicyChangeError(const WebCore::ResourceRequest&);
+    virtual WebCore::ResourceError cannotShowMIMETypeError(const WebCore::ResourceResponse&);
+    virtual WebCore::ResourceError fileDoesNotExistError(const WebCore::ResourceResponse&);
+    virtual WebCore::ResourceError pluginWillHandleLoadError(const WebCore::ResourceResponse&);
+    virtual bool shouldFallBack(const WebCore::ResourceError&);
+    virtual bool canHandleRequest(const WebCore::ResourceRequest&) const;
+    virtual bool canShowMIMEType(const WebCore::String& MIMEType) const;
+    virtual bool representationExistsForURLScheme(const WebCore::String& URLScheme) const;
+    virtual WebCore::String generatedMIMETypeForURLScheme(const WebCore::String& URLScheme) const;
+    virtual void frameLoadCompleted();
+    virtual void saveViewStateToItem(WebCore::HistoryItem*);
+    virtual void restoreViewState();
+    virtual void provisionalLoadStarted();
+    virtual void didFinishLoad();
+    virtual void prepareForDataSourceReplacement();
+    virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(
+        const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
+    virtual void setTitle(const WebCore::String& title, const WebCore::KURL&);
+    virtual WebCore::String userAgent(const WebCore::KURL&);
+    virtual void savePlatformDataToCachedFrame(WebCore::CachedFrame*);
+    virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
+    virtual void transitionToCommittedForNewPage();
+    virtual bool canCachePage() const;
+    virtual void download(
+        WebCore::ResourceHandle*, const WebCore::ResourceRequest&,
+        const WebCore::ResourceRequest& initialRequest,
+        const WebCore::ResourceResponse&);
+    virtual PassRefPtr<WebCore::Frame> createFrame(
+        const WebCore::KURL& url, const WebCore::String& name,
+        WebCore::HTMLFrameOwnerElement* ownerElement,
+        const WebCore::String& referrer, bool allowsScrolling,
+        int marginWidth, int marginHeight);
+    virtual PassRefPtr<WebCore::Widget> createPlugin(
+        const WebCore::IntSize&, WebCore::HTMLPlugInElement*, const WebCore::KURL&,
+        const Vector<WebCore::String>&, const Vector<WebCore::String>&,
+        const WebCore::String&, bool loadManually);
+    virtual void redirectDataToPlugin(WebCore::Widget* pluginWidget);
+    virtual PassRefPtr<WebCore::Widget> createJavaAppletWidget(
+        const WebCore::IntSize&,
+        WebCore::HTMLAppletElement*,
+        const WebCore::KURL& /* base_url */,
+        const Vector<WebCore::String>& paramNames,
+        const Vector<WebCore::String>& paramValues);
+    virtual WebCore::ObjectContentType objectContentType(
+        const WebCore::KURL& url, const WebCore::String& mimeType);
+    virtual WebCore::String overrideMediaType() const;
+    virtual void didPerformFirstNavigation() const;
+    virtual void registerForIconNotification(bool listen = true);
+    virtual void didChangeScrollOffset();
+    virtual bool allowJavaScript(bool enabledPerSettings);
+
+private:
+    void makeDocumentView();
+
+    // Given a NavigationAction, determine the associated WebNavigationPolicy.
+    // For example, a middle click means "open in background tab".
+    static bool actionSpecifiesNavigationPolicy(
+        const WebCore::NavigationAction& action, WebNavigationPolicy* policy);
+
+    // Called when a dummy back-forward navigation is intercepted.
+    void handleBackForwardNavigation(const WebCore::KURL&);
+
+    PassOwnPtr<WebPluginLoadObserver> pluginLoadObserver();
+
+    // The WebFrame that owns this object and manages its lifetime. Therefore,
+    // the web frame object is guaranteed to exist.
+    WebFrameImpl* m_webFrame;
+
+    // True if makeRepresentation was called.  We don't actually have a concept
+    // of a "representation", but we need to know when we're expected to have one.
+    // See finishedLoading().
+    bool m_hasRepresentation;
+
+    // Used to help track client redirects. When a provisional load starts, it
+    // has no redirects in its chain. But in the case of client redirects, we want
+    // to add that initial load as a redirect. When we get a new provisional load
+    // and the dest URL matches that load, we know that it was the result of a
+    // previous client redirect and the source should be added as a redirect.
+    // Both should be empty if unused.
+    WebCore::KURL m_expectedClientRedirectSrc;
+    WebCore::KURL m_expectedClientRedirectDest;
+
+    // Contains a pointer to the plugin widget.
+    RefPtr<WebPluginContainerImpl> m_pluginWidget;
+
+    // Indicates if we need to send over the initial notification to the plugin
+    // which specifies that the plugin should be ready to accept data.
+    bool m_sentInitialResponseToPlugin;
+
+    // The navigation policy to use for the next call to dispatchCreatePage.
+    WebNavigationPolicy m_nextNavigationPolicy;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/GraphicsContext3D.cpp b/WebKit/chromium/src/GraphicsContext3D.cpp
new file mode 100644
index 0000000..c9ba5a1
--- /dev/null
+++ b/WebKit/chromium/src/GraphicsContext3D.cpp
@@ -0,0 +1,2146 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "GraphicsContext3D.h"
+
+#include "CachedImage.h"
+#include "CString.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "ImageBuffer.h"
+#include "ImageData.h"
+#include "NotImplemented.h"
+#include "WebGLBuffer.h"
+#include "WebGLByteArray.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLRenderingContext.h"
+#include "WebGLShader.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
+
+#include <stdio.h>
+#include <wtf/FastMalloc.h>
+
+#if PLATFORM(WIN_OS)
+#include <windows.h>
+#endif
+
+#include "GL/glew.h"
+
+#if PLATFORM(CG)
+#include "GraphicsContext.h"
+#include <CoreGraphics/CGContext.h>
+#include <CoreGraphics/CGBitmapContext.h>
+#include <CoreGraphics/CGImage.h>
+#include <OpenGL/OpenGL.h>
+#else
+#define FLIP_FRAMEBUFFER_VERTICALLY
+#endif
+
+#if PLATFORM(SKIA)
+#include "NativeImageSkia.h"
+#endif
+
+#if PLATFORM(DARWIN)
+#define USE_TEXTURE_RECTANGLE_FOR_FRAMEBUFFER
+#endif
+
+#if PLATFORM(LINUX)
+#include <dlfcn.h>
+#include "GL/glxew.h"
+#endif
+
+using namespace std;
+
+namespace WebCore {
+
+// GraphicsContext3DInternal -----------------------------------------------------
+
+// Uncomment this to render to a separate window for debugging
+// #define RENDER_TO_DEBUGGING_WINDOW
+
+#define EXTRACT(val) (!val ? 0 : val->object())
+
+class GraphicsContext3DInternal {
+public:
+    GraphicsContext3DInternal();
+    ~GraphicsContext3DInternal();
+
+    bool makeContextCurrent();
+
+    PlatformGraphicsContext3D platformGraphicsContext3D() const;
+    Platform3DObject platformTexture() const;
+
+    void reshape(int width, int height);
+
+    void beginPaint(WebGLRenderingContext* context);
+
+    bool validateTextureTarget(int target);
+    bool validateTextureParameter(int param);
+
+    void activeTexture(unsigned long texture);
+    void bindBuffer(unsigned long target,
+                    WebGLBuffer* buffer);
+    void bindTexture(unsigned long target,
+                     WebGLTexture* texture);
+    void bufferDataImpl(unsigned long target, int size, const void* data, unsigned long usage);
+    void disableVertexAttribArray(unsigned long index);
+    void enableVertexAttribArray(unsigned long index);
+    unsigned long getError();
+    void vertexAttribPointer(unsigned long indx, int size, int type, bool normalized,
+                             unsigned long stride, unsigned long offset);
+    void viewportImpl(long x, long y, unsigned long width, unsigned long height);
+
+    void synthesizeGLError(unsigned long error);
+
+private:
+    unsigned int m_texture;
+    unsigned int m_fbo;
+    unsigned int m_depthBuffer;
+    unsigned int m_cachedWidth, m_cachedHeight;
+
+#ifdef FLIP_FRAMEBUFFER_VERTICALLY
+    unsigned char* m_scanline;
+    void flipVertically(unsigned char* framebuffer,
+                        unsigned int width,
+                        unsigned int height);
+#endif
+
+    // Note: we aren't currently using this information, but we will
+    // need to in order to verify that all enabled vertex arrays have
+    // a valid buffer bound -- to avoid crashes on certain cards.
+    unsigned int m_boundArrayBuffer;
+    class VertexAttribPointerState {
+    public:
+        VertexAttribPointerState();
+
+        bool enabled;
+        unsigned long buffer;
+        unsigned long indx;
+        int size;
+        int type;
+        bool normalized;
+        unsigned long stride;
+        unsigned long offset;
+    };
+
+    enum {
+        NumTrackedPointerStates = 2
+    };
+    VertexAttribPointerState m_vertexAttribPointerState[NumTrackedPointerStates];
+
+    // Errors raised by synthesizeGLError().
+    ListHashSet<unsigned long> m_syntheticErrors;
+
+#if PLATFORM(SKIA)
+    // If the width and height of the Canvas's backing store don't
+    // match those that we were given in the most recent call to
+    // reshape(), then we need an intermediate bitmap to read back the
+    // frame buffer into. This seems to happen when CSS styles are
+    // used to resize the Canvas.
+    SkBitmap* m_resizingBitmap;
+#endif
+
+#if PLATFORM(WIN_OS)
+    HWND  m_canvasWindow;
+    HDC   m_canvasDC;
+    HGLRC m_contextObj;
+#elif PLATFORM(CG)
+    CGLPBufferObj m_pbuffer;
+    CGLContextObj m_contextObj;
+    unsigned char* m_renderOutput;
+    CGContextRef m_cgContext;
+#elif PLATFORM(LINUX)
+    Display* m_display;
+    GLXContext m_contextObj;
+    GLXPbuffer m_pbuffer;
+    // In order to avoid problems caused by linking against libGL, we
+    // dynamically look up all the symbols we need.
+    // http://code.google.com/p/chromium/issues/detail?id=16800
+    void* m_libGL;
+    PFNGLXCHOOSEFBCONFIGPROC m_glXChooseFBConfig;
+    PFNGLXCREATENEWCONTEXTPROC m_glXCreateNewContext;
+    PFNGLXCREATEPBUFFERPROC m_glXCreatePbuffer;
+    PFNGLXDESTROYPBUFFERPROC m_glXDestroyPbuffer;
+    typedef Bool (* PFNGLXMAKECURRENTPROC)(Display* dpy, GLXDrawable drawable, GLXContext ctx);
+    PFNGLXMAKECURRENTPROC m_glXMakeCurrent;
+    typedef void (* PFNGLXDESTROYCONTEXTPROC)(Display* dpy, GLXContext ctx);
+    PFNGLXDESTROYCONTEXTPROC m_glXDestroyContext;
+    typedef GLXContext (* PFNGLXGETCURRENTCONTEXTPROC)(void);
+    PFNGLXGETCURRENTCONTEXTPROC m_glXGetCurrentContext;
+#else
+    #error Must port GraphicsContext3D to your platform
+#endif
+};
+
+GraphicsContext3DInternal::VertexAttribPointerState::VertexAttribPointerState()
+    : enabled(false)
+    , buffer(0)
+    , indx(0)
+    , size(0)
+    , type(0)
+    , normalized(false)
+    , stride(0)
+    , offset(0)
+{
+}
+
+#if PLATFORM(LINUX)
+static void* tryLoad(const char* libName)
+{
+    // We use RTLD_GLOBAL semantics so that GLEW initialization works;
+    // GLEW expects to be able to open the current process's handle
+    // and do dlsym's of GL entry points from there.
+    return dlopen(libName, RTLD_LAZY | RTLD_GLOBAL);
+}
+#endif
+
+GraphicsContext3DInternal::GraphicsContext3DInternal()
+    : m_texture(0)
+    , m_fbo(0)
+    , m_depthBuffer(0)
+#ifdef FLIP_FRAMEBUFFER_VERTICALLY
+    , m_scanline(0)
+#endif
+    , m_boundArrayBuffer(0)
+#if PLATFORM(SKIA)
+    , m_resizingBitmap(0)
+#endif
+#if PLATFORM(WIN_OS)
+    , m_canvasWindow(0)
+    , m_canvasDC(0)
+    , m_contextObj(0)
+#elif PLATFORM(CG)
+    , m_pbuffer(0)
+    , m_contextObj(0)
+    , m_renderOutput(0)
+    , m_cgContext(0)
+#elif PLATFORM(LINUX)
+    , m_display(0)
+    , m_contextObj(0)
+    , m_pbuffer(0)
+    , m_glXChooseFBConfig(0)
+    , m_glXCreateNewContext(0)
+    , m_glXCreatePbuffer(0)
+    , m_glXDestroyPbuffer(0)
+    , m_glXMakeCurrent(0)
+    , m_glXDestroyContext(0)
+    , m_glXGetCurrentContext(0)
+#else
+#error Must port to your platform
+#endif
+{
+#if PLATFORM(WIN_OS)
+    WNDCLASS wc;
+    if (!GetClassInfo(GetModuleHandle(0), L"CANVASGL", &wc)) {
+        ZeroMemory(&wc, sizeof(WNDCLASS));
+        wc.style = CS_OWNDC;
+        wc.hInstance = GetModuleHandle(0);
+        wc.lpfnWndProc = DefWindowProc;
+        wc.lpszClassName = L"CANVASGL";
+
+        if (!RegisterClass(&wc)) {
+            printf("GraphicsContext3D: RegisterClass failed\n");
+            return;
+        }
+    }
+
+    m_canvasWindow = CreateWindow(L"CANVASGL", L"CANVASGL",
+                                  WS_CAPTION,
+                                  CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT,
+                                  CW_USEDEFAULT, 0, 0, GetModuleHandle(0), 0);
+    if (!m_canvasWindow) {
+        printf("GraphicsContext3DInternal: CreateWindow failed\n");
+        return;
+    }
+
+    // get the device context
+    m_canvasDC = GetDC(m_canvasWindow);
+    if (!m_canvasDC) {
+        printf("GraphicsContext3DInternal: GetDC failed\n");
+        return;
+    }
+
+    // find default pixel format
+    PIXELFORMATDESCRIPTOR pfd;
+    ZeroMemory(&pfd, sizeof(PIXELFORMATDESCRIPTOR));
+    pfd.nSize = sizeof(PIXELFORMATDESCRIPTOR);
+    pfd.nVersion = 1;
+    pfd.dwFlags = PFD_DRAW_TO_WINDOW | PFD_SUPPORT_OPENGL
+#ifdef RENDER_TO_DEBUGGING_WINDOW
+        | PFD_DOUBLEBUFFER
+#endif // RENDER_TO_DEBUGGING_WINDOW
+        ;
+    int pixelformat = ChoosePixelFormat(m_canvasDC, &pfd);
+
+    // set the pixel format for the dc
+    if (!SetPixelFormat(m_canvasDC, pixelformat, &pfd)) {
+        printf("GraphicsContext3D: SetPixelFormat failed\n");
+        return;
+    }
+
+    // create rendering context
+    m_contextObj = wglCreateContext(m_canvasDC);
+    if (!m_contextObj) {
+        printf("GraphicsContext3D: wglCreateContext failed\n");
+        return;
+    }
+
+    if (!wglMakeCurrent(m_canvasDC, m_contextObj)) {
+        printf("GraphicsContext3D: wglMakeCurrent failed\n");
+        return;
+    }
+
+#ifdef RENDER_TO_DEBUGGING_WINDOW
+    typedef BOOL (WINAPI * PFNWGLSWAPINTERVALEXTPROC) (int interval);
+    PFNWGLSWAPINTERVALEXTPROC setSwapInterval = 0;
+    setSwapInterval = (PFNWGLSWAPINTERVALEXTPROC) wglGetProcAddress("wglSwapIntervalEXT");
+    if (setSwapInterval)
+        setSwapInterval(1);
+#endif // RENDER_TO_DEBUGGING_WINDOW
+
+#elif PLATFORM(CG)
+    // Create a 1x1 pbuffer and associated context to bootstrap things
+    CGLPixelFormatAttribute attribs[] = {
+        (CGLPixelFormatAttribute) kCGLPFAPBuffer,
+        (CGLPixelFormatAttribute) 0
+    };
+    CGLPixelFormatObj pixelFormat;
+    GLint numPixelFormats;
+    if (CGLChoosePixelFormat(attribs, &pixelFormat, &numPixelFormats) != kCGLNoError) {
+        printf("GraphicsContext3D: error choosing pixel format\n");
+        return;
+    }
+    if (!pixelFormat) {
+        printf("GraphicsContext3D: no pixel format selected\n");
+        return;
+    }
+    CGLContextObj context;
+    CGLError res = CGLCreateContext(pixelFormat, 0, &context);
+    CGLDestroyPixelFormat(pixelFormat);
+    if (res != kCGLNoError) {
+        printf("GraphicsContext3D: error creating context\n");
+        return;
+    }
+    CGLPBufferObj pbuffer;
+    if (CGLCreatePBuffer(1, 1, GL_TEXTURE_2D, GL_RGBA, 0, &pbuffer) != kCGLNoError) {
+        CGLDestroyContext(context);
+        printf("GraphicsContext3D: error creating pbuffer\n");
+        return;
+    }
+    if (CGLSetPBuffer(context, pbuffer, 0, 0, 0) != kCGLNoError) {
+        CGLDestroyContext(context);
+        CGLDestroyPBuffer(pbuffer);
+        printf("GraphicsContext3D: error attaching pbuffer to context\n");
+        return;
+    }
+    if (CGLSetCurrentContext(context) != kCGLNoError) {
+        CGLDestroyContext(context);
+        CGLDestroyPBuffer(pbuffer);
+        printf("GraphicsContext3D: error making context current\n");
+        return;
+    }
+    m_pbuffer = pbuffer;
+    m_contextObj = context;
+#elif PLATFORM(LINUX)
+    m_display = XOpenDisplay(0);
+    if (!m_display) {
+        printf("GraphicsContext3D: error opening X display\n");
+        return;
+    }
+
+    const char* libNames[] = {
+        "/usr/lib/libGL.so.1",
+        "/usr/lib32/libGL.so.1",
+        "/usr/lib64/libGL.so.1",
+    };
+    for (int i = 0; i < sizeof(libNames) / sizeof(const char*); i++) {
+        m_libGL = tryLoad(libNames[i]);
+        if (m_libGL)
+            break;
+    }
+    if (!m_libGL) {
+        printf("GraphicsContext3D: error opening libGL.so.1\n");
+        printf("GraphicsContext3D: tried:");
+        for (int i = 0; i < sizeof(libNames) / sizeof(const char*); i++)
+            printf(" %s", libNames[i]);
+        return;
+    }
+    m_glXChooseFBConfig = (PFNGLXCHOOSEFBCONFIGPROC) dlsym(m_libGL, "glXChooseFBConfig");
+    m_glXCreateNewContext = (PFNGLXCREATENEWCONTEXTPROC) dlsym(m_libGL, "glXCreateNewContext");
+    m_glXCreatePbuffer = (PFNGLXCREATEPBUFFERPROC) dlsym(m_libGL, "glXCreatePbuffer");
+    m_glXDestroyPbuffer = (PFNGLXDESTROYPBUFFERPROC) dlsym(m_libGL, "glXDestroyPbuffer");
+    m_glXMakeCurrent = (PFNGLXMAKECURRENTPROC) dlsym(m_libGL, "glXMakeCurrent");
+    m_glXDestroyContext = (PFNGLXDESTROYCONTEXTPROC) dlsym(m_libGL, "glXDestroyContext");
+    m_glXGetCurrentContext = (PFNGLXGETCURRENTCONTEXTPROC) dlsym(m_libGL, "glXGetCurrentContext");
+    if (!m_glXChooseFBConfig || !m_glXCreateNewContext || !m_glXCreatePbuffer
+        || !m_glXDestroyPbuffer || !m_glXMakeCurrent || !m_glXDestroyContext
+        || !m_glXGetCurrentContext) {
+        printf("GraphicsContext3D: error looking up bootstrapping entry points\n");
+        return;
+    }
+    int configAttrs[] = {
+        GLX_DRAWABLE_TYPE,
+        GLX_PBUFFER_BIT,
+        GLX_RENDER_TYPE,
+        GLX_RGBA_BIT,
+        GLX_DOUBLEBUFFER,
+        0,
+        0
+    };
+    int nelements = 0;
+    GLXFBConfig* config = m_glXChooseFBConfig(m_display, 0, configAttrs, &nelements);
+    if (!config) {
+        printf("GraphicsContext3D: glXChooseFBConfig failed\n");
+        return;
+    }
+    if (!nelements) {
+        printf("GraphicsContext3D: glXChooseFBConfig returned 0 elements\n");
+        XFree(config);
+        return;
+    }
+    GLXContext context = m_glXCreateNewContext(m_display, config[0], GLX_RGBA_TYPE, 0, True);
+    if (!context) {
+        printf("GraphicsContext3D: glXCreateNewContext failed\n");
+        XFree(config);
+        return;
+    }
+    int pbufferAttrs[] = {
+        GLX_PBUFFER_WIDTH,
+        1,
+        GLX_PBUFFER_HEIGHT,
+        1,
+        0
+    };
+    GLXPbuffer pbuffer = m_glXCreatePbuffer(m_display, config[0], pbufferAttrs);
+    XFree(config);
+    if (!pbuffer) {
+        printf("GraphicsContext3D: glxCreatePbuffer failed\n");
+        return;
+    }
+    if (!m_glXMakeCurrent(m_display, pbuffer, context)) {
+        printf("GraphicsContext3D: glXMakeCurrent failed\n");
+        return;
+    }
+    m_contextObj = context;
+    m_pbuffer = pbuffer;
+#else
+#error Must port to your platform
+#endif
+
+    static bool initializedGLEW = false;
+    if (!initializedGLEW) {
+        // Initialize GLEW and check for GL 2.0 support by the drivers.
+        GLenum glewInitResult = glewInit();
+        if (glewInitResult != GLEW_OK) {
+            printf("GraphicsContext3D: GLEW initialization failed\n");
+            return;
+        }
+        if (!glewIsSupported("GL_VERSION_2_0")) {
+            printf("GraphicsContext3D: OpenGL 2.0 not supported\n");
+            return;
+        }
+        initializedGLEW = true;
+    }
+}
+
+GraphicsContext3DInternal::~GraphicsContext3DInternal()
+{
+    makeContextCurrent();
+#ifndef RENDER_TO_DEBUGGING_WINDOW
+    glDeleteRenderbuffersEXT(1, &m_depthBuffer);
+    glDeleteTextures(1, &m_texture);
+#ifdef FLIP_FRAMEBUFFER_VERTICALLY
+    if (m_scanline)
+        delete[] m_scanline;
+#endif
+    glDeleteFramebuffersEXT(1, &m_fbo);
+#endif // !RENDER_TO_DEBUGGING_WINDOW
+#if PLATFORM(SKIA)
+    if (m_resizingBitmap)
+        delete m_resizingBitmap;
+#endif
+#if PLATFORM(WIN_OS)
+    wglMakeCurrent(0, 0);
+    wglDeleteContext(m_contextObj);
+    ReleaseDC(m_canvasWindow, m_canvasDC);
+    DestroyWindow(m_canvasWindow);
+#elif PLATFORM(CG)
+    CGLSetCurrentContext(0);
+    CGLDestroyContext(m_contextObj);
+    CGLDestroyPBuffer(m_pbuffer);
+    if (m_cgContext)
+        CGContextRelease(m_cgContext);
+    if (m_renderOutput)
+        delete[] m_renderOutput;
+#elif PLATFORM(LINUX)
+    m_glXMakeCurrent(m_display, 0, 0);
+    m_glXDestroyContext(m_display, m_contextObj);
+    m_glXDestroyPbuffer(m_display, m_pbuffer);
+    XCloseDisplay(m_display);
+    dlclose(m_libGL);
+#else
+#error Must port to your platform
+#endif
+    m_contextObj = 0;
+}
+
+bool GraphicsContext3DInternal::makeContextCurrent()
+{
+#if PLATFORM(WIN_OS)
+    if (wglGetCurrentContext() != m_contextObj)
+        if (wglMakeCurrent(m_canvasDC, m_contextObj))
+            return true;
+#elif PLATFORM(CG)
+    if (CGLGetCurrentContext() != m_contextObj)
+        if (CGLSetCurrentContext(m_contextObj) == kCGLNoError)
+            return true;
+#elif PLATFORM(LINUX)
+    if (m_glXGetCurrentContext() != m_contextObj)
+        if (m_glXMakeCurrent(m_display, m_pbuffer, m_contextObj))
+            return true;
+#else
+#error Must port to your platform
+#endif
+    return false;
+}
+
+PlatformGraphicsContext3D GraphicsContext3DInternal::platformGraphicsContext3D() const
+{
+    return m_contextObj;
+}
+
+Platform3DObject GraphicsContext3DInternal::platformTexture() const
+{
+    return m_texture;
+}
+
+static int createTextureObject(GLenum target)
+{
+    GLuint texture = 0;
+    glGenTextures(1, &texture);
+    glBindTexture(target, texture);
+    glTexParameterf(target, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+    glTexParameterf(target, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+    return texture;
+}
+
+void GraphicsContext3DInternal::reshape(int width, int height)
+{
+#ifdef RENDER_TO_DEBUGGING_WINDOW
+    SetWindowPos(m_canvasWindow, HWND_TOP, 0, 0, width, height,
+                 SWP_NOMOVE);
+    ShowWindow(m_canvasWindow, SW_SHOW);
+#endif
+
+    m_cachedWidth = width;
+    m_cachedHeight = height;
+    makeContextCurrent();
+
+#ifndef RENDER_TO_DEBUGGING_WINDOW
+#ifdef USE_TEXTURE_RECTANGLE_FOR_FRAMEBUFFER
+    // GL_TEXTURE_RECTANGLE_ARB is the best supported render target on Mac OS X
+    GLenum target = GL_TEXTURE_RECTANGLE_ARB;
+#else
+    GLenum target = GL_TEXTURE_2D;
+#endif
+    if (!m_texture) {
+        // Generate the texture object
+        m_texture = createTextureObject(target);
+        // Generate the framebuffer object
+        glGenFramebuffersEXT(1, &m_fbo);
+        // Generate the depth buffer
+        glGenRenderbuffersEXT(1, &m_depthBuffer);
+    }
+
+    // Reallocate the color and depth buffers
+    glBindTexture(target, m_texture);
+    glTexImage2D(target, 0, GL_RGBA8, width, height, 0, GL_RGBA, GL_UNSIGNED_BYTE, 0);
+    glBindTexture(target, 0);
+
+    glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+    glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_depthBuffer);
+    glRenderbufferStorageEXT(GL_RENDERBUFFER_EXT, GL_DEPTH_COMPONENT, width, height);
+    glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, 0);
+
+    glFramebufferTexture2DEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, target, m_texture, 0);
+    glFramebufferRenderbufferEXT(GL_FRAMEBUFFER_EXT, GL_DEPTH_ATTACHMENT_EXT, GL_RENDERBUFFER_EXT, m_depthBuffer);
+    GLenum status = glCheckFramebufferStatusEXT(GL_FRAMEBUFFER_EXT);
+    if (status != GL_FRAMEBUFFER_COMPLETE_EXT) {
+        printf("GraphicsContext3D: framebuffer was incomplete\n");
+
+        // FIXME: cleanup.
+        notImplemented();
+    }
+#endif  // RENDER_TO_DEBUGGING_WINDOW
+
+#ifdef FLIP_FRAMEBUFFER_VERTICALLY
+    if (m_scanline) {
+        delete[] m_scanline;
+        m_scanline = 0;
+    }
+    m_scanline = new unsigned char[width * 4];
+#endif  // FLIP_FRAMEBUFFER_VERTICALLY
+
+    glClear(GL_COLOR_BUFFER_BIT);
+    viewportImpl(0, 0, width, height);
+
+#if PLATFORM(CG)
+    // Need to reallocate the client-side backing store.
+    // FIXME: make this more efficient.
+    if (m_cgContext) {
+        CGContextRelease(m_cgContext);
+        m_cgContext = 0;
+    }
+    if (m_renderOutput) {
+        delete[] m_renderOutput;
+        m_renderOutput = 0;
+    }
+    int rowBytes = width * 4;
+    m_renderOutput = new unsigned char[height * rowBytes];
+    CGColorSpaceRef colorSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGB);
+    m_cgContext = CGBitmapContextCreate(m_renderOutput, width, height, 8, rowBytes,
+                                        colorSpace, kCGImageAlphaPremultipliedLast);
+    CGColorSpaceRelease(colorSpace);
+#endif  // PLATFORM(CG)
+}
+
+#ifdef FLIP_FRAMEBUFFER_VERTICALLY
+void GraphicsContext3DInternal::flipVertically(unsigned char* framebuffer,
+                                               unsigned int width,
+                                               unsigned int height)
+{
+    unsigned char* scanline = m_scanline;
+    if (!scanline)
+        return;
+    unsigned int rowBytes = width * 4;
+    unsigned int count = height / 2;
+    for (unsigned int i = 0; i < count; i++) {
+        unsigned char* rowA = framebuffer + i * rowBytes;
+        unsigned char* rowB = framebuffer + (height - i - 1) * rowBytes;
+        // FIXME: this is where the multiplication of the alpha
+        // channel into the color buffer will need to occur if the
+        // user specifies the "premultiplyAlpha" flag in the context
+        // creation attributes.
+        memcpy(scanline, rowB, rowBytes);
+        memcpy(rowB, rowA, rowBytes);
+        memcpy(rowA, scanline, rowBytes);
+    }
+}
+#endif
+
+void GraphicsContext3DInternal::beginPaint(WebGLRenderingContext* context)
+{
+    makeContextCurrent();
+
+#ifdef RENDER_TO_DEBUGGING_WINDOW
+    SwapBuffers(m_canvasDC);
+#else
+    // Earlier versions of this code used the GPU to flip the
+    // framebuffer vertically before reading it back for compositing
+    // via software. This code was quite complicated, used a lot of
+    // GPU memory, and didn't provide an obvious speedup. Since this
+    // vertical flip is only a temporary solution anyway until Chrome
+    // is fully GPU composited, it wasn't worth the complexity.
+
+    HTMLCanvasElement* canvas = context->canvas();
+    ImageBuffer* imageBuffer = canvas->buffer();
+    unsigned char* pixels = 0;
+#if PLATFORM(SKIA)
+    const SkBitmap* canvasBitmap = imageBuffer->context()->platformContext()->bitmap();
+    const SkBitmap* readbackBitmap = 0;
+    ASSERT(canvasBitmap->config() == SkBitmap::kARGB_8888_Config);
+    if (canvasBitmap->width() == m_cachedWidth && canvasBitmap->height() == m_cachedHeight) {
+        // This is the fastest and most common case. We read back
+        // directly into the canvas's backing store.
+        readbackBitmap = canvasBitmap;
+        if (m_resizingBitmap) {
+            delete m_resizingBitmap;
+            m_resizingBitmap = 0;
+        }
+    } else {
+        // We need to allocate a temporary bitmap for reading back the
+        // pixel data. We will then use Skia to rescale this bitmap to
+        // the size of the canvas's backing store.
+        if (m_resizingBitmap && (m_resizingBitmap->width() != m_cachedWidth || m_resizingBitmap->height() != m_cachedHeight)) {
+            delete m_resizingBitmap;
+            m_resizingBitmap = 0;
+        }
+        if (!m_resizingBitmap) {
+            m_resizingBitmap = new SkBitmap();
+            m_resizingBitmap->setConfig(SkBitmap::kARGB_8888_Config,
+                                        m_cachedWidth,
+                                        m_cachedHeight);
+            if (!m_resizingBitmap->allocPixels()) {
+                delete m_resizingBitmap;
+                m_resizingBitmap = 0;
+                return;
+            }
+        }
+        readbackBitmap = m_resizingBitmap;
+    }
+
+    // Read back the frame buffer.
+    SkAutoLockPixels bitmapLock(*readbackBitmap);
+    pixels = static_cast<unsigned char*>(readbackBitmap->getPixels());
+    glReadPixels(0, 0, m_cachedWidth, m_cachedHeight, GL_BGRA, GL_UNSIGNED_BYTE, pixels);
+#elif PLATFORM(CG)
+    if (m_renderOutput) {
+        ASSERT(CGBitmapContextGetWidth(m_cgContext) == m_cachedWidth);
+        ASSERT(CGBitmapContextGetHeight(m_cgContext) == m_cachedHeight);
+        pixels = m_renderOutput;
+        glReadPixels(0, 0, m_cachedWidth, m_cachedHeight, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
+    }
+#else
+#error Must port to your platform
+#endif
+
+#ifdef FLIP_FRAMEBUFFER_VERTICALLY
+    if (pixels)
+        flipVertically(pixels, m_cachedWidth, m_cachedHeight);
+#endif
+
+#if PLATFORM(SKIA)
+    if (m_resizingBitmap) {
+        // We need to draw the resizing bitmap into the canvas's backing store.
+        SkCanvas canvas(*canvasBitmap);
+        SkRect dst;
+        dst.set(0, 0, canvasBitmap->width(), canvasBitmap->height());
+        canvas.drawBitmapRect(*m_resizingBitmap, 0, dst);
+    }
+#elif PLATFORM(CG)
+    if (m_renderOutput) {
+        CGImageRef cgImage = CGBitmapContextCreateImage(m_cgContext);
+        // CSS styling may cause the canvas's content to be resized on
+        // the page. Go back to the Canvas to figure out the correct
+        // width and height to draw.
+        CGRect rect = CGRectMake(0, 0,
+                                 context->canvas()->width(),
+                                 context->canvas()->height());
+        // We want to completely overwrite the previous frame's
+        // rendering results.
+        CGContextSetBlendMode(imageBuffer->context()->platformContext(),
+                              kCGBlendModeCopy);
+        CGContextDrawImage(imageBuffer->context()->platformContext(),
+                           rect, cgImage);
+        CGImageRelease(cgImage);
+    }
+#else
+#error Must port to your platform
+#endif
+
+#endif  // RENDER_TO_DEBUGGING_WINDOW
+}
+
+void GraphicsContext3DInternal::activeTexture(unsigned long texture)
+{
+    // FIXME: query number of textures available.
+    if (texture < GL_TEXTURE0 || texture > GL_TEXTURE0+32)
+        // FIXME: raise exception.
+        return;
+
+    makeContextCurrent();
+    glActiveTexture(texture);
+}
+
+void GraphicsContext3DInternal::bindBuffer(unsigned long target,
+                                           WebGLBuffer* buffer)
+{
+    makeContextCurrent();
+    GLuint bufID = EXTRACT(buffer);
+    if (target == GL_ARRAY_BUFFER)
+        m_boundArrayBuffer = bufID;
+    glBindBuffer(target, bufID);
+}
+
+// If we didn't have to hack GL_TEXTURE_WRAP_R for cube maps,
+// we could just use:
+// GL_SAME_METHOD_2_X2(BindTexture, bindTexture, unsigned long, WebGLTexture*)
+void GraphicsContext3DInternal::bindTexture(unsigned long target,
+                                            WebGLTexture* texture)
+{
+    makeContextCurrent();
+    unsigned int textureObject = EXTRACT(texture);
+
+    glBindTexture(target, textureObject);
+
+    // FIXME: GL_TEXTURE_WRAP_R isn't exposed in the OpenGL ES 2.0
+    // API. On desktop OpenGL implementations it seems necessary to
+    // set this wrap mode to GL_CLAMP_TO_EDGE to get correct behavior
+    // of cube maps.
+    if (texture) {
+        if (target == GL_TEXTURE_CUBE_MAP) {
+            if (!texture->isCubeMapRWrapModeInitialized()) {
+                glTexParameteri(GL_TEXTURE_CUBE_MAP, GL_TEXTURE_WRAP_R, GL_CLAMP_TO_EDGE);
+                texture->setCubeMapRWrapModeInitialized(true);
+            }
+        } else
+            texture->setCubeMapRWrapModeInitialized(false);
+    }
+}
+
+void GraphicsContext3DInternal::bufferDataImpl(unsigned long target, int size, const void* data, unsigned long usage)
+{
+    makeContextCurrent();
+    // FIXME: make this verification more efficient.
+    GLint binding = 0;
+    GLenum binding_target = GL_ARRAY_BUFFER_BINDING;
+    if (target == GL_ELEMENT_ARRAY_BUFFER)
+        binding_target = GL_ELEMENT_ARRAY_BUFFER_BINDING;
+    glGetIntegerv(binding_target, &binding);
+    if (binding <= 0) {
+        // FIXME: raise exception.
+        // LogMessagef(("bufferData: no buffer bound"));
+        return;
+    }
+
+    glBufferData(target,
+                   size,
+                   data,
+                   usage);
+}
+
+void GraphicsContext3DInternal::disableVertexAttribArray(unsigned long index)
+{
+    makeContextCurrent();
+    if (index < NumTrackedPointerStates)
+        m_vertexAttribPointerState[index].enabled = false;
+    glDisableVertexAttribArray(index);
+}
+
+void GraphicsContext3DInternal::enableVertexAttribArray(unsigned long index)
+{
+    makeContextCurrent();
+    if (index < NumTrackedPointerStates)
+        m_vertexAttribPointerState[index].enabled = true;
+    glEnableVertexAttribArray(index);
+}
+
+unsigned long GraphicsContext3DInternal::getError()
+{
+    if (m_syntheticErrors.size() > 0) {
+        ListHashSet<unsigned long>::iterator iter = m_syntheticErrors.begin();
+        unsigned long err = *iter;
+        m_syntheticErrors.remove(iter);
+        return err;
+    }
+
+    makeContextCurrent();
+    return glGetError();
+}
+
+void GraphicsContext3DInternal::vertexAttribPointer(unsigned long indx, int size, int type, bool normalized,
+                                                    unsigned long stride, unsigned long offset)
+{
+    makeContextCurrent();
+
+    if (m_boundArrayBuffer <= 0) {
+        // FIXME: raise exception.
+        // LogMessagef(("bufferData: no buffer bound"));
+        return;
+    }
+
+    if (indx < NumTrackedPointerStates) {
+        VertexAttribPointerState& state = m_vertexAttribPointerState[indx];
+        state.buffer = m_boundArrayBuffer;
+        state.indx = indx;
+        state.size = size;
+        state.type = type;
+        state.normalized = normalized;
+        state.stride = stride;
+        state.offset = offset;
+    }
+
+    glVertexAttribPointer(indx, size, type, normalized, stride,
+                          reinterpret_cast<void*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3DInternal::viewportImpl(long x, long y, unsigned long width, unsigned long height)
+{
+    glViewport(x, y, width, height);
+}
+
+void GraphicsContext3DInternal::synthesizeGLError(unsigned long error)
+{
+    m_syntheticErrors.add(error);
+}
+
+// GraphicsContext3D -----------------------------------------------------
+
+/* Helper macros for when we're just wrapping a gl method, so that
+ * we can avoid having to type this 500 times.  Note that these MUST
+ * NOT BE USED if we need to check any of the parameters.
+ */
+
+#define GL_SAME_METHOD_0(glname, name)                                         \
+void GraphicsContext3D::name()                                                 \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname();                                                              \
+}
+
+#define GL_SAME_METHOD_1(glname, name, t1)                                     \
+void GraphicsContext3D::name(t1 a1)                                            \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1);                                                            \
+}
+
+#define GL_SAME_METHOD_1_X(glname, name, t1)                                   \
+void GraphicsContext3D::name(t1 a1)                                            \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(EXTRACT(a1));                                                   \
+}
+
+#define GL_SAME_METHOD_2(glname, name, t1, t2)                                 \
+void GraphicsContext3D::name(t1 a1, t2 a2)                                     \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, a2);                                                        \
+}
+
+#define GL_SAME_METHOD_2_X12(glname, name, t1, t2)                             \
+void GraphicsContext3D::name(t1 a1, t2 a2)                                     \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(EXTRACT(a1), EXTRACT(a2));                                      \
+}
+
+#define GL_SAME_METHOD_2_X2(glname, name, t1, t2)                              \
+void GraphicsContext3D::name(t1 a1, t2 a2)                                     \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, EXTRACT(a2));                                               \
+}
+
+#define GL_SAME_METHOD_3(glname, name, t1, t2, t3)                             \
+void GraphicsContext3D::name(t1 a1, t2 a2, t3 a3)                              \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, a2, a3);                                                    \
+}
+
+#define GL_SAME_METHOD_3_X12(glname, name, t1, t2, t3)                         \
+void GraphicsContext3D::name(t1 a1, t2 a2, t3 a3)                              \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(EXTRACT(a1), EXTRACT(a2), a3);                                  \
+}
+
+#define GL_SAME_METHOD_3_X2(glname, name, t1, t2, t3)                          \
+void GraphicsContext3D::name(t1 a1, t2 a2, t3 a3)                              \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, EXTRACT(a2), a3);                                           \
+}
+
+#define GL_SAME_METHOD_4(glname, name, t1, t2, t3, t4)                         \
+void GraphicsContext3D::name(t1 a1, t2 a2, t3 a3, t4 a4)                       \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, a2, a3, a4);                                                \
+}
+
+#define GL_SAME_METHOD_4_X4(glname, name, t1, t2, t3, t4)                      \
+void GraphicsContext3D::name(t1 a1, t2 a2, t3 a3, t4 a4)                       \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, a2, a3, EXTRACT(a4));                                       \
+}
+
+#define GL_SAME_METHOD_5(glname, name, t1, t2, t3, t4, t5)                     \
+void GraphicsContext3D::name(t1 a1, t2 a2, t3 a3, t4 a4, t5 a5)                \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, a2, a3, a4, a5);                                            \
+}
+
+#define GL_SAME_METHOD_5_X4(glname, name, t1, t2, t3, t4, t5)                  \
+void GraphicsContext3D::name(t1 a1, t2 a2, t3 a3, t4 a4, t5 a5)                \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, a2, a3, EXTRACT(a4), a5);                                   \
+}
+
+#define GL_SAME_METHOD_6(glname, name, t1, t2, t3, t4, t5, t6)                 \
+void GraphicsContext3D::name(t1 a1, t2 a2, t3 a3, t4 a4, t5 a5, t6 a6)         \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, a2, a3, a4, a5, a6);                                        \
+}
+
+#define GL_SAME_METHOD_8(glname, name, t1, t2, t3, t4, t5, t6, t7, t8)         \
+void GraphicsContext3D::name(t1 a1, t2 a2, t3 a3, t4 a4, t5 a5, t6 a6, t7 a7, t8 a8)   \
+{                                                                              \
+    makeContextCurrent();                                                      \
+    gl##glname(a1, a2, a3, a4, a5, a6, a7, a8);                                \
+}
+
+PassOwnPtr<GraphicsContext3D> GraphicsContext3D::create()
+{
+    PassOwnPtr<GraphicsContext3D> context = new GraphicsContext3D();
+    // FIXME: add error checking
+    return context;
+}
+
+GraphicsContext3D::GraphicsContext3D()
+    : m_currentWidth(0)
+    , m_currentHeight(0)
+    , m_internal(new GraphicsContext3DInternal())
+{
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+}
+
+PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D() const
+{
+    return m_internal->platformGraphicsContext3D();
+}
+
+Platform3DObject GraphicsContext3D::platformTexture() const
+{
+    return m_internal->platformTexture();
+}
+
+void GraphicsContext3D::makeContextCurrent()
+{
+    m_internal->makeContextCurrent();
+}
+
+void GraphicsContext3D::reshape(int width, int height)
+{
+    if (width == m_currentWidth && height == m_currentHeight)
+        return;
+
+    m_currentWidth = width;
+    m_currentHeight = height;
+
+    m_internal->reshape(width, height);
+}
+
+void GraphicsContext3D::beginPaint(WebGLRenderingContext* context)
+{
+    m_internal->beginPaint(context);
+}
+
+void GraphicsContext3D::endPaint()
+{
+}
+
+int GraphicsContext3D::sizeInBytes(int type)
+{
+    switch (type) {
+    case GL_BYTE:
+        return sizeof(GLbyte);
+    case GL_UNSIGNED_BYTE:
+        return sizeof(GLubyte);
+    case GL_SHORT:
+        return sizeof(GLshort);
+    case GL_UNSIGNED_SHORT:
+        return sizeof(GLushort);
+    case GL_INT:
+        return sizeof(GLint);
+    case GL_UNSIGNED_INT:
+        return sizeof(GLuint);
+    case GL_FLOAT:
+        return sizeof(GLfloat);
+    default: // FIXME: default cases are discouraged in WebKit.
+        return 0;
+    }
+}
+
+unsigned GraphicsContext3D::createBuffer()
+{
+    makeContextCurrent();
+    GLuint o;
+    glGenBuffers(1, &o);
+    return o;
+}
+
+unsigned GraphicsContext3D::createFramebuffer()
+{
+    makeContextCurrent();
+    GLuint o = 0;
+    glGenFramebuffersEXT(1, &o);
+    return o;
+}
+
+unsigned GraphicsContext3D::createProgram()
+{
+    makeContextCurrent();
+    return glCreateProgram();
+}
+
+unsigned GraphicsContext3D::createRenderbuffer()
+{
+    makeContextCurrent();
+    GLuint o;
+    glGenRenderbuffersEXT(1, &o);
+    return o;
+}
+
+unsigned GraphicsContext3D::createShader(unsigned long type)
+{
+    makeContextCurrent();
+    return glCreateShader((type == FRAGMENT_SHADER) ? GL_FRAGMENT_SHADER : GL_VERTEX_SHADER);
+}
+
+unsigned GraphicsContext3D::createTexture()
+{
+    makeContextCurrent();
+    GLuint o;
+    glGenTextures(1, &o);
+    return o;
+}
+
+void GraphicsContext3D::deleteBuffer(unsigned buffer)
+{
+    makeContextCurrent();
+    glDeleteBuffers(1, &buffer);
+}
+
+void GraphicsContext3D::deleteFramebuffer(unsigned framebuffer)
+{
+    makeContextCurrent();
+    glDeleteFramebuffersEXT(1, &framebuffer);
+}
+
+void GraphicsContext3D::deleteProgram(unsigned program)
+{
+    makeContextCurrent();
+    glDeleteProgram(program);
+}
+
+void GraphicsContext3D::deleteRenderbuffer(unsigned renderbuffer)
+{
+    makeContextCurrent();
+    glDeleteRenderbuffersEXT(1, &renderbuffer);
+}
+
+void GraphicsContext3D::deleteShader(unsigned shader)
+{
+    makeContextCurrent();
+    glDeleteShader(shader);
+}
+
+void GraphicsContext3D::deleteTexture(unsigned texture)
+{
+    makeContextCurrent();
+    glDeleteTextures(1, &texture);
+}
+
+void GraphicsContext3D::activeTexture(unsigned long texture)
+{
+    m_internal->activeTexture(texture);
+}
+
+GL_SAME_METHOD_2_X12(AttachShader, attachShader, WebGLProgram*, WebGLShader*)
+
+void GraphicsContext3D::bindAttribLocation(WebGLProgram* program,
+                                           unsigned long index,
+                                           const String& name)
+{
+    if (!program)
+        return;
+    makeContextCurrent();
+    glBindAttribLocation(EXTRACT(program), index, name.utf8().data());
+}
+
+void GraphicsContext3D::bindBuffer(unsigned long target,
+                                   WebGLBuffer* buffer)
+{
+    m_internal->bindBuffer(target, buffer);
+}
+
+GL_SAME_METHOD_2_X2(BindFramebufferEXT, bindFramebuffer, unsigned long, WebGLFramebuffer*)
+
+GL_SAME_METHOD_2_X2(BindRenderbufferEXT, bindRenderbuffer, unsigned long, WebGLRenderbuffer*)
+
+// If we didn't have to hack GL_TEXTURE_WRAP_R for cube maps,
+// we could just use:
+// GL_SAME_METHOD_2_X2(BindTexture, bindTexture, unsigned long, WebGLTexture*)
+void GraphicsContext3D::bindTexture(unsigned long target,
+                                    WebGLTexture* texture)
+{
+    m_internal->bindTexture(target, texture);
+}
+
+GL_SAME_METHOD_4(BlendColor, blendColor, double, double, double, double)
+
+GL_SAME_METHOD_1(BlendEquation, blendEquation, unsigned long)
+
+GL_SAME_METHOD_2(BlendEquationSeparate, blendEquationSeparate, unsigned long, unsigned long)
+
+GL_SAME_METHOD_2(BlendFunc, blendFunc, unsigned long, unsigned long)
+
+GL_SAME_METHOD_4(BlendFuncSeparate, blendFuncSeparate, unsigned long, unsigned long, unsigned long, unsigned long)
+
+void GraphicsContext3D::bufferData(unsigned long target, int size, unsigned long usage)
+{
+    m_internal->bufferDataImpl(target, size, 0, usage);
+}
+
+void GraphicsContext3D::bufferData(unsigned long target, WebGLArray* array, unsigned long usage)
+{
+    m_internal->bufferDataImpl(target, array->byteLength(), array->baseAddress(), usage);
+}
+
+void GraphicsContext3D::bufferSubData(unsigned long target, long offset, WebGLArray* array)
+{
+    if (!array || !array->length())
+        return;
+
+    makeContextCurrent();
+    // FIXME: make this verification more efficient.
+    GLint binding = 0;
+    GLenum binding_target = GL_ARRAY_BUFFER_BINDING;
+    if (target == GL_ELEMENT_ARRAY_BUFFER)
+        binding_target = GL_ELEMENT_ARRAY_BUFFER_BINDING;
+    glGetIntegerv(binding_target, &binding);
+    if (binding <= 0) {
+        // FIXME: raise exception.
+        // LogMessagef(("bufferSubData: no buffer bound"));
+        return;
+    }
+    glBufferSubData(target, offset, array->byteLength(), array->baseAddress());
+}
+
+unsigned long GraphicsContext3D::checkFramebufferStatus(unsigned long target)
+{
+    makeContextCurrent();
+    return glCheckFramebufferStatusEXT(target);
+}
+
+GL_SAME_METHOD_1(Clear, clear, unsigned long)
+
+GL_SAME_METHOD_4(ClearColor, clearColor, double, double, double, double)
+
+GL_SAME_METHOD_1(ClearDepth, clearDepth, double)
+
+GL_SAME_METHOD_1(ClearStencil, clearStencil, long)
+
+GL_SAME_METHOD_4(ColorMask, colorMask, bool, bool, bool, bool)
+
+GL_SAME_METHOD_1_X(CompileShader, compileShader, WebGLShader*)
+
+GL_SAME_METHOD_8(CopyTexImage2D, copyTexImage2D, unsigned long, long, unsigned long, long, long, unsigned long, unsigned long, long)
+
+GL_SAME_METHOD_8(CopyTexSubImage2D, copyTexSubImage2D, unsigned long, long, long, long, long, long, unsigned long, unsigned long)
+
+GL_SAME_METHOD_1(CullFace, cullFace, unsigned long)
+
+GL_SAME_METHOD_1(DepthFunc, depthFunc, unsigned long)
+
+GL_SAME_METHOD_1(DepthMask, depthMask, bool)
+
+GL_SAME_METHOD_2(DepthRange, depthRange, double, double)
+
+void GraphicsContext3D::detachShader(WebGLProgram* program, WebGLShader* shader)
+{
+    if (!program || !shader)
+        return;
+
+    makeContextCurrent();
+    glDetachShader(EXTRACT(program), EXTRACT(shader));
+}
+
+GL_SAME_METHOD_1(Disable, disable, unsigned long)
+
+void GraphicsContext3D::disableVertexAttribArray(unsigned long index)
+{
+    m_internal->disableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::drawArrays(unsigned long mode, long first, long count)
+{
+    switch (mode) {
+    case GL_TRIANGLES:
+    case GL_TRIANGLE_STRIP:
+    case GL_TRIANGLE_FAN:
+    case GL_POINTS:
+    case GL_LINE_STRIP:
+    case GL_LINE_LOOP:
+    case GL_LINES:
+        break;
+    default: // FIXME: default cases are discouraged in WebKit.
+        // FIXME: output log message, raise exception.
+        // LogMessage(NS_LITERAL_CSTRING("drawArrays: invalid mode"));
+        // return NS_ERROR_DOM_SYNTAX_ERR;
+        return;
+    }
+
+    if (first+count < first || first+count < count) {
+        // FIXME: output log message, raise exception.
+        // LogMessage(NS_LITERAL_CSTRING("drawArrays: overflow in first+count"));
+        // return NS_ERROR_INVALID_ARG;
+        return;
+    }
+
+    // FIXME: validate against currently bound buffer.
+    // if (!ValidateBuffers(first+count))
+    //     return NS_ERROR_INVALID_ARG;
+
+    makeContextCurrent();
+    glDrawArrays(mode, first, count);
+}
+
+void GraphicsContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
+{
+    makeContextCurrent();
+    // FIXME: make this verification more efficient.
+    GLint binding = 0;
+    GLenum binding_target = GL_ELEMENT_ARRAY_BUFFER_BINDING;
+    glGetIntegerv(binding_target, &binding);
+    if (binding <= 0) {
+        // FIXME: raise exception.
+        // LogMessagef(("bufferData: no buffer bound"));
+        return;
+    }
+    glDrawElements(mode, count, type,
+                   reinterpret_cast<void*>(static_cast<intptr_t>(offset)));
+}
+
+GL_SAME_METHOD_1(Enable, enable, unsigned long)
+
+void GraphicsContext3D::enableVertexAttribArray(unsigned long index)
+{
+    m_internal->enableVertexAttribArray(index);
+}
+
+GL_SAME_METHOD_0(Finish, finish)
+
+GL_SAME_METHOD_0(Flush, flush)
+
+GL_SAME_METHOD_4_X4(FramebufferRenderbufferEXT, framebufferRenderbuffer, unsigned long, unsigned long, unsigned long, WebGLRenderbuffer*)
+
+GL_SAME_METHOD_5_X4(FramebufferTexture2DEXT, framebufferTexture2D, unsigned long, unsigned long, unsigned long, WebGLTexture*, long)
+
+GL_SAME_METHOD_1(FrontFace, frontFace, unsigned long)
+
+void GraphicsContext3D::generateMipmap(unsigned long target)
+{
+    makeContextCurrent();
+    if (glGenerateMipmapEXT)
+        glGenerateMipmapEXT(target);
+    // FIXME: provide alternative code path? This will be unpleasant
+    // to implement if glGenerateMipmapEXT is not available -- it will
+    // require a texture readback and re-upload.
+}
+
+bool GraphicsContext3D::getActiveAttrib(WebGLProgram* program, unsigned long index, ActiveInfo& info)
+{
+    if (!program) {
+        synthesizeGLError(INVALID_VALUE);
+        return false;
+    }
+    GLint maxNameLength = -1;
+    glGetProgramiv(EXTRACT(program), GL_ACTIVE_ATTRIBUTE_MAX_LENGTH, &maxNameLength);
+    if (maxNameLength < 0)
+        return false;
+    GLchar* name = 0;
+    if (!tryFastMalloc(maxNameLength * sizeof(GLchar)).getValue(name)) {
+        synthesizeGLError(OUT_OF_MEMORY);
+        return false;
+    }
+    GLsizei length = 0;
+    GLint size = -1;
+    GLenum type = 0;
+    glGetActiveAttrib(EXTRACT(program), index, maxNameLength,
+                      &length, &size, &type, name);
+    if (size < 0) {
+        fastFree(name);
+        return false;
+    }
+    info.name = String(name, length);
+    info.type = type;
+    info.size = size;
+    fastFree(name);
+    return true;
+}
+
+bool GraphicsContext3D::getActiveUniform(WebGLProgram* program, unsigned long index, ActiveInfo& info)
+{
+    if (!program) {
+        synthesizeGLError(INVALID_VALUE);
+        return false;
+    }
+    GLint maxNameLength = -1;
+    glGetProgramiv(EXTRACT(program), GL_ACTIVE_UNIFORM_MAX_LENGTH, &maxNameLength);
+    if (maxNameLength < 0)
+        return false;
+    GLchar* name = 0;
+    if (!tryFastMalloc(maxNameLength * sizeof(GLchar)).getValue(name)) {
+        synthesizeGLError(OUT_OF_MEMORY);
+        return false;
+    }
+    GLsizei length = 0;
+    GLint size = -1;
+    GLenum type = 0;
+    glGetActiveUniform(EXTRACT(program), index, maxNameLength,
+                       &length, &size, &type, name);
+    if (size < 0) {
+        fastFree(name);
+        return false;
+    }
+    info.name = String(name, length);
+    info.type = type;
+    info.size = size;
+    fastFree(name);
+    return true;
+}
+
+int GraphicsContext3D::getAttribLocation(WebGLProgram* program, const String& name)
+{
+    if (!program)
+        return -1;
+
+    makeContextCurrent();
+    return glGetAttribLocation(EXTRACT(program), name.utf8().data());
+}
+
+void GraphicsContext3D::getBooleanv(unsigned long pname, unsigned char* value)
+{
+    makeContextCurrent();
+    glGetBooleanv(pname, value);
+}
+
+void GraphicsContext3D::getBufferParameteriv(unsigned long target, unsigned long pname, int* value)
+{
+    makeContextCurrent();
+    glGetBufferParameteriv(target, pname, value);
+}
+
+unsigned long GraphicsContext3D::getError()
+{
+    return m_internal->getError();
+}
+
+void GraphicsContext3D::getFloatv(unsigned long pname, float* value)
+{
+    makeContextCurrent();
+    glGetFloatv(pname, value);
+}
+
+void GraphicsContext3D::getFramebufferAttachmentParameteriv(unsigned long target,
+                                                            unsigned long attachment,
+                                                            unsigned long pname,
+                                                            int* value)
+{
+    makeContextCurrent();
+    glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, value);
+}
+
+void GraphicsContext3D::getIntegerv(unsigned long pname, int* value)
+{
+    makeContextCurrent();
+    glGetIntegerv(pname, value);
+}
+
+void GraphicsContext3D::getProgramiv(WebGLProgram* program,
+                                     unsigned long pname,
+                                     int* value)
+{
+    makeContextCurrent();
+    glGetProgramiv(EXTRACT(program), pname, value);
+}
+
+String GraphicsContext3D::getProgramInfoLog(WebGLProgram* program)
+{
+    makeContextCurrent();
+    GLuint programID = EXTRACT(program);
+    GLint logLength;
+    glGetProgramiv(programID, GL_INFO_LOG_LENGTH, &logLength);
+    if (!logLength)
+        return String();
+    GLchar* log = 0;
+    if (!tryFastMalloc(logLength * sizeof(GLchar)).getValue(log))
+        return String();
+    GLsizei returnedLogLength;
+    glGetProgramInfoLog(programID, logLength, &returnedLogLength, log);
+    ASSERT(logLength == returnedLogLength + 1);
+    String res = String(log, returnedLogLength);
+    fastFree(log);
+    return res;
+}
+
+void GraphicsContext3D::getRenderbufferParameteriv(unsigned long target,
+                                                   unsigned long pname,
+                                                   int* value)
+{
+    makeContextCurrent();
+    glGetRenderbufferParameterivEXT(target, pname, value);
+}
+
+void GraphicsContext3D::getShaderiv(WebGLShader* shader,
+                                    unsigned long pname,
+                                    int* value)
+{
+    makeContextCurrent();
+    glGetShaderiv(EXTRACT(shader), pname, value);
+}
+
+String GraphicsContext3D::getShaderInfoLog(WebGLShader* shader)
+{
+    makeContextCurrent();
+    GLuint shaderID = EXTRACT(shader);
+    GLint logLength;
+    glGetShaderiv(shaderID, GL_INFO_LOG_LENGTH, &logLength);
+    if (!logLength)
+        return String();
+    GLchar* log = 0;
+    if (!tryFastMalloc(logLength * sizeof(GLchar)).getValue(log))
+        return String();
+    GLsizei returnedLogLength;
+    glGetShaderInfoLog(shaderID, logLength, &returnedLogLength, log);
+    ASSERT(logLength == returnedLogLength + 1);
+    String res = String(log, returnedLogLength);
+    fastFree(log);
+    return res;
+}
+
+String GraphicsContext3D::getShaderSource(WebGLShader* shader)
+{
+    makeContextCurrent();
+    GLuint shaderID = EXTRACT(shader);
+    GLint logLength;
+    glGetShaderiv(shaderID, GL_SHADER_SOURCE_LENGTH, &logLength);
+    if (!logLength)
+        return String();
+    GLchar* log = 0;
+    if (!tryFastMalloc(logLength * sizeof(GLchar)).getValue(log))
+        return String();
+    GLsizei returnedLogLength;
+    glGetShaderSource(shaderID, logLength, &returnedLogLength, log);
+    ASSERT(logLength == returnedLogLength + 1);
+    String res = String(log, returnedLogLength);
+    fastFree(log);
+    return res;
+}
+
+String GraphicsContext3D::getString(unsigned long name)
+{
+    makeContextCurrent();
+    return String(reinterpret_cast<const char*>(glGetString(name)));
+}
+
+void GraphicsContext3D::getTexParameterfv(unsigned long target, unsigned long pname, float* value)
+{
+    makeContextCurrent();
+    glGetTexParameterfv(target, pname, value);
+}
+
+void GraphicsContext3D::getTexParameteriv(unsigned long target, unsigned long pname, int* value)
+{
+    makeContextCurrent();
+    glGetTexParameteriv(target, pname, value);
+}
+
+void GraphicsContext3D::getUniformfv(WebGLProgram* program, long location, float* value)
+{
+    makeContextCurrent();
+    glGetUniformfv(EXTRACT(program), location, value);
+}
+
+void GraphicsContext3D::getUniformiv(WebGLProgram* program, long location, int* value)
+{
+    makeContextCurrent();
+    glGetUniformiv(EXTRACT(program), location, value);
+}
+
+long GraphicsContext3D::getUniformLocation(WebGLProgram* program, const String& name)
+{
+    if (!program)
+        return -1;
+
+    makeContextCurrent();
+    return glGetUniformLocation(EXTRACT(program), name.utf8().data());
+}
+
+void GraphicsContext3D::getVertexAttribfv(unsigned long index,
+                                          unsigned long pname,
+                                          float* value)
+{
+    makeContextCurrent();
+    glGetVertexAttribfv(index, pname, value);
+}
+
+void GraphicsContext3D::getVertexAttribiv(unsigned long index,
+                                          unsigned long pname,
+                                          int* value)
+{
+    makeContextCurrent();
+    glGetVertexAttribiv(index, pname, value);
+}
+
+long GraphicsContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
+{
+    // FIXME: implement.
+    notImplemented();
+    return 0;
+}
+
+GL_SAME_METHOD_2(Hint, hint, unsigned long, unsigned long);
+
+bool GraphicsContext3D::isBuffer(WebGLBuffer* buffer)
+{
+    makeContextCurrent();
+    return glIsBuffer(EXTRACT(buffer));
+}
+
+bool GraphicsContext3D::isEnabled(unsigned long cap)
+{
+    makeContextCurrent();
+    return glIsEnabled(cap);
+}
+
+bool GraphicsContext3D::isFramebuffer(WebGLFramebuffer* framebuffer)
+{
+    makeContextCurrent();
+    return glIsFramebufferEXT(EXTRACT(framebuffer));
+}
+
+bool GraphicsContext3D::isProgram(WebGLProgram* program)
+{
+    makeContextCurrent();
+    return glIsProgram(EXTRACT(program));
+}
+
+bool GraphicsContext3D::isRenderbuffer(WebGLRenderbuffer* renderbuffer)
+{
+    makeContextCurrent();
+    return glIsRenderbufferEXT(EXTRACT(renderbuffer));
+}
+
+bool GraphicsContext3D::isShader(WebGLShader* shader)
+{
+    makeContextCurrent();
+    return glIsShader(EXTRACT(shader));
+}
+
+bool GraphicsContext3D::isTexture(WebGLTexture* texture)
+{
+    makeContextCurrent();
+    return glIsTexture(EXTRACT(texture));
+}
+
+GL_SAME_METHOD_1(LineWidth, lineWidth, double)
+
+GL_SAME_METHOD_1_X(LinkProgram, linkProgram, WebGLProgram*)
+
+void GraphicsContext3D::pixelStorei(unsigned long pname, long param)
+{
+    if (pname != GL_PACK_ALIGNMENT && pname != GL_UNPACK_ALIGNMENT) {
+        // FIXME: Create a fake GL error and throw an exception.
+        return;
+    }
+
+    makeContextCurrent();
+    glPixelStorei(pname, param);
+}
+
+GL_SAME_METHOD_2(PolygonOffset, polygonOffset, double, double)
+
+PassRefPtr<WebGLArray> GraphicsContext3D::readPixels(long x, long y,
+                                                      unsigned long width, unsigned long height,
+                                                      unsigned long format, unsigned long type) {
+    // FIXME: support more pixel formats and types.
+    if (!((format == GL_RGBA) && (type == GL_UNSIGNED_BYTE)))
+        return 0;
+
+    // FIXME: take into account pack alignment.
+    RefPtr<WebGLUnsignedByteArray> array = WebGLUnsignedByteArray::create(width * height * 4);
+    glReadPixels(x, y, width, height, format, type, array->baseAddress());
+    return array;
+}
+
+void GraphicsContext3D::releaseShaderCompiler()
+{
+}
+
+GL_SAME_METHOD_4(RenderbufferStorageEXT, renderbufferStorage, unsigned long, unsigned long, unsigned long, unsigned long)
+
+GL_SAME_METHOD_2(SampleCoverage, sampleCoverage, double, bool)
+
+GL_SAME_METHOD_4(Scissor, scissor, long, long, unsigned long, unsigned long)
+
+void GraphicsContext3D::shaderSource(WebGLShader* shader, const String& source)
+{
+    makeContextCurrent();
+    CString str = source.utf8();
+    const char* data = str.data();
+    GLint length = str.length();
+    glShaderSource(EXTRACT(shader), 1, &data, &length);
+}
+
+GL_SAME_METHOD_3(StencilFunc, stencilFunc, unsigned long, long, unsigned long)
+
+GL_SAME_METHOD_4(StencilFuncSeparate, stencilFuncSeparate, unsigned long, unsigned long, long, unsigned long)
+
+GL_SAME_METHOD_1(StencilMask, stencilMask, unsigned long)
+
+GL_SAME_METHOD_2(StencilMaskSeparate, stencilMaskSeparate, unsigned long, unsigned long)
+
+GL_SAME_METHOD_3(StencilOp, stencilOp, unsigned long, unsigned long, unsigned long)
+
+GL_SAME_METHOD_4(StencilOpSeparate, stencilOpSeparate, unsigned long, unsigned long, unsigned long, unsigned long)
+
+void GraphicsContext3D::synthesizeGLError(unsigned long error)
+{
+    m_internal->synthesizeGLError(error);
+}
+
+int GraphicsContext3D::texImage2D(unsigned target,
+                                  unsigned level,
+                                  unsigned internalformat,
+                                  unsigned width,
+                                  unsigned height,
+                                  unsigned border,
+                                  unsigned format,
+                                  unsigned type,
+                                  WebGLArray* pixels)
+{
+    // FIXME: must do validation similar to JOGL's to ensure that
+    // the incoming array is of the appropriate length.
+    glTexImage2D(target,
+                 level,
+                 internalformat,
+                 width,
+                 height,
+                 border,
+                 format,
+                 type,
+                 pixels->baseAddress());
+    return 0;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target,
+                                  unsigned level,
+                                  unsigned internalformat,
+                                  unsigned width,
+                                  unsigned height,
+                                  unsigned border,
+                                  unsigned format,
+                                  unsigned type,
+                                  ImageData* pixels)
+{
+    // FIXME: implement.
+    notImplemented();
+    return -1;
+}
+
+// Remove premultiplied alpha from color channels.
+// FIXME: this is lossy. Must retrieve original values from HTMLImageElement.
+static void unmultiplyAlpha(unsigned char* rgbaData, int numPixels)
+{
+    for (int j = 0; j < numPixels; j++) {
+        float b = rgbaData[4*j+0] / 255.0f;
+        float g = rgbaData[4*j+1] / 255.0f;
+        float r = rgbaData[4*j+2] / 255.0f;
+        float a = rgbaData[4*j+3] / 255.0f;
+        if (a > 0.0f) {
+            b /= a;
+            g /= a;
+            r /= a;
+            b = (b > 1.0f) ? 1.0f : b;
+            g = (g > 1.0f) ? 1.0f : g;
+            r = (r > 1.0f) ? 1.0f : r;
+            rgbaData[4*j+0] = (unsigned char) (b * 255.0f);
+            rgbaData[4*j+1] = (unsigned char) (g * 255.0f);
+            rgbaData[4*j+2] = (unsigned char) (r * 255.0f);
+        }
+    }
+}
+
+// FIXME: this must be changed to refer to the original image data
+// rather than unmultiplying the alpha channel.
+static int texImage2DHelper(unsigned target, unsigned level,
+                            int width, int height,
+                            int rowBytes,
+                            bool flipY,
+                            bool premultiplyAlpha,
+                            GLenum format,
+                            bool skipAlpha,
+                            unsigned char* pixels)
+{
+    ASSERT(format == GL_RGBA || format == GL_BGRA);
+    GLint internalFormat = GL_RGBA8;
+    if (skipAlpha) {
+        internalFormat = GL_RGB8;
+        // Ignore the alpha channel
+        premultiplyAlpha = true;
+    }
+    if (flipY) {
+        // Need to flip images vertically. To avoid making a copy of
+        // the entire image, we perform a ton of glTexSubImage2D
+        // calls. FIXME: should rethink this strategy for efficiency.
+        glTexImage2D(target, level, internalFormat,
+                     width,
+                     height,
+                     0,
+                     format,
+                     GL_UNSIGNED_BYTE,
+                     0);
+        unsigned char* row = 0;
+        bool allocatedRow = false;
+        if (!premultiplyAlpha) {
+            row = new unsigned char[rowBytes];
+            allocatedRow = true;
+        }
+        for (int i = 0; i < height; i++) {
+            if (premultiplyAlpha)
+                row = pixels + (rowBytes * i);
+            else {
+                memcpy(row, pixels + (rowBytes * i), rowBytes);
+                unmultiplyAlpha(row, width);
+            }
+            glTexSubImage2D(target, level, 0, height - i - 1,
+                            width, 1,
+                            format,
+                            GL_UNSIGNED_BYTE,
+                            row);
+        }
+        if (allocatedRow)
+            delete[] row;
+    } else {
+        // The pixels of cube maps' faces are defined with a top-down
+        // scanline ordering, unlike GL_TEXTURE_2D, so when uploading
+        // these, the above vertical flip is the wrong thing to do.
+        if (premultiplyAlpha)
+            glTexImage2D(target, level, internalFormat,
+                         width,
+                         height,
+                         0,
+                         format,
+                         GL_UNSIGNED_BYTE,
+                         pixels);
+        else {
+            glTexImage2D(target, level, internalFormat,
+                         width,
+                         height,
+                         0,
+                         format,
+                         GL_UNSIGNED_BYTE,
+                         0);
+            unsigned char* row = new unsigned char[rowBytes];
+            for (int i = 0; i < height; i++) {
+                memcpy(row, pixels + (rowBytes * i), rowBytes);
+                unmultiplyAlpha(row, width);
+                glTexSubImage2D(target, level, 0, i,
+                                width, 1,
+                                format,
+                                GL_UNSIGNED_BYTE,
+                                row);
+            }
+            delete[] row;
+        }
+    }
+    return 0;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, Image* image,
+                                  bool flipY, bool premultiplyAlpha)
+{
+    ASSERT(image);
+
+    int res = -1;
+#if PLATFORM(SKIA)
+    NativeImageSkia* skiaImage = image->nativeImageForCurrentFrame();
+    if (!skiaImage) {
+        ASSERT_NOT_REACHED();
+        return -1;
+    }
+    SkBitmap::Config skiaConfig = skiaImage->config();
+    // FIXME: must support more image configurations.
+    if (skiaConfig != SkBitmap::kARGB_8888_Config) {
+        ASSERT_NOT_REACHED();
+        return -1;
+    }
+    SkBitmap& skiaImageRef = *skiaImage;
+    SkAutoLockPixels lock(skiaImageRef);
+    int width = skiaImage->width();
+    int height = skiaImage->height();
+    unsigned char* pixels =
+        reinterpret_cast<unsigned char*>(skiaImage->getPixels());
+    int rowBytes = skiaImage->rowBytes();
+    res = texImage2DHelper(target, level,
+                           width, height,
+                           rowBytes,
+                           flipY, premultiplyAlpha,
+                           GL_BGRA,
+                           false,
+                           pixels);
+#elif PLATFORM(CG)
+    CGImageRef cgImage = image->nativeImageForCurrentFrame();
+    if (!cgImage) {
+        ASSERT_NOT_REACHED();
+        return -1;
+    }
+    int width = CGImageGetWidth(cgImage);
+    int height = CGImageGetHeight(cgImage);
+    int rowBytes = width * 4;
+    CGImageAlphaInfo info = CGImageGetAlphaInfo(cgImage);
+    bool skipAlpha = (info == kCGImageAlphaNone
+                   || info == kCGImageAlphaNoneSkipLast
+                   || info == kCGImageAlphaNoneSkipFirst);
+    unsigned char* imageData = new unsigned char[height * rowBytes];
+    CGColorSpaceRef colorSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGB);
+    CGContextRef tmpContext = CGBitmapContextCreate(imageData, width, height, 8, rowBytes,
+                                                    colorSpace,
+                                                    kCGImageAlphaPremultipliedLast);
+    CGColorSpaceRelease(colorSpace);
+    CGContextDrawImage(tmpContext,
+                       CGRectMake(0, 0, static_cast<CGFloat>(width), static_cast<CGFloat>(height)),
+                       cgImage);
+    CGContextRelease(tmpContext);
+    res = texImage2DHelper(target, level, width, height, rowBytes,
+                           flipY, premultiplyAlpha, GL_RGBA, skipAlpha, imageData);
+    delete[] imageData;
+#else
+#error Must port to your platform
+#endif
+    return res;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                                  bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: implement.
+    notImplemented();
+    return -1;
+}
+
+GL_SAME_METHOD_3(TexParameterf, texParameterf, unsigned, unsigned, float);
+
+GL_SAME_METHOD_3(TexParameteri, texParameteri, unsigned, unsigned, int);
+
+int GraphicsContext3D::texSubImage2D(unsigned target,
+                                     unsigned level,
+                                     unsigned xoffset,
+                                     unsigned yoffset,
+                                     unsigned width,
+                                     unsigned height,
+                                     unsigned format,
+                                     unsigned type,
+                                     WebGLArray* pixels)
+{
+    // FIXME: implement.
+    notImplemented();
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target,
+                                     unsigned level,
+                                     unsigned xoffset,
+                                     unsigned yoffset,
+                                     unsigned width,
+                                     unsigned height,
+                                     unsigned format,
+                                     unsigned type,
+                                     ImageData* pixels)
+{
+    // FIXME: implement.
+    notImplemented();
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target,
+                                     unsigned level,
+                                     unsigned xoffset,
+                                     unsigned yoffset,
+                                     unsigned width,
+                                     unsigned height,
+                                     Image* image,
+                                     bool flipY,
+                                     bool premultiplyAlpha)
+{
+    // FIXME: implement.
+    notImplemented();
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target,
+                                     unsigned level,
+                                     unsigned xoffset,
+                                     unsigned yoffset,
+                                     unsigned width,
+                                     unsigned height,
+                                     HTMLVideoElement* video,
+                                     bool flipY,
+                                     bool premultiplyAlpha)
+{
+    // FIXME: implement.
+    notImplemented();
+    return -1;
+}
+
+GL_SAME_METHOD_2(Uniform1f, uniform1f, long, float)
+
+void GraphicsContext3D::uniform1fv(long location, float* v, int size)
+{
+    makeContextCurrent();
+    glUniform1fv(location, size, v);
+}
+
+GL_SAME_METHOD_2(Uniform1i, uniform1i, long, int)
+
+void GraphicsContext3D::uniform1iv(long location, int* v, int size)
+{
+    makeContextCurrent();
+    glUniform1iv(location, size, v);
+}
+
+GL_SAME_METHOD_3(Uniform2f, uniform2f, long, float, float)
+
+void GraphicsContext3D::uniform2fv(long location, float* v, int size)
+{
+    makeContextCurrent();
+    glUniform2fv(location, size, v);
+}
+
+GL_SAME_METHOD_3(Uniform2i, uniform2i, long, int, int)
+
+void GraphicsContext3D::uniform2iv(long location, int* v, int size)
+{
+    makeContextCurrent();
+    glUniform2iv(location, size, v);
+}
+
+GL_SAME_METHOD_4(Uniform3f, uniform3f, long, float, float, float)
+
+void GraphicsContext3D::uniform3fv(long location, float* v, int size)
+{
+    makeContextCurrent();
+    glUniform3fv(location, size, v);
+}
+
+GL_SAME_METHOD_4(Uniform3i, uniform3i, long, int, int, int)
+
+void GraphicsContext3D::uniform3iv(long location, int* v, int size)
+{
+    makeContextCurrent();
+    glUniform3iv(location, size, v);
+}
+
+GL_SAME_METHOD_5(Uniform4f, uniform4f, long, float, float, float, float)
+
+void GraphicsContext3D::uniform4fv(long location, float* v, int size)
+{
+    makeContextCurrent();
+    glUniform4fv(location, size, v);
+}
+
+GL_SAME_METHOD_5(Uniform4i, uniform4i, long, int, int, int, int)
+
+void GraphicsContext3D::uniform4iv(long location, int* v, int size)
+{
+    makeContextCurrent();
+    glUniform4iv(location, size, v);
+}
+
+void GraphicsContext3D::uniformMatrix2fv(long location, bool transpose, float* value, int size)
+{
+    makeContextCurrent();
+    glUniformMatrix2fv(location, size, transpose, value);
+}
+
+void GraphicsContext3D::uniformMatrix3fv(long location, bool transpose, float* value, int size)
+{
+    makeContextCurrent();
+    glUniformMatrix3fv(location, size, transpose, value);
+}
+
+void GraphicsContext3D::uniformMatrix4fv(long location, bool transpose, float* value, int size)
+{
+    makeContextCurrent();
+    glUniformMatrix4fv(location, size, transpose, value);
+}
+
+GL_SAME_METHOD_1_X(UseProgram, useProgram, WebGLProgram*)
+
+GL_SAME_METHOD_1_X(ValidateProgram, validateProgram, WebGLProgram*)
+
+GL_SAME_METHOD_2(VertexAttrib1f, vertexAttrib1f, unsigned long, float)
+
+void GraphicsContext3D::vertexAttrib1fv(unsigned long indx, float* values)
+{
+    makeContextCurrent();
+    glVertexAttrib1fv(indx, values);
+}
+
+GL_SAME_METHOD_3(VertexAttrib2f, vertexAttrib2f, unsigned long, float, float)
+
+void GraphicsContext3D::vertexAttrib2fv(unsigned long indx, float* values)
+{
+    makeContextCurrent();
+    glVertexAttrib2fv(indx, values);
+}
+
+GL_SAME_METHOD_4(VertexAttrib3f, vertexAttrib3f, unsigned long, float, float, float)
+
+void GraphicsContext3D::vertexAttrib3fv(unsigned long indx, float* values)
+{
+    makeContextCurrent();
+    glVertexAttrib3fv(indx, values);
+}
+
+GL_SAME_METHOD_5(VertexAttrib4f, vertexAttrib4f, unsigned long, float, float, float, float)
+
+void GraphicsContext3D::vertexAttrib4fv(unsigned long indx, float* values)
+{
+    makeContextCurrent();
+    glVertexAttrib4fv(indx, values);
+}
+
+void GraphicsContext3D::vertexAttribPointer(unsigned long indx, int size, int type, bool normalized,
+                                            unsigned long stride, unsigned long offset)
+{
+    m_internal->vertexAttribPointer(indx, size, type, normalized, stride, offset);
+}
+
+void GraphicsContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    makeContextCurrent();
+    m_internal->viewportImpl(x, y, width, height);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebKit/chromium/src/InspectorClientImpl.cpp b/WebKit/chromium/src/InspectorClientImpl.cpp
new file mode 100644
index 0000000..54550d1
--- /dev/null
+++ b/WebKit/chromium/src/InspectorClientImpl.cpp
@@ -0,0 +1,218 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorClientImpl.h"
+
+#include "DOMWindow.h"
+#include "FloatRect.h"
+#include "InspectorController.h"
+#include "NotImplemented.h"
+#include "Page.h"
+#include "Settings.h"
+#include "WebRect.h"
+#include "WebURL.h"
+#include "WebURLRequest.h"
+#include "WebViewClient.h"
+#include "WebViewImpl.h"
+#include <wtf/Vector.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+InspectorClientImpl::InspectorClientImpl(WebViewImpl* webView)
+    : m_inspectedWebView(webView)
+{
+    ASSERT(m_inspectedWebView);
+}
+
+InspectorClientImpl::~InspectorClientImpl()
+{
+}
+
+void InspectorClientImpl::inspectorDestroyed()
+{
+    // Our lifetime is bound to the WebViewImpl.
+}
+
+Page* InspectorClientImpl::createPage()
+{
+    // This method should never be called in Chrome as inspector front-end lives
+    // in a separate process.
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void InspectorClientImpl::showWindow()
+{
+    ASSERT(m_inspectedWebView->devToolsAgentPrivate());
+    m_inspectedWebView->page()->inspectorController()->setWindowVisible(true);
+}
+
+void InspectorClientImpl::closeWindow()
+{
+    if (m_inspectedWebView->page())
+        m_inspectedWebView->page()->inspectorController()->setWindowVisible(false);
+}
+
+bool InspectorClientImpl::windowVisible()
+{
+    ASSERT(m_inspectedWebView->devToolsAgentPrivate());
+    return false;
+}
+
+void InspectorClientImpl::attachWindow()
+{
+    // FIXME: Implement this
+}
+
+void InspectorClientImpl::detachWindow()
+{
+    // FIXME: Implement this
+}
+
+void InspectorClientImpl::setAttachedWindowHeight(unsigned int height)
+{
+    // FIXME: Implement this
+    notImplemented();
+}
+
+static void invalidateNodeBoundingRect(WebViewImpl* webView)
+{
+    // FIXME: Is it important to just invalidate the rect of the node region
+    // given that this is not on a critical codepath?  In order to do so, we'd
+    // have to take scrolling into account.
+    const WebSize& size = webView->size();
+    WebRect damagedRect(0, 0, size.width, size.height);
+    if (webView->client())
+        webView->client()->didInvalidateRect(damagedRect);
+}
+
+void InspectorClientImpl::highlight(Node* node)
+{
+    // InspectorController does the actually tracking of the highlighted node
+    // and the drawing of the highlight. Here we just make sure to invalidate
+    // the rects of the old and new nodes.
+    hideHighlight();
+}
+
+void InspectorClientImpl::hideHighlight()
+{
+    // FIXME: able to invalidate a smaller rect.
+    invalidateNodeBoundingRect(m_inspectedWebView);
+}
+
+void InspectorClientImpl::inspectedURLChanged(const String& newURL)
+{
+    // FIXME: Implement this
+}
+
+String InspectorClientImpl::localizedStringsURL()
+{
+    notImplemented();
+    return String();
+}
+
+String InspectorClientImpl::hiddenPanels()
+{
+    notImplemented();
+    return "";
+}
+
+void InspectorClientImpl::populateSetting(const String& key, String* value)
+{
+    loadSettings();
+    if (m_settings->contains(key))
+        *value = m_settings->get(key);
+}
+
+void InspectorClientImpl::storeSetting(const String& key, const String& value)
+{
+    loadSettings();
+    m_settings->set(key, value);
+    saveSettings();
+}
+
+void InspectorClientImpl::inspectorWindowObjectCleared()
+{
+    notImplemented();
+}
+
+void InspectorClientImpl::loadSettings()
+{
+    if (m_settings)
+        return;
+
+    m_settings.set(new SettingsMap);
+    String data = m_inspectedWebView->inspectorSettings();
+    if (data.isEmpty())
+        return;
+
+    Vector<String> entries;
+    data.split("\n", entries);
+    for (Vector<String>::iterator it = entries.begin(); it != entries.end(); ++it) {
+        Vector<String> tokens;
+        it->split(":", tokens);
+        if (tokens.size() < 3)
+            continue;
+
+        String name = decodeURLEscapeSequences(tokens[0]);
+        String type = tokens[1];
+        String value = tokens[2];
+        for (size_t i = 3; i < tokens.size(); ++i)
+            value += ":" + tokens[i];
+
+        if (type == "string")
+            value = decodeURLEscapeSequences(value);
+
+        m_settings->set(name, value);
+    }
+}
+
+void InspectorClientImpl::saveSettings()
+{
+    String data;
+    for (SettingsMap::iterator it = m_settings->begin(); it != m_settings->end(); ++it) {
+        String name = encodeWithURLEscapeSequences(it->first);
+        String value = it->second;
+        String entry = String::format(
+            "%s:string:%s",
+            name.utf8().data(),
+            encodeWithURLEscapeSequences(value).utf8().data());
+        data.append(entry);
+        data.append("\n");
+    }
+    m_inspectedWebView->setInspectorSettings(data);
+    if (m_inspectedWebView->client())
+        m_inspectedWebView->client()->didUpdateInspectorSettings();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/InspectorClientImpl.h b/WebKit/chromium/src/InspectorClientImpl.h
new file mode 100644
index 0000000..6f7f8b1
--- /dev/null
+++ b/WebKit/chromium/src/InspectorClientImpl.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorClientImpl_h
+#define InspectorClientImpl_h
+
+#include "InspectorClient.h"
+#include "InspectorController.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebKit {
+class WebViewImpl;
+
+class InspectorClientImpl : public WebCore::InspectorClient {
+public:
+    InspectorClientImpl(WebViewImpl*);
+    ~InspectorClientImpl();
+
+    // InspectorClient methods:
+    virtual void inspectorDestroyed();
+    virtual WebCore::Page* createPage();
+    virtual WebCore::String localizedStringsURL();
+    virtual WebCore::String hiddenPanels();
+    virtual void showWindow();
+    virtual void closeWindow();
+    virtual bool windowVisible();
+    virtual void attachWindow();
+    virtual void detachWindow();
+    virtual void setAttachedWindowHeight(unsigned height);
+    virtual void highlight(WebCore::Node*);
+    virtual void hideHighlight();
+    virtual void inspectedURLChanged(const WebCore::String& newURL);
+    virtual void populateSetting(
+        const WebCore::String& key,
+        WebCore::String* value);
+    virtual void storeSetting(
+        const WebCore::String& key,
+        const WebCore::String& value);
+    virtual void inspectorWindowObjectCleared();
+
+private:
+    void loadSettings();
+    void saveSettings();
+
+    // The WebViewImpl of the page being inspected; gets passed to the constructor
+    WebViewImpl* m_inspectedWebView;
+
+    typedef HashMap<WebCore::String, WebCore::String> SettingsMap;
+    OwnPtr<SettingsMap> m_settings;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/LocalizedStrings.cpp b/WebKit/chromium/src/LocalizedStrings.cpp
new file mode 100644
index 0000000..1121931
--- /dev/null
+++ b/WebKit/chromium/src/LocalizedStrings.cpp
@@ -0,0 +1,307 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedStrings.h"
+
+#include "IntSize.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include "StringBuilder.h"
+
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebLocalizedString.h"
+#include "WebString.h"
+
+using WebKit::WebLocalizedString;
+
+namespace WebCore {
+
+static String query(WebLocalizedString::Name name)
+{
+    return WebKit::webKitClient()->queryLocalizedString(name);
+}
+
+static String query(WebLocalizedString::Name name, int numericValue)
+{
+    return WebKit::webKitClient()->queryLocalizedString(name, numericValue);
+}
+
+String searchableIndexIntroduction()
+{
+    return query(WebLocalizedString::SearchableIndexIntroduction);
+}
+
+String submitButtonDefaultLabel()
+{
+    return query(WebLocalizedString::SubmitButtonDefaultLabel);
+}
+
+String inputElementAltText()
+{
+    return query(WebLocalizedString::InputElementAltText);
+}
+
+String resetButtonDefaultLabel()
+{
+    return query(WebLocalizedString::ResetButtonDefaultLabel);
+}
+
+String fileButtonChooseFileLabel()
+{
+    return query(WebLocalizedString::FileButtonChooseFileLabel);
+}
+
+String fileButtonNoFileSelectedLabel()
+{
+    return query(WebLocalizedString::FileButtonNoFileSelectedLabel);
+}
+
+String searchMenuNoRecentSearchesText()
+{
+    return query(WebLocalizedString::SearchMenuNoRecentSearchesText);
+}
+String searchMenuRecentSearchesText()
+{
+    return query(WebLocalizedString::SearchMenuRecentSearchesText);
+}
+String searchMenuClearRecentSearchesText()
+{
+    return query(WebLocalizedString::SearchMenuClearRecentSearchesText);
+}
+
+String AXWebAreaText()
+{
+    return query(WebLocalizedString::AXWebAreaText);
+}
+
+String AXLinkText()
+{
+    return query(WebLocalizedString::AXLinkText);
+}
+
+String AXListMarkerText()
+{
+    return query(WebLocalizedString::AXListMarkerText);
+}
+
+String AXImageMapText()
+{
+    return query(WebLocalizedString::AXImageMapText);
+}
+
+String AXHeadingText()
+{
+    return query(WebLocalizedString::AXHeadingText);
+}
+
+String AXDefinitionListTermText()
+{
+    notImplemented();
+    return String("term");
+}
+
+String AXDefinitionListDefinitionText()
+{
+    notImplemented();
+    return String("definition");
+}
+
+String AXButtonActionVerb()
+{
+    return query(WebLocalizedString::AXButtonActionVerb);
+}
+
+String AXRadioButtonActionVerb()
+{
+    return query(WebLocalizedString::AXRadioButtonActionVerb);
+}
+
+String AXTextFieldActionVerb()
+{
+    return query(WebLocalizedString::AXTextFieldActionVerb);
+}
+
+String AXCheckedCheckBoxActionVerb()
+{
+    return query(WebLocalizedString::AXCheckedCheckBoxActionVerb);
+}
+
+String AXUncheckedCheckBoxActionVerb()
+{
+    return query(WebLocalizedString::AXUncheckedCheckBoxActionVerb);
+}
+
+String AXLinkActionVerb()
+{
+    return query(WebLocalizedString::AXLinkActionVerb);
+}
+
+String multipleFileUploadText(unsigned numberOfFiles)
+{
+    return query(WebLocalizedString::MultipleFileUploadText, numberOfFiles);
+}
+
+// Used in FTPDirectoryDocument.cpp
+String unknownFileSizeText()
+{
+    return String();
+}
+
+// The following two functions are not declared in LocalizedStrings.h.
+// They are used by the menu for the HTML keygen tag.
+String keygenMenuHighGradeKeySize()
+{
+    return query(WebLocalizedString::KeygenMenuHighGradeKeySize);
+}
+
+String keygenMenuMediumGradeKeySize()
+{
+    return query(WebLocalizedString::KeygenMenuMediumGradeKeySize);
+}
+
+// Used in ImageDocument.cpp as the title for pages when that page is an image.
+String imageTitle(const String& filename, const IntSize& size)
+{
+    // Note that we cannot use String::format because it works for ASCII only.
+    StringBuilder result;
+    result.append(filename);
+    result.append(" (");
+    result.append(String::number(size.width()));
+    result.append(static_cast<UChar>(0xD7));  // U+00D7 (multiplication sign)
+    result.append(String::number(size.height()));
+    result.append(")");
+    return result.toString();
+}
+
+// We don't use these strings, so they return an empty String. We can't just
+// make them asserts because webcore still calls them.
+String contextMenuItemTagOpenLinkInNewWindow() { return String(); }
+String contextMenuItemTagDownloadLinkToDisk() { return String(); }
+String contextMenuItemTagCopyLinkToClipboard() { return String(); }
+String contextMenuItemTagOpenImageInNewWindow() { return String(); }
+String contextMenuItemTagDownloadImageToDisk() { return String(); }
+String contextMenuItemTagCopyImageToClipboard() { return String(); }
+String contextMenuItemTagOpenFrameInNewWindow() { return String(); }
+String contextMenuItemTagCopy() { return String(); }
+String contextMenuItemTagGoBack() { return String(); }
+String contextMenuItemTagGoForward() { return String(); }
+String contextMenuItemTagStop() { return String(); }
+String contextMenuItemTagReload() { return String(); }
+String contextMenuItemTagCut() { return String(); }
+String contextMenuItemTagPaste() { return String(); }
+String contextMenuItemTagNoGuessesFound() { return String(); }
+String contextMenuItemTagIgnoreSpelling() { return String(); }
+String contextMenuItemTagLearnSpelling() { return String(); }
+String contextMenuItemTagSearchWeb() { return String(); }
+String contextMenuItemTagLookUpInDictionary() { return String(); }
+String contextMenuItemTagOpenLink() { return String(); }
+String contextMenuItemTagIgnoreGrammar() { return String(); }
+String contextMenuItemTagSpellingMenu() { return String(); }
+String contextMenuItemTagCheckSpelling() { return String(); }
+String contextMenuItemTagCheckSpellingWhileTyping() { return String(); }
+String contextMenuItemTagCheckGrammarWithSpelling() { return String(); }
+String contextMenuItemTagFontMenu() { return String(); }
+String contextMenuItemTagBold() { return String(); }
+String contextMenuItemTagItalic() { return String(); }
+String contextMenuItemTagUnderline() { return String(); }
+String contextMenuItemTagOutline() { return String(); }
+String contextMenuItemTagWritingDirectionMenu() { return String(); }
+String contextMenuItemTagTextDirectionMenu() { return String(); }
+String contextMenuItemTagDefaultDirection() { return String(); }
+String contextMenuItemTagLeftToRight() { return String(); }
+String contextMenuItemTagRightToLeft() { return String(); }
+String contextMenuItemTagInspectElement() { return String(); }
+String contextMenuItemTagShowSpellingPanel(bool show) { return String(); }
+String mediaElementLiveBroadcastStateText() { return String(); }
+String mediaElementLoadingStateText() { return String(); }
+
+String localizedMediaControlElementString(const String& /*name*/)
+{
+    // FIXME: to be fixed.
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& /*name*/)
+{
+    // FIXME: to be fixed.
+    return String();
+}
+
+String localizedMediaTimeDescription(float /*time*/)
+{
+    // FIXME: to be fixed.
+    return String();
+}
+
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+} // namespace WebCore
diff --git a/WebKit/chromium/src/MediaPlayerPrivateChromium.cpp b/WebKit/chromium/src/MediaPlayerPrivateChromium.cpp
new file mode 100644
index 0000000..09d33d4
--- /dev/null
+++ b/WebKit/chromium/src/MediaPlayerPrivateChromium.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MediaPlayerPrivateChromium.h"
+
+#if ENABLE(VIDEO)
+
+#include "WebMediaPlayerClientImpl.h"
+
+namespace WebCore {
+
+void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
+{
+    WebKit::WebMediaPlayerClientImpl::registerSelf(registrar);
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/WebKit/chromium/src/NotificationPresenterImpl.cpp b/WebKit/chromium/src/NotificationPresenterImpl.cpp
new file mode 100644
index 0000000..6b22319
--- /dev/null
+++ b/WebKit/chromium/src/NotificationPresenterImpl.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NotificationPresenterImpl.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Notification.h"
+#include "SecurityOrigin.h"
+
+#include "WebNotification.h"
+#include "WebNotificationPermissionCallback.h"
+#include "WebNotificationPresenter.h"
+
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class VoidCallbackClient : public WebNotificationPermissionCallback {
+public:
+    VoidCallbackClient(PassRefPtr<VoidCallback> callback)
+        : m_callback(callback)
+    {
+    }
+
+    virtual void permissionRequestComplete()
+    {
+        if (m_callback)
+            m_callback->handleEvent();
+        delete this;
+    }
+
+private:
+    RefPtr<VoidCallback> m_callback;
+};
+
+void NotificationPresenterImpl::initialize(WebNotificationPresenter* presenter)
+{
+    m_presenter = presenter;
+}
+
+bool NotificationPresenterImpl::isInitialized()
+{
+    return !!m_presenter;
+}
+
+bool NotificationPresenterImpl::show(Notification* notification)
+{
+    return m_presenter->show(PassRefPtr<Notification>(notification));
+}
+
+void NotificationPresenterImpl::cancel(Notification* notification)
+{
+    m_presenter->cancel(PassRefPtr<Notification>(notification));
+}
+
+void NotificationPresenterImpl::notificationObjectDestroyed(Notification* notification)
+{
+    m_presenter->objectDestroyed(PassRefPtr<Notification>(notification));
+}
+
+NotificationPresenter::Permission NotificationPresenterImpl::checkPermission(SecurityOrigin* origin)
+{
+    int result = m_presenter->checkPermission(origin->toString());
+    return static_cast<NotificationPresenter::Permission>(result);
+}
+
+void NotificationPresenterImpl::requestPermission(SecurityOrigin* origin, PassRefPtr<VoidCallback> callback)
+{
+    m_presenter->requestPermission(origin->toString(), new VoidCallbackClient(callback));
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/WebKit/chromium/src/NotificationPresenterImpl.h b/WebKit/chromium/src/NotificationPresenterImpl.h
new file mode 100644
index 0000000..4afe9dc
--- /dev/null
+++ b/WebKit/chromium/src/NotificationPresenterImpl.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationPresenterImpl_h
+#define NotificationPresenterImpl_h
+
+#include "NotificationPresenter.h"
+#include "VoidCallback.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebKit {
+
+class WebNotificationPresenter;
+
+class NotificationPresenterImpl : public WebCore::NotificationPresenter {
+public:
+    NotificationPresenterImpl() : m_presenter(0) { }
+
+    void initialize(WebNotificationPresenter* presenter);
+    bool isInitialized();
+
+    // WebCore::NotificationPresenter implementation.
+    virtual bool show(WebCore::Notification* object);
+    virtual void cancel(WebCore::Notification* object);
+    virtual void notificationObjectDestroyed(WebCore::Notification* object);
+    virtual WebCore::NotificationPresenter::Permission checkPermission(WebCore::SecurityOrigin* origin);
+    virtual void requestPermission(WebCore::SecurityOrigin* origin, WTF::PassRefPtr<WebCore::VoidCallback> callback);
+
+private:
+    // WebNotificationPresenter that this object delegates to.
+    WebNotificationPresenter* m_presenter;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif
diff --git a/WebKit/chromium/src/PlatformMessagePortChannel.cpp b/WebKit/chromium/src/PlatformMessagePortChannel.cpp
new file mode 100644
index 0000000..f8c41d3
--- /dev/null
+++ b/WebKit/chromium/src/PlatformMessagePortChannel.cpp
@@ -0,0 +1,258 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformMessagePortChannel.h"
+
+#include "MessagePort.h"
+#include "ScriptExecutionContext.h"
+#include "SerializedScriptValue.h"
+
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebMessagePortChannel.h"
+#include "WebString.h"
+
+using namespace WebKit;
+
+namespace WebCore {
+
+PassOwnPtr<MessagePortChannel> MessagePortChannel::create(PassRefPtr<PlatformMessagePortChannel> channel)
+{
+    return new MessagePortChannel(channel);
+}
+
+void MessagePortChannel::createChannel(PassRefPtr<MessagePort> port1, PassRefPtr<MessagePort> port2)
+{
+    PlatformMessagePortChannel::createChannel(port1, port2);
+}
+
+MessagePortChannel::MessagePortChannel(PassRefPtr<PlatformMessagePortChannel> channel)
+    : m_channel(channel)
+{
+}
+
+MessagePortChannel::~MessagePortChannel()
+{
+    // Make sure we close our platform channel when the base is freed, to keep the channel objects from leaking.
+    m_channel->close();
+}
+
+bool MessagePortChannel::entangleIfOpen(MessagePort* port)
+{
+    return m_channel->entangleIfOpen(port);
+}
+
+void MessagePortChannel::disentangle()
+{
+    m_channel->disentangle();
+}
+
+void MessagePortChannel::postMessageToRemote(PassOwnPtr<MessagePortChannel::EventData> message)
+{
+    m_channel->postMessageToRemote(message);
+}
+
+bool MessagePortChannel::tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>& result)
+{
+    return m_channel->tryGetMessageFromRemote(result);
+}
+
+void MessagePortChannel::close()
+{
+    m_channel->close();
+}
+
+bool MessagePortChannel::isConnectedTo(MessagePort* port)
+{
+    return m_channel->isConnectedTo(port);
+}
+
+bool MessagePortChannel::hasPendingActivity()
+{
+    return m_channel->hasPendingActivity();
+}
+
+MessagePort* MessagePortChannel::locallyEntangledPort(const ScriptExecutionContext* context)
+{
+    // This is just an optimization, so return 0 always.
+    return 0;
+}
+
+
+PassRefPtr<PlatformMessagePortChannel> PlatformMessagePortChannel::create()
+{
+    return adoptRef(new PlatformMessagePortChannel());
+}
+
+PassRefPtr<PlatformMessagePortChannel> PlatformMessagePortChannel::create(
+    WebMessagePortChannel* channel)
+{
+    return adoptRef(new PlatformMessagePortChannel(channel));
+}
+
+
+PlatformMessagePortChannel::PlatformMessagePortChannel()
+    : m_localPort(0)
+{
+    m_webChannel = webKitClient()->createMessagePortChannel();
+    if (m_webChannel)
+        m_webChannel->setClient(this);
+}
+
+PlatformMessagePortChannel::PlatformMessagePortChannel(WebMessagePortChannel* channel)
+    : m_localPort(0)
+    , m_webChannel(channel)
+{
+}
+
+PlatformMessagePortChannel::~PlatformMessagePortChannel()
+{
+    if (m_webChannel)
+        m_webChannel->destroy();
+}
+
+void PlatformMessagePortChannel::createChannel(PassRefPtr<MessagePort> port1, PassRefPtr<MessagePort> port2)
+{
+    // Create proxies for each endpoint.
+    RefPtr<PlatformMessagePortChannel> channel1 = PlatformMessagePortChannel::create();
+    RefPtr<PlatformMessagePortChannel> channel2 = PlatformMessagePortChannel::create();
+
+    // Entangle the two endpoints.
+    channel1->setEntangledChannel(channel2);
+    channel2->setEntangledChannel(channel1);
+
+    // Now entangle the proxies with the appropriate local ports.
+    port1->entangle(MessagePortChannel::create(channel2));
+    port2->entangle(MessagePortChannel::create(channel1));
+}
+
+void PlatformMessagePortChannel::messageAvailable()
+{
+    MutexLocker lock(m_mutex);
+    if (m_localPort)
+        m_localPort->messageAvailable();
+}
+
+bool PlatformMessagePortChannel::entangleIfOpen(MessagePort* port)
+{
+    MutexLocker lock(m_mutex);
+    m_localPort = port;
+    return true;
+}
+
+void PlatformMessagePortChannel::disentangle()
+{
+    MutexLocker lock(m_mutex);
+    m_localPort = 0;
+}
+
+void PlatformMessagePortChannel::postMessageToRemote(PassOwnPtr<MessagePortChannel::EventData> message)
+{
+    if (!m_localPort || !m_webChannel)
+        return;
+
+    WebString messageString = message->message()->toString();
+    OwnPtr<WebCore::MessagePortChannelArray> channels = message->channels();
+    WebMessagePortChannelArray* webChannels = 0;
+    if (channels.get() && channels->size()) {
+        webChannels = new WebMessagePortChannelArray(channels->size());
+        for (size_t i = 0; i < channels->size(); ++i) {
+            WebCore::PlatformMessagePortChannel* platformChannel = (*channels)[i]->channel();
+            (*webChannels)[i] = platformChannel->webChannelRelease();
+            (*webChannels)[i]->setClient(0);
+        }
+    }
+    m_webChannel->postMessage(messageString, webChannels);
+}
+
+bool PlatformMessagePortChannel::tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>& result)
+{
+    if (!m_webChannel)
+        return false;
+
+    WebString message;
+    WebMessagePortChannelArray webChannels;
+    bool rv = m_webChannel->tryGetMessage(&message, webChannels);
+    if (rv) {
+        OwnPtr<MessagePortChannelArray> channels;
+        if (webChannels.size()) {
+            channels = new MessagePortChannelArray(webChannels.size());
+            for (size_t i = 0; i < webChannels.size(); ++i) {
+                RefPtr<PlatformMessagePortChannel> platformChannel = create(webChannels[i]);
+                webChannels[i]->setClient(platformChannel.get());
+                (*channels)[i] = MessagePortChannel::create(platformChannel);
+            }
+        }
+        RefPtr<SerializedScriptValue> serializedMessage = SerializedScriptValue::create(message);
+        result = MessagePortChannel::EventData::create(serializedMessage.release(), channels.release());
+    }
+
+    return rv;
+}
+
+void PlatformMessagePortChannel::close()
+{
+    MutexLocker lock(m_mutex);
+    // Disentangle ourselves from the other end.  We still maintain a reference to m_webChannel,
+    // since previously-existing messages should still be delivered.
+    m_localPort = 0;
+    m_entangledChannel = 0;
+}
+
+bool PlatformMessagePortChannel::isConnectedTo(MessagePort* port)
+{
+    MutexLocker lock(m_mutex);
+    return m_entangledChannel && m_entangledChannel->m_localPort == port;
+}
+
+bool PlatformMessagePortChannel::hasPendingActivity()
+{
+    MutexLocker lock(m_mutex);
+    return m_localPort;
+}
+
+void PlatformMessagePortChannel::setEntangledChannel(PassRefPtr<PlatformMessagePortChannel> remote)
+{
+    if (m_webChannel)
+        m_webChannel->entangle(remote->m_webChannel);
+
+    MutexLocker lock(m_mutex);
+    m_entangledChannel = remote;
+}
+
+WebMessagePortChannel* PlatformMessagePortChannel::webChannelRelease()
+{
+    WebMessagePortChannel* rv = m_webChannel;
+    m_webChannel = 0;
+    return rv;
+}
+
+} // namespace WebCore
diff --git a/WebKit/chromium/src/PlatformMessagePortChannel.h b/WebKit/chromium/src/PlatformMessagePortChannel.h
new file mode 100644
index 0000000..05e8397
--- /dev/null
+++ b/WebKit/chromium/src/PlatformMessagePortChannel.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformMessagePortChannel_h
+#define PlatformMessagePortChannel_h
+
+// FIXME: This relative path is a temporary hack to support using this
+// header from webkit/glue.
+#include "../public/WebMessagePortChannelClient.h"
+
+#include "MessagePortChannel.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebKit {
+class WebMessagePortChannel;
+}
+
+namespace WebCore {
+
+class MessagePort;
+
+// PlatformMessagePortChannel is a platform-dependent interface to the remote side of a message channel.
+class PlatformMessagePortChannel : public ThreadSafeShared<PlatformMessagePortChannel>,
+                                   public WebKit::WebMessagePortChannelClient {
+public:
+    static void createChannel(PassRefPtr<MessagePort>, PassRefPtr<MessagePort>);
+    static PassRefPtr<PlatformMessagePortChannel> create();
+    static PassRefPtr<PlatformMessagePortChannel> create(WebKit::WebMessagePortChannel*);
+
+    // APIs delegated from MessagePortChannel.h
+    bool entangleIfOpen(MessagePort*);
+    void disentangle();
+    void postMessageToRemote(PassOwnPtr<MessagePortChannel::EventData>);
+    bool tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>&);
+    void close();
+    bool isConnectedTo(MessagePort* port);
+    bool hasPendingActivity();
+
+    // Releases ownership of the contained web channel.
+    WebKit::WebMessagePortChannel* webChannelRelease();
+
+    ~PlatformMessagePortChannel();
+
+private:
+    PlatformMessagePortChannel();
+    PlatformMessagePortChannel(WebKit::WebMessagePortChannel*);
+
+    void setEntangledChannel(PassRefPtr<PlatformMessagePortChannel>);
+
+    // WebKit::WebMessagePortChannelClient implementation
+    virtual void messageAvailable();
+
+    // Mutex used to ensure exclusive access to the object internals.
+    Mutex m_mutex;
+
+    // Pointer to our entangled pair - cleared when close() is called.
+    RefPtr<PlatformMessagePortChannel> m_entangledChannel;
+
+    // The port we are connected to - this is the port that is notified when new messages arrive.
+    MessagePort* m_localPort;
+
+    WebKit::WebMessagePortChannel* m_webChannel;
+};
+
+} // namespace WebCore
+
+#endif // PlatformMessagePortChannel_h
diff --git a/WebKit/chromium/src/ResourceHandle.cpp b/WebKit/chromium/src/ResourceHandle.cpp
new file mode 100644
index 0000000..bf6910f
--- /dev/null
+++ b/WebKit/chromium/src/ResourceHandle.cpp
@@ -0,0 +1,282 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ResourceHandle.h"
+
+#include "ResourceHandleClient.h"
+#include "ResourceRequest.h"
+
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebURLError.h"
+#include "WebURLLoader.h"
+#include "WebURLLoaderClient.h"
+#include "WebURLRequest.h"
+#include "WebURLResponse.h"
+#include "WrappedResourceRequest.h"
+#include "WrappedResourceResponse.h"
+
+using namespace WebKit;
+
+namespace WebCore {
+
+// ResourceHandleInternal -----------------------------------------------------
+
+class ResourceHandleInternal : public WebURLLoaderClient {
+public:
+    ResourceHandleInternal(const ResourceRequest& request, ResourceHandleClient* client)
+        : m_request(request)
+        , m_owner(0)
+        , m_client(client)
+    {
+    }
+
+    void start();
+    void cancel();
+    void setDefersLoading(bool);
+    bool allowStoredCredentials() const;
+
+    // WebURLLoaderClient methods:
+    virtual void willSendRequest(WebURLLoader*, WebURLRequest&, const WebURLResponse&);
+    virtual void didSendData(
+        WebURLLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
+    virtual void didReceiveResponse(WebURLLoader*, const WebURLResponse&);
+    virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength);
+    virtual void didFinishLoading(WebURLLoader*);
+    virtual void didFail(WebURLLoader*, const WebURLError&);
+
+    ResourceRequest m_request;
+    ResourceHandle* m_owner;
+    ResourceHandleClient* m_client;
+    OwnPtr<WebURLLoader> m_loader;
+};
+
+void ResourceHandleInternal::start()
+{
+    m_loader.set(webKitClient()->createURLLoader());
+    ASSERT(m_loader.get());
+
+    WrappedResourceRequest wrappedRequest(m_request);
+    wrappedRequest.setAllowStoredCredentials(allowStoredCredentials());
+    m_loader->loadAsynchronously(wrappedRequest, this);
+}
+
+void ResourceHandleInternal::cancel()
+{
+    m_loader->cancel();
+
+    // Do not make any further calls to the client.
+    m_client = 0;
+}
+
+void ResourceHandleInternal::setDefersLoading(bool value)
+{
+    m_loader->setDefersLoading(value);
+}
+
+bool ResourceHandleInternal::allowStoredCredentials() const
+{
+    return m_client && m_client->shouldUseCredentialStorage(m_owner);
+}
+
+void ResourceHandleInternal::willSendRequest(
+    WebURLLoader*, WebURLRequest& request, const WebURLResponse& response)
+{
+    ASSERT(m_client);
+    ASSERT(!request.isNull());
+    ASSERT(!response.isNull());
+    m_client->willSendRequest(m_owner, request.toMutableResourceRequest(), response.toResourceResponse());
+}
+
+void ResourceHandleInternal::didSendData(
+    WebURLLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+{
+    ASSERT(m_client);
+    m_client->didSendData(m_owner, bytesSent, totalBytesToBeSent);
+}
+
+void ResourceHandleInternal::didReceiveResponse(WebURLLoader*, const WebURLResponse& response)
+{
+    ASSERT(m_client);
+    ASSERT(!response.isNull());
+    m_client->didReceiveResponse(m_owner, response.toResourceResponse());
+}
+
+void ResourceHandleInternal::didReceiveData(
+    WebURLLoader*, const char* data, int dataLength)
+{
+    ASSERT(m_client);
+
+    // FIXME(yurys): it looks like lengthReceived is always the same as
+    // dataLength and that the latter parameter can be eliminated.
+    // See WebKit bug: https://bugs.webkit.org/show_bug.cgi?id=31019
+    m_client->didReceiveData(m_owner, data, dataLength, dataLength);
+}
+
+void ResourceHandleInternal::didFinishLoading(WebURLLoader*)
+{
+    ASSERT(m_client);
+    m_client->didFinishLoading(m_owner);
+}
+
+void ResourceHandleInternal::didFail(WebURLLoader*, const WebURLError& error)
+{
+    ASSERT(m_client);
+    m_client->didFail(m_owner, error);
+}
+
+// ResourceHandle -------------------------------------------------------------
+
+ResourceHandle::ResourceHandle(const ResourceRequest& request,
+                               ResourceHandleClient* client,
+                               bool defersLoading,
+                               bool shouldContentSniff,
+                               bool mightDownloadFromHandle)
+    : d(new ResourceHandleInternal(request, client))
+{
+    d->m_owner = this;
+
+    // FIXME: Figure out what to do with the bool params.
+}
+
+PassRefPtr<ResourceHandle> ResourceHandle::create(const ResourceRequest& request,
+                                                  ResourceHandleClient* client,
+                                                  Frame* deprecated,
+                                                  bool defersLoading,
+                                                  bool shouldContentSniff,
+                                                  bool mightDownloadFromHandle)
+{
+    RefPtr<ResourceHandle> newHandle = adoptRef(new ResourceHandle(
+        request, client, defersLoading, shouldContentSniff, mightDownloadFromHandle));
+
+    if (newHandle->start(deprecated))
+        return newHandle.release();
+
+    return 0;
+}
+
+const ResourceRequest& ResourceHandle::request() const
+{
+    return d->m_request;
+}
+
+ResourceHandleClient* ResourceHandle::client() const
+{
+    return d->m_client;
+}
+
+void ResourceHandle::setClient(ResourceHandleClient* client)
+{
+    d->m_client = client;
+}
+
+void ResourceHandle::setDefersLoading(bool value)
+{
+    d->setDefersLoading(value);
+}
+
+bool ResourceHandle::start(Frame* deprecated)
+{
+    d->start();
+    return true;
+}
+
+void ResourceHandle::clearAuthentication()
+{
+}
+
+void ResourceHandle::cancel()
+{
+    d->cancel();
+}
+
+ResourceHandle::~ResourceHandle()
+{
+    d->m_owner = 0;
+}
+
+PassRefPtr<SharedBuffer> ResourceHandle::bufferedData()
+{
+    return 0;
+}
+
+bool ResourceHandle::loadsBlocked()
+{
+    return false;  // This seems to be related to sync XMLHttpRequest...
+}
+
+// static
+bool ResourceHandle::supportsBufferedData()
+{
+    return false;  // The loader will buffer manually if it needs to.
+}
+
+// static
+void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request,
+                                               StoredCredentials storedCredentials,
+                                               ResourceError& error,
+                                               ResourceResponse& response,
+                                               Vector<char>& data,
+                                               Frame* deprecated)
+{
+    OwnPtr<WebURLLoader> loader(webKitClient()->createURLLoader());
+    ASSERT(loader.get());
+
+    WrappedResourceRequest requestIn(request);
+    requestIn.setAllowStoredCredentials(storedCredentials == AllowStoredCredentials);
+    WrappedResourceResponse responseOut(response);
+    WebURLError errorOut;
+    WebData dataOut;
+
+    loader->loadSynchronously(requestIn, responseOut, errorOut, dataOut);
+
+    error = errorOut;
+    data.clear();
+    data.append(dataOut.data(), dataOut.size());
+}
+
+// static
+bool ResourceHandle::willLoadFromCache(ResourceRequest& request, Frame*)
+{
+    // This method is used to determine if a POST request can be repeated from
+    // cache, but you cannot really know until you actually try to read from the
+    // cache.  Even if we checked now, something else could come along and wipe
+    // out the cache entry by the time we fetch it.
+    //
+    // So, we always say yes here, to prevent the FrameLoader from initiating a
+    // reload.  Then in FrameLoaderClientImpl::dispatchWillSendRequest, we
+    // fix-up the cache policy of the request to force a load from the cache.
+    //
+    ASSERT(request.httpMethod() == "POST");
+    return true;
+}
+
+} // namespace WebCore
diff --git a/WebKit/chromium/src/SharedWorkerRepository.cpp b/WebKit/chromium/src/SharedWorkerRepository.cpp
new file mode 100644
index 0000000..5e5bc46
--- /dev/null
+++ b/WebKit/chromium/src/SharedWorkerRepository.cpp
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "SharedWorkerRepository.h"
+
+#include "Event.h"
+#include "EventNames.h"
+#include "MessagePortChannel.h"
+#include "PlatformMessagePortChannel.h"
+#include "ScriptExecutionContext.h"
+#include "SharedWorker.h"
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebMessagePortChannel.h"
+#include "WebSharedWorker.h"
+#include "WebSharedWorkerRepository.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WorkerScriptLoader.h"
+#include "WorkerScriptLoaderClient.h"
+
+namespace WebCore {
+
+class Document;
+using WebKit::WebFrameImpl;
+using WebKit::WebMessagePortChannel;
+using WebKit::WebSharedWorker;
+using WebKit::WebSharedWorkerRepository;
+
+// Callback class that keeps the SharedWorker and WebSharedWorker objects alive while loads are potentially happening, and also translates load errors into error events on the worker.
+class SharedWorkerScriptLoader : private WorkerScriptLoaderClient, private WebSharedWorker::ConnectListener, private ActiveDOMObject {
+public:
+    SharedWorkerScriptLoader(PassRefPtr<SharedWorker> worker, const KURL& url, const String& name, PassOwnPtr<MessagePortChannel> port, PassOwnPtr<WebSharedWorker> webWorker)
+        : ActiveDOMObject(worker->scriptExecutionContext(), this)
+        , m_worker(worker)
+        , m_url(url)
+        , m_name(name)
+        , m_webWorker(webWorker)
+        , m_port(port)
+    {
+    }
+
+    void load();
+    virtual void contextDestroyed();
+private:
+    // WorkerScriptLoaderClient callback
+    virtual void notifyFinished();
+
+    virtual void connected();
+
+    void sendConnect();
+
+    RefPtr<SharedWorker> m_worker;
+    KURL m_url;
+    String m_name;
+    OwnPtr<WebSharedWorker> m_webWorker;
+    OwnPtr<MessagePortChannel> m_port;
+    WorkerScriptLoader m_scriptLoader;
+};
+
+void SharedWorkerScriptLoader::load()
+{
+    // If the shared worker is not yet running, load the script resource for it, otherwise just send it a connect event.
+    if (m_webWorker->isStarted())
+        sendConnect();
+    else
+        m_scriptLoader.loadAsynchronously(m_worker->scriptExecutionContext(), m_url, DenyCrossOriginRequests, this);
+}
+
+// Extracts a WebMessagePortChannel from a MessagePortChannel.
+static WebMessagePortChannel* getWebPort(PassOwnPtr<MessagePortChannel> port)
+{
+    // Extract the WebMessagePortChannel to send to the worker.
+    PlatformMessagePortChannel* platformChannel = port->channel();
+    WebMessagePortChannel* webPort = platformChannel->webChannelRelease();
+    webPort->setClient(0);
+    return webPort;
+}
+
+void SharedWorkerScriptLoader::notifyFinished()
+{
+    if (m_scriptLoader.failed()) {
+        m_worker->dispatchEvent(Event::create(eventNames().errorEvent, false, true));
+        delete this;
+    } else {
+        // Pass the script off to the worker, then send a connect event.
+        m_webWorker->startWorkerContext(m_url, m_name, m_worker->scriptExecutionContext()->userAgent(m_url), m_scriptLoader.script());
+        sendConnect();
+    }
+}
+
+void SharedWorkerScriptLoader::sendConnect()
+{
+    // Send the connect event off, and linger until it is done sending.
+    m_webWorker->connect(getWebPort(m_port.release()), this);
+}
+
+void SharedWorkerScriptLoader::contextDestroyed()
+{
+    ActiveDOMObject::contextDestroyed();
+    delete this;
+}
+
+void SharedWorkerScriptLoader::connected()
+{
+    // Connect event has been sent, so free ourselves (this releases the SharedWorker so it can be freed as well if unreferenced).
+    delete this;
+}
+
+bool SharedWorkerRepository::isAvailable()
+{
+    // Allow the WebKitClient to determine if SharedWorkers are available.
+    return WebKit::webKitClient()->sharedWorkerRepository();
+}
+
+static WebSharedWorkerRepository::DocumentID getId(void* document)
+{
+    ASSERT(document);
+    return reinterpret_cast<WebSharedWorkerRepository::DocumentID>(document);
+}
+
+void SharedWorkerRepository::connect(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, const KURL& url, const String& name, ExceptionCode& ec)
+{
+    // This should not be callable unless there's a SharedWorkerRepository for
+    // this context (since isAvailable() should have returned null).
+    ASSERT(WebKit::webKitClient()->sharedWorkerRepository());
+
+    // No nested workers (for now) - connect() should only be called from document context.
+    ASSERT(worker->scriptExecutionContext()->isDocument());
+    Document* document = static_cast<Document*>(worker->scriptExecutionContext());
+    WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
+    OwnPtr<WebSharedWorker> webWorker;
+    webWorker = webFrame->client()->createSharedWorker(webFrame, url, name, getId(document));
+
+    if (!webWorker) {
+        // Existing worker does not match this url, so return an error back to the caller.
+        ec = URL_MISMATCH_ERR;
+        return;
+    }
+
+    WebKit::webKitClient()->sharedWorkerRepository()->addSharedWorker(
+        webWorker.get(), getId(document));
+
+    // The loader object manages its own lifecycle (and the lifecycles of the two worker objects).
+    // It will free itself once loading is completed.
+    SharedWorkerScriptLoader* loader = new SharedWorkerScriptLoader(worker, url, name, port.release(), webWorker.release());
+    loader->load();
+}
+
+void SharedWorkerRepository::documentDetached(Document* document)
+{
+    WebSharedWorkerRepository* repo = WebKit::webKitClient()->sharedWorkerRepository();
+    if (repo)
+        repo->documentDetached(getId(document));
+}
+
+bool SharedWorkerRepository::hasSharedWorkers(Document* document)
+{
+    WebSharedWorkerRepository* repo = WebKit::webKitClient()->sharedWorkerRepository();
+    return repo && repo->hasSharedWorkers(getId(document));
+}
+
+
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/WebKit/chromium/src/SocketStreamHandle.cpp b/WebKit/chromium/src/SocketStreamHandle.cpp
new file mode 100644
index 0000000..9f19942
--- /dev/null
+++ b/WebKit/chromium/src/SocketStreamHandle.cpp
@@ -0,0 +1,236 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+#include "WebData.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebSocketStreamHandle.h"
+#include "WebSocketStreamHandleClient.h"
+#include "WebURL.h"
+#include <wtf/PassOwnPtr.h>
+
+using namespace WebKit;
+
+namespace WebCore {
+
+class SocketStreamHandleInternal : public WebSocketStreamHandleClient {
+public:
+    static PassOwnPtr<SocketStreamHandleInternal> create(SocketStreamHandle* handle)
+    {
+        return new SocketStreamHandleInternal(handle);
+    }
+    virtual ~SocketStreamHandleInternal();
+
+    void connect(const KURL&);
+    int send(const char*, int);
+    void close();
+
+    virtual void didOpenStream(WebSocketStreamHandle*, int);
+    virtual void didSendData(WebSocketStreamHandle*, int);
+    virtual void didReceiveData(WebSocketStreamHandle*, const WebData&);
+    virtual void didClose(WebSocketStreamHandle*);
+    virtual void didFail(WebSocketStreamHandle*, const WebSocketStreamError&);
+
+private:
+    explicit SocketStreamHandleInternal(SocketStreamHandle*);
+
+    SocketStreamHandle* m_handle;
+    OwnPtr<WebSocketStreamHandle> m_socket;
+    int m_maxPendingSendAllowed;
+    int m_pendingAmountSent;
+};
+
+SocketStreamHandleInternal::SocketStreamHandleInternal(SocketStreamHandle* handle)
+    : m_handle(handle)
+    , m_maxPendingSendAllowed(0)
+    , m_pendingAmountSent(0)
+{
+}
+
+SocketStreamHandleInternal::~SocketStreamHandleInternal()
+{
+    m_handle = 0;
+}
+
+void SocketStreamHandleInternal::connect(const KURL& url)
+{
+    m_socket.set(webKitClient()->createSocketStreamHandle());
+    LOG(Network, "connect");
+    ASSERT(m_socket.get());
+    m_socket->connect(url, this);
+}
+
+int SocketStreamHandleInternal::send(const char* data, int len)
+{
+    LOG(Network, "send len=%d", len);
+    ASSERT(m_socket.get());
+    if (m_pendingAmountSent + len >= m_maxPendingSendAllowed)
+        len = m_maxPendingSendAllowed - m_pendingAmountSent - 1;
+
+    if (len <= 0)
+        return len;
+    WebData webdata(data, len);
+    if (m_socket->send(webdata)) {
+        m_pendingAmountSent += len;
+        LOG(Network, "sent");
+        return len;
+    }
+    LOG(Network, "busy. buffering");
+    return 0;
+}
+
+void SocketStreamHandleInternal::close()
+{
+    LOG(Network, "close");
+    m_socket->close();
+}
+    
+void SocketStreamHandleInternal::didOpenStream(WebSocketStreamHandle* socketHandle, int maxPendingSendAllowed)
+{
+    LOG(Network, "SocketStreamHandleInternal::didOpen %d",
+        maxPendingSendAllowed);
+    ASSERT(maxPendingSendAllowed > 0);
+    if (m_handle && m_socket.get()) {
+        ASSERT(socketHandle == m_socket.get());
+        m_maxPendingSendAllowed = maxPendingSendAllowed;
+        m_handle->m_state = SocketStreamHandleBase::Open;
+        if (m_handle->m_client) {
+            m_handle->m_client->didOpen(m_handle);
+            return;
+        }
+    }
+    LOG(Network, "no m_handle or m_socket?");
+}
+
+void SocketStreamHandleInternal::didSendData(WebSocketStreamHandle* socketHandle, int amountSent)
+{
+    LOG(Network, "SocketStreamHandleInternal::didSendData %d", amountSent);
+    ASSERT(amountSent > 0);
+    if (m_handle && m_socket.get()) {
+        ASSERT(socketHandle == m_socket.get());
+        m_pendingAmountSent -= amountSent;
+        ASSERT(m_pendingAmountSent >= 0);
+        m_handle->sendPendingData();
+    }
+}
+
+void SocketStreamHandleInternal::didReceiveData(WebSocketStreamHandle* socketHandle, const WebData& data)
+{
+    LOG(Network, "didReceiveData");
+    if (m_handle && m_socket.get()) {
+        ASSERT(socketHandle == m_socket.get());
+        if (m_handle->m_client)
+            m_handle->m_client->didReceiveData(m_handle, data.data(), data.size());
+    }
+}
+
+void SocketStreamHandleInternal::didClose(WebSocketStreamHandle* socketHandle)
+{
+    LOG(Network, "didClose");
+    if (m_handle && m_socket.get()) {
+        ASSERT(socketHandle == m_socket.get());
+        m_socket.clear();
+        SocketStreamHandle* h = m_handle;
+        m_handle = 0;
+        if (h->m_client)
+            h->m_client->didClose(h);
+    }
+}
+
+void SocketStreamHandleInternal::didFail(WebSocketStreamHandle* socketHandle, const WebSocketStreamError& err)
+{
+    LOG(Network, "didFail");
+    if (m_handle && m_socket.get()) {
+        ASSERT(socketHandle == m_socket.get());
+        m_socket.clear();
+        SocketStreamHandle* h = m_handle;
+        m_handle = 0;
+        if (h->m_client)
+            h->m_client->didClose(h);  // didFail(h, err);
+    }
+}
+
+// FIXME: auth
+
+// SocketStreamHandle ----------------------------------------------------------
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    m_internal = SocketStreamHandleInternal::create(this);
+    m_internal->connect(m_url);
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    setClient(0);
+    m_internal.clear();
+}
+
+int SocketStreamHandle::platformSend(const char* buf, int len)
+{
+    if (!m_internal.get())
+        return 0;
+    return m_internal->send(buf, len);
+}
+
+void SocketStreamHandle::platformClose()
+{
+    if (m_internal.get())
+        m_internal->close();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)
+{
+    if (m_client)
+        m_client->didReceiveAuthenticationChallenge(this, challenge);
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge& challenge, const Credential& credential)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge& challenge)
+{
+    notImplemented();
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
diff --git a/WebKit/chromium/src/StorageAreaProxy.cpp b/WebKit/chromium/src/StorageAreaProxy.cpp
new file mode 100644
index 0000000..551507f
--- /dev/null
+++ b/WebKit/chromium/src/StorageAreaProxy.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageAreaProxy.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "SecurityOrigin.h"
+#include "StorageAreaImpl.h"
+
+#include "WebStorageArea.h"
+#include "WebString.h"
+#include "WebURL.h"
+
+namespace WebCore {
+
+StorageAreaProxy::StorageAreaProxy(WebKit::WebStorageArea* storageArea)
+    : m_storageArea(storageArea)
+{
+}
+
+StorageAreaProxy::~StorageAreaProxy()
+{
+}
+
+unsigned StorageAreaProxy::length() const
+{
+    return m_storageArea->length();
+}
+
+String StorageAreaProxy::key(unsigned index) const
+{
+    return m_storageArea->key(index);
+}
+
+String StorageAreaProxy::getItem(const String& key) const
+{
+    return m_storageArea->getItem(key);
+}
+
+void StorageAreaProxy::setItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
+{
+    bool quotaException = false;
+    m_storageArea->setItem(key, value, frame->document()->url(), quotaException);
+    ec = quotaException ? QUOTA_EXCEEDED_ERR : 0;
+}
+
+void StorageAreaProxy::removeItem(const String& key, Frame* frame)
+{
+    m_storageArea->removeItem(key, frame->document()->url());
+}
+
+void StorageAreaProxy::clear(Frame* frame)
+{
+    m_storageArea->clear(frame->document()->url());
+}
+
+bool StorageAreaProxy::contains(const String& key) const
+{
+    return !getItem(key).isNull();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebKit/chromium/src/StorageAreaProxy.h b/WebKit/chromium/src/StorageAreaProxy.h
new file mode 100644
index 0000000..5d09d82
--- /dev/null
+++ b/WebKit/chromium/src/StorageAreaProxy.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageAreaProxy_h
+#define StorageAreaProxy_h
+
+#if ENABLE(DOM_STORAGE)
+
+#include "StorageArea.h"
+
+namespace WebKit { class WebStorageArea; }
+
+namespace WebCore {
+
+class StorageAreaProxy : public StorageArea {
+public:
+    StorageAreaProxy(WebKit::WebStorageArea* storageArea);
+    virtual ~StorageAreaProxy();
+
+    // The HTML5 DOM Storage API
+    virtual unsigned length() const;
+    virtual String key(unsigned index) const;
+    virtual String getItem(const String& key) const;
+    virtual void setItem(const String& key, const String& value, ExceptionCode& ec, Frame* sourceFrame);
+    virtual void removeItem(const String& key, Frame* sourceFrame);
+    virtual void clear(Frame* sourceFrame);
+    virtual bool contains(const String& key) const;
+
+private:
+    OwnPtr<WebKit::WebStorageArea> m_storageArea;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // StorageAreaProxy_h
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.h b/WebKit/chromium/src/StorageEventDispatcherChromium.cpp
index df52379..3286929 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/WebKit/chromium/src/StorageEventDispatcherChromium.cpp
@@ -28,31 +28,29 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptObjectQuarantine_h
-#define ScriptObjectQuarantine_h
+#include "config.h"
+#include "StorageEventDispatcher.h"
 
-#include "ScriptState.h"
-
-namespace WebCore {
+#if ENABLE(DOM_STORAGE)
 
-    class Database;
-    class DOMWindow;
-    class Node;
-    class ScriptObject;
-    class ScriptValue;
-    class Storage;
+#include "SecurityOrigin.h"
+#include "StorageArea.h"
 
-    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebString.h"
+#include "WebURL.h"
 
-#if ENABLE(DATABASE)
-    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
-#endif
-#if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
-#endif
-    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+namespace WebCore {
 
+void StorageEventDispatcher::dispatch(const String& key, const String& oldValue,
+                                      const String& newValue, StorageType storageType,
+                                      SecurityOrigin* origin, Frame* sourceFrame)
+{
+    ASSERT(!sourceFrame);  // Sad, but true.
+    WebKit::webKitClient()->dispatchStorageEvent(key, oldValue, newValue, origin->toString(), WebKit::WebURL(), storageType == LocalStorage);
 }
 
-#endif // ScriptObjectQuarantine_h
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebKit/chromium/src/StorageEventDispatcherImpl.cpp b/WebKit/chromium/src/StorageEventDispatcherImpl.cpp
new file mode 100644
index 0000000..3518796
--- /dev/null
+++ b/WebKit/chromium/src/StorageEventDispatcherImpl.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageEventDispatcherImpl.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "DOMWindow.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "KURL.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "SecurityOrigin.h"
+#include "StorageEvent.h"
+
+namespace WebCore {
+
+StorageEventDispatcherImpl::StorageEventDispatcherImpl(const String& groupName)
+    : m_pageGroup(PageGroup::pageGroup(groupName))
+{
+    ASSERT(m_pageGroup);
+}
+
+void StorageEventDispatcherImpl::dispatchStorageEvent(const String& key, const String& oldValue,
+                                                      const String& newValue, SecurityOrigin* securityOrigin,
+                                                      const KURL& url, StorageType storageType)
+{
+    // FIXME: Implement
+    if (storageType == SessionStorage)
+        return;
+
+    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
+    // of any given page in the group or mutate the page group itself.
+    Vector<RefPtr<Frame> > frames;
+
+    const HashSet<Page*>& pages = m_pageGroup->pages();
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->document()->securityOrigin()->equal(securityOrigin))
+                frames.append(frame);
+        }
+    }
+
+    // FIXME: Figure out how to pass in the document URI.
+    for (unsigned i = 0; i < frames.size(); ++i) {
+        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue,
+                                                                        url, frames[i]->domWindow()->localStorage()));
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebKit/chromium/src/StorageEventDispatcherImpl.h b/WebKit/chromium/src/StorageEventDispatcherImpl.h
new file mode 100644
index 0000000..4c2db7c
--- /dev/null
+++ b/WebKit/chromium/src/StorageEventDispatcherImpl.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageEventDispatcherImpl_h
+#define StorageEventDispatcherImpl_h
+
+#if ENABLE(DOM_STORAGE)
+
+#include "PlatformString.h"
+#include "StorageArea.h"
+
+namespace WebCore {
+
+class KURL;
+class PageGroup;
+class SecurityOrigin;
+
+class StorageEventDispatcherImpl {
+public:
+    StorageEventDispatcherImpl(const String& groupName);
+
+    void dispatchStorageEvent(const String& key, const String& oldValue,
+                              const String& newValue, SecurityOrigin*,
+                              const KURL&, StorageType);
+
+private:
+    PageGroup* m_pageGroup;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // StorageEventDispatcherImpl_h
diff --git a/WebKit/chromium/src/StorageNamespaceProxy.cpp b/WebKit/chromium/src/StorageNamespaceProxy.cpp
new file mode 100644
index 0000000..e22bbef
--- /dev/null
+++ b/WebKit/chromium/src/StorageNamespaceProxy.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageNamespaceProxy.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "SecurityOrigin.h"
+#include "StorageAreaProxy.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebStorageNamespace.h"
+#include "WebString.h"
+
+namespace WebCore {
+
+PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path, unsigned quota)
+{
+    return new StorageNamespaceProxy(WebKit::webKitClient()->createLocalStorageNamespace(path, quota));
+}
+
+PassRefPtr<StorageNamespace> StorageNamespace::sessionStorageNamespace()
+{
+    return new StorageNamespaceProxy(WebKit::webKitClient()->createSessionStorageNamespace());
+}
+
+StorageNamespaceProxy::StorageNamespaceProxy(WebKit::WebStorageNamespace* storageNamespace)
+    : m_storageNamespace(storageNamespace)
+{
+}
+
+StorageNamespaceProxy::~StorageNamespaceProxy()
+{
+}
+
+PassRefPtr<StorageNamespace> StorageNamespaceProxy::copy()
+{
+    return adoptRef(new StorageNamespaceProxy(m_storageNamespace->copy()));
+}
+
+PassRefPtr<StorageArea> StorageNamespaceProxy::storageArea(PassRefPtr<SecurityOrigin> origin)
+{
+    return adoptRef(new StorageAreaProxy(m_storageNamespace->createStorageArea(origin->toString())));
+}
+
+void StorageNamespaceProxy::close()
+{
+    m_storageNamespace->close();
+}
+
+void StorageNamespaceProxy::unlock()
+{
+    // FIXME: Implement.
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebKit/chromium/src/StorageNamespaceProxy.h b/WebKit/chromium/src/StorageNamespaceProxy.h
new file mode 100644
index 0000000..9ff624b
--- /dev/null
+++ b/WebKit/chromium/src/StorageNamespaceProxy.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageNamespaceProxy_h
+#define StorageNamespaceProxy_h
+
+#if ENABLE(DOM_STORAGE)
+
+#include "StorageNamespace.h"
+
+namespace WebKit { class WebStorageNamespace; }
+
+namespace WebCore {
+
+class StorageNamespaceProxy : public StorageNamespace {
+public:
+    StorageNamespaceProxy(WebKit::WebStorageNamespace* storageNamespace);
+    virtual ~StorageNamespaceProxy();
+    virtual PassRefPtr<StorageArea> storageArea(PassRefPtr<SecurityOrigin>);
+    virtual PassRefPtr<StorageNamespace> copy();
+    virtual void close();
+    virtual void unlock();
+
+private:
+    OwnPtr<WebKit::WebStorageNamespace> m_storageNamespace;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // StorageNamespaceProxy_h
diff --git a/WebKit/chromium/src/WebAccessibilityCache.cpp b/WebKit/chromium/src/WebAccessibilityCache.cpp
new file mode 100644
index 0000000..8a3f697
--- /dev/null
+++ b/WebKit/chromium/src/WebAccessibilityCache.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAccessibilityCache.h"
+
+#include "AXObjectCache.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebAccessibilityCache::enableAccessibility()
+{
+    AXObjectCache::enableAccessibility();
+}
+
+}
diff --git a/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp b/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp
new file mode 100644
index 0000000..03e5f46
--- /dev/null
+++ b/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAccessibilityCacheImpl.h"
+
+#include "AccessibilityObject.h"
+#include "AXObjectCache.h"
+#include "Document.h"
+#include "Frame.h"
+
+#include "WebAccessibilityObject.h"
+#include "WebFrameImpl.h"
+#include "WebViewImpl.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+const int invalidObjectId = -1;
+const int firstObjectId = 1000;
+
+static PassRefPtr<AccessibilityObject> toAccessibilityObject(const WebAccessibilityObject& object)
+{
+    return object;
+}
+
+// WebView ----------------------------------------------------------------
+
+WebAccessibilityCache* WebAccessibilityCache::create()
+{
+    return new WebAccessibilityCacheImpl();
+}
+
+// WeakHandle -------------------------------------------------------------
+
+PassRefPtr<WebAccessibilityCacheImpl::WeakHandle> WebAccessibilityCacheImpl::WeakHandle::create(AccessibilityObject* object)
+{
+    // FIXME: Remove resetting ref-count from AccessibilityObjectWrapper
+    // and convert to use adoptRef.
+    return new WebAccessibilityCacheImpl::WeakHandle(object);
+}
+
+WebAccessibilityCacheImpl::WeakHandle::WeakHandle(AccessibilityObject* object)
+    : AccessibilityObjectWrapper(object)
+{
+    m_object->setWrapper(this);
+}
+
+// WebAccessibilityCacheImpl ----------------------------------------
+
+void WebAccessibilityCacheImpl::WeakHandle::detach()
+{
+    if (m_object)
+        m_object = 0;
+}
+
+WebAccessibilityCacheImpl::WebAccessibilityCacheImpl()
+    : m_nextNewId(firstObjectId)
+    , m_initialized(false)
+{
+}
+
+WebAccessibilityCacheImpl::~WebAccessibilityCacheImpl()
+{
+}
+
+void WebAccessibilityCacheImpl::initialize(WebView* view)
+{
+    AXObjectCache::enableAccessibility();
+    WebAccessibilityObject root = view->accessibilityObject();
+    if (root.isNull())
+        return;
+
+    RefPtr<AccessibilityObject> rootObject = toAccessibilityObject(root);
+
+    // Insert root in hashmaps.
+    m_objectMap.set(m_nextNewId, WeakHandle::create(rootObject.get()));
+    m_idMap.set(rootObject.get(), m_nextNewId++);
+
+    m_initialized = true;
+}
+
+WebAccessibilityObject WebAccessibilityCacheImpl::getObjectById(int id)
+{
+    ObjectMap::iterator it = m_objectMap.find(id);
+
+    if (it == m_objectMap.end() || !it->second)
+        return WebAccessibilityObject();
+
+    return WebAccessibilityObject(it->second->accessibilityObject());
+}
+
+bool WebAccessibilityCacheImpl::isValidId(int id) const
+{
+    return id >= firstObjectId;
+}
+
+void WebAccessibilityCacheImpl::remove(int id)
+{
+    ObjectMap::iterator it = m_objectMap.find(id);
+
+    if (it == m_objectMap.end())
+        return;
+
+    if (it->second) {
+        // Erase element from reverse hashmap.
+        IdMap::iterator it2 = m_idMap.find(it->second->accessibilityObject());
+        if (it2 != m_idMap.end())
+            m_idMap.remove(it2);
+    }
+
+    m_objectMap.remove(it);
+}
+
+void WebAccessibilityCacheImpl::clear()
+{
+    m_objectMap.clear();
+    m_idMap.clear();
+}
+
+int WebAccessibilityCacheImpl::addOrGetId(const WebAccessibilityObject& object)
+{
+    if (object.isNull())
+        return invalidObjectId;
+
+    RefPtr<AccessibilityObject> o = toAccessibilityObject(object);
+
+    IdMap::iterator it = m_idMap.find(o.get());
+
+    if (it != m_idMap.end())
+        return it->second;
+
+    // Insert new accessibility object in hashmaps and return its newly
+    // assigned accessibility object id.
+    m_objectMap.set(m_nextNewId, WeakHandle::create(o.get()));
+    m_idMap.set(o.get(), m_nextNewId);
+
+    return m_nextNewId++;
+}
+
+}
diff --git a/WebKit/chromium/src/WebAccessibilityCacheImpl.h b/WebKit/chromium/src/WebAccessibilityCacheImpl.h
new file mode 100644
index 0000000..5148b74
--- /dev/null
+++ b/WebKit/chromium/src/WebAccessibilityCacheImpl.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebAccessibilityCacheImpl_h
+#define WebAccessibilityCacheImpl_h
+
+#include "AccessibilityObjectWrapper.h"
+#include "WebAccessibilityCache.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebKit {
+
+// FIXME: Should be eliminated to use AXObjectCache instead.
+class WebAccessibilityCacheImpl : public WebKit::WebAccessibilityCache {
+public:
+    virtual void initialize(WebView* view);
+    virtual bool isInitialized() const { return m_initialized; }
+
+    virtual WebAccessibilityObject getObjectById(int);
+    virtual bool isValidId(int) const;
+    virtual int addOrGetId(const WebKit::WebAccessibilityObject&);
+
+    virtual void remove(int);
+    virtual void clear();
+
+protected:
+    friend class WebKit::WebAccessibilityCache;
+
+    WebAccessibilityCacheImpl();
+    ~WebAccessibilityCacheImpl();
+
+private:
+    // FIXME: This can be just part of Chromium's AccessibilityObjectWrapper.
+    class WeakHandle : public WebCore::AccessibilityObjectWrapper {
+    public:
+        static PassRefPtr<WeakHandle> create(WebCore::AccessibilityObject*);
+        virtual void detach();
+    private:
+        WeakHandle(WebCore::AccessibilityObject*);
+    };
+
+    typedef HashMap<int, RefPtr<WeakHandle> > ObjectMap;
+    typedef HashMap<WebCore::AccessibilityObject*, int> IdMap;
+
+    // Hashmap for caching of elements in use by the AT, mapping id (int) to
+    // WebAccessibilityObject.
+    ObjectMap m_objectMap;
+    // Hashmap for caching of elements in use by the AT, mapping a
+    // AccessibilityObject pointer to its id (int). Needed for reverse lookup,
+    // to ensure unnecessary duplicate entries are not created in the
+    // ObjectMap and for focus changes in WebKit.
+    IdMap m_idMap;
+
+    // Unique identifier for retrieving an accessibility object from the page's
+    // hashmaps. Id is always 0 for the root of the accessibility object
+    // hierarchy (on a per-renderer process basis).
+    int m_nextNewId;
+
+    bool m_initialized;
+};
+
+}
+
+#endif
diff --git a/WebKit/chromium/src/WebAccessibilityObject.cpp b/WebKit/chromium/src/WebAccessibilityObject.cpp
new file mode 100644
index 0000000..bdbd260
--- /dev/null
+++ b/WebKit/chromium/src/WebAccessibilityObject.cpp
@@ -0,0 +1,413 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAccessibilityObject.h"
+
+#include "AccessibilityObject.h"
+#include "EventHandler.h"
+#include "FrameView.h"
+#include "PlatformKeyboardEvent.h"
+#include "WebPoint.h"
+#include "WebRect.h"
+#include "WebString.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebAccessibilityObjectPrivate : public WebCore::AccessibilityObject {
+};
+
+void WebAccessibilityObject::reset()
+{
+    assign(0);
+}
+
+void WebAccessibilityObject::assign(const WebKit::WebAccessibilityObject& other)
+{
+    WebAccessibilityObjectPrivate* p = const_cast<WebAccessibilityObjectPrivate*>(other.m_private);
+    if (p)
+        p->ref();
+    assign(p);
+}
+
+WebString WebAccessibilityObject::accessibilityDescription() const
+{
+    if (!m_private)
+        return WebString();
+
+    m_private->updateBackingStore();
+    return m_private->accessibilityDescription();
+}
+
+WebString WebAccessibilityObject::actionVerb() const
+{
+    if (!m_private)
+        return WebString();
+
+    m_private->updateBackingStore();
+    return m_private->actionVerb();
+}
+
+bool WebAccessibilityObject::canSetFocusAttribute() const
+{
+    if (!m_private)
+        return false;
+
+    m_private->updateBackingStore();
+    return m_private->canSetFocusAttribute();
+}
+
+bool WebAccessibilityObject::canSetValueAttribute() const
+{
+    if (!m_private)
+        return false;
+
+    m_private->updateBackingStore();
+    return m_private->canSetValueAttribute();
+}
+
+unsigned WebAccessibilityObject::childCount() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->children().size();
+}
+
+WebAccessibilityObject WebAccessibilityObject::childAt(unsigned index) const
+{
+    if (!m_private)
+        return WebAccessibilityObject();
+
+    m_private->updateBackingStore();
+    if (m_private->children().size() <= index)
+        return WebAccessibilityObject();
+
+    return WebAccessibilityObject(m_private->children()[index]);
+}
+
+WebAccessibilityObject WebAccessibilityObject::firstChild() const
+{
+    if (!m_private)
+        return WebAccessibilityObject();
+
+    m_private->updateBackingStore();
+    return WebAccessibilityObject(m_private->firstChild());
+}
+
+WebAccessibilityObject WebAccessibilityObject::focusedChild() const
+{
+    if (!m_private)
+        return WebAccessibilityObject();
+
+    m_private->updateBackingStore();
+    RefPtr<AccessibilityObject> focused = m_private->focusedUIElement();
+    if (m_private == focused.get() || focused->parentObject() == m_private)
+        return WebAccessibilityObject(focused);
+
+    return WebAccessibilityObject();
+}
+
+WebAccessibilityObject WebAccessibilityObject::lastChild() const
+{
+    if (!m_private)
+        return WebAccessibilityObject();
+
+    m_private->updateBackingStore();
+    return WebAccessibilityObject(m_private->lastChild());
+}
+
+
+WebAccessibilityObject WebAccessibilityObject::nextSibling() const
+{
+    if (!m_private)
+        return WebAccessibilityObject();
+
+    m_private->updateBackingStore();
+    return WebAccessibilityObject(m_private->nextSibling());
+}
+
+WebAccessibilityObject WebAccessibilityObject::parentObject() const
+{
+    if (!m_private)
+        return WebAccessibilityObject();
+
+    m_private->updateBackingStore();
+    return WebAccessibilityObject(m_private->parentObject());
+}
+
+
+WebAccessibilityObject WebAccessibilityObject::previousSibling() const
+{
+    if (!m_private)
+        return WebAccessibilityObject();
+
+    m_private->updateBackingStore();
+    return WebAccessibilityObject(m_private->previousSibling());
+}
+
+bool WebAccessibilityObject::isAnchor() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isAnchor();
+}
+
+bool WebAccessibilityObject::isChecked() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isChecked();
+}
+
+
+bool WebAccessibilityObject::isFocused() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isFocused();
+}
+
+bool WebAccessibilityObject::isEnabled() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isEnabled();
+}
+
+bool WebAccessibilityObject::isHovered() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isHovered();
+}
+
+bool WebAccessibilityObject::isIndeterminate() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isIndeterminate();
+}
+
+bool WebAccessibilityObject::isMultiSelect() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isMultiSelect();
+}
+
+bool WebAccessibilityObject::isOffScreen() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isOffScreen();
+}
+
+bool WebAccessibilityObject::isPasswordField() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isPasswordField();
+}
+
+bool WebAccessibilityObject::isPressed() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isPressed();
+}
+
+bool WebAccessibilityObject::isReadOnly() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isReadOnly();
+}
+
+bool WebAccessibilityObject::isVisited() const
+{
+    if (!m_private)
+        return 0;
+
+    m_private->updateBackingStore();
+    return m_private->isVisited();
+}
+
+WebRect WebAccessibilityObject::boundingBoxRect() const
+{
+    if (!m_private)
+        return WebRect();
+
+    m_private->updateBackingStore();
+    return m_private->documentFrameView()->contentsToWindow(m_private->boundingBoxRect());
+}
+
+WebString WebAccessibilityObject::helpText() const
+{
+    if (!m_private)
+        return WebString();
+
+    m_private->updateBackingStore();
+    return m_private->helpText();
+}
+
+WebAccessibilityObject WebAccessibilityObject::hitTest(const WebPoint& point) const
+{
+    if (!m_private)
+        return WebAccessibilityObject();
+
+    m_private->updateBackingStore();
+    IntPoint contentsPoint = m_private->documentFrameView()->windowToContents(point);
+    RefPtr<AccessibilityObject> hit = m_private->doAccessibilityHitTest(contentsPoint);
+
+    if (hit.get())
+        return WebAccessibilityObject(hit);
+
+    if (m_private->boundingBoxRect().contains(contentsPoint))
+        return *this;
+
+    return WebAccessibilityObject();
+}
+
+WebString WebAccessibilityObject::keyboardShortcut() const
+{
+    if (!m_private)
+        return WebString();
+
+    m_private->updateBackingStore();
+    String accessKey = m_private->accessKey();
+    if (accessKey.isNull())
+        return WebString();
+
+    static String modifierString;
+    if (modifierString.isNull()) {
+        unsigned modifiers = EventHandler::accessKeyModifiers();
+        // Follow the same order as Mozilla MSAA implementation:
+        // Ctrl+Alt+Shift+Meta+key. MSDN states that keyboard shortcut strings
+        // should not be localized and defines the separator as "+".
+        if (modifiers & PlatformKeyboardEvent::CtrlKey)
+            modifierString += "Ctrl+";
+        if (modifiers & PlatformKeyboardEvent::AltKey)
+            modifierString += "Alt+";
+        if (modifiers & PlatformKeyboardEvent::ShiftKey)
+            modifierString += "Shift+";
+        if (modifiers & PlatformKeyboardEvent::MetaKey)
+            modifierString += "Win+";
+    }
+
+    return modifierString + accessKey;
+}
+
+bool WebAccessibilityObject::performDefaultAction() const
+{
+    if (!m_private)
+        return false;
+
+    m_private->updateBackingStore();
+    return m_private->performDefaultAction();
+}
+
+WebAccessibilityRole WebAccessibilityObject::roleValue() const
+{
+    if (!m_private)
+        return WebKit::WebAccessibilityRoleUnknown;
+
+    m_private->updateBackingStore();
+    return static_cast<WebAccessibilityRole>(m_private->roleValue());
+}
+
+WebString WebAccessibilityObject::stringValue() const
+{
+    if (!m_private)
+        return WebString();
+
+    m_private->updateBackingStore();
+    return m_private->stringValue();
+}
+
+WebString WebAccessibilityObject::title() const
+{
+    if (!m_private)
+        return WebString();
+
+    m_private->updateBackingStore();
+    return m_private->title();
+}
+
+WebAccessibilityObject::WebAccessibilityObject(const WTF::PassRefPtr<WebCore::AccessibilityObject>& object)
+    : m_private(static_cast<WebAccessibilityObjectPrivate*>(object.releaseRef()))
+{
+}
+
+WebAccessibilityObject& WebAccessibilityObject::operator=(const WTF::PassRefPtr<WebCore::AccessibilityObject>& object)
+{
+    assign(static_cast<WebAccessibilityObjectPrivate*>(object.releaseRef()));
+    return *this;
+}
+
+WebAccessibilityObject::operator WTF::PassRefPtr<WebCore::AccessibilityObject>() const
+{
+    return PassRefPtr<WebCore::AccessibilityObject>(const_cast<WebAccessibilityObjectPrivate*>(m_private));
+}
+
+void WebAccessibilityObject::assign(WebAccessibilityObjectPrivate* p)
+{
+    // p is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebBindings.cpp b/WebKit/chromium/src/WebBindings.cpp
new file mode 100644
index 0000000..0bc67b6
--- /dev/null
+++ b/WebKit/chromium/src/WebBindings.cpp
@@ -0,0 +1,323 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebBindings.h"
+
+#include "npruntime_impl.h"
+#include "npruntime_priv.h"
+
+#include "../public/WebDragData.h"
+#include "../public/WebRange.h"
+
+#if USE(V8)
+#include "ChromiumDataObject.h"
+#include "ClipboardChromium.h"
+#include "EventNames.h"
+#include "MouseEvent.h"
+#include "NPV8Object.h"  // for PrivateIdentifier
+#include "Range.h"
+#include "V8DOMWrapper.h"
+#include "V8Helpers.h"
+#include "V8Proxy.h"
+#elif USE(JSC)
+#include "bridge/c/c_utility.h"
+#endif
+
+#if USE(JAVASCRIPTCORE_BINDINGS)
+using JSC::Bindings::PrivateIdentifier;
+#endif
+
+using namespace WebCore;
+
+namespace WebKit {
+
+bool WebBindings::construct(NPP npp, NPObject *npobj, const NPVariant *args, uint32_t argCount, NPVariant* result)
+{
+    return _NPN_Construct(npp, npobj, args, argCount, result);
+}
+
+NPObject* WebBindings::createObject(NPP npp, NPClass* npClass)
+{
+    return _NPN_CreateObject(npp, npClass);
+}
+
+bool WebBindings::enumerate(NPP id, NPObject* obj, NPIdentifier** identifier, uint32_t* val)
+{
+    return _NPN_Enumerate(id, obj, identifier, val);
+}
+
+bool WebBindings::evaluate(NPP npp, NPObject* npObject, NPString* npScript, NPVariant* result)
+{
+    return _NPN_Evaluate(npp, npObject, npScript, result);
+}
+
+bool WebBindings::evaluateHelper(NPP npp, bool popups_allowed, NPObject* npobj, NPString* npscript, NPVariant* result)
+{
+    return _NPN_EvaluateHelper(npp, popups_allowed, npobj, npscript, result);
+}
+
+NPIdentifier WebBindings::getIntIdentifier(int32_t number)
+{
+    return _NPN_GetIntIdentifier(number);
+}
+
+bool WebBindings::getProperty(NPP npp, NPObject* obj, NPIdentifier propertyName, NPVariant *result)
+{
+    return _NPN_GetProperty(npp, obj, propertyName, result);
+}
+
+NPIdentifier WebBindings::getStringIdentifier(const NPUTF8* string)
+{
+    return _NPN_GetStringIdentifier(string);
+}
+
+void WebBindings::getStringIdentifiers(const NPUTF8** names, int32_t nameCount, NPIdentifier* identifiers)
+{
+    _NPN_GetStringIdentifiers(names, nameCount, identifiers);
+}
+
+bool WebBindings::hasMethod(NPP npp, NPObject* npObject, NPIdentifier methodName)
+{
+    return _NPN_HasMethod(npp, npObject, methodName);
+}
+
+bool WebBindings::hasProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName)
+{
+    return _NPN_HasProperty(npp, npObject, propertyName);
+}
+
+bool WebBindings::identifierIsString(NPIdentifier identifier)
+{
+    return _NPN_IdentifierIsString(identifier);
+}
+
+int32_t WebBindings::intFromIdentifier(NPIdentifier identifier)
+{
+    return _NPN_IntFromIdentifier(identifier);
+}
+
+void WebBindings::initializeVariantWithStringCopy(NPVariant* variant, const NPString* value)
+{
+#if USE(V8)
+    _NPN_InitializeVariantWithStringCopy(variant, value);
+#else
+    NPN_InitializeVariantWithStringCopy(variant, value);
+#endif
+}
+
+bool WebBindings::invoke(NPP npp, NPObject* npObject, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result)
+{
+    return _NPN_Invoke(npp, npObject, methodName, arguments, argumentCount, result);
+}
+
+bool WebBindings::invokeDefault(NPP id, NPObject* obj, const NPVariant* args, uint32_t count, NPVariant* result)
+{
+    return _NPN_InvokeDefault(id, obj, args, count, result);
+}
+
+void WebBindings::releaseObject(NPObject* npObject)
+{
+    return _NPN_ReleaseObject(npObject);
+}
+
+void WebBindings::releaseVariantValue(NPVariant* variant)
+{
+    _NPN_ReleaseVariantValue(variant);
+}
+
+bool WebBindings::removeProperty(NPP id, NPObject* object, NPIdentifier identifier)
+{
+    return  _NPN_RemoveProperty(id, object, identifier);
+}
+
+NPObject* WebBindings::retainObject(NPObject* npObject)
+{
+    return _NPN_RetainObject(npObject);
+}
+
+void WebBindings::setException(NPObject* obj, const NPUTF8* message)
+{
+    _NPN_SetException(obj, message);
+}
+
+bool WebBindings::setProperty(NPP id, NPObject* obj, NPIdentifier identifier, const NPVariant* variant)
+{
+    return _NPN_SetProperty(id, obj, identifier, variant);
+}
+
+void WebBindings::unregisterObject(NPObject* npObject)
+{
+#if USE(V8)
+    _NPN_UnregisterObject(npObject);
+#endif
+}
+
+NPUTF8* WebBindings::utf8FromIdentifier(NPIdentifier identifier)
+{
+    return _NPN_UTF8FromIdentifier(identifier);
+}
+
+void WebBindings::extractIdentifierData(const NPIdentifier& identifier, const NPUTF8*& string, int32_t& number, bool& isString)
+{
+    PrivateIdentifier* priv = static_cast<PrivateIdentifier*>(identifier);
+    if (!priv) {
+        isString = false;
+        number = 0;
+        return;
+    }
+
+    isString = priv->isString;
+    if (isString)
+        string = priv->value.string;
+    else
+        number = priv->value.number;
+}
+
+#if USE(V8)
+
+static v8::Local<v8::Value> getEvent(const v8::Handle<v8::Context>& context)
+{
+    static v8::Persistent<v8::String> eventSymbol(v8::Persistent<v8::String>::New(v8::String::NewSymbol("event")));
+    return context->Global()->GetHiddenValue(eventSymbol);
+}
+
+static bool getDragDataImpl(NPObject* npobj, int* eventId, WebDragData* data)
+{
+    if (!npobj)
+        return false;
+    if (npobj->_class != npScriptObjectClass)
+        return false;
+
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> context = v8::Context::GetEntered();
+    if (context.IsEmpty())
+        return false;
+
+    // Get the current WebCore event.
+    v8::Handle<v8::Value> currentEvent(getEvent(context));
+    Event* event = V8DOMWrapper::convertToNativeEvent(currentEvent);
+    if (!event)
+        return false;
+
+    // Check that the given npobj is that event.
+    V8NPObject* object = reinterpret_cast<V8NPObject*>(npobj);
+    Event* given = V8DOMWrapper::convertToNativeEvent(object->v8Object);
+    if (given != event)
+        return false;
+
+    // Check the execution frames are same origin.
+    V8Proxy* current = V8Proxy::retrieve(V8Proxy::retrieveFrameForCurrentContext());
+    Frame* frame = V8Proxy::retrieveFrame(context);
+    if (!current || !current->canAccessFrame(frame, false))
+        return false;
+
+    const EventNames& names(eventNames());
+    const AtomicString& eventType(event->type());
+
+    enum DragTargetMouseEventId {
+        DragEnterId = 1, DragOverId = 2, DragLeaveId = 3, DropId = 4
+    };
+
+    // The event type should be a drag event.
+    if (eventType == names.dragenterEvent)
+        *eventId = DragEnterId;
+    else if (eventType == names.dragoverEvent)
+        *eventId = DragOverId;
+    else if (eventType == names.dragleaveEvent)
+        *eventId = DragLeaveId;
+    else if (eventType == names.dropEvent)
+        *eventId = DropId;
+    else
+        return false;
+
+    // Drag events are mouse events and should have a clipboard.
+    MouseEvent* me = static_cast<MouseEvent*>(event);
+    Clipboard* clipboard = me->clipboard();
+    if (!clipboard)
+        return false;
+
+    // And that clipboard should be accessible by WebKit policy.
+    ClipboardChromium* chrome = static_cast<ClipboardChromium*>(clipboard);
+    HashSet<String> accessible(chrome->types());
+    if (accessible.isEmpty())
+        return false;
+
+    RefPtr<ChromiumDataObject> dataObject(chrome->dataObject());
+    if (dataObject && data)
+        *data = WebDragData(dataObject);
+
+    return dataObject;
+}
+
+static bool getRangeImpl(NPObject* npobj, WebRange* range)
+{
+    V8NPObject* v8npobject = reinterpret_cast<V8NPObject*>(npobj);
+    v8::Handle<v8::Object> v8object(v8npobject->v8Object);
+    if (V8ClassIndex::RANGE != V8DOMWrapper::domWrapperType(v8object))
+        return false;
+
+    Range* native = V8DOMWrapper::convertToNativeObject<WebCore::Range>(V8ClassIndex::RANGE, v8object);
+    if (!native)
+        return false;
+
+    *range = WebRange(native);
+    return true;
+}
+
+#endif
+
+bool WebBindings::getDragData(NPObject* event, int* eventId, WebDragData* data)
+{
+#if USE(V8)
+    return getDragDataImpl(event, eventId, data);
+#else
+    // Not supported on other ports (JSC, etc).
+    return false;
+#endif
+}
+
+bool WebBindings::isDragEvent(NPObject* event)
+{
+    int eventId;
+    return getDragData(event, &eventId, 0);
+}
+
+bool WebBindings::getRange(NPObject* range, WebRange* webrange)
+{
+#if USE(V8)
+    return getRangeImpl(range, webrange);
+#else
+    // Not supported on other ports (JSC, etc).
+    return false;
+#endif
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebCString.cpp b/WebKit/chromium/src/WebCString.cpp
new file mode 100644
index 0000000..82fbac0
--- /dev/null
+++ b/WebKit/chromium/src/WebCString.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCString.h"
+
+#include "CString.h"
+#include "TextEncoding.h"
+
+#include "WebString.h"
+
+namespace WebKit {
+
+class WebCStringPrivate : public WebCore::CStringBuffer {
+};
+
+void WebCString::reset()
+{
+    if (m_private) {
+        m_private->deref();
+        m_private = 0;
+    }
+}
+
+void WebCString::assign(const WebCString& other)
+{
+    assign(const_cast<WebCStringPrivate*>(other.m_private));
+}
+
+void WebCString::assign(const char* data, size_t length)
+{
+    char* newData;
+    RefPtr<WebCore::CStringBuffer> buffer =
+        WebCore::CString::newUninitialized(length, newData).buffer();
+    memcpy(newData, data, length);
+    assign(static_cast<WebCStringPrivate*>(buffer.get()));
+}
+
+size_t WebCString::length() const
+{
+    if (!m_private)
+        return 0;
+    // NOTE: The buffer's length includes the null byte.
+    return const_cast<WebCStringPrivate*>(m_private)->length() - 1;
+}
+
+const char* WebCString::data() const
+{
+    if (!m_private)
+        return 0;
+    return const_cast<WebCStringPrivate*>(m_private)->data();
+}
+
+WebString WebCString::utf16() const
+{
+    return WebCore::UTF8Encoding().decode(data(), length());
+}
+
+WebCString WebCString::fromUTF16(const WebUChar* data, size_t length)
+{
+    return WebCore::UTF8Encoding().encode(
+        data, length, WebCore::QuestionMarksForUnencodables);
+}
+
+WebCString WebCString::fromUTF16(const WebUChar* data)
+{
+    size_t len = 0;
+    while (data[len] != WebUChar(0))
+        len++;
+    return fromUTF16(data, len);
+}
+
+WebCString::WebCString(const WebCore::CString& s)
+    : m_private(static_cast<WebCStringPrivate*>(s.buffer()))
+{
+    if (m_private)
+        m_private->ref();
+}
+
+WebCString& WebCString::operator=(const WebCore::CString& s)
+{
+    assign(static_cast<WebCStringPrivate*>(s.buffer()));
+    return *this;
+}
+
+WebCString::operator WebCore::CString() const
+{
+    return m_private;
+}
+
+void WebCString::assign(WebCStringPrivate* p)
+{
+    // Take care to handle the case where m_private == p
+    if (p)
+        p->ref();
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebCache.cpp b/WebKit/chromium/src/WebCache.cpp
new file mode 100644
index 0000000..9d03a4d
--- /dev/null
+++ b/WebKit/chromium/src/WebCache.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCache.h"
+
+// Instead of providing accessors, we make all members of Cache public.
+// This will make it easier to track WebCore changes to the Cache class.
+// FIXME: We should introduce public getters on the Cache class.
+#define private public
+#include "Cache.h"
+#undef private
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// A helper method for coverting a Cache::TypeStatistic to a
+// WebCache::ResourceTypeStat.
+static void ToResourceTypeStat(const Cache::TypeStatistic& from,
+                               WebCache::ResourceTypeStat& to)
+{
+    to.count = static_cast<size_t>(from.count);
+    to.size = static_cast<size_t>(from.size);
+    to.liveSize = static_cast<size_t>(from.liveSize);
+    to.decodedSize = static_cast<size_t>(from.decodedSize);
+}
+
+void WebCache::setCapacities(
+    size_t minDeadCapacity, size_t maxDeadCapacity, size_t capacity)
+{
+    Cache* cache = WebCore::cache();
+    if (cache)
+        cache->setCapacities(static_cast<unsigned int>(minDeadCapacity),
+                             static_cast<unsigned int>(maxDeadCapacity),
+                             static_cast<unsigned int>(capacity));
+}
+
+void WebCache::clear()
+{
+    Cache* cache = WebCore::cache();
+    if (cache && !cache->disabled()) {
+        // NOTE: I think using setDisabled() instead of setCapacities() will
+        // remove from the cache items that won't actually be freed from memory
+        // (due to other live references to them), so it just results in wasting
+        // time later and not saving memory compared to the below technique.
+        unsigned minDeadCapacity = cache->m_minDeadCapacity;
+        unsigned maxDeadCapacity = cache->m_maxDeadCapacity;
+        unsigned capacity = cache->m_capacity;
+        cache->setCapacities(0, 0, 0);  // Will prune the cache.
+        cache->setCapacities(minDeadCapacity, maxDeadCapacity, capacity);
+    }
+}
+
+void WebCache::getUsageStats(UsageStats* result)
+{
+    ASSERT(result);
+
+    Cache* cache = WebCore::cache();
+    if (cache) {
+        result->minDeadCapacity = cache->m_minDeadCapacity;
+        result->maxDeadCapacity = cache->m_maxDeadCapacity;
+        result->capacity = cache->m_capacity;
+        result->liveSize = cache->m_liveSize;
+        result->deadSize = cache->m_deadSize;
+    } else
+        memset(result, 0, sizeof(UsageStats));
+}
+
+void WebCache::getResourceTypeStats(ResourceTypeStats* result)
+{
+    Cache* cache = WebCore::cache();
+    if (cache) {
+        Cache::Statistics stats = cache->getStatistics();
+        ToResourceTypeStat(stats.images, result->images);
+        ToResourceTypeStat(stats.cssStyleSheets, result->cssStyleSheets);
+        ToResourceTypeStat(stats.scripts, result->scripts);
+#if ENABLE(XSLT)
+        ToResourceTypeStat(stats.xslStyleSheets, result->xslStyleSheets);
+#else
+        memset(&result->xslStyleSheets, 0, sizeof(result->xslStyleSheets));
+#endif
+        ToResourceTypeStat(stats.fonts, result->fonts);
+    } else
+        memset(result, 0, sizeof(WebCache::ResourceTypeStats));
+}
+
+}  // namespace WebKit
diff --git a/WebKit/chromium/src/WebColor.cpp b/WebKit/chromium/src/WebColor.cpp
new file mode 100644
index 0000000..9323433
--- /dev/null
+++ b/WebKit/chromium/src/WebColor.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebColor.h"
+
+#include "Color.h"
+#include "CSSValueKeywords.h"
+#include "RenderTheme.h"
+#include "UnusedParam.h"
+#include "WebColorName.h"
+
+using namespace::WebCore;
+
+namespace WebKit {
+
+static int toCSSValueKeyword(WebColorName in_value)
+{
+    switch (in_value) {
+    case WebColorActiveBorder:
+        return CSSValueActiveborder;
+    case WebColorActiveCaption:
+        return CSSValueActivecaption;
+    case WebColorAppworkspace:
+        return CSSValueAppworkspace;
+    case WebColorBackground:
+        return CSSValueBackground;
+    case WebColorButtonFace:
+        return CSSValueButtonface;
+    case WebColorButtonHighlight:
+        return CSSValueButtonhighlight;
+    case WebColorButtonShadow:
+        return CSSValueButtonshadow;
+    case WebColorButtonText:
+        return CSSValueButtontext;
+    case WebColorCaptionText:
+        return CSSValueCaptiontext;
+    case WebColorGrayText:
+        return CSSValueGraytext;
+    case WebColorHighlight:
+        return CSSValueHighlight;
+    case WebColorHighlightText:
+        return CSSValueHighlighttext;
+    case WebColorInactiveBorder:
+        return CSSValueInactiveborder;
+    case WebColorInactiveCaption:
+        return CSSValueInactivecaption;
+    case WebColorInactiveCaptionText:
+        return CSSValueInactivecaptiontext;
+    case WebColorInfoBackground:
+        return CSSValueInfobackground;
+    case WebColorInfoText:
+        return CSSValueInfotext;
+    case WebColorMenu:
+        return CSSValueMenu;
+    case WebColorMenuText:
+        return CSSValueMenutext;
+    case WebColorScrollbar:
+        return CSSValueScrollbar;
+    case WebColorText:
+        return CSSValueText;
+    case WebColorThreedDarkShadow:
+        return CSSValueThreeddarkshadow;
+    case WebColorThreedShadow:
+        return CSSValueThreedshadow;
+    case WebColorThreedFace:
+        return CSSValueThreedface;
+    case WebColorThreedHighlight:
+        return CSSValueThreedhighlight;
+    case WebColorThreedLightShadow:
+        return CSSValueThreedlightshadow;
+    case WebColorWebkitFocusRingColor:
+        return CSSValueWebkitFocusRingColor;
+    case WebColorWindow:
+        return CSSValueWindow;
+    case WebColorWindowFrame:
+        return CSSValueWindowframe;
+    case WebColorWindowText:
+        return CSSValueWindowtext;
+    default:
+        return CSSValueInvalid;
+    }
+}
+
+void setNamedColors(const WebColorName* colorNames, const WebColor* colors, size_t length)
+{
+    for (size_t i = 0; i < length; ++i) {
+        WebColorName colorName = colorNames[i];
+        WebColor color = colors[i];
+
+        // Convert color to internal value identifier.
+        int internalColorName = toCSSValueKeyword(colorName);
+        if (internalColorName == CSSValueWebkitFocusRingColor) {
+            RenderTheme::setCustomFocusRingColor(color);
+            continue;
+        }
+    }
+
+    // TODO(jeremy): Tell RenderTheme to update colors.
+}
+
+} // WebKit
diff --git a/WebKit/chromium/src/WebCrossOriginPreflightResultCache.cpp b/WebKit/chromium/src/WebCrossOriginPreflightResultCache.cpp
new file mode 100644
index 0000000..719316d
--- /dev/null
+++ b/WebKit/chromium/src/WebCrossOriginPreflightResultCache.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCrossOriginPreflightResultCache.h"
+
+#include "CrossOriginPreflightResultCache.h"
+
+namespace WebKit {
+
+void WebCrossOriginPreflightResultCache::clear()
+{
+    WebCore::CrossOriginPreflightResultCache::shared().empty();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebCursorInfo.cpp b/WebKit/chromium/src/WebCursorInfo.cpp
new file mode 100644
index 0000000..d4b0f81
--- /dev/null
+++ b/WebKit/chromium/src/WebCursorInfo.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCursorInfo.h"
+
+#include "Cursor.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebCursorInfo::WebCursorInfo(const Cursor& cursor)
+{
+    type = static_cast<Type>(cursor.impl().type());
+    hotSpot = cursor.impl().hotSpot();
+    customImage = cursor.impl().customImage();
+#ifdef WIN32
+    externalHandle = 0;
+#endif
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebData.cpp b/WebKit/chromium/src/WebData.cpp
new file mode 100644
index 0000000..6aafe79
--- /dev/null
+++ b/WebKit/chromium/src/WebData.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebData.h"
+
+#include "SharedBuffer.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebDataPrivate : public SharedBuffer {
+};
+
+void WebData::reset()
+{
+    if (m_private) {
+        m_private->deref();
+        m_private = 0;
+    }
+}
+
+void WebData::assign(const WebData& other)
+{
+    WebDataPrivate* p = const_cast<WebDataPrivate*>(other.m_private);
+    if (p)
+        p->ref();
+    assign(p);
+}
+
+void WebData::assign(const char* data, size_t size)
+{
+    assign(static_cast<WebDataPrivate*>(
+        SharedBuffer::create(data, size).releaseRef()));
+}
+
+size_t WebData::size() const
+{
+    if (!m_private)
+        return 0;
+    return const_cast<WebDataPrivate*>(m_private)->size();
+}
+
+const char* WebData::data() const
+{
+    if (!m_private)
+        return 0;
+    return const_cast<WebDataPrivate*>(m_private)->data();
+}
+
+WebData::WebData(const PassRefPtr<SharedBuffer>& buffer)
+    : m_private(static_cast<WebDataPrivate*>(buffer.releaseRef()))
+{
+}
+
+WebData& WebData::operator=(const PassRefPtr<SharedBuffer>& buffer)
+{
+    assign(static_cast<WebDataPrivate*>(buffer.releaseRef()));
+    return *this;
+}
+
+WebData::operator PassRefPtr<SharedBuffer>() const
+{
+    return PassRefPtr<SharedBuffer>(const_cast<WebDataPrivate*>(m_private));
+}
+
+void WebData::assign(WebDataPrivate* p)
+{
+    // p is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebDataSourceImpl.cpp b/WebKit/chromium/src/WebDataSourceImpl.cpp
new file mode 100644
index 0000000..456706a
--- /dev/null
+++ b/WebKit/chromium/src/WebDataSourceImpl.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebDataSourceImpl.h"
+
+#include "WebURL.h"
+#include "WebURLError.h"
+#include "WebVector.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebPluginLoadObserver* WebDataSourceImpl::m_nextPluginLoadObserver = 0;
+
+PassRefPtr<WebDataSourceImpl> WebDataSourceImpl::create(const ResourceRequest& request, const SubstituteData& data)
+{
+    return adoptRef(new WebDataSourceImpl(request, data));
+}
+
+const WebURLRequest& WebDataSourceImpl::originalRequest() const
+{
+    m_originalRequestWrapper.bind(DocumentLoader::originalRequest());
+    return m_originalRequestWrapper;
+}
+
+const WebURLRequest& WebDataSourceImpl::request() const
+{
+    m_requestWrapper.bind(DocumentLoader::request());
+    return m_requestWrapper;
+}
+
+const WebURLResponse& WebDataSourceImpl::response() const
+{
+    m_responseWrapper.bind(DocumentLoader::response());
+    return m_responseWrapper;
+}
+
+bool WebDataSourceImpl::hasUnreachableURL() const
+{
+    return !DocumentLoader::unreachableURL().isEmpty();
+}
+
+WebURL WebDataSourceImpl::unreachableURL() const
+{
+    return DocumentLoader::unreachableURL();
+}
+
+void WebDataSourceImpl::redirectChain(WebVector<WebURL>& result) const
+{
+    result.assign(m_redirectChain);
+}
+
+WebString WebDataSourceImpl::pageTitle() const
+{
+    return title();
+}
+
+WebNavigationType WebDataSourceImpl::navigationType() const
+{
+    return toWebNavigationType(triggeringAction().type());
+}
+
+double WebDataSourceImpl::triggeringEventTime() const
+{
+    if (!triggeringAction().event())
+        return 0.0;
+
+    // DOMTimeStamp uses units of milliseconds.
+    return triggeringAction().event()->timeStamp() / 1000.0;
+}
+
+WebDataSource::ExtraData* WebDataSourceImpl::extraData() const
+{
+    return m_extraData.get();
+}
+
+void WebDataSourceImpl::setExtraData(ExtraData* extraData)
+{
+    m_extraData.set(extraData);
+}
+
+WebNavigationType WebDataSourceImpl::toWebNavigationType(NavigationType type)
+{
+    switch (type) {
+    case NavigationTypeLinkClicked:
+        return WebNavigationTypeLinkClicked;
+    case NavigationTypeFormSubmitted:
+        return WebNavigationTypeFormSubmitted;
+    case NavigationTypeBackForward:
+        return WebNavigationTypeBackForward;
+    case NavigationTypeReload:
+        return WebNavigationTypeReload;
+    case NavigationTypeFormResubmitted:
+        return WebNavigationTypeFormResubmitted;
+    case NavigationTypeOther:
+    default:
+        return WebNavigationTypeOther;
+    }
+}
+
+const KURL& WebDataSourceImpl::endOfRedirectChain() const
+{
+    ASSERT(!m_redirectChain.isEmpty());
+    return m_redirectChain.last();
+}
+
+void WebDataSourceImpl::clearRedirectChain()
+{
+    m_redirectChain.clear();
+}
+
+void WebDataSourceImpl::appendRedirect(const KURL& url)
+{
+    m_redirectChain.append(url);
+}
+
+void WebDataSourceImpl::setNextPluginLoadObserver(PassOwnPtr<WebPluginLoadObserver> observer)
+{
+    // This call should always be followed up with the creation of a
+    // WebDataSourceImpl, so we should never leak this object.
+    m_nextPluginLoadObserver = observer.release();
+}
+
+WebDataSourceImpl::WebDataSourceImpl(const ResourceRequest& request, const SubstituteData& data)
+    : DocumentLoader(request, data)
+{
+    if (m_nextPluginLoadObserver) {
+        // When a new frame is created, it initially gets a data source for an
+        // empty document.  Then it is navigated to the source URL of the
+        // frame, which results in a second data source being created.  We want
+        // to wait to attach the WebPluginLoadObserver to that data source.
+        if (!request.url().isEmpty()) {
+            ASSERT(m_nextPluginLoadObserver->url() == request.url());
+            m_pluginLoadObserver.set(m_nextPluginLoadObserver);
+            m_nextPluginLoadObserver = 0;
+        }
+    }
+}
+
+WebDataSourceImpl::~WebDataSourceImpl()
+{
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebDataSourceImpl.h b/WebKit/chromium/src/WebDataSourceImpl.h
new file mode 100644
index 0000000..8860fe4
--- /dev/null
+++ b/WebKit/chromium/src/WebDataSourceImpl.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDataSourceImpl_h
+#define WebDataSourceImpl_h
+
+// FIXME: This relative path is a temporary hack to support using this
+// header from webkit/glue.
+#include "../public/WebDataSource.h"
+
+#include "DocumentLoader.h"
+#include "KURL.h"
+
+#include "WebPluginLoadObserver.h"
+#include "WrappedResourceRequest.h"
+#include "WrappedResourceResponse.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+
+namespace WebKit {
+
+class WebPluginLoadObserver;
+
+class WebDataSourceImpl : public WebCore::DocumentLoader, public WebDataSource {
+public:
+    static PassRefPtr<WebDataSourceImpl> create(const WebCore::ResourceRequest&,
+                                                const WebCore::SubstituteData&);
+
+    static WebDataSourceImpl* fromDocumentLoader(WebCore::DocumentLoader* loader)
+    {
+        return static_cast<WebDataSourceImpl*>(loader);
+    }
+
+    // WebDataSource methods:
+    virtual const WebURLRequest& originalRequest() const;
+    virtual const WebURLRequest& request() const;
+    virtual const WebURLResponse& response() const;
+    virtual bool hasUnreachableURL() const;
+    virtual WebURL unreachableURL() const;
+    virtual void redirectChain(WebVector<WebURL>&) const;
+    virtual WebString pageTitle() const;
+    virtual WebNavigationType navigationType() const;
+    virtual double triggeringEventTime() const;
+    virtual ExtraData* extraData() const;
+    virtual void setExtraData(ExtraData*);
+
+    static WebNavigationType toWebNavigationType(WebCore::NavigationType type);
+
+    bool hasRedirectChain() const { return !m_redirectChain.isEmpty(); }
+    const WebCore::KURL& endOfRedirectChain() const;
+    void clearRedirectChain();
+    void appendRedirect(const WebCore::KURL& url);
+
+    PassOwnPtr<WebPluginLoadObserver> releasePluginLoadObserver() { return m_pluginLoadObserver.release(); }
+    static void setNextPluginLoadObserver(PassOwnPtr<WebPluginLoadObserver>);
+
+private:
+    WebDataSourceImpl(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
+    ~WebDataSourceImpl();
+
+    // Mutable because the const getters will magically sync these to the
+    // latest version from WebKit.
+    mutable WrappedResourceRequest m_originalRequestWrapper;
+    mutable WrappedResourceRequest m_requestWrapper;
+    mutable WrappedResourceResponse m_responseWrapper;
+
+    // Lists all intermediate URLs that have redirected for the current provisional load.
+    // See WebFrameLoaderClient::dispatchDidReceiveServerRedirectForProvisionalLoad for a
+    // description of who modifies this when to keep it up to date.
+    Vector<WebCore::KURL> m_redirectChain;
+
+    OwnPtr<ExtraData> m_extraData;
+    OwnPtr<WebPluginLoadObserver> m_pluginLoadObserver;
+
+    static WebPluginLoadObserver* m_nextPluginLoadObserver;
+};
+
+} // namespace WebKit
+
+#endif  // WebDataSourceImpl_h
diff --git a/WebKit/chromium/src/WebDatabase.cpp b/WebKit/chromium/src/WebDatabase.cpp
new file mode 100644
index 0000000..2cd36b6
--- /dev/null
+++ b/WebKit/chromium/src/WebDatabase.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebDatabase.h"
+
+#include "Database.h"
+#include "DatabaseThread.h"
+#include "Document.h"
+#include "KURL.h"
+#include "QuotaTracker.h"
+#include "SecurityOrigin.h"
+#include "WebDatabaseObserver.h"
+#include "WebString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+static WebDatabaseObserver* databaseObserver = 0;
+
+class WebDatabasePrivate : public Database {
+};
+
+void WebDatabase::reset()
+{
+    assign(0);
+}
+
+void WebDatabase::assign(const WebDatabase& other)
+{
+    WebDatabasePrivate* d = const_cast<WebDatabasePrivate*>(other.m_private);
+    if (d)
+        d->ref();
+    assign(d);
+}
+
+WebString WebDatabase::name() const
+{
+    ASSERT(m_private);
+    return m_private->stringIdentifier();
+}
+
+WebString WebDatabase::displayName() const
+{
+    ASSERT(m_private);
+    return m_private->displayName();
+}
+
+unsigned long WebDatabase::estimatedSize() const
+{
+    ASSERT(m_private);
+    return m_private->estimatedSize();
+}
+
+WebSecurityOrigin WebDatabase::securityOrigin() const
+{
+    ASSERT(m_private);
+    return WebSecurityOrigin(m_private->securityOrigin());
+}
+
+void WebDatabase::setObserver(WebDatabaseObserver* observer)
+{
+    databaseObserver = observer;
+}
+
+WebDatabaseObserver* WebDatabase::observer()
+{
+    return databaseObserver;
+}
+
+void WebDatabase::updateDatabaseSize(
+    const WebString& originIdentifier, const WebString& databaseName,
+    unsigned long long databaseSize, unsigned long long spaceAvailable)
+{
+    WebCore::QuotaTracker::instance().updateDatabaseSizeAndSpaceAvailableToOrigin(
+        originIdentifier, databaseName, databaseSize, spaceAvailable);
+}
+
+WebDatabase::WebDatabase(const WTF::PassRefPtr<Database>& database)
+    : m_private(static_cast<WebDatabasePrivate*>(database.releaseRef()))
+{
+}
+
+WebDatabase& WebDatabase::operator=(const WTF::PassRefPtr<Database>& database)
+{
+    assign(static_cast<WebDatabasePrivate*>(database.releaseRef()));
+    return *this;
+}
+
+WebDatabase::operator WTF::PassRefPtr<Database>() const
+{
+    return PassRefPtr<Database>(const_cast<WebDatabasePrivate*>(m_private));
+}
+
+void WebDatabase::assign(WebDatabasePrivate* d)
+{
+    // d is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = d;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebDevToolsAgentPrivate.h b/WebKit/chromium/src/WebDevToolsAgentPrivate.h
new file mode 100644
index 0000000..0c1c67e
--- /dev/null
+++ b/WebKit/chromium/src/WebDevToolsAgentPrivate.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDevToolsAgentPrivate_h
+#define WebDevToolsAgentPrivate_h
+
+// FIXME: This relative path is a temporary hack to support using this
+// header from webkit/glue.
+#include "../public/WebDevToolsAgent.h"
+
+namespace WebKit {
+class WebFrameImpl;
+
+class WebDevToolsAgentPrivate : public WebDevToolsAgent {
+public:
+    // Notifications from FrameLoaderClientImpl:
+
+    // The window object for the frame has been cleared of any extra properties
+    // that may have been set by script from the previously loaded document.
+    virtual void didClearWindowObject(WebFrameImpl*) = 0;
+
+    // The provisional datasource is now committed.  The first part of the
+    // response body has been received, and the encoding of the response body
+    // is known.
+    virtual void didCommitProvisionalLoad(WebFrameImpl*, bool isNewNavigation) = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebDragData.cpp b/WebKit/chromium/src/WebDragData.cpp
new file mode 100644
index 0000000..4af1119
--- /dev/null
+++ b/WebKit/chromium/src/WebDragData.cpp
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebDragData.h"
+
+#include "ChromiumDataObject.h"
+#include "WebData.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebVector.h"
+
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebDragDataPrivate : public ChromiumDataObject {
+};
+
+void WebDragData::initialize()
+{
+    assign(static_cast<WebDragDataPrivate*>(ChromiumDataObject::create().releaseRef()));
+}
+
+void WebDragData::reset()
+{
+    assign(0);
+}
+
+void WebDragData::assign(const WebDragData& other)
+{
+    WebDragDataPrivate* p = const_cast<WebDragDataPrivate*>(other.m_private);
+    if (p)
+        p->ref();
+    assign(p);
+}
+
+WebURL WebDragData::url() const
+{
+    ASSERT(!isNull());
+    return m_private->url;
+}
+
+void WebDragData::setURL(const WebURL& url)
+{
+    ensureMutable();
+    m_private->url = url;
+}
+
+WebString WebDragData::urlTitle() const
+{
+    ASSERT(!isNull());
+    return m_private->urlTitle;
+}
+
+void WebDragData::setURLTitle(const WebString& urlTitle)
+{
+    ensureMutable();
+    m_private->urlTitle = urlTitle;
+}
+
+WebString WebDragData::fileExtension() const
+{
+    ASSERT(!isNull());
+    return m_private->fileExtension;
+}
+
+void WebDragData::setFileExtension(const WebString& fileExtension)
+{
+    ensureMutable();
+    m_private->fileExtension = fileExtension;
+}
+
+bool WebDragData::hasFileNames() const
+{
+    ASSERT(!isNull());
+    return !m_private->filenames.isEmpty();
+}
+
+void WebDragData::fileNames(WebVector<WebString>& fileNames) const
+{
+    ASSERT(!isNull());
+    fileNames = m_private->filenames;
+}
+
+void WebDragData::setFileNames(const WebVector<WebString>& fileNames)
+{
+    ensureMutable();
+    m_private->filenames.clear();
+    m_private->filenames.append(fileNames.data(), fileNames.size());
+}
+
+void WebDragData::appendToFileNames(const WebString& fileName)
+{
+    ensureMutable();
+    m_private->filenames.append(fileName);
+}
+
+WebString WebDragData::plainText() const
+{
+    ASSERT(!isNull());
+    return m_private->plainText;
+}
+
+void WebDragData::setPlainText(const WebString& plainText)
+{
+    ensureMutable();
+    m_private->plainText = plainText;
+}
+
+WebString WebDragData::htmlText() const
+{
+    ASSERT(!isNull());
+    return m_private->textHtml;
+}
+
+void WebDragData::setHTMLText(const WebString& htmlText)
+{
+    ensureMutable();
+    m_private->textHtml = htmlText;
+}
+
+WebURL WebDragData::htmlBaseURL() const
+{
+    ASSERT(!isNull());
+    return m_private->htmlBaseUrl;
+}
+
+void WebDragData::setHTMLBaseURL(const WebURL& htmlBaseURL)
+{
+    ensureMutable();
+    m_private->htmlBaseUrl = htmlBaseURL;
+}
+
+WebString WebDragData::fileContentFileName() const
+{
+    ASSERT(!isNull());
+    return m_private->fileContentFilename;
+}
+
+void WebDragData::setFileContentFileName(const WebString& fileName)
+{
+    ensureMutable();
+    m_private->fileContentFilename = fileName;
+}
+
+WebData WebDragData::fileContent() const
+{
+    ASSERT(!isNull());
+    return WebData(m_private->fileContent);
+}
+
+void WebDragData::setFileContent(const WebData& fileContent)
+{
+    ensureMutable();
+    m_private->fileContent = fileContent;
+}
+
+WebDragData::WebDragData(const WTF::PassRefPtr<WebCore::ChromiumDataObject>& data)
+    : m_private(static_cast<WebDragDataPrivate*>(data.releaseRef()))
+{
+}
+
+WebDragData& WebDragData::operator=(const WTF::PassRefPtr<WebCore::ChromiumDataObject>& data)
+{
+    assign(static_cast<WebDragDataPrivate*>(data.releaseRef()));
+    return *this;
+}
+
+WebDragData::operator WTF::PassRefPtr<WebCore::ChromiumDataObject>() const
+{
+    return PassRefPtr<ChromiumDataObject>(const_cast<WebDragDataPrivate*>(m_private));
+}
+
+void WebDragData::assign(WebDragDataPrivate* p)
+{
+    // p is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+void WebDragData::ensureMutable()
+{
+    ASSERT(!isNull());
+    if (!m_private->hasOneRef())
+        assign(static_cast<WebDragDataPrivate*>(m_private->copy().releaseRef()));
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebElement.cpp b/WebKit/chromium/src/WebElement.cpp
new file mode 100644
index 0000000..3f13ee1
--- /dev/null
+++ b/WebKit/chromium/src/WebElement.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebElement.h"
+
+#include "Element.h"
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebElement::WebElement(const WTF::PassRefPtr<WebCore::Element>& elem)
+    : WebNode(elem.releaseRef())
+{
+}
+
+WebElement& WebElement::operator=(const WTF::PassRefPtr<WebCore::Element>& elem)
+{
+    WebNode::assign(elem.releaseRef());
+    return *this;
+}
+
+WebElement::operator WTF::PassRefPtr<Element>() const
+{
+    return PassRefPtr<Element>(static_cast<Element*>(m_private));
+}
+
+} // namespace WebKit
+
diff --git a/WebKit/chromium/src/WebFileChooserCompletionImpl.cpp b/WebKit/chromium/src/WebFileChooserCompletionImpl.cpp
new file mode 100644
index 0000000..4152dc5
--- /dev/null
+++ b/WebKit/chromium/src/WebFileChooserCompletionImpl.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebFileChooserCompletionImpl.h"
+
+namespace WebKit {
+
+WebFileChooserCompletionImpl::WebFileChooserCompletionImpl(PassRefPtr<WebCore::FileChooser> chooser)
+    : m_fileChooser(chooser)
+{
+}
+
+WebFileChooserCompletionImpl::~WebFileChooserCompletionImpl()
+{
+}
+
+void WebFileChooserCompletionImpl::didChooseFile(const WebVector<WebString>& fileNames)
+{
+    if (fileNames.size() == 1)
+        m_fileChooser->chooseFile(fileNames[0]);
+    else {
+        // This clause handles a case of file_names.size()==0 too.
+        Vector<WebCore::String> paths;
+        for (size_t i = 0; i < fileNames.size(); ++i)
+            paths.append(fileNames[i]);
+        m_fileChooser->chooseFiles(paths);
+    }
+    // This object is no longer needed.
+    delete this;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebFileChooserCompletionImpl.h b/WebKit/chromium/src/WebFileChooserCompletionImpl.h
new file mode 100644
index 0000000..fe759e0
--- /dev/null
+++ b/WebKit/chromium/src/WebFileChooserCompletionImpl.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFileChooserCompletionImpl_h
+#define WebFileChooserCompletionImpl_h
+
+// FIXME: These relative paths are a temporary hack to support using this
+// header from webkit/glue.
+#include "../public/WebFileChooserCompletion.h"
+#include "../public/WebString.h"
+#include "../public/WebVector.h"
+
+#include "FileChooser.h"
+
+#include <wtf/PassRefPtr.h>
+
+using WebKit::WebFileChooserCompletion;
+using WebKit::WebString;
+using WebKit::WebVector;
+
+namespace WebKit {
+
+class WebFileChooserCompletionImpl : public WebFileChooserCompletion {
+public:
+    WebFileChooserCompletionImpl(PassRefPtr<WebCore::FileChooser> chooser);
+    ~WebFileChooserCompletionImpl();
+    virtual void didChooseFile(const WebVector<WebString>& fileNames);
+private:
+    RefPtr<WebCore::FileChooser> m_fileChooser;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebFontCache.cpp b/WebKit/chromium/src/WebFontCache.cpp
new file mode 100644
index 0000000..52358ec
--- /dev/null
+++ b/WebKit/chromium/src/WebFontCache.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebFontCache.h"
+
+#include "FontCache.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// static
+size_t WebFontCache::fontDataCount()
+{
+    return fontCache()->fontDataCount();
+}
+
+// static
+size_t WebFontCache::inactiveFontDataCount()
+{
+    return fontCache()->inactiveFontDataCount();
+}
+
+// static
+void WebFontCache::clear()
+{
+    fontCache()->invalidate();
+}
+
+}  // namespace WebKit
diff --git a/WebKit/chromium/src/WebFormElement.cpp b/WebKit/chromium/src/WebFormElement.cpp
new file mode 100644
index 0000000..5471608
--- /dev/null
+++ b/WebKit/chromium/src/WebFormElement.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebFormElement.h"
+
+#include "HTMLFormControlElement.h"
+#include "HTMLFormElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebFormPrivate : public HTMLFormElement {
+};
+
+WebFormElement::WebFormElement(const WTF::PassRefPtr<HTMLFormElement>& e)
+    : WebElement(e.releaseRef())
+{
+}
+
+WebFormElement& WebFormElement::operator=(const WTF::PassRefPtr<HTMLFormElement>& e)
+{
+    WebNode::assign(e.releaseRef());
+    return *this;
+}
+
+WebFormElement::operator WTF::PassRefPtr<WebCore::HTMLFormElement>() const
+{
+    return PassRefPtr<HTMLFormElement>(static_cast<HTMLFormElement*>(m_private));
+}
+
+bool WebFormElement::autoComplete() const
+{
+    return constUnwrap<HTMLFormElement>()->autoComplete();
+}
+
+WebString WebFormElement::action() const
+{
+    return constUnwrap<HTMLFormElement>()->action();
+}
+
+WebString WebFormElement::name() const 
+{
+    return constUnwrap<HTMLFormElement>()->name();
+}
+
+WebString WebFormElement::method() const 
+{
+    return constUnwrap<HTMLFormElement>()->method();
+}
+    
+void WebFormElement::submit()
+{
+    unwrap<HTMLFormElement>()->submit();
+}
+
+void WebFormElement::getNamedElements(const WebString& name,
+                                      WebVector<WebNode>& result)
+{
+    Vector<RefPtr<Node> > tempVector;
+    unwrap<HTMLFormElement>()->getNamedElements(name, tempVector);
+    result.assign(tempVector);
+}
+    
+void WebFormElement::getInputElements(WebVector<WebInputElement>& result) const
+{
+    const HTMLFormElement* form = constUnwrap<HTMLFormElement>();
+    Vector<RefPtr<HTMLInputElement> > tempVector;
+    for (size_t i = 0; i < form->formElements.size(); i++) {
+        if (form->formElements[i]->hasLocalName(HTMLNames::inputTag))
+            tempVector.append(static_cast<HTMLInputElement*>(
+                form->formElements[i]));
+    }
+    result.assign(tempVector);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebFrameImpl.cpp b/WebKit/chromium/src/WebFrameImpl.cpp
new file mode 100644
index 0000000..ab6769f
--- /dev/null
+++ b/WebKit/chromium/src/WebFrameImpl.cpp
@@ -0,0 +1,1915 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// How ownership works
+// -------------------
+//
+// Big oh represents a refcounted relationship: owner O--- ownee
+//
+// WebView (for the toplevel frame only)
+//    O
+//    |
+//   Page O------- Frame (m_mainFrame) O-------O FrameView
+//                   ||
+//                   ||
+//               FrameLoader O-------- WebFrame (via FrameLoaderClient)
+//
+// FrameLoader and Frame are formerly one object that was split apart because
+// it got too big. They basically have the same lifetime, hence the double line.
+//
+// WebFrame is refcounted and has one ref on behalf of the FrameLoader/Frame.
+// This is not a normal reference counted pointer because that would require
+// changing WebKit code that we don't control. Instead, it is created with this
+// ref initially and it is removed when the FrameLoader is getting destroyed.
+//
+// WebFrames are created in two places, first in WebViewImpl when the root
+// frame is created, and second in WebFrame::CreateChildFrame when sub-frames
+// are created. WebKit will hook up this object to the FrameLoader/Frame
+// and the refcount will be correct.
+//
+// How frames are destroyed
+// ------------------------
+//
+// The main frame is never destroyed and is re-used. The FrameLoader is re-used
+// and a reference to the main frame is kept by the Page.
+//
+// When frame content is replaced, all subframes are destroyed. This happens
+// in FrameLoader::detachFromParent for each subframe.
+//
+// Frame going away causes the FrameLoader to get deleted. In FrameLoader's
+// destructor, it notifies its client with frameLoaderDestroyed. This calls
+// WebFrame::Closing and then derefs the WebFrame and will cause it to be
+// deleted (unless an external someone is also holding a reference).
+
+#include "config.h"
+#include "WebFrameImpl.h"
+
+#include "Chrome.h"
+#include "ChromiumBridge.h"
+#include "ClipboardUtilitiesChromium.h"
+#include "Console.h"
+#include "Document.h"
+#include "DocumentFragment.h" // Only needed for ReplaceSelectionCommand.h :(
+#include "DocumentLoader.h"
+#include "DocumentMarker.h"
+#include "DOMUtilitiesPrivate.h"
+#include "DOMWindow.h"
+#include "Editor.h"
+#include "EventHandler.h"
+#include "FormState.h"
+#include "FrameChromium.h"
+#include "FrameLoader.h"
+#include "FrameLoadRequest.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HistoryItem.h"
+#include "HTMLCollection.h"
+#include "HTMLFormElement.h"
+#include "HTMLFrameOwnerElement.h"
+#include "HTMLHeadElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLLinkElement.h"
+#include "HTMLNames.h"
+#include "InspectorController.h"
+#include "markup.h"
+#include "Page.h"
+#include "PlatformContextSkia.h"
+#include "PrintContext.h"
+#include "RenderFrame.h"
+#include "RenderView.h"
+#include "RenderWidget.h"
+#include "ReplaceSelectionCommand.h"
+#include "ResourceHandle.h"
+#include "ResourceRequest.h"
+#include "ScriptController.h"
+#include "ScriptSourceCode.h"
+#include "ScriptValue.h"
+#include "ScrollbarTheme.h"
+#include "ScrollTypes.h"
+#include "SelectionController.h"
+#include "Settings.h"
+#include "SkiaUtils.h"
+#include "SubstituteData.h"
+#include "TextAffinity.h"
+#include "TextIterator.h"
+#include "WebConsoleMessage.h"
+#include "WebDataSourceImpl.h"
+#include "WebFindOptions.h"
+#include "WebFormElement.h"
+#include "WebFrameClient.h"
+#include "WebHistoryItem.h"
+#include "WebInputElement.h"
+#include "WebPasswordAutocompleteListener.h"
+#include "WebRange.h"
+#include "WebRect.h"
+#include "WebScriptSource.h"
+#include "WebSecurityOrigin.h"
+#include "WebSize.h"
+#include "WebURLError.h"
+#include "WebVector.h"
+#include "WebViewImpl.h"
+#include "XPathResult.h"
+
+#include <algorithm>
+#include <wtf/CurrentTime.h>
+
+
+#if PLATFORM(DARWIN)
+#include "LocalCurrentGraphicsContext.h"
+#endif
+
+#if PLATFORM(LINUX)
+#include <gdk/gdk.h>
+#endif
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// Key for a StatsCounter tracking how many WebFrames are active.
+static const char* const webFrameActiveCount = "WebFrameActiveCount";
+
+static const char* const osdType = "application/opensearchdescription+xml";
+static const char* const osdRel = "search";
+
+// Backend for contentAsPlainText, this is a recursive function that gets
+// the text for the current frame and all of its subframes. It will append
+// the text of each frame in turn to the |output| up to |maxChars| length.
+//
+// The |frame| must be non-null.
+static void frameContentAsPlainText(size_t maxChars, Frame* frame,
+                                    Vector<UChar>* output)
+{
+    Document* doc = frame->document();
+    if (!doc)
+        return;
+
+    if (!frame->view())
+        return;
+
+    // TextIterator iterates over the visual representation of the DOM. As such,
+    // it requires you to do a layout before using it (otherwise it'll crash).
+    if (frame->view()->needsLayout())
+        frame->view()->layout();
+
+    // Select the document body.
+    RefPtr<Range> range(doc->createRange());
+    ExceptionCode exception = 0;
+    range->selectNodeContents(doc->body(), exception);
+
+    if (!exception) {
+        // The text iterator will walk nodes giving us text. This is similar to
+        // the plainText() function in TextIterator.h, but we implement the maximum
+        // size and also copy the results directly into a wstring, avoiding the
+        // string conversion.
+        for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
+            const UChar* chars = it.characters();
+            if (!chars) {
+                if (it.length()) {
+                    // It appears from crash reports that an iterator can get into a state
+                    // where the character count is nonempty but the character pointer is
+                    // null. advance()ing it will then just add that many to the null
+                    // pointer which won't be caught in a null check but will crash.
+                    //
+                    // A null pointer and 0 length is common for some nodes.
+                    //
+                    // IF YOU CATCH THIS IN A DEBUGGER please let brettw know. We don't
+                    // currently understand the conditions for this to occur. Ideally, the
+                    // iterators would never get into the condition so we should fix them
+                    // if we can.
+                    ASSERT_NOT_REACHED();
+                    break;
+                }
+
+                // Just got a null node, we can forge ahead!
+                continue;
+            }
+            size_t toAppend =
+                std::min(static_cast<size_t>(it.length()), maxChars - output->size());
+            output->append(chars, toAppend);
+            if (output->size() >= maxChars)
+                return; // Filled up the buffer.
+        }
+    }
+
+    // The separator between frames when the frames are converted to plain text.
+    const UChar frameSeparator[] = { '\n', '\n' };
+    const size_t frameSeparatorLen = 2;
+
+    // Recursively walk the children.
+    FrameTree* frameTree = frame->tree();
+    for (Frame* curChild = frameTree->firstChild(); curChild; curChild = curChild->tree()->nextSibling()) {
+        // Make sure the frame separator won't fill up the buffer, and give up if
+        // it will. The danger is if the separator will make the buffer longer than
+        // maxChars. This will cause the computation above:
+        //   maxChars - output->size()
+        // to be a negative number which will crash when the subframe is added.
+        if (output->size() >= maxChars - frameSeparatorLen)
+            return;
+
+        output->append(frameSeparator, frameSeparatorLen);
+        frameContentAsPlainText(maxChars, curChild, output);
+        if (output->size() >= maxChars)
+            return; // Filled up the buffer.
+    }
+}
+
+// Simple class to override some of PrintContext behavior.
+class ChromePrintContext : public PrintContext, public Noncopyable {
+public:
+    ChromePrintContext(Frame* frame)
+        : PrintContext(frame)
+        , m_printedPageWidth(0)
+    {
+    }
+
+    void begin(float width)
+    {
+        ASSERT(!m_printedPageWidth);
+        m_printedPageWidth = width;
+        PrintContext::begin(m_printedPageWidth);
+    }
+
+    float getPageShrink(int pageNumber) const
+    {
+        IntRect pageRect = m_pageRects[pageNumber];
+        return m_printedPageWidth / pageRect.width();
+    }
+
+    // Spools the printed page, a subrect of m_frame.  Skip the scale step.
+    // NativeTheme doesn't play well with scaling. Scaling is done browser side
+    // instead.  Returns the scale to be applied.
+    float spoolPage(GraphicsContext& ctx, int pageNumber)
+    {
+        IntRect pageRect = m_pageRects[pageNumber];
+        float scale = m_printedPageWidth / pageRect.width();
+
+        ctx.save();
+        ctx.translate(static_cast<float>(-pageRect.x()),
+                      static_cast<float>(-pageRect.y()));
+        ctx.clip(pageRect);
+        m_frame->view()->paintContents(&ctx, pageRect);
+        ctx.restore();
+        return scale;
+    }
+
+private:
+    // Set when printing.
+    float m_printedPageWidth;
+};
+
+static WebDataSource* DataSourceForDocLoader(DocumentLoader* loader)
+{
+    return loader ? WebDataSourceImpl::fromDocumentLoader(loader) : 0;
+}
+
+
+// WebFrame -------------------------------------------------------------------
+
+class WebFrameImpl::DeferredScopeStringMatches {
+public:
+    DeferredScopeStringMatches(WebFrameImpl* webFrame,
+                               int identifier,
+                               const WebString& searchText,
+                               const WebFindOptions& options,
+                               bool reset)
+        : m_timer(this, &DeferredScopeStringMatches::doTimeout)
+        , m_webFrame(webFrame)
+        , m_identifier(identifier)
+        , m_searchText(searchText)
+        , m_options(options)
+        , m_reset(reset)
+    {
+        m_timer.startOneShot(0.0);
+    }
+
+private:
+    void doTimeout(Timer<DeferredScopeStringMatches>*)
+    {
+        m_webFrame->callScopeStringMatches(
+            this, m_identifier, m_searchText, m_options, m_reset);
+    }
+
+    Timer<DeferredScopeStringMatches> m_timer;
+    RefPtr<WebFrameImpl> m_webFrame;
+    int m_identifier;
+    WebString m_searchText;
+    WebFindOptions m_options;
+    bool m_reset;
+};
+
+
+// WebFrame -------------------------------------------------------------------
+
+WebFrame* WebFrame::frameForEnteredContext()
+{
+    Frame* frame =
+        ScriptController::retrieveFrameForEnteredContext();
+    return WebFrameImpl::fromFrame(frame);
+}
+
+WebFrame* WebFrame::frameForCurrentContext()
+{
+    Frame* frame =
+        ScriptController::retrieveFrameForCurrentContext();
+    return WebFrameImpl::fromFrame(frame);
+}
+
+WebString WebFrameImpl::name() const
+{
+    return m_frame->tree()->name();
+}
+
+WebURL WebFrameImpl::url() const
+{
+    const WebDataSource* ds = dataSource();
+    if (!ds)
+        return WebURL();
+    return ds->request().url();
+}
+
+WebURL WebFrameImpl::favIconURL() const
+{
+    FrameLoader* frameLoader = m_frame->loader();
+    // The URL to the favicon may be in the header. As such, only
+    // ask the loader for the favicon if it's finished loading.
+    if (frameLoader->state() == FrameStateComplete) {
+        const KURL& url = frameLoader->iconURL();
+        if (!url.isEmpty())
+            return url;
+    }
+    return WebURL();
+}
+
+WebURL WebFrameImpl::openSearchDescriptionURL() const
+{
+    FrameLoader* frameLoader = m_frame->loader();
+    if (frameLoader->state() == FrameStateComplete
+        && m_frame->document() && m_frame->document()->head()
+        && !m_frame->tree()->parent()) {
+        HTMLHeadElement* head = m_frame->document()->head();
+        if (head) {
+            RefPtr<HTMLCollection> children = head->children();
+            for (Node* child = children->firstItem(); child; child = children->nextItem()) {
+                HTMLLinkElement* linkElement = toHTMLLinkElement(child);
+                if (linkElement
+                    && linkElement->type() == osdType
+                    && linkElement->rel() == osdRel
+                    && !linkElement->href().isEmpty())
+                    return linkElement->href();
+            }
+        }
+    }
+    return WebURL();
+}
+
+WebSize WebFrameImpl::scrollOffset() const
+{
+    FrameView* view = frameView();
+    if (view)
+        return view->scrollOffset();
+
+    return WebSize();
+}
+
+WebSize WebFrameImpl::contentsSize() const
+{
+    return frame()->view()->contentsSize();
+}
+
+int WebFrameImpl::contentsPreferredWidth() const
+{
+    if (m_frame->document() && m_frame->document()->renderView())
+        return m_frame->document()->renderView()->minPrefWidth();
+    return 0;
+}
+
+int WebFrameImpl::documentElementScrollHeight() const
+{
+    if (m_frame->document() && m_frame->document()->documentElement())
+        return m_frame->document()->documentElement()->scrollHeight();
+    return 0;
+}
+
+bool WebFrameImpl::hasVisibleContent() const
+{
+    return frame()->view()->visibleWidth() > 0 && frame()->view()->visibleHeight() > 0;
+}
+
+WebView* WebFrameImpl::view() const
+{
+    return viewImpl();
+}
+
+WebFrame* WebFrameImpl::opener() const
+{
+    Frame* opener = 0;
+    if (m_frame)
+        opener = m_frame->loader()->opener();
+    return fromFrame(opener);
+}
+
+WebFrame* WebFrameImpl::parent() const
+{
+    Frame* parent = 0;
+    if (m_frame)
+        parent = m_frame->tree()->parent();
+    return fromFrame(parent);
+}
+
+WebFrame* WebFrameImpl::top() const
+{
+    if (m_frame)
+        return fromFrame(m_frame->tree()->top());
+
+    return 0;
+}
+
+WebFrame* WebFrameImpl::firstChild() const
+{
+    return fromFrame(frame()->tree()->firstChild());
+}
+
+WebFrame* WebFrameImpl::lastChild() const
+{
+    return fromFrame(frame()->tree()->lastChild());
+}
+
+WebFrame* WebFrameImpl::nextSibling() const
+{
+    return fromFrame(frame()->tree()->nextSibling());
+}
+
+WebFrame* WebFrameImpl::previousSibling() const
+{
+    return fromFrame(frame()->tree()->previousSibling());
+}
+
+WebFrame* WebFrameImpl::traverseNext(bool wrap) const
+{
+    return fromFrame(frame()->tree()->traverseNextWithWrap(wrap));
+}
+
+WebFrame* WebFrameImpl::traversePrevious(bool wrap) const
+{
+    return fromFrame(frame()->tree()->traversePreviousWithWrap(wrap));
+}
+
+WebFrame* WebFrameImpl::findChildByName(const WebString& name) const
+{
+    return fromFrame(frame()->tree()->child(name));
+}
+
+WebFrame* WebFrameImpl::findChildByExpression(const WebString& xpath) const
+{
+    if (xpath.isEmpty())
+        return 0;
+
+    Document* document = m_frame->document();
+
+    ExceptionCode ec = 0;
+    PassRefPtr<XPathResult> xpathResult =
+        document->evaluate(xpath,
+        document,
+        0, // namespace
+        XPathResult::ORDERED_NODE_ITERATOR_TYPE,
+        0, // XPathResult object
+        ec);
+    if (!xpathResult.get())
+        return 0;
+
+    Node* node = xpathResult->iterateNext(ec);
+
+    if (!node || !node->isFrameOwnerElement())
+        return 0;
+    HTMLFrameOwnerElement* frameElement =
+        static_cast<HTMLFrameOwnerElement*>(node);
+    return fromFrame(frameElement->contentFrame());
+}
+
+void WebFrameImpl::forms(WebVector<WebFormElement>& results) const
+{
+    if (!m_frame)
+        return;
+
+    RefPtr<HTMLCollection> forms = m_frame->document()->forms();
+    size_t formCount = forms->length();
+
+    WebVector<WebFormElement> temp(formCount);
+    for (size_t i = 0; i < formCount; ++i) {
+        Node* node = forms->item(i);
+        // Strange but true, sometimes item can be 0.
+        if (node)
+            temp[i] = static_cast<HTMLFormElement*>(node);
+    }
+    results.swap(temp);
+}
+
+WebSecurityOrigin WebFrameImpl::securityOrigin() const
+{
+    if (!m_frame || !m_frame->document())
+        return WebSecurityOrigin();
+
+    return WebSecurityOrigin(m_frame->document()->securityOrigin());
+}
+
+void WebFrameImpl::grantUniversalAccess()
+{
+    ASSERT(m_frame && m_frame->document());
+    if (m_frame && m_frame->document())
+        m_frame->document()->securityOrigin()->grantUniversalAccess();
+}
+
+NPObject* WebFrameImpl::windowObject() const
+{
+    if (!m_frame)
+        return 0;
+
+    return m_frame->script()->windowScriptNPObject();
+}
+
+void WebFrameImpl::bindToWindowObject(const WebString& name, NPObject* object)
+{
+    ASSERT(m_frame);
+    if (!m_frame || !m_frame->script()->isEnabled())
+        return;
+
+    String key = name;
+#if USE(V8)
+    m_frame->script()->bindToWindowObject(m_frame, key, object);
+#else
+    notImplemented();
+#endif
+}
+
+void WebFrameImpl::executeScript(const WebScriptSource& source)
+{
+    m_frame->script()->executeScript(
+        ScriptSourceCode(source.code, source.url, source.startLine));
+}
+
+void WebFrameImpl::executeScriptInNewContext(
+    const WebScriptSource* sourcesIn, unsigned numSources, int extensionGroup)
+{
+    Vector<ScriptSourceCode> sources;
+
+    for (unsigned i = 0; i < numSources; ++i) {
+        sources.append(ScriptSourceCode(
+            sourcesIn[i].code, sourcesIn[i].url, sourcesIn[i].startLine));
+    }
+
+    m_frame->script()->evaluateInNewContext(sources, extensionGroup);
+}
+
+void WebFrameImpl::executeScriptInIsolatedWorld(
+    int worldId, const WebScriptSource* sourcesIn, unsigned numSources,
+    int extensionGroup)
+{
+    Vector<ScriptSourceCode> sources;
+
+    for (unsigned i = 0; i < numSources; ++i) {
+        sources.append(ScriptSourceCode(
+            sourcesIn[i].code, sourcesIn[i].url, sourcesIn[i].startLine));
+    }
+
+    m_frame->script()->evaluateInIsolatedWorld(worldId, sources, extensionGroup);
+}
+
+void WebFrameImpl::addMessageToConsole(const WebConsoleMessage& message)
+{
+    ASSERT(frame());
+
+    MessageLevel webCoreMessageLevel;
+    switch (message.level) {
+    case WebConsoleMessage::LevelTip:
+        webCoreMessageLevel = TipMessageLevel;
+        break;
+    case WebConsoleMessage::LevelLog:
+        webCoreMessageLevel = LogMessageLevel;
+        break;
+    case WebConsoleMessage::LevelWarning:
+        webCoreMessageLevel = WarningMessageLevel;
+        break;
+    case WebConsoleMessage::LevelError:
+        webCoreMessageLevel = ErrorMessageLevel;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    frame()->domWindow()->console()->addMessage(
+        OtherMessageSource, LogMessageType, webCoreMessageLevel, message.text,
+        1, String());
+}
+
+void WebFrameImpl::collectGarbage()
+{
+    if (!m_frame)
+        return;
+    if (!m_frame->settings()->isJavaScriptEnabled())
+        return;
+    // FIXME: Move this to the ScriptController and make it JS neutral.
+#if USE(V8)
+    m_frame->script()->collectGarbage();
+#else
+    notImplemented();
+#endif
+}
+
+#if USE(V8)
+// Returns the V8 context for this frame, or an empty handle if there is none.
+v8::Local<v8::Context> WebFrameImpl::mainWorldScriptContext() const
+{
+    if (!m_frame)
+        return v8::Local<v8::Context>();
+
+    return V8Proxy::mainWorldContext(m_frame);
+}
+#endif
+
+bool WebFrameImpl::insertStyleText(
+    const WebString& css, const WebString& id) {
+    Document* document = frame()->document();
+    if (!document)
+        return false;
+    Element* documentElement = document->documentElement();
+    if (!documentElement)
+        return false;
+
+    ExceptionCode err = 0;
+
+    if (!id.isEmpty()) {
+        Element* oldElement = document->getElementById(id);
+        if (oldElement) {
+            Node* parent = oldElement->parent();
+            if (!parent)
+                return false;
+            parent->removeChild(oldElement, err);
+        }
+    }
+
+    RefPtr<Element> stylesheet = document->createElement(
+        HTMLNames::styleTag, false);
+    if (!id.isEmpty())
+        stylesheet->setAttribute(HTMLNames::idAttr, id);
+    stylesheet->setTextContent(css, err);
+    ASSERT(!err);
+    Node* first = documentElement->firstChild();
+    bool success = documentElement->insertBefore(stylesheet, first, err);
+    ASSERT(success);
+    return success;
+}
+
+void WebFrameImpl::reload()
+{
+    m_frame->loader()->history()->saveDocumentAndScrollState();
+
+    stopLoading();  // Make sure existing activity stops.
+    m_frame->loader()->reload();
+}
+
+void WebFrameImpl::loadRequest(const WebURLRequest& request)
+{
+    ASSERT(!request.isNull());
+    const ResourceRequest& resourceRequest = request.toResourceRequest();
+
+    if (resourceRequest.url().protocolIs("javascript")) {
+        loadJavaScriptURL(resourceRequest.url());
+        return;
+    }
+
+    stopLoading();  // Make sure existing activity stops.
+    m_frame->loader()->load(resourceRequest, false);
+}
+
+void WebFrameImpl::loadHistoryItem(const WebHistoryItem& item)
+{
+    RefPtr<HistoryItem> historyItem = PassRefPtr<HistoryItem>(item);
+    ASSERT(historyItem.get());
+
+    stopLoading();  // Make sure existing activity stops.
+
+    // If there is no currentItem, which happens when we are navigating in
+    // session history after a crash, we need to manufacture one otherwise WebKit
+    // hoarks. This is probably the wrong thing to do, but it seems to work.
+    RefPtr<HistoryItem> currentItem = m_frame->loader()->history()->currentItem();
+    if (!currentItem) {
+        currentItem = HistoryItem::create();
+        currentItem->setLastVisitWasFailure(true);
+        m_frame->loader()->history()->setCurrentItem(currentItem.get());
+        viewImpl()->setCurrentHistoryItem(currentItem.get());
+    }
+
+    m_frame->loader()->history()->goToItem(
+        historyItem.get(), FrameLoadTypeIndexedBackForward);
+}
+
+void WebFrameImpl::loadData(const WebData& data,
+                            const WebString& mimeType,
+                            const WebString& textEncoding,
+                            const WebURL& baseURL,
+                            const WebURL& unreachableURL,
+                            bool replace)
+{
+    SubstituteData substData(data, mimeType, textEncoding, unreachableURL);
+    ASSERT(substData.isValid());
+
+    // If we are loading substitute data to replace an existing load, then
+    // inherit all of the properties of that original request.  This way,
+    // reload will re-attempt the original request.  It is essential that
+    // we only do this when there is an unreachableURL since a non-empty
+    // unreachableURL informs FrameLoader::reload to load unreachableURL
+    // instead of the currently loaded URL.
+    ResourceRequest request;
+    if (replace && !unreachableURL.isEmpty())
+        request = m_frame->loader()->originalRequest();
+    request.setURL(baseURL);
+
+    stopLoading();  // Make sure existing activity stops.
+
+    m_frame->loader()->load(request, substData, false);
+    if (replace) {
+        // Do this to force WebKit to treat the load as replacing the currently
+        // loaded page.
+        m_frame->loader()->setReplacing();
+    }
+}
+
+void WebFrameImpl::loadHTMLString(const WebData& data,
+                                  const WebURL& baseURL,
+                                  const WebURL& unreachableURL,
+                                  bool replace)
+{
+    loadData(data,
+             WebString::fromUTF8("text/html"),
+             WebString::fromUTF8("UTF-8"),
+             baseURL,
+             unreachableURL,
+             replace);
+}
+
+bool WebFrameImpl::isLoading() const
+{
+    if (!m_frame)
+        return false;
+    return m_frame->loader()->isLoading();
+}
+
+void WebFrameImpl::stopLoading()
+{
+    if (!m_frame)
+      return;
+
+    // FIXME: Figure out what we should really do here.  It seems like a bug
+    // that FrameLoader::stopLoading doesn't call stopAllLoaders.
+    m_frame->loader()->stopAllLoaders();
+    m_frame->loader()->stopLoading(UnloadEventPolicyNone);
+}
+
+WebDataSource* WebFrameImpl::provisionalDataSource() const
+{
+    FrameLoader* frameLoader = m_frame->loader();
+
+    // We regard the policy document loader as still provisional.
+    DocumentLoader* docLoader = frameLoader->provisionalDocumentLoader();
+    if (!docLoader)
+        docLoader = frameLoader->policyDocumentLoader();
+
+    return DataSourceForDocLoader(docLoader);
+}
+
+WebDataSource* WebFrameImpl::dataSource() const
+{
+    return DataSourceForDocLoader(m_frame->loader()->documentLoader());
+}
+
+WebHistoryItem WebFrameImpl::previousHistoryItem() const
+{
+    // We use the previous item here because documentState (filled-out forms)
+    // only get saved to history when it becomes the previous item.  The caller
+    // is expected to query the history item after a navigation occurs, after
+    // the desired history item has become the previous entry.
+    return WebHistoryItem(viewImpl()->previousHistoryItem());
+}
+
+WebHistoryItem WebFrameImpl::currentHistoryItem() const
+{
+    m_frame->loader()->history()->saveDocumentAndScrollState();
+
+    return WebHistoryItem(m_frame->page()->backForwardList()->currentItem());
+}
+
+void WebFrameImpl::enableViewSourceMode(bool enable)
+{
+    if (m_frame)
+        m_frame->setInViewSourceMode(enable);
+}
+
+bool WebFrameImpl::isViewSourceModeEnabled() const
+{
+    if (m_frame)
+        return m_frame->inViewSourceMode();
+
+    return false;
+}
+
+void WebFrameImpl::setReferrerForRequest(
+    WebURLRequest& request, const WebURL& referrerURL) {
+    String referrer;
+    if (referrerURL.isEmpty())
+        referrer = m_frame->loader()->outgoingReferrer();
+    else
+        referrer = referrerURL.spec().utf16();
+    if (SecurityOrigin::shouldHideReferrer(request.url(), referrer))
+        return;
+    request.setHTTPHeaderField(WebString::fromUTF8("Referer"), referrer);
+}
+
+void WebFrameImpl::dispatchWillSendRequest(WebURLRequest& request)
+{
+    ResourceResponse response;
+    m_frame->loader()->client()->dispatchWillSendRequest(
+        0, 0, request.toMutableResourceRequest(), response);
+}
+
+void WebFrameImpl::commitDocumentData(const char* data, size_t dataLen)
+{
+    DocumentLoader* documentLoader = m_frame->loader()->documentLoader();
+
+    // Set the text encoding.  This calls begin() for us.  It is safe to call
+    // this multiple times (Mac does: page/mac/WebCoreFrameBridge.mm).
+    bool userChosen = true;
+    String encoding = documentLoader->overrideEncoding();
+    if (encoding.isNull()) {
+        userChosen = false;
+        encoding = documentLoader->response().textEncodingName();
+    }
+    m_frame->loader()->setEncoding(encoding, userChosen);
+
+    // NOTE: mac only does this if there is a document
+    m_frame->loader()->addData(data, dataLen);
+}
+
+unsigned WebFrameImpl::unloadListenerCount() const
+{
+    return frame()->domWindow()->pendingUnloadEventListeners();
+}
+
+bool WebFrameImpl::isProcessingUserGesture() const
+{
+    return frame()->loader()->isProcessingUserGesture();
+}
+
+bool WebFrameImpl::willSuppressOpenerInNewFrame() const
+{
+    return frame()->loader()->suppressOpenerInNewFrame();
+}
+
+void WebFrameImpl::replaceSelection(const WebString& text)
+{
+    RefPtr<DocumentFragment> fragment = createFragmentFromText(
+        frame()->selection()->toNormalizedRange().get(), text);
+    applyCommand(ReplaceSelectionCommand::create(
+        frame()->document(), fragment.get(), false, true, true));
+}
+
+void WebFrameImpl::insertText(const WebString& text)
+{
+    frame()->editor()->insertText(text, 0);
+}
+
+void WebFrameImpl::setMarkedText(
+    const WebString& text, unsigned location, unsigned length)
+{
+    Editor* editor = frame()->editor();
+
+    editor->confirmComposition(text);
+
+    Vector<CompositionUnderline> decorations;
+    editor->setComposition(text, decorations, location, length);
+}
+
+void WebFrameImpl::unmarkText()
+{
+    frame()->editor()->confirmCompositionWithoutDisturbingSelection();
+}
+
+bool WebFrameImpl::hasMarkedText() const
+{
+    return frame()->editor()->hasComposition();
+}
+
+WebRange WebFrameImpl::markedRange() const
+{
+    return frame()->editor()->compositionRange();
+}
+
+bool WebFrameImpl::executeCommand(const WebString& name)
+{
+    ASSERT(frame());
+
+    if (name.length() <= 2)
+        return false;
+
+    // Since we don't have NSControl, we will convert the format of command
+    // string and call the function on Editor directly.
+    String command = name;
+
+    // Make sure the first letter is upper case.
+    command.replace(0, 1, command.substring(0, 1).upper());
+
+    // Remove the trailing ':' if existing.
+    if (command[command.length() - 1] == UChar(':'))
+        command = command.substring(0, command.length() - 1);
+
+    bool rv = true;
+
+    // Specially handling commands that Editor::execCommand does not directly
+    // support.
+    if (command == "DeleteToEndOfParagraph") {
+        Editor* editor = frame()->editor();
+        if (!editor->deleteWithDirection(SelectionController::FORWARD,
+                                         ParagraphBoundary,
+                                         true,
+                                         false)) {
+            editor->deleteWithDirection(SelectionController::FORWARD,
+                                        CharacterGranularity,
+                                        true,
+                                        false);
+        }
+    } else if (command == "Indent")
+        frame()->editor()->indent();
+    else if (command == "Outdent")
+        frame()->editor()->outdent();
+    else if (command == "DeleteBackward")
+        rv = frame()->editor()->command(AtomicString("BackwardDelete")).execute();
+    else if (command == "DeleteForward")
+        rv = frame()->editor()->command(AtomicString("ForwardDelete")).execute();
+    else if (command == "AdvanceToNextMisspelling") {
+        // False must be passed here, or the currently selected word will never be
+        // skipped.
+        frame()->editor()->advanceToNextMisspelling(false);
+    } else if (command == "ToggleSpellPanel")
+        frame()->editor()->showSpellingGuessPanel();
+    else
+        rv = frame()->editor()->command(command).execute();
+    return rv;
+}
+
+bool WebFrameImpl::executeCommand(const WebString& name, const WebString& value)
+{
+    ASSERT(frame());
+    String webName = name;
+
+    // moveToBeginningOfDocument and moveToEndfDocument are only handled by WebKit
+    // for editable nodes.
+    if (!frame()->editor()->canEdit() && webName == "moveToBeginningOfDocument")
+        return viewImpl()->propagateScroll(ScrollUp, ScrollByDocument);
+
+    if (!frame()->editor()->canEdit() && webName == "moveToEndOfDocument")
+        return viewImpl()->propagateScroll(ScrollDown, ScrollByDocument);
+
+    return frame()->editor()->command(webName).execute(value);
+}
+
+bool WebFrameImpl::isCommandEnabled(const WebString& name) const
+{
+    ASSERT(frame());
+    return frame()->editor()->command(name).isEnabled();
+}
+
+void WebFrameImpl::enableContinuousSpellChecking(bool enable)
+{
+    if (enable == isContinuousSpellCheckingEnabled())
+        return;
+    frame()->editor()->toggleContinuousSpellChecking();
+}
+
+bool WebFrameImpl::isContinuousSpellCheckingEnabled() const
+{
+    return frame()->editor()->isContinuousSpellCheckingEnabled();
+}
+
+bool WebFrameImpl::hasSelection() const
+{
+    // frame()->selection()->isNone() never returns true.
+    return (frame()->selection()->start() != frame()->selection()->end());
+}
+
+WebRange WebFrameImpl::selectionRange() const
+{
+    return frame()->selection()->toNormalizedRange();
+}
+
+WebString WebFrameImpl::selectionAsText() const
+{
+    RefPtr<Range> range = frame()->selection()->toNormalizedRange();
+    if (!range.get())
+        return WebString();
+
+    String text = range->text();
+#if PLATFORM(WIN_OS)
+    replaceNewlinesWithWindowsStyleNewlines(text);
+#endif
+    replaceNBSPWithSpace(text);
+    return text;
+}
+
+WebString WebFrameImpl::selectionAsMarkup() const
+{
+    RefPtr<Range> range = frame()->selection()->toNormalizedRange();
+    if (!range.get())
+        return WebString();
+
+    return createMarkup(range.get(), 0);
+}
+
+int WebFrameImpl::printBegin(const WebSize& pageSize)
+{
+    ASSERT(!frame()->document()->isFrameSet());
+
+    m_printContext.set(new ChromePrintContext(frame()));
+    FloatRect rect(0, 0, static_cast<float>(pageSize.width),
+                         static_cast<float>(pageSize.height));
+    m_printContext->begin(rect.width());
+    float pageHeight;
+    // We ignore the overlays calculation for now since they are generated in the
+    // browser. pageHeight is actually an output parameter.
+    m_printContext->computePageRects(rect, 0, 0, 1.0, pageHeight);
+    return m_printContext->pageCount();
+}
+
+float WebFrameImpl::getPrintPageShrink(int page)
+{
+    // Ensure correct state.
+    if (!m_printContext.get() || page < 0) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+
+    return m_printContext->getPageShrink(page);
+}
+
+float WebFrameImpl::printPage(int page, WebCanvas* canvas)
+{
+    // Ensure correct state.
+    if (!m_printContext.get() || page < 0 || !frame() || !frame()->document()) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+
+#if PLATFORM(WIN_OS) || PLATFORM(LINUX) || PLATFORM(FREEBSD)
+    PlatformContextSkia context(canvas);
+    GraphicsContext spool(&context);
+#elif PLATFORM(DARWIN)
+    GraphicsContext spool(canvas);
+    LocalCurrentGraphicsContext localContext(&spool);
+#endif
+
+    return m_printContext->spoolPage(spool, page);
+}
+
+void WebFrameImpl::printEnd()
+{
+    ASSERT(m_printContext.get());
+    if (m_printContext.get())
+        m_printContext->end();
+    m_printContext.clear();
+}
+
+bool WebFrameImpl::find(int identifier,
+                        const WebString& searchText,
+                        const WebFindOptions& options,
+                        bool wrapWithinFrame,
+                        WebRect* selectionRect)
+{
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+
+    if (!options.findNext)
+        frame()->page()->unmarkAllTextMatches();
+    else
+        setMarkerActive(m_activeMatch.get(), false);  // Active match is changing.
+
+    // Starts the search from the current selection.
+    bool startInSelection = true;
+
+    // If the user has selected something since the last Find operation we want
+    // to start from there. Otherwise, we start searching from where the last Find
+    // operation left off (either a Find or a FindNext operation).
+    VisibleSelection selection(frame()->selection()->selection());
+    bool activeSelection = !selection.isNone();
+    if (!activeSelection && m_activeMatch) {
+        selection = VisibleSelection(m_activeMatch.get());
+        frame()->selection()->setSelection(selection);
+    }
+
+    ASSERT(frame() && frame()->view());
+    bool found = frame()->findString(
+        searchText, options.forward, options.matchCase, wrapWithinFrame,
+        startInSelection);
+    if (found) {
+        // Store which frame was active. This will come in handy later when we
+        // change the active match ordinal below.
+        WebFrameImpl* oldActiveFrame = mainFrameImpl->m_activeMatchFrame;
+        // Set this frame as the active frame (the one with the active highlight).
+        mainFrameImpl->m_activeMatchFrame = this;
+
+        // We found something, so we can now query the selection for its position.
+        VisibleSelection newSelection(frame()->selection()->selection());
+        IntRect currSelectionRect;
+
+        // If we thought we found something, but it couldn't be selected (perhaps
+        // because it was marked -webkit-user-select: none), we can't set it to
+        // be active but we still continue searching. This matches Safari's
+        // behavior, including some oddities when selectable and un-selectable text
+        // are mixed on a page: see https://bugs.webkit.org/show_bug.cgi?id=19127.
+        if (newSelection.isNone() || (newSelection.start() == newSelection.end()))
+            m_activeMatch = 0;
+        else {
+            m_activeMatch = newSelection.toNormalizedRange();
+            currSelectionRect = m_activeMatch->boundingBox();
+            setMarkerActive(m_activeMatch.get(), true);  // Active.
+            // WebKit draws the highlighting for all matches.
+            executeCommand(WebString::fromUTF8("Unselect"));
+        }
+
+        if (!options.findNext || activeSelection) {
+            // This is either a Find operation or a Find-next from a new start point
+            // due to a selection, so we set the flag to ask the scoping effort
+            // to find the active rect for us so we can update the ordinal (n of m).
+            m_locatingActiveRect = true;
+        } else {
+            if (oldActiveFrame != this) {
+                // If the active frame has changed it means that we have a multi-frame
+                // page and we just switch to searching in a new frame. Then we just
+                // want to reset the index.
+                if (options.forward)
+                    m_activeMatchIndex = 0;
+                else
+                    m_activeMatchIndex = m_lastMatchCount - 1;
+            } else {
+                // We are still the active frame, so increment (or decrement) the
+                // |m_activeMatchIndex|, wrapping if needed (on single frame pages).
+                options.forward ? ++m_activeMatchIndex : --m_activeMatchIndex;
+                if (m_activeMatchIndex + 1 > m_lastMatchCount)
+                    m_activeMatchIndex = 0;
+                if (m_activeMatchIndex == -1)
+                    m_activeMatchIndex = m_lastMatchCount - 1;
+            }
+            if (selectionRect) {
+                WebRect rect = frame()->view()->convertToContainingWindow(currSelectionRect);
+                rect.x -= frameView()->scrollOffset().width();
+                rect.y -= frameView()->scrollOffset().height();
+                *selectionRect = rect;
+
+                reportFindInPageSelection(rect, m_activeMatchIndex + 1, identifier);
+            }
+        }
+    } else {
+        // Nothing was found in this frame.
+        m_activeMatch = 0;
+
+        // Erase all previous tickmarks and highlighting.
+        invalidateArea(InvalidateAll);
+    }
+
+    return found;
+}
+
+void WebFrameImpl::stopFinding(bool clearSelection)
+{
+    if (!clearSelection)
+        setFindEndstateFocusAndSelection();
+    cancelPendingScopingEffort();
+
+    // Remove all markers for matches found and turn off the highlighting.
+    if (!parent())
+        frame()->document()->removeMarkers(DocumentMarker::TextMatch);
+    frame()->setMarkedTextMatchesAreHighlighted(false);
+
+    // Let the frame know that we don't want tickmarks or highlighting anymore.
+    invalidateArea(InvalidateAll);
+}
+
+void WebFrameImpl::scopeStringMatches(int identifier,
+                                      const WebString& searchText,
+                                      const WebFindOptions& options,
+                                      bool reset)
+{
+    if (!shouldScopeMatches(searchText))
+        return;
+
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+
+    if (reset) {
+        // This is a brand new search, so we need to reset everything.
+        // Scoping is just about to begin.
+        m_scopingComplete = false;
+        // Clear highlighting for this frame.
+        if (frame()->markedTextMatchesAreHighlighted())
+            frame()->page()->unmarkAllTextMatches();
+        // Clear the counters from last operation.
+        m_lastMatchCount = 0;
+        m_nextInvalidateAfter = 0;
+
+        m_resumeScopingFromRange = 0;
+
+        mainFrameImpl->m_framesScopingCount++;
+
+        // Now, defer scoping until later to allow find operation to finish quickly.
+        scopeStringMatchesSoon(
+            identifier,
+            searchText,
+            options,
+            false);  // false=we just reset, so don't do it again.
+        return;
+    }
+
+    RefPtr<Range> searchRange(rangeOfContents(frame()->document()));
+
+    ExceptionCode ec = 0, ec2 = 0;
+    if (m_resumeScopingFromRange.get()) {
+        // This is a continuation of a scoping operation that timed out and didn't
+        // complete last time around, so we should start from where we left off.
+        searchRange->setStart(m_resumeScopingFromRange->startContainer(),
+                              m_resumeScopingFromRange->startOffset(ec2) + 1,
+                              ec);
+        if (ec || ec2) {
+            if (ec2)  // A non-zero |ec| happens when navigating during search.
+                ASSERT_NOT_REACHED();
+            return;
+        }
+    }
+
+    // This timeout controls how long we scope before releasing control.  This
+    // value does not prevent us from running for longer than this, but it is
+    // periodically checked to see if we have exceeded our allocated time.
+    const double maxScopingDuration = 0.1;  // seconds
+
+    int matchCount = 0;
+    bool timedOut = false;
+    double startTime = currentTime();
+    do {
+        // Find next occurrence of the search string.
+        // FIXME: (http://b/1088245) This WebKit operation may run for longer
+        // than the timeout value, and is not interruptible as it is currently
+        // written. We may need to rewrite it with interruptibility in mind, or
+        // find an alternative.
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(),
+                                                searchText,
+                                                true,
+                                                options.matchCase));
+        if (resultRange->collapsed(ec)) {
+            if (!resultRange->startContainer()->isInShadowTree())
+                break;
+
+            searchRange = rangeOfContents(frame()->document());
+            searchRange->setStartAfter(
+                resultRange->startContainer()->shadowAncestorNode(), ec);
+            continue;
+        }
+
+        // A non-collapsed result range can in some funky whitespace cases still not
+        // advance the range's start position (4509328). Break to avoid infinite
+        // loop. (This function is based on the implementation of
+        // Frame::markAllMatchesForText, which is where this safeguard comes from).
+        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
+        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
+            break;
+
+        // Only treat the result as a match if it is visible
+        if (frame()->editor()->insideVisibleArea(resultRange.get())) {
+            ++matchCount;
+
+            setStart(searchRange.get(), newStart);
+            Node* shadowTreeRoot = searchRange->shadowTreeRootNode();
+            if (searchRange->collapsed(ec) && shadowTreeRoot)
+                searchRange->setEnd(shadowTreeRoot, shadowTreeRoot->childNodeCount(), ec);
+
+            // Catch a special case where Find found something but doesn't know what
+            // the bounding box for it is. In this case we set the first match we find
+            // as the active rect.
+            IntRect resultBounds = resultRange->boundingBox();
+            IntRect activeSelectionRect;
+            if (m_locatingActiveRect) {
+                activeSelectionRect = m_activeMatch.get() ?
+                    m_activeMatch->boundingBox() : resultBounds;
+            }
+
+            // If the Find function found a match it will have stored where the
+            // match was found in m_activeSelectionRect on the current frame. If we
+            // find this rect during scoping it means we have found the active
+            // tickmark.
+            bool foundActiveMatch = false;
+            if (m_locatingActiveRect && (activeSelectionRect == resultBounds)) {
+                // We have found the active tickmark frame.
+                mainFrameImpl->m_activeMatchFrame = this;
+                foundActiveMatch = true;
+                // We also know which tickmark is active now.
+                m_activeMatchIndex = matchCount - 1;
+                // To stop looking for the active tickmark, we set this flag.
+                m_locatingActiveRect = false;
+
+                // Notify browser of new location for the selected rectangle.
+                resultBounds.move(-frameView()->scrollOffset().width(),
+                                  -frameView()->scrollOffset().height());
+                reportFindInPageSelection(
+                    frame()->view()->convertToContainingWindow(resultBounds),
+                    m_activeMatchIndex + 1,
+                    identifier);
+            }
+
+            addMarker(resultRange.get(), foundActiveMatch);
+        }
+
+        m_resumeScopingFromRange = resultRange;
+        timedOut = (currentTime() - startTime) >= maxScopingDuration;
+    } while (!timedOut);
+
+    // Remember what we search for last time, so we can skip searching if more
+    // letters are added to the search string (and last outcome was 0).
+    m_lastSearchString = searchText;
+
+    if (matchCount > 0) {
+        frame()->setMarkedTextMatchesAreHighlighted(true);
+
+        m_lastMatchCount += matchCount;
+
+        // Let the mainframe know how much we found during this pass.
+        mainFrameImpl->increaseMatchCount(matchCount, identifier);
+    }
+
+    if (timedOut) {
+        // If we found anything during this pass, we should redraw. However, we
+        // don't want to spam too much if the page is extremely long, so if we
+        // reach a certain point we start throttling the redraw requests.
+        if (matchCount > 0)
+            invalidateIfNecessary();
+
+        // Scoping effort ran out of time, lets ask for another time-slice.
+        scopeStringMatchesSoon(
+            identifier,
+            searchText,
+            options,
+            false);  // don't reset.
+        return;  // Done for now, resume work later.
+    }
+
+    // This frame has no further scoping left, so it is done. Other frames might,
+    // of course, continue to scope matches.
+    m_scopingComplete = true;
+    mainFrameImpl->m_framesScopingCount--;
+
+    // If this is the last frame to finish scoping we need to trigger the final
+    // update to be sent.
+    if (!mainFrameImpl->m_framesScopingCount)
+        mainFrameImpl->increaseMatchCount(0, identifier);
+
+    // This frame is done, so show any scrollbar tickmarks we haven't drawn yet.
+    invalidateArea(InvalidateScrollbar);
+}
+
+void WebFrameImpl::cancelPendingScopingEffort()
+{
+    deleteAllValues(m_deferredScopingWork);
+    m_deferredScopingWork.clear();
+
+    m_activeMatchIndex = -1;
+}
+
+void WebFrameImpl::increaseMatchCount(int count, int identifier)
+{
+    // This function should only be called on the mainframe.
+    ASSERT(!parent());
+
+    m_totalMatchCount += count;
+
+    // Update the UI with the latest findings.
+    if (client())
+        client()->reportFindInPageMatchCount(identifier, m_totalMatchCount, !m_framesScopingCount);
+}
+
+void WebFrameImpl::reportFindInPageSelection(const WebRect& selectionRect,
+                                             int activeMatchOrdinal,
+                                             int identifier)
+{
+    // Update the UI with the latest selection rect.
+    if (client())
+        client()->reportFindInPageSelection(identifier, ordinalOfFirstMatchForFrame(this) + activeMatchOrdinal, selectionRect);
+}
+
+void WebFrameImpl::resetMatchCount()
+{
+    m_totalMatchCount = 0;
+    m_framesScopingCount = 0;
+}
+
+WebURL WebFrameImpl::completeURL(const WebString& url) const
+{
+    if (!m_frame || !m_frame->document())
+        return WebURL();
+
+    return m_frame->document()->completeURL(url);
+}
+
+WebString WebFrameImpl::contentAsText(size_t maxChars) const
+{
+    if (!m_frame)
+        return WebString();
+
+    Vector<UChar> text;
+    frameContentAsPlainText(maxChars, m_frame, &text);
+    return String::adopt(text);
+}
+
+WebString WebFrameImpl::contentAsMarkup() const
+{
+    return createFullMarkup(m_frame->document());
+}
+
+// WebFrameImpl public ---------------------------------------------------------
+
+int WebFrameImpl::m_liveObjectCount = 0;
+
+PassRefPtr<WebFrameImpl> WebFrameImpl::create(WebFrameClient* client)
+{
+    return adoptRef(new WebFrameImpl(client));
+}
+
+WebFrameImpl::WebFrameImpl(WebFrameClient* client)
+    : m_frameLoaderClient(this)
+    , m_client(client)
+    , m_activeMatchFrame(0)
+    , m_activeMatchIndex(-1)
+    , m_locatingActiveRect(false)
+    , m_resumeScopingFromRange(0)
+    , m_lastMatchCount(-1)
+    , m_totalMatchCount(-1)
+    , m_framesScopingCount(-1)
+    , m_scopingComplete(false)
+    , m_nextInvalidateAfter(0)
+{
+    ChromiumBridge::incrementStatsCounter(webFrameActiveCount);
+    m_liveObjectCount++;
+}
+
+WebFrameImpl::~WebFrameImpl()
+{
+    ChromiumBridge::decrementStatsCounter(webFrameActiveCount);
+    m_liveObjectCount--;
+
+    cancelPendingScopingEffort();
+    clearPasswordListeners();
+}
+
+void WebFrameImpl::initializeAsMainFrame(WebViewImpl* webViewImpl)
+{
+    RefPtr<Frame> frame = Frame::create(webViewImpl->page(), 0, &m_frameLoaderClient);
+    m_frame = frame.get();
+
+    // Add reference on behalf of FrameLoader.  See comments in
+    // WebFrameLoaderClient::frameLoaderDestroyed for more info.
+    ref();
+
+    // We must call init() after m_frame is assigned because it is referenced
+    // during init().
+    m_frame->init();
+}
+
+PassRefPtr<Frame> WebFrameImpl::createChildFrame(
+    const FrameLoadRequest& request, HTMLFrameOwnerElement* ownerElement)
+{
+    RefPtr<WebFrameImpl> webframe(adoptRef(new WebFrameImpl(m_client)));
+
+    // Add an extra ref on behalf of the Frame/FrameLoader, which references the
+    // WebFrame via the FrameLoaderClient interface. See the comment at the top
+    // of this file for more info.
+    webframe->ref();
+
+    RefPtr<Frame> childFrame = Frame::create(
+        m_frame->page(), ownerElement, &webframe->m_frameLoaderClient);
+    webframe->m_frame = childFrame.get();
+
+    childFrame->tree()->setName(request.frameName());
+
+    m_frame->tree()->appendChild(childFrame);
+
+    // Frame::init() can trigger onload event in the parent frame,
+    // which may detach this frame and trigger a null-pointer access
+    // in FrameTree::removeChild. Move init() after appendChild call
+    // so that webframe->mFrame is in the tree before triggering
+    // onload event handler.
+    // Because the event handler may set webframe->mFrame to null,
+    // it is necessary to check the value after calling init() and
+    // return without loading URL.
+    // (b:791612)
+    childFrame->init();      // create an empty document
+    if (!childFrame->tree()->parent())
+        return 0;
+
+    m_frame->loader()->loadURLIntoChildFrame(
+        request.resourceRequest().url(),
+        request.resourceRequest().httpReferrer(),
+        childFrame.get());
+
+    // A synchronous navigation (about:blank) would have already processed
+    // onload, so it is possible for the frame to have already been destroyed by
+    // script in the page.
+    if (!childFrame->tree()->parent())
+        return 0;
+
+    return childFrame.release();
+}
+
+void WebFrameImpl::layout()
+{
+    // layout this frame
+    FrameView* view = m_frame->view();
+    if (view)
+        view->layoutIfNeededRecursive();
+}
+
+void WebFrameImpl::paint(WebCanvas* canvas, const WebRect& rect)
+{
+    if (rect.isEmpty())
+        return;
+    IntRect dirtyRect(rect);
+#if WEBKIT_USING_CG
+    GraphicsContext gc(canvas);
+    LocalCurrentGraphicsContext localContext(&gc);
+#elif WEBKIT_USING_SKIA
+    PlatformContextSkia context(canvas);
+
+    // PlatformGraphicsContext is actually a pointer to PlatformContextSkia
+    GraphicsContext gc(reinterpret_cast<PlatformGraphicsContext*>(&context));
+#else
+    notImplemented();
+#endif
+    gc.save();
+    if (m_frame->document() && frameView()) {
+        gc.clip(dirtyRect);
+        frameView()->paint(&gc, dirtyRect);
+        m_frame->page()->inspectorController()->drawNodeHighlight(gc);
+    } else
+        gc.fillRect(dirtyRect, Color::white, DeviceColorSpace);
+    gc.restore();
+}
+
+void WebFrameImpl::createFrameView()
+{
+    ASSERT(m_frame); // If m_frame doesn't exist, we probably didn't init properly.
+
+    Page* page = m_frame->page();
+    ASSERT(page);
+    ASSERT(page->mainFrame());
+
+    bool isMainFrame = m_frame == page->mainFrame();
+    if (isMainFrame && m_frame->view())
+        m_frame->view()->setParentVisible(false);
+
+    m_frame->setView(0);
+
+    WebViewImpl* webView = viewImpl();
+
+    RefPtr<FrameView> view;
+    if (isMainFrame)
+        view = FrameView::create(m_frame, webView->size());
+    else
+        view = FrameView::create(m_frame);
+
+    m_frame->setView(view);
+
+    if (webView->isTransparent())
+        view->setTransparent(true);
+
+    // FIXME: The Mac code has a comment about this possibly being unnecessary.
+    // See installInFrame in WebCoreFrameBridge.mm
+    if (m_frame->ownerRenderer())
+        m_frame->ownerRenderer()->setWidget(view.get());
+
+    if (HTMLFrameOwnerElement* owner = m_frame->ownerElement())
+        view->setCanHaveScrollbars(owner->scrollingMode() != ScrollbarAlwaysOff);
+
+    if (isMainFrame)
+        view->setParentVisible(true);
+}
+
+WebFrameImpl* WebFrameImpl::fromFrame(Frame* frame)
+{
+    if (!frame)
+        return 0;
+
+    return static_cast<FrameLoaderClientImpl*>(frame->loader()->client())->webFrame();
+}
+
+WebViewImpl* WebFrameImpl::viewImpl() const
+{
+    if (!m_frame)
+        return 0;
+
+    return WebViewImpl::fromPage(m_frame->page());
+}
+
+WebDataSourceImpl* WebFrameImpl::dataSourceImpl() const
+{
+    return static_cast<WebDataSourceImpl*>(dataSource());
+}
+
+WebDataSourceImpl* WebFrameImpl::provisionalDataSourceImpl() const
+{
+    return static_cast<WebDataSourceImpl*>(provisionalDataSource());
+}
+
+void WebFrameImpl::setFindEndstateFocusAndSelection()
+{
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+
+    if (this == mainFrameImpl->activeMatchFrame() && m_activeMatch.get()) {
+        // If the user has set the selection since the match was found, we
+        // don't focus anything.
+        VisibleSelection selection(frame()->selection()->selection());
+        if (!selection.isNone())
+            return;
+
+        // Try to find the first focusable node up the chain, which will, for
+        // example, focus links if we have found text within the link.
+        Node* node = m_activeMatch->firstNode();
+        while (node && !node->isFocusable() && node != frame()->document())
+            node = node->parent();
+
+        if (node && node != frame()->document()) {
+            // Found a focusable parent node. Set focus to it.
+            frame()->document()->setFocusedNode(node);
+            return;
+        }
+
+        // Iterate over all the nodes in the range until we find a focusable node.
+        // This, for example, sets focus to the first link if you search for
+        // text and text that is within one or more links.
+        node = m_activeMatch->firstNode();
+        while (node && node != m_activeMatch->pastLastNode()) {
+            if (node->isFocusable()) {
+                frame()->document()->setFocusedNode(node);
+                return;
+            }
+            node = node->traverseNextNode();
+        }
+
+        // No node related to the active match was focusable, so set the
+        // active match as the selection (so that when you end the Find session,
+        // you'll have the last thing you found highlighted) and make sure that
+        // we have nothing focused (otherwise you might have text selected but
+        // a link focused, which is weird).
+        frame()->selection()->setSelection(m_activeMatch.get());
+        frame()->document()->setFocusedNode(0);
+    }
+}
+
+void WebFrameImpl::didFail(const ResourceError& error, bool wasProvisional)
+{
+    if (!client())
+        return;
+    WebURLError webError = error;
+    if (wasProvisional)
+        client()->didFailProvisionalLoad(this, webError);
+    else
+        client()->didFailLoad(this, webError);
+}
+
+void WebFrameImpl::setAllowsScrolling(bool flag)
+{
+    m_frame->view()->setCanHaveScrollbars(flag);
+}
+
+void WebFrameImpl::registerPasswordListener(
+    WebInputElement inputElement,
+    WebPasswordAutocompleteListener* listener)
+{
+    RefPtr<HTMLInputElement> element = inputElement.operator PassRefPtr<HTMLInputElement>();
+    ASSERT(m_passwordListeners.find(element) == m_passwordListeners.end());
+    m_passwordListeners.set(element, listener);
+}
+
+WebPasswordAutocompleteListener* WebFrameImpl::getPasswordListener(
+    HTMLInputElement* inputElement)
+{
+    return m_passwordListeners.get(RefPtr<HTMLInputElement>(inputElement));
+}
+
+// WebFrameImpl private --------------------------------------------------------
+
+void WebFrameImpl::closing()
+{
+    m_frame = 0;
+}
+
+void WebFrameImpl::invalidateArea(AreaToInvalidate area)
+{
+    ASSERT(frame() && frame()->view());
+    FrameView* view = frame()->view();
+
+    if ((area & InvalidateAll) == InvalidateAll)
+        view->invalidateRect(view->frameRect());
+    else {
+        if ((area & InvalidateContentArea) == InvalidateContentArea) {
+            IntRect contentArea(
+                view->x(), view->y(), view->visibleWidth(), view->visibleHeight());
+            view->invalidateRect(contentArea);
+        }
+
+        if ((area & InvalidateScrollbar) == InvalidateScrollbar) {
+            // Invalidate the vertical scroll bar region for the view.
+            IntRect scrollBarVert(
+                view->x() + view->visibleWidth(), view->y(),
+                ScrollbarTheme::nativeTheme()->scrollbarThickness(),
+                view->visibleHeight());
+            view->invalidateRect(scrollBarVert);
+        }
+    }
+}
+
+void WebFrameImpl::addMarker(Range* range, bool activeMatch)
+{
+    // Use a TextIterator to visit the potentially multiple nodes the range
+    // covers.
+    TextIterator markedText(range);
+    for (; !markedText.atEnd(); markedText.advance()) {
+        RefPtr<Range> textPiece = markedText.range();
+        int exception = 0;
+
+        DocumentMarker marker = {
+            DocumentMarker::TextMatch,
+            textPiece->startOffset(exception),
+            textPiece->endOffset(exception),
+            "",
+            activeMatch
+        };
+
+        if (marker.endOffset > marker.startOffset) {
+            // Find the node to add a marker to and add it.
+            Node* node = textPiece->startContainer(exception);
+            frame()->document()->addMarker(node, marker);
+
+            // Rendered rects for markers in WebKit are not populated until each time
+            // the markers are painted. However, we need it to happen sooner, because
+            // the whole purpose of tickmarks on the scrollbar is to show where
+            // matches off-screen are (that haven't been painted yet).
+            Vector<DocumentMarker> markers = frame()->document()->markersForNode(node);
+            frame()->document()->setRenderedRectForMarker(
+                textPiece->startContainer(exception),
+                markers[markers.size() - 1],
+                range->boundingBox());
+        }
+    }
+}
+
+void WebFrameImpl::setMarkerActive(Range* range, bool active)
+{
+    if (!range)
+        return;
+
+    frame()->document()->setMarkersActive(range, active);
+}
+
+int WebFrameImpl::ordinalOfFirstMatchForFrame(WebFrameImpl* frame) const
+{
+    int ordinal = 0;
+    WebFrameImpl* mainFrameImpl = viewImpl()->mainFrameImpl();
+    // Iterate from the main frame up to (but not including) |frame| and
+    // add up the number of matches found so far.
+    for (WebFrameImpl* it = mainFrameImpl;
+         it != frame;
+         it = static_cast<WebFrameImpl*>(it->traverseNext(true))) {
+        if (it->m_lastMatchCount > 0)
+            ordinal += it->m_lastMatchCount;
+    }
+    return ordinal;
+}
+
+bool WebFrameImpl::shouldScopeMatches(const String& searchText)
+{
+    // Don't scope if we can't find a frame or if the frame is not visible.
+    // The user may have closed the tab/application, so abort.
+    if (!frame() || !hasVisibleContent())
+        return false;
+
+    ASSERT(frame()->document() && frame()->view());
+
+    // If the frame completed the scoping operation and found 0 matches the last
+    // time it was searched, then we don't have to search it again if the user is
+    // just adding to the search string or sending the same search string again.
+    if (m_scopingComplete && !m_lastSearchString.isEmpty() && !m_lastMatchCount) {
+        // Check to see if the search string prefixes match.
+        String previousSearchPrefix =
+            searchText.substring(0, m_lastSearchString.length());
+
+        if (previousSearchPrefix == m_lastSearchString)
+            return false;  // Don't search this frame, it will be fruitless.
+    }
+
+    return true;
+}
+
+void WebFrameImpl::scopeStringMatchesSoon(int identifier, const WebString& searchText,
+                                          const WebFindOptions& options, bool reset)
+{
+    m_deferredScopingWork.append(new DeferredScopeStringMatches(
+        this, identifier, searchText, options, reset));
+}
+
+void WebFrameImpl::callScopeStringMatches(DeferredScopeStringMatches* caller,
+                                          int identifier, const WebString& searchText,
+                                          const WebFindOptions& options, bool reset)
+{
+    m_deferredScopingWork.remove(m_deferredScopingWork.find(caller));
+
+    scopeStringMatches(identifier, searchText, options, reset);
+
+    // This needs to happen last since searchText is passed by reference.
+    delete caller;
+}
+
+void WebFrameImpl::invalidateIfNecessary()
+{
+    if (m_lastMatchCount > m_nextInvalidateAfter) {
+        // FIXME: (http://b/1088165) Optimize the drawing of the tickmarks and
+        // remove this. This calculation sets a milestone for when next to
+        // invalidate the scrollbar and the content area. We do this so that we
+        // don't spend too much time drawing the scrollbar over and over again.
+        // Basically, up until the first 500 matches there is no throttle.
+        // After the first 500 matches, we set set the milestone further and
+        // further out (750, 1125, 1688, 2K, 3K).
+        static const int startSlowingDownAfter = 500;
+        static const int slowdown = 750;
+        int i = (m_lastMatchCount / startSlowingDownAfter);
+        m_nextInvalidateAfter += i * slowdown;
+
+        invalidateArea(InvalidateScrollbar);
+    }
+}
+
+void WebFrameImpl::clearPasswordListeners()
+{
+    deleteAllValues(m_passwordListeners);
+    m_passwordListeners.clear();
+}
+
+void WebFrameImpl::loadJavaScriptURL(const KURL& url)
+{
+    // This is copied from FrameLoader::executeIfJavaScriptURL.  Unfortunately,
+    // we cannot just use that method since it is private, and it also doesn't
+    // quite behave as we require it to for bookmarklets.  The key difference is
+    // that we need to suppress loading the string result from evaluating the JS
+    // URL if executing the JS URL resulted in a location change.  We also allow
+    // a JS URL to be loaded even if scripts on the page are otherwise disabled.
+
+    if (!m_frame->document() || !m_frame->page())
+        return;
+
+    String script = decodeURLEscapeSequences(url.string().substring(strlen("javascript:")));
+    ScriptValue result = m_frame->script()->executeScript(script, true);
+
+    String scriptResult;
+    if (!result.getString(scriptResult))
+        return;
+
+    SecurityOrigin* securityOrigin = m_frame->document()->securityOrigin();
+
+    if (!m_frame->redirectScheduler()->locationChangePending()) {
+        m_frame->loader()->stopAllLoaders();
+        m_frame->loader()->begin(m_frame->loader()->url(), true, securityOrigin);
+        m_frame->loader()->write(scriptResult);
+        m_frame->loader()->end();
+    }
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebFrameImpl.h b/WebKit/chromium/src/WebFrameImpl.h
new file mode 100644
index 0000000..2cd332a
--- /dev/null
+++ b/WebKit/chromium/src/WebFrameImpl.h
@@ -0,0 +1,355 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFrameImpl_h
+#define WebFrameImpl_h
+
+// FIXME: remove this relative path once consumers from glue are removed.
+#include "../public/WebFrame.h"
+#include "Frame.h"
+#include "FrameLoaderClientImpl.h"
+#include "PlatformString.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+class HistoryItem;
+class KURL;
+class Node;
+class Range;
+class SubstituteData;
+struct WindowFeatures;
+}
+
+namespace WebKit {
+class ChromePrintContext;
+class WebDataSourceImpl;
+class WebInputElement;
+class WebFrameClient;
+class WebPasswordAutocompleteListener;
+class WebView;
+class WebViewImpl;
+
+// Implementation of WebFrame, note that this is a reference counted object.
+class WebFrameImpl : public WebFrame, public RefCounted<WebFrameImpl> {
+public:
+    // WebFrame methods:
+    virtual WebString name() const;
+    virtual WebURL url() const;
+    virtual WebURL favIconURL() const;
+    virtual WebURL openSearchDescriptionURL() const;
+    virtual WebSize scrollOffset() const;
+    virtual WebSize contentsSize() const;
+    virtual int contentsPreferredWidth() const;
+    virtual int documentElementScrollHeight() const;
+    virtual bool hasVisibleContent() const;
+    virtual WebView* view() const;
+    virtual WebFrame* opener() const;
+    virtual WebFrame* parent() const;
+    virtual WebFrame* top() const;
+    virtual WebFrame* firstChild() const;
+    virtual WebFrame* lastChild() const;
+    virtual WebFrame* nextSibling() const;
+    virtual WebFrame* previousSibling() const;
+    virtual WebFrame* traverseNext(bool wrap) const;
+    virtual WebFrame* traversePrevious(bool wrap) const;
+    virtual WebFrame* findChildByName(const WebString&) const;
+    virtual WebFrame* findChildByExpression(const WebString&) const;
+    virtual void forms(WebVector<WebFormElement>&) const;
+    virtual WebSecurityOrigin securityOrigin() const;
+    virtual void grantUniversalAccess();
+    virtual NPObject* windowObject() const;
+    virtual void bindToWindowObject(const WebString& name, NPObject*);
+    virtual void executeScript(const WebScriptSource&);
+    virtual void executeScriptInNewContext(
+        const WebScriptSource* sources, unsigned numSources, int extensionGroup);
+    virtual void executeScriptInIsolatedWorld(
+        int worldId, const WebScriptSource* sources, unsigned numSources,
+        int extensionGroup);
+    virtual void addMessageToConsole(const WebConsoleMessage&);
+    virtual void collectGarbage();
+#if WEBKIT_USING_V8
+    virtual v8::Local<v8::Context> mainWorldScriptContext() const;
+#endif
+    virtual bool insertStyleText(const WebString& css, const WebString& id);
+    virtual void reload();
+    virtual void loadRequest(const WebURLRequest&);
+    virtual void loadHistoryItem(const WebHistoryItem&);
+    virtual void loadData(
+        const WebData&, const WebString& mimeType, const WebString& textEncoding,
+        const WebURL& baseURL, const WebURL& unreachableURL, bool replace);
+    virtual void loadHTMLString(
+        const WebData& html, const WebURL& baseURL, const WebURL& unreachableURL,
+        bool replace);
+    virtual bool isLoading() const;
+    virtual void stopLoading();
+    virtual WebDataSource* provisionalDataSource() const;
+    virtual WebDataSource* dataSource() const;
+    virtual WebHistoryItem previousHistoryItem() const;
+    virtual WebHistoryItem currentHistoryItem() const;
+    virtual void enableViewSourceMode(bool enable);
+    virtual bool isViewSourceModeEnabled() const;
+    virtual void setReferrerForRequest(WebURLRequest&, const WebURL& referrer);
+    virtual void dispatchWillSendRequest(WebURLRequest&);
+    virtual void commitDocumentData(const char* data, size_t length);
+    virtual unsigned unloadListenerCount() const;
+    virtual bool isProcessingUserGesture() const;
+    virtual bool willSuppressOpenerInNewFrame() const;
+    virtual void replaceSelection(const WebString&);
+    virtual void insertText(const WebString&);
+    virtual void setMarkedText(const WebString&, unsigned location, unsigned length);
+    virtual void unmarkText();
+    virtual bool hasMarkedText() const;
+    virtual WebRange markedRange() const;
+    virtual bool executeCommand(const WebString&);
+    virtual bool executeCommand(const WebString&, const WebString& value);
+    virtual bool isCommandEnabled(const WebString&) const;
+    virtual void enableContinuousSpellChecking(bool);
+    virtual bool isContinuousSpellCheckingEnabled() const;
+    virtual bool hasSelection() const;
+    virtual WebRange selectionRange() const;
+    virtual WebString selectionAsText() const;
+    virtual WebString selectionAsMarkup() const;
+    virtual int printBegin(const WebSize& pageSize);
+    virtual float printPage(int pageToPrint, WebCanvas*);
+    virtual float getPrintPageShrink(int page);
+    virtual void printEnd();
+    virtual bool find(
+        int identifier, const WebString& searchText, const WebFindOptions&,
+        bool wrapWithinFrame, WebRect* selectionRect);
+    virtual void stopFinding(bool clearSelection);
+    virtual void scopeStringMatches(
+        int identifier, const WebString& searchText, const WebFindOptions&,
+        bool reset);
+    virtual void cancelPendingScopingEffort();
+    virtual void increaseMatchCount(int count, int identifier);
+    virtual void resetMatchCount();
+    virtual void registerPasswordListener(
+        WebInputElement, WebPasswordAutocompleteListener*);
+
+    virtual WebURL completeURL(const WebString& url) const;
+    virtual WebString contentAsText(size_t maxChars) const;
+    virtual WebString contentAsMarkup() const;
+
+    static PassRefPtr<WebFrameImpl> create(WebFrameClient* client);
+    ~WebFrameImpl();
+
+    static int liveObjectCount() { return m_liveObjectCount; }
+
+    // Called by the WebViewImpl to initialize its main frame:
+    void initializeAsMainFrame(WebViewImpl*);
+
+    PassRefPtr<WebCore::Frame> createChildFrame(
+        const WebCore::FrameLoadRequest&, WebCore::HTMLFrameOwnerElement*);
+
+    void layout();
+    void paint(WebCanvas*, const WebRect&);
+    void createFrameView();
+
+    static WebFrameImpl* fromFrame(WebCore::Frame* frame);
+
+    WebViewImpl* viewImpl() const;
+
+    WebCore::Frame* frame() const { return m_frame; }
+    WebCore::FrameView* frameView() const { return m_frame ? m_frame->view() : 0; }
+
+    // Getters for the impls corresponding to Get(Provisional)DataSource. They
+    // may return 0 if there is no corresponding data source.
+    WebDataSourceImpl* dataSourceImpl() const;
+    WebDataSourceImpl* provisionalDataSourceImpl() const;
+
+    // Returns which frame has an active match. This function should only be
+    // called on the main frame, as it is the only frame keeping track. Returned
+    // value can be 0 if no frame has an active match.
+    const WebFrameImpl* activeMatchFrame() const { return m_activeMatchFrame; }
+
+    // When a Find operation ends, we want to set the selection to what was active
+    // and set focus to the first focusable node we find (starting with the first
+    // node in the matched range and going up the inheritance chain). If we find
+    // nothing to focus we focus the first focusable node in the range. This
+    // allows us to set focus to a link (when we find text inside a link), which
+    // allows us to navigate by pressing Enter after closing the Find box.
+    void setFindEndstateFocusAndSelection();
+
+    void didFail(const WebCore::ResourceError&, bool wasProvisional);
+
+    // Sets whether the WebFrameImpl allows its document to be scrolled.
+    // If the parameter is true, allow the document to be scrolled.
+    // Otherwise, disallow scrolling.
+    void setAllowsScrolling(bool);
+
+    // Returns the password autocomplete listener associated with the passed
+    // user name input element, or 0 if none available.
+    // Note that the returned listener is owner by the WebFrameImpl and should not
+    // be kept around as it is deleted when the page goes away.
+    WebPasswordAutocompleteListener* getPasswordListener(WebCore::HTMLInputElement*);
+
+    WebFrameClient* client() const { return m_client; }
+    void dropClient() { m_client = 0; }
+
+private:
+    class DeferredScopeStringMatches;
+    friend class DeferredScopeStringMatches;
+    friend class FrameLoaderClientImpl;
+
+    // A bit mask specifying area of the frame to invalidate.
+    enum AreaToInvalidate {
+      InvalidateNothing,
+      InvalidateContentArea,
+      InvalidateScrollbar,   // Vertical scrollbar only.
+      InvalidateAll          // Both content area and the scrollbar.
+    };
+
+    WebFrameImpl(WebFrameClient*);
+
+    // Informs the WebFrame that the Frame is being closed, called by the
+    // WebFrameLoaderClient
+    void closing();
+
+    // Notifies the delegate about a new selection rect.
+    void reportFindInPageSelection(
+        const WebRect& selectionRect, int activeMatchOrdinal, int identifier);
+
+    // Invalidates a certain area within the frame.
+    void invalidateArea(AreaToInvalidate);
+
+    // Add a WebKit TextMatch-highlight marker to nodes in a range.
+    void addMarker(WebCore::Range*, bool activeMatch);
+
+    // Sets the markers within a range as active or inactive.
+    void setMarkerActive(WebCore::Range*, bool active);
+
+    // Returns the ordinal of the first match in the frame specified. This
+    // function enumerates the frames, starting with the main frame and up to (but
+    // not including) the frame passed in as a parameter and counts how many
+    // matches have been found.
+    int ordinalOfFirstMatchForFrame(WebFrameImpl*) const;
+
+    // Determines whether the scoping effort is required for a particular frame.
+    // It is not necessary if the frame is invisible, for example, or if this
+    // is a repeat search that already returned nothing last time the same prefix
+    // was searched.
+    bool shouldScopeMatches(const WebCore::String& searchText);
+
+    // Queue up a deferred call to scopeStringMatches.
+    void scopeStringMatchesSoon(
+        int identifier, const WebString& searchText, const WebFindOptions&,
+        bool reset);
+
+    // Called by a DeferredScopeStringMatches instance.
+    void callScopeStringMatches(
+        DeferredScopeStringMatches*, int identifier, const WebString& searchText,
+        const WebFindOptions&, bool reset);
+
+    // Determines whether to invalidate the content area and scrollbar.
+    void invalidateIfNecessary();
+
+    // Clears the map of password listeners.
+    void clearPasswordListeners();
+
+    void loadJavaScriptURL(const WebCore::KURL&);
+
+    // Used to check for leaks of this object.
+    static int m_liveObjectCount;
+
+    FrameLoaderClientImpl m_frameLoaderClient;
+
+    WebFrameClient* m_client;
+
+    // This is a weak pointer to our corresponding WebCore frame.  A reference to
+    // ourselves is held while frame_ is valid.  See our Closing method.
+    WebCore::Frame* m_frame;
+
+    // A way for the main frame to keep track of which frame has an active
+    // match. Should be 0 for all other frames.
+    WebFrameImpl* m_activeMatchFrame;
+
+    // The range of the active match for the current frame.
+    RefPtr<WebCore::Range> m_activeMatch;
+
+    // The index of the active match.
+    int m_activeMatchIndex;
+
+    // This flag is used by the scoping effort to determine if we need to figure
+    // out which rectangle is the active match. Once we find the active
+    // rectangle we clear this flag.
+    bool m_locatingActiveRect;
+
+    // The scoping effort can time out and we need to keep track of where we
+    // ended our last search so we can continue from where we left of.
+    RefPtr<WebCore::Range> m_resumeScopingFromRange;
+
+    // Keeps track of the last string this frame searched for. This is used for
+    // short-circuiting searches in the following scenarios: When a frame has
+    // been searched and returned 0 results, we don't need to search that frame
+    // again if the user is just adding to the search (making it more specific).
+    WebCore::String m_lastSearchString;
+
+    // Keeps track of how many matches this frame has found so far, so that we
+    // don't loose count between scoping efforts, and is also used (in conjunction
+    // with m_lastSearchString and m_scopingComplete) to figure out if we need to
+    // search the frame again.
+    int m_lastMatchCount;
+
+    // This variable keeps a cumulative total of matches found so far for ALL the
+    // frames on the page, and is only incremented by calling IncreaseMatchCount
+    // (on the main frame only). It should be -1 for all other frames.
+    size_t m_totalMatchCount;
+
+    // This variable keeps a cumulative total of how many frames are currently
+    // scoping, and is incremented/decremented on the main frame only.
+    // It should be -1 for all other frames.
+    int m_framesScopingCount;
+
+    // Keeps track of whether the scoping effort was completed (the user may
+    // interrupt it before it completes by submitting a new search).
+    bool m_scopingComplete;
+
+    // Keeps track of when the scoping effort should next invalidate the scrollbar
+    // and the frame area.
+    int m_nextInvalidateAfter;
+
+    // A list of all of the pending calls to scopeStringMatches.
+    Vector<DeferredScopeStringMatches*> m_deferredScopingWork;
+
+    // Valid between calls to BeginPrint() and EndPrint(). Containts the print
+    // information. Is used by PrintPage().
+    OwnPtr<ChromePrintContext> m_printContext;
+
+    // The input fields that are interested in edit events and their associated
+    // listeners.
+    typedef HashMap<RefPtr<WebCore::HTMLInputElement>,
+                    WebPasswordAutocompleteListener*> PasswordListenerMap;
+    PasswordListenerMap m_passwordListeners;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebHTTPBody.cpp b/WebKit/chromium/src/WebHTTPBody.cpp
new file mode 100644
index 0000000..335ed5c
--- /dev/null
+++ b/WebKit/chromium/src/WebHTTPBody.cpp
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebHTTPBody.h"
+
+#include "FormData.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebHTTPBodyPrivate : public FormData {
+};
+
+void WebHTTPBody::initialize()
+{
+    assign(static_cast<WebHTTPBodyPrivate*>(FormData::create().releaseRef()));
+}
+
+void WebHTTPBody::reset()
+{
+    assign(0);
+}
+
+void WebHTTPBody::assign(const WebHTTPBody& other)
+{
+    WebHTTPBodyPrivate* p = const_cast<WebHTTPBodyPrivate*>(other.m_private);
+    if (p)
+        p->ref();
+    assign(p);
+}
+
+size_t WebHTTPBody::elementCount() const
+{
+    ASSERT(!isNull());
+    return m_private->elements().size();
+}
+
+bool WebHTTPBody::elementAt(size_t index, Element& result) const
+{
+    ASSERT(!isNull());
+
+    if (index >= m_private->elements().size())
+        return false;
+
+    const FormDataElement& element = m_private->elements()[index];
+
+    switch (element.m_type) {
+    case FormDataElement::data:
+        result.type = Element::TypeData;
+        result.data.assign(element.m_data.data(), element.m_data.size());
+        result.filePath.reset();
+        break;
+    case FormDataElement::encodedFile:
+        result.type = Element::TypeFile;
+        result.data.reset();
+        result.filePath = element.m_filename;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    return true;
+}
+
+void WebHTTPBody::appendData(const WebData& data)
+{
+    ensureMutable();
+    // FIXME: FormDataElement::m_data should be a SharedBuffer<char>.  Then we
+    // could avoid this buffer copy.
+    m_private->appendData(data.data(), data.size());
+}
+
+void WebHTTPBody::appendFile(const WebString& filePath)
+{
+    ensureMutable();
+    m_private->appendFile(filePath);
+}
+
+long long WebHTTPBody::identifier() const
+{
+    ASSERT(!isNull());
+    return m_private->identifier();
+}
+
+void WebHTTPBody::setIdentifier(long long identifier)
+{
+    ensureMutable();
+    return m_private->setIdentifier(identifier);
+}
+
+WebHTTPBody::WebHTTPBody(const PassRefPtr<FormData>& data)
+    : m_private(static_cast<WebHTTPBodyPrivate*>(data.releaseRef()))
+{
+}
+
+WebHTTPBody& WebHTTPBody::operator=(const PassRefPtr<FormData>& data)
+{
+    assign(static_cast<WebHTTPBodyPrivate*>(data.releaseRef()));
+    return *this;
+}
+
+WebHTTPBody::operator PassRefPtr<FormData>() const
+{
+    return m_private;
+}
+
+void WebHTTPBody::assign(WebHTTPBodyPrivate* p)
+{
+    // p is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+void WebHTTPBody::ensureMutable()
+{
+    ASSERT(!isNull());
+    if (!m_private->hasOneRef())
+        assign(static_cast<WebHTTPBodyPrivate*>(m_private->copy().releaseRef()));
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebHistoryItem.cpp b/WebKit/chromium/src/WebHistoryItem.cpp
new file mode 100644
index 0000000..d4ee50a
--- /dev/null
+++ b/WebKit/chromium/src/WebHistoryItem.cpp
@@ -0,0 +1,296 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebHistoryItem.h"
+
+#include "FormData.h"
+#include "HistoryItem.h"
+#include "KURL.h"
+
+#include "WebHTTPBody.h"
+#include "WebPoint.h"
+#include "WebString.h"
+#include "WebVector.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebHistoryItemPrivate : public HistoryItem {
+};
+
+void WebHistoryItem::initialize()
+{
+    assign(static_cast<WebHistoryItemPrivate*>(HistoryItem::create().releaseRef()));
+}
+
+void WebHistoryItem::reset()
+{
+    assign(0);
+}
+
+void WebHistoryItem::assign(const WebHistoryItem& other)
+{
+    WebHistoryItemPrivate* p = const_cast<WebHistoryItemPrivate*>(other.m_private);
+    if (p)
+        p->ref();
+    assign(p);
+}
+
+WebString WebHistoryItem::urlString() const
+{
+    ASSERT(!isNull());
+    return m_private->urlString();
+}
+
+void WebHistoryItem::setURLString(const WebString& url)
+{
+    ensureMutable();
+    m_private->setURLString(KURL(ParsedURLString, url).string());
+}
+
+WebString WebHistoryItem::originalURLString() const
+{
+    ASSERT(!isNull());
+    return m_private->originalURLString();
+}
+
+void WebHistoryItem::setOriginalURLString(const WebString& originalURLString)
+{
+    ensureMutable();
+    m_private->setOriginalURLString(originalURLString);
+}
+
+WebString WebHistoryItem::referrer() const
+{
+    ASSERT(!isNull());
+    return m_private->referrer();
+}
+
+void WebHistoryItem::setReferrer(const WebString& referrer)
+{
+    ensureMutable();
+    m_private->setReferrer(referrer);
+}
+
+WebString WebHistoryItem::target() const
+{
+    ASSERT(!isNull());
+    return m_private->target();
+}
+
+void WebHistoryItem::setTarget(const WebString& target)
+{
+    ensureMutable();
+    m_private->setTarget(target);
+}
+
+WebString WebHistoryItem::parent() const
+{
+    ASSERT(!isNull());
+    return m_private->parent();
+}
+
+void WebHistoryItem::setParent(const WebString& parent)
+{
+    ensureMutable();
+    m_private->setParent(parent);
+}
+
+WebString WebHistoryItem::title() const
+{
+    ASSERT(!isNull());
+    return m_private->title();
+}
+
+void WebHistoryItem::setTitle(const WebString& title)
+{
+    ensureMutable();
+    m_private->setTitle(title);
+}
+
+WebString WebHistoryItem::alternateTitle() const
+{
+    ASSERT(!isNull());
+    return m_private->alternateTitle();
+}
+
+void WebHistoryItem::setAlternateTitle(const WebString& alternateTitle)
+{
+    ensureMutable();
+    m_private->setAlternateTitle(alternateTitle);
+}
+
+double WebHistoryItem::lastVisitedTime() const
+{
+    ASSERT(!isNull());
+    return m_private->lastVisitedTime();
+}
+
+void WebHistoryItem::setLastVisitedTime(double lastVisitedTime)
+{
+    ensureMutable();
+    // FIXME: setLastVisitedTime increments the visit count, so we have to
+    // correct for that.  Instead, we should have a back-door to just mutate
+    // the last visited time directly.
+    int count = m_private->visitCount();
+    m_private->setLastVisitedTime(lastVisitedTime);
+    m_private->setVisitCount(count);
+}
+
+WebPoint WebHistoryItem::scrollOffset() const
+{
+    ASSERT(!isNull());
+    return m_private->scrollPoint();
+}
+
+void WebHistoryItem::setScrollOffset(const WebPoint& scrollOffset)
+{
+    ensureMutable();
+    m_private->setScrollPoint(scrollOffset);
+}
+
+bool WebHistoryItem::isTargetItem() const
+{
+    ASSERT(!isNull());
+    return m_private->isTargetItem();
+}
+
+void WebHistoryItem::setIsTargetItem(bool isTargetItem)
+{
+    ensureMutable();
+    m_private->setIsTargetItem(isTargetItem);
+}
+
+int WebHistoryItem::visitCount() const
+{
+    ASSERT(!isNull());
+    return m_private->visitCount();
+}
+
+void WebHistoryItem::setVisitCount(int count)
+{
+    ensureMutable();
+    m_private->setVisitCount(count);
+}
+
+WebVector<WebString> WebHistoryItem::documentState() const
+{
+    ASSERT(!isNull());
+    return m_private->documentState();
+}
+
+void WebHistoryItem::setDocumentState(const WebVector<WebString>& state)
+{
+    ensureMutable();
+    // FIXME: would be nice to avoid the intermediate copy
+    Vector<String> ds;
+    for (size_t i = 0; i < state.size(); ++i)
+        ds.append(state[i]);
+    m_private->setDocumentState(ds);
+}
+
+WebString WebHistoryItem::httpContentType() const
+{
+    ASSERT(!isNull());
+    return m_private->formContentType();
+}
+
+void WebHistoryItem::setHTTPContentType(const WebString& httpContentType)
+{
+    ensureMutable();
+    m_private->setFormContentType(httpContentType);
+}
+
+WebHTTPBody WebHistoryItem::httpBody() const
+{
+    ASSERT(!isNull());
+    return WebHTTPBody(m_private->formData());
+}
+
+void WebHistoryItem::setHTTPBody(const WebHTTPBody& httpBody)
+{
+    ensureMutable();
+    m_private->setFormData(httpBody);
+}
+
+WebVector<WebHistoryItem> WebHistoryItem::children() const
+{
+    ASSERT(!isNull());
+    return m_private->children();
+}
+
+void WebHistoryItem::setChildren(const WebVector<WebHistoryItem>& items)
+{
+    ensureMutable();
+    m_private->clearChildren();
+    for (size_t i = 0; i < items.size(); ++i)
+        m_private->addChildItem(items[i]);
+}
+
+void WebHistoryItem::appendToChildren(const WebHistoryItem& item)
+{
+    ensureMutable();
+    m_private->addChildItem(item);
+}
+
+WebHistoryItem::WebHistoryItem(const PassRefPtr<HistoryItem>& item)
+    : m_private(static_cast<WebHistoryItemPrivate*>(item.releaseRef()))
+{
+}
+
+WebHistoryItem& WebHistoryItem::operator=(const PassRefPtr<HistoryItem>& item)
+{
+    assign(static_cast<WebHistoryItemPrivate*>(item.releaseRef()));
+    return *this;
+}
+
+WebHistoryItem::operator PassRefPtr<HistoryItem>() const
+{
+    return m_private;
+}
+
+void WebHistoryItem::assign(WebHistoryItemPrivate* p)
+{
+    // p is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+void WebHistoryItem::ensureMutable()
+{
+    ASSERT(!isNull());
+    if (!m_private->hasOneRef())
+        assign(static_cast<WebHistoryItemPrivate*>(m_private->copy().releaseRef()));
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebImageCG.cpp b/WebKit/chromium/src/WebImageCG.cpp
new file mode 100644
index 0000000..60b2449
--- /dev/null
+++ b/WebKit/chromium/src/WebImageCG.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebImage.h"
+
+#include "Image.h"
+#include "ImageSource.h"
+#include "SharedBuffer.h"
+
+#include "WebData.h"
+#include "WebSize.h"
+
+#include <CoreGraphics/CGImage.h>
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RetainPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebImage WebImage::fromData(const WebData& data, const WebSize& desiredSize)
+{
+    // FIXME: Do something like what WebImageSkia.cpp does to enumerate frames.
+    // Not sure whether the CG decoder uses the same frame ordering rules (if so
+    // we can just use the same logic).
+
+    ImageSource source;
+    source.setData(PassRefPtr<SharedBuffer>(data).get(), true);
+    if (!source.isSizeAvailable())
+        return WebImage();
+
+    RetainPtr<CGImageRef> frame0(AdoptCF, source.createFrameAtIndex(0));
+    if (!frame0)
+        return WebImage();
+
+    return WebImage(frame0.get());
+}
+
+void WebImage::reset()
+{
+    CGImageRelease(m_imageRef);
+    m_imageRef = 0;
+}
+
+void WebImage::assign(const WebImage& image)
+{
+    assign(image.m_imageRef);
+}
+
+bool WebImage::isNull() const
+{
+    return !m_imageRef;
+}
+
+WebSize WebImage::size() const
+{
+    return WebSize(CGImageGetWidth(m_imageRef), CGImageGetHeight(m_imageRef));
+}
+
+WebImage::WebImage(const PassRefPtr<Image>& image)
+    : m_imageRef(0)
+{
+    if (image.get())
+        assign(image->nativeImageForCurrentFrame());
+}
+
+WebImage& WebImage::operator=(const PassRefPtr<Image>& image)
+{
+    if (image.get())
+        assign(image->nativeImageForCurrentFrame());
+    else
+        reset();
+    return *this;
+}
+
+void WebImage::assign(CGImageRef imageRef)
+{
+    // Make sure to retain the imageRef first incase m_imageRef == imageRef.
+    CGImageRetain(imageRef);
+    CGImageRelease(m_imageRef);
+    m_imageRef = imageRef;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebImageSkia.cpp b/WebKit/chromium/src/WebImageSkia.cpp
new file mode 100644
index 0000000..0684b58
--- /dev/null
+++ b/WebKit/chromium/src/WebImageSkia.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebImage.h"
+
+#include "Image.h"
+#include "ImageSource.h"
+#include "NativeImageSkia.h"
+#include "SharedBuffer.h"
+
+#include "WebData.h"
+#include "WebSize.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebImage WebImage::fromData(const WebData& data, const WebSize& desiredSize)
+{
+    ImageSource source;
+    source.setData(PassRefPtr<SharedBuffer>(data).get(), true);
+    if (!source.isSizeAvailable())
+        return WebImage();
+
+    // Frames are arranged by decreasing size, then decreasing bit depth.
+    // Pick the frame closest to |desiredSize|'s area without being smaller,
+    // which has the highest bit depth.
+    const size_t frameCount = source.frameCount();
+    size_t index = 0;  // Default to first frame if none are large enough.
+    int frameAreaAtIndex = 0;
+    for (size_t i = 0; i < frameCount; ++i) {
+        const IntSize frameSize = source.frameSizeAtIndex(i);
+        if (WebSize(frameSize) == desiredSize) {
+            index = i;
+            break;  // Perfect match.
+        }
+
+        const int frameArea = frameSize.width() * frameSize.height();
+        if (frameArea < (desiredSize.width * desiredSize.height))
+            break;  // No more frames that are large enough.
+
+        if (!i || (frameArea < frameAreaAtIndex)) {
+            index = i;  // Closer to desired area than previous best match.
+            frameAreaAtIndex = frameArea;
+        }
+    }
+
+    OwnPtr<NativeImageSkia> frame(source.createFrameAtIndex(index));
+    if (!frame.get())
+        return WebImage();
+
+    return WebImage(*frame);
+}
+
+void WebImage::reset()
+{
+    m_bitmap.reset();
+}
+
+void WebImage::assign(const WebImage& image)
+{
+    m_bitmap = image.m_bitmap;
+}
+
+bool WebImage::isNull() const
+{
+    return m_bitmap.isNull();
+}
+
+WebSize WebImage::size() const
+{
+    return WebSize(m_bitmap.width(), m_bitmap.height());
+}
+
+WebImage::WebImage(const PassRefPtr<Image>& image)
+{
+    operator=(image);
+}
+
+WebImage& WebImage::operator=(const PassRefPtr<Image>& image)
+{
+    NativeImagePtr p;
+    if (image.get() && (p = image->nativeImageForCurrentFrame()))
+        assign(*p);
+    else
+        reset();
+    return *this;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebInputElement.cpp b/WebKit/chromium/src/WebInputElement.cpp
new file mode 100644
index 0000000..d403120
--- /dev/null
+++ b/WebKit/chromium/src/WebInputElement.cpp
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebInputElement.h"
+
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "WebString.h"
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebInputElement::WebInputElement(const WTF::PassRefPtr<HTMLInputElement>& elem)
+    : WebElement(elem.releaseRef())
+{
+}
+
+WebInputElement& WebInputElement::operator=(const WTF::PassRefPtr<HTMLInputElement>& elem)
+{
+    WebNode::assign(elem.releaseRef());
+    return *this;
+}
+
+WebInputElement::operator WTF::PassRefPtr<HTMLInputElement>() const
+{
+    return PassRefPtr<HTMLInputElement>(static_cast<HTMLInputElement*>(m_private));
+}
+
+bool WebInputElement::isEnabledFormControl() const
+{
+    return constUnwrap<HTMLInputElement>()->isEnabledFormControl();
+}
+
+WebInputElement::InputType WebInputElement::inputType() const
+{
+    return static_cast<InputType>(constUnwrap<HTMLInputElement>()->inputType());
+}
+
+WebString WebInputElement::formControlType() const
+{
+    return constUnwrap<HTMLInputElement>()->formControlType();
+}
+    
+void WebInputElement::setActivatedSubmit(bool activated)
+{
+    unwrap<HTMLInputElement>()->setActivatedSubmit(activated);
+}
+
+void WebInputElement::setValue(const WebString& value)
+{
+    unwrap<HTMLInputElement>()->setValue(value);
+}
+
+WebString WebInputElement::value() const
+{
+    return constUnwrap<HTMLInputElement>()->value();
+}
+
+void WebInputElement::setAutofilled(bool autoFilled)
+{
+    unwrap<HTMLInputElement>()->setAutofilled(autoFilled);
+}
+
+void WebInputElement::dispatchFormControlChangeEvent()
+{
+    unwrap<HTMLInputElement>()->dispatchFormControlChangeEvent();
+}
+
+void WebInputElement::setSelectionRange(int start, int end)
+{
+    unwrap<HTMLInputElement>()->setSelectionRange(start, end);
+}
+    
+WebString WebInputElement::name() const
+{
+    return constUnwrap<HTMLInputElement>()->name();
+}
+    
+WebString WebInputElement::nameForAutofill() const
+{
+    String name = constUnwrap<HTMLInputElement>()->name();
+    String trimmedName = name.stripWhiteSpace();
+    if (!trimmedName.isEmpty())
+        return trimmedName;
+    name = constUnwrap<HTMLInputElement>()->getAttribute(HTMLNames::idAttr);
+    trimmedName = name.stripWhiteSpace();
+    if (!trimmedName.isEmpty())
+        return trimmedName;
+    return String();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebInputEvent.cpp b/WebKit/chromium/src/WebInputEvent.cpp
new file mode 100644
index 0000000..b5c56fa
--- /dev/null
+++ b/WebKit/chromium/src/WebInputEvent.cpp
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebInputEvent.h"
+
+#include "KeyboardCodes.h"
+
+#include <ctype.h>
+#include <stdio.h>
+
+#include <wtf/Assertions.h>
+#include <wtf/StringExtras.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+static const char* staticKeyIdentifiers(unsigned short keyCode)
+{
+    switch (keyCode) {
+    case VKEY_MENU:
+        return "Alt";
+    case VKEY_CONTROL:
+        return "Control";
+    case VKEY_SHIFT:
+        return "Shift";
+    case VKEY_CAPITAL:
+        return "CapsLock";
+    case VKEY_LWIN:
+    case VKEY_RWIN:
+        return "Win";
+    case VKEY_CLEAR:
+        return "Clear";
+    case VKEY_DOWN:
+        return "Down";
+    case VKEY_END:
+        return "End";
+    case VKEY_RETURN:
+        return "Enter";
+    case VKEY_EXECUTE:
+        return "Execute";
+    case VKEY_F1:
+        return "F1";
+    case VKEY_F2:
+        return "F2";
+    case VKEY_F3:
+        return "F3";
+    case VKEY_F4:
+        return "F4";
+    case VKEY_F5:
+        return "F5";
+    case VKEY_F6:
+        return "F6";
+    case VKEY_F7:
+        return "F7";
+    case VKEY_F8:
+        return "F8";
+    case VKEY_F9:
+        return "F9";
+    case VKEY_F10:
+        return "F11";
+    case VKEY_F12:
+        return "F12";
+    case VKEY_F13:
+        return "F13";
+    case VKEY_F14:
+        return "F14";
+    case VKEY_F15:
+        return "F15";
+    case VKEY_F16:
+        return "F16";
+    case VKEY_F17:
+        return "F17";
+    case VKEY_F18:
+        return "F18";
+    case VKEY_F19:
+        return "F19";
+    case VKEY_F20:
+        return "F20";
+    case VKEY_F21:
+        return "F21";
+    case VKEY_F22:
+        return "F22";
+    case VKEY_F23:
+        return "F23";
+    case VKEY_F24:
+        return "F24";
+    case VKEY_HELP:
+        return "Help";
+    case VKEY_HOME:
+        return "Home";
+    case VKEY_INSERT:
+        return "Insert";
+    case VKEY_LEFT:
+        return "Left";
+    case VKEY_NEXT:
+        return "PageDown";
+    case VKEY_PRIOR:
+        return "PageUp";
+    case VKEY_PAUSE:
+        return "Pause";
+    case VKEY_SNAPSHOT:
+        return "PrintScreen";
+    case VKEY_RIGHT:
+        return "Right";
+    case VKEY_SCROLL:
+        return "Scroll";
+    case VKEY_SELECT:
+        return "Select";
+    case VKEY_UP:
+        return "Up";
+    case VKEY_DELETE:
+        return "U+007F"; // Standard says that DEL becomes U+007F.
+    default:
+        return 0;
+    }
+}
+
+void WebKeyboardEvent::setKeyIdentifierFromWindowsKeyCode()
+{
+    const char* id = staticKeyIdentifiers(windowsKeyCode);
+    if (id) {
+        strncpy(keyIdentifier, id, sizeof(keyIdentifier) - 1);
+        keyIdentifier[sizeof(keyIdentifier) - 1] = '\0';
+    } else
+        snprintf(keyIdentifier, sizeof(keyIdentifier), "U+%04X", toupper(windowsKeyCode));
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebInputEventConversion.cpp b/WebKit/chromium/src/WebInputEventConversion.cpp
new file mode 100644
index 0000000..147f88b
--- /dev/null
+++ b/WebKit/chromium/src/WebInputEventConversion.cpp
@@ -0,0 +1,257 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebInputEventConversion.h"
+
+#include "EventNames.h"
+#include "KeyboardCodes.h"
+#include "KeyboardEvent.h"
+#include "MouseEvent.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformMouseEvent.h"
+#include "PlatformWheelEvent.h"
+#include "ScrollView.h"
+#include "WebInputEvent.h"
+#include "Widget.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// MakePlatformMouseEvent -----------------------------------------------------
+
+PlatformMouseEventBuilder::PlatformMouseEventBuilder(Widget* widget, const WebMouseEvent& e)
+{
+    // FIXME: widget is always toplevel, unless it's a popup.  We may be able
+    // to get rid of this once we abstract popups into a WebKit API.
+    m_position = widget->convertFromContainingWindow(IntPoint(e.x, e.y));
+    m_globalPosition = IntPoint(e.globalX, e.globalY);
+    m_button = static_cast<MouseButton>(e.button);
+    m_shiftKey = (e.modifiers & WebInputEvent::ShiftKey);
+    m_ctrlKey = (e.modifiers & WebInputEvent::ControlKey);
+    m_altKey = (e.modifiers & WebInputEvent::AltKey);
+    m_metaKey = (e.modifiers & WebInputEvent::MetaKey);
+    m_modifierFlags = e.modifiers;
+    m_timestamp = e.timeStampSeconds;
+    m_clickCount = e.clickCount;
+
+    switch (e.type) {
+    case WebInputEvent::MouseMove:
+    case WebInputEvent::MouseLeave:  // synthesize a move event
+        m_eventType = MouseEventMoved;
+        break;
+
+    case WebInputEvent::MouseDown:
+        m_eventType = MouseEventPressed;
+        break;
+
+    case WebInputEvent::MouseUp:
+        m_eventType = MouseEventReleased;
+        break;
+
+    default:
+        ASSERT_NOT_REACHED();
+    }
+}
+
+// PlatformWheelEventBuilder --------------------------------------------------
+
+PlatformWheelEventBuilder::PlatformWheelEventBuilder(Widget* widget, const WebMouseWheelEvent& e)
+{
+    m_position = widget->convertFromContainingWindow(IntPoint(e.x, e.y));
+    m_globalPosition = IntPoint(e.globalX, e.globalY);
+    m_deltaX = e.deltaX;
+    m_deltaY = e.deltaY;
+    m_wheelTicksX = e.wheelTicksX;
+    m_wheelTicksY = e.wheelTicksY;
+    m_isAccepted = false;
+    m_granularity = e.scrollByPage ?
+        ScrollByPageWheelEvent : ScrollByPixelWheelEvent;
+    m_shiftKey = (e.modifiers & WebInputEvent::ShiftKey);
+    m_ctrlKey = (e.modifiers & WebInputEvent::ControlKey);
+    m_altKey = (e.modifiers & WebInputEvent::AltKey);
+    m_metaKey = (e.modifiers & WebInputEvent::MetaKey);
+}
+
+// MakePlatformKeyboardEvent --------------------------------------------------
+
+static inline const PlatformKeyboardEvent::Type toPlatformKeyboardEventType(WebInputEvent::Type type)
+{
+    switch (type) {
+    case WebInputEvent::KeyUp:
+        return PlatformKeyboardEvent::KeyUp;
+    case WebInputEvent::KeyDown:
+        return PlatformKeyboardEvent::KeyDown;
+    case WebInputEvent::RawKeyDown:
+        return PlatformKeyboardEvent::RawKeyDown;
+    case WebInputEvent::Char:
+        return PlatformKeyboardEvent::Char;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    return PlatformKeyboardEvent::KeyDown;
+}
+
+PlatformKeyboardEventBuilder::PlatformKeyboardEventBuilder(const WebKeyboardEvent& e)
+{
+    m_type = toPlatformKeyboardEventType(e.type);
+    m_text = String(e.text);
+    m_unmodifiedText = String(e.unmodifiedText);
+    m_keyIdentifier = String(e.keyIdentifier);
+    m_autoRepeat = (e.modifiers & WebInputEvent::IsAutoRepeat);
+    m_windowsVirtualKeyCode = e.windowsKeyCode;
+    m_nativeVirtualKeyCode = e.nativeKeyCode;
+    m_isKeypad = (e.modifiers & WebInputEvent::IsKeyPad);
+    m_shiftKey = (e.modifiers & WebInputEvent::ShiftKey);
+    m_ctrlKey = (e.modifiers & WebInputEvent::ControlKey);
+    m_altKey = (e.modifiers & WebInputEvent::AltKey);
+    m_metaKey = (e.modifiers & WebInputEvent::MetaKey);
+    m_isSystemKey = e.isSystemKey;
+}
+
+void PlatformKeyboardEventBuilder::setKeyType(Type type)
+{
+    // According to the behavior of Webkit in Windows platform,
+    // we need to convert KeyDown to RawKeydown and Char events
+    // See WebKit/WebKit/Win/WebView.cpp
+    ASSERT(m_type == KeyDown);
+    ASSERT(type == RawKeyDown || type == Char);
+    m_type = type;
+
+    if (type == RawKeyDown) {
+        m_text = String();
+        m_unmodifiedText = String();
+    } else {
+        m_keyIdentifier = String();
+        m_windowsVirtualKeyCode = 0;
+    }
+}
+
+// Please refer to bug http://b/issue?id=961192, which talks about Webkit
+// keyboard event handling changes. It also mentions the list of keys
+// which don't have associated character events.
+bool PlatformKeyboardEventBuilder::isCharacterKey() const
+{
+    switch (windowsVirtualKeyCode()) {
+    case VKEY_BACK:
+    case VKEY_ESCAPE:
+        return false;
+    }
+    return true;
+}
+
+static int getWebInputModifiers(const UIEventWithKeyState& event)
+{
+    int modifiers = 0;
+    if (event.ctrlKey())
+        modifiers |= WebInputEvent::ControlKey;
+    if (event.shiftKey())
+        modifiers |= WebInputEvent::ShiftKey;
+    if (event.altKey())
+        modifiers |= WebInputEvent::AltKey;
+    if (event.metaKey())
+        modifiers |= WebInputEvent::MetaKey;
+    return modifiers;
+}
+
+WebMouseEventBuilder::WebMouseEventBuilder(const ScrollView* view, const MouseEvent& event)
+{
+    if (event.type() == eventNames().mousemoveEvent)
+        type = WebInputEvent::MouseMove;
+    else if (event.type() == eventNames().mouseoutEvent)
+        type = WebInputEvent::MouseLeave;
+    else if (event.type() == eventNames().mouseoverEvent)
+        type = WebInputEvent::MouseEnter;
+    else if (event.type() == eventNames().mousedownEvent)
+        type = WebInputEvent::MouseDown;
+    else if (event.type() == eventNames().mouseupEvent)
+        type = WebInputEvent::MouseUp;
+    else
+        return; // Skip all other mouse events.
+    timeStampSeconds = event.timeStamp() * 1.0e-3;
+    switch (event.button()) {
+    case LeftButton:
+        button = WebMouseEvent::ButtonLeft;
+        break;
+    case MiddleButton:
+        button = WebMouseEvent::ButtonMiddle;
+        break;
+    case RightButton:
+        button = WebMouseEvent::ButtonRight;
+        break;
+    }
+    modifiers = getWebInputModifiers(event);
+    if (event.buttonDown()) {
+        switch (event.button()) {
+        case LeftButton:
+            modifiers |= WebInputEvent::LeftButtonDown;
+            break;
+        case MiddleButton:
+            modifiers |= WebInputEvent::MiddleButtonDown;
+            break;
+        case RightButton:
+            modifiers |= WebInputEvent::RightButtonDown;
+            break;
+        }
+    }
+    IntPoint p = view->contentsToWindow(IntPoint(event.pageX(), event.pageY()));
+    globalX = event.screenX();
+    globalY = event.screenY();
+    windowX = p.x();
+    windowY = p.y();
+    x = event.offsetX();
+    y = event.offsetY();
+    clickCount = event.detail();
+}
+
+WebKeyboardEventBuilder::WebKeyboardEventBuilder(const KeyboardEvent& event)
+{
+    if (event.type() == eventNames().keydownEvent)
+        type = KeyDown;
+    else if (event.type() == eventNames().keyupEvent)
+        type = WebInputEvent::KeyUp;
+    else if (event.type() == eventNames().keypressEvent)
+        type = WebInputEvent::Char;
+    else
+        return; // Skip all other keyboard events.
+    modifiers = getWebInputModifiers(event);
+    timeStampSeconds = event.timeStamp() * 1.0e-3;
+    windowsKeyCode = event.keyCode();
+    nativeKeyCode = event.keyEvent()->nativeVirtualKeyCode();
+    unsigned int numChars = std::min(event.keyEvent()->text().length(),
+        static_cast<unsigned int>(WebKeyboardEvent::textLengthCap));
+    for (unsigned int i = 0; i < numChars; i++) {
+        text[i] = event.keyEvent()->text()[i];
+        unmodifiedText[i] = event.keyEvent()->unmodifiedText()[i];
+    }
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebInputEventConversion.h b/WebKit/chromium/src/WebInputEventConversion.h
new file mode 100644
index 0000000..4c9cf82
--- /dev/null
+++ b/WebKit/chromium/src/WebInputEventConversion.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebInputEventConversion_h
+#define WebInputEventConversion_h
+
+// FIXME: This relative path is a temporary hack to support using this
+// header from webkit/glue.
+#include "../public/WebInputEvent.h"
+
+#include "PlatformKeyboardEvent.h"
+#include "PlatformMouseEvent.h"
+#include "PlatformWheelEvent.h"
+
+namespace WebCore {
+class KeyboardEvent;
+class MouseEvent;
+class ScrollView;
+class Widget;
+}
+
+namespace WebKit {
+
+class WebMouseEvent;
+class WebMouseWheelEvent;
+class WebKeyboardEvent;
+
+// These classes are used to convert from WebInputEvent subclasses to
+// corresponding WebCore events.
+
+class PlatformMouseEventBuilder : public WebCore::PlatformMouseEvent {
+public:
+    PlatformMouseEventBuilder(WebCore::Widget*, const WebMouseEvent&);
+};
+
+class PlatformWheelEventBuilder : public WebCore::PlatformWheelEvent {
+public:
+    PlatformWheelEventBuilder(WebCore::Widget*, const WebMouseWheelEvent&);
+};
+
+class PlatformKeyboardEventBuilder : public WebCore::PlatformKeyboardEvent {
+public:
+    PlatformKeyboardEventBuilder(const WebKeyboardEvent&);
+    void setKeyType(Type);
+    bool isCharacterKey() const;
+};
+
+// Converts a WebCore::MouseEvent to a corresponding WebMouseEvent. view is
+// the ScrollView corresponding to the event.  Returns true if successful.
+// NOTE: This is only implemented for mousemove, mouseover, mouseout,
+// mousedown and mouseup.  If the event mapping fails, the event type will
+// be set to Undefined.
+class WebMouseEventBuilder : public WebMouseEvent {
+public:
+    WebMouseEventBuilder(const WebCore::ScrollView*, const WebCore::MouseEvent&);
+};
+
+// Converts a WebCore::KeyboardEvent to a corresponding WebKeyboardEvent.
+// Returns true if successful.  NOTE: This is only implemented for keydown
+// and keyup.  If the event mapping fails, the event type will be set to
+// Undefined.
+class WebKeyboardEventBuilder : public WebKeyboardEvent {
+public:
+    WebKeyboardEventBuilder(const WebCore::KeyboardEvent&);
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebKit.cpp b/WebKit/chromium/src/WebKit.cpp
new file mode 100644
index 0000000..a129f85
--- /dev/null
+++ b/WebKit/chromium/src/WebKit.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebKit.h"
+
+#include "AtomicString.h"
+#include "DOMTimer.h"
+#include "Page.h"
+#include "RuntimeEnabledFeatures.h"
+#include "TextEncoding.h"
+#include "WebMediaPlayerClientImpl.h"
+#include "WebSocket.h"
+#include "WorkerContextExecutionProxy.h"
+
+#include <wtf/Assertions.h>
+#include <wtf/Threading.h>
+
+namespace WebKit {
+
+static WebKitClient* s_webKitClient = 0;
+static bool s_layoutTestMode = false;
+
+void initialize(WebKitClient* webKitClient)
+{
+    ASSERT(webKitClient);
+    ASSERT(!s_webKitClient);
+    s_webKitClient = webKitClient;
+
+    WTF::initializeThreading();
+    WebCore::AtomicString::init();
+
+    // Chromium sets the minimum interval timeout to 4ms, overriding the
+    // default of 10ms.  We'd like to go lower, however there are poorly
+    // coded websites out there which do create CPU-spinning loops.  Using
+    // 4ms prevents the CPU from spinning too busily and provides a balance
+    // between CPU spinning and the smallest possible interval timer.
+    WebCore::DOMTimer::setMinTimerInterval(0.004);
+
+    // There are some code paths (for example, running WebKit in the browser
+    // process and calling into LocalStorage before anything else) where the
+    // UTF8 string encoding tables are used on a background thread before
+    // they're set up.  This is a problem because their set up routines assert
+    // they're running on the main WebKitThread.  It might be possible to make
+    // the initialization thread-safe, but given that so many code paths use
+    // this, initializing this lazily probably doesn't buy us much.
+    WebCore::UTF8Encoding();
+}
+
+void shutdown()
+{
+    s_webKitClient = 0;
+}
+
+WebKitClient* webKitClient()
+{
+    return s_webKitClient;
+}
+
+void setLayoutTestMode(bool value)
+{
+    s_layoutTestMode = value;
+}
+
+bool layoutTestMode()
+{
+    return s_layoutTestMode;
+}
+
+void resetPluginCache(bool reloadPages)
+{
+    WebCore::Page::refreshPlugins(reloadPages);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
new file mode 100644
index 0000000..c2a3535
--- /dev/null
+++ b/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -0,0 +1,397 @@
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "config.h"
+#include "WebMediaPlayerClientImpl.h"
+
+#if ENABLE(VIDEO)
+
+#include "CString.h"
+#include "Frame.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "IntSize.h"
+#include "KURL.h"
+#include "MediaPlayer.h"
+#include "NotImplemented.h"
+#include "TimeRanges.h"
+
+#include "WebCanvas.h"
+#include "WebCString.h"
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebMediaPlayer.h"
+#include "WebMimeRegistry.h"
+#include "WebRect.h"
+#include "WebSize.h"
+#include "WebString.h"
+#include "WebURL.h"
+
+// WebCommon.h defines WEBKIT_USING_SKIA so this has to be included last.
+#if WEBKIT_USING_SKIA
+#include "PlatformContextSkia.h"
+#endif
+
+#include <wtf/Assertions.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+static WebMediaPlayer* createWebMediaPlayer(
+    WebMediaPlayerClient* client, Frame* frame)
+{
+    WebFrameImpl* webFrame = WebFrameImpl::fromFrame(frame);
+    if (!webFrame->client())
+        return 0;
+    return webFrame->client()->createMediaPlayer(webFrame, client);
+}
+
+bool WebMediaPlayerClientImpl::m_isEnabled = false;
+
+bool WebMediaPlayerClientImpl::isEnabled()
+{
+    return m_isEnabled;
+}
+
+void WebMediaPlayerClientImpl::setIsEnabled(bool isEnabled)
+{
+    m_isEnabled = isEnabled;
+}
+
+void WebMediaPlayerClientImpl::registerSelf(MediaEngineRegistrar registrar)
+{
+    if (m_isEnabled) {
+        registrar(WebMediaPlayerClientImpl::create,
+                  WebMediaPlayerClientImpl::getSupportedTypes,
+                  WebMediaPlayerClientImpl::supportsType);
+    }
+}
+
+// WebMediaPlayerClient --------------------------------------------------------
+
+void WebMediaPlayerClientImpl::networkStateChanged()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->networkStateChanged();
+}
+
+void WebMediaPlayerClientImpl::readyStateChanged()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->readyStateChanged();
+}
+
+void WebMediaPlayerClientImpl::volumeChanged()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->volumeChanged();
+}
+
+void WebMediaPlayerClientImpl::timeChanged()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->timeChanged();
+}
+
+void WebMediaPlayerClientImpl::repaint()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->repaint();
+}
+
+void WebMediaPlayerClientImpl::durationChanged()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->durationChanged();
+}
+
+void WebMediaPlayerClientImpl::rateChanged()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->rateChanged();
+}
+
+void WebMediaPlayerClientImpl::sizeChanged()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->sizeChanged();
+}
+
+void WebMediaPlayerClientImpl::sawUnsupportedTracks()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->mediaPlayerClient()->mediaPlayerSawUnsupportedTracks(m_mediaPlayer);
+}
+
+// MediaPlayerPrivateInterface -------------------------------------------------
+
+void WebMediaPlayerClientImpl::load(const String& url)
+{
+    Frame* frame = static_cast<HTMLMediaElement*>(
+        m_mediaPlayer->mediaPlayerClient())->document()->frame();
+    m_webMediaPlayer.set(createWebMediaPlayer(this, frame));
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->load(KURL(ParsedURLString, url));
+}
+
+void WebMediaPlayerClientImpl::cancelLoad()
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->cancelLoad();
+}
+
+void WebMediaPlayerClientImpl::play()
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->play();
+}
+
+void WebMediaPlayerClientImpl::pause()
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->pause();
+}
+
+IntSize WebMediaPlayerClientImpl::naturalSize() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->naturalSize();
+    return IntSize();
+}
+
+bool WebMediaPlayerClientImpl::hasVideo() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->hasVideo();
+    return false;
+}
+
+bool WebMediaPlayerClientImpl::hasAudio() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->hasAudio();
+    return false;
+}
+
+void WebMediaPlayerClientImpl::setVisible(bool visible)
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->setVisible(visible);
+}
+
+float WebMediaPlayerClientImpl::duration() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->duration();
+    return 0.0f;
+}
+
+float WebMediaPlayerClientImpl::currentTime() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->currentTime();
+    return 0.0f;
+}
+
+void WebMediaPlayerClientImpl::seek(float time)
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->seek(time);
+}
+
+bool WebMediaPlayerClientImpl::seeking() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->seeking();
+    return false;
+}
+
+void WebMediaPlayerClientImpl::setEndTime(float time)
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->setEndTime(time);
+}
+
+void WebMediaPlayerClientImpl::setRate(float rate)
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->setRate(rate);
+}
+
+bool WebMediaPlayerClientImpl::paused() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->paused();
+    return false;
+}
+
+bool WebMediaPlayerClientImpl::supportsFullscreen() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->supportsFullscreen();
+    return false;
+}
+
+bool WebMediaPlayerClientImpl::supportsSave() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->supportsSave();
+    return false;
+}
+
+void WebMediaPlayerClientImpl::setVolume(float volume)
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->setVolume(volume);
+}
+
+MediaPlayer::NetworkState WebMediaPlayerClientImpl::networkState() const
+{
+    if (m_webMediaPlayer.get())
+        return static_cast<MediaPlayer::NetworkState>(m_webMediaPlayer->networkState());
+    return MediaPlayer::Empty;
+}
+
+MediaPlayer::ReadyState WebMediaPlayerClientImpl::readyState() const
+{
+    if (m_webMediaPlayer.get())
+        return static_cast<MediaPlayer::ReadyState>(m_webMediaPlayer->readyState());
+    return MediaPlayer::HaveNothing;
+}
+
+float WebMediaPlayerClientImpl::maxTimeSeekable() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->maxTimeSeekable();
+    return 0.0f;
+}
+
+PassRefPtr<TimeRanges> WebMediaPlayerClientImpl::buffered() const
+{
+    if (m_webMediaPlayer.get()) {
+        const WebTimeRanges& webRanges = m_webMediaPlayer->buffered();
+
+        // FIXME: Save the time ranges in a member variable and update it when needed.
+        RefPtr<TimeRanges> ranges = TimeRanges::create();
+        for (size_t i = 0; i < webRanges.size(); ++i)
+            ranges->add(webRanges[i].start, webRanges[i].end);
+        return ranges.release();
+    }
+    return TimeRanges::create();
+}
+
+int WebMediaPlayerClientImpl::dataRate() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->dataRate();
+    return 0;
+}
+
+bool WebMediaPlayerClientImpl::totalBytesKnown() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->totalBytesKnown();
+    return false;
+}
+
+unsigned WebMediaPlayerClientImpl::totalBytes() const
+{
+    if (m_webMediaPlayer.get())
+        return static_cast<unsigned>(m_webMediaPlayer->totalBytes());
+    return 0;
+}
+
+unsigned WebMediaPlayerClientImpl::bytesLoaded() const
+{
+    if (m_webMediaPlayer.get())
+        return static_cast<unsigned>(m_webMediaPlayer->bytesLoaded());
+    return 0;
+}
+
+void WebMediaPlayerClientImpl::setSize(const IntSize& size)
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->setSize(WebSize(size.width(), size.height()));
+}
+
+void WebMediaPlayerClientImpl::paint(GraphicsContext* context, const IntRect& rect)
+{
+    // Normally GraphicsContext operations do nothing when painting is disabled.
+    // Since we're accessing platformContext() directly we have to manually
+    // check.
+    if (m_webMediaPlayer.get() && !context->paintingDisabled()) {
+#if WEBKIT_USING_SKIA
+        m_webMediaPlayer->paint(context->platformContext()->canvas(), rect);
+#elif WEBKIT_USING_CG
+        m_webMediaPlayer->paint(context->platformContext(), rect);
+#else
+        notImplemented();
+#endif
+    }
+}
+
+void WebMediaPlayerClientImpl::setAutobuffer(bool autoBuffer)
+{
+    if (m_webMediaPlayer.get())
+        m_webMediaPlayer->setAutoBuffer(autoBuffer);
+}
+
+bool WebMediaPlayerClientImpl::hasSingleSecurityOrigin() const
+{
+    if (m_webMediaPlayer.get())
+        return m_webMediaPlayer->hasSingleSecurityOrigin();
+    return false;
+}
+
+MediaPlayer::MovieLoadType WebMediaPlayerClientImpl::movieLoadType() const
+{
+    if (m_webMediaPlayer.get())
+        return static_cast<MediaPlayer::MovieLoadType>(
+            m_webMediaPlayer->movieLoadType());
+    return MediaPlayer::Unknown;
+}
+
+MediaPlayerPrivateInterface* WebMediaPlayerClientImpl::create(MediaPlayer* player)
+{
+    WebMediaPlayerClientImpl* client = new WebMediaPlayerClientImpl();
+    client->m_mediaPlayer = player;
+    return client;
+}
+
+void WebMediaPlayerClientImpl::getSupportedTypes(HashSet<String>& supportedTypes)
+{
+    // FIXME: integrate this list with WebMediaPlayerClientImpl::supportsType.
+    notImplemented();
+}
+
+MediaPlayer::SupportsType WebMediaPlayerClientImpl::supportsType(const String& type,
+                                                                 const String& codecs)
+{
+    WebMimeRegistry::SupportsType supportsType =
+        webKitClient()->mimeRegistry()->supportsMediaMIMEType(type, codecs);
+
+    switch (supportsType) {
+    default:
+        ASSERT_NOT_REACHED();
+    case WebMimeRegistry::IsNotSupported:
+        return MediaPlayer::IsNotSupported;
+    case WebMimeRegistry::IsSupported:
+        return MediaPlayer::IsSupported;
+    case WebMimeRegistry::MayBeSupported:
+        return MediaPlayer::MayBeSupported;
+    }
+    return MediaPlayer::IsNotSupported;
+}
+
+WebMediaPlayerClientImpl::WebMediaPlayerClientImpl()
+    : m_mediaPlayer(0)
+{
+}
+
+} // namespace WebKit
+
+#endif  // ENABLE(VIDEO)
diff --git a/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/WebKit/chromium/src/WebMediaPlayerClientImpl.h
new file mode 100644
index 0000000..7f087d0
--- /dev/null
+++ b/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMediaPlayerClientImpl_h
+#define WebMediaPlayerClientImpl_h
+
+#if ENABLE(VIDEO)
+
+#include "MediaPlayerPrivate.h"
+#include "WebMediaPlayerClient.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebKit {
+
+class WebMediaPlayer;
+
+// This class serves as a bridge between WebCore::MediaPlayer and
+// WebKit::WebMediaPlayer.
+class WebMediaPlayerClientImpl : public WebMediaPlayerClient
+                               , public WebCore::MediaPlayerPrivateInterface {
+public:
+    static bool isEnabled();
+    static void setIsEnabled(bool);
+    static void registerSelf(WebCore::MediaEngineRegistrar);
+
+    // WebMediaPlayerClient methods:
+    virtual void networkStateChanged();
+    virtual void readyStateChanged();
+    virtual void volumeChanged();
+    virtual void timeChanged();
+    virtual void repaint();
+    virtual void durationChanged();
+    virtual void rateChanged();
+    virtual void sizeChanged();
+    virtual void sawUnsupportedTracks();
+
+    // MediaPlayerPrivateInterface methods:
+    virtual void load(const WebCore::String& url);
+    virtual void cancelLoad();
+    virtual void play();
+    virtual void pause();
+    virtual bool supportsFullscreen() const;
+    virtual bool supportsSave() const;
+    virtual WebCore::IntSize naturalSize() const;
+    virtual bool hasVideo() const;
+    virtual bool hasAudio() const;
+    virtual void setVisible(bool);
+    virtual float duration() const;
+    virtual float currentTime() const;
+    virtual void seek(float time);
+    virtual bool seeking() const;
+    virtual void setEndTime(float time);
+    virtual void setRate(float);
+    virtual bool paused() const;
+    virtual void setVolume(float);
+    virtual WebCore::MediaPlayer::NetworkState networkState() const;
+    virtual WebCore::MediaPlayer::ReadyState readyState() const;
+    virtual float maxTimeSeekable() const;
+    virtual WTF::PassRefPtr<WebCore::TimeRanges> buffered() const;
+    virtual int dataRate() const;
+    virtual void setAutobuffer(bool);
+    virtual bool totalBytesKnown() const;
+    virtual unsigned totalBytes() const;
+    virtual unsigned bytesLoaded() const;
+    virtual void setSize(const WebCore::IntSize&);
+    virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect&);
+    virtual bool hasSingleSecurityOrigin() const;
+    virtual WebCore::MediaPlayer::MovieLoadType movieLoadType() const;
+
+private:
+    WebMediaPlayerClientImpl();
+
+    static WebCore::MediaPlayerPrivateInterface* create(WebCore::MediaPlayer*);
+    static void getSupportedTypes(WTF::HashSet<WebCore::String>&);
+    static WebCore::MediaPlayer::SupportsType supportsType(
+        const WebCore::String& type, const WebCore::String& codecs);
+
+    WebCore::MediaPlayer* m_mediaPlayer;
+    OwnPtr<WebMediaPlayer> m_webMediaPlayer;
+    static bool m_isEnabled;
+};
+
+} // namespace WebKit
+
+#endif
+
+#endif
diff --git a/WebKit/chromium/src/WebNode.cpp b/WebKit/chromium/src/WebNode.cpp
new file mode 100644
index 0000000..965c412
--- /dev/null
+++ b/WebKit/chromium/src/WebNode.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebNode.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "FrameLoaderClientImpl.h"
+#include "Node.h"
+
+#include "WebFrameImpl.h"
+#include "WebString.h"
+
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebNodePrivate : public Node {
+};
+
+void WebNode::reset()
+{
+    assign(0);
+}
+
+void WebNode::assign(const WebNode& other)
+{
+    WebNodePrivate* p = const_cast<WebNodePrivate*>(other.m_private);
+    if (p)
+        p->ref();
+    assign(p);
+}
+
+WebNode WebNode::parentNode() const
+{
+    return PassRefPtr<Node>(const_cast<Node*>(m_private->parentNode()));
+}
+
+WebString WebNode::nodeName() const
+{
+    return m_private->nodeName();
+}
+
+WebNode::WebNode(const WTF::PassRefPtr<WebCore::Node>& node)
+    : m_private(static_cast<WebNodePrivate*>(node.releaseRef()))
+{
+}
+
+WebNode& WebNode::operator=(const WTF::PassRefPtr<WebCore::Node>& node)
+{
+    assign(static_cast<WebNodePrivate*>(node.releaseRef()));
+    return *this;
+}
+
+WebNode::operator WTF::PassRefPtr<WebCore::Node>() const
+{
+    return PassRefPtr<Node>(const_cast<WebNodePrivate*>(m_private));
+}
+
+void WebNode::assign(WebNodePrivate* p)
+{
+    // p is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+WebFrame* WebNode::frame() const
+{
+    return WebFrameImpl::fromFrame(m_private->document()->frame());
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebNotification.cpp b/WebKit/chromium/src/WebNotification.cpp
new file mode 100644
index 0000000..1f6916e
--- /dev/null
+++ b/WebKit/chromium/src/WebNotification.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebNotification.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Notification.h"
+
+#include "WebString.h"
+#include "WebURL.h"
+
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebNotificationPrivate : public Notification {
+};
+
+void WebNotification::reset()
+{
+    assign(0);
+}
+
+void WebNotification::assign(const WebNotification& other)
+{
+    WebNotificationPrivate* p = const_cast<WebNotificationPrivate*>(other.m_private);
+    if (p)
+        p->ref();
+    assign(p);
+}
+
+bool WebNotification::lessThan(const WebNotification& other) const
+{
+    return reinterpret_cast<uintptr_t>(m_private) < reinterpret_cast<uintptr_t>(other.m_private);
+}
+
+bool WebNotification::isHTML() const
+{
+    return m_private->isHTML();
+}
+
+WebURL WebNotification::url() const
+{
+    ASSERT(isHTML());
+    return m_private->url();
+}
+
+WebString WebNotification::icon() const
+{
+    ASSERT(!isHTML());
+    return m_private->contents().icon();
+}
+
+WebString WebNotification::title() const
+{
+    ASSERT(!isHTML());
+    return m_private->contents().title();
+}
+
+WebString WebNotification::body() const
+{
+    ASSERT(!isHTML());
+    return m_private->contents().body();
+}
+
+void WebNotification::dispatchDisplayEvent()
+{
+    RefPtr<Event> event = Event::create("display", false, true);
+    m_private->dispatchEvent(event.release());
+}
+
+void WebNotification::dispatchErrorEvent(const WebKit::WebString& /* errorMessage */)
+{
+    // FIXME: errorMessage not supported by WebCore yet
+    RefPtr<Event> event = Event::create(eventNames().errorEvent, false, true);
+    m_private->dispatchEvent(event.release());
+}
+
+void WebNotification::dispatchCloseEvent(bool /* byUser */)
+{
+    // FIXME: byUser flag not supported by WebCore yet
+    RefPtr<Event> event = Event::create(eventNames().closeEvent, false, true);
+    m_private->dispatchEvent(event.release());
+}
+
+WebNotification::WebNotification(const WTF::PassRefPtr<Notification>& notification)
+    : m_private(static_cast<WebNotificationPrivate*>(notification.releaseRef()))
+{
+}
+
+WebNotification& WebNotification::operator=(const WTF::PassRefPtr<Notification>& notification)
+{
+    assign(static_cast<WebNotificationPrivate*>(notification.releaseRef()));
+    return *this;
+}
+
+WebNotification::operator WTF::PassRefPtr<Notification>() const
+{
+    return WTF::PassRefPtr<Notification>(const_cast<WebNotificationPrivate*>(m_private));
+}
+
+void WebNotification::assign(WebNotificationPrivate* p)
+{
+    // p is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/WebKit/chromium/src/WebPasswordFormData.cpp b/WebKit/chromium/src/WebPasswordFormData.cpp
new file mode 100644
index 0000000..64b1754
--- /dev/null
+++ b/WebKit/chromium/src/WebPasswordFormData.cpp
@@ -0,0 +1,180 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebPasswordFormData.h"
+
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "KURL.h"
+
+#include "DOMUtilitiesPrivate.h"
+#include "WebPasswordFormUtils.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+namespace {
+
+// Helper to determine which password is the main one, and which is
+// an old password (e.g on a "make new password" form), if any.
+bool locateSpecificPasswords(PasswordFormFields* fields,
+                             HTMLInputElement** password,
+                             HTMLInputElement** oldPassword)
+{
+    ASSERT(fields);
+    ASSERT(password);
+    ASSERT(oldPassword);
+    switch (fields->passwords.size()) {
+    case 1:
+        // Single password, easy.
+        *password = fields->passwords[0];
+        break;
+    case 2:
+        if (fields->passwords[0]->value() == fields->passwords[1]->value())
+            // Treat two identical passwords as a single password.
+            *password = fields->passwords[0];
+        else {
+            // Assume first is old password, second is new (no choice but to guess).
+            *oldPassword = fields->passwords[0];
+            *password = fields->passwords[1];
+        }
+        break;
+    case 3:
+        if (fields->passwords[0]->value() == fields->passwords[1]->value()
+            && fields->passwords[0]->value() == fields->passwords[2]->value()) {
+            // All three passwords the same? Just treat as one and hope.
+            *password = fields->passwords[0];
+        } else if (fields->passwords[0]->value() == fields->passwords[1]->value()) {
+            // Two the same and one different -> old password is duplicated one.
+            *oldPassword = fields->passwords[0];
+            *password = fields->passwords[2];
+        } else if (fields->passwords[1]->value() == fields->passwords[2]->value()) {
+            *oldPassword = fields->passwords[0];
+            *password = fields->passwords[1];
+        } else {
+            // Three different passwords, or first and last match with middle
+            // different. No idea which is which, so no luck.
+            return false;
+        }
+        break;
+    default:
+        return false;
+    }
+    return true;
+}
+
+// Helped method to clear url of unneeded parts.
+KURL stripURL(const KURL& url)
+{
+    KURL strippedURL = url;
+    strippedURL.setUser(String());
+    strippedURL.setPass(String());
+    strippedURL.setQuery(String());
+    strippedURL.setFragmentIdentifier(String());
+    return strippedURL;
+}
+
+// Helper to gather up the final form data and create a PasswordForm.
+void assemblePasswordFormResult(const KURL& fullOrigin,
+                                const KURL& fullAction,
+                                HTMLFormControlElement* submit,
+                                HTMLInputElement* userName,
+                                HTMLInputElement* oldPassword,
+                                HTMLInputElement* password,
+                                WebPasswordFormData* result)
+{
+    // We want to keep the path but strip any authentication data, as well as
+    // query and ref portions of URL, for the form action and form origin.
+    result->action = stripURL(fullAction);
+    result->origin = stripURL(fullOrigin);
+
+    // Naming is confusing here because we have both the HTML form origin URL
+    // the page where the form was seen), and the "origin" components of the url
+    // (scheme, host, and port).
+    KURL signonRealmURL = stripURL(fullOrigin);
+    signonRealmURL.setPath("");
+    result->signonRealm = signonRealmURL;
+
+    if (submit)
+        result->submitElement = submit->name();
+    if (userName) {
+        result->userNameElement = userName->name();
+        result->userNameValue = userName->value();
+    }
+    if (password) {
+        result->passwordElement = password->name();
+        result->passwordValue = password->value();
+    }
+    if (oldPassword) {
+        result->oldPasswordElement = oldPassword->name();
+        result->oldPasswordValue = oldPassword->value();
+    }
+}
+
+} // namespace
+
+WebPasswordFormData::WebPasswordFormData(const WebFormElement& webForm)
+{
+    RefPtr<HTMLFormElement> form = webForm.operator PassRefPtr<HTMLFormElement>();
+
+    Frame* frame = form->document()->frame();
+    if (!frame)
+        return;
+
+    PasswordFormFields fields;
+    findPasswordFormFields(form.get(), &fields);
+
+    // Get the document URL
+    KURL fullOrigin(ParsedURLString, form->document()->documentURI());
+
+    // Calculate the canonical action URL
+    KURL fullAction = frame->loader()->completeURL(form->action());
+    if (!fullAction.isValid())
+        return;
+
+    // Determine the types of the password fields
+    HTMLInputElement* password = 0;
+    HTMLInputElement* oldPassword = 0;
+    if (!locateSpecificPasswords(&fields, &password, &oldPassword))
+        return;
+
+    assemblePasswordFormResult(fullOrigin, fullAction,
+                               fields.submit, fields.userName,
+                               oldPassword, password, this);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebPasswordFormUtils.cpp b/WebKit/chromium/src/WebPasswordFormUtils.cpp
new file mode 100644
index 0000000..766dc63
--- /dev/null
+++ b/WebKit/chromium/src/WebPasswordFormUtils.cpp
@@ -0,0 +1,110 @@
+/* ***** BEGIN LICENSE BLOCK *****
+* Version: MPL 1.1/GPL 2.0/LGPL 2.1
+*
+* The contents of this file are subject to the Mozilla Public License Version
+* 1.1 (the "License"); you may not use this file except in compliance with
+* the License. You may obtain a copy of the License at
+* http://www.mozilla.org/MPL/
+*
+* Software distributed under the License is distributed on an "AS IS" basis,
+* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+* for the specific language governing rights and limitations under the
+* License.
+*
+* The Original Code is Mozilla Password Manager.
+*
+* The Initial Developer of the Original Code is
+* Brian Ryner.
+* Portions created by the Initial Developer are Copyright (C) 2003
+* the Initial Developer. All Rights Reserved.
+*
+* Contributor(s):
+*  Brian Ryner <bryner@brianryner.com>
+*
+* Alternatively, the contents of this file may be used under the terms of
+* either the GNU General Public License Version 2 or later (the "GPL"), or
+* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+* in which case the provisions of the GPL or the LGPL are applicable instead
+* of those above. If you wish to allow use of your version of this file only
+* under the terms of either the GPL or the LGPL, and not to allow others to
+* use your version of this file under the terms of the MPL, indicate your
+* decision by deleting the provisions above and replace them with the notice
+* and other provisions required by the GPL or the LGPL. If you do not delete
+* the provisions above, a recipient may use your version of this file under
+* the terms of any one of the MPL, the GPL or the LGPL.
+*
+* ***** END LICENSE BLOCK ***** */
+
+// Helper to WebPasswordFormData to do the locating of username/password
+// fields.
+// This method based on Firefox2 code in
+//   toolkit/components/passwordmgr/base/nsPasswordManager.cpp
+
+#include "config.h"
+#include "WebPasswordFormUtils.h"
+
+#include "HTMLFormElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "KURL.h"
+
+#include "DOMUtilitiesPrivate.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// Maximum number of password fields we will observe before throwing our
+// hands in the air and giving up with a given form.
+static const size_t maxPasswords = 3;
+
+void findPasswordFormFields(HTMLFormElement* form, PasswordFormFields* fields)
+{
+    ASSERT(form);
+    ASSERT(fields);
+
+    int firstPasswordIndex = 0;
+    // First, find the password fields and activated submit button
+    const Vector<HTMLFormControlElement*>& formElements = form->formElements;
+    for (size_t i = 0; i < formElements.size(); i++) {
+        HTMLFormControlElement* formElement = formElements[i];
+        if (formElement->isActivatedSubmit())
+            fields->submit = formElement;
+
+        if (!formElement->hasLocalName(HTMLNames::inputTag))
+            continue;
+
+        HTMLInputElement* inputElement = toHTMLInputElement(formElement);
+        if (!inputElement->isEnabledFormControl())
+            continue;
+
+        if ((fields->passwords.size() < maxPasswords)
+            && (inputElement->inputType() == HTMLInputElement::PASSWORD)
+            && (inputElement->autoComplete())) {
+            if (fields->passwords.isEmpty())
+                firstPasswordIndex = i;
+            fields->passwords.append(inputElement);
+        }
+    }
+
+    if (!fields->passwords.isEmpty()) {
+        // Then, search backwards for the username field
+        for (int i = firstPasswordIndex - 1; i >= 0; i--) {
+            HTMLFormControlElement* formElement = formElements[i];
+            if (!formElement->hasLocalName(HTMLNames::inputTag))
+                continue;
+
+            HTMLInputElement* inputElement = toHTMLInputElement(formElement);
+            if (!inputElement->isEnabledFormControl())
+                continue;
+
+            if ((inputElement->inputType() == HTMLInputElement::TEXT)
+                && (inputElement->autoComplete())) {
+                fields->userName = inputElement;
+                break;
+            }
+        }
+    }
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebPasswordFormUtils.h b/WebKit/chromium/src/WebPasswordFormUtils.h
new file mode 100644
index 0000000..fd503b4
--- /dev/null
+++ b/WebKit/chromium/src/WebPasswordFormUtils.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPasswordFormUtils_h
+#define WebPasswordFormUtils_h
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+class HTMLInputElement;
+class HTMLFormControlElement;
+class HTMLFormElement;
+}
+
+namespace WebKit {
+
+// Helper structure to locate username, passwords and submit fields.
+struct PasswordFormFields {
+    WebCore::HTMLInputElement* userName;
+    Vector<WebCore::HTMLInputElement*> passwords;
+    WebCore::HTMLFormControlElement* submit;
+    PasswordFormFields() : userName(0), submit(0) { }
+};
+
+void findPasswordFormFields(WebCore::HTMLFormElement* form,
+                            PasswordFormFields* fields);
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.cpp b/WebKit/chromium/src/WebPluginContainerImpl.cpp
new file mode 100644
index 0000000..43f3cef
--- /dev/null
+++ b/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -0,0 +1,556 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebPluginContainerImpl.h"
+
+#include "ChromeClientImpl.h"
+#include "WebCursorInfo.h"
+#include "WebDataSourceImpl.h"
+#include "WebInputEvent.h"
+#include "WebInputEventConversion.h"
+#include "WebKit.h"
+#include "WebPlugin.h"
+#include "WebRect.h"
+#include "WebURLError.h"
+#include "WebURLRequest.h"
+#include "WebVector.h"
+#include "WrappedResourceResponse.h"
+
+#include "EventNames.h"
+#include "FocusController.h"
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HostWindow.h"
+#include "HTMLFormElement.h"
+#include "HTMLNames.h"
+#include "HTMLPlugInElement.h"
+#include "KeyboardEvent.h"
+#include "MouseEvent.h"
+#include "Page.h"
+#include "ScrollView.h"
+
+#if WEBKIT_USING_SKIA
+#include "PlatformContextSkia.h"
+#endif
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// Public methods --------------------------------------------------------------
+
+void WebPluginContainerImpl::setFrameRect(const IntRect& frameRect)
+{
+    Widget::setFrameRect(frameRect);
+    reportGeometry();
+}
+
+void WebPluginContainerImpl::paint(GraphicsContext* gc, const IntRect& damageRect)
+{
+    if (gc->paintingDisabled())
+        return;
+
+    if (!parent())
+        return;
+
+    // Don't paint anything if the plugin doesn't intersect the damage rect.
+    if (!frameRect().intersects(damageRect))
+        return;
+
+    gc->save();
+
+    ASSERT(parent()->isFrameView());
+    ScrollView* view = parent();
+
+    // The plugin is positioned in window coordinates, so it needs to be painted
+    // in window coordinates.
+    IntPoint origin = view->windowToContents(IntPoint(0, 0));
+    gc->translate(static_cast<float>(origin.x()), static_cast<float>(origin.y()));
+
+#if WEBKIT_USING_SKIA
+    WebCanvas* canvas = gc->platformContext()->canvas();
+#elif WEBKIT_USING_CG
+    WebCanvas* canvas = gc->platformContext();
+#endif
+
+    IntRect windowRect =
+        IntRect(view->contentsToWindow(damageRect.location()), damageRect.size());
+    m_webPlugin->paint(canvas, windowRect);
+
+    gc->restore();
+}
+
+void WebPluginContainerImpl::invalidateRect(const IntRect& rect)
+{
+    if (!parent())
+        return;
+
+    IntRect damageRect = convertToContainingWindow(rect);
+
+    // Get our clip rect and intersect with it to ensure we don't invalidate
+    // too much.
+    IntRect clipRect = parent()->windowClipRect();
+    damageRect.intersect(clipRect);
+
+    parent()->hostWindow()->repaint(damageRect, true);
+}
+
+void WebPluginContainerImpl::setFocus()
+{
+    Widget::setFocus();
+    m_webPlugin->updateFocus(true);
+}
+
+void WebPluginContainerImpl::show()
+{
+    setSelfVisible(true);
+    m_webPlugin->updateVisibility(true);
+
+    Widget::show();
+}
+
+void WebPluginContainerImpl::hide()
+{
+    setSelfVisible(false);
+    m_webPlugin->updateVisibility(false);
+
+    Widget::hide();
+}
+
+void WebPluginContainerImpl::handleEvent(Event* event)
+{
+    if (!m_webPlugin->acceptsInputEvents())
+        return;
+
+    // The events we pass are defined at:
+    //    http://devedge-temp.mozilla.org/library/manuals/2002/plugin/1.0/structures5.html#1000000
+    // Don't take the documentation as truth, however.  There are many cases
+    // where mozilla behaves differently than the spec.
+    if (event->isMouseEvent())
+        handleMouseEvent(static_cast<MouseEvent*>(event));
+    else if (event->isKeyboardEvent())
+        handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
+}
+
+void WebPluginContainerImpl::frameRectsChanged()
+{
+    Widget::frameRectsChanged();
+    reportGeometry();
+}
+
+void WebPluginContainerImpl::setParentVisible(bool parentVisible)
+{
+    // We override this function to make sure that geometry updates are sent
+    // over to the plugin. For e.g. when a plugin is instantiated it does not
+    // have a valid parent. As a result the first geometry update from webkit
+    // is ignored. This function is called when the plugin eventually gets a
+    // parent.
+
+    if (isParentVisible() == parentVisible)
+        return;  // No change.
+
+    Widget::setParentVisible(parentVisible);
+    if (!isSelfVisible())
+        return;  // This widget has explicitely been marked as not visible.
+
+    m_webPlugin->updateVisibility(isVisible());
+}
+
+void WebPluginContainerImpl::setParent(ScrollView* view)
+{
+    // We override this function so that if the plugin is windowed, we can call
+    // NPP_SetWindow at the first possible moment.  This ensures that
+    // NPP_SetWindow is called before the manual load data is sent to a plugin.
+    // If this order is reversed, Flash won't load videos.
+
+    Widget::setParent(view);
+    if (view)
+        reportGeometry();
+}
+
+void WebPluginContainerImpl::invalidate()
+{
+    Widget::invalidate();
+}
+
+void WebPluginContainerImpl::invalidateRect(const WebRect& rect)
+{
+    invalidateRect(static_cast<IntRect>(rect));
+}
+
+void WebPluginContainerImpl::reportGeometry()
+{
+    if (!parent())
+        return;
+
+    IntRect windowRect, clipRect;
+    Vector<IntRect> cutOutRects;
+    calculateGeometry(frameRect(), windowRect, clipRect, cutOutRects);
+
+    m_webPlugin->updateGeometry(windowRect, clipRect, cutOutRects, isVisible());
+}
+
+void WebPluginContainerImpl::clearScriptObjects()
+{
+    Frame* frame = m_element->document()->frame();
+    if (!frame)
+        return;
+    frame->script()->cleanupScriptObjectsForPlugin(this);
+}
+
+NPObject* WebPluginContainerImpl::scriptableObjectForElement()
+{
+    return m_element->getNPObject();
+}
+
+WebString WebPluginContainerImpl::executeScriptURL(const WebURL& url, bool popupsAllowed)
+{
+    Frame* frame = m_element->document()->frame();
+    if (!frame)
+        return WebString();
+
+    const KURL& kurl = url;
+    ASSERT(kurl.protocolIs("javascript"));
+
+    String script = decodeURLEscapeSequences(
+        kurl.string().substring(strlen("javascript:")));
+
+    ScriptValue result = frame->script()->executeScript(script, popupsAllowed);
+
+    // Failure is reported as a null string.
+    String resultStr;
+    result.getString(resultStr);
+    return resultStr;
+}
+
+void WebPluginContainerImpl::loadFrameRequest(
+    const WebURLRequest& request, const WebString& target, bool notifyNeeded, void* notifyData)
+{
+    Frame* frame = m_element->document()->frame();
+    if (!frame)
+        return;  // FIXME: send a notification in this case?
+
+    if (notifyNeeded) {
+        // FIXME: This is a bit of hack to allow us to observe completion of
+        // our frame request.  It would be better to evolve FrameLoader to
+        // support a completion callback instead.
+        WebPluginLoadObserver* observer =
+            new WebPluginLoadObserver(this, request.url(), notifyData);
+        m_pluginLoadObservers.append(observer);
+        WebDataSourceImpl::setNextPluginLoadObserver(observer);
+    }
+
+    FrameLoadRequest frameRequest(request.toResourceRequest());
+    frameRequest.setFrameName(target);
+
+    frame->loader()->loadFrameRequest(
+        frameRequest,
+        false,  // lock history
+        false,  // lock back forward list
+        0,      // event
+        0,     // form state
+        SendReferrer);
+}
+
+void WebPluginContainerImpl::didReceiveResponse(const ResourceResponse& response)
+{
+    // Make sure that the plugin receives window geometry before data, or else
+    // plugins misbehave.
+    frameRectsChanged();
+
+    WrappedResourceResponse urlResponse(response);
+    m_webPlugin->didReceiveResponse(urlResponse);
+}
+
+void WebPluginContainerImpl::didReceiveData(const char *data, int dataLength)
+{
+    m_webPlugin->didReceiveData(data, dataLength);
+}
+
+void WebPluginContainerImpl::didFinishLoading()
+{
+    m_webPlugin->didFinishLoading();
+}
+
+void WebPluginContainerImpl::didFailLoading(const ResourceError& error)
+{
+    m_webPlugin->didFailLoading(error);
+}
+
+NPObject* WebPluginContainerImpl::scriptableObject()
+{
+    return m_webPlugin->scriptableObject();
+}
+
+void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver* observer)
+{
+    size_t pos = m_pluginLoadObservers.find(observer);
+    if (pos == notFound)
+        return;
+    m_pluginLoadObservers.remove(pos);
+}
+
+// Private methods -------------------------------------------------------------
+
+WebPluginContainerImpl::~WebPluginContainerImpl()
+{
+    for (size_t i = 0; i < m_pluginLoadObservers.size(); ++i)
+        m_pluginLoadObservers[i]->clearPluginContainer();
+    m_webPlugin->destroy();
+}
+
+void WebPluginContainerImpl::handleMouseEvent(MouseEvent* event)
+{
+    ASSERT(parent()->isFrameView());
+
+    // We cache the parent FrameView here as the plugin widget could be deleted
+    // in the call to HandleEvent. See http://b/issue?id=1362948
+    FrameView* parentView = static_cast<FrameView*>(parent());
+
+    WebMouseEventBuilder webEvent(parentView, *event);
+    if (webEvent.type == WebInputEvent::Undefined)
+        return;
+
+    if (event->type() == eventNames().mousedownEvent) {
+        // Ensure that the frame containing the plugin has focus.
+        Frame* containingFrame = parentView->frame();
+        if (Page* currentPage = containingFrame->page())
+            currentPage->focusController()->setFocusedFrame(containingFrame);
+        // Give focus to our containing HTMLPluginElement.
+        containingFrame->document()->setFocusedNode(m_element);
+    }
+
+    WebCursorInfo cursorInfo;
+    bool handled = m_webPlugin->handleInputEvent(webEvent, cursorInfo);
+#if !PLATFORM(DARWIN)
+    // TODO(pkasting): http://b/1119691 This conditional seems exactly
+    // backwards, but if I reverse it, giving focus to a transparent
+    // (windowless) plugin fails.
+    handled = !handled;
+    // TODO(awalker): oddly, the above is not true in Mac builds.  Looking
+    // at Apple's corresponding code for Mac and Windows (PluginViewMac and
+    // PluginViewWin), setDefaultHandled() gets called when handleInputEvent()
+    // returns true, which then indicates to WebCore that the plugin wants to
+    // swallow the event--which is what we want.  Calling setDefaultHandled()
+    // fixes several Mac Chromium bugs, but does indeed prevent windowless plugins
+    // from getting focus in Windows builds, as pkasting notes above.  So for
+    // now, we only do so in Mac builds.
+#endif
+    if (handled)
+        event->setDefaultHandled();
+
+    // A windowless plugin can change the cursor in response to a mouse move
+    // event.  We need to reflect the changed cursor in the frame view as the
+    // mouse is moved in the boundaries of the windowless plugin.
+    Page* page = parentView->frame()->page();
+    if (!page)
+        return;
+    ChromeClientImpl* chromeClient =
+        static_cast<ChromeClientImpl*>(page->chrome()->client());
+    chromeClient->setCursorForPlugin(cursorInfo);
+}
+
+void WebPluginContainerImpl::handleKeyboardEvent(KeyboardEvent* event)
+{
+    WebKeyboardEventBuilder webEvent(*event);
+    if (webEvent.type == WebInputEvent::Undefined)
+        return;
+
+    WebCursorInfo cursor_info;
+    bool handled = m_webPlugin->handleInputEvent(webEvent, cursor_info);
+#if !PLATFORM(DARWIN)
+    // TODO(pkasting): http://b/1119691 See above.
+    handled = !handled;
+#endif
+    if (handled)
+        event->setDefaultHandled();
+}
+
+void WebPluginContainerImpl::calculateGeometry(const IntRect& frameRect,
+                                               IntRect& windowRect,
+                                               IntRect& clipRect,
+                                               Vector<IntRect>& cutOutRects)
+{
+    windowRect = IntRect(
+        parent()->contentsToWindow(frameRect.location()), frameRect.size());
+
+    // Calculate a clip-rect so that we don't overlap the scrollbars, etc.
+    clipRect = windowClipRect();
+    clipRect.move(-windowRect.x(), -windowRect.y());
+
+    windowCutOutRects(frameRect, cutOutRects);
+    // Convert to the plugin position.
+    for (size_t i = 0; i < cutOutRects.size(); i++)
+        cutOutRects[i].move(-frameRect.x(), -frameRect.y());
+}
+
+WebCore::IntRect WebPluginContainerImpl::windowClipRect() const
+{
+    // Start by clipping to our bounds.
+    IntRect clipRect =
+        convertToContainingWindow(IntRect(0, 0, width(), height()));
+
+    // document()->renderer() can be 0 when we receive messages from the
+    // plugins while we are destroying a frame.
+    if (m_element->renderer()->document()->renderer()) {
+        // Take our element and get the clip rect from the enclosing layer and
+        // frame view.
+        RenderLayer* layer = m_element->renderer()->enclosingLayer();
+        clipRect.intersect(
+            m_element->document()->view()->windowClipRectForLayer(layer, true));
+    }
+
+    return clipRect;
+}
+
+static void getObjectStack(const RenderObject* ro,
+                           Vector<const RenderObject*>* roStack)
+{
+    roStack->clear();
+    while (ro) {
+        roStack->append(ro);
+        ro = ro->parent();
+    }
+}
+
+// Returns true if stack1 is at or above stack2
+static bool checkStackOnTop(
+        const Vector<const RenderObject*>& iframeZstack,
+        const Vector<const RenderObject*>& pluginZstack)
+{
+    for (size_t i1 = 0, i2 = 0;
+         i1 < iframeZstack.size() && i2 < pluginZstack.size();
+         i1++, i2++) {
+        // The root is at the end of these stacks.  We want to iterate
+        // root-downwards so we index backwards from the end.
+        const RenderObject* ro1 = iframeZstack[iframeZstack.size() - 1 - i1];
+        const RenderObject* ro2 = pluginZstack[pluginZstack.size() - 1 - i2];
+
+        if (ro1 != ro2) {
+            // When we find nodes in the stack that are not the same, then
+            // we've found the nodes just below the lowest comment ancestor.
+            // Determine which should be on top.
+
+            // See if z-index determines an order.
+            if (ro1->style() && ro2->style()) {
+                int z1 = ro1->style()->zIndex();
+                int z2 = ro2->style()->zIndex();
+                if (z1 > z2)
+                    return true;
+                if (z1 < z2)
+                    return false;
+            }
+
+            // For compatibility with IE: when the plugin is not positioned,
+            // it stacks behind the iframe, even if it's later in the
+            // document order.
+            if (ro2->style()->position() == StaticPosition)
+                return true;
+
+            // Inspect the document order.  Later order means higher
+            // stacking.
+            const RenderObject* parent = ro1->parent();
+            if (!parent)
+                return false;
+            ASSERT(parent == ro2->parent());
+
+            for (const RenderObject* ro = parent->firstChild(); ro; ro = ro->nextSibling()) {
+                if (ro == ro1)
+                    return false;
+                if (ro == ro2)
+                    return true;
+            }
+            ASSERT(false);  // We should have seen ro1 and ro2 by now.
+            return false;
+        }
+    }
+    return true;
+}
+
+// Return a set of rectangles that should not be overdrawn by the
+// plugin ("cutouts").  This helps implement the "iframe shim"
+// technique of overlaying a windowed plugin with content from the
+// page.  In a nutshell, iframe elements should occlude plugins when
+// they occur higher in the stacking order.
+void WebPluginContainerImpl::windowCutOutRects(const IntRect& frameRect,
+                                               Vector<IntRect>& cutOutRects)
+{
+    RenderObject* pluginNode = m_element->renderer();
+    ASSERT(pluginNode);
+    if (!pluginNode->style())
+        return;
+    Vector<const RenderObject*> pluginZstack;
+    Vector<const RenderObject*> iframeZstack;
+    getObjectStack(pluginNode, &pluginZstack);
+
+    // Get the parent widget
+    Widget* parentWidget = this->parent();
+    if (!parentWidget->isFrameView())
+        return;
+
+    FrameView* parentFrameView = static_cast<FrameView*>(parentWidget);
+
+    const HashSet<RefPtr<Widget> >* children = parentFrameView->children();
+    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != children->end(); ++it) {
+        // We only care about FrameView's because iframes show up as FrameViews.
+        if (!(*it)->isFrameView())
+            continue;
+
+        const FrameView* frameView =
+            static_cast<const FrameView*>((*it).get());
+        // Check to make sure we can get both the element and the RenderObject
+        // for this FrameView, if we can't just move on to the next object.
+        if (!frameView->frame() || !frameView->frame()->ownerElement()
+            || !frameView->frame()->ownerElement()->renderer())
+            continue;
+
+        HTMLElement* element = frameView->frame()->ownerElement();
+        RenderObject* iframeRenderer = element->renderer();
+
+        if (element->hasTagName(HTMLNames::iframeTag)
+            && iframeRenderer->absoluteBoundingBoxRect().intersects(frameRect)
+            && (!iframeRenderer->style() || iframeRenderer->style()->visibility() == VISIBLE)) {
+            getObjectStack(iframeRenderer, &iframeZstack);
+            if (checkStackOnTop(iframeZstack, pluginZstack)) {
+                IntPoint point =
+                    roundedIntPoint(iframeRenderer->localToAbsolute());
+                RenderBox* rbox = toRenderBox(iframeRenderer);
+                IntSize size(rbox->width(), rbox->height());
+                cutOutRects.append(IntRect(point, size));
+            }
+        }
+    }
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.h b/WebKit/chromium/src/WebPluginContainerImpl.h
new file mode 100644
index 0000000..00450bb
--- /dev/null
+++ b/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPluginContainerImpl_h
+#define WebPluginContainerImpl_h
+
+// FIXME: This relative path is a temporary hack to support using this
+// header from webkit/glue.
+#include "../public/WebPluginContainer.h"
+
+#include "Widget.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/Vector.h>
+
+struct NPObject;
+
+namespace WebCore {
+class HTMLPlugInElement;
+class IntRect;
+class KeyboardEvent;
+class MouseEvent;
+class ResourceError;
+class ResourceResponse;
+}
+
+namespace WebKit {
+
+class WebPlugin;
+class WebPluginLoadObserver;
+
+class WebPluginContainerImpl : public WebCore::Widget, public WebPluginContainer {
+public:
+    static PassRefPtr<WebPluginContainerImpl> create(WebCore::HTMLPlugInElement* element, WebPlugin* webPlugin)
+    {
+        return adoptRef(new WebPluginContainerImpl(element, webPlugin));
+    }
+
+    // Widget methods
+    virtual void setFrameRect(const WebCore::IntRect&);
+    virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect&);
+    virtual void invalidateRect(const WebCore::IntRect&);
+    virtual void setFocus();
+    virtual void show();
+    virtual void hide();
+    virtual void handleEvent(WebCore::Event*);
+    virtual void frameRectsChanged();
+    virtual void setParentVisible(bool);
+    virtual void setParent(WebCore::ScrollView*);
+
+    // WebPluginContainer methods
+    virtual void invalidate();
+    virtual void invalidateRect(const WebRect&);
+    virtual void reportGeometry();
+    virtual void clearScriptObjects();
+    virtual NPObject* scriptableObjectForElement();
+    virtual WebString executeScriptURL(const WebURL&, bool popupsAllowed);
+    virtual void loadFrameRequest(const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData);
+
+    // Resource load events for the plugin's source data:
+    void didReceiveResponse(const WebCore::ResourceResponse&);
+    void didReceiveData(const char *data, int dataLength);
+    void didFinishLoading();
+    void didFailLoading(const WebCore::ResourceError&);
+
+    NPObject* scriptableObject();
+
+    // This cannot be null.
+    WebPlugin* plugin() { return m_webPlugin; }
+
+    void willDestroyPluginLoadObserver(WebPluginLoadObserver*);
+
+private:
+    WebPluginContainerImpl(WebCore::HTMLPlugInElement* element, WebPlugin* webPlugin)
+        : m_element(element)
+        , m_webPlugin(webPlugin) { }
+    ~WebPluginContainerImpl();
+
+    void handleMouseEvent(WebCore::MouseEvent*);
+    void handleKeyboardEvent(WebCore::KeyboardEvent*);
+
+    void calculateGeometry(const WebCore::IntRect& frameRect,
+                           WebCore::IntRect& windowRect,
+                           WebCore::IntRect& clipRect,
+                           Vector<WebCore::IntRect>& cutOutRects);
+    WebCore::IntRect windowClipRect() const;
+    void windowCutOutRects(const WebCore::IntRect& frameRect,
+                           Vector<WebCore::IntRect>& cutOutRects);
+
+    WebCore::HTMLPlugInElement* m_element;
+    WebPlugin* m_webPlugin;
+    Vector<WebPluginLoadObserver*> m_pluginLoadObservers;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebPluginListBuilderImpl.cpp b/WebKit/chromium/src/WebPluginListBuilderImpl.cpp
new file mode 100644
index 0000000..6926a2d
--- /dev/null
+++ b/WebKit/chromium/src/WebPluginListBuilderImpl.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebPluginListBuilderImpl.h"
+
+#include "PluginData.h"
+#include "WebString.h"
+#include <wtf/Vector.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebPluginListBuilderImpl::addPlugin(const WebString& name, const WebString& description, const WebString& fileName)
+{
+    PluginInfo* info = new PluginInfo();
+    info->name = name;
+    info->desc = description;
+    info->file = fileName;
+    m_results->append(info);
+}
+
+void WebPluginListBuilderImpl::addMediaTypeToLastPlugin(const WebString& name, const WebString& description)
+{
+    MimeClassInfo* info = new MimeClassInfo();
+    info->type = name;
+    info->desc = description;
+    m_results->last()->mimes.append(info);
+}
+
+void WebPluginListBuilderImpl::addFileExtensionToLastMediaType(const WebString& extension)
+{
+    MimeClassInfo* info = m_results->last()->mimes.last();
+    if (!info->suffixes.isEmpty())
+        info->suffixes.append(',');
+    info->suffixes.append(extension);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebPluginListBuilderImpl.h b/WebKit/chromium/src/WebPluginListBuilderImpl.h
new file mode 100644
index 0000000..7a8a497
--- /dev/null
+++ b/WebKit/chromium/src/WebPluginListBuilderImpl.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPluginListBuilderImpl_h
+#define WebPluginListBuilderImpl_h
+
+#include "WebPluginListBuilder.h"
+
+#include "PluginData.h"
+#include <wtf/Vector.h>
+
+namespace WebKit {
+
+class WebPluginListBuilderImpl : public WebPluginListBuilder {
+public:
+    WebPluginListBuilderImpl(Vector<WebCore::PluginInfo*>* results) : m_results(results) { }
+
+    // WebPluginListBuilder methods:
+    virtual void addPlugin(const WebString& name, const WebString& description, const WebString& fileName);
+    virtual void addMediaTypeToLastPlugin(const WebString& name, const WebString& description);
+    virtual void addFileExtensionToLastMediaType(const WebString& extension);
+
+private:
+    Vector<WebCore::PluginInfo*>* m_results;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebPluginLoadObserver.cpp b/WebKit/chromium/src/WebPluginLoadObserver.cpp
new file mode 100644
index 0000000..5ec59a6
--- /dev/null
+++ b/WebKit/chromium/src/WebPluginLoadObserver.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebPluginLoadObserver.h"
+
+#include "WebPlugin.h"
+#include "WebPluginContainerImpl.h"
+
+namespace WebKit {
+
+WebPluginLoadObserver::~WebPluginLoadObserver()
+{
+    if (m_pluginContainer)
+        m_pluginContainer->willDestroyPluginLoadObserver(this);
+}
+
+void WebPluginLoadObserver::didFinishLoading()
+{
+    if (m_pluginContainer)
+        m_pluginContainer->plugin()->didFinishLoadingFrameRequest(m_notifyURL, m_notifyData);
+}
+
+void WebPluginLoadObserver::didFailLoading(const WebURLError& error)
+{
+    if (m_pluginContainer)
+        m_pluginContainer->plugin()->didFailLoadingFrameRequest(m_notifyURL, m_notifyData, error);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebPluginLoadObserver.h b/WebKit/chromium/src/WebPluginLoadObserver.h
new file mode 100644
index 0000000..097d08d
--- /dev/null
+++ b/WebKit/chromium/src/WebPluginLoadObserver.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPluginLoadObserver_h
+#define WebPluginLoadObserver_h
+
+#include "../public/WebURL.h"
+
+namespace WebKit {
+
+class WebPluginContainerImpl;
+struct WebURLError;
+
+class WebPluginLoadObserver {
+public:
+    WebPluginLoadObserver(WebPluginContainerImpl* pluginContainer,
+                          const WebURL& notifyURL, void* notifyData)
+        : m_pluginContainer(pluginContainer)
+        , m_notifyURL(notifyURL)
+        , m_notifyData(notifyData)
+    {
+    }
+
+    ~WebPluginLoadObserver();
+
+    const WebURL& url() const { return m_notifyURL; }
+
+    void clearPluginContainer() { m_pluginContainer = 0; }
+    void didFinishLoading();
+    void didFailLoading(const WebURLError&);
+
+private:
+    WebPluginContainerImpl* m_pluginContainer;
+    WebURL m_notifyURL;
+    void* m_notifyData;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebPopupMenuImpl.cpp b/WebKit/chromium/src/WebPopupMenuImpl.cpp
new file mode 100644
index 0000000..f6d360e
--- /dev/null
+++ b/WebKit/chromium/src/WebPopupMenuImpl.cpp
@@ -0,0 +1,312 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebPopupMenuImpl.h"
+
+#include "Cursor.h"
+#include "FramelessScrollView.h"
+#include "FrameView.h"
+#include "IntRect.h"
+#include "PlatformContextSkia.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformMouseEvent.h"
+#include "PlatformWheelEvent.h"
+#include "SkiaUtils.h"
+
+#include "WebInputEvent.h"
+#include "WebInputEventConversion.h"
+#include "WebRect.h"
+#include "WebWidgetClient.h"
+
+#include <skia/ext/platform_canvas.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// WebPopupMenu ---------------------------------------------------------------
+
+WebPopupMenu* WebPopupMenu::create(WebWidgetClient* client)
+{
+    return new WebPopupMenuImpl(client);
+}
+
+// WebWidget ------------------------------------------------------------------
+
+WebPopupMenuImpl::WebPopupMenuImpl(WebWidgetClient* client)
+    : m_client(client)
+    , m_widget(0)
+{
+    // set to impossible point so we always get the first mouse pos
+    m_lastMousePosition = WebPoint(-1, -1);
+}
+
+WebPopupMenuImpl::~WebPopupMenuImpl()
+{
+    if (m_widget)
+        m_widget->setClient(0);
+}
+
+void WebPopupMenuImpl::Init(FramelessScrollView* widget, const WebRect& bounds)
+{
+    m_widget = widget;
+    m_widget->setClient(this);
+
+    if (m_client) {
+        m_client->setWindowRect(bounds);
+        m_client->show(WebNavigationPolicy());  // Policy is ignored
+    }
+}
+
+void WebPopupMenuImpl::MouseMove(const WebMouseEvent& event)
+{
+    // don't send mouse move messages if the mouse hasn't moved.
+    if (event.x != m_lastMousePosition.x || event.y != m_lastMousePosition.y) {
+        m_lastMousePosition = WebPoint(event.x, event.y);
+        m_widget->handleMouseMoveEvent(PlatformMouseEventBuilder(m_widget, event));
+    }
+}
+
+void WebPopupMenuImpl::MouseLeave(const WebMouseEvent& event)
+{
+    m_widget->handleMouseMoveEvent(PlatformMouseEventBuilder(m_widget, event));
+}
+
+void WebPopupMenuImpl::MouseDown(const WebMouseEvent& event)
+{
+    m_widget->handleMouseDownEvent(PlatformMouseEventBuilder(m_widget, event));
+}
+
+void WebPopupMenuImpl::MouseUp(const WebMouseEvent& event)
+{
+    mouseCaptureLost();
+    m_widget->handleMouseReleaseEvent(PlatformMouseEventBuilder(m_widget, event));
+}
+
+void WebPopupMenuImpl::MouseWheel(const WebMouseWheelEvent& event)
+{
+    m_widget->handleWheelEvent(PlatformWheelEventBuilder(m_widget, event));
+}
+
+bool WebPopupMenuImpl::KeyEvent(const WebKeyboardEvent& event)
+{
+    return m_widget->handleKeyEvent(PlatformKeyboardEventBuilder(event));
+}
+
+// WebWidget -------------------------------------------------------------------
+
+void WebPopupMenuImpl::close()
+{
+    if (m_widget)
+        m_widget->hide();
+
+    m_client = 0;
+
+    deref();  // Balances ref() from WebWidget::Create
+}
+
+void WebPopupMenuImpl::resize(const WebSize& newSize)
+{
+    if (m_size == newSize)
+        return;
+    m_size = newSize;
+
+    if (m_widget) {
+      IntRect newGeometry(0, 0, m_size.width, m_size.height);
+      m_widget->setFrameRect(newGeometry);
+    }
+
+    if (m_client) {
+      WebRect damagedRect(0, 0, m_size.width, m_size.height);
+      m_client->didInvalidateRect(damagedRect);
+    }
+}
+
+void WebPopupMenuImpl::layout()
+{
+}
+
+void WebPopupMenuImpl::paint(WebCanvas* canvas, const WebRect& rect)
+{
+    if (!m_widget)
+        return;
+
+    if (!rect.isEmpty()) {
+#if WEBKIT_USING_CG
+        GraphicsContext gc(canvas);
+#elif WEBKIT_USING_SKIA
+        PlatformContextSkia context(canvas);
+        // PlatformGraphicsContext is actually a pointer to PlatformContextSkia.
+        GraphicsContext gc(reinterpret_cast<PlatformGraphicsContext*>(&context));
+#else
+        notImplemented();
+#endif
+        m_widget->paint(&gc, rect);
+    }
+}
+
+bool WebPopupMenuImpl::handleInputEvent(const WebInputEvent& inputEvent)
+{
+    if (!m_widget)
+        return false;
+
+    // TODO (jcampan): WebKit seems to always return false on mouse events
+    // methods. For now we'll assume it has processed them (as we are only
+    // interested in whether keyboard events are processed).
+    switch (inputEvent.type) {
+    case WebInputEvent::MouseMove:
+        MouseMove(*static_cast<const WebMouseEvent*>(&inputEvent));
+        return true;
+
+    case WebInputEvent::MouseLeave:
+        MouseLeave(*static_cast<const WebMouseEvent*>(&inputEvent));
+        return true;
+
+    case WebInputEvent::MouseWheel:
+        MouseWheel(*static_cast<const WebMouseWheelEvent*>(&inputEvent));
+        return true;
+
+    case WebInputEvent::MouseDown:
+        MouseDown(*static_cast<const WebMouseEvent*>(&inputEvent));
+        return true;
+
+    case WebInputEvent::MouseUp:
+        MouseUp(*static_cast<const WebMouseEvent*>(&inputEvent));
+        return true;
+
+    // In Windows, RawKeyDown only has information about the physical key, but
+    // for "selection", we need the information about the character the key
+    // translated into. For English, the physical key value and the character
+    // value are the same, hence, "selection" works for English. But for other
+    // languages, such as Hebrew, the character value is different from the
+    // physical key value. Thus, without accepting Char event type which
+    // contains the key's character value, the "selection" won't work for
+    // non-English languages, such as Hebrew.
+    case WebInputEvent::RawKeyDown:
+    case WebInputEvent::KeyDown:
+    case WebInputEvent::KeyUp:
+    case WebInputEvent::Char:
+        return KeyEvent(*static_cast<const WebKeyboardEvent*>(&inputEvent));
+
+    default:
+        break;
+    }
+    return false;
+}
+
+void WebPopupMenuImpl::mouseCaptureLost()
+{
+}
+
+void WebPopupMenuImpl::setFocus(bool enable)
+{
+}
+
+bool WebPopupMenuImpl::handleCompositionEvent(
+    WebCompositionCommand command, int cursorPosition, int targetStart,
+    int targetEnd, const WebString& imeString)
+{
+    return false;
+}
+
+bool WebPopupMenuImpl::queryCompositionStatus(bool* enabled, WebRect* caretRect)
+{
+    return false;
+}
+
+void WebPopupMenuImpl::setTextDirection(WebTextDirection direction)
+{
+}
+
+
+//-----------------------------------------------------------------------------
+// WebCore::HostWindow
+
+void WebPopupMenuImpl::repaint(const IntRect& paintRect,
+                               bool contentChanged,
+                               bool immediate,
+                               bool repaintContentOnly)
+{
+    // Ignore spurious calls.
+    if (!contentChanged || paintRect.isEmpty())
+        return;
+    if (m_client)
+        m_client->didInvalidateRect(paintRect);
+}
+
+void WebPopupMenuImpl::scroll(const IntSize& scrollDelta,
+                              const IntRect& scrollRect,
+                              const IntRect& clipRect)
+{
+    if (m_client) {
+        int dx = scrollDelta.width();
+        int dy = scrollDelta.height();
+        m_client->didScrollRect(dx, dy, clipRect);
+    }
+}
+
+IntPoint WebPopupMenuImpl::screenToWindow(const IntPoint& point) const
+{
+    notImplemented();
+    return IntPoint();
+}
+
+IntRect WebPopupMenuImpl::windowToScreen(const IntRect& rect) const
+{
+    notImplemented();
+    return IntRect();
+}
+
+void WebPopupMenuImpl::scrollRectIntoView(const IntRect&, const ScrollView*) const
+{
+    // Nothing to be done here since we do not have the concept of a container
+    // that implements its own scrolling.
+}
+
+void WebPopupMenuImpl::scrollbarsModeDidChange() const
+{
+    // Nothing to be done since we have no concept of different scrollbar modes.
+}
+
+//-----------------------------------------------------------------------------
+// WebCore::FramelessScrollViewClient
+
+void WebPopupMenuImpl::popupClosed(FramelessScrollView* widget)
+{
+    ASSERT(widget == m_widget);
+    if (m_widget) {
+        m_widget->setClient(0);
+        m_widget = 0;
+    }
+    m_client->closeWidgetSoon();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebPopupMenuImpl.h b/WebKit/chromium/src/WebPopupMenuImpl.h
new file mode 100644
index 0000000..13eb674
--- /dev/null
+++ b/WebKit/chromium/src/WebPopupMenuImpl.h
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPopupMenuImpl_h
+#define WebPopupMenuImpl_h
+
+// FIXME: Add this to FramelessScrollViewClient.h
+namespace WebCore { class FramelessScrollView; }
+
+#include "FramelessScrollViewClient.h"
+// FIXME: remove the relative paths once glue/ consumers are removed.
+#include "../public/WebPoint.h"
+#include "../public/WebPopupMenu.h"
+#include "../public/WebSize.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+class Frame;
+class FramelessScrollView;
+class KeyboardEvent;
+class Page;
+class PlatformKeyboardEvent;
+class Range;
+class Widget;
+}
+
+namespace WebKit {
+class WebKeyboardEvent;
+class WebMouseEvent;
+class WebMouseWheelEvent;
+struct WebRect;
+
+class WebPopupMenuImpl : public WebPopupMenu,
+                         public WebCore::FramelessScrollViewClient,
+                         public RefCounted<WebPopupMenuImpl> {
+public:
+    // WebWidget
+    virtual void close();
+    virtual WebSize size() { return m_size; }
+    virtual void resize(const WebSize&);
+    virtual void layout();
+    virtual void paint(WebCanvas* canvas, const WebRect& rect);
+    virtual bool handleInputEvent(const WebInputEvent&);
+    virtual void mouseCaptureLost();
+    virtual void setFocus(bool enable);
+    virtual bool handleCompositionEvent(
+        WebCompositionCommand command, int cursorPosition,
+        int targetStart, int targetEnd, const WebString& text);
+    virtual bool queryCompositionStatus(bool* enabled, WebRect* caretRect);
+    virtual void setTextDirection(WebTextDirection direction);
+
+    // WebPopupMenuImpl
+    void Init(WebCore::FramelessScrollView* widget,
+              const WebRect& bounds);
+
+    WebWidgetClient* client() { return m_client; }
+
+    void MouseMove(const WebMouseEvent&);
+    void MouseLeave(const WebMouseEvent&);
+    void MouseDown(const WebMouseEvent&);
+    void MouseUp(const WebMouseEvent&);
+    void MouseDoubleClick(const WebMouseEvent&);
+    void MouseWheel(const WebMouseWheelEvent&);
+    bool KeyEvent(const WebKeyboardEvent&);
+
+   protected:
+    friend class WebPopupMenu;  // For WebPopupMenu::create
+    friend class WTF::RefCounted<WebPopupMenuImpl>;
+
+    WebPopupMenuImpl(WebWidgetClient* client);
+    ~WebPopupMenuImpl();
+
+    // WebCore::HostWindow methods:
+    virtual void repaint(
+        const WebCore::IntRect&, bool contentChanged, bool immediate = false,
+        bool repaintContentOnly = false);
+    virtual void scroll(
+        const WebCore::IntSize& scrollDelta, const WebCore::IntRect& scrollRect,
+        const WebCore::IntRect& clipRect);
+    virtual WebCore::IntPoint screenToWindow(const WebCore::IntPoint&) const;
+    virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&) const;
+    virtual PlatformPageClient platformPageClient() const { return 0; }
+    virtual void scrollRectIntoView(const WebCore::IntRect&, const WebCore::ScrollView*) const;
+    virtual void scrollbarsModeDidChange() const;
+
+    // WebCore::FramelessScrollViewClient methods:
+    virtual void popupClosed(WebCore::FramelessScrollView*);
+
+    WebWidgetClient* m_client;
+    WebSize m_size;
+
+    WebPoint m_lastMousePosition;
+
+    // This is a non-owning ref.  The popup will notify us via popupClosed()
+    // before it is destroyed.
+    WebCore::FramelessScrollView* m_widget;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebRange.cpp b/WebKit/chromium/src/WebRange.cpp
new file mode 100644
index 0000000..3dd000d
--- /dev/null
+++ b/WebKit/chromium/src/WebRange.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebRange.h"
+
+#include "Range.h"
+#include "WebNode.h"
+#include "WebString.h"
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebRangePrivate : public Range {
+};
+
+void WebRange::reset()
+{
+    assign(0);
+}
+
+void WebRange::assign(const WebRange& other)
+{
+    WebRangePrivate* p = const_cast<WebRangePrivate*>(other.m_private);
+    if (p)
+        p->ref();
+    assign(p);
+}
+
+int WebRange::startOffset() const
+{
+    return m_private->startOffset();
+}
+
+int WebRange::endOffset() const
+{
+    return m_private->endOffset();
+}
+
+WebNode WebRange::startContainer(int& exceptionCode) const
+{
+    return PassRefPtr<Node>(m_private->startContainer(exceptionCode));
+}
+
+WebNode WebRange::endContainer(int& exceptionCode) const
+{
+    return PassRefPtr<Node>(m_private->endContainer(exceptionCode));
+}
+
+WebString WebRange::toHTMLText() const
+{
+    return m_private->toHTML();
+}
+
+WebString WebRange::toPlainText() const
+{
+    return m_private->text();
+}
+
+WebRange::WebRange(const WTF::PassRefPtr<WebCore::Range>& range)
+    : m_private(static_cast<WebRangePrivate*>(range.releaseRef()))
+{
+}
+
+WebRange& WebRange::operator=(const WTF::PassRefPtr<WebCore::Range>& range)
+{
+    assign(static_cast<WebRangePrivate*>(range.releaseRef()));
+    return *this;
+}
+
+WebRange::operator WTF::PassRefPtr<WebCore::Range>() const
+{
+    return PassRefPtr<Range>(const_cast<WebRangePrivate*>(m_private));
+}
+
+void WebRange::assign(WebRangePrivate* p)
+{
+    // p is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebRegularExpression.cpp b/WebKit/chromium/src/WebRegularExpression.cpp
new file mode 100644
index 0000000..558b750
--- /dev/null
+++ b/WebKit/chromium/src/WebRegularExpression.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebRegularExpression.h"
+
+#include "RegularExpression.h"
+#include "WebString.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebRegularExpressionPrivate : public RegularExpression {
+};
+
+WebRegularExpression::WebRegularExpression(const WebString& pattern,
+                                           WebTextCaseSensitivity caseSensitivity)
+{
+    TextCaseSensitivity sensitivity = static_cast<TextCaseSensitivity>(caseSensitivity);
+    RegularExpression* re = new RegularExpression(pattern, sensitivity);
+    m_private = static_cast<WebRegularExpressionPrivate*>(re);
+}
+
+WebRegularExpression::~WebRegularExpression()
+{
+    delete m_private;
+}
+
+int WebRegularExpression::match(const WebString& str,
+                                int startFrom,
+                                int* matchLength) const
+{
+    if (!m_private)
+        return -1;
+
+    return m_private->match(str, startFrom, matchLength);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebRuntimeFeatures.cpp b/WebKit/chromium/src/WebRuntimeFeatures.cpp
new file mode 100644
index 0000000..b630a09
--- /dev/null
+++ b/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebRuntimeFeatures.h"
+
+#include "RuntimeEnabledFeatures.h"
+#include "WebMediaPlayerClientImpl.h"
+#include "WebSocket.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebRuntimeFeatures::enableDatabase(bool enable)
+{
+#if ENABLE(DATABASE)
+    RuntimeEnabledFeatures::setDatabaseEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isDatabaseEnabled()
+{
+#if ENABLE(DATABASE)
+    return RuntimeEnabledFeatures::databaseEnabled();
+#else
+    return false;
+#endif
+}
+
+void WebRuntimeFeatures::enableLocalStorage(bool enable)
+{
+#if ENABLE(DOM_STORAGE)
+    RuntimeEnabledFeatures::setLocalStorageEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isLocalStorageEnabled()
+{
+#if ENABLE(DOM_STORAGE)
+    return RuntimeEnabledFeatures::localStorageEnabled();
+#else
+    return false;
+#endif
+}
+
+void WebRuntimeFeatures::enableSessionStorage(bool enable)
+{
+#if ENABLE(DOM_STORAGE)
+    RuntimeEnabledFeatures::setSessionStorageEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isSessionStorageEnabled()
+{
+#if ENABLE(DOM_STORAGE)
+    return RuntimeEnabledFeatures::sessionStorageEnabled();
+#else
+    return false;
+#endif
+}
+
+void WebRuntimeFeatures::enableMediaPlayer(bool enable)
+{
+#if ENABLE(VIDEO)
+    WebMediaPlayerClientImpl::setIsEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isMediaPlayerEnabled()
+{
+#if ENABLE(VIDEO)
+    return WebMediaPlayerClientImpl::isEnabled();
+#else
+    return false;
+#endif
+}
+
+void WebRuntimeFeatures::enableSockets(bool enable)
+{
+#if ENABLE(WEB_SOCKETS)
+    WebSocket::setIsAvailable(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isSocketsEnabled()
+{
+#if ENABLE(WEB_SOCKETS)
+    return WebSocket::isAvailable();
+#else
+    return false;
+#endif
+}
+
+void WebRuntimeFeatures::enableNotifications(bool enable)
+{
+#if ENABLE(NOTIFICATIONS)
+    RuntimeEnabledFeatures::setNotificationsEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isNotificationsEnabled()
+{
+#if ENABLE(NOTIFICATIONS)
+    return RuntimeEnabledFeatures::notificationsEnabled();
+#else
+    return false;
+#endif
+}
+
+void WebRuntimeFeatures::enableApplicationCache(bool enable)
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    RuntimeEnabledFeatures::setApplicationCacheEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isApplicationCacheEnabled()
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    return RuntimeEnabledFeatures::applicationCacheEnabled();
+#else
+    return false;
+#endif
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebScriptController.cpp b/WebKit/chromium/src/WebScriptController.cpp
new file mode 100644
index 0000000..d2c168d
--- /dev/null
+++ b/WebKit/chromium/src/WebScriptController.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebScriptController.h"
+
+#include "V8Binding.h"
+#include "V8DOMMap.h"
+#include "V8Proxy.h"
+
+#include "WebString.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebScriptController::registerExtension(v8::Extension* extension)
+{
+    V8Proxy::registerExtension(extension, WebString());
+}
+
+void WebScriptController::registerExtension(v8::Extension* extension,
+                                            const WebString& schemeRestriction)
+{
+    V8Proxy::registerExtension(extension, schemeRestriction);
+}
+
+void WebScriptController::registerExtension(v8::Extension* extension,
+                                            int extensionGroup)
+{
+    V8Proxy::registerExtension(extension, extensionGroup);
+}
+
+void WebScriptController::enableV8SingleThreadMode()
+{
+    enableStringImplCache();
+    enableFasterDOMStoreAccess();
+}
+
+void WebScriptController::flushConsoleMessages()
+{
+    WebCore::V8Proxy::processConsoleMessages();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebSearchableFormData.cpp b/WebKit/chromium/src/WebSearchableFormData.cpp
new file mode 100644
index 0000000..eddaffe
--- /dev/null
+++ b/WebKit/chromium/src/WebSearchableFormData.cpp
@@ -0,0 +1,257 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebSearchableFormData.h"
+
+#include "Document.h"
+#include "FormDataBuilder.h"
+#include "FormDataList.h"
+#include "Frame.h"
+#include "HTMLFormControlElement.h"
+#include "HTMLFormElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "HTMLOptionElement.h"
+#include "HTMLOptionsCollection.h"
+#include "HTMLSelectElement.h"
+#include "TextEncoding.h"
+#include "WebFormElement.h"
+
+using namespace WebCore;
+
+namespace {
+
+// Gets the encoding for the form.
+void GetFormEncoding(const HTMLFormElement* form, TextEncoding* encoding)
+{
+    String str(form->getAttribute(HTMLNames::accept_charsetAttr));
+    str.replace(',', ' ');
+    Vector<String> charsets;
+    str.split(' ', charsets);
+    for (Vector<String>::const_iterator i(charsets.begin()); i != charsets.end(); ++i) {
+        *encoding = TextEncoding(*i);
+        if (encoding->isValid())
+            return;
+    }
+    const Frame* frame = form->document()->frame();
+    *encoding = frame ? TextEncoding(frame->loader()->encoding()) : Latin1Encoding();
+}
+
+// Returns true if the submit request results in an HTTP URL.
+bool IsHTTPFormSubmit(const HTMLFormElement* form)
+{
+    String action(form->action());
+    return form->document()->frame()->loader()->completeURL(action.isNull() ? "" : action).protocol() == "http";
+}
+
+// If the form does not have an activated submit button, the first submit
+// button is returned.
+HTMLFormControlElement* GetButtonToActivate(HTMLFormElement* form)
+{
+    HTMLFormControlElement* firstSubmitButton = 0;
+    for (Vector<HTMLFormControlElement*>::const_iterator i(form->formElements.begin()); i != form->formElements.end(); ++i) {
+      HTMLFormControlElement* formElement = *i;
+      if (formElement->isActivatedSubmit())
+          // There's a button that is already activated for submit, return 0.
+          return 0;
+      if (!firstSubmitButton && formElement->isSuccessfulSubmitButton())
+          firstSubmitButton = formElement;
+    }
+    return firstSubmitButton;
+}
+
+// Returns true if the selected state of all the options matches the default
+// selected state.
+bool IsSelectInDefaultState(const HTMLSelectElement* select)
+{
+    const Vector<Element*>& listItems = select->listItems();
+    if (select->multiple() || select->size() > 1) {
+        for (Vector<Element*>::const_iterator i(listItems.begin()); i != listItems.end(); ++i) {
+            if (!(*i)->hasLocalName(HTMLNames::optionTag))
+                continue;
+            const HTMLOptionElement* optionElement = static_cast<const HTMLOptionElement*>(*i);
+            if (optionElement->selected() != optionElement->defaultSelected())
+                return false;
+        }
+        return true;
+    }
+
+    // The select is rendered as a combobox (called menulist in WebKit). At
+    // least one item is selected, determine which one.
+    const HTMLOptionElement* initialSelected = 0;
+    for (Vector<Element*>::const_iterator i(listItems.begin()); i != listItems.end(); ++i) {
+        if (!(*i)->hasLocalName(HTMLNames::optionTag))
+            continue;
+        const HTMLOptionElement* optionElement = static_cast<const HTMLOptionElement*>(*i);
+        if (optionElement->defaultSelected()) {
+            // The page specified the option to select.
+            initialSelected = optionElement;
+            break;
+        }
+        if (!initialSelected)
+            initialSelected = optionElement;
+    }
+    return initialSelected ? initialSelected->selected() : true;
+}
+
+// Returns true if the form element is in its default state, false otherwise.
+// The default state is the state of the form element on initial load of the
+// page, and varies depending upon the form element. For example, a checkbox is
+// in its default state if the checked state matches the defaultChecked state.
+bool IsInDefaultState(const HTMLFormControlElement* formElement)
+{
+    if (formElement->hasTagName(HTMLNames::inputTag)) {
+        const HTMLInputElement* inputElement = static_cast<const HTMLInputElement*>(formElement);
+        if (inputElement->inputType() == HTMLInputElement::CHECKBOX || inputElement->inputType() == HTMLInputElement::RADIO)
+            return inputElement->checked() == inputElement->defaultChecked();
+    } else if (formElement->hasTagName(HTMLNames::selectTag))
+        return IsSelectInDefaultState(static_cast<const HTMLSelectElement*>(formElement));
+    return true;
+}
+
+// If form has only one text input element, return true. If a valid input
+// element is not found, return false. Additionally, the form data for all
+// elements is added to enc_string and the encoding used is set in
+// encoding_name.
+bool HasSuitableTextElement(const HTMLFormElement* form, Vector<char>* encodedString, String* encodingName)
+{
+    TextEncoding encoding;
+    GetFormEncoding(form, &encoding);
+    if (!encoding.isValid()) {
+        // Need a valid encoding to encode the form elements.
+        // If the encoding isn't found webkit ends up replacing the params with
+        // empty strings. So, we don't try to do anything here.
+        return 0;
+    }
+    *encodingName = encoding.name();
+
+    HTMLInputElement* textElement = 0;
+    for (Vector<HTMLFormControlElement*>::const_iterator i(form->formElements.begin()); i != form->formElements.end(); ++i) {
+        HTMLFormControlElement* formElement = *i;
+        if (formElement->disabled() || formElement->name().isNull())
+            continue;
+
+        if (!IsInDefaultState(formElement) || formElement->hasTagName(HTMLNames::textareaTag))
+            return 0;
+
+        bool isTextElement = false;
+        if (formElement->hasTagName(HTMLNames::inputTag)) {
+            switch (static_cast<const HTMLInputElement*>(formElement)->inputType()) {
+            case HTMLInputElement::TEXT:
+            case HTMLInputElement::ISINDEX:
+                isTextElement = true;
+                break;
+            case HTMLInputElement::PASSWORD:
+                // Don't store passwords! This is most likely an https anyway.
+                // Fall through.
+            case HTMLInputElement::FILE:
+                // Too big, don't try to index this.
+                return 0;
+            default:
+                // All other input types are indexable.
+                break;
+            }
+      }
+
+      FormDataList dataList(encoding);
+      if (!formElement->appendFormData(dataList, false))
+          continue;
+
+      const Vector<FormDataList::Item>& itemList = dataList.list();
+      if (isTextElement && !itemList.isEmpty()) {
+          if (textElement) {
+              // The auto-complete bar only knows how to fill in one value.
+              // This form has multiple fields; don't treat it as searchable.
+              return false;
+          }
+          textElement = static_cast<HTMLInputElement*>(formElement);
+      }
+      for (Vector<FormDataList::Item>::const_iterator j(itemList.begin()); j != itemList.end(); ++j) {
+          // Handle ISINDEX / <input name=isindex> specially, but only if it's
+          // the first entry.
+          if (!encodedString->isEmpty() || j->data() != "isindex") {
+              if (!encodedString->isEmpty())
+                  encodedString->append('&');
+              FormDataBuilder::encodeStringAsFormData(*encodedString, j->data());
+              encodedString->append('=');
+          }
+          ++j;
+          if (formElement == textElement)
+              encodedString->append("{searchTerms}", 13);
+          else
+              FormDataBuilder::encodeStringAsFormData(*encodedString, j->data());
+      }
+    }
+
+    return textElement;
+}
+
+} // namespace
+
+namespace WebKit {
+
+WebSearchableFormData::WebSearchableFormData(const WebFormElement& form)
+{
+    RefPtr<HTMLFormElement> formElement = form.operator PassRefPtr<HTMLFormElement>();
+    const Frame* frame = formElement->document()->frame();
+    if (!frame)
+        return;
+
+    // Only consider forms that GET data and the action targets an http page.
+    if (equalIgnoringCase(formElement->getAttribute(HTMLNames::methodAttr), "post") || !IsHTTPFormSubmit(formElement.get()))
+        return;
+
+    HTMLFormControlElement* firstSubmitButton = GetButtonToActivate(formElement.get());
+    if (firstSubmitButton) {
+        // The form does not have an active submit button, make the first button
+        // active. We need to do this, otherwise the URL will not contain the
+        // name of the submit button.
+        firstSubmitButton->setActivatedSubmit(true);
+    }
+    Vector<char> encodedString;
+    String encoding;
+    bool hasElement = HasSuitableTextElement(formElement.get(), &encodedString, &encoding);
+    if (firstSubmitButton)
+        firstSubmitButton->setActivatedSubmit(false);
+    if (!hasElement) {
+        // Not a searchable form.
+        return;
+    }
+
+    String action(formElement->action());
+    KURL url(frame->loader()->completeURL(action.isNull() ? "" : action));
+    RefPtr<FormData> formData = FormData::create(encodedString);
+    url.setQuery(formData->flattenToString());
+    m_url = url;
+    m_encoding = encoding;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebSecurityOrigin.cpp b/WebKit/chromium/src/WebSecurityOrigin.cpp
new file mode 100644
index 0000000..3cf7364
--- /dev/null
+++ b/WebKit/chromium/src/WebSecurityOrigin.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebSecurityOrigin.h"
+
+#include "SecurityOrigin.h"
+#include "WebString.h"
+#include <wtf/PassRefPtr.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebSecurityOriginPrivate : public SecurityOrigin {
+};
+
+void WebSecurityOrigin::reset()
+{
+    assign(0);
+}
+
+void WebSecurityOrigin::assign(const WebSecurityOrigin& other)
+{
+    WebSecurityOriginPrivate* p = const_cast<WebSecurityOriginPrivate*>(other.m_private);
+    if (p)
+        p->ref();
+    assign(p);
+}
+
+WebString WebSecurityOrigin::protocol() const
+{
+    ASSERT(m_private);
+    return m_private->protocol();
+}
+
+WebString WebSecurityOrigin::host() const
+{
+    ASSERT(m_private);
+    return m_private->host();
+}
+
+unsigned short WebSecurityOrigin::port() const
+{
+    ASSERT(m_private);
+    return m_private->port();
+}
+
+bool WebSecurityOrigin::isEmpty() const
+{
+    ASSERT(m_private);
+    return m_private->isEmpty();
+}
+
+WebString WebSecurityOrigin::toString() const
+{
+    ASSERT(m_private);
+    return m_private->toString();
+}
+
+WebString WebSecurityOrigin::databaseIdentifier()
+{
+    ASSERT(m_private);
+    return m_private->databaseIdentifier();
+}
+
+WebSecurityOrigin::WebSecurityOrigin(const WTF::PassRefPtr<WebCore::SecurityOrigin>& origin)
+    : m_private(static_cast<WebSecurityOriginPrivate*>(origin.releaseRef()))
+{
+}
+
+WebSecurityOrigin& WebSecurityOrigin::operator=(const WTF::PassRefPtr<WebCore::SecurityOrigin>& origin)
+{
+    assign(static_cast<WebSecurityOriginPrivate*>(origin.releaseRef()));
+    return *this;
+}
+
+WebSecurityOrigin::operator WTF::PassRefPtr<WebCore::SecurityOrigin>() const
+{
+    return PassRefPtr<SecurityOrigin>(const_cast<WebSecurityOriginPrivate*>(m_private));
+}
+
+void WebSecurityOrigin::assign(WebSecurityOriginPrivate* p)
+{
+    // p is already ref'd for us by the caller
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebSecurityPolicy.cpp b/WebKit/chromium/src/WebSecurityPolicy.cpp
new file mode 100644
index 0000000..c66c805
--- /dev/null
+++ b/WebKit/chromium/src/WebSecurityPolicy.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebSecurityPolicy.h"
+
+#include "FrameLoader.h"
+#include "SecurityOrigin.h"
+
+#include "WebString.h"
+#include "WebURL.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebSecurityPolicy::registerURLSchemeAsLocal(const WebString& scheme)
+{
+    SecurityOrigin::registerURLSchemeAsLocal(scheme);
+}
+
+void WebSecurityPolicy::registerURLSchemeAsNoAccess(const WebString& scheme)
+{
+    SecurityOrigin::registerURLSchemeAsNoAccess(scheme);
+}
+
+void WebSecurityPolicy::whiteListAccessFromOrigin(const WebURL& sourceOrigin,
+    const WebString& destinationProtocol,
+    const WebString& destinationHost,
+    bool allowDestinationSubdomains)
+{
+    SecurityOrigin::whiteListAccessFromOrigin(
+        *SecurityOrigin::create(sourceOrigin), destinationProtocol,
+        destinationHost, allowDestinationSubdomains);
+}
+
+void WebSecurityPolicy::resetOriginAccessWhiteLists()
+{
+    SecurityOrigin::resetOriginAccessWhiteLists();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebSettingsImpl.cpp b/WebKit/chromium/src/WebSettingsImpl.cpp
new file mode 100644
index 0000000..e019653
--- /dev/null
+++ b/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -0,0 +1,257 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebSettingsImpl.h"
+
+#include "FontRenderingMode.h"
+#include "Settings.h"
+#include "WebString.h"
+#include "WebURL.h"
+
+#if defined(OS_WIN)
+#include "RenderThemeChromiumWin.h"
+#endif
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebSettingsImpl::WebSettingsImpl(Settings* settings)
+    : m_settings(settings)
+{
+    ASSERT(settings);
+}
+
+void WebSettingsImpl::setStandardFontFamily(const WebString& font)
+{
+    m_settings->setStandardFontFamily(font);
+}
+
+void WebSettingsImpl::setFixedFontFamily(const WebString& font)
+{
+    m_settings->setFixedFontFamily((String)font);
+}
+
+void WebSettingsImpl::setSerifFontFamily(const WebString& font)
+{
+    m_settings->setSerifFontFamily((String)font);
+}
+
+void WebSettingsImpl::setSansSerifFontFamily(const WebString& font)
+{
+    m_settings->setSansSerifFontFamily((String)font);
+}
+
+void WebSettingsImpl::setCursiveFontFamily(const WebString& font)
+{
+    m_settings->setCursiveFontFamily((String)font);
+}
+
+void WebSettingsImpl::setFantasyFontFamily(const WebString& font)
+{
+    m_settings->setFantasyFontFamily((String)font);
+}
+
+void WebSettingsImpl::setDefaultFontSize(int size)
+{
+    m_settings->setDefaultFontSize(size);
+#if defined(OS_WIN)
+    // RenderTheme is a singleton that needs to know the default font size to
+    // draw some form controls.  We let it know each time the size changes.
+    WebCore::RenderThemeChromiumWin::setDefaultFontSize(size);
+#endif
+}
+
+void WebSettingsImpl::setDefaultFixedFontSize(int size)
+{
+    m_settings->setDefaultFixedFontSize(size);
+}
+
+void WebSettingsImpl::setMinimumFontSize(int size)
+{
+    m_settings->setMinimumFontSize(size);
+}
+
+void WebSettingsImpl::setMinimumLogicalFontSize(int size)
+{
+    m_settings->setMinimumLogicalFontSize(size);
+}
+
+void WebSettingsImpl::setDefaultTextEncodingName(const WebString& encoding)
+{
+    m_settings->setDefaultTextEncodingName((String)encoding);
+}
+
+void WebSettingsImpl::setJavaScriptEnabled(bool enabled)
+{
+    m_settings->setJavaScriptEnabled(enabled);
+}
+
+void WebSettingsImpl::setWebSecurityEnabled(bool enabled)
+{
+    m_settings->setWebSecurityEnabled(enabled);
+}
+
+void WebSettingsImpl::setJavaScriptCanOpenWindowsAutomatically(bool canOpenWindows)
+{
+    m_settings->setJavaScriptCanOpenWindowsAutomatically(canOpenWindows);
+}
+
+void WebSettingsImpl::setLoadsImagesAutomatically(bool loadsImagesAutomatically)
+{
+    m_settings->setLoadsImagesAutomatically(loadsImagesAutomatically);
+}
+
+void WebSettingsImpl::setPluginsEnabled(bool enabled)
+{
+    m_settings->setPluginsEnabled(enabled);
+}
+
+void WebSettingsImpl::setDOMPasteAllowed(bool enabled)
+{
+    m_settings->setDOMPasteAllowed(enabled);
+}
+
+void WebSettingsImpl::setDeveloperExtrasEnabled(bool enabled)
+{
+    m_settings->setDeveloperExtrasEnabled(enabled);
+}
+
+void WebSettingsImpl::setNeedsSiteSpecificQuirks(bool enabled)
+{
+    m_settings->setNeedsSiteSpecificQuirks(enabled);
+}
+
+void WebSettingsImpl::setShrinksStandaloneImagesToFit(bool shrinkImages)
+{
+    m_settings->setShrinksStandaloneImagesToFit(shrinkImages);
+}
+
+void WebSettingsImpl::setUsesEncodingDetector(bool usesDetector)
+{
+    m_settings->setUsesEncodingDetector(usesDetector);
+}
+
+void WebSettingsImpl::setTextAreasAreResizable(bool areResizable)
+{
+    m_settings->setTextAreasAreResizable(areResizable);
+}
+
+void WebSettingsImpl::setJavaEnabled(bool enabled)
+{
+    m_settings->setJavaEnabled(enabled);
+}
+
+void WebSettingsImpl::setAllowScriptsToCloseWindows(bool allow)
+{
+    m_settings->setAllowScriptsToCloseWindows(allow);
+}
+
+void WebSettingsImpl::setUserStyleSheetLocation(const WebURL& location)
+{
+    m_settings->setUserStyleSheetLocation(location);
+}
+
+void WebSettingsImpl::setUsesPageCache(bool usesPageCache)
+{
+    m_settings->setUsesPageCache(usesPageCache);
+}
+
+void WebSettingsImpl::setDownloadableBinaryFontsEnabled(bool enabled)
+{
+    m_settings->setDownloadableBinaryFontsEnabled(enabled);
+}
+
+void WebSettingsImpl::setXSSAuditorEnabled(bool enabled)
+{
+    m_settings->setXSSAuditorEnabled(enabled);
+}
+
+void WebSettingsImpl::setLocalStorageEnabled(bool enabled)
+{
+    m_settings->setLocalStorageEnabled(enabled);
+}
+
+void WebSettingsImpl::setEditableLinkBehaviorNeverLive()
+{
+    // FIXME: If you ever need more behaviors than this, then we should probably
+    //        define an enum in WebSettings.h and have a switch statement that
+    //        translates.  Until then, this is probably fine, though.
+    m_settings->setEditableLinkBehavior(WebCore::EditableLinkNeverLive);
+}
+
+void WebSettingsImpl::setFontRenderingModeNormal()
+{
+    // FIXME: If you ever need more behaviors than this, then we should probably
+    //        define an enum in WebSettings.h and have a switch statement that
+    //        translates.  Until then, this is probably fine, though.
+    m_settings->setFontRenderingMode(WebCore::NormalRenderingMode);
+}
+
+void WebSettingsImpl::setShouldPaintCustomScrollbars(bool enabled)
+{
+    m_settings->setShouldPaintCustomScrollbars(enabled);
+}
+
+void WebSettingsImpl::setDatabasesEnabled(bool enabled)
+{
+    m_settings->setDatabasesEnabled(enabled);
+}
+
+void WebSettingsImpl::setAllowUniversalAccessFromFileURLs(bool allow)
+{
+    m_settings->setAllowUniversalAccessFromFileURLs(allow);
+}
+
+void WebSettingsImpl::setTextDirectionSubmenuInclusionBehaviorNeverIncluded()
+{
+    // FIXME: If you ever need more behaviors than this, then we should probably
+    //        define an enum in WebSettings.h and have a switch statement that
+    //        translates.  Until then, this is probably fine, though.
+    m_settings->setTextDirectionSubmenuInclusionBehavior(WebCore::TextDirectionSubmenuNeverIncluded);
+}
+
+void WebSettingsImpl::setOfflineWebApplicationCacheEnabled(bool enabled)
+{
+    m_settings->setOfflineWebApplicationCacheEnabled(enabled);
+}
+
+void WebSettingsImpl::setExperimentalWebGLEnabled(bool enabled)
+{
+    m_settings->setWebGLEnabled(enabled);
+}
+
+void WebSettingsImpl::setGeolocationEnabled(bool enabled)
+{
+    m_settings->setGeolocationEnabled(enabled);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebSettingsImpl.h b/WebKit/chromium/src/WebSettingsImpl.h
new file mode 100644
index 0000000..9c0f9f4
--- /dev/null
+++ b/WebKit/chromium/src/WebSettingsImpl.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSettingsImpl_h
+#define WebSettingsImpl_h
+
+// TODO(jorlow): Remove this hack once WebView is free of glue.
+#include "../public/WebSettings.h"
+
+namespace WebCore {
+class Settings;
+}
+
+namespace WebKit {
+
+class WebSettingsImpl : public WebSettings {
+public:
+    explicit WebSettingsImpl(WebCore::Settings*);
+    virtual ~WebSettingsImpl() { }
+
+    virtual void setStandardFontFamily(const WebString&);
+    virtual void setFixedFontFamily(const WebString&);
+    virtual void setSerifFontFamily(const WebString&);
+    virtual void setSansSerifFontFamily(const WebString&);
+    virtual void setCursiveFontFamily(const WebString&);
+    virtual void setFantasyFontFamily(const WebString&);
+    virtual void setDefaultFontSize(int);
+    virtual void setDefaultFixedFontSize(int);
+    virtual void setMinimumFontSize(int);
+    virtual void setMinimumLogicalFontSize(int);
+    virtual void setDefaultTextEncodingName(const WebString&);
+    virtual void setJavaScriptEnabled(bool);
+    virtual void setWebSecurityEnabled(bool);
+    virtual void setJavaScriptCanOpenWindowsAutomatically(bool);
+    virtual void setLoadsImagesAutomatically(bool);
+    virtual void setPluginsEnabled(bool);
+    virtual void setDOMPasteAllowed(bool);
+    virtual void setDeveloperExtrasEnabled(bool);
+    virtual void setNeedsSiteSpecificQuirks(bool);
+    virtual void setShrinksStandaloneImagesToFit(bool);
+    virtual void setUsesEncodingDetector(bool);
+    virtual void setTextAreasAreResizable(bool);
+    virtual void setJavaEnabled(bool);
+    virtual void setAllowScriptsToCloseWindows(bool);
+    virtual void setUserStyleSheetLocation(const WebURL&);
+    virtual void setUsesPageCache(bool);
+    virtual void setDownloadableBinaryFontsEnabled(bool);
+    virtual void setXSSAuditorEnabled(bool);
+    virtual void setLocalStorageEnabled(bool);
+    virtual void setEditableLinkBehaviorNeverLive();
+    virtual void setFontRenderingModeNormal();
+    virtual void setShouldPaintCustomScrollbars(bool);
+    virtual void setDatabasesEnabled(bool);
+    virtual void setAllowUniversalAccessFromFileURLs(bool);
+    virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded();
+    virtual void setOfflineWebApplicationCacheEnabled(bool);
+    virtual void setExperimentalWebGLEnabled(bool);
+    virtual void setGeolocationEnabled(bool);
+
+private:
+    WebCore::Settings* m_settings;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebSharedWorkerImpl.cpp b/WebKit/chromium/src/WebSharedWorkerImpl.cpp
new file mode 100644
index 0000000..4547336
--- /dev/null
+++ b/WebKit/chromium/src/WebSharedWorkerImpl.cpp
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebSharedWorkerImpl.h"
+
+#include "GenericWorkerTask.h"
+#include "KURL.h"
+#include "MessageEvent.h"
+#include "MessagePortChannel.h"
+#include "PlatformMessagePortChannel.h"
+#include "ScriptExecutionContext.h"
+#include "SharedWorkerContext.h"
+#include "SharedWorkerThread.h"
+
+#include "WebMessagePortChannel.h"
+#include "WebString.h"
+#include "WebURL.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+#if ENABLE(SHARED_WORKERS)
+
+WebSharedWorkerImpl::WebSharedWorkerImpl(WebCommonWorkerClient* client)
+    : m_client(client)
+{
+}
+
+WebSharedWorkerImpl::~WebSharedWorkerImpl()
+{
+}
+
+bool WebSharedWorkerImpl::isStarted()
+{
+    // Should not ever be called from the worker thread (this API is only called on WebSharedWorkerProxy on the renderer thread).
+    ASSERT_NOT_REACHED();
+    return workerThread();
+}
+
+void WebSharedWorkerImpl::connect(WebMessagePortChannel* webChannel, ConnectListener* listener)
+{
+    // Convert the WebMessagePortChanel to a WebCore::MessagePortChannel.
+    RefPtr<PlatformMessagePortChannel> platform_channel =
+        PlatformMessagePortChannel::create(webChannel);
+    webChannel->setClient(platform_channel.get());
+    OwnPtr<MessagePortChannel> channel =
+        MessagePortChannel::create(platform_channel);
+
+    workerThread()->runLoop().postTask(
+        createCallbackTask(&connectTask, this, channel.release()));
+    if (listener)
+        listener->connected();
+}
+
+void WebSharedWorkerImpl::connectTask(ScriptExecutionContext* context, WebSharedWorkerImpl* worker, PassOwnPtr<MessagePortChannel> channel)
+{
+    // Wrap the passed-in channel in a MessagePort, and send it off via a connect event.
+    RefPtr<MessagePort> port = MessagePort::create(*context);
+    port->entangle(channel.release());
+    ASSERT(context->isWorkerContext());
+    WorkerContext* workerContext = static_cast<WorkerContext*>(context);
+    ASSERT(workerContext->isSharedWorkerContext());
+    workerContext->toSharedWorkerContext()->dispatchEvent(createConnectEvent(port));
+}
+
+void WebSharedWorkerImpl::startWorkerContext(const WebURL& url, const WebString& name, const WebString& userAgent, const WebString& sourceCode)
+{
+    initializeLoader(url);
+    setWorkerThread(SharedWorkerThread::create(name, url, userAgent, sourceCode, *this, *this));
+    workerThread()->start();
+}
+
+void WebSharedWorkerImpl::terminateWorkerContext()
+{
+    stopWorkerThread();
+}
+
+void WebSharedWorkerImpl::clientDestroyed()
+{
+    m_client = 0;
+}
+
+WebWorkerClient* WebSharedWorkerImpl::client()
+{
+    // We should never be asked for a WebWorkerClient (only dedicated workers have an associated WebWorkerClient).
+    // It should not be possible for SharedWorkerContext to generate an API call outside those supported by WebCommonWorkerClient.
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+WebSharedWorker* WebSharedWorker::create(WebCommonWorkerClient* client)
+{
+    return new WebSharedWorkerImpl(client);
+}
+
+#endif // ENABLE(SHARED_WORKERS)
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebSharedWorkerImpl.h b/WebKit/chromium/src/WebSharedWorkerImpl.h
new file mode 100644
index 0000000..7c10d76
--- /dev/null
+++ b/WebKit/chromium/src/WebSharedWorkerImpl.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSharedWorkerImpl_h
+#define WebSharedWorkerImpl_h
+
+#include "WebSharedWorker.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "ScriptExecutionContext.h"
+
+#include "WebWorkerBase.h"
+
+namespace WebKit {
+
+// This class is used by the worker process code to talk to the WebCore::SharedWorker implementation.
+// It can't use it directly since it uses WebKit types, so this class converts the data types.
+// When the WebCore::SharedWorker object wants to call WebCore::WorkerReportingProxy, this class will
+// convert to Chrome data types first and then call the supplied WebCommonWorkerClient.
+class WebSharedWorkerImpl : public WebWorkerBase, public WebSharedWorker {
+public:
+    explicit WebSharedWorkerImpl(WebCommonWorkerClient* client);
+
+    // WebSharedWorker methods:
+    virtual bool isStarted();
+    virtual void startWorkerContext(const WebURL&, const WebString& name, const WebString& userAgent, const WebString& sourceCode);
+    virtual void connect(WebMessagePortChannel*, ConnectListener*);
+    virtual void terminateWorkerContext();
+    virtual void clientDestroyed();
+
+    // WebWorkerBase methods:
+    WebWorkerClient* client();
+    WebCommonWorkerClient* commonClient() { return m_client; }
+
+private:
+    virtual ~WebSharedWorkerImpl();
+
+    static void connectTask(WebCore::ScriptExecutionContext*, WebSharedWorkerImpl*, PassOwnPtr<WebCore::MessagePortChannel>);
+
+    WebCommonWorkerClient* m_client;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(SHARED_WORKERS)
+
+#endif
diff --git a/WebKit/chromium/src/WebStorageAreaImpl.cpp b/WebKit/chromium/src/WebStorageAreaImpl.cpp
new file mode 100644
index 0000000..f24bee3
--- /dev/null
+++ b/WebKit/chromium/src/WebStorageAreaImpl.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebStorageAreaImpl.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "ExceptionCode.h"
+
+#include "WebString.h"
+#include "WebURL.h"
+
+namespace WebKit {
+
+const WebURL* WebStorageAreaImpl::storageEventURL = 0;
+
+WebStorageAreaImpl::WebStorageAreaImpl(PassRefPtr<WebCore::StorageArea> storageArea)
+    : m_storageArea(storageArea)
+{
+}
+
+WebStorageAreaImpl::~WebStorageAreaImpl()
+{
+}
+
+unsigned WebStorageAreaImpl::length()
+{
+    return m_storageArea->length();
+}
+
+WebString WebStorageAreaImpl::key(unsigned index)
+{
+    return m_storageArea->key(index);
+}
+
+WebString WebStorageAreaImpl::getItem(const WebString& key)
+{
+    return m_storageArea->getItem(key);
+}
+
+void WebStorageAreaImpl::setItem(const WebString& key, const WebString& value, const WebURL& url, bool& quotaException)
+{
+    int exceptionCode = 0;
+
+    ScopedStorageEventURL scope(url);
+    m_storageArea->setItem(key, value, exceptionCode, 0);
+
+    if (exceptionCode) {
+        ASSERT(exceptionCode == WebCore::QUOTA_EXCEEDED_ERR);
+        quotaException = true;
+    } else
+        quotaException = false;
+}
+
+void WebStorageAreaImpl::removeItem(const WebString& key, const WebURL& url)
+{
+    ScopedStorageEventURL scope(url);
+    m_storageArea->removeItem(key, 0);
+}
+
+void WebStorageAreaImpl::clear(const WebURL& url)
+{
+    ScopedStorageEventURL scope(url);
+    m_storageArea->clear(0);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebKit/chromium/src/WebStorageAreaImpl.h b/WebKit/chromium/src/WebStorageAreaImpl.h
new file mode 100644
index 0000000..e1f74e0
--- /dev/null
+++ b/WebKit/chromium/src/WebStorageAreaImpl.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStorageAreaImpl_h
+#define WebStorageAreaImpl_h
+
+#if ENABLE(DOM_STORAGE)
+
+#include "StorageAreaImpl.h"
+#include "WebStorageArea.h"
+
+namespace WebKit {
+
+class WebStorageAreaImpl : public WebStorageArea {
+public:
+    WebStorageAreaImpl(PassRefPtr<WebCore::StorageArea> storageArea);
+    virtual ~WebStorageAreaImpl();
+    virtual unsigned length();
+    virtual WebString key(unsigned index);
+    virtual WebString getItem(const WebString& key);
+    virtual void setItem(const WebString& key, const WebString& value, const WebURL& url, bool& quotaException);
+    virtual void removeItem(const WebString& key, const WebURL& url);
+    virtual void clear(const WebURL& url);
+
+    // For storage events in single-process mode and test shell.
+    static const WebURL* currentStorageEventURL() { return storageEventURL; }
+
+private:
+    class ScopedStorageEventURL {
+    public:
+        ScopedStorageEventURL(const WebURL& url)
+        {
+            // FIXME: Once storage events are fired async in WebKit (as they should
+            //        be) this can be ASSERTed to be 0 rather than saved.
+            m_existingStorageEventURL = storageEventURL;
+            storageEventURL = &url;
+        }
+        ~ScopedStorageEventURL()
+        {
+            storageEventURL = m_existingStorageEventURL;
+        }
+
+    private:
+        const WebURL* m_existingStorageEventURL;
+    };
+
+    static const WebURL* storageEventURL;
+
+    RefPtr<WebCore::StorageArea> m_storageArea;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // WebStorageAreaImpl_h
diff --git a/WebKit/chromium/src/WebStorageEventDispatcherImpl.cpp b/WebKit/chromium/src/WebStorageEventDispatcherImpl.cpp
new file mode 100644
index 0000000..515a423
--- /dev/null
+++ b/WebKit/chromium/src/WebStorageEventDispatcherImpl.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebStorageEventDispatcherImpl.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "KURL.h"
+#include "SecurityOrigin.h"
+
+#include "WebStorageAreaImpl.h"
+#include "WebURL.h"
+
+namespace WebKit {
+
+extern const char* pageGroupName;
+
+WebStorageEventDispatcher* WebStorageEventDispatcher::create()
+{
+    return new WebStorageEventDispatcherImpl();
+}
+
+WebStorageEventDispatcherImpl::WebStorageEventDispatcherImpl()
+    : m_eventDispatcher(new WebCore::StorageEventDispatcherImpl(pageGroupName))
+{
+    ASSERT(m_eventDispatcher);
+}
+
+void WebStorageEventDispatcherImpl::dispatchStorageEvent(const WebString& key, const WebString& oldValue,
+                                                         const WebString& newValue, const WebString& origin,
+                                                         const WebURL& passedInURL, bool isLocalStorage)
+{
+    // Hack for single-process mode and test shell.
+    const WebURL* storageAreaImplURL = WebStorageAreaImpl::currentStorageEventURL();
+    const WebURL& url = storageAreaImplURL ? *storageAreaImplURL : passedInURL;
+
+    WebCore::StorageType storageType = isLocalStorage ? WebCore::LocalStorage : WebCore::SessionStorage;
+    RefPtr<WebCore::SecurityOrigin> securityOrigin = WebCore::SecurityOrigin::createFromString(origin);
+    m_eventDispatcher->dispatchStorageEvent(key, oldValue, newValue, securityOrigin.get(), url, storageType);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebKit/chromium/src/WebStorageEventDispatcherImpl.h b/WebKit/chromium/src/WebStorageEventDispatcherImpl.h
new file mode 100644
index 0000000..6848b99
--- /dev/null
+++ b/WebKit/chromium/src/WebStorageEventDispatcherImpl.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStorageEventDispatcherImpl_h
+#define WebStorageEventDispatcherImpl_h
+
+#if ENABLE(DOM_STORAGE)
+
+#include "StorageEventDispatcherImpl.h"
+#include "WebStorageEventDispatcher.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebKit {
+
+class WebStorageEventDispatcherImpl : public WebStorageEventDispatcher {
+public:
+    WebStorageEventDispatcherImpl();
+
+    virtual void dispatchStorageEvent(const WebString& key, const WebString& oldValue,
+                                      const WebString& newValue, const WebString& origin,
+                                      const WebURL&, bool isLocalStorage);
+
+private:
+    OwnPtr<WebCore::StorageEventDispatcherImpl> m_eventDispatcher;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // WebStorageEventDispatcherImpl_h
diff --git a/WebKit/chromium/src/WebStorageNamespaceImpl.cpp b/WebKit/chromium/src/WebStorageNamespaceImpl.cpp
new file mode 100644
index 0000000..e6f6548
--- /dev/null
+++ b/WebKit/chromium/src/WebStorageNamespaceImpl.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebStorageNamespaceImpl.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "SecurityOrigin.h"
+
+#include "WebStorageAreaImpl.h"
+#include "WebString.h"
+
+namespace WebKit {
+
+WebStorageNamespace* WebStorageNamespace::createLocalStorageNamespace(const WebString& path, unsigned quota)
+{
+    return new WebStorageNamespaceImpl(WebCore::StorageNamespaceImpl::localStorageNamespace(path, quota));
+}
+
+WebStorageNamespace* WebStorageNamespace::createSessionStorageNamespace()
+{
+    return new WebStorageNamespaceImpl(WebCore::StorageNamespaceImpl::sessionStorageNamespace());
+}
+
+WebStorageNamespaceImpl::WebStorageNamespaceImpl(PassRefPtr<WebCore::StorageNamespace> storageNamespace)
+    : m_storageNamespace(storageNamespace)
+{
+}
+
+WebStorageNamespaceImpl::~WebStorageNamespaceImpl()
+{
+}
+
+WebStorageArea* WebStorageNamespaceImpl::createStorageArea(const WebString& originString)
+{
+    WebCore::String originWebCoreString = originString;
+    if (originWebCoreString == "file://") {
+        // FIXME: We should really be passing around WebSecurityOrigin objects
+        //        to represent security origins instead of strings.  One issue
+        //        with using strings is that createFromString(toString) does
+        //        not round-trip for file URLs because file:// looks like a
+        //        directory (which is sandboxed).
+        //
+        // For the time being, we work around this issue by using "file:///a",
+        // which does not look like a directory.  We should fix this when
+        // jorlow gets back from vactation.
+        originWebCoreString = "file:///a";
+    }
+    RefPtr<WebCore::SecurityOrigin> origin = WebCore::SecurityOrigin::createFromString(originWebCoreString);
+    return new WebStorageAreaImpl(m_storageNamespace->storageArea(origin.release()));
+}
+
+WebStorageNamespace* WebStorageNamespaceImpl::copy()
+{
+    return new WebStorageNamespaceImpl(m_storageNamespace->copy());
+}
+
+void WebStorageNamespaceImpl::close()
+{
+    m_storageNamespace->close();
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebKit/chromium/src/WebStorageNamespaceImpl.h b/WebKit/chromium/src/WebStorageNamespaceImpl.h
new file mode 100644
index 0000000..4e82c21
--- /dev/null
+++ b/WebKit/chromium/src/WebStorageNamespaceImpl.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStorageNamespaceImpl_h
+#define WebStorageNamespaceImpl_h
+
+#if ENABLE(DOM_STORAGE)
+
+#include "StorageNamespaceImpl.h"
+#include "WebStorageNamespace.h"
+
+namespace WebKit {
+
+class WebStorageNamespaceImpl : public WebStorageNamespace {
+public:
+    WebStorageNamespaceImpl(PassRefPtr<WebCore::StorageNamespace> storageNamespace);
+    virtual ~WebStorageNamespaceImpl();
+    virtual WebStorageArea* createStorageArea(const WebString& origin);
+    virtual WebStorageNamespace* copy();
+    virtual void close();
+
+private:
+    RefPtr<WebCore::StorageNamespace> m_storageNamespace;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // WebStorageNamespaceImpl_h
diff --git a/WebKit/chromium/src/WebString.cpp b/WebKit/chromium/src/WebString.cpp
new file mode 100644
index 0000000..f45e05f
--- /dev/null
+++ b/WebKit/chromium/src/WebString.cpp
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebString.h"
+
+#include "AtomicString.h"
+#include "CString.h"
+#include "PlatformString.h"
+
+#include "WebCString.h"
+
+namespace WebKit {
+
+class WebStringPrivate : public WebCore::StringImpl {
+};
+
+void WebString::reset()
+{
+    if (m_private) {
+        m_private->deref();
+        m_private = 0;
+    }
+}
+
+void WebString::assign(const WebString& other)
+{
+    assign(const_cast<WebStringPrivate*>(other.m_private));
+}
+
+void WebString::assign(const WebUChar* data, size_t length)
+{
+    assign(static_cast<WebStringPrivate*>(
+        WebCore::StringImpl::create(data, length).get()));
+}
+
+size_t WebString::length() const
+{
+    return m_private ? const_cast<WebStringPrivate*>(m_private)->length() : 0;
+}
+
+const WebUChar* WebString::data() const
+{
+    return m_private ? const_cast<WebStringPrivate*>(m_private)->characters() : 0;
+}
+
+WebCString WebString::utf8() const
+{
+    return WebCore::String(m_private).utf8();
+}
+
+WebString WebString::fromUTF8(const char* data, size_t length)
+{
+    return WebCore::String::fromUTF8(data, length);
+}
+
+WebString WebString::fromUTF8(const char* data)
+{
+    return WebCore::String::fromUTF8(data);
+}
+
+WebString::WebString(const WebCore::String& s)
+    : m_private(static_cast<WebStringPrivate*>(s.impl()))
+{
+    if (m_private)
+        m_private->ref();
+}
+
+WebString& WebString::operator=(const WebCore::String& s)
+{
+    assign(static_cast<WebStringPrivate*>(s.impl()));
+    return *this;
+}
+
+WebString::operator WebCore::String() const
+{
+    return m_private;
+}
+
+WebString::WebString(const WebCore::AtomicString& s)
+    : m_private(0)
+{
+    assign(s.string());
+}
+
+WebString& WebString::operator=(const WebCore::AtomicString& s)
+{
+    assign(s.string());
+    return *this;
+}
+
+WebString::operator WebCore::AtomicString() const
+{
+    return WebCore::AtomicString(static_cast<WebCore::StringImpl *>(m_private));
+}
+
+void WebString::assign(WebStringPrivate* p)
+{
+    // Take care to handle the case where m_private == p
+    if (p)
+        p->ref();
+    if (m_private)
+        m_private->deref();
+    m_private = p;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebURL.cpp b/WebKit/chromium/src/WebURL.cpp
new file mode 100644
index 0000000..feb92c1
--- /dev/null
+++ b/WebKit/chromium/src/WebURL.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebURL.h"
+
+#include "KURL.h"
+
+namespace WebKit {
+
+WebURL::WebURL(const WebCore::KURL& url)
+    : m_spec(url.utf8String())
+    , m_parsed(url.parsed())
+    , m_isValid(url.isValid())
+{
+}
+
+WebURL& WebURL::operator=(const WebCore::KURL& url)
+{
+    m_spec = url.utf8String();
+    m_parsed = url.parsed();
+    m_isValid = url.isValid();
+    return *this;
+}
+
+WebURL::operator WebCore::KURL() const
+{
+    return WebCore::KURL(m_spec, m_parsed, m_isValid);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebURLError.cpp b/WebKit/chromium/src/WebURLError.cpp
new file mode 100644
index 0000000..a038aee
--- /dev/null
+++ b/WebKit/chromium/src/WebURLError.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebURLError.h"
+
+#include "CString.h"
+#include "KURL.h"
+#include "ResourceError.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebURLError::WebURLError(const ResourceError& error)
+{
+    *this = error;
+}
+
+WebURLError& WebURLError::operator=(const ResourceError& error)
+{
+    if (error.isNull())
+        *this = WebURLError();
+    else {
+        domain = error.domain();
+        reason = error.errorCode();
+        unreachableURL = KURL(ParsedURLString, error.failingURL());
+    }
+    return *this;
+}
+
+WebURLError::operator ResourceError() const
+{
+    if (!reason)
+        return ResourceError();
+    CString spec = unreachableURL.spec();
+    return ResourceError(domain, reason,
+                         String::fromUTF8(spec.data(), spec.length()),
+                         String());
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebURLRequest.cpp b/WebKit/chromium/src/WebURLRequest.cpp
new file mode 100644
index 0000000..46fa842
--- /dev/null
+++ b/WebKit/chromium/src/WebURLRequest.cpp
@@ -0,0 +1,265 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebURLRequest.h"
+
+#include "ResourceRequest.h"
+
+#include "WebHTTPBody.h"
+#include "WebHTTPHeaderVisitor.h"
+#include "WebURL.h"
+#include "WebURLRequestPrivate.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// The standard implementation of WebURLRequestPrivate, which maintains
+// ownership of a ResourceRequest instance.
+class WebURLRequestPrivateImpl : public WebURLRequestPrivate {
+public:
+    WebURLRequestPrivateImpl()
+    {
+        m_resourceRequest = &m_resourceRequestAllocation;
+    }
+
+    WebURLRequestPrivateImpl(const WebURLRequestPrivate* p)
+        : m_resourceRequestAllocation(*p->m_resourceRequest)
+    {
+        m_resourceRequest = &m_resourceRequestAllocation;
+    }
+
+    virtual void dispose() { delete this; }
+
+    ResourceRequest m_resourceRequestAllocation;
+};
+
+void WebURLRequest::initialize()
+{
+    assign(new WebURLRequestPrivateImpl());
+}
+
+void WebURLRequest::reset()
+{
+    assign(0);
+}
+
+void WebURLRequest::assign(const WebURLRequest& r)
+{
+    if (&r != this)
+        assign(r.m_private ? new WebURLRequestPrivateImpl(r.m_private) : 0);
+}
+
+bool WebURLRequest::isNull() const
+{
+    return !m_private || m_private->m_resourceRequest->isNull();
+}
+
+WebURL WebURLRequest::url() const
+{
+    return m_private->m_resourceRequest->url();
+}
+
+void WebURLRequest::setURL(const WebURL& url)
+{
+    m_private->m_resourceRequest->setURL(url);
+}
+
+WebURL WebURLRequest::firstPartyForCookies() const
+{
+    return m_private->m_resourceRequest->firstPartyForCookies();
+}
+
+void WebURLRequest::setFirstPartyForCookies(const WebURL& firstPartyForCookies)
+{
+    m_private->m_resourceRequest->setFirstPartyForCookies(firstPartyForCookies);
+}
+
+bool WebURLRequest::allowCookies() const
+{
+    return m_private->m_resourceRequest->allowCookies();
+}
+
+void WebURLRequest::setAllowCookies(bool allowCookies)
+{
+    m_private->m_resourceRequest->setAllowCookies(allowCookies);
+}
+
+bool WebURLRequest::allowStoredCredentials() const
+{
+    return m_private->m_allowStoredCredentials;
+}
+
+void WebURLRequest::setAllowStoredCredentials(bool allowStoredCredentials)
+{
+    m_private->m_allowStoredCredentials = allowStoredCredentials;
+}
+
+WebURLRequest::CachePolicy WebURLRequest::cachePolicy() const
+{
+    return static_cast<WebURLRequest::CachePolicy>(
+        m_private->m_resourceRequest->cachePolicy());
+}
+
+void WebURLRequest::setCachePolicy(CachePolicy cachePolicy)
+{
+    m_private->m_resourceRequest->setCachePolicy(
+        static_cast<ResourceRequestCachePolicy>(cachePolicy));
+}
+
+WebString WebURLRequest::httpMethod() const
+{
+    return m_private->m_resourceRequest->httpMethod();
+}
+
+void WebURLRequest::setHTTPMethod(const WebString& httpMethod)
+{
+    m_private->m_resourceRequest->setHTTPMethod(httpMethod);
+}
+
+WebString WebURLRequest::httpHeaderField(const WebString& name) const
+{
+    return m_private->m_resourceRequest->httpHeaderField(name);
+}
+
+void WebURLRequest::setHTTPHeaderField(const WebString& name, const WebString& value)
+{
+    m_private->m_resourceRequest->setHTTPHeaderField(name, value);
+}
+
+void WebURLRequest::addHTTPHeaderField(const WebString& name, const WebString& value)
+{
+    m_private->m_resourceRequest->addHTTPHeaderField(name, value);
+}
+
+void WebURLRequest::clearHTTPHeaderField(const WebString& name)
+{
+    // FIXME: Add a clearHTTPHeaderField method to ResourceRequest.
+    const HTTPHeaderMap& map = m_private->m_resourceRequest->httpHeaderFields();
+    const_cast<HTTPHeaderMap*>(&map)->remove(name);
+}
+
+void WebURLRequest::visitHTTPHeaderFields(WebHTTPHeaderVisitor* visitor) const
+{
+    const HTTPHeaderMap& map = m_private->m_resourceRequest->httpHeaderFields();
+    for (HTTPHeaderMap::const_iterator it = map.begin(); it != map.end(); ++it)
+        visitor->visitHeader(it->first, it->second);
+}
+
+WebHTTPBody WebURLRequest::httpBody() const
+{
+    return WebHTTPBody(m_private->m_resourceRequest->httpBody());
+}
+
+void WebURLRequest::setHTTPBody(const WebHTTPBody& httpBody)
+{
+    m_private->m_resourceRequest->setHTTPBody(httpBody);
+}
+
+bool WebURLRequest::reportUploadProgress() const
+{
+    return m_private->m_resourceRequest->reportUploadProgress();
+}
+
+void WebURLRequest::setReportUploadProgress(bool reportUploadProgress)
+{
+    m_private->m_resourceRequest->setReportUploadProgress(reportUploadProgress);
+}
+
+WebURLRequest::TargetType WebURLRequest::targetType() const
+{
+    return static_cast<TargetType>(m_private->m_resourceRequest->targetType());
+}
+
+void WebURLRequest::setTargetType(TargetType targetType)
+{
+    m_private->m_resourceRequest->setTargetType(
+        static_cast<ResourceRequest::TargetType>(targetType));
+}
+
+int WebURLRequest::requestorID() const
+{
+    return m_private->m_resourceRequest->requestorID();
+}
+
+void WebURLRequest::setRequestorID(int requestorID)
+{
+    m_private->m_resourceRequest->setRequestorID(requestorID);
+}
+
+int WebURLRequest::requestorProcessID() const
+{
+    return m_private->m_resourceRequest->requestorProcessID();
+}
+
+void WebURLRequest::setRequestorProcessID(int requestorProcessID)
+{
+    m_private->m_resourceRequest->setRequestorProcessID(requestorProcessID);
+}
+
+int WebURLRequest::appCacheHostID() const
+{
+    return m_private->m_resourceRequest->appCacheHostID();
+}
+
+void WebURLRequest::setAppCacheHostID(int appCacheHostID)
+{
+    m_private->m_resourceRequest->setAppCacheHostID(appCacheHostID);
+}
+
+ResourceRequest& WebURLRequest::toMutableResourceRequest()
+{
+    ASSERT(m_private);
+    ASSERT(m_private->m_resourceRequest);
+
+    return *m_private->m_resourceRequest;
+}
+
+const ResourceRequest& WebURLRequest::toResourceRequest() const
+{
+    ASSERT(m_private);
+    ASSERT(m_private->m_resourceRequest);
+
+    return *m_private->m_resourceRequest;
+}
+
+void WebURLRequest::assign(WebURLRequestPrivate* p)
+{
+    // Subclasses may call this directly so a self-assignment check is needed
+    // here as well as in the public assign method.
+    if (m_private == p)
+        return;
+    if (m_private)
+        m_private->dispose();
+    m_private = p;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebURLRequestPrivate.h b/WebKit/chromium/src/WebURLRequestPrivate.h
new file mode 100644
index 0000000..2f7c25f
--- /dev/null
+++ b/WebKit/chromium/src/WebURLRequestPrivate.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebURLRequestPrivate_h
+#define WebURLRequestPrivate_h
+
+namespace WebCore { class ResourceRequest; }
+
+namespace WebKit {
+
+class WebURLRequestPrivate {
+public:
+    WebURLRequestPrivate() : m_resourceRequest(0), m_allowStoredCredentials(true) { }
+
+    // Called by WebURLRequest when it no longer needs this object.
+    virtual void dispose() = 0;
+
+    WebCore::ResourceRequest* m_resourceRequest;
+    bool m_allowStoredCredentials;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebURLResponse.cpp b/WebKit/chromium/src/WebURLResponse.cpp
new file mode 100644
index 0000000..49f07f9
--- /dev/null
+++ b/WebKit/chromium/src/WebURLResponse.cpp
@@ -0,0 +1,269 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebURLResponse.h"
+
+#include "ResourceResponse.h"
+
+#include "WebHTTPHeaderVisitor.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebURLResponsePrivate.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// The standard implementation of WebURLResponsePrivate, which maintains
+// ownership of a ResourceResponse instance.
+class WebURLResponsePrivateImpl : public WebURLResponsePrivate {
+public:
+    WebURLResponsePrivateImpl()
+    {
+        m_resourceResponse = &m_resourceResponseAllocation;
+    }
+
+    WebURLResponsePrivateImpl(const WebURLResponsePrivate* p)
+        : m_resourceResponseAllocation(*p->m_resourceResponse)
+    {
+        m_resourceResponse = &m_resourceResponseAllocation;
+    }
+
+    virtual void dispose() { delete this; }
+
+    ResourceResponse m_resourceResponseAllocation;
+};
+
+void WebURLResponse::initialize()
+{
+    assign(new WebURLResponsePrivateImpl());
+}
+
+void WebURLResponse::reset()
+{
+    assign(0);
+}
+
+void WebURLResponse::assign(const WebURLResponse& r)
+{
+    if (&r != this)
+        assign(r.m_private ? new WebURLResponsePrivateImpl(r.m_private) : 0);
+}
+
+bool WebURLResponse::isNull() const
+{
+    return !m_private || m_private->m_resourceResponse->isNull();
+}
+
+WebURL WebURLResponse::url() const
+{
+    return m_private->m_resourceResponse->url();
+}
+
+void WebURLResponse::setURL(const WebURL& url)
+{
+    m_private->m_resourceResponse->setURL(url);
+}
+
+WebString WebURLResponse::mimeType() const
+{
+    return m_private->m_resourceResponse->mimeType();
+}
+
+void WebURLResponse::setMIMEType(const WebString& mimeType)
+{
+    m_private->m_resourceResponse->setMimeType(mimeType);
+}
+
+long long WebURLResponse::expectedContentLength() const
+{
+    return m_private->m_resourceResponse->expectedContentLength();
+}
+
+void WebURLResponse::setExpectedContentLength(long long expectedContentLength)
+{
+    m_private->m_resourceResponse->setExpectedContentLength(expectedContentLength);
+}
+
+WebString WebURLResponse::textEncodingName() const
+{
+    return m_private->m_resourceResponse->textEncodingName();
+}
+
+void WebURLResponse::setTextEncodingName(const WebString& textEncodingName)
+{
+    m_private->m_resourceResponse->setTextEncodingName(textEncodingName);
+}
+
+WebString WebURLResponse::suggestedFileName() const
+{
+    return m_private->m_resourceResponse->suggestedFilename();
+}
+
+void WebURLResponse::setSuggestedFileName(const WebString& suggestedFileName)
+{
+    m_private->m_resourceResponse->setSuggestedFilename(suggestedFileName);
+}
+
+int WebURLResponse::httpStatusCode() const
+{
+    return m_private->m_resourceResponse->httpStatusCode();
+}
+
+void WebURLResponse::setHTTPStatusCode(int httpStatusCode)
+{
+    m_private->m_resourceResponse->setHTTPStatusCode(httpStatusCode);
+}
+
+WebString WebURLResponse::httpStatusText() const
+{
+    return m_private->m_resourceResponse->httpStatusText();
+}
+
+void WebURLResponse::setHTTPStatusText(const WebString& httpStatusText)
+{
+    m_private->m_resourceResponse->setHTTPStatusText(httpStatusText);
+}
+
+WebString WebURLResponse::httpHeaderField(const WebString& name) const
+{
+    return m_private->m_resourceResponse->httpHeaderField(name);
+}
+
+void WebURLResponse::setHTTPHeaderField(const WebString& name, const WebString& value)
+{
+    m_private->m_resourceResponse->setHTTPHeaderField(name, value);
+}
+
+void WebURLResponse::addHTTPHeaderField(const WebString& name, const WebString& value)
+{
+    // FIXME: Add an addHTTPHeaderField method to ResourceResponse.
+    const HTTPHeaderMap& map = m_private->m_resourceResponse->httpHeaderFields();
+    String valueStr(value);
+    pair<HTTPHeaderMap::iterator, bool> result =
+        const_cast<HTTPHeaderMap*>(&map)->add(name, valueStr);
+    if (!result.second)
+        result.first->second += ", " + valueStr;
+}
+
+void WebURLResponse::clearHTTPHeaderField(const WebString& name)
+{
+    // FIXME: Add a clearHTTPHeaderField method to ResourceResponse.
+    const HTTPHeaderMap& map = m_private->m_resourceResponse->httpHeaderFields();
+    const_cast<HTTPHeaderMap*>(&map)->remove(name);
+}
+
+void WebURLResponse::visitHTTPHeaderFields(WebHTTPHeaderVisitor* visitor) const
+{
+    const HTTPHeaderMap& map = m_private->m_resourceResponse->httpHeaderFields();
+    for (HTTPHeaderMap::const_iterator it = map.begin(); it != map.end(); ++it)
+        visitor->visitHeader(it->first, it->second);
+}
+
+double WebURLResponse::lastModifiedDate() const
+{
+    return static_cast<double>(m_private->m_resourceResponse->lastModifiedDate());
+}
+
+void WebURLResponse::setLastModifiedDate(double lastModifiedDate)
+{
+    m_private->m_resourceResponse->setLastModifiedDate(static_cast<time_t>(lastModifiedDate));
+}
+
+bool WebURLResponse::isContentFiltered() const
+{
+    return m_private->m_resourceResponse->isContentFiltered();
+}
+
+void WebURLResponse::setIsContentFiltered(bool isContentFiltered)
+{
+    m_private->m_resourceResponse->setIsContentFiltered(isContentFiltered);
+}
+
+long long WebURLResponse::appCacheID() const
+{
+    return m_private->m_resourceResponse->appCacheID();
+}
+
+void WebURLResponse::setAppCacheID(long long appCacheID)
+{
+    m_private->m_resourceResponse->setAppCacheID(appCacheID);
+}
+
+WebURL WebURLResponse::appCacheManifestURL() const
+{
+    return m_private->m_resourceResponse->appCacheManifestURL();
+}
+
+void WebURLResponse::setAppCacheManifestURL(const WebURL& url)
+{
+    m_private->m_resourceResponse->setAppCacheManifestURL(url);
+}
+
+WebCString WebURLResponse::securityInfo() const
+{
+    // FIXME: getSecurityInfo is misnamed.
+    return m_private->m_resourceResponse->getSecurityInfo();
+}
+
+void WebURLResponse::setSecurityInfo(const WebCString& securityInfo)
+{
+    m_private->m_resourceResponse->setSecurityInfo(securityInfo);
+}
+
+ResourceResponse& WebURLResponse::toMutableResourceResponse()
+{
+    ASSERT(m_private);
+    ASSERT(m_private->m_resourceResponse);
+
+    return *m_private->m_resourceResponse;
+}
+
+const ResourceResponse& WebURLResponse::toResourceResponse() const
+{
+    ASSERT(m_private);
+    ASSERT(m_private->m_resourceResponse);
+
+    return *m_private->m_resourceResponse;
+}
+
+void WebURLResponse::assign(WebURLResponsePrivate* p)
+{
+    // Subclasses may call this directly so a self-assignment check is needed
+    // here as well as in the public assign method.
+    if (m_private == p)
+        return;
+    if (m_private)
+        m_private->dispose();
+    m_private = p;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebURLResponsePrivate.h b/WebKit/chromium/src/WebURLResponsePrivate.h
new file mode 100644
index 0000000..716c8db
--- /dev/null
+++ b/WebKit/chromium/src/WebURLResponsePrivate.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebURLResponsePrivate_h
+#define WebURLResponsePrivate_h
+
+namespace WebCore { class ResourceResponse; }
+
+namespace WebKit {
+
+class WebURLResponsePrivate {
+public:
+    WebURLResponsePrivate() : m_resourceResponse(0) { }
+
+    // Called by WebURLResponse when it no longer needs this object.
+    virtual void dispose() = 0;
+
+    WebCore::ResourceResponse* m_resourceResponse;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebViewImpl.cpp b/WebKit/chromium/src/WebViewImpl.cpp
new file mode 100644
index 0000000..357cdca
--- /dev/null
+++ b/WebKit/chromium/src/WebViewImpl.cpp
@@ -0,0 +1,1798 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebViewImpl.h"
+
+#include "AutocompletePopupMenuClient.h"
+#include "AXObjectCache.h"
+#include "ContextMenu.h"
+#include "ContextMenuController.h"
+#include "ContextMenuItem.h"
+#include "CSSStyleSelector.h"
+#include "CSSValueKeywords.h"
+#include "Cursor.h"
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "DOMUtilitiesPrivate.h"
+#include "DragController.h"
+#include "DragData.h"
+#include "Editor.h"
+#include "EventHandler.h"
+#include "FocusController.h"
+#include "FontDescription.h"
+#include "FrameLoader.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HitTestResult.h"
+#include "HTMLInputElement.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "Image.h"
+#include "InspectorController.h"
+#include "IntRect.h"
+#include "KeyboardCodes.h"
+#include "KeyboardEvent.h"
+#include "MIMETypeRegistry.h"
+#include "NodeRenderStyle.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "Pasteboard.h"
+#include "PlatformContextSkia.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformMouseEvent.h"
+#include "PlatformWheelEvent.h"
+#include "PluginInfoStore.h"
+#include "PopupMenuChromium.h"
+#include "PopupMenuClient.h"
+#include "ProgressTracker.h"
+#include "RenderView.h"
+#include "ResourceHandle.h"
+#include "SecurityOrigin.h"
+#include "SelectionController.h"
+#include "Settings.h"
+#include "TypingCommand.h"
+#include "WebAccessibilityObject.h"
+#include "WebDevToolsAgentPrivate.h"
+#include "WebDragData.h"
+#include "WebFrameImpl.h"
+#include "WebInputEvent.h"
+#include "WebInputEventConversion.h"
+#include "WebMediaPlayerAction.h"
+#include "WebNode.h"
+#include "WebPoint.h"
+#include "WebPopupMenuImpl.h"
+#include "WebRect.h"
+#include "WebSettingsImpl.h"
+#include "WebString.h"
+#include "WebVector.h"
+#include "WebViewClient.h"
+
+#if PLATFORM(WIN_OS)
+#include "KeyboardCodesWin.h"
+#include "RenderThemeChromiumWin.h"
+#else
+#if PLATFORM(LINUX)
+#include "RenderThemeChromiumLinux.h"
+#endif
+#include "KeyboardCodesPosix.h"
+#include "RenderTheme.h"
+#endif
+
+// Get rid of WTF's pow define so we can use std::pow.
+#undef pow
+#include <cmath> // for std::pow
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// Change the text zoom level by kTextSizeMultiplierRatio each time the user
+// zooms text in or out (ie., change by 20%).  The min and max values limit
+// text zoom to half and 3x the original text size.  These three values match
+// those in Apple's port in WebKit/WebKit/WebView/WebView.mm
+static const double textSizeMultiplierRatio = 1.2;
+static const double minTextSizeMultiplier = 0.5;
+static const double maxTextSizeMultiplier = 3.0;
+
+// The group name identifies a namespace of pages.  Page group is used on OSX
+// for some programs that use HTML views to display things that don't seem like
+// web pages to the user (so shouldn't have visited link coloring).  We only use
+// one page group.
+const char* pageGroupName = "default";
+
+// Ensure that the WebDragOperation enum values stay in sync with the original
+// DragOperation constants.
+#define COMPILE_ASSERT_MATCHING_ENUM(coreName) \
+    COMPILE_ASSERT(int(coreName) == int(Web##coreName), dummy##coreName)
+COMPILE_ASSERT_MATCHING_ENUM(DragOperationNone);
+COMPILE_ASSERT_MATCHING_ENUM(DragOperationCopy);
+COMPILE_ASSERT_MATCHING_ENUM(DragOperationLink);
+COMPILE_ASSERT_MATCHING_ENUM(DragOperationGeneric);
+COMPILE_ASSERT_MATCHING_ENUM(DragOperationPrivate);
+COMPILE_ASSERT_MATCHING_ENUM(DragOperationMove);
+COMPILE_ASSERT_MATCHING_ENUM(DragOperationDelete);
+COMPILE_ASSERT_MATCHING_ENUM(DragOperationEvery);
+
+// Note that focusOnShow is false so that the autocomplete popup is shown not
+// activated.  We need the page to still have focus so the user can keep typing
+// while the popup is showing.
+static const PopupContainerSettings autocompletePopupSettings = {
+    false,  // focusOnShow
+    false,  // setTextOnIndexChange
+    false,  // acceptOnAbandon
+    true,   // loopSelectionNavigation
+    true,   // restrictWidthOfListBox. Same as other browser (Fx, IE, and safari)
+    // For autocomplete, we use the direction of the input field as the direction
+    // of the popup items. The main reason is to keep the display of items in
+    // drop-down the same as the items in the input field.
+    PopupContainerSettings::DOMElementDirection,
+};
+
+// WebView ----------------------------------------------------------------
+
+WebView* WebView::create(WebViewClient* client)
+{
+    return new WebViewImpl(client);
+}
+
+void WebView::updateVisitedLinkState(unsigned long long linkHash)
+{
+    Page::visitedStateChanged(PageGroup::pageGroup(pageGroupName), linkHash);
+}
+
+void WebView::resetVisitedLinkState()
+{
+    Page::allVisitedStateChanged(PageGroup::pageGroup(pageGroupName));
+}
+
+void WebViewImpl::initializeMainFrame(WebFrameClient* frameClient)
+{
+    // NOTE: The WebFrameImpl takes a reference to itself within InitMainFrame
+    // and releases that reference once the corresponding Frame is destroyed.
+    RefPtr<WebFrameImpl> frame = WebFrameImpl::create(frameClient);
+
+    frame->initializeAsMainFrame(this);
+
+    // Restrict the access to the local file system
+    // (see WebView.mm WebView::_commonInitializationWithFrameName).
+    SecurityOrigin::setLocalLoadPolicy(SecurityOrigin::AllowLocalLoadsForLocalOnly);
+}
+
+WebViewImpl::WebViewImpl(WebViewClient* client)
+    : m_client(client)
+    , m_backForwardListClientImpl(this)
+    , m_chromeClientImpl(this)
+    , m_contextMenuClientImpl(this)
+    , m_dragClientImpl(this)
+    , m_editorClientImpl(this)
+    , m_inspectorClientImpl(this)
+    , m_observedNewNavigation(false)
+#ifndef NDEBUG
+    , m_newNavigationLoader(0)
+#endif
+    , m_zoomLevel(0)
+    , m_contextMenuAllowed(false)
+    , m_doingDragAndDrop(false)
+    , m_ignoreInputEvents(false)
+    , m_suppressNextKeypressEvent(false)
+    , m_initialNavigationPolicy(WebNavigationPolicyIgnore)
+    , m_imeAcceptEvents(true)
+    , m_dragTargetDispatch(false)
+    , m_dragIdentity(0)
+    , m_dropEffect(DropEffectDefault)
+    , m_operationsAllowed(WebDragOperationNone)
+    , m_dragOperation(WebDragOperationNone)
+    , m_autocompletePopupShowing(false)
+    , m_isTransparent(false)
+    , m_tabsToLinks(false)
+{
+    // WebKit/win/WebView.cpp does the same thing, except they call the
+    // KJS specific wrapper around this method. We need to have threading
+    // initialized because CollatorICU requires it.
+    WTF::initializeThreading();
+
+    // set to impossible point so we always get the first mouse pos
+    m_lastMousePosition = WebPoint(-1, -1);
+
+    // the page will take ownership of the various clients
+    m_page.set(new Page(&m_chromeClientImpl,
+                        &m_contextMenuClientImpl,
+                        &m_editorClientImpl,
+                        &m_dragClientImpl,
+                        &m_inspectorClientImpl,
+                        0));
+
+    m_page->backForwardList()->setClient(&m_backForwardListClientImpl);
+    m_page->setGroupName(pageGroupName);
+}
+
+WebViewImpl::~WebViewImpl()
+{
+    ASSERT(!m_page);
+}
+
+RenderTheme* WebViewImpl::theme() const
+{
+    return m_page.get() ? m_page->theme() : RenderTheme::defaultTheme().get();
+}
+
+WebFrameImpl* WebViewImpl::mainFrameImpl()
+{
+    return m_page.get() ? WebFrameImpl::fromFrame(m_page->mainFrame()) : 0;
+}
+
+bool WebViewImpl::tabKeyCyclesThroughElements() const
+{
+    ASSERT(m_page.get());
+    return m_page->tabKeyCyclesThroughElements();
+}
+
+void WebViewImpl::setTabKeyCyclesThroughElements(bool value)
+{
+    if (m_page)
+        m_page->setTabKeyCyclesThroughElements(value);
+}
+
+void WebViewImpl::mouseMove(const WebMouseEvent& event)
+{
+    if (!mainFrameImpl() || !mainFrameImpl()->frameView())
+        return;
+
+    m_lastMousePosition = WebPoint(event.x, event.y);
+
+    // We call mouseMoved here instead of handleMouseMovedEvent because we need
+    // our ChromeClientImpl to receive changes to the mouse position and
+    // tooltip text, and mouseMoved handles all of that.
+    mainFrameImpl()->frame()->eventHandler()->mouseMoved(
+        PlatformMouseEventBuilder(mainFrameImpl()->frameView(), event));
+}
+
+void WebViewImpl::mouseLeave(const WebMouseEvent& event)
+{
+    // This event gets sent as the main frame is closing.  In that case, just
+    // ignore it.
+    if (!mainFrameImpl() || !mainFrameImpl()->frameView())
+        return;
+
+    m_client->setMouseOverURL(WebURL());
+
+    mainFrameImpl()->frame()->eventHandler()->handleMouseMoveEvent(
+        PlatformMouseEventBuilder(mainFrameImpl()->frameView(), event));
+}
+
+void WebViewImpl::mouseDown(const WebMouseEvent& event)
+{
+    if (!mainFrameImpl() || !mainFrameImpl()->frameView())
+        return;
+
+    m_lastMouseDownPoint = WebPoint(event.x, event.y);
+
+    // If a text field that has focus is clicked again, we should display the
+    // autocomplete popup.
+    RefPtr<Node> clickedNode;
+    if (event.button == WebMouseEvent::ButtonLeft) {
+        RefPtr<Node> focusedNode = focusedWebCoreNode();
+        if (focusedNode.get() && toHTMLInputElement(focusedNode.get())) {
+            IntPoint point(event.x, event.y);
+            point = m_page->mainFrame()->view()->windowToContents(point);
+            HitTestResult result(point);
+            result = m_page->mainFrame()->eventHandler()->hitTestResultAtPoint(point, false);
+            if (result.innerNonSharedNode() == focusedNode) {
+                // Already focused text field was clicked, let's remember this.  If
+                // focus has not changed after the mouse event is processed, we'll
+                // trigger the autocomplete.
+                clickedNode = focusedNode;
+            }
+        }
+    }
+
+    mainFrameImpl()->frame()->eventHandler()->handleMousePressEvent(
+        PlatformMouseEventBuilder(mainFrameImpl()->frameView(), event));
+
+    if (clickedNode.get() && clickedNode == focusedWebCoreNode()) {
+        // Focus has not changed, show the autocomplete popup.
+        static_cast<EditorClientImpl*>(m_page->editorClient())->
+            showFormAutofillForNode(clickedNode.get());
+    }
+
+    // Dispatch the contextmenu event regardless of if the click was swallowed.
+    // On Windows, we handle it on mouse up, not down.
+#if PLATFORM(DARWIN)
+    if (event.button == WebMouseEvent::ButtonRight
+        || (event.button == WebMouseEvent::ButtonLeft
+            && event.modifiers & WebMouseEvent::ControlKey))
+        mouseContextMenu(event);
+#elif PLATFORM(LINUX)
+    if (event.button == WebMouseEvent::ButtonRight)
+        mouseContextMenu(event);
+#endif
+}
+
+void WebViewImpl::mouseContextMenu(const WebMouseEvent& event)
+{
+    if (!mainFrameImpl() || !mainFrameImpl()->frameView())
+        return;
+
+    m_page->contextMenuController()->clearContextMenu();
+
+    PlatformMouseEventBuilder pme(mainFrameImpl()->frameView(), event);
+
+    // Find the right target frame. See issue 1186900.
+    HitTestResult result = hitTestResultForWindowPos(pme.pos());
+    Frame* targetFrame;
+    if (result.innerNonSharedNode())
+        targetFrame = result.innerNonSharedNode()->document()->frame();
+    else
+        targetFrame = m_page->focusController()->focusedOrMainFrame();
+
+#if PLATFORM(WIN_OS)
+    targetFrame->view()->setCursor(pointerCursor());
+#endif
+
+    m_contextMenuAllowed = true;
+    targetFrame->eventHandler()->sendContextMenuEvent(pme);
+    m_contextMenuAllowed = false;
+    // Actually showing the context menu is handled by the ContextMenuClient
+    // implementation...
+}
+
+void WebViewImpl::mouseUp(const WebMouseEvent& event)
+{
+    if (!mainFrameImpl() || !mainFrameImpl()->frameView())
+        return;
+
+#if PLATFORM(LINUX)
+    // If the event was a middle click, attempt to copy text into the focused
+    // frame. We execute this before we let the page have a go at the event
+    // because the page may change what is focused during in its event handler.
+    //
+    // This code is in the mouse up handler. There is some debate about putting
+    // this here, as opposed to the mouse down handler.
+    //   xterm: pastes on up.
+    //   GTK: pastes on down.
+    //   Firefox: pastes on up.
+    //   Midori: couldn't paste at all with 0.1.2
+    //
+    // There is something of a webcompat angle to this well, as highlighted by
+    // crbug.com/14608. Pages can clear text boxes 'onclick' and, if we paste on
+    // down then the text is pasted just before the onclick handler runs and
+    // clears the text box. So it's important this happens after the
+    // handleMouseReleaseEvent() earlier in this function
+    if (event.button == WebMouseEvent::ButtonMiddle) {
+        Frame* focused = focusedWebCoreFrame();
+        IntPoint clickPoint(m_lastMouseDownPoint.x, m_lastMouseDownPoint.y);
+        clickPoint = m_page->mainFrame()->view()->windowToContents(clickPoint);
+        HitTestResult hitTestResult =
+            focused->eventHandler()->hitTestResultAtPoint(clickPoint, false, false,
+                                                          ShouldHitTestScrollbars);
+        // We don't want to send a paste when middle clicking a scroll bar or a
+        // link (which will navigate later in the code).
+        if (!hitTestResult.scrollbar() && !hitTestResult.isLiveLink() && focused) {
+            Editor* editor = focused->editor();
+            Pasteboard* pasteboard = Pasteboard::generalPasteboard();
+            bool oldSelectionMode = pasteboard->isSelectionMode();
+            pasteboard->setSelectionMode(true);
+            editor->command(AtomicString("Paste")).execute();
+            pasteboard->setSelectionMode(oldSelectionMode);
+        }
+    }
+#endif
+
+    mouseCaptureLost();
+    mainFrameImpl()->frame()->eventHandler()->handleMouseReleaseEvent(
+        PlatformMouseEventBuilder(mainFrameImpl()->frameView(), event));
+
+#if PLATFORM(WIN_OS)
+    // Dispatch the contextmenu event regardless of if the click was swallowed.
+    // On Mac/Linux, we handle it on mouse down, not up.
+    if (event.button == WebMouseEvent::ButtonRight)
+        mouseContextMenu(event);
+#endif
+}
+
+void WebViewImpl::mouseWheel(const WebMouseWheelEvent& event)
+{
+    PlatformWheelEventBuilder platformEvent(mainFrameImpl()->frameView(), event);
+    mainFrameImpl()->frame()->eventHandler()->handleWheelEvent(platformEvent);
+}
+
+bool WebViewImpl::keyEvent(const WebKeyboardEvent& event)
+{
+    ASSERT((event.type == WebInputEvent::RawKeyDown)
+        || (event.type == WebInputEvent::KeyDown)
+        || (event.type == WebInputEvent::KeyUp));
+
+    // Please refer to the comments explaining the m_suppressNextKeypressEvent
+    // member.
+    // The m_suppressNextKeypressEvent is set if the KeyDown is handled by
+    // Webkit. A keyDown event is typically associated with a keyPress(char)
+    // event and a keyUp event. We reset this flag here as this is a new keyDown
+    // event.
+    m_suppressNextKeypressEvent = false;
+
+    // Give autocomplete a chance to consume the key events it is interested in.
+    if (autocompleteHandleKeyEvent(event))
+        return true;
+
+    Frame* frame = focusedWebCoreFrame();
+    if (!frame)
+        return false;
+
+    EventHandler* handler = frame->eventHandler();
+    if (!handler)
+        return keyEventDefault(event);
+
+#if PLATFORM(WIN_OS) || PLATFORM(LINUX)
+    if ((!event.modifiers && (event.windowsKeyCode == VKEY_APPS))
+        || ((event.modifiers == WebInputEvent::ShiftKey) && (event.windowsKeyCode == VKEY_F10))) {
+        sendContextMenuEvent(event);
+        return true;
+    }
+#endif
+
+    // It's not clear if we should continue after detecting a capslock keypress.
+    // I'll err on the side of continuing, which is the pre-existing behaviour.
+    if (event.windowsKeyCode == VKEY_CAPITAL)
+        handler->capsLockStateMayHaveChanged();
+
+    PlatformKeyboardEventBuilder evt(event);
+
+    if (handler->keyEvent(evt)) {
+        if (WebInputEvent::RawKeyDown == event.type)
+            m_suppressNextKeypressEvent = true;
+        return true;
+    }
+
+    return keyEventDefault(event);
+}
+
+bool WebViewImpl::autocompleteHandleKeyEvent(const WebKeyboardEvent& event)
+{
+    if (!m_autocompletePopupShowing
+        // Home and End should be left to the text field to process.
+        || event.windowsKeyCode == VKEY_HOME
+        || event.windowsKeyCode == VKEY_END)
+      return false;
+
+    // Pressing delete triggers the removal of the selected suggestion from the DB.
+    if (event.windowsKeyCode == VKEY_DELETE
+        && m_autocompletePopup->selectedIndex() != -1) {
+        Node* node = focusedWebCoreNode();
+        if (!node || (node->nodeType() != Node::ELEMENT_NODE)) {
+            ASSERT_NOT_REACHED();
+            return false;
+        }
+        Element* element = static_cast<Element*>(node);
+        if (!element->hasLocalName(HTMLNames::inputTag)) {
+            ASSERT_NOT_REACHED();
+            return false;
+        }
+
+        int selectedIndex = m_autocompletePopup->selectedIndex();
+        HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
+        WebString name = inputElement->name();
+        WebString value = m_autocompletePopupClient->itemText(selectedIndex);
+        m_client->removeAutofillSuggestions(name, value);
+        // Update the entries in the currently showing popup to reflect the
+        // deletion.
+        m_autocompletePopupClient->removeItemAtIndex(selectedIndex);
+        refreshAutofillPopup();
+        return false;
+    }
+
+    if (!m_autocompletePopup->isInterestedInEventForKey(event.windowsKeyCode))
+        return false;
+
+    if (m_autocompletePopup->handleKeyEvent(PlatformKeyboardEventBuilder(event))) {
+        // We need to ignore the next Char event after this otherwise pressing
+        // enter when selecting an item in the menu will go to the page.
+        if (WebInputEvent::RawKeyDown == event.type)
+            m_suppressNextKeypressEvent = true;
+        return true;
+    }
+
+    return false;
+}
+
+bool WebViewImpl::charEvent(const WebKeyboardEvent& event)
+{
+    ASSERT(event.type == WebInputEvent::Char);
+
+    // Please refer to the comments explaining the m_suppressNextKeypressEvent
+    // member.  The m_suppressNextKeypressEvent is set if the KeyDown is
+    // handled by Webkit. A keyDown event is typically associated with a
+    // keyPress(char) event and a keyUp event. We reset this flag here as it
+    // only applies to the current keyPress event.
+    bool suppress = m_suppressNextKeypressEvent;
+    m_suppressNextKeypressEvent = false;
+
+    Frame* frame = focusedWebCoreFrame();
+    if (!frame)
+        return suppress;
+
+    EventHandler* handler = frame->eventHandler();
+    if (!handler)
+        return suppress || keyEventDefault(event);
+
+    PlatformKeyboardEventBuilder evt(event);
+    if (!evt.isCharacterKey())
+        return true;
+
+    // Accesskeys are triggered by char events and can't be suppressed.
+    if (handler->handleAccessKey(evt))
+        return true;
+
+    // Safari 3.1 does not pass off windows system key messages (WM_SYSCHAR) to
+    // the eventHandler::keyEvent. We mimic this behavior on all platforms since
+    // for now we are converting other platform's key events to windows key
+    // events.
+    if (evt.isSystemKey())
+        return false;
+
+    if (!suppress && !handler->keyEvent(evt))
+        return keyEventDefault(event);
+
+    return true;
+}
+
+// The WebViewImpl::SendContextMenuEvent function is based on the Webkit
+// function
+// bool WebView::handleContextMenuEvent(WPARAM wParam, LPARAM lParam) in
+// webkit\webkit\win\WebView.cpp. The only significant change in this
+// function is the code to convert from a Keyboard event to the Right
+// Mouse button up event.
+//
+// This function is an ugly copy/paste and should be cleaned up when the
+// WebKitWin version is cleaned: https://bugs.webkit.org/show_bug.cgi?id=20438
+#if PLATFORM(WIN_OS) || PLATFORM(LINUX)
+// FIXME: implement on Mac
+bool WebViewImpl::sendContextMenuEvent(const WebKeyboardEvent& event)
+{
+    static const int kContextMenuMargin = 1;
+    Frame* mainFrameImpl = page()->mainFrame();
+    FrameView* view = mainFrameImpl->view();
+    if (!view)
+        return false;
+
+    IntPoint coords(-1, -1);
+#if PLATFORM(WIN_OS)
+    int rightAligned = ::GetSystemMetrics(SM_MENUDROPALIGNMENT);
+#else
+    int rightAligned = 0;
+#endif
+    IntPoint location;
+
+    // The context menu event was generated from the keyboard, so show the
+    // context menu by the current selection.
+    Position start = mainFrameImpl->selection()->selection().start();
+    Position end = mainFrameImpl->selection()->selection().end();
+
+    Frame* focusedFrame = page()->focusController()->focusedOrMainFrame();
+    Node* focusedNode = focusedFrame->document()->focusedNode();
+
+    if (start.node() && end.node()) {
+        RenderObject* renderer = start.node()->renderer();
+        if (!renderer)
+            return false;
+
+        RefPtr<Range> selection = mainFrameImpl->selection()->toNormalizedRange();
+        IntRect firstRect = mainFrameImpl->firstRectForRange(selection.get());
+
+        int x = rightAligned ? firstRect.right() : firstRect.x();
+        location = IntPoint(x, firstRect.bottom());
+    } else if (focusedNode)
+        location = focusedNode->getRect().bottomLeft();
+    else {
+        location = IntPoint(
+            rightAligned ? view->contentsWidth() - kContextMenuMargin : kContextMenuMargin,
+            kContextMenuMargin);
+    }
+
+    location = view->contentsToWindow(location);
+    // FIXME: The IntSize(0, -1) is a hack to get the hit-testing to result in
+    // the selected element. Ideally we'd have the position of a context menu
+    // event be separate from its target node.
+    coords = location + IntSize(0, -1);
+
+    // The contextMenuController() holds onto the last context menu that was
+    // popped up on the page until a new one is created. We need to clear
+    // this menu before propagating the event through the DOM so that we can
+    // detect if we create a new menu for this event, since we won't create
+    // a new menu if the DOM swallows the event and the defaultEventHandler does
+    // not run.
+    page()->contextMenuController()->clearContextMenu();
+
+    focusedFrame->view()->setCursor(pointerCursor());
+    WebMouseEvent mouseEvent;
+    mouseEvent.button = WebMouseEvent::ButtonRight;
+    mouseEvent.x = coords.x();
+    mouseEvent.y = coords.y();
+    mouseEvent.type = WebInputEvent::MouseUp;
+
+    PlatformMouseEventBuilder platformEvent(view, mouseEvent);
+
+    m_contextMenuAllowed = true;
+    bool handled = focusedFrame->eventHandler()->sendContextMenuEvent(platformEvent);
+    m_contextMenuAllowed = false;
+    return handled;
+}
+#endif
+
+bool WebViewImpl::keyEventDefault(const WebKeyboardEvent& event)
+{
+    Frame* frame = focusedWebCoreFrame();
+    if (!frame)
+        return false;
+
+    switch (event.type) {
+    case WebInputEvent::Char:
+        if (event.windowsKeyCode == VKEY_SPACE) {
+            int keyCode = ((event.modifiers & WebInputEvent::ShiftKey) ? VKEY_PRIOR : VKEY_NEXT);
+            return scrollViewWithKeyboard(keyCode, event.modifiers);
+        }
+        break;
+    case WebInputEvent::RawKeyDown:
+        if (event.modifiers == WebInputEvent::ControlKey) {
+            switch (event.windowsKeyCode) {
+            case 'A':
+                focusedFrame()->executeCommand(WebString::fromUTF8("SelectAll"));
+                return true;
+            case VKEY_INSERT:
+            case 'C':
+                focusedFrame()->executeCommand(WebString::fromUTF8("Copy"));
+                return true;
+            // Match FF behavior in the sense that Ctrl+home/end are the only Ctrl
+            // key combinations which affect scrolling. Safari is buggy in the
+            // sense that it scrolls the page for all Ctrl+scrolling key
+            // combinations. For e.g. Ctrl+pgup/pgdn/up/down, etc.
+            case VKEY_HOME:
+            case VKEY_END:
+                break;
+            default:
+                return false;
+            }
+        }
+        if (!event.isSystemKey && !(event.modifiers & WebInputEvent::ShiftKey))
+            return scrollViewWithKeyboard(event.windowsKeyCode, event.modifiers);
+        break;
+    default:
+        break;
+    }
+    return false;
+}
+
+bool WebViewImpl::scrollViewWithKeyboard(int keyCode, int modifiers)
+{
+    ScrollDirection scrollDirection;
+    ScrollGranularity scrollGranularity;
+
+    switch (keyCode) {
+    case VKEY_LEFT:
+        scrollDirection = ScrollLeft;
+        scrollGranularity = ScrollByLine;
+        break;
+    case VKEY_RIGHT:
+        scrollDirection = ScrollRight;
+        scrollGranularity = ScrollByLine;
+        break;
+    case VKEY_UP:
+        scrollDirection = ScrollUp;
+        scrollGranularity = ScrollByLine;
+        break;
+    case VKEY_DOWN:
+        scrollDirection = ScrollDown;
+        scrollGranularity = ScrollByLine;
+        break;
+    case VKEY_HOME:
+        scrollDirection = ScrollUp;
+        scrollGranularity = ScrollByDocument;
+        break;
+    case VKEY_END:
+        scrollDirection = ScrollDown;
+        scrollGranularity = ScrollByDocument;
+        break;
+    case VKEY_PRIOR:  // page up
+        scrollDirection = ScrollUp;
+        scrollGranularity = ScrollByPage;
+        break;
+    case VKEY_NEXT:  // page down
+        scrollDirection = ScrollDown;
+        scrollGranularity = ScrollByPage;
+        break;
+    default:
+        return false;
+    }
+
+    return propagateScroll(scrollDirection, scrollGranularity);
+}
+
+bool WebViewImpl::propagateScroll(ScrollDirection scrollDirection,
+                                  ScrollGranularity scrollGranularity)
+{
+    Frame* frame = focusedWebCoreFrame();
+    if (!frame)
+        return false;
+
+    bool scrollHandled =
+        frame->eventHandler()->scrollOverflow(scrollDirection,
+                                              scrollGranularity);
+    Frame* currentFrame = frame;
+    while (!scrollHandled && currentFrame) {
+        scrollHandled = currentFrame->view()->scroll(scrollDirection,
+                                                     scrollGranularity);
+        currentFrame = currentFrame->tree()->parent();
+    }
+    return scrollHandled;
+}
+
+Frame* WebViewImpl::focusedWebCoreFrame()
+{
+    return m_page.get() ? m_page->focusController()->focusedOrMainFrame() : 0;
+}
+
+WebViewImpl* WebViewImpl::fromPage(Page* page)
+{
+    if (!page)
+        return 0;
+
+    return static_cast<ChromeClientImpl*>(page->chrome()->client())->webView();
+}
+
+// WebWidget ------------------------------------------------------------------
+
+void WebViewImpl::close()
+{
+    RefPtr<WebFrameImpl> mainFrameImpl;
+
+    if (m_page.get()) {
+        // Initiate shutdown for the entire frameset.  This will cause a lot of
+        // notifications to be sent.
+        if (m_page->mainFrame()) {
+            mainFrameImpl = WebFrameImpl::fromFrame(m_page->mainFrame());
+            m_page->mainFrame()->loader()->frameDetached();
+        }
+        m_page.clear();
+    }
+
+    // Should happen after m_page.clear().
+    if (m_devToolsAgent.get())
+        m_devToolsAgent.clear();
+
+    // Reset the delegate to prevent notifications being sent as we're being
+    // deleted.
+    m_client = 0;
+
+    deref();  // Balances ref() acquired in WebView::create
+}
+
+void WebViewImpl::resize(const WebSize& newSize)
+{
+    if (m_size == newSize)
+        return;
+    m_size = newSize;
+
+    if (mainFrameImpl()->frameView()) {
+        mainFrameImpl()->frameView()->resize(m_size.width, m_size.height);
+        mainFrameImpl()->frame()->eventHandler()->sendResizeEvent();
+    }
+
+    if (m_client) {
+        WebRect damagedRect(0, 0, m_size.width, m_size.height);
+        m_client->didInvalidateRect(damagedRect);
+    }
+}
+
+void WebViewImpl::layout()
+{
+    WebFrameImpl* webframe = mainFrameImpl();
+    if (webframe) {
+        // In order for our child HWNDs (NativeWindowWidgets) to update properly,
+        // they need to be told that we are updating the screen.  The problem is
+        // that the native widgets need to recalculate their clip region and not
+        // overlap any of our non-native widgets.  To force the resizing, call
+        // setFrameRect().  This will be a quick operation for most frames, but
+        // the NativeWindowWidgets will update a proper clipping region.
+        FrameView* view = webframe->frameView();
+        if (view)
+            view->setFrameRect(view->frameRect());
+
+        // setFrameRect may have the side-effect of causing existing page
+        // layout to be invalidated, so layout needs to be called last.
+
+        webframe->layout();
+    }
+}
+
+void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect)
+{
+    WebFrameImpl* webframe = mainFrameImpl();
+    if (webframe)
+        webframe->paint(canvas, rect);
+}
+
+// FIXME: m_currentInputEvent should be removed once ChromeClient::show() can
+// get the current-event information from WebCore.
+const WebInputEvent* WebViewImpl::m_currentInputEvent = 0;
+
+bool WebViewImpl::handleInputEvent(const WebInputEvent& inputEvent)
+{
+    // If we've started a drag and drop operation, ignore input events until
+    // we're done.
+    if (m_doingDragAndDrop)
+        return true;
+
+    if (m_ignoreInputEvents)
+        return true;
+
+    // FIXME: Remove m_currentInputEvent.
+    // This only exists to allow ChromeClient::show() to know which mouse button
+    // triggered a window.open event.
+    // Safari must perform a similar hack, ours is in our WebKit glue layer
+    // theirs is in the application.  This should go when WebCore can be fixed
+    // to pass more event information to ChromeClient::show()
+    m_currentInputEvent = &inputEvent;
+
+    bool handled = true;
+
+    // FIXME: WebKit seems to always return false on mouse events processing
+    // methods. For now we'll assume it has processed them (as we are only
+    // interested in whether keyboard events are processed).
+    switch (inputEvent.type) {
+    case WebInputEvent::MouseMove:
+        mouseMove(*static_cast<const WebMouseEvent*>(&inputEvent));
+        break;
+
+    case WebInputEvent::MouseLeave:
+        mouseLeave(*static_cast<const WebMouseEvent*>(&inputEvent));
+        break;
+
+    case WebInputEvent::MouseWheel:
+        mouseWheel(*static_cast<const WebMouseWheelEvent*>(&inputEvent));
+        break;
+
+    case WebInputEvent::MouseDown:
+        mouseDown(*static_cast<const WebMouseEvent*>(&inputEvent));
+        break;
+
+    case WebInputEvent::MouseUp:
+        mouseUp(*static_cast<const WebMouseEvent*>(&inputEvent));
+        break;
+
+    case WebInputEvent::RawKeyDown:
+    case WebInputEvent::KeyDown:
+    case WebInputEvent::KeyUp:
+        handled = keyEvent(*static_cast<const WebKeyboardEvent*>(&inputEvent));
+        break;
+
+    case WebInputEvent::Char:
+        handled = charEvent(*static_cast<const WebKeyboardEvent*>(&inputEvent));
+        break;
+
+    default:
+        handled = false;
+    }
+
+    m_currentInputEvent = 0;
+
+    return handled;
+}
+
+void WebViewImpl::mouseCaptureLost()
+{
+}
+
+void WebViewImpl::setFocus(bool enable)
+{
+    m_page->focusController()->setFocused(enable);
+    if (enable) {
+        // Note that we don't call setActive() when disabled as this cause extra
+        // focus/blur events to be dispatched.
+        m_page->focusController()->setActive(true);
+        RefPtr<Frame> focusedFrame = m_page->focusController()->focusedFrame();
+        if (focusedFrame) {
+            Node* focusedNode = focusedFrame->document()->focusedNode();
+            if (focusedNode && focusedNode->isElementNode()
+                && focusedFrame->selection()->selection().isNone()) {
+                // If the selection was cleared while the WebView was not
+                // focused, then the focus element shows with a focus ring but
+                // no caret and does respond to keyboard inputs.
+                Element* element = static_cast<Element*>(focusedNode);
+                if (element->isTextFormControl())
+                    element->updateFocusAppearance(true);
+                else if (focusedNode->isContentEditable()) {
+                    // updateFocusAppearance() selects all the text of
+                    // contentseditable DIVs. So we set the selection explicitly
+                    // instead. Note that this has the side effect of moving the
+                    // caret back to the beginning of the text.
+                    Position position(focusedNode, 0,
+                                      Position::PositionIsOffsetInAnchor);
+                    focusedFrame->selection()->setSelection(
+                        VisibleSelection(position, SEL_DEFAULT_AFFINITY));
+                }
+            }
+        }
+        m_imeAcceptEvents = true;
+    } else {
+        hideAutoCompletePopup();
+
+        // Clear focus on the currently focused frame if any.
+        if (!m_page.get())
+            return;
+
+        Frame* frame = m_page->mainFrame();
+        if (!frame)
+            return;
+
+        RefPtr<Frame> focusedFrame = m_page->focusController()->focusedFrame();
+        if (focusedFrame.get()) {
+            // Finish an ongoing composition to delete the composition node.
+            Editor* editor = focusedFrame->editor();
+            if (editor && editor->hasComposition())
+                editor->confirmComposition();
+            m_imeAcceptEvents = false;
+        }
+    }
+}
+
+bool WebViewImpl::handleCompositionEvent(WebCompositionCommand command,
+                                         int cursorPosition,
+                                         int targetStart,
+                                         int targetEnd,
+                                         const WebString& imeString)
+{
+    Frame* focused = focusedWebCoreFrame();
+    if (!focused || !m_imeAcceptEvents)
+        return false;
+    Editor* editor = focused->editor();
+    if (!editor)
+        return false;
+    if (!editor->canEdit()) {
+        // The input focus has been moved to another WebWidget object.
+        // We should use this |editor| object only to complete the ongoing
+        // composition.
+        if (!editor->hasComposition())
+            return false;
+    }
+
+    // We should verify the parent node of this IME composition node are
+    // editable because JavaScript may delete a parent node of the composition
+    // node. In this case, WebKit crashes while deleting texts from the parent
+    // node, which doesn't exist any longer.
+    PassRefPtr<Range> range = editor->compositionRange();
+    if (range) {
+        const Node* node = range->startPosition().node();
+        if (!node || !node->isContentEditable())
+            return false;
+    }
+
+    if (command == WebCompositionCommandDiscard) {
+        // A browser process sent an IPC message which does not contain a valid
+        // string, which means an ongoing composition has been canceled.
+        // If the ongoing composition has been canceled, replace the ongoing
+        // composition string with an empty string and complete it.
+        String emptyString;
+        Vector<CompositionUnderline> emptyUnderlines;
+        editor->setComposition(emptyString, emptyUnderlines, 0, 0);
+    } else {
+        // A browser process sent an IPC message which contains a string to be
+        // displayed in this Editor object.
+        // To display the given string, set the given string to the
+        // m_compositionNode member of this Editor object and display it.
+        if (targetStart < 0)
+            targetStart = 0;
+        if (targetEnd < 0)
+            targetEnd = static_cast<int>(imeString.length());
+        String compositionString(imeString);
+        // Create custom underlines.
+        // To emphasize the selection, the selected region uses a solid black
+        // for its underline while other regions uses a pale gray for theirs.
+        Vector<CompositionUnderline> underlines(3);
+        underlines[0].startOffset = 0;
+        underlines[0].endOffset = targetStart;
+        underlines[0].thick = true;
+        underlines[0].color.setRGB(0xd3, 0xd3, 0xd3);
+        underlines[1].startOffset = targetStart;
+        underlines[1].endOffset = targetEnd;
+        underlines[1].thick = true;
+        underlines[1].color.setRGB(0x00, 0x00, 0x00);
+        underlines[2].startOffset = targetEnd;
+        underlines[2].endOffset = static_cast<int>(imeString.length());
+        underlines[2].thick = true;
+        underlines[2].color.setRGB(0xd3, 0xd3, 0xd3);
+        // When we use custom underlines, WebKit ("InlineTextBox.cpp" Line 282)
+        // prevents from writing a text in between 'selectionStart' and
+        // 'selectionEnd' somehow.
+        // Therefore, we use the 'cursorPosition' for these arguments so that
+        // there are not any characters in the above region.
+        editor->setComposition(compositionString, underlines,
+                               cursorPosition, cursorPosition);
+        // The given string is a result string, which means the ongoing
+        // composition has been completed. I have to call the
+        // Editor::confirmCompletion() and complete this composition.
+        if (command == WebCompositionCommandConfirm)
+            editor->confirmComposition();
+    }
+
+    return editor->hasComposition();
+}
+
+bool WebViewImpl::queryCompositionStatus(bool* enableIME, WebRect* caretRect)
+{
+    // Store whether the selected node needs IME and the caret rectangle.
+    // This process consists of the following four steps:
+    //  1. Retrieve the selection controller of the focused frame;
+    //  2. Retrieve the caret rectangle from the controller;
+    //  3. Convert the rectangle, which is relative to the parent view, to the
+    //     one relative to the client window, and;
+    //  4. Store the converted rectangle.
+    const Frame* focused = focusedWebCoreFrame();
+    if (!focused)
+        return false;
+
+    const Editor* editor = focused->editor();
+    if (!editor || !editor->canEdit())
+        return false;
+
+    SelectionController* controller = focused->selection();
+    if (!controller)
+        return false;
+
+    const Node* node = controller->start().node();
+    if (!node)
+        return false;
+
+    *enableIME = node->shouldUseInputMethod() && !controller->isInPasswordField();
+    const FrameView* view = node->document()->view();
+    if (!view)
+        return false;
+
+    *caretRect = view->contentsToWindow(controller->absoluteCaretBounds());
+    return true;
+}
+
+void WebViewImpl::setTextDirection(WebTextDirection direction)
+{
+    // The Editor::setBaseWritingDirection() function checks if we can change
+    // the text direction of the selected node and updates its DOM "dir"
+    // attribute and its CSS "direction" property.
+    // So, we just call the function as Safari does.
+    const Frame* focused = focusedWebCoreFrame();
+    if (!focused)
+        return;
+
+    Editor* editor = focused->editor();
+    if (!editor || !editor->canEdit())
+        return;
+
+    switch (direction) {
+    case WebTextDirectionDefault:
+        editor->setBaseWritingDirection(NaturalWritingDirection);
+        break;
+
+    case WebTextDirectionLeftToRight:
+        editor->setBaseWritingDirection(LeftToRightWritingDirection);
+        break;
+
+    case WebTextDirectionRightToLeft:
+        editor->setBaseWritingDirection(RightToLeftWritingDirection);
+        break;
+
+    default:
+        notImplemented();
+        break;
+    }
+}
+
+// WebView --------------------------------------------------------------------
+
+WebSettings* WebViewImpl::settings()
+{
+    if (!m_webSettings.get())
+        m_webSettings.set(new WebSettingsImpl(m_page->settings()));
+    ASSERT(m_webSettings.get());
+    return m_webSettings.get();
+}
+
+WebString WebViewImpl::pageEncoding() const
+{
+    if (!m_page.get())
+        return WebString();
+
+    return m_page->mainFrame()->loader()->encoding();
+}
+
+void WebViewImpl::setPageEncoding(const WebString& encodingName)
+{
+    if (!m_page.get())
+        return;
+
+    // Only change override encoding, don't change default encoding.
+    // Note that the new encoding must be 0 if it isn't supposed to be set.
+    String newEncodingName;
+    if (!encodingName.isEmpty())
+        newEncodingName = encodingName;
+    m_page->mainFrame()->loader()->reloadWithOverrideEncoding(newEncodingName);
+}
+
+bool WebViewImpl::dispatchBeforeUnloadEvent()
+{
+    // FIXME: This should really cause a recursive depth-first walk of all
+    // frames in the tree, calling each frame's onbeforeunload.  At the moment,
+    // we're consistent with Safari 3.1, not IE/FF.
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return true;
+
+    return frame->shouldClose();
+}
+
+void WebViewImpl::dispatchUnloadEvent()
+{
+    // Run unload handlers.
+    m_page->mainFrame()->loader()->closeURL();
+}
+
+WebFrame* WebViewImpl::mainFrame()
+{
+    return mainFrameImpl();
+}
+
+WebFrame* WebViewImpl::findFrameByName(
+    const WebString& name, WebFrame* relativeToFrame)
+{
+    if (!relativeToFrame)
+        relativeToFrame = mainFrame();
+    Frame* frame = static_cast<WebFrameImpl*>(relativeToFrame)->frame();
+    frame = frame->tree()->find(name);
+    return WebFrameImpl::fromFrame(frame);
+}
+
+WebFrame* WebViewImpl::focusedFrame()
+{
+    return WebFrameImpl::fromFrame(focusedWebCoreFrame());
+}
+
+void WebViewImpl::setFocusedFrame(WebFrame* frame)
+{
+    if (!frame) {
+        // Clears the focused frame if any.
+        Frame* frame = focusedWebCoreFrame();
+        if (frame)
+            frame->selection()->setFocused(false);
+        return;
+    }
+    WebFrameImpl* frameImpl = static_cast<WebFrameImpl*>(frame);
+    Frame* webcoreFrame = frameImpl->frame();
+    webcoreFrame->page()->focusController()->setFocusedFrame(webcoreFrame);
+}
+
+void WebViewImpl::setInitialFocus(bool reverse)
+{
+    if (!m_page.get())
+        return;
+
+    // Since we don't have a keyboard event, we'll create one.
+    WebKeyboardEvent keyboardEvent;
+    keyboardEvent.type = WebInputEvent::RawKeyDown;
+    if (reverse)
+        keyboardEvent.modifiers = WebInputEvent::ShiftKey;
+
+    // VK_TAB which is only defined on Windows.
+    keyboardEvent.windowsKeyCode = 0x09;
+    PlatformKeyboardEventBuilder platformEvent(keyboardEvent);
+    RefPtr<KeyboardEvent> webkitEvent = KeyboardEvent::create(platformEvent, 0);
+    page()->focusController()->setInitialFocus(
+        reverse ? FocusDirectionBackward : FocusDirectionForward,
+        webkitEvent.get());
+}
+
+void WebViewImpl::clearFocusedNode()
+{
+    if (!m_page.get())
+        return;
+
+    RefPtr<Frame> frame = m_page->mainFrame();
+    if (!frame.get())
+        return;
+
+    RefPtr<Document> document = frame->document();
+    if (!document.get())
+        return;
+
+    RefPtr<Node> oldFocusedNode = document->focusedNode();
+
+    // Clear the focused node.
+    document->setFocusedNode(0);
+
+    if (!oldFocusedNode.get())
+        return;
+
+    // If a text field has focus, we need to make sure the selection controller
+    // knows to remove selection from it. Otherwise, the text field is still
+    // processing keyboard events even though focus has been moved to the page and
+    // keystrokes get eaten as a result.
+    if (oldFocusedNode->hasTagName(HTMLNames::textareaTag)
+        || (oldFocusedNode->hasTagName(HTMLNames::inputTag)
+            && static_cast<HTMLInputElement*>(oldFocusedNode.get())->isTextField())) {
+        // Clear the selection.
+        SelectionController* selection = frame->selection();
+        selection->clear();
+    }
+}
+
+int WebViewImpl::zoomLevel()
+{
+    return m_zoomLevel;
+}
+
+int WebViewImpl::setZoomLevel(bool textOnly, int zoomLevel)
+{
+    float zoomFactor = static_cast<float>(
+        std::max(std::min(std::pow(textSizeMultiplierRatio, zoomLevel),
+                          maxTextSizeMultiplier),
+                 minTextSizeMultiplier));
+    Frame* frame = mainFrameImpl()->frame();
+    if (zoomFactor != frame->zoomFactor()) {
+        m_zoomLevel = zoomLevel;
+        frame->setZoomFactor(zoomFactor, textOnly);
+    }
+    return m_zoomLevel;
+}
+
+void WebViewImpl::performMediaPlayerAction(const WebMediaPlayerAction& action,
+                                           const WebPoint& location)
+{
+    HitTestResult result =
+        hitTestResultForWindowPos(location);
+    RefPtr<Node> node = result.innerNonSharedNode();
+    if (!node->hasTagName(HTMLNames::videoTag) && !node->hasTagName(HTMLNames::audioTag))
+      return;
+
+    RefPtr<HTMLMediaElement> mediaElement =
+        static_pointer_cast<HTMLMediaElement>(node);
+    switch (action.type) {
+    case WebMediaPlayerAction::Play:
+        if (action.enable)
+            mediaElement->play();
+        else
+            mediaElement->pause();
+        break;
+    case WebMediaPlayerAction::Mute:
+        mediaElement->setMuted(action.enable);
+        break;
+    case WebMediaPlayerAction::Loop:
+        mediaElement->setLoop(action.enable);
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+}
+
+void WebViewImpl::copyImageAt(const WebPoint& point)
+{
+    if (!m_page.get())
+        return;
+
+    HitTestResult result = hitTestResultForWindowPos(point);
+
+    if (result.absoluteImageURL().isEmpty()) {
+        // There isn't actually an image at these coordinates.  Might be because
+        // the window scrolled while the context menu was open or because the page
+        // changed itself between when we thought there was an image here and when
+        // we actually tried to retreive the image.
+        //
+        // FIXME: implement a cache of the most recent HitTestResult to avoid having
+        //        to do two hit tests.
+        return;
+    }
+
+    m_page->mainFrame()->editor()->copyImage(result);
+}
+
+void WebViewImpl::dragSourceEndedAt(
+    const WebPoint& clientPoint,
+    const WebPoint& screenPoint,
+    WebDragOperation operation)
+{
+    PlatformMouseEvent pme(clientPoint,
+                           screenPoint,
+                           LeftButton, MouseEventMoved, 0, false, false, false,
+                           false, 0);
+    m_page->mainFrame()->eventHandler()->dragSourceEndedAt(pme,
+        static_cast<DragOperation>(operation));
+}
+
+void WebViewImpl::dragSourceSystemDragEnded()
+{
+    // It's possible for us to get this callback while not doing a drag if
+    // it's from a previous page that got unloaded.
+    if (m_doingDragAndDrop) {
+        m_page->dragController()->dragEnded();
+        m_doingDragAndDrop = false;
+    }
+}
+
+WebDragOperation WebViewImpl::dragTargetDragEnter(
+    const WebDragData& webDragData, int identity,
+    const WebPoint& clientPoint,
+    const WebPoint& screenPoint,
+    WebDragOperationsMask operationsAllowed)
+{
+    ASSERT(!m_currentDragData.get());
+
+    m_currentDragData = webDragData;
+    m_dragIdentity = identity;
+    m_operationsAllowed = operationsAllowed;
+
+    DragData dragData(
+        m_currentDragData.get(),
+        clientPoint,
+        screenPoint,
+        static_cast<DragOperation>(operationsAllowed));
+
+    m_dropEffect = DropEffectDefault;
+    m_dragTargetDispatch = true;
+    DragOperation effect = m_page->dragController()->dragEntered(&dragData);
+    // Mask the operation against the drag source's allowed operations.
+    if ((effect & dragData.draggingSourceOperationMask()) != effect)
+        effect = DragOperationNone;
+    m_dragTargetDispatch = false;
+
+    if (m_dropEffect != DropEffectDefault) {
+        m_dragOperation = (m_dropEffect != DropEffectNone) ? WebDragOperationCopy
+                                                           : WebDragOperationNone;
+    } else
+        m_dragOperation = static_cast<WebDragOperation>(effect);
+    return m_dragOperation;
+}
+
+WebDragOperation WebViewImpl::dragTargetDragOver(
+    const WebPoint& clientPoint,
+    const WebPoint& screenPoint,
+    WebDragOperationsMask operationsAllowed)
+{
+    ASSERT(m_currentDragData.get());
+
+    m_operationsAllowed = operationsAllowed;
+    DragData dragData(
+        m_currentDragData.get(),
+        clientPoint,
+        screenPoint,
+        static_cast<DragOperation>(operationsAllowed));
+
+    m_dropEffect = DropEffectDefault;
+    m_dragTargetDispatch = true;
+    DragOperation effect = m_page->dragController()->dragUpdated(&dragData);
+    // Mask the operation against the drag source's allowed operations.
+    if ((effect & dragData.draggingSourceOperationMask()) != effect)
+        effect = DragOperationNone;
+    m_dragTargetDispatch = false;
+
+    if (m_dropEffect != DropEffectDefault) {
+        m_dragOperation = (m_dropEffect != DropEffectNone) ? WebDragOperationCopy
+                                                           : WebDragOperationNone;
+    } else
+        m_dragOperation = static_cast<WebDragOperation>(effect);
+    return m_dragOperation;
+}
+
+void WebViewImpl::dragTargetDragLeave()
+{
+    ASSERT(m_currentDragData.get());
+
+    DragData dragData(
+        m_currentDragData.get(),
+        IntPoint(),
+        IntPoint(),
+        static_cast<DragOperation>(m_operationsAllowed));
+
+    m_dragTargetDispatch = true;
+    m_page->dragController()->dragExited(&dragData);
+    m_dragTargetDispatch = false;
+
+    m_currentDragData = 0;
+    m_dropEffect = DropEffectDefault;
+    m_dragOperation = WebDragOperationNone;
+    m_dragIdentity = 0;
+}
+
+void WebViewImpl::dragTargetDrop(const WebPoint& clientPoint,
+                                 const WebPoint& screenPoint)
+{
+    ASSERT(m_currentDragData.get());
+
+    // If this webview transitions from the "drop accepting" state to the "not
+    // accepting" state, then our IPC message reply indicating that may be in-
+    // flight, or else delayed by javascript processing in this webview.  If a
+    // drop happens before our IPC reply has reached the browser process, then
+    // the browser forwards the drop to this webview.  So only allow a drop to
+    // proceed if our webview m_dragOperation state is not DragOperationNone.
+
+    if (m_dragOperation == WebDragOperationNone) { // IPC RACE CONDITION: do not allow this drop.
+        dragTargetDragLeave();
+        return;
+    }
+
+    DragData dragData(
+        m_currentDragData.get(),
+        clientPoint,
+        screenPoint,
+        static_cast<DragOperation>(m_operationsAllowed));
+
+    m_dragTargetDispatch = true;
+    m_page->dragController()->performDrag(&dragData);
+    m_dragTargetDispatch = false;
+
+    m_currentDragData = 0;
+    m_dropEffect = DropEffectDefault;
+    m_dragOperation = WebDragOperationNone;
+    m_dragIdentity = 0;
+}
+
+int WebViewImpl::dragIdentity()
+{
+    if (m_dragTargetDispatch)
+        return m_dragIdentity;
+    return 0;
+}
+
+unsigned long WebViewImpl::createUniqueIdentifierForRequest() {
+    if (m_page)
+        return m_page->progress()->createUniqueIdentifier();
+    return 0;
+}
+
+void WebViewImpl::inspectElementAt(const WebPoint& point)
+{
+    if (!m_page.get())
+        return;
+
+    if (point.x == -1 || point.y == -1)
+        m_page->inspectorController()->inspect(0);
+    else {
+        HitTestResult result = hitTestResultForWindowPos(point);
+
+        if (!result.innerNonSharedNode())
+            return;
+
+        m_page->inspectorController()->inspect(result.innerNonSharedNode());
+    }
+}
+
+WebString WebViewImpl::inspectorSettings() const
+{
+    return m_inspectorSettings;
+}
+
+void WebViewImpl::setInspectorSettings(const WebString& settings)
+{
+    m_inspectorSettings = settings;
+}
+
+WebDevToolsAgent* WebViewImpl::devToolsAgent()
+{
+    return m_devToolsAgent.get();
+}
+
+void WebViewImpl::setDevToolsAgent(WebDevToolsAgent* devToolsAgent)
+{
+    ASSERT(!m_devToolsAgent.get()); // May only set once!
+    m_devToolsAgent.set(static_cast<WebDevToolsAgentPrivate*>(devToolsAgent));
+}
+
+WebAccessibilityObject WebViewImpl::accessibilityObject()
+{
+    if (!mainFrameImpl())
+        return WebAccessibilityObject();
+
+    Document* document = mainFrameImpl()->frame()->document();
+    return WebAccessibilityObject(
+        document->axObjectCache()->getOrCreate(document->renderer()));
+}
+
+void WebViewImpl::applyAutofillSuggestions(
+    const WebNode& node,
+    const WebVector<WebString>& suggestions,
+    int defaultSuggestionIndex)
+{
+    if (!m_page.get() || suggestions.isEmpty()) {
+        hideAutoCompletePopup();
+        return;
+    }
+
+    ASSERT(defaultSuggestionIndex < static_cast<int>(suggestions.size()));
+
+    if (RefPtr<Frame> focused = m_page->focusController()->focusedFrame()) {
+        RefPtr<Document> document = focused->document();
+        if (!document.get()) {
+            hideAutoCompletePopup();
+            return;
+        }
+
+        RefPtr<Node> focusedNode = document->focusedNode();
+        // If the node for which we queried the autofill suggestions is not the
+        // focused node, then we have nothing to do.  FIXME: also check the
+        // carret is at the end and that the text has not changed.
+        if (!focusedNode.get() || focusedNode != PassRefPtr<Node>(node)) {
+            hideAutoCompletePopup();
+            return;
+        }
+
+        if (!focusedNode->hasTagName(HTMLNames::inputTag)) {
+            ASSERT_NOT_REACHED();
+            return;
+        }
+
+        HTMLInputElement* inputElem =
+            static_cast<HTMLInputElement*>(focusedNode.get());
+
+        // The first time the autocomplete is shown we'll create the client and the
+        // popup.
+        if (!m_autocompletePopupClient.get())
+            m_autocompletePopupClient.set(new AutocompletePopupMenuClient(this));
+        m_autocompletePopupClient->initialize(inputElem,
+                                              suggestions,
+                                              defaultSuggestionIndex);
+        if (!m_autocompletePopup.get()) {
+            m_autocompletePopup =
+                PopupContainer::create(m_autocompletePopupClient.get(),
+                                       autocompletePopupSettings);
+        }
+
+        if (m_autocompletePopupShowing) {
+            m_autocompletePopupClient->setSuggestions(suggestions);
+            refreshAutofillPopup();
+        } else {
+            m_autocompletePopup->show(focusedNode->getRect(),
+                                      focusedNode->ownerDocument()->view(), 0);
+            m_autocompletePopupShowing = true;
+        }
+    }
+}
+
+void WebViewImpl::hideAutofillPopup()
+{
+    hideAutoCompletePopup();
+}
+
+void WebViewImpl::performCustomContextMenuAction(unsigned action)
+{
+    if (!m_page)
+        return;
+    ContextMenu* menu = m_page->contextMenuController()->contextMenu();
+    if (!menu)
+        return;
+    ContextMenuItem* item = menu->itemWithAction(static_cast<ContextMenuAction>(ContextMenuItemBaseCustomTag + action));
+    if (item)
+        m_page->contextMenuController()->contextMenuItemSelected(item);
+    m_page->contextMenuController()->clearContextMenu();
+}
+
+// WebView --------------------------------------------------------------------
+
+bool WebViewImpl::setDropEffect(bool accept)
+{
+    if (m_dragTargetDispatch) {
+        m_dropEffect = accept ? DropEffectCopy : DropEffectNone;
+        return true;
+    }
+    return false;
+}
+
+void WebViewImpl::setIsTransparent(bool isTransparent)
+{
+    // Set any existing frames to be transparent.
+    Frame* frame = m_page->mainFrame();
+    while (frame) {
+        frame->view()->setTransparent(isTransparent);
+        frame = frame->tree()->traverseNext();
+    }
+
+    // Future frames check this to know whether to be transparent.
+    m_isTransparent = isTransparent;
+}
+
+bool WebViewImpl::isTransparent() const
+{
+    return m_isTransparent;
+}
+
+void WebViewImpl::setIsActive(bool active)
+{
+    if (page() && page()->focusController())
+        page()->focusController()->setActive(active);
+}
+
+bool WebViewImpl::isActive() const
+{
+    return (page() && page()->focusController()) ? page()->focusController()->isActive() : false;
+}
+
+void WebViewImpl::setScrollbarColors(unsigned inactiveColor,
+                                     unsigned activeColor,
+                                     unsigned trackColor) {
+#if PLATFORM(LINUX)
+    RenderThemeChromiumLinux::setScrollbarColors(inactiveColor,
+                                                 activeColor,
+                                                 trackColor);
+#endif
+}
+
+void WebViewImpl::didCommitLoad(bool* isNewNavigation)
+{
+    if (isNewNavigation)
+        *isNewNavigation = m_observedNewNavigation;
+
+#ifndef NDEBUG
+    ASSERT(!m_observedNewNavigation
+        || m_page->mainFrame()->loader()->documentLoader() == m_newNavigationLoader);
+    m_newNavigationLoader = 0;
+#endif
+    m_observedNewNavigation = false;
+}
+
+bool WebViewImpl::navigationPolicyFromMouseEvent(unsigned short button,
+                                                 bool ctrl, bool shift,
+                                                 bool alt, bool meta,
+                                                 WebNavigationPolicy* policy)
+{
+#if PLATFORM(WIN_OS) || PLATFORM(LINUX) || PLATFORM(FREEBSD)
+    const bool newTabModifier = (button == 1) || ctrl;
+#elif PLATFORM(DARWIN)
+    const bool newTabModifier = (button == 1) || meta;
+#endif
+    if (!newTabModifier && !shift && !alt)
+      return false;
+
+    ASSERT(policy);
+    if (newTabModifier) {
+        if (shift)
+          *policy = WebNavigationPolicyNewForegroundTab;
+        else
+          *policy = WebNavigationPolicyNewBackgroundTab;
+    } else {
+        if (shift)
+          *policy = WebNavigationPolicyNewWindow;
+        else
+          *policy = WebNavigationPolicyDownload;
+    }
+    return true;
+}
+
+void WebViewImpl::startDragging(const WebPoint& eventPos,
+                                const WebDragData& dragData,
+                                WebDragOperationsMask mask)
+{
+    if (!m_client)
+        return;
+    ASSERT(!m_doingDragAndDrop);
+    m_doingDragAndDrop = true;
+    m_client->startDragging(eventPos, dragData, mask);
+}
+
+void WebViewImpl::setCurrentHistoryItem(HistoryItem* item)
+{
+    m_backForwardListClientImpl.setCurrentHistoryItem(item);
+}
+
+HistoryItem* WebViewImpl::previousHistoryItem()
+{
+    return m_backForwardListClientImpl.previousHistoryItem();
+}
+
+void WebViewImpl::observeNewNavigation()
+{
+    m_observedNewNavigation = true;
+#ifndef NDEBUG
+    m_newNavigationLoader = m_page->mainFrame()->loader()->documentLoader();
+#endif
+}
+
+void WebViewImpl::hideAutoCompletePopup()
+{
+    if (m_autocompletePopupShowing) {
+        m_autocompletePopup->hidePopup();
+        autoCompletePopupDidHide();
+    }
+}
+
+void WebViewImpl::autoCompletePopupDidHide()
+{
+    m_autocompletePopupShowing = false;
+}
+
+void WebViewImpl::setIgnoreInputEvents(bool newValue)
+{
+    ASSERT(m_ignoreInputEvents != newValue);
+    m_ignoreInputEvents = newValue;
+}
+
+#if ENABLE(NOTIFICATIONS)
+NotificationPresenterImpl* WebViewImpl::notificationPresenterImpl()
+{
+    if (!m_notificationPresenter.isInitialized() && m_client)
+        m_notificationPresenter.initialize(m_client->notificationPresenter());
+    return &m_notificationPresenter;
+}
+#endif
+
+void WebViewImpl::refreshAutofillPopup()
+{
+    ASSERT(m_autocompletePopupShowing);
+
+    // Hide the popup if it has become empty.
+    if (!m_autocompletePopupClient->listSize()) {
+        hideAutoCompletePopup();
+        return;
+    }
+
+    IntRect oldBounds = m_autocompletePopup->boundsRect();
+    m_autocompletePopup->refresh();
+    IntRect newBounds = m_autocompletePopup->boundsRect();
+    // Let's resize the backing window if necessary.
+    if (oldBounds != newBounds) {
+        WebPopupMenuImpl* popupMenu =
+            static_cast<WebPopupMenuImpl*>(m_autocompletePopup->client());
+        popupMenu->client()->setWindowRect(newBounds);
+    }
+}
+
+Node* WebViewImpl::focusedWebCoreNode()
+{
+    Frame* frame = m_page->focusController()->focusedFrame();
+    if (!frame)
+        return 0;
+
+    Document* document = frame->document();
+    if (!document)
+        return 0;
+
+    return document->focusedNode();
+}
+
+HitTestResult WebViewImpl::hitTestResultForWindowPos(const IntPoint& pos)
+{
+    IntPoint docPoint(m_page->mainFrame()->view()->windowToContents(pos));
+    return m_page->mainFrame()->eventHandler()->hitTestResultAtPoint(docPoint, false);
+}
+
+void WebViewImpl::setTabsToLinks(bool enable)
+{
+    m_tabsToLinks = enable;
+}
+
+bool WebViewImpl::tabsToLinks() const
+{
+    return m_tabsToLinks;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebViewImpl.h b/WebKit/chromium/src/WebViewImpl.h
new file mode 100644
index 0000000..dd5191e
--- /dev/null
+++ b/WebKit/chromium/src/WebViewImpl.h
@@ -0,0 +1,420 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebViewImpl_h
+#define WebViewImpl_h
+
+// FIXME: Remove these relative paths once consumers from glue are removed.
+#include "../public/WebNavigationPolicy.h"
+#include "../public/WebPoint.h"
+#include "../public/WebSize.h"
+#include "../public/WebString.h"
+#include "../public/WebView.h"
+
+#include "BackForwardListClientImpl.h"
+#include "ChromeClientImpl.h"
+#include "ContextMenuClientImpl.h"
+#include "DragClientImpl.h"
+#include "EditorClientImpl.h"
+#include "InspectorClientImpl.h"
+#include "NotificationPresenterImpl.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+class ChromiumDataObject;
+class Frame;
+class HistoryItem;
+class HitTestResult;
+class KeyboardEvent;
+class Page;
+class PlatformKeyboardEvent;
+class PopupContainer;
+class Range;
+class RenderTheme;
+class Widget;
+}
+
+namespace WebKit {
+class AutocompletePopupMenuClient;
+class ContextMenuClientImpl;
+class WebAccessibilityObject;
+class WebDevToolsAgentPrivate;
+class WebFrameImpl;
+class WebKeyboardEvent;
+class WebMouseEvent;
+class WebMouseWheelEvent;
+class WebSettingsImpl;
+
+class WebViewImpl : public WebView, public RefCounted<WebViewImpl> {
+public:
+    // WebWidget methods:
+    virtual void close();
+    virtual WebSize size() { return m_size; }
+    virtual void resize(const WebSize&);
+    virtual void layout();
+    virtual void paint(WebCanvas*, const WebRect&);
+    virtual bool handleInputEvent(const WebInputEvent&);
+    virtual void mouseCaptureLost();
+    virtual void setFocus(bool enable);
+    virtual bool handleCompositionEvent(WebCompositionCommand command,
+                                        int cursorPosition,
+                                        int targetStart,
+                                        int targetEnd,
+                                        const WebString& text);
+    virtual bool queryCompositionStatus(bool* enabled,
+                                        WebRect* caretRect);
+    virtual void setTextDirection(WebTextDirection direction);
+
+    // WebView methods:
+    virtual void initializeMainFrame(WebFrameClient*);
+    virtual WebSettings* settings();
+    virtual WebString pageEncoding() const;
+    virtual void setPageEncoding(const WebString& encoding);
+    virtual bool isTransparent() const;
+    virtual void setIsTransparent(bool value);
+    virtual bool tabsToLinks() const;
+    virtual void setTabsToLinks(bool value);
+    virtual bool tabKeyCyclesThroughElements() const;
+    virtual void setTabKeyCyclesThroughElements(bool value);
+    virtual bool isActive() const;
+    virtual void setIsActive(bool value);
+    virtual bool dispatchBeforeUnloadEvent();
+    virtual void dispatchUnloadEvent();
+    virtual WebFrame* mainFrame();
+    virtual WebFrame* findFrameByName(
+        const WebString& name, WebFrame* relativeToFrame);
+    virtual WebFrame* focusedFrame();
+    virtual void setFocusedFrame(WebFrame* frame);
+    virtual void setInitialFocus(bool reverse);
+    virtual void clearFocusedNode();
+    virtual int zoomLevel();
+    virtual int setZoomLevel(bool textOnly, int zoomLevel);
+    virtual void performMediaPlayerAction(
+        const WebMediaPlayerAction& action,
+        const WebPoint& location);
+    virtual void copyImageAt(const WebPoint& point);
+    virtual void dragSourceEndedAt(
+        const WebPoint& clientPoint,
+        const WebPoint& screenPoint,
+        WebDragOperation operation);
+    virtual void dragSourceSystemDragEnded();
+    virtual WebDragOperation dragTargetDragEnter(
+        const WebDragData& dragData, int identity,
+        const WebPoint& clientPoint,
+        const WebPoint& screenPoint,
+        WebDragOperationsMask operationsAllowed);
+    virtual WebDragOperation dragTargetDragOver(
+        const WebPoint& clientPoint,
+        const WebPoint& screenPoint,
+        WebDragOperationsMask operationsAllowed);
+    virtual void dragTargetDragLeave();
+    virtual void dragTargetDrop(
+        const WebPoint& clientPoint,
+        const WebPoint& screenPoint);
+    virtual int dragIdentity();
+    virtual bool setDropEffect(bool accept);
+    virtual unsigned long createUniqueIdentifierForRequest();
+    virtual void inspectElementAt(const WebPoint& point);
+    virtual WebString inspectorSettings() const;
+    virtual void setInspectorSettings(const WebString& settings);
+    virtual WebDevToolsAgent* devToolsAgent();
+    virtual void setDevToolsAgent(WebDevToolsAgent*);
+    virtual WebAccessibilityObject accessibilityObject();
+    virtual void applyAutofillSuggestions(
+        const WebNode&,
+        const WebVector<WebString>& suggestions,
+        int defaultSuggestionIndex);
+    virtual void hideAutofillPopup();
+    virtual void setScrollbarColors(unsigned inactiveColor,
+                                    unsigned activeColor,
+                                    unsigned trackColor);
+    virtual void performCustomContextMenuAction(unsigned action);
+
+    // WebViewImpl
+
+    void setIgnoreInputEvents(bool newValue);
+    WebDevToolsAgentPrivate* devToolsAgentPrivate() { return m_devToolsAgent.get(); }
+
+    const WebPoint& lastMouseDownPoint() const
+    {
+        return m_lastMouseDownPoint;
+    }
+
+    WebCore::Frame* focusedWebCoreFrame();
+
+    // Returns the currently focused Node or null if no node has focus.
+    WebCore::Node* focusedWebCoreNode();
+
+    static WebViewImpl* fromPage(WebCore::Page*);
+
+    WebViewClient* client()
+    {
+        return m_client;
+    }
+
+    // Returns the page object associated with this view.  This may be null when
+    // the page is shutting down, but will be valid at all other times.
+    WebCore::Page* page() const
+    {
+        return m_page.get();
+    }
+
+    WebCore::RenderTheme* theme() const;
+
+    // Returns the main frame associated with this view.  This may be null when
+    // the page is shutting down, but will be valid at all other times.
+    WebFrameImpl* mainFrameImpl();
+
+    // History related methods:
+    void setCurrentHistoryItem(WebCore::HistoryItem*);
+    WebCore::HistoryItem* previousHistoryItem();
+    void observeNewNavigation();
+
+    // Event related methods:
+    void mouseMove(const WebMouseEvent&);
+    void mouseLeave(const WebMouseEvent&);
+    void mouseDown(const WebMouseEvent&);
+    void mouseUp(const WebMouseEvent&);
+    void mouseContextMenu(const WebMouseEvent&);
+    void mouseDoubleClick(const WebMouseEvent&);
+    void mouseWheel(const WebMouseWheelEvent&);
+    bool keyEvent(const WebKeyboardEvent&);
+    bool charEvent(const WebKeyboardEvent&);
+
+    // Handles context menu events orignated via the the keyboard. These
+    // include the VK_APPS virtual key and the Shift+F10 combine.  Code is
+    // based on the Webkit function bool WebView::handleContextMenuEvent(WPARAM
+    // wParam, LPARAM lParam) in webkit\webkit\win\WebView.cpp. The only
+    // significant change in this function is the code to convert from a
+    // Keyboard event to the Right Mouse button down event.
+    bool sendContextMenuEvent(const WebKeyboardEvent&);
+
+    // Notifies the WebView that a load has been committed.  isNewNavigation
+    // will be true if a new session history item should be created for that
+    // load.
+    void didCommitLoad(bool* isNewNavigation);
+
+    bool contextMenuAllowed() const
+    {
+        return m_contextMenuAllowed;
+    }
+
+    // Set the disposition for how this webview is to be initially shown.
+    void setInitialNavigationPolicy(WebNavigationPolicy policy)
+    {
+        m_initialNavigationPolicy = policy;
+    }
+    WebNavigationPolicy initialNavigationPolicy() const
+    {
+        return m_initialNavigationPolicy;
+    }
+
+    // Determines whether a page should e.g. be opened in a background tab.
+    // Returns false if it has no opinion, in which case it doesn't set *policy.
+    static bool navigationPolicyFromMouseEvent(
+        unsigned short button,
+        bool ctrl,
+        bool shift,
+        bool alt,
+        bool meta,
+        WebNavigationPolicy*);
+
+    // Start a system drag and drop operation.
+    void startDragging(
+        const WebPoint& eventPos,
+        const WebDragData& dragData,
+        WebDragOperationsMask dragSourceOperationMask);
+
+    // Hides the autocomplete popup if it is showing.
+    void hideAutoCompletePopup();
+    void autoCompletePopupDidHide();
+
+#if ENABLE(NOTIFICATIONS)
+    // Returns the provider of desktop notifications.
+    NotificationPresenterImpl* notificationPresenterImpl();
+#endif
+
+    // Tries to scroll a frame or any parent of a frame. Returns true if the view
+    // was scrolled.
+    bool propagateScroll(WebCore::ScrollDirection, WebCore::ScrollGranularity);
+
+    // HACK: currentInputEvent() is for ChromeClientImpl::show(), until we can
+    // fix WebKit to pass enough information up into ChromeClient::show() so we
+    // can decide if the window.open event was caused by a middle-mouse click
+    static const WebInputEvent* currentInputEvent()
+    {
+        return m_currentInputEvent;
+    }
+
+private:
+    friend class WebView;  // So WebView::Create can call our constructor
+    friend class WTF::RefCounted<WebViewImpl>;
+
+    WebViewImpl(WebViewClient* client);
+    ~WebViewImpl();
+
+    // Returns true if the event was actually processed.
+    bool keyEventDefault(const WebKeyboardEvent&);
+
+    // Returns true if the autocomple has consumed the event.
+    bool autocompleteHandleKeyEvent(const WebKeyboardEvent&);
+
+    // Repaints the autofill popup.  Should be called when the suggestions have
+    // changed.  Note that this should only be called when the autofill popup is
+    // showing.
+    void refreshAutofillPopup();
+
+    // Returns true if the view was scrolled.
+    bool scrollViewWithKeyboard(int keyCode, int modifiers);
+
+    // Converts |pos| from window coordinates to contents coordinates and gets
+    // the HitTestResult for it.
+    WebCore::HitTestResult hitTestResultForWindowPos(const WebCore::IntPoint&);
+
+    WebViewClient* m_client;
+
+    BackForwardListClientImpl m_backForwardListClientImpl;
+    ChromeClientImpl m_chromeClientImpl;
+    ContextMenuClientImpl m_contextMenuClientImpl;
+    DragClientImpl m_dragClientImpl;
+    EditorClientImpl m_editorClientImpl;
+    InspectorClientImpl m_inspectorClientImpl;
+
+    WebSize m_size;
+
+    WebPoint m_lastMousePosition;
+    OwnPtr<WebCore::Page> m_page;
+
+    // This flag is set when a new navigation is detected.  It is used to satisfy
+    // the corresponding argument to WebFrameClient::didCommitProvisionalLoad.
+    bool m_observedNewNavigation;
+#ifndef NDEBUG
+    // Used to assert that the new navigation we observed is the same navigation
+    // when we make use of m_observedNewNavigation.
+    const WebCore::DocumentLoader* m_newNavigationLoader;
+#endif
+
+    // An object that can be used to manipulate m_page->settings() without linking
+    // against WebCore.  This is lazily allocated the first time GetWebSettings()
+    // is called.
+    OwnPtr<WebSettingsImpl> m_webSettings;
+
+    // A copy of the web drop data object we received from the browser.
+    RefPtr<WebCore::ChromiumDataObject> m_currentDragData;
+
+    // The point relative to the client area where the mouse was last pressed
+    // down. This is used by the drag client to determine what was under the
+    // mouse when the drag was initiated. We need to track this here in
+    // WebViewImpl since DragClient::startDrag does not pass the position the
+    // mouse was at when the drag was initiated, only the current point, which
+    // can be misleading as it is usually not over the element the user actually
+    // dragged by the time a drag is initiated.
+    WebPoint m_lastMouseDownPoint;
+
+    // Keeps track of the current zoom level.  0 means no zoom, positive numbers
+    // mean zoom in, negative numbers mean zoom out.
+    int m_zoomLevel;
+
+    bool m_contextMenuAllowed;
+
+    bool m_doingDragAndDrop;
+
+    bool m_ignoreInputEvents;
+
+    // Webkit expects keyPress events to be suppressed if the associated keyDown
+    // event was handled. Safari implements this behavior by peeking out the
+    // associated WM_CHAR event if the keydown was handled. We emulate
+    // this behavior by setting this flag if the keyDown was handled.
+    bool m_suppressNextKeypressEvent;
+
+    // The policy for how this webview is to be initially shown.
+    WebNavigationPolicy m_initialNavigationPolicy;
+
+    // Represents whether or not this object should process incoming IME events.
+    bool m_imeAcceptEvents;
+
+    // True while dispatching system drag and drop events to drag/drop targets
+    // within this WebView.
+    bool m_dragTargetDispatch;
+
+    // Valid when m_dragTargetDispatch is true; the identity of the drag data
+    // copied from the WebDropData object sent from the browser process.
+    int m_dragIdentity;
+
+    // Valid when m_dragTargetDispatch is true.  Used to override the default
+    // browser drop effect with the effects "none" or "copy".
+    enum DragTargetDropEffect {
+        DropEffectDefault = -1,
+        DropEffectNone,
+        DropEffectCopy
+    } m_dropEffect;
+
+    // The available drag operations (copy, move link...) allowed by the source.
+    WebDragOperation m_operationsAllowed;
+
+    // The current drag operation as negotiated by the source and destination.
+    // When not equal to DragOperationNone, the drag data can be dropped onto the
+    // current drop target in this WebView (the drop target can accept the drop).
+    WebDragOperation m_dragOperation;
+
+    // The autocomplete popup.  Kept around and reused every-time new suggestions
+    // should be shown.
+    RefPtr<WebCore::PopupContainer> m_autocompletePopup;
+
+    // Whether the autocomplete popup is currently showing.
+    bool m_autocompletePopupShowing;
+
+    // The autocomplete client.
+    OwnPtr<AutocompletePopupMenuClient> m_autocompletePopupClient;
+
+    OwnPtr<WebDevToolsAgentPrivate> m_devToolsAgent;
+
+    // Whether the webview is rendering transparently.
+    bool m_isTransparent;
+
+    // Whether the user can press tab to focus links.
+    bool m_tabsToLinks;
+
+    // Inspector settings.
+    WebString m_inspectorSettings;
+
+#if ENABLE(NOTIFICATIONS)
+    // The provider of desktop notifications;
+    NotificationPresenterImpl m_notificationPresenter;
+#endif
+
+    static const WebInputEvent* m_currentInputEvent;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebWorkerBase.cpp b/WebKit/chromium/src/WebWorkerBase.cpp
new file mode 100644
index 0000000..85a263b
--- /dev/null
+++ b/WebKit/chromium/src/WebWorkerBase.cpp
@@ -0,0 +1,308 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebWorkerBase.h"
+
+#include "GenericWorkerTask.h"
+#include "MessagePortChannel.h"
+#include "PlatformMessagePortChannel.h"
+
+#include "WebDataSourceImpl.h"
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include "WebMessagePortChannel.h"
+#include "WebView.h"
+#include "WebWorkerClient.h"
+
+#include "WorkerThread.h"
+#include <wtf/MainThread.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+#if ENABLE(WORKERS)
+
+// Dummy WebViewDelegate - we only need it in Worker process to load a
+// 'shadow page' which will initialize WebCore loader.
+class WorkerWebFrameClient : public WebFrameClient {
+public:
+    // Tell the loader to load the data into the 'shadow page' synchronously,
+    // so we can grab the resulting Document right after load.
+    virtual void didCreateDataSource(WebFrame* frame, WebDataSource* ds)
+    {
+        static_cast<WebDataSourceImpl*>(ds)->setDeferMainResourceDataLoad(false);
+    }
+
+    // Lazy allocate and leak this instance.
+    static WorkerWebFrameClient* sharedInstance()
+    {
+        static WorkerWebFrameClient client;
+        return &client;
+    }
+
+private:
+    WorkerWebFrameClient()
+    {
+    }
+};
+
+// This function is called on the main thread to force to initialize some static
+// values used in WebKit before any worker thread is started. This is because in
+// our worker processs, we do not run any WebKit code in main thread and thus
+// when multiple workers try to start at the same time, we might hit crash due
+// to contention for initializing static values.
+static void initializeWebKitStaticValues()
+{
+    static bool initialized = false;
+    if (!initialized) {
+        initialized = true;
+        // Note that we have to pass a URL with valid protocol in order to follow
+        // the path to do static value initializations.
+        RefPtr<SecurityOrigin> origin =
+            SecurityOrigin::create(KURL(ParsedURLString, "http://localhost"));
+        origin.release();
+    }
+}
+
+WebWorkerBase::WebWorkerBase()
+    : m_webView(0)
+    , m_askedToTerminate(false)
+{
+    initializeWebKitStaticValues();
+}
+
+WebWorkerBase::~WebWorkerBase()
+{
+    ASSERT(m_webView);
+    m_webView->close();
+}
+
+void WebWorkerBase::stopWorkerThread()
+{
+    if (m_askedToTerminate)
+        return;
+    m_askedToTerminate = true;
+    if (m_workerThread)
+        m_workerThread->stop();
+}
+
+void WebWorkerBase::initializeLoader(const WebURL& url)
+{
+    // Create 'shadow page'. This page is never displayed, it is used to proxy the
+    // loading requests from the worker context to the rest of WebKit and Chromium
+    // infrastructure.
+    ASSERT(!m_webView);
+    m_webView = WebView::create(0);
+    m_webView->initializeMainFrame(WorkerWebFrameClient::sharedInstance());
+
+    WebFrameImpl* webFrame = static_cast<WebFrameImpl*>(m_webView->mainFrame());
+
+    // Construct substitute data source for the 'shadow page'. We only need it
+    // to have same origin as the worker so the loading checks work correctly.
+    CString content("");
+    int len = static_cast<int>(content.length());
+    RefPtr<SharedBuffer> buf(SharedBuffer::create(content.data(), len));
+    SubstituteData substData(buf, String("text/html"), String("UTF-8"), KURL());
+    ResourceRequest request(url, CString());
+    webFrame->frame()->loader()->load(request, substData, false);
+
+    // This document will be used as 'loading context' for the worker.
+    m_loadingDocument = webFrame->frame()->document();
+}
+
+void WebWorkerBase::dispatchTaskToMainThread(PassOwnPtr<ScriptExecutionContext::Task> task)
+{
+    return callOnMainThread(invokeTaskMethod, task.release());
+}
+
+void WebWorkerBase::invokeTaskMethod(void* param)
+{
+    ScriptExecutionContext::Task* task =
+        static_cast<ScriptExecutionContext::Task*>(param);
+    task->performTask(0);
+    delete task;
+}
+
+// WorkerObjectProxy -----------------------------------------------------------
+
+void WebWorkerBase::postMessageToWorkerObject(PassRefPtr<SerializedScriptValue> message,
+                                              PassOwnPtr<MessagePortChannelArray> channels)
+{
+    dispatchTaskToMainThread(createCallbackTask(&postMessageTask, this,
+                                                message->toString(), channels));
+}
+
+void WebWorkerBase::postMessageTask(ScriptExecutionContext* context,
+                                    WebWorkerBase* thisPtr,
+                                    String message,
+                                    PassOwnPtr<MessagePortChannelArray> channels)
+{
+    if (!thisPtr->client())
+        return;
+
+    WebMessagePortChannelArray webChannels(channels.get() ? channels->size() : 0);
+    for (size_t i = 0; i < webChannels.size(); ++i) {
+        webChannels[i] = (*channels)[i]->channel()->webChannelRelease();
+        webChannels[i]->setClient(0);
+    }
+
+    thisPtr->client()->postMessageToWorkerObject(message, webChannels);
+}
+
+void WebWorkerBase::postExceptionToWorkerObject(const String& errorMessage,
+                                                int lineNumber,
+                                                const String& sourceURL)
+{
+    dispatchTaskToMainThread(createCallbackTask(&postExceptionTask, this,
+                                                errorMessage, lineNumber,
+                                                sourceURL));
+}
+
+void WebWorkerBase::postExceptionTask(ScriptExecutionContext* context,
+                                      WebWorkerBase* thisPtr,
+                                      const String& errorMessage,
+                                      int lineNumber, const String& sourceURL)
+{
+    if (!thisPtr->commonClient())
+        return;
+
+    thisPtr->commonClient()->postExceptionToWorkerObject(errorMessage,
+                                                         lineNumber,
+                                                         sourceURL);
+}
+
+void WebWorkerBase::postConsoleMessageToWorkerObject(MessageDestination destination,
+                                                     MessageSource source,
+                                                     MessageType type,
+                                                     MessageLevel level,
+                                                     const String& message,
+                                                     int lineNumber,
+                                                     const String& sourceURL)
+{
+    dispatchTaskToMainThread(createCallbackTask(&postConsoleMessageTask, this,
+                                                static_cast<int>(destination),
+                                                static_cast<int>(source),
+                                                static_cast<int>(type),
+                                                static_cast<int>(level),
+                                                message, lineNumber, sourceURL));
+}
+
+void WebWorkerBase::postConsoleMessageTask(ScriptExecutionContext* context,
+                                           WebWorkerBase* thisPtr,
+                                           int destination, int source,
+                                           int type, int level,
+                                           const String& message,
+                                           int lineNumber,
+                                           const String& sourceURL)
+{
+    if (!thisPtr->commonClient())
+        return;
+    thisPtr->commonClient()->postConsoleMessageToWorkerObject(destination, source,
+                                                              type, level, message,
+                                                              lineNumber, sourceURL);
+}
+
+void WebWorkerBase::confirmMessageFromWorkerObject(bool hasPendingActivity)
+{
+    dispatchTaskToMainThread(createCallbackTask(&confirmMessageTask, this,
+                                                hasPendingActivity));
+}
+
+void WebWorkerBase::confirmMessageTask(ScriptExecutionContext* context,
+                                       WebWorkerBase* thisPtr,
+                                       bool hasPendingActivity)
+{
+    if (!thisPtr->client())
+        return;
+    thisPtr->client()->confirmMessageFromWorkerObject(hasPendingActivity);
+}
+
+void WebWorkerBase::reportPendingActivity(bool hasPendingActivity)
+{
+    dispatchTaskToMainThread(createCallbackTask(&reportPendingActivityTask,
+                                                this, hasPendingActivity));
+}
+
+void WebWorkerBase::reportPendingActivityTask(ScriptExecutionContext* context,
+                                              WebWorkerBase* thisPtr,
+                                              bool hasPendingActivity)
+{
+    if (!thisPtr->client())
+        return;
+    thisPtr->client()->reportPendingActivity(hasPendingActivity);
+}
+
+void WebWorkerBase::workerContextClosed()
+{
+    dispatchTaskToMainThread(createCallbackTask(&workerContextClosedTask,
+                                                this));
+}
+
+void WebWorkerBase::workerContextClosedTask(ScriptExecutionContext* context,
+                                            WebWorkerBase* thisPtr)
+{
+    if (thisPtr->commonClient())
+        thisPtr->commonClient()->workerContextClosed();
+}
+
+void WebWorkerBase::workerContextDestroyed()
+{
+    dispatchTaskToMainThread(createCallbackTask(&workerContextDestroyedTask,
+                                                this));
+}
+
+void WebWorkerBase::workerContextDestroyedTask(ScriptExecutionContext* context,
+                                               WebWorkerBase* thisPtr)
+{
+    if (thisPtr->commonClient())
+        thisPtr->commonClient()->workerContextDestroyed();
+    // The lifetime of this proxy is controlled by the worker context.
+    delete thisPtr;
+}
+
+// WorkerLoaderProxy -----------------------------------------------------------
+
+void WebWorkerBase::postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task> task)
+{
+    ASSERT(m_loadingDocument->isDocument());
+    m_loadingDocument->postTask(task);
+}
+
+void WebWorkerBase::postTaskForModeToWorkerContext(
+    PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
+{
+    m_workerThread->runLoop().postTaskForMode(task, mode);
+}
+
+#endif // ENABLE(WORKERS)
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebWorkerBase.h b/WebKit/chromium/src/WebWorkerBase.h
new file mode 100644
index 0000000..0217401
--- /dev/null
+++ b/WebKit/chromium/src/WebWorkerBase.h
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebWorkerBase_h
+#define WebWorkerBase_h
+
+#if ENABLE(WORKERS)
+
+#include "ScriptExecutionContext.h"
+#include "WorkerLoaderProxy.h"
+#include "WorkerObjectProxy.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+class WorkerThread;
+}
+
+namespace WebKit {
+class WebCommonWorkerClient;
+class WebURL;
+class WebView;
+class WebWorkerClient;
+
+// Base class for WebSharedWorkerImpl and WebWorkerImpl. It contains common
+// code used by both implementation classes, including implementations of the
+// WorkerObjectProxy and WorkerLoaderProxy interfaces.
+class WebWorkerBase : public WebCore::WorkerObjectProxy
+                    , public WebCore::WorkerLoaderProxy {
+public:
+    WebWorkerBase();
+    virtual ~WebWorkerBase();
+
+    // WebCore::WorkerObjectProxy methods:
+    virtual void postMessageToWorkerObject(
+        PassRefPtr<WebCore::SerializedScriptValue>,
+        PassOwnPtr<WebCore::MessagePortChannelArray>);
+    virtual void postExceptionToWorkerObject(
+        const WebCore::String&, int, const WebCore::String&);
+    virtual void postConsoleMessageToWorkerObject(
+        WebCore::MessageDestination, WebCore::MessageSource, WebCore::MessageType,
+        WebCore::MessageLevel, const WebCore::String&, int, const WebCore::String&);
+    virtual void confirmMessageFromWorkerObject(bool);
+    virtual void reportPendingActivity(bool);
+    virtual void workerContextClosed();
+    virtual void workerContextDestroyed();
+
+    // WebCore::WorkerLoaderProxy methods:
+    virtual void postTaskToLoader(PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
+    virtual void postTaskForModeToWorkerContext(
+        PassOwnPtr<WebCore::ScriptExecutionContext::Task>, const WebCore::String& mode);
+
+    // Executes the given task on the main thread.
+    static void dispatchTaskToMainThread(PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
+
+protected:
+    virtual WebWorkerClient* client() = 0;
+    virtual WebCommonWorkerClient* commonClient() = 0;
+
+    void setWorkerThread(PassRefPtr<WebCore::WorkerThread> thread) { m_workerThread = thread; }
+    WebCore::WorkerThread* workerThread() { return m_workerThread.get(); }
+
+    // Shuts down the worker thread.
+    void stopWorkerThread();
+
+    // Creates the shadow loader used for worker network requests.
+    void initializeLoader(const WebURL&);
+
+private:
+    // Function used to invoke tasks on the main thread.
+    static void invokeTaskMethod(void*);
+
+    // Tasks that are run on the main thread.
+    static void postMessageTask(
+        WebCore::ScriptExecutionContext* context,
+        WebWorkerBase* thisPtr,
+        WebCore::String message,
+        PassOwnPtr<WebCore::MessagePortChannelArray> channels);
+    static void postExceptionTask(
+        WebCore::ScriptExecutionContext* context,
+        WebWorkerBase* thisPtr,
+        const WebCore::String& message,
+        int lineNumber,
+        const WebCore::String& sourceURL);
+    static void postConsoleMessageTask(
+        WebCore::ScriptExecutionContext* context,
+        WebWorkerBase* thisPtr,
+        int destination,
+        int source,
+        int type,
+        int level,
+        const WebCore::String& message,
+        int lineNumber,
+        const WebCore::String& sourceURL);
+    static void confirmMessageTask(
+        WebCore::ScriptExecutionContext* context,
+        WebWorkerBase* thisPtr,
+        bool hasPendingActivity);
+    static void reportPendingActivityTask(
+        WebCore::ScriptExecutionContext* context,
+        WebWorkerBase* thisPtr,
+        bool hasPendingActivity);
+    static void workerContextClosedTask(
+        WebCore::ScriptExecutionContext* context,
+        WebWorkerBase* thisPtr);
+    static void workerContextDestroyedTask(
+        WebCore::ScriptExecutionContext* context,
+        WebWorkerBase* thisPtr);
+
+    // 'shadow page' - created to proxy loading requests from the worker.
+    RefPtr<WebCore::ScriptExecutionContext> m_loadingDocument;
+    WebView* m_webView;
+    bool m_askedToTerminate;
+
+    RefPtr<WebCore::WorkerThread> m_workerThread;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(WORKERS)
+
+#endif
diff --git a/WebKit/chromium/src/WebWorkerClientImpl.cpp b/WebKit/chromium/src/WebWorkerClientImpl.cpp
new file mode 100644
index 0000000..6be03a7
--- /dev/null
+++ b/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -0,0 +1,416 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebWorkerClientImpl.h"
+
+#if ENABLE(WORKERS)
+
+#include "DedicatedWorkerThread.h"
+#include "ErrorEvent.h"
+#include "Frame.h"
+#include "FrameLoaderClient.h"
+#include "GenericWorkerTask.h"
+#include "MessageEvent.h"
+#include "MessagePort.h"
+#include "MessagePortChannel.h"
+#include "ScriptExecutionContext.h"
+#include "Worker.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
+#include "WorkerMessagingProxy.h"
+#include <wtf/Threading.h>
+
+#include "FrameLoaderClientImpl.h"
+#include "PlatformMessagePortChannel.h"
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebMessagePortChannel.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebViewImpl.h"
+#include "WebWorker.h"
+#include "WebWorkerImpl.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+// When WebKit creates a WorkerContextProxy object, we check if we're in the
+// renderer or worker process.  If the latter, then we just use
+// WorkerMessagingProxy.
+//
+// If we're in the renderer process, then we need use the glue provided
+// WebWorker object to talk to the worker process over IPC.  The worker process
+// talks to Worker* using WorkerObjectProxy, which we implement on
+// WebWorkerClientImpl.
+//
+// Note that if we're running each worker in a separate process, then nested
+// workers end up using the same codepath as the renderer process.
+
+// static
+WorkerContextProxy* WebWorkerClientImpl::createWorkerContextProxy(Worker* worker)
+{
+    // Special behavior for multiple workers per process.
+    // FIXME: v8 doesn't support more than one workers per process.
+    // if (!worker->scriptExecutionContext()->isDocument())
+    //     return new WorkerMessagingProxy(worker);
+
+    WebWorker* webWorker = 0;
+    WebWorkerClientImpl* proxy = new WebWorkerClientImpl(worker);
+
+    if (worker->scriptExecutionContext()->isDocument()) {
+        Document* document = static_cast<Document*>(
+            worker->scriptExecutionContext());
+        WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
+        webWorker = webFrame->client()->createWorker(webFrame, proxy);
+    } else {
+        WorkerContextExecutionProxy* currentContext =
+        WorkerContextExecutionProxy::retrieve();
+        if (!currentContext) {
+            ASSERT_NOT_REACHED();
+            return 0;
+        }
+
+        DedicatedWorkerThread* thread =
+        static_cast<DedicatedWorkerThread*>(currentContext->workerContext()->thread());
+        WorkerObjectProxy* workerObjectProxy = &thread->workerObjectProxy();
+        WebWorkerImpl* impl = reinterpret_cast<WebWorkerImpl*>(workerObjectProxy);
+        webWorker = impl->client()->createWorker(proxy);
+    }
+
+    proxy->setWebWorker(webWorker);
+    return proxy;
+}
+
+WebWorkerClientImpl::WebWorkerClientImpl(Worker* worker)
+    : m_scriptExecutionContext(worker->scriptExecutionContext())
+    , m_worker(worker)
+    , m_askedToTerminate(false)
+    , m_unconfirmedMessageCount(0)
+    , m_workerContextHadPendingActivity(false)
+    , m_workerThreadId(currentThread())
+{
+}
+
+WebWorkerClientImpl::~WebWorkerClientImpl()
+{
+}
+
+void WebWorkerClientImpl::setWebWorker(WebWorker* webWorker)
+{
+    m_webWorker = webWorker;
+}
+
+void WebWorkerClientImpl::startWorkerContext(const KURL& scriptURL,
+                                             const String& userAgent,
+                                             const String& sourceCode)
+{
+    // Worker.terminate() could be called from JS before the context is started.
+    if (m_askedToTerminate)
+        return;
+    if (!isMainThread()) {
+        WebWorkerBase::dispatchTaskToMainThread(createCallbackTask(
+            &startWorkerContextTask,
+            this,
+            scriptURL.string(),
+            userAgent,
+            sourceCode));
+        return;
+    }
+    m_webWorker->startWorkerContext(scriptURL, userAgent, sourceCode);
+}
+
+void WebWorkerClientImpl::terminateWorkerContext()
+{
+    if (m_askedToTerminate)
+        return;
+    m_askedToTerminate = true;
+    if (!isMainThread()) {
+        WebWorkerBase::dispatchTaskToMainThread(createCallbackTask(&terminateWorkerContextTask, this));
+        return;
+    }
+    m_webWorker->terminateWorkerContext();
+}
+
+void WebWorkerClientImpl::postMessageToWorkerContext(
+    PassRefPtr<SerializedScriptValue> message,
+    PassOwnPtr<MessagePortChannelArray> channels)
+{
+    // Worker.terminate() could be called from JS before the context is started.
+    if (m_askedToTerminate)
+        return;
+    ++m_unconfirmedMessageCount;
+    if (!isMainThread()) {
+        WebWorkerBase::dispatchTaskToMainThread(createCallbackTask(&postMessageToWorkerContextTask,
+                                                                   this,
+                                                                   message->toString(),
+                                                                   channels));
+        return;
+    }
+    WebMessagePortChannelArray webChannels(channels.get() ? channels->size() : 0);
+    for (size_t i = 0; i < webChannels.size(); ++i) {
+        WebMessagePortChannel* webchannel =
+                        (*channels)[i]->channel()->webChannelRelease();
+        webchannel->setClient(0);
+        webChannels[i] = webchannel;
+    }
+    m_webWorker->postMessageToWorkerContext(message->toString(), webChannels);
+}
+
+bool WebWorkerClientImpl::hasPendingActivity() const
+{
+    return !m_askedToTerminate
+           && (m_unconfirmedMessageCount || m_workerContextHadPendingActivity);
+}
+
+void WebWorkerClientImpl::workerObjectDestroyed()
+{
+    if (isMainThread()) {
+        m_webWorker->workerObjectDestroyed();
+        m_worker = 0;
+    }
+    // Even if this is called on the main thread, there could be a queued task for
+    // this object, so don't delete it right away.
+    WebWorkerBase::dispatchTaskToMainThread(createCallbackTask(&workerObjectDestroyedTask,
+                                                               this));
+}
+
+void WebWorkerClientImpl::postMessageToWorkerObject(const WebString& message,
+                                                    const WebMessagePortChannelArray& channels)
+{
+    OwnPtr<MessagePortChannelArray> channels2;
+    if (channels.size()) {
+        channels2 = new MessagePortChannelArray(channels.size());
+        for (size_t i = 0; i < channels.size(); ++i) {
+            RefPtr<PlatformMessagePortChannel> platform_channel =
+                            PlatformMessagePortChannel::create(channels[i]);
+            channels[i]->setClient(platform_channel.get());
+            (*channels2)[i] = MessagePortChannel::create(platform_channel);
+        }
+    }
+
+    if (currentThread() != m_workerThreadId) {
+        m_scriptExecutionContext->postTask(createCallbackTask(&postMessageToWorkerObjectTask,
+                                                              this,
+                                                              String(message),
+                                                              channels2.release()));
+        return;
+    }
+
+    postMessageToWorkerObjectTask(m_scriptExecutionContext.get(), this,
+                                  message, channels2.release());
+}
+
+void WebWorkerClientImpl::postExceptionToWorkerObject(const WebString& errorMessage,
+                                                      int lineNumber,
+                                                      const WebString& sourceURL)
+{
+    if (currentThread() != m_workerThreadId) {
+        m_scriptExecutionContext->postTask(createCallbackTask(&postExceptionToWorkerObjectTask,
+                                                              this,
+                                                              String(errorMessage),
+                                                              lineNumber,
+                                                              String(sourceURL)));
+        return;
+    }
+
+    bool handled = false;
+    handled = m_worker->dispatchEvent(ErrorEvent::create(errorMessage,
+                                                         sourceURL,
+                                                         lineNumber));
+    if (!handled)
+        m_scriptExecutionContext->reportException(errorMessage, lineNumber, sourceURL);
+}
+
+void WebWorkerClientImpl::postConsoleMessageToWorkerObject(int destinationId,
+                                                           int sourceId,
+                                                           int messageType,
+                                                           int messageLevel,
+                                                           const WebString& message,
+                                                           int lineNumber,
+                                                           const WebString& sourceURL)
+{
+    if (currentThread() != m_workerThreadId) {
+        m_scriptExecutionContext->postTask(createCallbackTask(&postConsoleMessageToWorkerObjectTask,
+                                                              this,
+                                                              destinationId,
+                                                              sourceId,
+                                                              messageType,
+                                                              messageLevel,
+                                                              String(message),
+                                                              lineNumber,
+                                                              String(sourceURL)));
+        return;
+    }
+
+    m_scriptExecutionContext->addMessage(static_cast<MessageDestination>(destinationId),
+                                         static_cast<MessageSource>(sourceId),
+                                         static_cast<MessageType>(messageType),
+                                         static_cast<MessageLevel>(messageLevel),
+                                         String(message), lineNumber,
+                                         String(sourceURL));
+}
+
+void WebWorkerClientImpl::confirmMessageFromWorkerObject(bool hasPendingActivity)
+{
+    // unconfirmed_message_count_ can only be updated on the thread where it's
+    // accessed.  Otherwise there are race conditions with v8's garbage
+    // collection.
+    m_scriptExecutionContext->postTask(createCallbackTask(&confirmMessageFromWorkerObjectTask,
+                                                          this));
+}
+
+void WebWorkerClientImpl::reportPendingActivity(bool hasPendingActivity)
+{
+    // See above comment in confirmMessageFromWorkerObject.
+    m_scriptExecutionContext->postTask(createCallbackTask(&reportPendingActivityTask,
+                                                          this,
+                                                          hasPendingActivity));
+}
+
+void WebWorkerClientImpl::workerContextDestroyed()
+{
+}
+
+void WebWorkerClientImpl::workerContextClosed()
+{
+}
+
+void WebWorkerClientImpl::startWorkerContextTask(ScriptExecutionContext* context,
+                                                 WebWorkerClientImpl* thisPtr,
+                                                 const String& scriptURL,
+                                                 const String& userAgent,
+                                                 const String& sourceCode)
+{
+    thisPtr->m_webWorker->startWorkerContext(KURL(ParsedURLString, scriptURL),
+                                             userAgent, sourceCode);
+}
+
+void WebWorkerClientImpl::terminateWorkerContextTask(ScriptExecutionContext* context,
+                                                     WebWorkerClientImpl* thisPtr)
+{
+    thisPtr->m_webWorker->terminateWorkerContext();
+}
+
+void WebWorkerClientImpl::postMessageToWorkerContextTask(ScriptExecutionContext* context,
+                                                         WebWorkerClientImpl* thisPtr,
+                                                         const String& message,
+                                                         PassOwnPtr<MessagePortChannelArray> channels)
+{
+    WebMessagePortChannelArray webChannels(channels.get() ? channels->size() : 0);
+
+    for (size_t i = 0; i < webChannels.size(); ++i) {
+        webChannels[i] = (*channels)[i]->channel()->webChannelRelease();
+        webChannels[i]->setClient(0);
+    }
+
+    thisPtr->m_webWorker->postMessageToWorkerContext(message, webChannels);
+}
+
+void WebWorkerClientImpl::workerObjectDestroyedTask(ScriptExecutionContext* context,
+                                                    WebWorkerClientImpl* thisPtr)
+{
+    if (thisPtr->m_worker) // Check we haven't alread called this.
+        thisPtr->m_webWorker->workerObjectDestroyed();
+    delete thisPtr;
+}
+
+void WebWorkerClientImpl::postMessageToWorkerObjectTask(
+                                                        ScriptExecutionContext* context,
+                                                        WebWorkerClientImpl* thisPtr,
+                                                        const String& message,
+                                                        PassOwnPtr<MessagePortChannelArray> channels)
+{
+
+    if (thisPtr->m_worker) {
+        OwnPtr<MessagePortArray> ports =
+            MessagePort::entanglePorts(*context, channels.release());
+        RefPtr<SerializedScriptValue> serializedMessage =
+            SerializedScriptValue::create(message);
+        thisPtr->m_worker->dispatchEvent(MessageEvent::create(ports.release(),
+                                                              serializedMessage.release()));
+    }
+}
+
+void WebWorkerClientImpl::postExceptionToWorkerObjectTask(
+                                                          ScriptExecutionContext* context,
+                                                          WebWorkerClientImpl* thisPtr,
+                                                          const String& errorMessage,
+                                                          int lineNumber,
+                                                          const String& sourceURL)
+{
+    bool handled = false;
+    if (thisPtr->m_worker)
+        handled = thisPtr->m_worker->dispatchEvent(ErrorEvent::create(errorMessage,
+                                                                      sourceURL,
+                                                                      lineNumber));
+    if (!handled)
+        thisPtr->m_scriptExecutionContext->reportException(errorMessage,
+                                                           lineNumber,
+                                                           sourceURL);
+}
+
+void WebWorkerClientImpl::postConsoleMessageToWorkerObjectTask(ScriptExecutionContext* context,
+                                                               WebWorkerClientImpl* thisPtr,
+                                                               int destinationId,
+                                                               int sourceId,
+                                                               int messageType,
+                                                               int messageLevel,
+                                                               const String& message,
+                                                               int lineNumber,
+                                                               const String& sourceURL)
+{
+    thisPtr->m_scriptExecutionContext->addMessage(static_cast<MessageDestination>(destinationId),
+                                                  static_cast<MessageSource>(sourceId),
+                                                  static_cast<MessageType>(messageType),
+                                                  static_cast<MessageLevel>(messageLevel),
+                                                  message, lineNumber,
+                                                  sourceURL);
+}
+
+void WebWorkerClientImpl::confirmMessageFromWorkerObjectTask(ScriptExecutionContext* context,
+                                                             WebWorkerClientImpl* thisPtr)
+{
+    thisPtr->m_unconfirmedMessageCount--;
+}
+
+void WebWorkerClientImpl::reportPendingActivityTask(ScriptExecutionContext* context,
+                                                    WebWorkerClientImpl* thisPtr,
+                                                    bool hasPendingActivity)
+{
+    thisPtr->m_workerContextHadPendingActivity = hasPendingActivity;
+}
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WebWorkerClientImpl.h b/WebKit/chromium/src/WebWorkerClientImpl.h
new file mode 100644
index 0000000..63acebc
--- /dev/null
+++ b/WebKit/chromium/src/WebWorkerClientImpl.h
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebWorkerClientImpl_h
+#define WebWorkerClientImpl_h
+
+#if ENABLE(WORKERS)
+
+// FIXME: fix to just "WebWorkerClient.h" once nobody in glue depends on us.
+#include "../public/WebWorkerClient.h"
+
+#include "WorkerContextProxy.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+class ScriptExecutionContext;
+}
+
+namespace WebKit {
+class WebWorker;
+
+// The purpose of this class is to provide a WorkerContextProxy
+// implementation that we can give to WebKit.  Internally, it converts the
+// data types to Chrome compatible ones so that renderer code can use it over
+// IPC.
+class WebWorkerClientImpl : public WebCore::WorkerContextProxy
+                          , public WebWorkerClient {
+public:
+    WebWorkerClientImpl(WebCore::Worker*);
+
+    // WebCore::WorkerContextProxy Factory.
+    static WebCore::WorkerContextProxy* createWorkerContextProxy(WebCore::Worker*);
+    void setWebWorker(WebWorker*);
+
+    // WebCore::WorkerContextProxy methods:
+    // These are called on the thread that created the worker.  In the renderer
+    // process, this will be the main WebKit thread.  In the worker process, this
+    // will be the thread of the executing worker (not the main WebKit thread).
+    virtual void startWorkerContext(const WebCore::KURL&,
+                                    const WebCore::String&,
+                                    const WebCore::String&);
+    virtual void terminateWorkerContext();
+    virtual void postMessageToWorkerContext(
+        PassRefPtr<WebCore::SerializedScriptValue> message,
+        PassOwnPtr<WebCore::MessagePortChannelArray> channels);
+    virtual bool hasPendingActivity() const;
+    virtual void workerObjectDestroyed();
+
+    // WebWorkerClient methods:
+    // These are called on the main WebKit thread.
+    virtual void postMessageToWorkerObject(const WebString&, const WebMessagePortChannelArray&);
+    virtual void postExceptionToWorkerObject(const WebString&, int, const WebString&);
+    virtual void postConsoleMessageToWorkerObject(int, int, int, int, const WebString&,
+                                                  int, const WebString&);
+    virtual void confirmMessageFromWorkerObject(bool);
+    virtual void reportPendingActivity(bool);
+    virtual void workerContextClosed();
+    virtual void workerContextDestroyed();
+    virtual WebWorker* createWorker(WebWorkerClient*) { return 0; }
+    virtual WebNotificationPresenter* notificationPresenter()
+    {
+        // FIXME: Notifications not yet supported in workers.
+        return 0;
+    }
+
+private:
+    virtual ~WebWorkerClientImpl();
+
+    // Methods used to support WebWorkerClientImpl being constructed on worker
+    // threads.
+    // These tasks are dispatched on the WebKit thread.
+    static void startWorkerContextTask(WebCore::ScriptExecutionContext* context,
+                                       WebWorkerClientImpl* thisPtr,
+                                       const WebCore::String& scriptURL,
+                                       const WebCore::String& userAgent,
+                                       const WebCore::String& sourceCode);
+    static void terminateWorkerContextTask(WebCore::ScriptExecutionContext* context,
+                                           WebWorkerClientImpl* thisPtr);
+    static void postMessageToWorkerContextTask(WebCore::ScriptExecutionContext* context,
+                                               WebWorkerClientImpl* thisPtr,
+                                               const WebCore::String& message,
+                                               PassOwnPtr<WebCore::MessagePortChannelArray> channels);
+    static void workerObjectDestroyedTask(WebCore::ScriptExecutionContext* context,
+                                          WebWorkerClientImpl* thisPtr);
+
+    // These tasks are dispatched on the thread that created the worker (i.e.
+    // main WebKit thread in renderer process, and the worker thread in the
+    // worker process).
+    static void postMessageToWorkerObjectTask(WebCore::ScriptExecutionContext* context,
+                                              WebWorkerClientImpl* thisPtr,
+                                              const WebCore::String& message,
+                                              PassOwnPtr<WebCore::MessagePortChannelArray> channels);
+    static void postExceptionToWorkerObjectTask(WebCore::ScriptExecutionContext* context,
+                                                WebWorkerClientImpl* thisPtr,
+                                                const WebCore::String& message,
+                                                int lineNumber,
+                                                const WebCore::String& sourceURL);
+    static void postConsoleMessageToWorkerObjectTask(WebCore::ScriptExecutionContext* context,
+                                                     WebWorkerClientImpl* thisPtr,
+                                                     int destinationId,
+                                                     int sourceId,
+                                                     int messageType,
+                                                     int messageLevel,
+                                                     const WebCore::String& message,
+                                                     int lineNumber,
+                                                     const WebCore::String& sourceURL);
+    static void confirmMessageFromWorkerObjectTask(WebCore::ScriptExecutionContext* context,
+                                                   WebWorkerClientImpl* thisPtr);
+    static void reportPendingActivityTask(WebCore::ScriptExecutionContext* context,
+                                          WebWorkerClientImpl* thisPtr,
+                                          bool hasPendingActivity);
+
+    // Guard against context from being destroyed before a worker exits.
+    RefPtr<WebCore::ScriptExecutionContext> m_scriptExecutionContext;
+
+    WebCore::Worker* m_worker;
+    WebWorker* m_webWorker;
+    bool m_askedToTerminate;
+    unsigned m_unconfirmedMessageCount;
+    bool m_workerContextHadPendingActivity;
+    ThreadIdentifier m_workerThreadId;
+};
+
+} // namespace WebKit;
+
+#endif // ENABLE(WORKERS)
+
+#endif
diff --git a/WebKit/chromium/src/WebWorkerImpl.cpp b/WebKit/chromium/src/WebWorkerImpl.cpp
new file mode 100644
index 0000000..744be30
--- /dev/null
+++ b/WebKit/chromium/src/WebWorkerImpl.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebWorkerImpl.h"
+
+#include "DedicatedWorkerContext.h"
+#include "DedicatedWorkerThread.h"
+#include "GenericWorkerTask.h"
+#include "KURL.h"
+#include "MessageEvent.h"
+#include "MessagePort.h"
+#include "MessagePortChannel.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+#include "SerializedScriptValue.h"
+#include "SubstituteData.h"
+#include <wtf/Threading.h>
+
+#include "PlatformMessagePortChannel.h"
+#include "WebMessagePortChannel.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebWorkerClient.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+#if ENABLE(WORKERS)
+
+WebWorker* WebWorker::create(WebWorkerClient* client)
+{
+    return new WebWorkerImpl(client);
+}
+
+
+WebWorkerImpl::WebWorkerImpl(WebWorkerClient* client)
+    : m_client(client)
+{
+}
+
+WebWorkerImpl::~WebWorkerImpl()
+{
+}
+
+WebCommonWorkerClient* WebWorkerImpl::commonClient()
+{
+    return m_client;
+}
+
+void WebWorkerImpl::postMessageToWorkerContextTask(WebCore::ScriptExecutionContext* context,
+                                                   WebWorkerImpl* thisPtr,
+                                                   const String& message,
+                                                   PassOwnPtr<MessagePortChannelArray> channels)
+{
+    ASSERT(context->isWorkerContext());
+    DedicatedWorkerContext* workerContext =
+        static_cast<DedicatedWorkerContext*>(context);
+
+    OwnPtr<MessagePortArray> ports =
+        MessagePort::entanglePorts(*context, channels.release());
+    RefPtr<SerializedScriptValue> serializedMessage =
+        SerializedScriptValue::create(message);
+    workerContext->dispatchEvent(MessageEvent::create(
+        ports.release(), serializedMessage.release()));
+    thisPtr->confirmMessageFromWorkerObject(workerContext->hasPendingActivity());
+}
+
+// WebWorker -------------------------------------------------------------------
+
+void WebWorkerImpl::startWorkerContext(const WebURL& scriptUrl,
+                                       const WebString& userAgent,
+                                       const WebString& sourceCode)
+{
+    initializeLoader(scriptUrl);
+    setWorkerThread(DedicatedWorkerThread::create(scriptUrl, userAgent,
+                                                  sourceCode, *this, *this));
+    // Worker initialization means a pending activity.
+    reportPendingActivity(true);
+    workerThread()->start();
+}
+
+void WebWorkerImpl::terminateWorkerContext()
+{
+    stopWorkerThread();
+}
+
+void WebWorkerImpl::postMessageToWorkerContext(const WebString& message,
+                                               const WebMessagePortChannelArray& webChannels)
+{
+    OwnPtr<MessagePortChannelArray> channels;
+    if (webChannels.size()) {
+        channels = new MessagePortChannelArray(webChannels.size());
+        for (size_t i = 0; i < webChannels.size(); ++i) {
+            RefPtr<PlatformMessagePortChannel> platform_channel =
+                PlatformMessagePortChannel::create(webChannels[i]);
+            webChannels[i]->setClient(platform_channel.get());
+            (*channels)[i] = MessagePortChannel::create(platform_channel);
+        }
+    }
+
+    workerThread()->runLoop().postTask(
+        createCallbackTask(&postMessageToWorkerContextTask,
+                           this, String(message), channels.release()));
+}
+
+void WebWorkerImpl::workerObjectDestroyed()
+{
+    // Worker object in the renderer was destroyed, perhaps a result of GC.
+    // For us, it's a signal to start terminating the WorkerContext too.
+    // FIXME: when 'kill a worker' html5 spec algorithm is implemented, it
+    // should be used here instead of 'terminate a worker'.
+    terminateWorkerContext();
+}
+
+void WebWorkerImpl::clientDestroyed()
+{
+    m_client = 0;
+}
+
+#else
+
+WebWorker* WebWorker::create(WebWorkerClient* client)
+{
+    return 0;
+}
+
+#endif // ENABLE(WORKERS)
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebWorkerImpl.h b/WebKit/chromium/src/WebWorkerImpl.h
new file mode 100644
index 0000000..bec96cd
--- /dev/null
+++ b/WebKit/chromium/src/WebWorkerImpl.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebWorkerImpl_h
+#define WebWorkerImpl_h
+
+#include "WebWorker.h"
+
+#if ENABLE(WORKERS)
+
+#include "ScriptExecutionContext.h"
+
+#include "WebWorkerBase.h"
+
+namespace WebKit {
+class WebView;
+
+// This class is used by the worker process code to talk to the WebCore::Worker
+// implementation.  It can't use it directly since it uses WebKit types, so this
+// class converts the data types.  When the WebCore::Worker object wants to call
+// WebCore::WorkerObjectProxy, this class will conver to Chrome data types first
+// and then call the supplied WebWorkerClient.
+class WebWorkerImpl : public WebWorkerBase, public WebWorker {
+public:
+    explicit WebWorkerImpl(WebWorkerClient* client);
+
+    // WebWorker methods:
+    virtual void startWorkerContext(const WebURL&, const WebString&, const WebString&);
+    virtual void terminateWorkerContext();
+    virtual void postMessageToWorkerContext(const WebString&, const WebMessagePortChannelArray&);
+    virtual void workerObjectDestroyed();
+    virtual void clientDestroyed();
+
+    // WebWorkerBase methods:
+    virtual WebWorkerClient* client() { return m_client; }
+    virtual WebCommonWorkerClient* commonClient();
+
+private:
+    virtual ~WebWorkerImpl();
+
+    // Tasks that are run on the worker thread.
+    static void postMessageToWorkerContextTask(
+        WebCore::ScriptExecutionContext* context,
+        WebWorkerImpl* thisPtr,
+        const WebCore::String& message,
+        PassOwnPtr<WebCore::MessagePortChannelArray> channels);
+
+    WebWorkerClient* m_client;
+
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(WORKERS)
+
+#endif
diff --git a/WebKit/chromium/src/WrappedResourceRequest.h b/WebKit/chromium/src/WrappedResourceRequest.h
new file mode 100644
index 0000000..97311db
--- /dev/null
+++ b/WebKit/chromium/src/WrappedResourceRequest.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WrappedResourceRequest_h
+#define WrappedResourceRequest_h
+
+// FIXME: This relative path is a temporary hack to support using this
+// header from webkit/glue.
+#include "../public/WebURLRequest.h"
+#include "WebURLRequestPrivate.h"
+
+namespace WebKit {
+
+class WrappedResourceRequest : public WebURLRequest {
+public:
+    ~WrappedResourceRequest()
+    {
+        reset(); // Need to drop reference to m_handle
+    }
+
+    WrappedResourceRequest() { }
+
+    WrappedResourceRequest(WebCore::ResourceRequest& resourceRequest)
+    {
+        bind(resourceRequest);
+    }
+
+    WrappedResourceRequest(const WebCore::ResourceRequest& resourceRequest)
+    {
+        bind(resourceRequest);
+    }
+
+    void bind(WebCore::ResourceRequest& resourceRequest)
+    {
+        m_handle.m_resourceRequest = &resourceRequest;
+        assign(&m_handle);
+    }
+
+    void bind(const WebCore::ResourceRequest& resourceRequest)
+    {
+        bind(*const_cast<WebCore::ResourceRequest*>(&resourceRequest));
+    }
+
+private:
+    class Handle : public WebURLRequestPrivate {
+    public:
+        virtual void dispose() { m_resourceRequest = 0; }
+    };
+
+    Handle m_handle;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/WrappedResourceResponse.h b/WebKit/chromium/src/WrappedResourceResponse.h
new file mode 100644
index 0000000..af4f88f
--- /dev/null
+++ b/WebKit/chromium/src/WrappedResourceResponse.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WrappedResourceResponse_h
+#define WrappedResourceResponse_h
+
+// FIXME: This relative path is a temporary hack to support using this
+// header from webkit/glue.
+#include "../public/WebURLResponse.h"
+#include "WebURLResponsePrivate.h"
+
+namespace WebKit {
+
+class WrappedResourceResponse : public WebURLResponse {
+public:
+    ~WrappedResourceResponse()
+    {
+        reset(); // Need to drop reference to m_handle
+    }
+
+    WrappedResourceResponse() { }
+
+    WrappedResourceResponse(WebCore::ResourceResponse& resourceResponse)
+    {
+        bind(resourceResponse);
+    }
+
+    WrappedResourceResponse(const WebCore::ResourceResponse& resourceResponse)
+    {
+        bind(resourceResponse);
+    }
+
+    void bind(WebCore::ResourceResponse& resourceResponse)
+    {
+        m_handle.m_resourceResponse = &resourceResponse;
+        assign(&m_handle);
+    }
+
+    void bind(const WebCore::ResourceResponse& resourceResponse)
+    {
+        bind(*const_cast<WebCore::ResourceResponse*>(&resourceResponse));
+    }
+
+private:
+    class Handle : public WebURLResponsePrivate {
+    public:
+        virtual void dispose() { m_resourceResponse = 0; }
+    };
+
+    Handle m_handle;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/src/gtk/WebFontInfo.cpp b/WebKit/chromium/src/gtk/WebFontInfo.cpp
new file mode 100644
index 0000000..76ed618
--- /dev/null
+++ b/WebKit/chromium/src/gtk/WebFontInfo.cpp
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebFontInfo.h"
+
+#include <fontconfig/fontconfig.h>
+#include <string.h>
+#include <unicode/utf16.h>
+
+namespace WebKit {
+
+WebCString WebFontInfo::familyForChars(const WebUChar* characters, size_t numCharacters)
+{
+    FcCharSet* cset = FcCharSetCreate();
+    for (size_t i = 0; i < numCharacters; ++i) {
+        if (U16_IS_SURROGATE(characters[i])
+         && U16_IS_SURROGATE_LEAD(characters[i])
+         && i != numCharacters - 1
+         && U16_IS_TRAIL(characters[i + 1])) {
+              FcCharSetAddChar(cset, U16_GET_SUPPLEMENTARY(characters[i], characters[i+1]));
+          i++;
+        } else
+              FcCharSetAddChar(cset, characters[i]);
+    }
+    FcPattern* pattern = FcPatternCreate();
+
+    FcValue fcvalue;
+    fcvalue.type = FcTypeCharSet;
+    fcvalue.u.c = cset;
+    FcPatternAdd(pattern, FC_CHARSET, fcvalue, 0);
+
+    fcvalue.type = FcTypeBool;
+    fcvalue.u.b = FcTrue;
+    FcPatternAdd(pattern, FC_SCALABLE, fcvalue, 0);
+
+    FcConfigSubstitute(0, pattern, FcMatchPattern);
+    FcDefaultSubstitute(pattern);
+
+    FcResult result;
+    FcFontSet* fontSet = FcFontSort(0, pattern, 0, 0, &result);
+    FcPatternDestroy(pattern);
+    FcCharSetDestroy(cset);
+
+    if (!fontSet)
+        return WebCString();
+
+    // Older versions of fontconfig have a bug where they cannot select
+    // only scalable fonts so we have to manually filter the results.
+    for (int i = 0; i < fontSet->nfont; ++i) {
+        FcPattern* current = fontSet->fonts[i];
+        FcBool isScalable;
+
+        if (FcPatternGetBool(current, FC_SCALABLE, 0, &isScalable) != FcResultMatch
+            || !isScalable)
+            continue;
+
+        // fontconfig can also return fonts which are unreadable
+        FcChar8* cFilename;
+        if (FcPatternGetString(current, FC_FILE, 0, &cFilename) != FcResultMatch)
+            continue;
+
+        if (access(reinterpret_cast<char*>(cFilename), R_OK))
+            continue;
+
+        FcChar8* family;
+        WebCString result;
+        if (FcPatternGetString(current, FC_FAMILY, 0, &family) == FcResultMatch) {
+            const char* charFamily = reinterpret_cast<char*>(family);
+            result = WebCString(charFamily, strlen(charFamily));
+        }
+        FcFontSetDestroy(fontSet);
+        return result;
+    }
+
+    FcFontSetDestroy(fontSet);
+    return WebCString();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/gtk/WebInputEventFactory.cpp b/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
new file mode 100644
index 0000000..7125a16
--- /dev/null
+++ b/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
@@ -0,0 +1,496 @@
+/*
+ * Copyright (C) 2006-2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebInputEventFactory.h"
+
+#include "KeyboardCodes.h"
+#include "KeyCodeConversion.h"
+
+#include "WebInputEvent.h"
+
+#include <gdk/gdk.h>
+#include <gdk/gdkkeysyms.h>
+#include <gtk/gtk.h>
+#include <gtk/gtkversion.h>
+
+#include <wtf/Assertions.h>
+
+namespace {
+
+gint getDoubleClickTime()
+{
+    static GtkSettings* settings = gtk_settings_get_default();
+    gint doubleClickTime = 250;
+    g_object_get(G_OBJECT(settings), "gtk-double-click-time", &doubleClickTime, 0);
+    return doubleClickTime;
+}
+
+}  // namespace
+
+namespace WebKit {
+
+static double gdkEventTimeToWebEventTime(guint32 time)
+{
+    // Convert from time in ms to time in sec.
+    return time / 1000.0;
+}
+
+static int gdkStateToWebEventModifiers(guint state)
+{
+    int modifiers = 0;
+    if (state & GDK_SHIFT_MASK)
+        modifiers |= WebInputEvent::ShiftKey;
+    if (state & GDK_CONTROL_MASK)
+        modifiers |= WebInputEvent::ControlKey;
+    if (state & GDK_MOD1_MASK)
+        modifiers |= WebInputEvent::AltKey;
+#if GTK_CHECK_VERSION(2, 10, 0)
+    if (state & GDK_META_MASK)
+        modifiers |= WebInputEvent::MetaKey;
+#endif
+    if (state & GDK_BUTTON1_MASK)
+        modifiers |= WebInputEvent::LeftButtonDown;
+    if (state & GDK_BUTTON2_MASK)
+        modifiers |= WebInputEvent::MiddleButtonDown;
+    if (state & GDK_BUTTON3_MASK)
+        modifiers |= WebInputEvent::RightButtonDown;
+    return modifiers;
+}
+
+static int gdkEventToWindowsKeyCode(const GdkEventKey* event)
+{
+    static const unsigned int hardwareCodeToGDKKeyval[] = {
+        0,                 // 0x00:
+        0,                 // 0x01:
+        0,                 // 0x02:
+        0,                 // 0x03:
+        0,                 // 0x04:
+        0,                 // 0x05:
+        0,                 // 0x06:
+        0,                 // 0x07:
+        0,                 // 0x08:
+        0,                 // 0x09: GDK_Escape
+        GDK_1,             // 0x0A: GDK_1
+        GDK_2,             // 0x0B: GDK_2
+        GDK_3,             // 0x0C: GDK_3
+        GDK_4,             // 0x0D: GDK_4
+        GDK_5,             // 0x0E: GDK_5
+        GDK_6,             // 0x0F: GDK_6
+        GDK_7,             // 0x10: GDK_7
+        GDK_8,             // 0x11: GDK_8
+        GDK_9,             // 0x12: GDK_9
+        GDK_0,             // 0x13: GDK_0
+        GDK_minus,         // 0x14: GDK_minus
+        GDK_equal,         // 0x15: GDK_equal
+        0,                 // 0x16: GDK_BackSpace
+        0,                 // 0x17: GDK_Tab
+        GDK_q,             // 0x18: GDK_q
+        GDK_w,             // 0x19: GDK_w
+        GDK_e,             // 0x1A: GDK_e
+        GDK_r,             // 0x1B: GDK_r
+        GDK_t,             // 0x1C: GDK_t
+        GDK_y,             // 0x1D: GDK_y
+        GDK_u,             // 0x1E: GDK_u
+        GDK_i,             // 0x1F: GDK_i
+        GDK_o,             // 0x20: GDK_o
+        GDK_p,             // 0x21: GDK_p
+        GDK_bracketleft,   // 0x22: GDK_bracketleft
+        GDK_bracketright,  // 0x23: GDK_bracketright
+        0,                 // 0x24: GDK_Return
+        0,                 // 0x25: GDK_Control_L
+        GDK_a,             // 0x26: GDK_a
+        GDK_s,             // 0x27: GDK_s
+        GDK_d,             // 0x28: GDK_d
+        GDK_f,             // 0x29: GDK_f
+        GDK_g,             // 0x2A: GDK_g
+        GDK_h,             // 0x2B: GDK_h
+        GDK_j,             // 0x2C: GDK_j
+        GDK_k,             // 0x2D: GDK_k
+        GDK_l,             // 0x2E: GDK_l
+        GDK_semicolon,     // 0x2F: GDK_semicolon
+        GDK_apostrophe,    // 0x30: GDK_apostrophe
+        GDK_grave,         // 0x31: GDK_grave
+        0,                 // 0x32: GDK_Shift_L
+        GDK_backslash,     // 0x33: GDK_backslash
+        GDK_z,             // 0x34: GDK_z
+        GDK_x,             // 0x35: GDK_x
+        GDK_c,             // 0x36: GDK_c
+        GDK_v,             // 0x37: GDK_v
+        GDK_b,             // 0x38: GDK_b
+        GDK_n,             // 0x39: GDK_n
+        GDK_m,             // 0x3A: GDK_m
+        GDK_comma,         // 0x3B: GDK_comma
+        GDK_period,        // 0x3C: GDK_period
+        GDK_slash,         // 0x3D: GDK_slash
+        0,                 // 0x3E: GDK_Shift_R
+    };
+
+    // |windowsKeyCode| has to include a valid virtual-key code even when we
+    // use non-US layouts, e.g. even when we type an 'A' key of a US keyboard
+    // on the Hebrew layout, |windowsKeyCode| should be VK_A.
+    // On the other hand, |event->keyval| value depends on the current
+    // GdkKeymap object, i.e. when we type an 'A' key of a US keyboard on
+    // the Hebrew layout, |event->keyval| becomes GDK_hebrew_shin and this
+    // WebCore::windowsKeyCodeForKeyEvent() call returns 0.
+    // To improve compatibilty with Windows, we use |event->hardware_keycode|
+    // for retrieving its Windows key-code for the keys when the
+    // WebCore::windowsKeyCodeForEvent() call returns 0.
+    // We shouldn't use |event->hardware_keycode| for keys that GdkKeymap
+    // objects cannot change because |event->hardware_keycode| doesn't change
+    // even when we change the layout options, e.g. when we swap a control
+    // key and a caps-lock key, GTK doesn't swap their
+    // |event->hardware_keycode| values but swap their |event->keyval| values.
+    int windowsKeyCode = WebCore::windowsKeyCodeForKeyEvent(event->keyval);
+    if (windowsKeyCode)
+        return windowsKeyCode;
+
+    const int tableSize = sizeof(hardwareCodeToGDKKeyval) / sizeof(hardwareCodeToGDKKeyval[0]);
+    if (event->hardware_keycode < tableSize) {
+        int keyval = hardwareCodeToGDKKeyval[event->hardware_keycode];
+        if (keyval)
+            return WebCore::windowsKeyCodeForKeyEvent(keyval);
+    }
+
+    // This key is one that keyboard-layout drivers cannot change.
+    // Use |event->keyval| to retrieve its |windowsKeyCode| value.
+    return WebCore::windowsKeyCodeForKeyEvent(event->keyval);
+}
+
+// Gets the corresponding control character of a specified key code. See:
+// http://en.wikipedia.org/wiki/Control_characters
+// We emulate Windows behavior here.
+static WebUChar getControlCharacter(int windowsKeyCode, bool shift)
+{
+    if (windowsKeyCode >= WebCore::VKEY_A && windowsKeyCode <= WebCore::VKEY_Z) {
+        // ctrl-A ~ ctrl-Z map to \x01 ~ \x1A
+        return windowsKeyCode - WebCore::VKEY_A + 1;
+    }
+    if (shift) {
+        // following graphics chars require shift key to input.
+        switch (windowsKeyCode) {
+        // ctrl-@ maps to \x00 (Null byte)
+        case WebCore::VKEY_2:
+            return 0;
+        // ctrl-^ maps to \x1E (Record separator, Information separator two)
+        case WebCore::VKEY_6:
+            return 0x1E;
+        // ctrl-_ maps to \x1F (Unit separator, Information separator one)
+        case WebCore::VKEY_OEM_MINUS:
+            return 0x1F;
+        // Returns 0 for all other keys to avoid inputting unexpected chars.
+        default:
+            return 0;
+        }
+    } else {
+        switch (windowsKeyCode) {
+        // ctrl-[ maps to \x1B (Escape)
+        case WebCore::VKEY_OEM_4:
+            return 0x1B;
+        // ctrl-\ maps to \x1C (File separator, Information separator four)
+        case WebCore::VKEY_OEM_5:
+            return 0x1C;
+        // ctrl-] maps to \x1D (Group separator, Information separator three)
+        case WebCore::VKEY_OEM_6:
+            return 0x1D;
+        // ctrl-Enter maps to \x0A (Line feed)
+        case WebCore::VKEY_RETURN:
+            return 0x0A;
+        // Returns 0 for all other keys to avoid inputting unexpected chars.
+        default:
+            return 0;
+        }
+    }
+}
+
+// WebKeyboardEvent -----------------------------------------------------------
+
+WebKeyboardEvent WebInputEventFactory::keyboardEvent(const GdkEventKey* event)
+{
+    WebKeyboardEvent result;
+
+    result.timeStampSeconds = gdkEventTimeToWebEventTime(event->time);
+    result.modifiers = gdkStateToWebEventModifiers(event->state);
+
+    switch (event->type) {
+    case GDK_KEY_RELEASE:
+        result.type = WebInputEvent::KeyUp;
+        break;
+    case GDK_KEY_PRESS:
+        result.type = WebInputEvent::RawKeyDown;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    // According to MSDN:
+    // http://msdn.microsoft.com/en-us/library/ms646286(VS.85).aspx
+    // Key events with Alt modifier and F10 are system key events.
+    // We just emulate this behavior. It's necessary to prevent webkit from
+    // processing keypress event generated by alt-d, etc.
+    // F10 is not special on Linux, so don't treat it as system key.
+    if (result.modifiers & WebInputEvent::AltKey)
+        result.isSystemKey = true;
+
+    // The key code tells us which physical key was pressed (for example, the
+    // A key went down or up).  It does not determine whether A should be lower
+    // or upper case.  This is what text does, which should be the keyval.
+    result.windowsKeyCode = gdkEventToWindowsKeyCode(event);
+    result.nativeKeyCode = event->hardware_keycode;
+
+    if (result.windowsKeyCode == WebCore::VKEY_RETURN)
+        // We need to treat the enter key as a key press of character \r.  This
+        // is apparently just how webkit handles it and what it expects.
+        result.unmodifiedText[0] = '\r';
+    else
+        // FIXME: fix for non BMP chars
+        result.unmodifiedText[0] =
+            static_cast<WebUChar>(gdk_keyval_to_unicode(event->keyval));
+
+    // If ctrl key is pressed down, then control character shall be input.
+    if (result.modifiers & WebInputEvent::ControlKey)
+        result.text[0] = getControlCharacter(
+            result.windowsKeyCode, result.modifiers & WebInputEvent::ShiftKey);
+    else
+        result.text[0] = result.unmodifiedText[0];
+
+    result.setKeyIdentifierFromWindowsKeyCode();
+
+    // FIXME: Do we need to set IsAutoRepeat or IsKeyPad?
+
+    return result;
+}
+
+WebKeyboardEvent WebInputEventFactory::keyboardEvent(wchar_t character, int state, double timeStampSeconds)
+{
+    // keyboardEvent(const GdkEventKey*) depends on the GdkEventKey object and
+    // it is hard to use/ it from signal handlers which don't use GdkEventKey
+    // objects (e.g. GtkIMContext signal handlers.) For such handlers, this
+    // function creates a WebInputEvent::Char event without using a
+    // GdkEventKey object.
+    WebKeyboardEvent result;
+    result.type = WebKit::WebInputEvent::Char;
+    result.timeStampSeconds = timeStampSeconds;
+    result.modifiers = gdkStateToWebEventModifiers(state);
+    result.windowsKeyCode = character;
+    result.nativeKeyCode = character;
+    result.text[0] = character;
+    result.unmodifiedText[0] = character;
+
+    // According to MSDN:
+    // http://msdn.microsoft.com/en-us/library/ms646286(VS.85).aspx
+    // Key events with Alt modifier and F10 are system key events.
+    // We just emulate this behavior. It's necessary to prevent webkit from
+    // processing keypress event generated by alt-d, etc.
+    // F10 is not special on Linux, so don't treat it as system key.
+    if (result.modifiers & WebInputEvent::AltKey)
+        result.isSystemKey = true;
+
+    return result;
+}
+
+// WebMouseEvent --------------------------------------------------------------
+
+WebMouseEvent WebInputEventFactory::mouseEvent(const GdkEventButton* event)
+{
+    WebMouseEvent result;
+
+    result.timeStampSeconds = gdkEventTimeToWebEventTime(event->time);
+
+    result.modifiers = gdkStateToWebEventModifiers(event->state);
+    result.x = static_cast<int>(event->x);
+    result.y = static_cast<int>(event->y);
+    result.windowX = result.x;
+    result.windowY = result.y;
+    result.globalX = static_cast<int>(event->x_root);
+    result.globalY = static_cast<int>(event->y_root);
+    result.clickCount = 0;
+
+    switch (event->type) {
+    case GDK_BUTTON_PRESS:
+        result.type = WebInputEvent::MouseDown;
+        break;
+    case GDK_BUTTON_RELEASE:
+        result.type = WebInputEvent::MouseUp;
+        break;
+    case GDK_3BUTTON_PRESS:
+    case GDK_2BUTTON_PRESS:
+    default:
+        ASSERT_NOT_REACHED();
+    };
+
+    if (GDK_BUTTON_PRESS == event->type) {
+        static int numClicks = 0;
+        static GdkWindow* eventWindow = 0;
+        static gint lastLeftClickTime = 0;
+
+        gint time_diff = event->time - lastLeftClickTime;
+        if (eventWindow == event->window && time_diff < getDoubleClickTime())
+            numClicks++;
+        else
+            numClicks = 1;
+
+        result.clickCount = numClicks;
+        eventWindow = event->window;
+        lastLeftClickTime = event->time;
+    }
+
+    result.button = WebMouseEvent::ButtonNone;
+    if (event->button == 1)
+        result.button = WebMouseEvent::ButtonLeft;
+    else if (event->button == 2)
+        result.button = WebMouseEvent::ButtonMiddle;
+    else if (event->button == 3)
+        result.button = WebMouseEvent::ButtonRight;
+
+    return result;
+}
+
+WebMouseEvent WebInputEventFactory::mouseEvent(const GdkEventMotion* event)
+{
+    WebMouseEvent result;
+
+    result.timeStampSeconds = gdkEventTimeToWebEventTime(event->time);
+    result.modifiers = gdkStateToWebEventModifiers(event->state);
+    result.x = static_cast<int>(event->x);
+    result.y = static_cast<int>(event->y);
+    result.windowX = result.x;
+    result.windowY = result.y;
+    result.globalX = static_cast<int>(event->x_root);
+    result.globalY = static_cast<int>(event->y_root);
+
+    switch (event->type) {
+    case GDK_MOTION_NOTIFY:
+        result.type = WebInputEvent::MouseMove;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    result.button = WebMouseEvent::ButtonNone;
+    if (event->state & GDK_BUTTON1_MASK)
+        result.button = WebMouseEvent::ButtonLeft;
+    else if (event->state & GDK_BUTTON2_MASK)
+        result.button = WebMouseEvent::ButtonMiddle;
+    else if (event->state & GDK_BUTTON3_MASK)
+        result.button = WebMouseEvent::ButtonRight;
+
+    return result;
+}
+
+WebMouseEvent WebInputEventFactory::mouseEvent(const GdkEventCrossing* event)
+{
+    WebMouseEvent result;
+
+    result.timeStampSeconds = gdkEventTimeToWebEventTime(event->time);
+    result.modifiers = gdkStateToWebEventModifiers(event->state);
+    result.x = static_cast<int>(event->x);
+    result.y = static_cast<int>(event->y);
+    result.windowX = result.x;
+    result.windowY = result.y;
+    result.globalX = static_cast<int>(event->x_root);
+    result.globalY = static_cast<int>(event->y_root);
+
+    switch (event->type) {
+    case GDK_ENTER_NOTIFY:
+    case GDK_LEAVE_NOTIFY:
+        // Note that if we sent MouseEnter or MouseLeave to WebKit, it
+        // wouldn't work - they don't result in the proper JavaScript events.
+        // MouseMove does the right thing.
+        result.type = WebInputEvent::MouseMove;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    result.button = WebMouseEvent::ButtonNone;
+    if (event->state & GDK_BUTTON1_MASK)
+        result.button = WebMouseEvent::ButtonLeft;
+    else if (event->state & GDK_BUTTON2_MASK)
+        result.button = WebMouseEvent::ButtonMiddle;
+    else if (event->state & GDK_BUTTON3_MASK)
+        result.button = WebMouseEvent::ButtonRight;
+
+    return result;
+}
+
+// WebMouseWheelEvent ---------------------------------------------------------
+
+WebMouseWheelEvent WebInputEventFactory::mouseWheelEvent(const GdkEventScroll* event)
+{
+    WebMouseWheelEvent result;
+
+    result.type = WebInputEvent::MouseWheel;
+    result.button = WebMouseEvent::ButtonNone;
+
+    result.timeStampSeconds = gdkEventTimeToWebEventTime(event->time);
+    result.modifiers = gdkStateToWebEventModifiers(event->state);
+    result.x = static_cast<int>(event->x);
+    result.y = static_cast<int>(event->y);
+    result.windowX = result.x;
+    result.windowY = result.y;
+    result.globalX = static_cast<int>(event->x_root);
+    result.globalY = static_cast<int>(event->y_root);
+
+    // How much should we scroll per mouse wheel event?
+    // - Windows uses 3 lines by default and obeys a system setting.
+    // - Mozilla has a pref that lets you either use the "system" number of lines
+    //   to scroll, or lets the user override it.
+    //   For the "system" number of lines, it appears they've hardcoded 3.
+    //   See case NS_MOUSE_SCROLL in content/events/src/nsEventStateManager.cpp
+    //   and InitMouseScrollEvent in widget/src/gtk2/nsCommonWidget.cpp .
+    // - Gtk makes the scroll amount a function of the size of the scroll bar,
+    //   which is not available to us here.
+    // Instead, we pick a number that empirically matches Firefox's behavior.
+    static const float scrollbarPixelsPerTick = 160.0f / 3.0f;
+
+    switch (event->direction) {
+    case GDK_SCROLL_UP:
+        result.deltaY = scrollbarPixelsPerTick;
+        result.wheelTicksY = 1;
+        break;
+    case GDK_SCROLL_DOWN:
+        result.deltaY = -scrollbarPixelsPerTick;
+        result.wheelTicksY = -1;
+        break;
+    case GDK_SCROLL_LEFT:
+        result.deltaX = scrollbarPixelsPerTick;
+        result.wheelTicksX = 1;
+        break;
+    case GDK_SCROLL_RIGHT:
+        result.deltaX = -scrollbarPixelsPerTick;
+        result.wheelTicksX = -1;
+        break;
+    }
+
+    return result;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/gtk/WebScreenInfoFactory.cpp b/WebKit/chromium/src/gtk/WebScreenInfoFactory.cpp
new file mode 100644
index 0000000..081daa2
--- /dev/null
+++ b/WebKit/chromium/src/gtk/WebScreenInfoFactory.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebScreenInfoFactory.h"
+
+#include "WebScreenInfo.h"
+#include <gtk/gtk.h>
+
+namespace WebKit {
+
+WebScreenInfo WebScreenInfoFactory::screenInfo(GtkWidget* widget)
+{
+    WebScreenInfo results;
+    results.depth = 32;
+    results.depthPerComponent = 8;
+    results.isMonochrome = false;
+
+    if (!widget)
+        return results;
+
+    GdkScreen* screen = gtk_widget_get_screen(widget);
+
+    results.rect = WebRect(
+        0, 0, gdk_screen_get_width(screen), gdk_screen_get_height(screen));
+
+    // I don't know of a way to query the "maximize" size of the window (e.g.
+    // screen size less sidebars etc) since this is something which only the
+    // window manager knows.
+    results.availableRect = results.rect;
+
+    return results;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/linux/WebFontRendering.cpp b/WebKit/chromium/src/linux/WebFontRendering.cpp
new file mode 100644
index 0000000..b9862f5
--- /dev/null
+++ b/WebKit/chromium/src/linux/WebFontRendering.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebFontRendering.h"
+
+#include "FontPlatformData.h"
+
+using WebCore::FontPlatformData;
+
+namespace WebKit {
+
+// static
+void WebFontRendering::setHinting(SkPaint::Hinting hinting)
+{
+    FontPlatformData::setHinting(hinting);
+}
+
+// static
+void WebFontRendering::setAntiAlias(bool isAntiAlias)
+{
+    FontPlatformData::setAntiAlias(isAntiAlias);
+}
+
+// static
+void WebFontRendering::setSubpixelGlyphs(bool isSubpixelGlyphs)
+{
+    FontPlatformData::setSubpixelGlyphs(isSubpixelGlyphs);
+}
+
+// static
+void WebFontRendering::setLCDOrder(SkFontHost::LCDOrder order)
+{
+    SkFontHost::SetSubpixelOrder(order);
+}
+
+// static
+void WebFontRendering::setLCDOrientation(SkFontHost::LCDOrientation orientation)
+{
+    SkFontHost::SetSubpixelOrientation(orientation);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/mac/WebInputEventFactory.mm b/WebKit/chromium/src/mac/WebInputEventFactory.mm
new file mode 100644
index 0000000..d618228
--- /dev/null
+++ b/WebKit/chromium/src/mac/WebInputEventFactory.mm
@@ -0,0 +1,1196 @@
+/*
+ * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006-2009 Google Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebInputEventFactory.h"
+
+#include <ApplicationServices/ApplicationServices.h>
+#import <Cocoa/Cocoa.h>
+
+#include "WebInputEvent.h"
+#include <wtf/ASCIICType.h>
+
+namespace WebKit {
+
+// WebKeyboardEvent -----------------------------------------------------------
+
+// ----------------------------------------------------------------------------
+// Begin Apple code, copied from KeyEventMac.mm
+//
+// We can share some of this code if we factored it out of KeyEventMac, but
+// the main problem is that it relies on the NSString ctor on String for
+// conversions, and since we're building without PLATFORM(MAC), we don't have
+// that. As a result we have to use NSString here exclusively and thus tweak
+// the code so it's not re-usable as-is. One possiblity would be to make the
+// upstream code only use NSString, but I'm not certain how far that change
+// would propagate.
+
+static inline bool isKeyUpEvent(NSEvent* event)
+{
+    if ([event type] != NSFlagsChanged)
+        return [event type] == NSKeyUp;
+    // FIXME: This logic fails if the user presses both Shift keys at once, for example:
+    // we treat releasing one of them as keyDown.
+    switch ([event keyCode]) {
+    case 54: // Right Command
+    case 55: // Left Command
+        return ([event modifierFlags] & NSCommandKeyMask) == 0;
+
+    case 57: // Capslock
+        return ([event modifierFlags] & NSAlphaShiftKeyMask) == 0;
+
+    case 56: // Left Shift
+    case 60: // Right Shift
+        return ([event modifierFlags] & NSShiftKeyMask) == 0;
+
+    case 58: // Left Alt
+    case 61: // Right Alt
+        return ([event modifierFlags] & NSAlternateKeyMask) == 0;
+
+    case 59: // Left Ctrl
+    case 62: // Right Ctrl
+        return ([event modifierFlags] & NSControlKeyMask) == 0;
+
+    case 63: // Function
+        return ([event modifierFlags] & NSFunctionKeyMask) == 0;
+    }
+    return false;
+}
+
+static bool isKeypadEvent(NSEvent* event)
+{
+    // Check that this is the type of event that has a keyCode.
+    switch ([event type]) {
+    case NSKeyDown:
+    case NSKeyUp:
+    case NSFlagsChanged:
+        break;
+    default:
+        return false;
+    }
+
+    switch ([event keyCode]) {
+    case 71: // Clear
+    case 81: // =
+    case 75: // /
+    case 67: // *
+    case 78: // -
+    case 69: // +
+    case 76: // Enter
+    case 65: // .
+    case 82: // 0
+    case 83: // 1
+    case 84: // 2
+    case 85: // 3
+    case 86: // 4
+    case 87: // 5
+    case 88: // 6
+    case 89: // 7
+    case 91: // 8
+    case 92: // 9
+        return true;
+    }
+
+    return false;
+}
+
+static int windowsKeyCodeForKeyEvent(NSEvent* event)
+{
+    switch ([event keyCode]) {
+    // VK_TAB (09) TAB key
+    case 48:
+        return 0x09;
+
+    // VK_APPS (5D) Right windows/meta key
+    case 54: // Right Command
+        return 0x5D;
+
+    // VK_LWIN (5B) Left windows/meta key
+    case 55: // Left Command
+        return 0x5B;
+
+    // VK_CAPITAL (14) caps locks key
+    case 57: // Capslock
+        return 0x14;
+
+    // VK_SHIFT (10) either shift key
+    case 56: // Left Shift
+    case 60: // Right Shift
+        return 0x10;
+
+    // VK_MENU (12) either alt key
+    case 58: // Left Alt
+    case 61: // Right Alt
+        return 0x12;
+
+    // VK_CONTROL (11) either ctrl key
+    case 59: // Left Ctrl
+    case 62: // Right Ctrl
+        return 0x11;
+
+// Begin non-Apple addition ---------------------------------------------------
+    case 63: // Function (no Windows key code)
+        return 0;
+// End non-Apple addition -----------------------------------------------------
+
+    // VK_CLEAR (0C) CLEAR key
+    case 71: return 0x0C;
+
+    // VK_NUMPAD0 (60) Numeric keypad 0 key
+    case 82: return 0x60;
+    // VK_NUMPAD1 (61) Numeric keypad 1 key
+    case 83: return 0x61;
+    // VK_NUMPAD2 (62) Numeric keypad 2 key
+    case 84: return 0x62;
+    // VK_NUMPAD3 (63) Numeric keypad 3 key
+    case 85: return 0x63;
+    // VK_NUMPAD4 (64) Numeric keypad 4 key
+    case 86: return 0x64;
+    // VK_NUMPAD5 (65) Numeric keypad 5 key
+    case 87: return 0x65;
+    // VK_NUMPAD6 (66) Numeric keypad 6 key
+    case 88: return 0x66;
+    // VK_NUMPAD7 (67) Numeric keypad 7 key
+    case 89: return 0x67;
+    // VK_NUMPAD8 (68) Numeric keypad 8 key
+    case 91: return 0x68;
+    // VK_NUMPAD9 (69) Numeric keypad 9 key
+    case 92: return 0x69;
+    // VK_MULTIPLY (6A) Multiply key
+    case 67: return 0x6A;
+    // VK_ADD (6B) Add key
+    case 69: return 0x6B;
+
+    // VK_SUBTRACT (6D) Subtract key
+    case 78: return 0x6D;
+    // VK_DECIMAL (6E) Decimal key
+    case 65: return 0x6E;
+    // VK_DIVIDE (6F) Divide key
+    case 75: return 0x6F;
+    }
+
+// Begin non-Apple addition ---------------------------------------------------
+    // |-[NSEvent charactersIgnoringModifiers]| isn't allowed for
+    // NSFlagsChanged, and conceivably we may not have caught everything
+    // which causes an NSFlagsChanged above.
+    if ([event type] == NSFlagsChanged)
+        return 0;
+// End non-Apple addition -----------------------------------------------------
+
+    NSString* s = [event charactersIgnoringModifiers];
+    if ([s length] != 1)
+        return 0;
+
+    switch ([s characterAtIndex:0]) {
+    // VK_LBUTTON (01) Left mouse button
+    // VK_RBUTTON (02) Right mouse button
+    // VK_CANCEL (03) Control-break processing
+    // VK_MBUTTON (04) Middle mouse button (three-button mouse)
+    // VK_XBUTTON1 (05)
+    // VK_XBUTTON2 (06)
+
+    // VK_BACK (08) BACKSPACE key
+    case 8: case 0x7F: return 0x08;
+    // VK_TAB (09) TAB key
+    case 9: return 0x09;
+
+    // VK_CLEAR (0C) CLEAR key
+    // handled by key code above
+
+    // VK_RETURN (0D)
+    case 0xD: case 3: return 0x0D;
+
+    // VK_SHIFT (10) SHIFT key
+    // VK_CONTROL (11) CTRL key
+    // VK_MENU (12) ALT key
+
+    // VK_PAUSE (13) PAUSE key
+    case NSPauseFunctionKey: return 0x13;
+
+    // VK_CAPITAL (14) CAPS LOCK key
+    // VK_KANA (15) Input Method Editor (IME) Kana mode
+    // VK_HANGUEL (15) IME Hanguel mode (maintained for compatibility; use VK_HANGUL)
+    // VK_HANGUL (15) IME Hangul mode
+    // VK_JUNJA (17) IME Junja mode
+    // VK_FINAL (18) IME final mode
+    // VK_HANJA (19) IME Hanja mode
+    // VK_KANJI (19) IME Kanji mode
+
+    // VK_ESCAPE (1B) ESC key
+    case 0x1B: return 0x1B;
+
+    // VK_CONVERT (1C) IME convert
+    // VK_NONCONVERT (1D) IME nonconvert
+    // VK_ACCEPT (1E) IME accept
+    // VK_MODECHANGE (1F) IME mode change request
+
+    // VK_SPACE (20) SPACEBAR
+    case ' ': return 0x20;
+    // VK_PRIOR (21) PAGE UP key
+    case NSPageUpFunctionKey: return 0x21;
+    // VK_NEXT (22) PAGE DOWN key
+    case NSPageDownFunctionKey: return 0x22;
+    // VK_END (23) END key
+    case NSEndFunctionKey: return 0x23;
+    // VK_HOME (24) HOME key
+    case NSHomeFunctionKey: return 0x24;
+    // VK_LEFT (25) LEFT ARROW key
+    case NSLeftArrowFunctionKey: return 0x25;
+    // VK_UP (26) UP ARROW key
+    case NSUpArrowFunctionKey: return 0x26;
+    // VK_RIGHT (27) RIGHT ARROW key
+    case NSRightArrowFunctionKey: return 0x27;
+    // VK_DOWN (28) DOWN ARROW key
+    case NSDownArrowFunctionKey: return 0x28;
+    // VK_SELECT (29) SELECT key
+    case NSSelectFunctionKey: return 0x29;
+    // VK_PRINT (2A) PRINT key
+    case NSPrintFunctionKey: return 0x2A;
+    // VK_EXECUTE (2B) EXECUTE key
+    case NSExecuteFunctionKey: return 0x2B;
+    // VK_SNAPSHOT (2C) PRINT SCREEN key
+    case NSPrintScreenFunctionKey: return 0x2C;
+    // VK_INSERT (2D) INS key
+    case NSInsertFunctionKey: case NSHelpFunctionKey: return 0x2D;
+    // VK_DELETE (2E) DEL key
+    case NSDeleteFunctionKey: return 0x2E;
+
+    // VK_HELP (2F) HELP key
+
+    //  (30) 0 key
+    case '0': case ')': return 0x30;
+    //  (31) 1 key
+    case '1': case '!': return 0x31;
+    //  (32) 2 key
+    case '2': case '@': return 0x32;
+    //  (33) 3 key
+    case '3': case '#': return 0x33;
+    //  (34) 4 key
+    case '4': case '$': return 0x34;
+    //  (35) 5 key
+    case '5': case '%': return 0x35;
+    //  (36) 6 key
+    case '6': case '^': return 0x36;
+    //  (37) 7 key
+    case '7': case '&': return 0x37;
+    //  (38) 8 key
+    case '8': case '*': return 0x38;
+    //  (39) 9 key
+    case '9': case '(': return 0x39;
+    //  (41) A key
+    case 'a': case 'A': return 0x41;
+    //  (42) B key
+    case 'b': case 'B': return 0x42;
+    //  (43) C key
+    case 'c': case 'C': return 0x43;
+    //  (44) D key
+    case 'd': case 'D': return 0x44;
+    //  (45) E key
+    case 'e': case 'E': return 0x45;
+    //  (46) F key
+    case 'f': case 'F': return 0x46;
+    //  (47) G key
+    case 'g': case 'G': return 0x47;
+    //  (48) H key
+    case 'h': case 'H': return 0x48;
+    //  (49) I key
+    case 'i': case 'I': return 0x49;
+    //  (4A) J key
+    case 'j': case 'J': return 0x4A;
+    //  (4B) K key
+    case 'k': case 'K': return 0x4B;
+    //  (4C) L key
+    case 'l': case 'L': return 0x4C;
+    //  (4D) M key
+    case 'm': case 'M': return 0x4D;
+    //  (4E) N key
+    case 'n': case 'N': return 0x4E;
+    //  (4F) O key
+    case 'o': case 'O': return 0x4F;
+    //  (50) P key
+    case 'p': case 'P': return 0x50;
+    //  (51) Q key
+    case 'q': case 'Q': return 0x51;
+    //  (52) R key
+    case 'r': case 'R': return 0x52;
+    //  (53) S key
+    case 's': case 'S': return 0x53;
+    //  (54) T key
+    case 't': case 'T': return 0x54;
+    //  (55) U key
+    case 'u': case 'U': return 0x55;
+    //  (56) V key
+    case 'v': case 'V': return 0x56;
+    //  (57) W key
+    case 'w': case 'W': return 0x57;
+    //  (58) X key
+    case 'x': case 'X': return 0x58;
+    //  (59) Y key
+    case 'y': case 'Y': return 0x59;
+    //  (5A) Z key
+    case 'z': case 'Z': return 0x5A;
+
+    // VK_LWIN (5B) Left Windows key (Microsoft Natural keyboard)
+    // VK_RWIN (5C) Right Windows key (Natural keyboard)
+    // VK_APPS (5D) Applications key (Natural keyboard)
+    // VK_SLEEP (5F) Computer Sleep key
+
+    // VK_NUMPAD0 (60) Numeric keypad 0 key
+    // VK_NUMPAD1 (61) Numeric keypad 1 key
+    // VK_NUMPAD2 (62) Numeric keypad 2 key
+    // VK_NUMPAD3 (63) Numeric keypad 3 key
+    // VK_NUMPAD4 (64) Numeric keypad 4 key
+    // VK_NUMPAD5 (65) Numeric keypad 5 key
+    // VK_NUMPAD6 (66) Numeric keypad 6 key
+    // VK_NUMPAD7 (67) Numeric keypad 7 key
+    // VK_NUMPAD8 (68) Numeric keypad 8 key
+    // VK_NUMPAD9 (69) Numeric keypad 9 key
+    // VK_MULTIPLY (6A) Multiply key
+    // VK_ADD (6B) Add key
+    // handled by key code above
+
+    // VK_SEPARATOR (6C) Separator key
+
+    // VK_SUBTRACT (6D) Subtract key
+    // VK_DECIMAL (6E) Decimal key
+    // VK_DIVIDE (6F) Divide key
+    // handled by key code above
+
+    // VK_F1 (70) F1 key
+    case NSF1FunctionKey: return 0x70;
+    // VK_F2 (71) F2 key
+    case NSF2FunctionKey: return 0x71;
+    // VK_F3 (72) F3 key
+    case NSF3FunctionKey: return 0x72;
+    // VK_F4 (73) F4 key
+    case NSF4FunctionKey: return 0x73;
+    // VK_F5 (74) F5 key
+    case NSF5FunctionKey: return 0x74;
+    // VK_F6 (75) F6 key
+    case NSF6FunctionKey: return 0x75;
+    // VK_F7 (76) F7 key
+    case NSF7FunctionKey: return 0x76;
+    // VK_F8 (77) F8 key
+    case NSF8FunctionKey: return 0x77;
+    // VK_F9 (78) F9 key
+    case NSF9FunctionKey: return 0x78;
+    // VK_F10 (79) F10 key
+    case NSF10FunctionKey: return 0x79;
+    // VK_F11 (7A) F11 key
+    case NSF11FunctionKey: return 0x7A;
+    // VK_F12 (7B) F12 key
+    case NSF12FunctionKey: return 0x7B;
+    // VK_F13 (7C) F13 key
+    case NSF13FunctionKey: return 0x7C;
+    // VK_F14 (7D) F14 key
+    case NSF14FunctionKey: return 0x7D;
+    // VK_F15 (7E) F15 key
+    case NSF15FunctionKey: return 0x7E;
+    // VK_F16 (7F) F16 key
+    case NSF16FunctionKey: return 0x7F;
+    // VK_F17 (80H) F17 key
+    case NSF17FunctionKey: return 0x80;
+    // VK_F18 (81H) F18 key
+    case NSF18FunctionKey: return 0x81;
+    // VK_F19 (82H) F19 key
+    case NSF19FunctionKey: return 0x82;
+    // VK_F20 (83H) F20 key
+    case NSF20FunctionKey: return 0x83;
+    // VK_F21 (84H) F21 key
+    case NSF21FunctionKey: return 0x84;
+    // VK_F22 (85H) F22 key
+    case NSF22FunctionKey: return 0x85;
+    // VK_F23 (86H) F23 key
+    case NSF23FunctionKey: return 0x86;
+    // VK_F24 (87H) F24 key
+    case NSF24FunctionKey: return 0x87;
+
+    // VK_NUMLOCK (90) NUM LOCK key
+
+    // VK_SCROLL (91) SCROLL LOCK key
+    case NSScrollLockFunctionKey: return 0x91;
+
+    // VK_LSHIFT (A0) Left SHIFT key
+    // VK_RSHIFT (A1) Right SHIFT key
+    // VK_LCONTROL (A2) Left CONTROL key
+    // VK_RCONTROL (A3) Right CONTROL key
+    // VK_LMENU (A4) Left MENU key
+    // VK_RMENU (A5) Right MENU key
+    // VK_BROWSER_BACK (A6) Windows 2000/XP: Browser Back key
+    // VK_BROWSER_FORWARD (A7) Windows 2000/XP: Browser Forward key
+    // VK_BROWSER_REFRESH (A8) Windows 2000/XP: Browser Refresh key
+    // VK_BROWSER_STOP (A9) Windows 2000/XP: Browser Stop key
+    // VK_BROWSER_SEARCH (AA) Windows 2000/XP: Browser Search key
+    // VK_BROWSER_FAVORITES (AB) Windows 2000/XP: Browser Favorites key
+    // VK_BROWSER_HOME (AC) Windows 2000/XP: Browser Start and Home key
+    // VK_VOLUME_MUTE (AD) Windows 2000/XP: Volume Mute key
+    // VK_VOLUME_DOWN (AE) Windows 2000/XP: Volume Down key
+    // VK_VOLUME_UP (AF) Windows 2000/XP: Volume Up key
+    // VK_MEDIA_NEXT_TRACK (B0) Windows 2000/XP: Next Track key
+    // VK_MEDIA_PREV_TRACK (B1) Windows 2000/XP: Previous Track key
+    // VK_MEDIA_STOP (B2) Windows 2000/XP: Stop Media key
+    // VK_MEDIA_PLAY_PAUSE (B3) Windows 2000/XP: Play/Pause Media key
+    // VK_LAUNCH_MAIL (B4) Windows 2000/XP: Start Mail key
+    // VK_LAUNCH_MEDIA_SELECT (B5) Windows 2000/XP: Select Media key
+    // VK_LAUNCH_APP1 (B6) Windows 2000/XP: Start Application 1 key
+    // VK_LAUNCH_APP2 (B7) Windows 2000/XP: Start Application 2 key
+
+    // VK_OEM_1 (BA) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ';:' key
+    case ';': case ':': return 0xBA;
+    // VK_OEM_PLUS (BB) Windows 2000/XP: For any country/region, the '+' key
+    case '=': case '+': return 0xBB;
+    // VK_OEM_COMMA (BC) Windows 2000/XP: For any country/region, the ',' key
+    case ',': case '<': return 0xBC;
+    // VK_OEM_MINUS (BD) Windows 2000/XP: For any country/region, the '-' key
+    case '-': case '_': return 0xBD;
+    // VK_OEM_PERIOD (BE) Windows 2000/XP: For any country/region, the '.' key
+    case '.': case '>': return 0xBE;
+    // VK_OEM_2 (BF) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '/?' key
+    case '/': case '?': return 0xBF;
+    // VK_OEM_3 (C0) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '`~' key
+    case '`': case '~': return 0xC0;
+    // VK_OEM_4 (DB) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '[{' key
+    case '[': case '{': return 0xDB;
+    // VK_OEM_5 (DC) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the '\|' key
+    case '\\': case '|': return 0xDC;
+    // VK_OEM_6 (DD) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ']}' key
+    case ']': case '}': return 0xDD;
+    // VK_OEM_7 (DE) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the 'single-quote/double-quote' key
+    case '\'': case '"': return 0xDE;
+
+    // VK_OEM_8 (DF) Used for miscellaneous characters; it can vary by keyboard.
+    // VK_OEM_102 (E2) Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard
+    // VK_PROCESSKEY (E5) Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key
+    // VK_PACKET (E7) Windows 2000/XP: Used to pass Unicode characters as if they were keystrokes. The VK_PACKET key is the low word of a 32-bit Virtual Key value used for non-keyboard input methods. For more information, see Remark in KEYBDINPUT,SendInput, WM_KEYDOWN, and WM_KEYUP
+    // VK_ATTN (F6) Attn key
+    // VK_CRSEL (F7) CrSel key
+    // VK_EXSEL (F8) ExSel key
+    // VK_EREOF (F9) Erase EOF key
+    // VK_PLAY (FA) Play key
+    // VK_ZOOM (FB) Zoom key
+    // VK_NONAME (FC) Reserved for future use
+    // VK_PA1 (FD) PA1 key
+    // VK_OEM_CLEAR (FE) Clear key
+    }
+
+    return 0;
+}
+
+static inline NSString* textFromEvent(NSEvent* event)
+{
+    if ([event type] == NSFlagsChanged)
+        return @"";
+    return [event characters];
+}
+
+static inline NSString* unmodifiedTextFromEvent(NSEvent* event)
+{
+    if ([event type] == NSFlagsChanged)
+        return @"";
+    return [event charactersIgnoringModifiers];
+}
+
+static NSString* keyIdentifierForKeyEvent(NSEvent* event)
+{
+    if ([event type] == NSFlagsChanged) {
+        switch ([event keyCode]) {
+        case 54: // Right Command
+        case 55: // Left Command
+            return @"Meta";
+
+        case 57: // Capslock
+            return @"CapsLock";
+
+        case 56: // Left Shift
+        case 60: // Right Shift
+            return @"Shift";
+
+        case 58: // Left Alt
+        case 61: // Right Alt
+            return @"Alt";
+
+        case 59: // Left Ctrl
+        case 62: // Right Ctrl
+            return @"Control";
+
+// Begin non-Apple addition/modification --------------------------------------
+        case 63: // Function
+            return @"Function";
+
+        default: // Unknown, but this may be a strange/new keyboard.
+            return @"Unidentified";
+// End non-Apple addition/modification ----------------------------------------
+        }
+    }
+
+    NSString* s = [event charactersIgnoringModifiers];
+    if ([s length] != 1)
+        return @"Unidentified";
+
+    unichar c = [s characterAtIndex:0];
+    switch (c) {
+    // Each identifier listed in the DOM spec is listed here.
+    // Many are simply commented out since they do not appear on standard Macintosh keyboards
+    // or are on a key that doesn't have a corresponding character.
+
+    // "Accept"
+    // "AllCandidates"
+
+    // "Alt"
+    case NSMenuFunctionKey:
+        return @"Alt";
+
+    // "Apps"
+    // "BrowserBack"
+    // "BrowserForward"
+    // "BrowserHome"
+    // "BrowserRefresh"
+    // "BrowserSearch"
+    // "BrowserStop"
+    // "CapsLock"
+
+    // "Clear"
+    case NSClearLineFunctionKey:
+        return @"Clear";
+
+    // "CodeInput"
+    // "Compose"
+    // "Control"
+    // "Crsel"
+    // "Convert"
+    // "Copy"
+    // "Cut"
+
+    // "Down"
+    case NSDownArrowFunctionKey:
+        return @"Down";
+    // "End"
+    case NSEndFunctionKey:
+        return @"End";
+    // "Enter"
+    case 0x3: case 0xA: case 0xD: // Macintosh calls the one on the main keyboard Return, but Windows calls it Enter, so we'll do the same for the DOM
+        return @"Enter";
+
+    // "EraseEof"
+
+    // "Execute"
+    case NSExecuteFunctionKey:
+        return @"Execute";
+
+    // "Exsel"
+
+    // "F1"
+    case NSF1FunctionKey:
+        return @"F1";
+    // "F2"
+    case NSF2FunctionKey:
+        return @"F2";
+    // "F3"
+    case NSF3FunctionKey:
+        return @"F3";
+    // "F4"
+    case NSF4FunctionKey:
+        return @"F4";
+    // "F5"
+    case NSF5FunctionKey:
+        return @"F5";
+    // "F6"
+    case NSF6FunctionKey:
+        return @"F6";
+    // "F7"
+    case NSF7FunctionKey:
+        return @"F7";
+    // "F8"
+    case NSF8FunctionKey:
+        return @"F8";
+    // "F9"
+    case NSF9FunctionKey:
+        return @"F9";
+    // "F10"
+    case NSF10FunctionKey:
+        return @"F10";
+    // "F11"
+    case NSF11FunctionKey:
+        return @"F11";
+    // "F12"
+    case NSF12FunctionKey:
+        return @"F12";
+    // "F13"
+    case NSF13FunctionKey:
+        return @"F13";
+    // "F14"
+    case NSF14FunctionKey:
+        return @"F14";
+    // "F15"
+    case NSF15FunctionKey:
+        return @"F15";
+    // "F16"
+    case NSF16FunctionKey:
+        return @"F16";
+    // "F17"
+    case NSF17FunctionKey:
+        return @"F17";
+    // "F18"
+    case NSF18FunctionKey:
+        return @"F18";
+    // "F19"
+    case NSF19FunctionKey:
+        return @"F19";
+    // "F20"
+    case NSF20FunctionKey:
+        return @"F20";
+    // "F21"
+    case NSF21FunctionKey:
+        return @"F21";
+    // "F22"
+    case NSF22FunctionKey:
+        return @"F22";
+    // "F23"
+    case NSF23FunctionKey:
+        return @"F23";
+    // "F24"
+    case NSF24FunctionKey:
+        return @"F24";
+
+    // "FinalMode"
+
+    // "Find"
+    case NSFindFunctionKey:
+        return @"Find";
+
+    // "FullWidth"
+    // "HalfWidth"
+    // "HangulMode"
+    // "HanjaMode"
+
+    // "Help"
+    case NSHelpFunctionKey:
+        return @"Help";
+
+    // "Hiragana"
+
+    // "Home"
+    case NSHomeFunctionKey:
+        return @"Home";
+    // "Insert"
+    case NSInsertFunctionKey:
+        return @"Insert";
+
+    // "JapaneseHiragana"
+    // "JapaneseKatakana"
+    // "JapaneseRomaji"
+    // "JunjaMode"
+    // "KanaMode"
+    // "KanjiMode"
+    // "Katakana"
+    // "LaunchApplication1"
+    // "LaunchApplication2"
+    // "LaunchMail"
+
+    // "Left"
+    case NSLeftArrowFunctionKey:
+        return @"Left";
+
+    // "Meta"
+    // "MediaNextTrack"
+    // "MediaPlayPause"
+    // "MediaPreviousTrack"
+    // "MediaStop"
+
+    // "ModeChange"
+    case NSModeSwitchFunctionKey:
+        return @"ModeChange";
+
+    // "Nonconvert"
+    // "NumLock"
+
+    // "PageDown"
+    case NSPageDownFunctionKey:
+        return @"PageDown";
+    // "PageUp"
+    case NSPageUpFunctionKey:
+        return @"PageUp";
+
+    // "Paste"
+
+    // "Pause"
+    case NSPauseFunctionKey:
+        return @"Pause";
+
+    // "Play"
+    // "PreviousCandidate"
+
+    // "PrintScreen"
+    case NSPrintScreenFunctionKey:
+        return @"PrintScreen";
+
+    // "Process"
+    // "Props"
+
+    // "Right"
+    case NSRightArrowFunctionKey:
+        return @"Right";
+
+    // "RomanCharacters"
+
+    // "Scroll"
+    case NSScrollLockFunctionKey:
+        return @"Scroll";
+    // "Select"
+    case NSSelectFunctionKey:
+        return @"Select";
+
+    // "SelectMedia"
+    // "Shift"
+
+    // "Stop"
+    case NSStopFunctionKey:
+        return @"Stop";
+    // "Up"
+    case NSUpArrowFunctionKey:
+        return @"Up";
+    // "Undo"
+    case NSUndoFunctionKey:
+        return @"Undo";
+
+    // "VolumeDown"
+    // "VolumeMute"
+    // "VolumeUp"
+    // "Win"
+    // "Zoom"
+
+    // More function keys, not in the key identifier specification.
+    case NSF25FunctionKey:
+        return @"F25";
+    case NSF26FunctionKey:
+        return @"F26";
+    case NSF27FunctionKey:
+        return @"F27";
+    case NSF28FunctionKey:
+        return @"F28";
+    case NSF29FunctionKey:
+        return @"F29";
+    case NSF30FunctionKey:
+        return @"F30";
+    case NSF31FunctionKey:
+        return @"F31";
+    case NSF32FunctionKey:
+        return @"F32";
+    case NSF33FunctionKey:
+        return @"F33";
+    case NSF34FunctionKey:
+        return @"F34";
+    case NSF35FunctionKey:
+        return @"F35";
+
+    // Turn 0x7F into 0x08, because backspace needs to always be 0x08.
+    case 0x7F:
+        return @"U+0008";
+    // Standard says that DEL becomes U+007F.
+    case NSDeleteFunctionKey:
+        return @"U+007F";
+
+    // Always use 0x09 for tab instead of AppKit's backtab character.
+    case NSBackTabCharacter:
+        return @"U+0009";
+
+    case NSBeginFunctionKey:
+    case NSBreakFunctionKey:
+    case NSClearDisplayFunctionKey:
+    case NSDeleteCharFunctionKey:
+    case NSDeleteLineFunctionKey:
+    case NSInsertCharFunctionKey:
+    case NSInsertLineFunctionKey:
+    case NSNextFunctionKey:
+    case NSPrevFunctionKey:
+    case NSPrintFunctionKey:
+    case NSRedoFunctionKey:
+    case NSResetFunctionKey:
+    case NSSysReqFunctionKey:
+    case NSSystemFunctionKey:
+    case NSUserFunctionKey:
+        // FIXME: We should use something other than the vendor-area Unicode values for the above keys.
+        // For now, just fall through to the default.
+    default:
+        return [NSString stringWithFormat:@"U+%04X", WTF::toASCIIUpper(c)];
+    }
+}
+
+// End Apple code.
+// ----------------------------------------------------------------------------
+
+static inline int modifiersFromEvent(NSEvent* event) {
+    int modifiers = 0;
+
+    if ([event modifierFlags] & NSControlKeyMask)
+        modifiers |= WebInputEvent::ControlKey;
+    if ([event modifierFlags] & NSShiftKeyMask)
+        modifiers |= WebInputEvent::ShiftKey;
+    if ([event modifierFlags] & NSAlternateKeyMask)
+        modifiers |= WebInputEvent::AltKey;
+    if ([event modifierFlags] & NSCommandKeyMask)
+        modifiers |= WebInputEvent::MetaKey;
+    // TODO(port): Set mouse button states
+
+    return modifiers;
+}
+
+WebKeyboardEvent WebInputEventFactory::keyboardEvent(NSEvent* event)
+{
+    WebKeyboardEvent result;
+
+    result.type =
+        isKeyUpEvent(event) ? WebInputEvent::KeyUp : WebInputEvent::RawKeyDown;
+
+    result.modifiers = modifiersFromEvent(event);
+
+    if (isKeypadEvent(event))
+        result.modifiers |= WebInputEvent::IsKeyPad;
+
+    if (([event type] != NSFlagsChanged) && [event isARepeat])
+        result.modifiers |= WebInputEvent::IsAutoRepeat;
+
+    result.windowsKeyCode = windowsKeyCodeForKeyEvent(event);
+    result.nativeKeyCode = [event keyCode];
+
+    NSString* textStr = textFromEvent(event);
+    NSString* unmodifiedStr = unmodifiedTextFromEvent(event);
+    NSString* identifierStr = keyIdentifierForKeyEvent(event);
+
+    // Begin Apple code, copied from KeyEventMac.mm
+
+    // Always use 13 for Enter/Return -- we don't want to use AppKit's
+    // different character for Enter.
+    if (result.windowsKeyCode == '\r') {
+        textStr = @"\r";
+        unmodifiedStr = @"\r";
+    }
+
+    // The adjustments below are only needed in backward compatibility mode,
+    // but we cannot tell what mode we are in from here.
+
+    // Turn 0x7F into 8, because backspace needs to always be 8.
+    if ([textStr isEqualToString:@"\x7F"])
+        textStr = @"\x8";
+    if ([unmodifiedStr isEqualToString:@"\x7F"])
+        unmodifiedStr = @"\x8";
+    // Always use 9 for tab -- we don't want to use AppKit's different character
+    // for shift-tab.
+    if (result.windowsKeyCode == 9) {
+        textStr = @"\x9";
+        unmodifiedStr = @"\x9";
+    }
+
+    // End Apple code.
+
+    if ([textStr length] < WebKeyboardEvent::textLengthCap &&
+        [unmodifiedStr length] < WebKeyboardEvent::textLengthCap) {
+        [textStr getCharacters:&result.text[0]];
+        [unmodifiedStr getCharacters:&result.unmodifiedText[0]];
+    } else
+        ASSERT_NOT_REACHED();
+
+    [identifierStr getCString:&result.keyIdentifier[0]
+                    maxLength:sizeof(result.keyIdentifier)
+                     encoding:NSASCIIStringEncoding];
+
+    result.timeStampSeconds = [event timestamp];
+
+    // Windows and Linux set |isSystemKey| if alt is down. WebKit looks at this
+    // flag to decide if it should handle a key or not. E.g. alt-left/right
+    // shouldn't be used by WebKit to scroll the current page, because we want
+    // to get that key back for it to do history navigation. Hence, the
+    // corresponding situation on OS X is to set this for cmd key presses.
+    if (result.modifiers & WebInputEvent::MetaKey)
+        result.isSystemKey = true;
+
+    return result;
+}
+
+WebKeyboardEvent WebInputEventFactory::keyboardEvent(wchar_t character,
+                                                     int modifiers,
+                                                     double timeStampSeconds)
+{
+    // keyboardEvent(NSEvent*) depends on the NSEvent object and
+    // it is hard to use it from methods of the NSTextInput protocol. For
+    // such methods, this function creates a WebInputEvent::Char event without
+    // using a NSEvent object.
+    WebKeyboardEvent result;
+    result.type = WebKit::WebInputEvent::Char;
+    result.timeStampSeconds = timeStampSeconds;
+    result.modifiers = modifiers;
+    result.windowsKeyCode = character;
+    result.nativeKeyCode = character;
+    result.text[0] = character;
+    result.unmodifiedText[0] = character;
+
+    // Windows and Linux set |isSystemKey| if alt is down. WebKit looks at this
+    // flag to decide if it should handle a key or not. E.g. alt-left/right
+    // shouldn't be used by WebKit to scroll the current page, because we want
+    // to get that key back for it to do history navigation. Hence, the
+    // corresponding situation on OS X is to set this for cmd key presses.
+    if (result.modifiers & WebInputEvent::MetaKey)
+        result.isSystemKey = true;
+
+    return result;
+}
+
+// WebMouseEvent --------------------------------------------------------------
+
+WebMouseEvent WebInputEventFactory::mouseEvent(NSEvent* event, NSView* view)
+{
+    WebMouseEvent result;
+
+    result.clickCount = 0;
+
+    switch ([event type]) {
+    case NSMouseExited:
+        result.type = WebInputEvent::MouseLeave;
+        result.button = WebMouseEvent::ButtonNone;
+        break;
+    case NSLeftMouseDown:
+        result.type = WebInputEvent::MouseDown;
+        result.clickCount = [event clickCount];
+        result.button = WebMouseEvent::ButtonLeft;
+        break;
+    case NSOtherMouseDown:
+        result.type = WebInputEvent::MouseDown;
+        result.clickCount = [event clickCount];
+        result.button = WebMouseEvent::ButtonMiddle;
+        break;
+    case NSRightMouseDown:
+        result.type = WebInputEvent::MouseDown;
+        result.clickCount = [event clickCount];
+        result.button = WebMouseEvent::ButtonRight;
+        break;
+    case NSLeftMouseUp:
+        result.type = WebInputEvent::MouseUp;
+        result.button = WebMouseEvent::ButtonLeft;
+        break;
+    case NSOtherMouseUp:
+        result.type = WebInputEvent::MouseUp;
+        result.button = WebMouseEvent::ButtonMiddle;
+        break;
+    case NSRightMouseUp:
+        result.type = WebInputEvent::MouseUp;
+        result.button = WebMouseEvent::ButtonRight;
+        break;
+    case NSMouseMoved:
+    case NSMouseEntered:
+        result.type = WebInputEvent::MouseMove;
+        break;
+    case NSLeftMouseDragged:
+        result.type = WebInputEvent::MouseMove;
+        result.button = WebMouseEvent::ButtonLeft;
+        break;
+    case NSOtherMouseDragged:
+        result.type = WebInputEvent::MouseMove;
+        result.button = WebMouseEvent::ButtonMiddle;
+        break;
+    case NSRightMouseDragged:
+        result.type = WebInputEvent::MouseMove;
+        result.button = WebMouseEvent::ButtonRight;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    NSPoint location = [NSEvent mouseLocation];  // global coordinates
+    result.globalX = location.x;
+    result.globalY = [[[view window] screen] frame].size.height - location.y;
+
+    NSPoint windowLocal = [event locationInWindow];
+    location = [view convertPoint:windowLocal fromView:nil];
+    result.y = [view frame].size.height - location.y;  // flip y
+    result.x = location.x;
+    result.windowX = result.x;
+    result.windowY = result.y;
+
+    result.modifiers = modifiersFromEvent(event);
+
+    result.timeStampSeconds = [event timestamp];
+
+    return result;
+}
+
+// WebMouseWheelEvent ---------------------------------------------------------
+
+WebMouseWheelEvent WebInputEventFactory::mouseWheelEvent(NSEvent* event, NSView* view)
+{
+    WebMouseWheelEvent result;
+
+    result.type = WebInputEvent::MouseWheel;
+    result.button = WebMouseEvent::ButtonNone;
+
+    result.modifiers = modifiersFromEvent(event);
+
+    // Set coordinates by translating event coordinates from screen to client.
+    NSPoint location = [NSEvent mouseLocation];  // global coordinates
+    result.globalX = location.x;
+    result.globalY = location.y;
+    NSPoint windowLocal = [event locationInWindow];
+    location = [view convertPoint:windowLocal fromView:nil];
+    result.x = location.x;
+    result.y = [view frame].size.height - location.y;  // flip y
+    result.windowX = result.x;
+    result.windowY = result.y;
+
+    // Of Mice and Men
+    // ---------------
+    //
+    // There are three types of scroll data available on a scroll wheel CGEvent.
+    // Apple's documentation ([1]) is rather vague in their differences, and not
+    // terribly helpful in deciding which to use. This is what's really going on.
+    //
+    // First, these events behave very differently depending on whether a standard
+    // wheel mouse is used (one that scrolls in discrete units) or a
+    // trackpad/Mighty Mouse is used (which both provide continuous scrolling).
+    // You must check to see which was used for the event by testing the
+    // kCGScrollWheelEventIsContinuous field.
+    //
+    // Second, these events refer to "axes". Axis 1 is the y-axis, and axis 2 is
+    // the x-axis.
+    //
+    // Third, there is a concept of mouse acceleration. Scrolling the same amount
+    // of physical distance will give you different results logically depending on
+    // whether you scrolled a little at a time or in one continuous motion. Some
+    // fields account for this while others do not.
+    //
+    // Fourth, for trackpads there is a concept of chunkiness. When scrolling
+    // continuously, events can be delivered in chunks. That is to say, lots of
+    // scroll events with delta 0 will be delivered, and every so often an event
+    // with a non-zero delta will be delivered, containing the accumulated deltas
+    // from all the intermediate moves. [2]
+    //
+    // For notchy wheel mice (kCGScrollWheelEventIsContinuous == 0)
+    // ------------------------------------------------------------
+    //
+    // kCGScrollWheelEventDeltaAxis*
+    //   This is the rawest of raw events. For each mouse notch you get a value of
+    //   +1/-1. This does not take acceleration into account and thus is less
+    //   useful for building UIs.
+    //
+    // kCGScrollWheelEventPointDeltaAxis*
+    //   This is smarter. In general, for each mouse notch you get a value of
+    //   +1/-1, but this _does_ take acceleration into account, so you will get
+    //   larger values on longer scrolls. This field would be ideal for building
+    //   UIs except for one nasty bug: when the shift key is pressed, this set of
+    //   fields fails to move the value into the axis2 field (the other two types
+    //   of data do). This wouldn't be so bad except for the fact that while the
+    //   number of axes is used in the creation of a CGScrollWheelEvent, there is
+    //   no way to get that information out of the event once created.
+    //
+    // kCGScrollWheelEventFixedPtDeltaAxis*
+    //   This is a fixed value, and for each mouse notch you get a value of
+    //   +0.1/-0.1 (but, like above, scaled appropriately for acceleration). This
+    //   value takes acceleration into account, and in fact is identical to the
+    //   results you get from -[NSEvent delta*]. (That is, if you linked on Tiger
+    //   or greater; see [2] for details.)
+    //
+    // A note about continuous devices
+    // -------------------------------
+    //
+    // There are two devices that provide continuous scrolling events (trackpads
+    // and Mighty Mouses) and they behave rather differently. The Mighty Mouse
+    // behaves a lot like a regular mouse. There is no chunking, and the
+    // FixedPtDelta values are the PointDelta values multiplied by 0.1. With the
+    // trackpad, though, there is chunking. While the FixedPtDelta values are
+    // reasonable (they occur about every fifth event but have values five times
+    // larger than usual) the Delta values are unreasonable. They don't appear to
+    // accumulate properly.
+    //
+    // For continuous devices (kCGScrollWheelEventIsContinuous != 0)
+    // -------------------------------------------------------------
+    //
+    // kCGScrollWheelEventDeltaAxis*
+    //   This provides values with no acceleration. With a trackpad, these values
+    //   are chunked but each non-zero value does not appear to be cumulative.
+    //   This seems to be a bug.
+    //
+    // kCGScrollWheelEventPointDeltaAxis*
+    //   This provides values with acceleration. With a trackpad, these values are
+    //   not chunked and are highly accurate.
+    //
+    // kCGScrollWheelEventFixedPtDeltaAxis*
+    //   This provides values with acceleration. With a trackpad, these values are
+    //   chunked but unlike Delta events are properly cumulative.
+    //
+    // Summary
+    // -------
+    //
+    // In general the best approach to take is: determine if the event is
+    // continuous. If it is not, then use the FixedPtDelta events (or just stick
+    // with Cocoa events). They provide both acceleration and proper horizontal
+    // scrolling. If the event is continuous, then doing pixel scrolling with the
+    // PointDelta is the way to go. In general, avoid the Delta events. They're
+    // the oldest (dating back to 10.4, before CGEvents were public) but they lack
+    // acceleration and precision, making them useful only in specific edge cases.
+    //
+    // References
+    // ----------
+    //
+    // [1] <http://developer.apple.com/documentation/Carbon/Reference/QuartzEventServicesRef/Reference/reference.html>
+    // [2] <http://developer.apple.com/releasenotes/Cocoa/AppKitOlderNotes.html>
+    //     Scroll to the section headed "NSScrollWheel events".
+    //
+    // P.S. The "smooth scrolling" option in the system preferences is utterly
+    // unrelated to any of this.
+
+    CGEventRef cgEvent = [event CGEvent];
+    ASSERT(cgEvent);
+
+    // Wheel ticks are supposed to be raw, unaccelerated values, one per physical
+    // mouse wheel notch. The delta event is perfect for this (being a good
+    // "specific edge case" as mentioned above). Trackpads, unfortunately, do
+    // event chunking, and sending mousewheel events with 0 ticks causes some
+    // websites to malfunction. Therefore, for all continuous input devices we use
+    // the point delta data instead, since we cannot distinguish trackpad data
+    // from data from any other continuous device.
+
+    if (CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventIsContinuous)) {
+        result.wheelTicksY = result.deltaY =
+            CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventPointDeltaAxis1);
+        result.wheelTicksX = result.deltaX =
+            CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventPointDeltaAxis2);
+    } else {
+        result.wheelTicksY =
+            CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventDeltaAxis1);
+        result.wheelTicksX =
+            CGEventGetIntegerValueField(cgEvent, kCGScrollWheelEventDeltaAxis2);
+
+        // Convert wheel delta amount to a number of pixels to scroll.
+        static const double scrollbarPixelsPerCocoaTick = 40.0;
+
+        result.deltaX = [event deltaX] * scrollbarPixelsPerCocoaTick;
+        result.deltaY = [event deltaY] * scrollbarPixelsPerCocoaTick;
+    }
+
+    result.timeStampSeconds = [event timestamp];
+
+    return result;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/mac/WebScreenInfoFactory.mm b/WebKit/chromium/src/mac/WebScreenInfoFactory.mm
new file mode 100644
index 0000000..2805f7a
--- /dev/null
+++ b/WebKit/chromium/src/mac/WebScreenInfoFactory.mm
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebScreenInfoFactory.h"
+
+#import <AppKit/AppKit.h>
+
+#include "WebScreenInfo.h"
+
+namespace WebKit {
+
+static NSScreen* screenForWindow(NSWindow* window)
+{
+    NSScreen* screen = [window screen];  // nil if the window is off-screen
+    if (screen)
+        return screen;
+
+    NSArray* screens = [NSScreen screens];
+    if ([screens count] > 0)
+        return [screens objectAtIndex:0];  // screen containing the menubar
+
+    return nil;
+}
+
+static WebRect toUserSpace(const NSRect& rect, NSWindow* destination)
+{
+    CGRect userRect = NSRectToCGRect(rect);
+
+    userRect.origin.y =
+        NSMaxY([screenForWindow(destination) frame]) - (userRect.origin.y + userRect.size.height); // flip
+
+    if (destination) {
+        CGFloat scale = 1 / [destination userSpaceScaleFactor];  // scale down
+        userRect.origin.x *= scale;
+        userRect.origin.y *= scale;
+        userRect.size.width *= scale;
+        userRect.size.height *= scale;
+    }
+
+    return WebRect(userRect.origin.x,
+                   userRect.origin.y,
+                   userRect.size.width,
+                   userRect.size.height);
+}
+
+WebScreenInfo WebScreenInfoFactory::screenInfo(NSView* view)
+{
+    NSString *colorSpace = NSColorSpaceFromDepth([[NSScreen deepestScreen] depth]);
+
+    WebScreenInfo results;
+    results.depth =
+        NSBitsPerPixelFromDepth([[NSScreen deepestScreen] depth]);
+    results.depthPerComponent =
+        NSBitsPerSampleFromDepth([[NSScreen deepestScreen] depth]);
+    results.isMonochrome = colorSpace == NSCalibratedWhiteColorSpace
+                        || colorSpace == NSCalibratedBlackColorSpace
+                        || colorSpace == NSDeviceWhiteColorSpace
+                        || colorSpace == NSDeviceBlackColorSpace;
+    results.rect =
+        toUserSpace([screenForWindow([view window]) frame], [view window]);
+    results.availableRect =
+        toUserSpace([screenForWindow([view window]) visibleFrame], [view window]);
+    return results;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/win/WebInputEventFactory.cpp b/WebKit/chromium/src/win/WebInputEventFactory.cpp
new file mode 100644
index 0000000..a5bd935
--- /dev/null
+++ b/WebKit/chromium/src/win/WebInputEventFactory.cpp
@@ -0,0 +1,437 @@
+/*
+ * Copyright (C) 2006-2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebInputEventFactory.h"
+
+#include "WebInputEvent.h"
+
+#include <wtf/Assertions.h>
+
+namespace WebKit {
+
+static const unsigned long defaultScrollLinesPerWheelDelta = 3;
+static const unsigned long defaultScrollCharsPerWheelDelta = 1;
+
+// WebKeyboardEvent -----------------------------------------------------------
+
+static bool isKeyPad(WPARAM wparam, LPARAM lparam)
+{
+    bool keypad = false;
+    switch (wparam) {
+    case VK_RETURN:
+        keypad = (lparam >> 16) & KF_EXTENDED;
+        break;
+    case VK_INSERT:
+    case VK_DELETE:
+    case VK_HOME:
+    case VK_END:
+    case VK_PRIOR:
+    case VK_NEXT:
+    case VK_UP:
+    case VK_DOWN:
+    case VK_LEFT:
+    case VK_RIGHT:
+        keypad = !((lparam >> 16) & KF_EXTENDED);
+        break;
+    case VK_NUMLOCK:
+    case VK_NUMPAD0:
+    case VK_NUMPAD1:
+    case VK_NUMPAD2:
+    case VK_NUMPAD3:
+    case VK_NUMPAD4:
+    case VK_NUMPAD5:
+    case VK_NUMPAD6:
+    case VK_NUMPAD7:
+    case VK_NUMPAD8:
+    case VK_NUMPAD9:
+    case VK_DIVIDE:
+    case VK_MULTIPLY:
+    case VK_SUBTRACT:
+    case VK_ADD:
+    case VK_DECIMAL:
+    case VK_CLEAR:
+        keypad = true;
+        break;
+    default:
+        keypad = false;
+    }
+    return keypad;
+}
+
+WebKeyboardEvent WebInputEventFactory::keyboardEvent(HWND hwnd, UINT message,
+                                                     WPARAM wparam, LPARAM lparam)
+{
+    WebKeyboardEvent result;
+
+    // TODO(pkasting): http://b/1117926 Are we guaranteed that the message that
+    // GetMessageTime() refers to is the same one that we're passed in? Perhaps
+    // one of the construction parameters should be the time passed by the
+    // caller, who would know for sure.
+    result.timeStampSeconds = GetMessageTime() / 1000.0;
+
+    result.windowsKeyCode = result.nativeKeyCode = static_cast<int>(wparam);
+
+    switch (message) {
+    case WM_SYSKEYDOWN:
+        result.isSystemKey = true;
+    case WM_KEYDOWN:
+        result.type = WebInputEvent::RawKeyDown;
+        break;
+    case WM_SYSKEYUP:
+        result.isSystemKey = true;
+    case WM_KEYUP:
+        result.type = WebInputEvent::KeyUp;
+        break;
+    case WM_IME_CHAR:
+        result.type = WebInputEvent::Char;
+        break;
+    case WM_SYSCHAR:
+        result.isSystemKey = true;
+        result.type = WebInputEvent::Char;
+    case WM_CHAR:
+        result.type = WebInputEvent::Char;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    if (result.type == WebInputEvent::Char || result.type == WebInputEvent::RawKeyDown) {
+        result.text[0] = result.windowsKeyCode;
+        result.unmodifiedText[0] = result.windowsKeyCode;
+    }
+    if (result.type != WebInputEvent::Char)
+        result.setKeyIdentifierFromWindowsKeyCode();
+
+    if (GetKeyState(VK_SHIFT) & 0x8000)
+        result.modifiers |= WebInputEvent::ShiftKey;
+    if (GetKeyState(VK_CONTROL) & 0x8000)
+        result.modifiers |= WebInputEvent::ControlKey;
+    if (GetKeyState(VK_MENU) & 0x8000)
+        result.modifiers |= WebInputEvent::AltKey;
+    // NOTE: There doesn't seem to be a way to query the mouse button state in
+    // this case.
+
+    if (LOWORD(lparam) > 1)
+        result.modifiers |= WebInputEvent::IsAutoRepeat;
+    if (isKeyPad(wparam, lparam))
+        result.modifiers |= WebInputEvent::IsKeyPad;
+
+    return result;
+}
+
+// WebMouseEvent --------------------------------------------------------------
+
+static int gLastClickCount;
+static double gLastClickTime;
+
+static LPARAM GetRelativeCursorPos(HWND hwnd)
+{
+    POINT pos = {-1, -1};
+    GetCursorPos(&pos);
+    ScreenToClient(hwnd, &pos);
+    return MAKELPARAM(pos.x, pos.y);
+}
+
+void WebInputEventFactory::resetLastClickState()
+{
+    gLastClickTime = gLastClickCount = 0;
+}
+
+WebMouseEvent WebInputEventFactory::mouseEvent(HWND hwnd, UINT message,
+                                               WPARAM wparam, LPARAM lparam)
+{
+    WebMouseEvent result; //(WebInputEvent::Uninitialized());
+
+    switch (message) {
+    case WM_MOUSEMOVE:
+        result.type = WebInputEvent::MouseMove;
+        if (wparam & MK_LBUTTON)
+            result.button = WebMouseEvent::ButtonLeft;
+        else if (wparam & MK_MBUTTON)
+            result.button = WebMouseEvent::ButtonMiddle;
+        else if (wparam & MK_RBUTTON)
+            result.button = WebMouseEvent::ButtonRight;
+        else
+            result.button = WebMouseEvent::ButtonNone;
+        break;
+    case WM_MOUSELEAVE:
+        result.type = WebInputEvent::MouseLeave;
+        result.button = WebMouseEvent::ButtonNone;
+        // set the current mouse position (relative to the client area of the
+        // current window) since none is specified for this event
+        lparam = GetRelativeCursorPos(hwnd);
+        break;
+    case WM_LBUTTONDOWN:
+    case WM_LBUTTONDBLCLK:
+        result.type = WebInputEvent::MouseDown;
+        result.button = WebMouseEvent::ButtonLeft;
+        break;
+    case WM_MBUTTONDOWN:
+    case WM_MBUTTONDBLCLK:
+        result.type = WebInputEvent::MouseDown;
+        result.button = WebMouseEvent::ButtonMiddle;
+        break;
+    case WM_RBUTTONDOWN:
+    case WM_RBUTTONDBLCLK:
+        result.type = WebInputEvent::MouseDown;
+        result.button = WebMouseEvent::ButtonRight;
+        break;
+    case WM_LBUTTONUP:
+        result.type = WebInputEvent::MouseUp;
+        result.button = WebMouseEvent::ButtonLeft;
+        break;
+    case WM_MBUTTONUP:
+        result.type = WebInputEvent::MouseUp;
+        result.button = WebMouseEvent::ButtonMiddle;
+        break;
+    case WM_RBUTTONUP:
+        result.type = WebInputEvent::MouseUp;
+        result.button = WebMouseEvent::ButtonRight;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    // TODO(pkasting): http://b/1117926 Are we guaranteed that the message that
+    // GetMessageTime() refers to is the same one that we're passed in? Perhaps
+    // one of the construction parameters should be the time passed by the
+    // caller, who would know for sure.
+    result.timeStampSeconds = GetMessageTime() / 1000.0;
+
+    // set position fields:
+
+    result.x = static_cast<short>(LOWORD(lparam));
+    result.y = static_cast<short>(HIWORD(lparam));
+    result.windowX = result.x;
+    result.windowY = result.y;
+
+    POINT globalPoint = { result.x, result.y };
+    ClientToScreen(hwnd, &globalPoint);
+
+    result.globalX = globalPoint.x;
+    result.globalY = globalPoint.y;
+
+    // calculate number of clicks:
+
+    // This differs slightly from the WebKit code in WebKit/win/WebView.cpp
+    // where their original code looks buggy.
+    static int lastClickPositionX;
+    static int lastClickPositionY;
+    static WebMouseEvent::Button lastClickButton = WebMouseEvent::ButtonLeft;
+
+    double currentTime = result.timeStampSeconds;
+    bool cancelPreviousClick =
+        (abs(lastClickPositionX - result.x) > (GetSystemMetrics(SM_CXDOUBLECLK) / 2))
+        || (abs(lastClickPositionY - result.y) > (GetSystemMetrics(SM_CYDOUBLECLK) / 2))
+        || ((currentTime - gLastClickTime) * 1000.0 > GetDoubleClickTime());
+
+    if (result.type == WebInputEvent::MouseDown) {
+        if (!cancelPreviousClick && (result.button == lastClickButton))
+            ++gLastClickCount;
+        else {
+            gLastClickCount = 1;
+            lastClickPositionX = result.x;
+            lastClickPositionY = result.y;
+        }
+        gLastClickTime = currentTime;
+        lastClickButton = result.button;
+    } else if (result.type == WebInputEvent::MouseMove
+               || result.type == WebInputEvent::MouseLeave) {
+        if (cancelPreviousClick) {
+            gLastClickCount = 0;
+            lastClickPositionX = 0;
+            lastClickPositionY = 0;
+            gLastClickTime = 0;
+        }
+    }
+    result.clickCount = gLastClickCount;
+
+    // set modifiers:
+
+    if (wparam & MK_CONTROL)
+        result.modifiers |= WebInputEvent::ControlKey;
+    if (wparam & MK_SHIFT)
+        result.modifiers |= WebInputEvent::ShiftKey;
+    if (GetKeyState(VK_MENU) & 0x8000)
+        result.modifiers |= WebInputEvent::AltKey;
+    if (wparam & MK_LBUTTON)
+        result.modifiers |= WebInputEvent::LeftButtonDown;
+    if (wparam & MK_MBUTTON)
+        result.modifiers |= WebInputEvent::MiddleButtonDown;
+    if (wparam & MK_RBUTTON)
+        result.modifiers |= WebInputEvent::RightButtonDown;
+
+    return result;
+}
+
+// WebMouseWheelEvent ---------------------------------------------------------
+
+WebMouseWheelEvent WebInputEventFactory::mouseWheelEvent(HWND hwnd, UINT message,
+                                                         WPARAM wparam, LPARAM lparam)
+{
+    WebMouseWheelEvent result; //(WebInputEvent::Uninitialized());
+
+    result.type = WebInputEvent::MouseWheel;
+
+    // TODO(pkasting): http://b/1117926 Are we guaranteed that the message that
+    // GetMessageTime() refers to is the same one that we're passed in? Perhaps
+    // one of the construction parameters should be the time passed by the
+    // caller, who would know for sure.
+    result.timeStampSeconds = GetMessageTime() / 1000.0;
+
+    result.button = WebMouseEvent::ButtonNone;
+
+    // Get key state, coordinates, and wheel delta from event.
+    typedef SHORT (WINAPI *GetKeyStateFunction)(int key);
+    GetKeyStateFunction getKeyState;
+    UINT keyState;
+    float wheelDelta;
+    bool horizontalScroll = false;
+    if ((message == WM_VSCROLL) || (message == WM_HSCROLL)) {
+        // Synthesize mousewheel event from a scroll event.  This is needed to
+        // simulate middle mouse scrolling in some laptops.  Use GetAsyncKeyState
+        // for key state since we are synthesizing the input event.
+        getKeyState = GetAsyncKeyState;
+        keyState = 0;
+        if (getKeyState(VK_SHIFT))
+            keyState |= MK_SHIFT;
+        if (getKeyState(VK_CONTROL))
+            keyState |= MK_CONTROL;
+        // NOTE: There doesn't seem to be a way to query the mouse button state
+        // in this case.
+
+        POINT cursorPosition = {0};
+        GetCursorPos(&cursorPosition);
+        result.globalX = cursorPosition.x;
+        result.globalY = cursorPosition.y;
+
+        switch (LOWORD(wparam)) {
+        case SB_LINEUP:    // == SB_LINELEFT
+            wheelDelta = WHEEL_DELTA;
+            break;
+        case SB_LINEDOWN:  // == SB_LINERIGHT
+            wheelDelta = -WHEEL_DELTA;
+            break;
+        case SB_PAGEUP:
+            wheelDelta = 1;
+            result.scrollByPage = true;
+            break;
+        case SB_PAGEDOWN:
+            wheelDelta = -1;
+            result.scrollByPage = true;
+            break;
+        default:  // We don't supoprt SB_THUMBPOSITION or SB_THUMBTRACK here.
+            wheelDelta = 0;
+            break;
+        }
+
+        if (message == WM_HSCROLL)
+            horizontalScroll = true;
+    } else {
+        // Non-synthesized event; we can just read data off the event.
+        getKeyState = GetKeyState;
+        keyState = GET_KEYSTATE_WPARAM(wparam);
+
+        result.globalX = static_cast<short>(LOWORD(lparam));
+        result.globalY = static_cast<short>(HIWORD(lparam));
+
+        wheelDelta = static_cast<float>(GET_WHEEL_DELTA_WPARAM(wparam));
+        if (message == WM_MOUSEHWHEEL) {
+            horizontalScroll = true;
+            wheelDelta = -wheelDelta;  // Windows is <- -/+ ->, WebKit <- +/- ->.
+        }
+    }
+    if (keyState & MK_SHIFT)
+        horizontalScroll = true;
+
+    // Set modifiers based on key state.
+    if (keyState & MK_SHIFT)
+        result.modifiers |= WebInputEvent::ShiftKey;
+    if (keyState & MK_CONTROL)
+        result.modifiers |= WebInputEvent::ControlKey;
+    if (getKeyState(VK_MENU) & 0x8000)
+        result.modifiers |= WebInputEvent::AltKey;
+    if (keyState & MK_LBUTTON)
+        result.modifiers |= WebInputEvent::LeftButtonDown;
+    if (keyState & MK_MBUTTON)
+        result.modifiers |= WebInputEvent::MiddleButtonDown;
+    if (keyState & MK_RBUTTON)
+        result.modifiers |= WebInputEvent::RightButtonDown;
+
+    // Set coordinates by translating event coordinates from screen to client.
+    POINT clientPoint = { result.globalX, result.globalY };
+    MapWindowPoints(0, hwnd, &clientPoint, 1);
+    result.x = clientPoint.x;
+    result.y = clientPoint.y;
+    result.windowX = result.x;
+    result.windowY = result.y;
+
+    // Convert wheel delta amount to a number of pixels to scroll.
+    //
+    // How many pixels should we scroll per line?  Gecko uses the height of the
+    // current line, which means scroll distance changes as you go through the
+    // page or go to different pages.  IE 7 is ~50 px/line, although the value
+    // seems to vary slightly by page and zoom level.  Since IE 7 has a smoothing
+    // algorithm on scrolling, it can get away with slightly larger scroll values
+    // without feeling jerky.  Here we use 100 px per three lines (the default
+    // scroll amount is three lines per wheel tick).
+    static const float scrollbarPixelsPerLine = 100.0f / 3.0f;
+    wheelDelta /= WHEEL_DELTA;
+    float scrollDelta = wheelDelta;
+    if (horizontalScroll) {
+        unsigned long scrollChars = defaultScrollCharsPerWheelDelta;
+        SystemParametersInfo(SPI_GETWHEELSCROLLCHARS, 0, &scrollChars, 0);
+        // TODO(pkasting): Should probably have a different multiplier
+        // scrollbarPixelsPerChar here.
+        scrollDelta *= static_cast<float>(scrollChars) * scrollbarPixelsPerLine;
+    } else {
+        unsigned long scrollLines = defaultScrollLinesPerWheelDelta;
+        SystemParametersInfo(SPI_GETWHEELSCROLLLINES, 0, &scrollLines, 0);
+        if (scrollLines == WHEEL_PAGESCROLL)
+            result.scrollByPage = true;
+        if (!result.scrollByPage)
+            scrollDelta *= static_cast<float>(scrollLines) * scrollbarPixelsPerLine;
+    }
+
+    // Set scroll amount based on above calculations.  WebKit expects positive
+    // deltaY to mean "scroll up" and positive deltaX to mean "scroll left".
+    if (horizontalScroll) {
+        result.deltaX = scrollDelta;
+        result.wheelTicksX = wheelDelta;
+    } else {
+        result.deltaY = scrollDelta;
+        result.wheelTicksY = wheelDelta;
+    }
+
+    return result;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/win/WebScreenInfoFactory.cpp b/WebKit/chromium/src/win/WebScreenInfoFactory.cpp
new file mode 100644
index 0000000..8416acc
--- /dev/null
+++ b/WebKit/chromium/src/win/WebScreenInfoFactory.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebScreenInfoFactory.h"
+
+#include "WebScreenInfo.h"
+
+#include <windows.h>
+
+namespace WebKit {
+
+static WebRect toWebRect(const RECT& input)
+{
+    WebRect output;
+    output.x = input.left;
+    output.y = input.top;
+    output.width = input.right - input.left;
+    output.height = input.bottom - input.top;
+    return output;
+}
+
+WebScreenInfo WebScreenInfoFactory::screenInfo(HWND window)
+{
+    HMONITOR monitor = MonitorFromWindow(window, MONITOR_DEFAULTTOPRIMARY);
+
+    MONITORINFOEX monitorInfo;
+    monitorInfo.cbSize = sizeof(MONITORINFOEX);
+    GetMonitorInfo(monitor, &monitorInfo);
+
+    DEVMODE devMode;
+    devMode.dmSize = sizeof(devMode);
+    devMode.dmDriverExtra = 0;
+    EnumDisplaySettings(monitorInfo.szDevice, ENUM_CURRENT_SETTINGS, &devMode);
+
+    WebScreenInfo results;
+    results.depth = devMode.dmBitsPerPel;
+    results.depthPerComponent = devMode.dmBitsPerPel / 3;  // Assumes RGB
+    results.isMonochrome = devMode.dmColor == DMCOLOR_MONOCHROME;
+    results.rect = toWebRect(monitorInfo.rcMonitor);
+    results.availableRect = toWebRect(monitorInfo.rcWork);
+    return results;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/x11/WebScreenInfoFactory.cpp b/WebKit/chromium/src/x11/WebScreenInfoFactory.cpp
new file mode 100644
index 0000000..548880c
--- /dev/null
+++ b/WebKit/chromium/src/x11/WebScreenInfoFactory.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebScreenInfoFactory.h"
+
+#include "WebScreenInfo.h"
+
+#include <X11/Xlib.h>
+
+namespace WebKit {
+
+WebScreenInfo WebScreenInfoFactory::screenInfo(Display* display, int screenNumber)
+{
+    WebScreenInfo results;
+    // FIXME: not all screens with use 8bpp.
+    results.depthPerComponent = 8;
+
+    int displayWidth = XDisplayWidth(display, screenNumber);
+    int displayHeight = XDisplayHeight(display, screenNumber);
+    results.depth = XDisplayPlanes(display, screenNumber);
+    results.isMonochrome = results.depth == 1;
+
+    results.rect = WebRect(0, 0, displayWidth, displayHeight);
+
+    // I don't know of a way to query the "maximize" size of the window (e.g.
+    // screen size less sidebars etc) since this is something which only the
+    // window manager knows.
+    results.availableRect = results.rect;
+
+    return results;
+}
+
+} // namespace WebKit
diff --git a/WebKit/gtk/ChangeLog b/WebKit/gtk/ChangeLog
index 62aa3da..ac80deb 100644
--- a/WebKit/gtk/ChangeLog
+++ b/WebKit/gtk/ChangeLog
@@ -1,3 +1,438 @@
+2009-12-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Add a missing null-check, that is causing some crash reports.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::committedLoad):
+
+2009-12-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Should provide an API to control the IconDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=32334
+
+        First step towards a full IconDatabase API. This provides
+        notification for pages with favicons, and lets clients handle
+        them.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::registerForIconNotification):
+        (WebKit::FrameLoaderClient::dispatchDidReceiveIcon):
+        * tests/resources/blank.ico: Added.
+        * tests/testwebview.c: Added.
+        (server_callback):
+        (idle_quit_loop_cb):
+        (icon_uri_changed_cb):
+        (icon_loaded_cb):
+        (test_webkit_web_view_icon_uri):
+        (main):
+        * webkit/webkitprivate.cpp:
+        (closeIconDatabaseOnExit):
+        (webkit_init):
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_get_property):
+        (webkit_web_view_finalize):
+        (webkit_web_view_class_init):
+        (webkit_web_view_get_icon_uri):
+        * webkit/webkitwebview.h:
+
+2009-12-08  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Point out the meaning of "Content-Disposition" when implementing the
+        mime-type-policy-decision-requested signal.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init):
+
+2009-12-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Doesn't respect Content-Disposition for downloads, and provides no way for apps to do that
+        https://bugs.webkit.org/show_bug.cgi?id=32247
+
+        Provide a way for applications to respect Content-Disposition, by
+        fetching the WebKitNetworkResponse from the frame during
+        mime-type-policy-decision-requested.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDecidePolicyForMIMEType): Download
+        content when Content-Disposition is attachment.
+        * tests/testmimehandling.c:
+        (server_callback):
+        (mime_type_policy_decision_requested_cb):
+        * tests/testwebframe.c:
+        (test_webkit_web_frame_response):
+        (main):
+        * webkit/webkitprivate.cpp:
+        (WebKit::core):
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_get_network_response):
+        * webkit/webkitwebframe.h:
+
+2009-12-07  Gyuyoung Kim  <gyuyoung@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32024
+        [GTK] WebKit does not compile without JAVASCRIPT_DEBUGGER
+
+        Fix build errors when javascript-debugger is disabled on GTK
+
+        * webkit/webkitwebinspector.cpp:
+        (webkit_web_inspector_set_property):
+        (webkit_web_inspector_get_property):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Eliminate the segfaults which occur when accessing the text interface now
+        implemented by text controls.
+
+        * tests/testatk.c
+        (test_webkit_atk_get_text_at_offset_textarea):
+        (test_webkit_atk_get_text_at_offset_text_input):
+        (main):
+
+2009-12-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        New test to make sure we do not regress this feature anymore. All
+        test files were created by me.
+
+        [GTK] REGRESSION: webkit thinks it can render PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=32183
+
+        * tests/resources/test.html: Added.
+        * tests/resources/test.ogg: Added.
+        * tests/resources/test.pdf: Added.
+        * tests/resources/test.txt: Added.
+        * tests/testmimehandling.c: Added.
+        (server_callback):
+        (idle_quit_loop_cb):
+        (mime_type_policy_decision_requested_cb):
+        (test_mime_type):
+        (test_mime_pdf):
+        (test_mime_html):
+        (test_mime_text):
+        (test_mime_ogg):
+        (main):
+
+2009-12-05  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Use a better URI for the unreachable test. localhost:80 is very
+        likely to be open.
+
+        * tests/testwebdatasource.c:
+        (load_finished_unreachable_cb):
+        (test_webkit_web_data_source_unreachable_uri):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidPushStateWithinPage):
+        (WebKit::FrameLoaderClient::dispatchDidReplaceStateWithinPage):
+        (WebKit::FrameLoaderClient::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        * WebCoreSupport/InspectorClientGtk.cpp:
+        (WebKit::InspectorClient::populateSetting):
+        (WebKit::InspectorClient::storeSetting):
+        * WebCoreSupport/InspectorClientGtk.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidAddBackForwardItem): Add an empty implementation. Method added to FrameLoaderClient by Android (see bug).
+        (WebKit::FrameLoaderClient::dispatchDidRemoveBackForwardItem): ditto.
+        (WebKit::FrameLoaderClient::dispatchDidChangeBackForwardIndex): ditto.
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add API used by the new 'sampleSVGAnimationForElementAtTime' DRT method,
+        forwarding the call to SVGDocumentExtensions, if SVG is enabled.
+
+        Implemented just like the existing pauseAnimation* methods for CSS animations.
+
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_pause_svg_animation):
+
+2009-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Prepare for 1.1.17 release.
+
+        * NEWS:
+        * docs/webkitgtk-docs.sgml:
+        * docs/webkitgtk-sections.txt:
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * webkit/webkitwebview.cpp: Change the path for GOwnPtr.h.
+
+2009-11-24  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        When building up the pango layout from text boxes, only append a
+        newline char after verifying there are no more boxes on this line.
+
+        * tests/testatk.c
+        (test_webkit_atk_get_text_at_offset_newlines):
+        (main):
+
+2009-11-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Web Inspector: Implement "show inspector" in WebKit GTK
+        API and enable console tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31669
+
+        * webkit/webkitwebinspector.cpp:
+        (webkit_web_inspector_show):
+        * webkit/webkitwebinspector.h:
+
+2009-11-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Tab key does not cycle through elements by default
+        https://bugs.webkit.org/show_bug.cgi?id=31505
+
+        Properly localize documentation strings for the
+        tab-key-cycles-through-elements property.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+
+2009-11-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Tab key does not cycle through elements by default
+        https://bugs.webkit.org/show_bug.cgi?id=31505
+
+        Ensure that WebKitWebSettings tab-key-cycles-through-elements
+        property is true by default with the G_PARAM_CONSTRUCT_FLAG.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+
+2009-11-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Failing test media/video-document-types.html
+        https://bugs.webkit.org/show_bug.cgi?id=31352
+
+        Match what Mac has been doing since r36001: cancel the main load,
+        and handle failures caused by 'will be handled by plugin' errors.
+
+        Covered by test media/video-document-types.html
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::committedLoad):
+        (WebKit::FrameLoaderClient::shouldFallBack):
+
+2009-11-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make DRT show web inspector for tests in inspector/ folder.
+        - Updated DRT to show/close inspector for all tests under /inspector
+        - Introduced LayoutTestController::setTimelineProfilingEnabled and
+          WebInspector::setTimelineProfilingEnabled beside setJavaScriptProfilingEnabled
+        - Removed reload on each inspector test
+        - Renamed fast/inspector to fast/inspector-support in order not to trigger
+        inspector for those.
+        - Reimplemented timeline tests in order to get rid of reload there.
+        - Moved tests that don't require harness into the fast group.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31472
+
+        * webkit/webkitwebinspector.cpp:
+        (webkit_web_inspector_class_init):
+        (webkit_web_inspector_set_property):
+        (webkit_web_inspector_get_property):
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Update for changes to FrameLoaderClient
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Reviewed by Dave Hyatt.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+        Replaced windowObjectCleared with this function. Does nothing if the
+        passed-in world is not the mainThreadNormalWorld().
+
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_dump_render_tree):
+
+2009-11-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        Should not print javascript console messages to stdout
+        https://bugs.webkit.org/show_bug.cgi?id=31346
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_real_console_message): Print console messages to
+        stderr instead, using the recommended method (a g_log variant).
+
+2009-11-11  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30221
+        [GTK] fails to load media embedded in iframe element
+
+        The FrameLoader can show Media if the audio/video support is
+        enabled at compile time.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::canShowMIMEType):
+
+2009-11-10  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Remove WebSocket configuration from WebKitWebSettings
+        https://bugs.webkit.org/show_bug.cgi?id=31244
+
+        Remove non-functional enable-web-sockets property from WebKitWebSettings.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        (webkit_web_settings_copy):
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Expose Page::tabKeyCyclesThroughElements in the API
+        https://bugs.webkit.org/show_bug.cgi?id=30482
+
+        Expose Page::tabKeyCyclesThroughElements as a property of
+        WebKitWebSettings.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+        (webkit_web_view_settings_notify):
+
+2009-11-04  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Move handling of target list to PasteboardHelperGtk.
+
+        * WebCoreSupport/PasteboardHelperGtk.cpp:
+        (WebKit::PasteboardHelperGtk::PasteboardHelperGtk):
+        (WebKit::PasteboardHelperGtk::~PasteboardHelperGtk):
+        (WebKit::PasteboardHelperGtk::fullTargetList):
+        * WebCoreSupport/PasteboardHelperGtk.h:
+        * webkit/webkitprivate.cpp:
+        (WebKit::pasteboardHelperInstance):
+        (webkit_init):
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_dispose):
+        (webkit_web_view_init):
+        (webkit_web_view_get_copy_target_list):
+        (webkit_web_view_get_paste_target_list):
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        Added stub implementation for new ChromeClient function.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::focusedNodeChanged):
+        * WebCoreSupport/ChromeClientGtk.h:
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Trivial fix - move public API declaration into the
+        public subsection of the doc.
+
+        * docs/webkitgtk-sections.txt:
+
 2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
         Reviewed by Jan Alonzo.
diff --git a/WebKit/gtk/NEWS b/WebKit/gtk/NEWS
index b901f4b..f40390e 100644
--- a/WebKit/gtk/NEWS
+++ b/WebKit/gtk/NEWS
@@ -1,4 +1,18 @@
 =================
+WebKitGTK+ 1.1.17
+=================
+
+What's new in WebKitGTK+ 1.1.17?
+
+  - New APIs to show and close the web inspector and to inspect an
+    element at the given coordinates.
+  - New property, WebKitWebSettings::tab-key-cycles-through-elements,
+    controls whether TAB is simply interpreted as another keystroke or
+    is used to cycle through the elements in a page.
+  - Many a11y improvements.
+  - The usual amount of random bugfixes.
+
+=================
 WebKitGTK+ 1.1.16
 =================
 
diff --git a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
index 8d31af3..d9a043b 100644
--- a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
@@ -242,6 +242,10 @@ void ChromeClient::takeFocus(FocusDirection)
     unfocus();
 }
 
+void ChromeClient::focusedNodeChanged(Node*)
+{
+}
+
 bool ChromeClient::canRunBeforeUnloadConfirmPanel()
 {
     return true;
diff --git a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
index e321c35..beb7a08 100644
--- a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
@@ -47,6 +47,8 @@ namespace WebKit {
         virtual bool canTakeFocus(WebCore::FocusDirection);
         virtual void takeFocus(WebCore::FocusDirection);
 
+        virtual void focusedNodeChanged(WebCore::Node*);
+
         virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&);
         virtual void show();
 
diff --git a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index 7286625..0eaa7c8 100644
--- a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -149,6 +149,10 @@ void FrameLoaderClient::committedLoad(WebCore::DocumentLoader* loader, const cha
         frameLoader->setEncoding(encoding, userChosen);
         if (data)
             frameLoader->addData(data, length);
+
+        Frame* coreFrame = loader->frame();
+        if (coreFrame && coreFrame->document() && coreFrame->document()->isMediaDocument())
+            loader->cancelMainResourceLoad(frameLoader->client()->pluginWillHandleLoadError(loader->response()));
     }
 
     if (m_pluginView) {
@@ -301,10 +305,19 @@ void FrameLoaderClient::dispatchDecidePolicyForMIMEType(FramePolicyFunction poli
     if (isHandled)
         return;
 
+    GOwnPtr<WebKitNetworkResponse> networkResponse(webkit_web_frame_get_network_response(m_frame));
+    if (networkResponse) {
+        ResourceResponse response = core(networkResponse.get());
+        if (response.isAttachment()) {
+            webkit_web_policy_decision_download(policyDecision);
+            return;
+        }
+    }
+
     if (canShowMIMEType(mimeType))
-        webkit_web_policy_decision_use (policyDecision);
+        webkit_web_policy_decision_use(policyDecision);
     else
-        webkit_web_policy_decision_ignore (policyDecision);
+        webkit_web_policy_decision_ignore(policyDecision);
 }
 
 static WebKitWebNavigationAction* getNavigationAction(const NavigationAction& action, const char* targetFrame)
@@ -500,8 +513,11 @@ String FrameLoaderClient::overrideMediaType() const
     return String();
 }
 
-void FrameLoaderClient::windowObjectCleared()
+void FrameLoaderClient::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 {
+    if (world != mainThreadNormalWorld())
+        return;
+
     // Is this obsolete now?
     g_signal_emit_by_name(m_frame, "cleared");
 
@@ -533,7 +549,7 @@ void FrameLoaderClient::didPerformFirstNavigation() const
 {
 }
 
-void FrameLoaderClient::registerForIconNotification(bool)
+void FrameLoaderClient::registerForIconNotification(bool shouldRegister)
 {
     notImplemented();
 }
@@ -662,6 +678,21 @@ void FrameLoaderClient::dispatchDidChangeLocationWithinPage()
         g_object_notify(G_OBJECT(webView), "uri");
 }
 
+void FrameLoaderClient::dispatchDidPushStateWithinPage()
+{
+    notImplemented();
+}
+
+void FrameLoaderClient::dispatchDidReplaceStateWithinPage()
+{
+    notImplemented();
+}
+
+void FrameLoaderClient::dispatchDidPopStateWithinPage()
+{
+    notImplemented();
+}
+
 void FrameLoaderClient::dispatchWillClose()
 {
     notImplemented();
@@ -671,7 +702,12 @@ void FrameLoaderClient::dispatchDidReceiveIcon()
 {
     WebKitWebView* webView = getViewFromFrame(m_frame);
 
-    g_signal_emit_by_name(webView, "icon-loaded", m_frame);
+    // Avoid reporting favicons for non-main frames.
+    if (m_frame != webkit_web_view_get_main_frame(webView))
+        return;
+
+    g_object_notify(G_OBJECT(webView), "icon-uri");
+    g_signal_emit_by_name(webView, "icon-loaded", webkit_web_view_get_icon_uri(webView));
 }
 
 void FrameLoaderClient::dispatchDidStartProvisionalLoad()
@@ -781,8 +817,10 @@ bool FrameLoaderClient::canHandleRequest(const ResourceRequest&) const
 
 bool FrameLoaderClient::canShowMIMEType(const String& type) const
 {
-    return MIMETypeRegistry::isSupportedImageMIMEType(type) || MIMETypeRegistry::isSupportedNonImageMIMEType(type) ||
-        PluginDatabase::installedPlugins()->isMIMETypeRegistered(type);
+    return (MIMETypeRegistry::isSupportedImageMIMEType(type)
+            || MIMETypeRegistry::isSupportedNonImageMIMEType(type)
+            || MIMETypeRegistry::isSupportedMediaMIMEType(type)
+            || PluginDatabase::installedPlugins()->isMIMETypeRegistered(type));
 }
 
 bool FrameLoaderClient::representationExistsForURLScheme(const String&) const
@@ -993,9 +1031,7 @@ ResourceError FrameLoaderClient::pluginWillHandleLoadError(const ResourceRespons
 
 bool FrameLoaderClient::shouldFallBack(const ResourceError& error)
 {
-    // FIXME: Mac checks for WebKitErrorPlugInWillHandleLoad here to avoid
-    // loading plugin content twice. Do we need it?
-    return !(error.isCancellation() || error.errorCode() == WEBKIT_POLICY_ERROR_FRAME_LOAD_INTERRUPTED_BY_POLICY_CHANGE);
+    return !(error.isCancellation() || error.errorCode() == WEBKIT_POLICY_ERROR_FRAME_LOAD_INTERRUPTED_BY_POLICY_CHANGE || error.errorCode() == WEBKIT_PLUGIN_ERROR_WILL_HANDLE_LOAD);
 }
 
 bool FrameLoaderClient::canCachePage() const
diff --git a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
index 997ea64..cace770 100644
--- a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
@@ -76,6 +76,9 @@ namespace WebKit {
         virtual void dispatchDidCancelClientRedirect();
         virtual void dispatchWillPerformClientRedirect(const WebCore::KURL&, double, double);
         virtual void dispatchDidChangeLocationWithinPage();
+        virtual void dispatchDidPushStateWithinPage();
+        virtual void dispatchDidReplaceStateWithinPage();
+        virtual void dispatchDidPopStateWithinPage();
         virtual void dispatchWillClose();
         virtual void dispatchDidReceiveIcon();
         virtual void dispatchDidStartProvisionalLoad();
@@ -114,7 +117,7 @@ namespace WebKit {
         virtual void redirectDataToPlugin(WebCore::Widget* pluginWidget);
         virtual PassRefPtr<WebCore::Widget> createJavaAppletWidget(const WebCore::IntSize&, WebCore::HTMLAppletElement*, const WebCore::KURL& baseURL, const WTF::Vector<WebCore::String>& paramNames, const WTF::Vector<WebCore::String>& paramValues);
         virtual WebCore::String overrideMediaType() const;
-        virtual void windowObjectCleared();
+        virtual void dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*);
         virtual void documentElementAvailable();
         virtual void didPerformFirstNavigation() const;
 
diff --git a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
index 78f5543..a06ff50 100644
--- a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
@@ -204,18 +204,12 @@ void InspectorClient::inspectorWindowObjectCleared()
     notImplemented();
 }
 
-
-void InspectorClient::populateSetting(const String& key, InspectorController::Setting& setting)
-{
-    notImplemented();
-}
-
-void InspectorClient::storeSetting(const String& key, const InspectorController::Setting& setting)
+void InspectorClient::populateSetting(const String& key, String* value)
 {
     notImplemented();
 }
 
-void InspectorClient::removeSetting(const String& key)
+void InspectorClient::storeSetting(const String& key, const String& value)
 {
     notImplemented();
 }
diff --git a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.h b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.h
index ed9fe08..297fd8f 100644
--- a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.h
@@ -66,9 +66,8 @@ namespace WebKit {
         virtual void hideHighlight();
         virtual void inspectedURLChanged(const WebCore::String& newURL);
 
-        virtual void populateSetting(const WebCore::String& key, WebCore::InspectorController::Setting&);
-        virtual void storeSetting(const WebCore::String& key, const WebCore::InspectorController::Setting&);
-        virtual void removeSetting(const WebCore::String& key);
+        virtual void populateSetting(const WebCore::String& key, WebCore::String* value);
+        virtual void storeSetting(const WebCore::String& key, const WebCore::String& value);
 
         virtual void inspectorWindowObjectCleared();
 
diff --git a/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.cpp b/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.cpp
index f2ea316..c71ef1b 100644
--- a/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.cpp
@@ -31,6 +31,20 @@ using namespace WebCore;
 
 namespace WebKit {
 
+static GdkAtom gdkMarkupAtom = gdk_atom_intern("text/html", FALSE);
+
+PasteboardHelperGtk::PasteboardHelperGtk()
+    : m_targetList(gtk_target_list_new(0, 0))
+{
+    gtk_target_list_add_text_targets(m_targetList, WEBKIT_WEB_VIEW_TARGET_INFO_TEXT);
+    gtk_target_list_add(m_targetList, gdkMarkupAtom, 0, WEBKIT_WEB_VIEW_TARGET_INFO_HTML);
+}
+
+PasteboardHelperGtk::~PasteboardHelperGtk()
+{
+    gtk_target_list_unref(m_targetList);
+}
+
 GtkClipboard* PasteboardHelperGtk::getCurrentTarget(Frame* frame) const
 {
     WebKitWebView* webView = webkit_web_frame_get_web_view(kit(frame));
@@ -55,16 +69,9 @@ GtkClipboard* PasteboardHelperGtk::getPrimary(Frame* frame) const
                                     GDK_SELECTION_PRIMARY);
 }
 
-GtkTargetList* PasteboardHelperGtk::getCopyTargetList(Frame* frame) const
-{
-    WebKitWebView* webView = webkit_web_frame_get_web_view(kit(frame));
-    return webkit_web_view_get_copy_target_list(webView);
-}
-
-GtkTargetList* PasteboardHelperGtk::getPasteTargetList(Frame* frame) const
+GtkTargetList* PasteboardHelperGtk::targetList() const
 {
-    WebKitWebView* webView = webkit_web_frame_get_web_view(kit(frame));
-    return webkit_web_view_get_paste_target_list(webView);
+    return m_targetList;
 }
 
 gint PasteboardHelperGtk::getWebViewTargetInfoHtml() const
diff --git a/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.h b/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.h
index 849b417..12ba207 100644
--- a/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.h
+++ b/WebKit/gtk/WebCoreSupport/PasteboardHelperGtk.h
@@ -39,13 +39,16 @@ namespace WebKit {
 
 class PasteboardHelperGtk : public PasteboardHelper {
 public:
-    PasteboardHelperGtk() { }
+    PasteboardHelperGtk();
+    ~PasteboardHelperGtk();
     virtual GtkClipboard* getCurrentTarget(Frame*) const;
     virtual GtkClipboard* getClipboard(Frame*) const;
     virtual GtkClipboard* getPrimary(Frame*) const;
-    virtual GtkTargetList* getCopyTargetList(Frame*) const;
-    virtual GtkTargetList* getPasteTargetList(Frame*) const;
+    virtual GtkTargetList* targetList() const;
     virtual gint getWebViewTargetInfoHtml() const;
+
+private:
+    GtkTargetList* m_targetList;
 };
 
 }
diff --git a/WebKit/gtk/docs/webkitgtk-docs.sgml b/WebKit/gtk/docs/webkitgtk-docs.sgml
index 7719336..ca478f9 100644
--- a/WebKit/gtk/docs/webkitgtk-docs.sgml
+++ b/WebKit/gtk/docs/webkitgtk-docs.sgml
@@ -93,4 +93,7 @@
   <index id="index-1.1.16" role="1.1.16">
     <title>Index of new symbols in 1.1.16</title>
   </index>
+  <index id="index-1.1.17" role="1.1.17">
+    <title>Index of new symbols in 1.1.17</title>
+  </index>
 </book>
diff --git a/WebKit/gtk/docs/webkitgtk-sections.txt b/WebKit/gtk/docs/webkitgtk-sections.txt
index 8bdd3b3..1f4d1b7 100644
--- a/WebKit/gtk/docs/webkitgtk-sections.txt
+++ b/WebKit/gtk/docs/webkitgtk-sections.txt
@@ -282,6 +282,9 @@ WebKitSoupAuthDialogClass
 WebKitWebInspector
 webkit_web_inspector_get_inspected_uri
 webkit_web_inspector_get_web_view
+webkit_web_inspector_inspect_coordinates
+webkit_web_inspector_show
+webkit_web_inspector_close
 <SUBSECTION Standard>
 WEBKIT_WEB_INSPECTOR
 WEBKIT_IS_WEB_INSPECTOR
@@ -349,6 +352,7 @@ WebKitWebPolicyDecisionPrivate
 <FILE>webkitnetworkrequest</FILE>
 <TITLE>WebKitNetworkRequest</TITLE>
 WebKitNetworkRequest
+webkit_network_request_new
 webkit_network_request_get_uri
 webkit_network_request_get_message
 webkit_network_request_set_uri
@@ -361,7 +365,6 @@ WEBKIT_IS_NETWORK_REQUEST_CLASS
 WEBKIT_NETWORK_REQUEST_GET_CLASS
 <SUBSECTION Private>
 webkit_network_request_get_type
-webkit_network_request_new
 WebKitNetworkRequestPrivate
 WebKitNetworkRequest
 WebKitNetworkRequestClass
diff --git a/WebKit/gtk/tests/resources/blank.ico b/WebKit/gtk/tests/resources/blank.ico
new file mode 100644
index 0000000..ea848b9
--- /dev/null
+++ b/WebKit/gtk/tests/resources/blank.ico
diff --git a/WebKit/gtk/tests/resources/test.html b/WebKit/gtk/tests/resources/test.html
new file mode 100644
index 0000000..98f7d4f
--- /dev/null
+++ b/WebKit/gtk/tests/resources/test.html
@@ -0,0 +1,6 @@
+<html>
+<head><title>test</title></head>
+<body>test</body>
+</html>></head>
+<body>test</body>
+</html>
diff --git a/WebKit/gtk/tests/resources/test.ogg b/WebKit/gtk/tests/resources/test.ogg
new file mode 100644
index 0000000..7f3a3b9
--- /dev/null
+++ b/WebKit/gtk/tests/resources/test.ogg
diff --git a/WebKit/gtk/tests/resources/test.pdf b/WebKit/gtk/tests/resources/test.pdf
new file mode 100644
index 0000000..2424c19
--- /dev/null
+++ b/WebKit/gtk/tests/resources/test.pdf
diff --git a/WebKit/gtk/tests/resources/test.txt b/WebKit/gtk/tests/resources/test.txt
new file mode 100644
index 0000000..9daeafb
--- /dev/null
+++ b/WebKit/gtk/tests/resources/test.txt
@@ -0,0 +1 @@
+test
diff --git a/WebKit/gtk/tests/testatk.c b/WebKit/gtk/tests/testatk.c
index e47898b..c5f4db3 100644
--- a/WebKit/gtk/tests/testatk.c
+++ b/WebKit/gtk/tests/testatk.c
@@ -28,6 +28,12 @@
 
 static const char* contents = "<html><body><p>This is a test. This is the second sentence. And this the third.</p></body></html>";
 
+static const char* contentsWithNewlines = "<html><body><p>This is a test. \n\nThis\n is the second sentence. And this the third.</p></body></html>";
+
+static const char* contentsInTextarea = "<html><body><textarea cols='80'>This is a test. This is the second sentence. And this the third.</textarea></body></html>";
+
+static const char* contentsInTextInput = "<html><body><input type='text' size='80' value='This is a test. This is the second sentence. And this the third.'/></body></html>";
+
 static gboolean bail_out(GMainLoop* loop)
 {
     if (g_main_loop_is_running(loop))
@@ -259,6 +265,105 @@ static void test_webkit_atk_get_text_at_offset(void)
     g_object_unref(webView);
 }
 
+static void test_webkit_atk_get_text_at_offset_newlines(void)
+{
+    WebKitWebView* webView;
+    AtkObject* obj;
+    GMainLoop* loop;
+    AtkText* text_obj;
+
+    webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
+    webkit_web_view_load_string(webView, contentsWithNewlines, NULL, NULL, NULL);
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_main_loop_run(loop);
+
+    /* Get to the inner AtkText object */
+    obj = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+
+    text_obj = ATK_TEXT(obj);
+    g_assert(ATK_IS_TEXT(text_obj));
+
+    run_get_text_tests(text_obj);
+
+    g_object_unref(webView);
+}
+
+static void test_webkit_atk_get_text_at_offset_textarea(void)
+{
+    WebKitWebView* webView;
+    AtkObject* obj;
+    GMainLoop* loop;
+    AtkText* text_obj;
+
+    webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
+    webkit_web_view_load_string(webView, contentsInTextarea, NULL, NULL, NULL);
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_main_loop_run(loop);
+
+    /* Get to the inner AtkText object */
+    obj = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+
+    text_obj = ATK_TEXT(obj);
+    g_assert(ATK_IS_TEXT(text_obj));
+
+    run_get_text_tests(text_obj);
+
+    g_object_unref(webView);
+}
+
+static void test_webkit_atk_get_text_at_offset_text_input(void)
+{
+    WebKitWebView* webView;
+    AtkObject* obj;
+    GMainLoop* loop;
+    AtkText* text_obj;
+
+    webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
+    webkit_web_view_load_string(webView, contentsInTextInput, NULL, NULL, NULL);
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_main_loop_run(loop);
+
+    /* Get to the inner AtkText object */
+    obj = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+
+    text_obj = ATK_TEXT(obj);
+    g_assert(ATK_IS_TEXT(text_obj));
+
+    run_get_text_tests(text_obj);
+
+    g_object_unref(webView);
+}
+
 int main(int argc, char** argv)
 {
     g_thread_init(NULL);
@@ -267,6 +372,9 @@ int main(int argc, char** argv)
     g_test_bug_base("https://bugs.webkit.org/");
     g_test_add_func("/webkit/atk/get_text_at_offset", test_webkit_atk_get_text_at_offset);
     g_test_add_func("/webkit/atk/get_text_at_offset_forms", test_webkit_atk_get_text_at_offset_forms);
+    g_test_add_func("/webkit/atk/get_text_at_offset_newlines", test_webkit_atk_get_text_at_offset_newlines);
+    g_test_add_func("/webkit/atk/get_text_at_offset_textarea", test_webkit_atk_get_text_at_offset_textarea);
+    g_test_add_func("/webkit/atk/get_text_at_offset_text_input", test_webkit_atk_get_text_at_offset_text_input);
     return g_test_run ();
 }
 
diff --git a/WebKit/gtk/tests/testmimehandling.c b/WebKit/gtk/tests/testmimehandling.c
new file mode 100644
index 0000000..e68dcdf
--- /dev/null
+++ b/WebKit/gtk/tests/testmimehandling.c
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2009 Jan Michael Alonzo
+ * Copyright (C) 2009 Gustavo Noronha Silva
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <glib.h>
+#include <glib/gstdio.h>
+#include <libsoup/soup.h>
+#include <string.h>
+#include <webkit/webkit.h>
+
+#if GLIB_CHECK_VERSION(2, 16, 0) && GTK_CHECK_VERSION(2, 14, 0)
+
+GMainLoop* loop;
+SoupSession *session;
+char* base_uri;
+
+/* For real request testing */
+static void
+server_callback(SoupServer *server, SoupMessage *msg,
+                 const char *path, GHashTable *query,
+                 SoupClientContext *context, gpointer data)
+{
+    if (msg->method != SOUP_METHOD_GET) {
+        soup_message_set_status(msg, SOUP_STATUS_NOT_IMPLEMENTED);
+        return;
+    }
+
+    soup_message_set_status(msg, SOUP_STATUS_OK);
+
+    /* PDF */
+    if (g_str_equal(path, "/pdf")) {
+        char* contents;
+        gsize length;
+        GError* error = NULL;
+
+        g_file_get_contents("test.pdf", &contents, &length, &error);
+        g_assert(!error);
+
+        soup_message_body_append(msg->response_body, SOUP_MEMORY_TAKE, contents, length);
+    } else if (g_str_equal(path, "/html")) {
+        char* contents;
+        gsize length;
+        GError* error = NULL;
+
+        g_file_get_contents("test.html", &contents, &length, &error);
+        g_assert(!error);
+
+        soup_message_body_append(msg->response_body, SOUP_MEMORY_TAKE, contents, length);
+    } else if (g_str_equal(path, "/text")) {
+        char* contents;
+        gsize length;
+        GError* error = NULL;
+
+        soup_message_headers_append(msg->response_headers, "Content-Disposition", "attachment; filename=test.txt");
+
+        g_file_get_contents("test.txt", &contents, &length, &error);
+        g_assert(!error);
+
+        soup_message_body_append(msg->response_body, SOUP_MEMORY_TAKE, contents, length);
+    } else if (g_str_equal(path, "/ogg")) {
+        char* contents;
+        gsize length;
+        GError* error = NULL;
+
+        g_file_get_contents("test.ogg", &contents, &length, &error);
+        g_assert(!error);
+
+        soup_message_body_append(msg->response_body, SOUP_MEMORY_TAKE, contents, length);
+    }
+
+    soup_message_body_complete(msg->response_body);
+}
+
+static gboolean idle_quit_loop_cb(gpointer data)
+{
+    g_main_loop_quit(loop);
+    return FALSE;
+}
+
+static gboolean mime_type_policy_decision_requested_cb(WebKitWebView* view, WebKitWebFrame* frame,
+                                                       WebKitNetworkRequest* request, const char* mime_type,
+                                                       WebKitWebPolicyDecision* decision, gpointer data)
+{
+    char* type = (char*)data;
+
+    if (g_str_equal(type, "pdf")) {
+        g_assert_cmpstr(mime_type, ==, "application/pdf");
+        g_assert(!webkit_web_view_can_show_mime_type(view, mime_type));
+    } else if (g_str_equal(type, "html")) {
+        g_assert_cmpstr(mime_type, ==, "text/html");
+        g_assert(webkit_web_view_can_show_mime_type(view, mime_type));
+    } else if (g_str_equal(type, "text")) {
+        WebKitNetworkResponse* response = webkit_web_frame_get_network_response(frame);
+        SoupMessage* message = webkit_network_response_get_message(response);
+        char* disposition;
+
+        g_assert(message);
+        soup_message_headers_get_content_disposition(message->response_headers,
+                                                     &disposition, NULL);
+        g_object_unref(response);
+
+        g_assert_cmpstr(disposition, ==, "attachment");
+        g_free(disposition);
+
+        g_assert_cmpstr(mime_type, ==, "text/plain");
+        g_assert(webkit_web_view_can_show_mime_type(view, mime_type));
+    } else if (g_str_equal(type, "ogg")) {
+        g_assert_cmpstr(mime_type, ==, "audio/ogg");
+        g_assert(webkit_web_view_can_show_mime_type(view, mime_type));
+    }
+
+    g_free(type);
+
+    return FALSE;
+}
+
+static void test_mime_type(const char* name)
+{
+    WebKitWebView* view = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(G_OBJECT(view));
+
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_object_connect(G_OBJECT(view),
+                     "signal::load-finished", idle_quit_loop_cb, NULL,
+                     "signal::mime-type-policy-decision-requested", mime_type_policy_decision_requested_cb, g_strdup(name),
+                     NULL);
+
+    char* effective_uri = g_strdup_printf("%s%s", base_uri, name);
+    webkit_web_view_load_uri(view, effective_uri);
+    g_free(effective_uri);
+
+    g_main_loop_run(loop);
+
+    g_object_unref(view);
+}
+
+static void test_mime_pdf()
+{
+    test_mime_type("pdf");
+}
+
+static void test_mime_html()
+{
+    test_mime_type("html");
+}
+
+static void test_mime_text()
+{
+    test_mime_type("text");
+}
+
+static void test_mime_ogg()
+{
+    test_mime_type("pdf");
+}
+
+int main(int argc, char** argv)
+{
+    SoupServer* server;
+    SoupURI* soup_uri;
+    char* test_dir;
+    char* resources_dir;
+
+    g_thread_init(NULL);
+    gtk_test_init(&argc, &argv, NULL);
+
+    /* Hopefully make test independent of the path it's called from. */
+    test_dir = g_path_get_dirname(argv[0]);
+    resources_dir = g_build_path(G_DIR_SEPARATOR_S, test_dir,
+                                 "..", "..", "..", "..",
+                                 "WebKit", "gtk", "tests", "resources",
+                                 NULL);
+    g_free(test_dir);
+
+    g_chdir(resources_dir);
+    g_free(resources_dir);
+
+    server = soup_server_new(SOUP_SERVER_PORT, 0, NULL);
+    soup_server_run_async(server);
+
+    soup_server_add_handler(server, NULL, server_callback, NULL, NULL);
+
+    soup_uri = soup_uri_new("http://127.0.0.1/");
+    soup_uri_set_port(soup_uri, soup_server_get_port(server));
+
+    base_uri = soup_uri_to_string(soup_uri, FALSE);
+    soup_uri_free(soup_uri);
+
+    g_test_bug_base("https://bugs.webkit.org/");
+    g_test_add_func("/webkit/mime/PDF", test_mime_pdf);
+    g_test_add_func("/webkit/mime/HTML", test_mime_html);
+    g_test_add_func("/webkit/mime/TEXT", test_mime_text);
+    g_test_add_func("/webkit/mime/OGG", test_mime_ogg);
+
+    return g_test_run();
+}
+
+#else
+int main(int argc, char** argv)
+{
+    g_critical("You will need at least glib-2.16.0 and gtk-2.14.0 to run the unit tests. Doing nothing now.");
+    return 0;
+}
+
+#endif
diff --git a/WebKit/gtk/tests/testwebdatasource.c b/WebKit/gtk/tests/testwebdatasource.c
index de2430f..fe5c62f 100644
--- a/WebKit/gtk/tests/testwebdatasource.c
+++ b/WebKit/gtk/tests/testwebdatasource.c
@@ -66,7 +66,7 @@ static void load_finished_unreachable_cb(WebKitWebView* view, WebKitWebFrame* fr
     frame = webkit_web_view_get_main_frame(view);
     datasource = webkit_web_frame_get_data_source(frame);
 
-    g_assert_cmpstr("http://localhost/doireallyexist.html", ==,
+    g_assert_cmpstr("http://this.host.does.not.exist/doireallyexist.html", ==,
                     webkit_web_data_source_get_unreachable_uri(datasource));
 
     if (g_main_loop_is_running(loop))
@@ -149,7 +149,7 @@ static void test_webkit_web_data_source_unreachable_uri()
     g_object_ref_sink(view);
     loop = g_main_loop_new(NULL, TRUE);
     g_signal_connect(view, "load-finished", G_CALLBACK(load_finished_unreachable_cb), loop);
-    webkit_web_view_load_uri(view, "http://localhost/doireallyexist.html");
+    webkit_web_view_load_uri(view, "http://this.host.does.not.exist/doireallyexist.html");
 
     if (!waitTimer)
         waitTimer = g_timeout_add_seconds(defaultTimeout, (GSourceFunc)wait_timer_fired, loop);
diff --git a/WebKit/gtk/tests/testwebframe.c b/WebKit/gtk/tests/testwebframe.c
index 068e2cf..620c9c9 100644
--- a/WebKit/gtk/tests/testwebframe.c
+++ b/WebKit/gtk/tests/testwebframe.c
@@ -155,6 +155,14 @@ cleanup:
     g_free(temporaryFilename);
 }
 
+static void test_webkit_web_frame_response()
+{
+    WebKitWebFrame* frame = g_object_new(WEBKIT_TYPE_WEB_FRAME, NULL);
+    WebKitNetworkResponse* response = webkit_web_frame_get_network_response(frame);
+    g_assert(!response);
+    g_object_unref(frame);
+}
+
 int main(int argc, char** argv)
 {
     g_thread_init(NULL);
@@ -164,6 +172,7 @@ int main(int argc, char** argv)
     g_test_add_func("/webkit/webview/create_destroy", test_webkit_web_frame_create_destroy);
     g_test_add_func("/webkit/webframe/lifetime", test_webkit_web_frame_lifetime);
     g_test_add_func("/webkit/webview/printing", test_webkit_web_frame_printing);
+    g_test_add_func("/webkit/webview/response", test_webkit_web_frame_response);
     return g_test_run ();
 }
 
diff --git a/WebKit/gtk/tests/testwebview.c b/WebKit/gtk/tests/testwebview.c
new file mode 100644
index 0000000..e0921c0
--- /dev/null
+++ b/WebKit/gtk/tests/testwebview.c
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2008 Holger Hans Peter Freyther
+ * Copyright (C) 2009 Collabora Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+
+#include <glib.h>
+#include <glib/gstdio.h>
+#include <gtk/gtk.h>
+#include <webkit/webkit.h>
+
+#if GLIB_CHECK_VERSION(2, 16, 0) && GTK_CHECK_VERSION(2, 14, 0)
+
+GMainLoop* loop;
+SoupSession *session;
+char* base_uri;
+
+/* For real request testing */
+static void
+server_callback(SoupServer* server, SoupMessage* msg,
+                 const char* path, GHashTable* query,
+                 SoupClientContext* context, gpointer data)
+{
+    if (msg->method != SOUP_METHOD_GET) {
+        soup_message_set_status(msg, SOUP_STATUS_NOT_IMPLEMENTED);
+        return;
+    }
+
+    soup_message_set_status(msg, SOUP_STATUS_OK);
+
+    if (g_str_equal(path, "/favicon.ico")) {
+        char* contents;
+        gsize length;
+        GError* error = NULL;
+
+        g_file_get_contents("blank.ico", &contents, &length, &error);
+        g_assert(!error);
+
+        soup_message_body_append(msg->response_body, SOUP_MEMORY_TAKE, contents, length);
+    } else {
+        char* contents = g_strdup("<html><body>test</body></html>");
+        soup_message_body_append(msg->response_body, SOUP_MEMORY_TAKE, contents, strlen(contents));
+    }
+
+    soup_message_body_complete(msg->response_body);
+}
+
+static gboolean idle_quit_loop_cb(gpointer data)
+{
+    g_main_loop_quit(loop);
+    return FALSE;
+}
+
+static void icon_uri_changed_cb(WebKitWebView* web_view, GParamSpec* pspec, gpointer data)
+{
+    gboolean* been_here = (gboolean*)data;
+    char* expected_uri;
+
+    g_assert_cmpstr(g_param_spec_get_name(pspec), ==, "icon-uri");
+
+    expected_uri = g_strdup_printf("%sfavicon.ico", base_uri);
+    g_assert_cmpstr(webkit_web_view_get_icon_uri(web_view), ==, expected_uri);
+    g_free(expected_uri);
+
+    *been_here = TRUE;
+}
+
+static void icon_loaded_cb(WebKitWebView* web_view, char* icon_uri, gpointer data)
+{
+    gboolean* been_here = (gboolean*)data;
+    char* expected_uri = g_strdup_printf("%sfavicon.ico", base_uri);
+    g_assert_cmpstr(icon_uri, ==, expected_uri);
+    g_free(expected_uri);
+
+    g_assert_cmpstr(icon_uri, ==, webkit_web_view_get_icon_uri(web_view));
+
+    *been_here = TRUE;
+}
+
+static void test_webkit_web_view_icon_uri()
+{
+    gboolean been_to_uri_changed = FALSE;
+    gboolean been_to_icon_loaded = FALSE;
+    WebKitWebView* view = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(G_OBJECT(view));
+
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_object_connect(G_OBJECT(view),
+                     "signal::load-finished", idle_quit_loop_cb, NULL,
+                     "signal::notify::icon-uri", icon_uri_changed_cb, &been_to_uri_changed,
+                     "signal::icon-loaded", icon_loaded_cb, &been_to_icon_loaded,
+                     NULL);
+
+    webkit_web_view_load_uri(view, base_uri);
+
+    g_main_loop_run(loop);
+
+    g_assert(been_to_uri_changed);
+    g_assert(been_to_icon_loaded);
+
+    g_object_unref(view);
+}
+
+int main(int argc, char** argv)
+{
+    SoupServer* server;
+    SoupURI* soup_uri;
+    char* test_dir;
+    char* resources_dir;
+
+    g_thread_init(NULL);
+    gtk_test_init(&argc, &argv, NULL);
+
+    /* Hopefully make test independent of the path it's called from. */
+    test_dir = g_path_get_dirname(argv[0]);
+    resources_dir = g_build_path(G_DIR_SEPARATOR_S, test_dir,
+                                 "..", "..", "..", "..",
+                                 "WebKit", "gtk", "tests", "resources",
+                                 NULL);
+    g_free(test_dir);
+
+    g_chdir(resources_dir);
+    g_free(resources_dir);
+
+    server = soup_server_new(SOUP_SERVER_PORT, 0, NULL);
+    soup_server_run_async(server);
+
+    soup_server_add_handler(server, NULL, server_callback, NULL, NULL);
+
+    soup_uri = soup_uri_new("http://127.0.0.1/");
+    soup_uri_set_port(soup_uri, soup_server_get_port(server));
+
+    base_uri = soup_uri_to_string(soup_uri, FALSE);
+    soup_uri_free(soup_uri);
+
+    g_test_bug_base("https://bugs.webkit.org/");
+    g_test_add_func("/webkit/webview/icon-uri", test_webkit_web_view_icon_uri);
+
+    return g_test_run ();
+}
+
+#else
+int main(int argc, char** argv)
+{
+    g_critical("You will need at least glib-2.16.0 and gtk-2.14.0 to run the unit tests. Doing nothing now.");
+    return 0;
+}
+
+#endif
diff --git a/WebKit/gtk/webkit/webkitprivate.cpp b/WebKit/gtk/webkit/webkitprivate.cpp
index 4425dcd..c80160c 100644
--- a/WebKit/gtk/webkit/webkitprivate.cpp
+++ b/WebKit/gtk/webkit/webkitprivate.cpp
@@ -28,6 +28,7 @@
 #include "FrameLoader.h"
 #include "FrameLoaderClientGtk.h"
 #include "HitTestResult.h"
+#include "IconDatabase.h"
 #include <libintl.h>
 #include "Logging.h"
 #include "PageCache.h"
@@ -37,8 +38,11 @@
 #include "ResourceHandle.h"
 #include "ResourceHandleClient.h"
 #include "ResourceHandleInternal.h"
+#include "ResourceResponse.h"
 #include <runtime/InitializeThreading.h>
 #include "SecurityOrigin.h"
+#include <stdlib.h>
+#include "webkitnetworkresponse.h"
 
 #if ENABLE(DATABASE)
 #include "DatabaseTracker.h"
@@ -112,6 +116,15 @@ WebCore::ResourceRequest core(WebKitNetworkRequest* request)
     return ResourceRequest(url);
 }
 
+WebCore::ResourceResponse core(WebKitNetworkResponse* response)
+{
+    SoupMessage* soupMessage = webkit_network_response_get_message(response);
+    if (soupMessage)
+        return ResourceResponse(soupMessage);
+
+    return ResourceResponse();
+}
+
 WebCore::EditingBehavior core(WebKitEditingBehavior type)
 {
     return (WebCore::EditingBehavior)type;
@@ -153,6 +166,12 @@ WebKitHitTestResult* kit(const WebCore::HitTestResult& result)
                                            NULL));
 }
 
+PasteboardHelperGtk* pasteboardHelperInstance()
+{
+    static PasteboardHelperGtk* helper = new PasteboardHelperGtk();
+    return helper;
+}
+
 } /** end namespace WebKit */
 
 namespace WTF {
@@ -208,6 +227,11 @@ static GtkWidget* currentToplevelCallback(WebKitSoupAuthDialog* feature, SoupMes
         return NULL;
 }
 
+static void closeIconDatabaseOnExit()
+{
+    iconDatabase()->close();
+}
+
 void webkit_init()
 {
     static bool isInitialized = false;
@@ -237,7 +261,14 @@ void webkit_init()
 
     PageGroup::setShouldTrackVisitedLinks(true);
 
-    Pasteboard::generalPasteboard()->setHelper(new WebKit::PasteboardHelperGtk());
+    Pasteboard::generalPasteboard()->setHelper(WebKit::pasteboardHelperInstance());
+
+    iconDatabase()->setEnabled(true);
+
+    GOwnPtr<gchar> iconDatabasePath(g_build_filename(g_get_user_data_dir(), "webkit", "icondatabase", NULL));
+    iconDatabase()->open(iconDatabasePath.get());
+
+    atexit(closeIconDatabaseOnExit);
 
     SoupSession* session = webkit_get_default_session();
 
diff --git a/WebKit/gtk/webkit/webkitprivate.h b/WebKit/gtk/webkit/webkitprivate.h
index 088175f..e17e79e 100644
--- a/WebKit/gtk/webkit/webkitprivate.h
+++ b/WebKit/gtk/webkit/webkitprivate.h
@@ -70,6 +70,7 @@ class DownloadClient;
 namespace WebKit {
 
     class DocumentLoader;
+    class PasteboardHelperGtk;
 
     WebKitWebView* getViewFromFrame(WebKitWebFrame*);
 
@@ -97,6 +98,8 @@ namespace WebKit {
     WebCore::SecurityOrigin* core(WebKitSecurityOrigin*);
 
     WebKitHitTestResult* kit(const WebCore::HitTestResult&);
+
+    WebKit::PasteboardHelperGtk* pasteboardHelperInstance();
 }
 
 typedef struct {
@@ -129,9 +132,6 @@ extern "C" {
         bool editable;
         GtkIMContext* imContext;
 
-        GtkTargetList* copy_target_list;
-        GtkTargetList* paste_target_list;
-
         gboolean transparent;
 
         GtkAdjustment* horizontalAdjustment;
@@ -142,6 +142,8 @@ extern "C" {
         char* encoding;
         char* customEncoding;
 
+        char* iconURI;
+
         gboolean disposing;
         gboolean usePrimaryForPaste;
 
@@ -301,6 +303,9 @@ extern "C" {
     WEBKIT_API bool
     webkit_web_frame_pause_transition(WebKitWebFrame* frame, const gchar* name, double time, const gchar* element);
 
+    WEBKIT_API bool
+    webkit_web_frame_pause_svg_animation(WebKitWebFrame* frame, const gchar* animationId, double time, const gchar* elementId);
+
     WEBKIT_API unsigned int
     webkit_web_frame_number_of_active_animations(WebKitWebFrame* frame);
 
diff --git a/WebKit/gtk/webkit/webkitwebframe.cpp b/WebKit/gtk/webkit/webkitwebframe.cpp
index 843f923..64fdc40 100644
--- a/WebKit/gtk/webkit/webkitwebframe.cpp
+++ b/WebKit/gtk/webkit/webkitwebframe.cpp
@@ -54,6 +54,7 @@
 #include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include "SubstituteData.h"
+#include "SVGSMILElement.h"
 
 #include <atk/atk.h>
 #include <JavaScriptCore/APICast.h>
@@ -794,7 +795,7 @@ gchar* webkit_web_frame_dump_render_tree(WebKitWebFrame* frame)
     if (view && view->layoutPending())
         view->layout();
 
-    String string = externalRepresentation(coreFrame->contentRenderer());
+    String string = externalRepresentation(coreFrame);
     return g_strdup(string.utf8().data());
 }
 
@@ -959,6 +960,22 @@ bool webkit_web_frame_pause_transition(WebKitWebFrame* frame, const gchar* name,
     return core(frame)->animation()->pauseTransitionAtTime(coreElement->renderer(), AtomicString(name), time);
 }
 
+bool webkit_web_frame_pause_svg_animation(WebKitWebFrame* frame, const gchar* animationId, double time, const gchar* elementId)
+{
+    ASSERT(core(frame));
+    Document* document = core(frame)->document();
+    if (!document || !document->svgExtensions())
+        return false;
+    Element* coreElement = document->getElementById(AtomicString(animationId));
+    if (!coreElement || !SVGSMILElement::isSMILElement(coreElement))
+        return false;
+#if ENABLE(SVG)
+    return document->accessSVGExtensions()->sampleAnimationAtTime(elementId, static_cast<SVGSMILElement*>(coreElement), time);
+#else
+    return false;
+#endif
+}
+
 unsigned int webkit_web_frame_number_of_active_animations(WebKitWebFrame* frame)
 {
     Frame* coreFrame = core(frame);
@@ -1124,3 +1141,29 @@ void webkit_web_frame_layout(WebKitWebFrame* frame)
 
     view->layout();
 }
+
+/**
+ * webkit_web_frame_get_network_response:
+ * @frame: a #WebKitWebFrame
+ *
+ * Returns a #WebKitNetworkResponse object representing the response
+ * that was given to the request for the given frame, or NULL if the
+ * frame was not created by a load. You must unref the object when you
+ * are done with it.
+ *
+ * Return value: a #WebKitNetworkResponse object
+ *
+ * Since: 1.1.18
+ */
+WebKitNetworkResponse* webkit_web_frame_get_network_response(WebKitWebFrame* frame)
+{
+    Frame* coreFrame = core(frame);
+    if (!coreFrame)
+        return NULL;
+
+    WebCore::DocumentLoader* loader = coreFrame->loader()->activeDocumentLoader();
+    if (!loader)
+        return NULL;
+
+    return webkit_network_response_new_with_core_response(loader->response());
+}
diff --git a/WebKit/gtk/webkit/webkitwebframe.h b/WebKit/gtk/webkit/webkitwebframe.h
index 7a95545..28d7113 100644
--- a/WebKit/gtk/webkit/webkitwebframe.h
+++ b/WebKit/gtk/webkit/webkitwebframe.h
@@ -172,6 +172,9 @@ webkit_web_frame_get_provisional_data_source (WebKitWebFrame       *frame);
 WEBKIT_API WebKitSecurityOrigin*
 webkit_web_frame_get_security_origin         (WebKitWebFrame       *frame);
 
+WEBKIT_API WebKitNetworkResponse*
+webkit_web_frame_get_network_response        (WebKitWebFrame       *frame);
+
 G_END_DECLS
 
 #endif
diff --git a/WebKit/gtk/webkit/webkitwebinspector.cpp b/WebKit/gtk/webkit/webkitwebinspector.cpp
index ee2815c..2feb064 100644
--- a/WebKit/gtk/webkit/webkitwebinspector.cpp
+++ b/WebKit/gtk/webkit/webkitwebinspector.cpp
@@ -83,7 +83,8 @@ enum {
 
     PROP_WEB_VIEW,
     PROP_INSPECTED_URI,
-    PROP_JAVASCRIPT_PROFILING_ENABLED
+    PROP_JAVASCRIPT_PROFILING_ENABLED,
+    PROP_TIMELINE_PROFILING_ENABLED    
 };
 
 G_DEFINE_TYPE(WebKitWebInspector, webkit_web_inspector, G_TYPE_OBJECT)
@@ -300,6 +301,22 @@ static void webkit_web_inspector_class_init(WebKitWebInspectorClass* klass)
                                         FALSE,
                                         WEBKIT_PARAM_READWRITE));
 
+    /**
+    * WebKitWebInspector:timeline-profiling-enabled
+    *
+    * This is enabling Timeline profiling in the Inspector.
+    *
+    * Since: 1.1.17
+    */
+    g_object_class_install_property(gobject_class,
+                                    PROP_TIMELINE_PROFILING_ENABLED,
+                                    g_param_spec_boolean(
+                                        "timeline-profiling-enabled",
+                                        _("Enable Timeline profiling"),
+                                        _("Profile the WebCore instrumentation."),
+                                        FALSE,
+                                        WEBKIT_PARAM_READWRITE));
+
     g_type_class_add_private(klass, sizeof(WebKitWebInspectorPrivate));
 }
 
@@ -329,12 +346,25 @@ static void webkit_web_inspector_set_property(GObject* object, guint prop_id, co
 
     switch(prop_id) {
     case PROP_JAVASCRIPT_PROFILING_ENABLED: {
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         bool enabled = g_value_get_boolean(value);
         WebCore::InspectorController* controller = priv->page->inspectorController();
         if (enabled)
             controller->enableProfiler();
         else
             controller->disableProfiler();
+#else
+        g_message("PROP_JAVASCRIPT_PROFILING_ENABLED is not work because of the javascript debugger is disabled\n");
+#endif
+        break;
+    }
+    case PROP_TIMELINE_PROFILING_ENABLED: {
+        bool enabled = g_value_get_boolean(value);
+        WebCore::InspectorController* controller = priv->page->inspectorController();
+        if (enabled)
+            controller->startTimelineProfiler();
+        else
+            controller->stopTimelineProfiler();
         break;
     }
     default:
@@ -356,7 +386,14 @@ static void webkit_web_inspector_get_property(GObject* object, guint prop_id, GV
         g_value_set_string(value, priv->inspected_uri);
         break;
     case PROP_JAVASCRIPT_PROFILING_ENABLED:
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         g_value_set_boolean(value, priv->page->inspectorController()->profilerEnabled());
+#else
+        g_message("PROP_JAVASCRIPT_PROFILING_ENABLED is not work because of the javascript debugger is disabled\n");
+#endif
+        break;
+    case PROP_TIMELINE_PROFILING_ENABLED:
+        g_value_set_boolean(value, priv->page->inspectorController()->timelineAgent() != 0);
         break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
@@ -437,6 +474,29 @@ webkit_web_inspector_set_inspector_client(WebKitWebInspector* web_inspector, Web
 }
 
 /**
+ * webkit_web_inspector_show:
+ * @web_inspector: the #WebKitWebInspector that will be shown
+ *
+ * Causes the Web Inspector to be shown.
+ *
+ * Since: 1.1.17
+ */
+void webkit_web_inspector_show(WebKitWebInspector* webInspector)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_INSPECTOR(webInspector));
+
+    WebKitWebInspectorPrivate* priv = webInspector->priv;
+
+    Frame* frame = priv->page->focusController()->focusedOrMainFrame();
+    FrameView* view = frame->view();
+
+    if (!view)
+        return;
+
+    priv->page->inspectorController()->show();
+}
+
+/**
  * webkit_web_inspector_inspect_coordinates:
  * @web_inspector: the #WebKitWebInspector that will do the inspection
  * @x: the X coordinate of the node to be inspected
diff --git a/WebKit/gtk/webkit/webkitwebinspector.h b/WebKit/gtk/webkit/webkitwebinspector.h
index 94fd806..bde4854 100644
--- a/WebKit/gtk/webkit/webkitwebinspector.h
+++ b/WebKit/gtk/webkit/webkitwebinspector.h
@@ -64,8 +64,10 @@ WEBKIT_API void
 webkit_web_inspector_inspect_coordinates(WebKitWebInspector* web_inspector, gdouble x, gdouble y);
 
 WEBKIT_API void
-webkit_web_inspector_close(WebKitWebInspector* webInspector);
+webkit_web_inspector_show(WebKitWebInspector* webInspector);
 
+WEBKIT_API void
+webkit_web_inspector_close(WebKitWebInspector* webInspector);
 G_END_DECLS
 
 #endif /* webkitwebinspector_h */
diff --git a/WebKit/gtk/webkit/webkitwebsettings.cpp b/WebKit/gtk/webkit/webkitwebsettings.cpp
index 89c5233..143ae06 100644
--- a/WebKit/gtk/webkit/webkitwebsettings.cpp
+++ b/WebKit/gtk/webkit/webkitwebsettings.cpp
@@ -96,8 +96,8 @@ struct _WebKitWebSettingsPrivate {
     gboolean enable_offline_web_application_cache;
     WebKitEditingBehavior editing_behavior;
     gboolean enable_universal_access_from_file_uris;
-    gboolean enable_web_sockets;
     gboolean enable_dom_paste;
+    gboolean tab_key_cycles_through_elements;
 };
 
 #define WEBKIT_WEB_SETTINGS_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_SETTINGS, WebKitWebSettingsPrivate))
@@ -138,8 +138,8 @@ enum {
     PROP_ENABLE_OFFLINE_WEB_APPLICATION_CACHE,
     PROP_EDITING_BEHAVIOR,
     PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS,
-    PROP_ENABLE_WEB_SOCKETS,
-    PROP_ENABLE_DOM_PASTE
+    PROP_ENABLE_DOM_PASTE,
+    PROP_TAB_KEY_CYCLES_THROUGH_ELEMENTS
 };
 
 // Create a default user agent string
@@ -652,24 +652,6 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
                                                          flags));
 
     /**
-     * WebKitWebSettings:enable-web-sockets
-     *
-     * Whether to enable support for Web Sockets.
-     *
-     * Implementation of Web Sockets is currently considered experimental.
-     * Name of this property and the behavior could change in the future.
-     *
-     * Since: 1.1.16
-     */
-    g_object_class_install_property(gobject_class,
-                                    PROP_ENABLE_WEB_SOCKETS,
-                                    g_param_spec_boolean("enable-web-sockets",
-                                                         _("Enable Web Sockets"),
-                                                         _("Whether to enable Web Sockets"),
-                                                         FALSE,
-                                                         flags));
-
-    /**
      * WebKitWebSettings:enable-dom-paste
      *
      * Whether to enable DOM paste. If set to %TRUE, document.execCommand("Paste")
@@ -684,6 +666,25 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
                                                          _("Whether to enable DOM paste"),
                                                          FALSE,
                                                          flags));
+    /**
+    * WebKitWebSettings:tab-key-cycles-through-elements:
+    *
+    * Whether the tab key cycles through elements on the page.
+    *
+    * If @flag is %TRUE, pressing the tab key will focus the next element in
+    * the @web_view. If @flag is %FALSE, the @web_view will interpret tab
+    * key presses as normal key presses. If the selected element is editable, the
+    * tab key will cause the insertion of a tab character.
+    *
+    * Since: 1.1.17
+    */
+    g_object_class_install_property(gobject_class,
+                                    PROP_TAB_KEY_CYCLES_THROUGH_ELEMENTS,
+                                    g_param_spec_boolean("tab-key-cycles-through-elements",
+                                                         _("Tab key cycles through elements"),
+                                                         _("Whether the tab key cycles through elements on the page."),
+                                                         TRUE,
+                                                         flags));
 
     g_type_class_add_private(klass, sizeof(WebKitWebSettingsPrivate));
 }
@@ -878,12 +879,12 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
     case PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS:
         priv->enable_universal_access_from_file_uris = g_value_get_boolean(value);
         break;
-    case PROP_ENABLE_WEB_SOCKETS:
-        priv->enable_web_sockets = g_value_get_boolean(value);
-        break;
     case PROP_ENABLE_DOM_PASTE:
         priv->enable_dom_paste = g_value_get_boolean(value);
         break;
+    case PROP_TAB_KEY_CYCLES_THROUGH_ELEMENTS:
+        priv->tab_key_cycles_through_elements =  g_value_get_boolean(value);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -995,12 +996,12 @@ static void webkit_web_settings_get_property(GObject* object, guint prop_id, GVa
    case PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS:
         g_value_set_boolean(value, priv->enable_universal_access_from_file_uris);
         break;
-    case PROP_ENABLE_WEB_SOCKETS:
-        g_value_set_boolean(value, priv->enable_web_sockets);
-        break;
     case PROP_ENABLE_DOM_PASTE:
         g_value_set_boolean(value, priv->enable_dom_paste);
         break;
+    case PROP_TAB_KEY_CYCLES_THROUGH_ELEMENTS:
+        g_value_set_boolean(value, priv->tab_key_cycles_through_elements);
+        break;
    default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -1065,7 +1066,6 @@ WebKitWebSettings* webkit_web_settings_copy(WebKitWebSettings* web_settings)
                  "enable-offline-web-application-cache", priv->enable_offline_web_application_cache,
                  "editing-behavior", priv->editing_behavior,
                  "enable-universal-access-from-file-uris", priv->enable_universal_access_from_file_uris,
-                 "enable-web-sockets", priv->enable_web_sockets,
                  "enable-dom-paste", priv->enable_dom_paste,
                  NULL));
 
diff --git a/WebKit/gtk/webkit/webkitwebview.cpp b/WebKit/gtk/webkit/webkitwebview.cpp
index 9f668f4..bebd01a 100644
--- a/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/WebKit/gtk/webkit/webkitwebview.cpp
@@ -59,11 +59,14 @@
 #include "HitTestResult.h"
 #include <glib/gi18n-lib.h>
 #include "GraphicsContext.h"
+#include "IconDatabase.h"
 #include "InspectorClientGtk.h"
 #include "FrameLoader.h"
 #include "FrameView.h"
 #include "MouseEventWithHitTestResults.h"
+#include "Pasteboard.h"
 #include "PasteboardHelper.h"
+#include "PasteboardHelperGtk.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformWheelEvent.h"
 #include "ProgressTracker.h"
@@ -71,7 +74,7 @@
 #include "RenderView.h"
 #include "ScriptValue.h"
 #include "Scrollbar.h"
-#include <wtf/GOwnPtr.h>
+#include <wtf/gtk/GOwnPtr.h>
 
 #include <gdk/gdkkeysyms.h>
 
@@ -131,7 +134,7 @@ enum {
     HOVERING_OVER_LINK,
     POPULATE_POPUP,
     STATUS_BAR_TEXT_CHANGED,
-    ICOND_LOADED,
+    ICON_LOADED,
     SELECTION_CHANGED,
     CONSOLE_MESSAGE,
     SCRIPT_ALERT,
@@ -170,7 +173,8 @@ enum {
     PROP_LOAD_STATUS,
     PROP_PROGRESS,
     PROP_ENCODING,
-    PROP_CUSTOM_ENCODING
+    PROP_CUSTOM_ENCODING,
+    PROP_ICON_URI
 };
 
 static guint webkit_web_view_signals[LAST_SIGNAL] = { 0, };
@@ -352,6 +356,9 @@ static void webkit_web_view_get_property(GObject* object, guint prop_id, GValue*
     case PROP_PROGRESS:
         g_value_set_double(value, webkit_web_view_get_progress(webView));
         break;
+    case PROP_ICON_URI:
+        g_value_set_string(value, webkit_web_view_get_icon_uri(webView));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
     }
@@ -865,7 +872,7 @@ static gboolean webkit_web_view_real_script_prompt(WebKitWebView* webView, WebKi
 
 static gboolean webkit_web_view_real_console_message(WebKitWebView* webView, const gchar* message, unsigned int line, const gchar* sourceId)
 {
-    g_print("console message: %s @%d: %s\n", sourceId, line, message);
+    g_message("console message: %s @%d: %s\n", sourceId, line, message);
     return TRUE;
 }
 
@@ -1001,12 +1008,6 @@ static void webkit_web_view_dispose(GObject* object)
 
         g_object_unref(priv->imContext);
         priv->imContext = NULL;
-
-        gtk_target_list_unref(priv->copy_target_list);
-        priv->copy_target_list = NULL;
-
-        gtk_target_list_unref(priv->paste_target_list);
-        priv->paste_target_list = NULL;
     }
 
     if (priv->mainResource) {
@@ -1030,6 +1031,7 @@ static void webkit_web_view_finalize(GObject* object)
     g_free(priv->mainResourceIdentifier);
     g_free(priv->encoding);
     g_free(priv->customEncoding);
+    g_free(priv->iconURI);
 
     G_OBJECT_CLASS(webkit_web_view_parent_class)->finalize(object);
 }
@@ -1456,11 +1458,14 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
      * Decide whether or not to display the given MIME type.  If this
      * signal is not handled, the default behavior is to show the
      * content of the requested URI if WebKit can show this MIME
-     * type; if WebKit is not able to show the MIME type nothing
-     * happens.
+     * type and the content disposition is not a download; if WebKit
+     * is not able to show the MIME type nothing happens.
      *
      * Notice that if you return TRUE, meaning that you handled the
-     * signal, you are expected to have decided what to do, by calling
+     * signal, you are expected to be aware of the "Content-Disposition"
+     * header. A value of "attachment" usually indicates a download
+     * regardless of the MIME type, see also
+     * soup_message_headers_get_content_disposition(). And you must call
      * webkit_web_policy_decision_ignore(),
      * webkit_web_policy_decision_use(), or
      * webkit_web_policy_decision_download() on the @policy_decision
@@ -1730,14 +1735,24 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             G_TYPE_NONE, 1,
             G_TYPE_STRING);
 
-    webkit_web_view_signals[ICOND_LOADED] = g_signal_new("icon-loaded",
+    /**
+     * WebKitWebView::icon-loaded:
+     * @web_view: the object on which the signal is emitted
+     * @icon_uri: the URI for the icon
+     *
+     * This signal is emitted when the main frame has got a favicon.
+     *
+     * Since: 1.1.18
+     */
+    webkit_web_view_signals[ICON_LOADED] = g_signal_new("icon-loaded",
             G_TYPE_FROM_CLASS(webViewClass),
             (GSignalFlags)G_SIGNAL_RUN_LAST,
             0,
             NULL,
             NULL,
-            g_cclosure_marshal_VOID__VOID,
-            G_TYPE_NONE, 0);
+            g_cclosure_marshal_VOID__STRING,
+            G_TYPE_NONE, 1,
+            G_TYPE_STRING);
 
     webkit_web_view_signals[SELECTION_CHANGED] = g_signal_new("selection-changed",
             G_TYPE_FROM_CLASS(webViewClass),
@@ -2378,6 +2393,20 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
                                                         0.0, 1.0, 1.0,
                                                         WEBKIT_PARAM_READABLE));
 
+    /**
+     * WebKitWebView:icon-uri:
+     *
+     * The URI for the favicon for the #WebKitWebView.
+     *
+     * Since: 1.1.18
+     */
+    g_object_class_install_property(objectClass, PROP_ICON_URI,
+                                    g_param_spec_string("icon-uri",
+                                                        _("Icon URI"),
+                                                        _("The URI for the favicon for the #WebKitWebView."),
+                                                        NULL,
+                                                        WEBKIT_PARAM_READABLE));
+
     g_type_class_add_private(webViewClass, sizeof(WebKitWebViewPrivate));
 }
 
@@ -2392,7 +2421,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
         enableScripts, enablePlugins, enableDeveloperExtras, resizableTextAreas,
         enablePrivateBrowsing, enableCaretBrowsing, enableHTML5Database, enableHTML5LocalStorage,
         enableXSSAuditor, javascriptCanOpenWindows, enableOfflineWebAppCache,
-        enableUniversalAccessFromFileURI, enableDOMPaste;
+        enableUniversalAccessFromFileURI, enableDOMPaste, tabKeyCyclesThroughElements;
 
     WebKitEditingBehavior editingBehavior;
 
@@ -2422,6 +2451,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
                  "editing-behavior", &editingBehavior,
                  "enable-universal-access-from-file-uris", &enableUniversalAccessFromFileURI,
                  "enable-dom-paste", &enableDOMPaste,
+                 "tab-key-cycles-through-elements", &tabKeyCyclesThroughElements,
                  NULL);
 
     settings->setDefaultTextEncodingName(defaultEncoding);
@@ -2450,6 +2480,10 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     settings->setAllowUniversalAccessFromFileURLs(enableUniversalAccessFromFileURI);
     settings->setDOMPasteAllowed(enableDOMPaste);
 
+    Page* page = core(webView);
+    if (page)
+        page->setTabKeyCyclesThroughElements(tabKeyCyclesThroughElements);
+
     g_free(defaultEncoding);
     g_free(cursiveFontFamily);
     g_free(defaultFontFamily);
@@ -2537,6 +2571,11 @@ static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GPar
         settings->setAllowUniversalAccessFromFileURLs(g_value_get_boolean(&value));
     else if (name == g_intern_string("enable-dom-paste"))
         settings->setDOMPasteAllowed(g_value_get_boolean(&value));
+    else if (name == g_intern_string("tab-key-cycles-through-elements")) {
+        Page* page = core(webView);
+        if (page)
+            page->setTabKeyCyclesThroughElements(g_value_get_boolean(&value));
+    }
     else if (!g_object_class_find_property(G_OBJECT_GET_CLASS(webSettings), name))
         g_warning("Unexpected setting '%s'", name);
     g_value_unset(&value);
@@ -2572,17 +2611,6 @@ static void webkit_web_view_init(WebKitWebView* webView)
 
     priv->zoomFullContent = FALSE;
 
-    GdkAtom textHtml = gdk_atom_intern_static_string("text/html");
-    /* Targets for copy */
-    priv->copy_target_list = gtk_target_list_new(NULL, 0);
-    gtk_target_list_add(priv->copy_target_list, textHtml, 0, WEBKIT_WEB_VIEW_TARGET_INFO_HTML);
-    gtk_target_list_add_text_targets(priv->copy_target_list, WEBKIT_WEB_VIEW_TARGET_INFO_TEXT);
-
-    /* Targets for pasting */
-    priv->paste_target_list = gtk_target_list_new(NULL, 0);
-    gtk_target_list_add(priv->paste_target_list, textHtml, 0, WEBKIT_WEB_VIEW_TARGET_INFO_HTML);
-    gtk_target_list_add_text_targets(priv->paste_target_list, WEBKIT_WEB_VIEW_TARGET_INFO_TEXT);
-
     priv->webSettings = webkit_web_settings_new();
     webkit_web_view_update_settings(webView);
     g_signal_connect(priv->webSettings, "notify", G_CALLBACK(webkit_web_view_settings_notify), webView);
@@ -3386,10 +3414,7 @@ void webkit_web_view_set_editable(WebKitWebView* webView, gboolean flag)
  **/
 GtkTargetList* webkit_web_view_get_copy_target_list(WebKitWebView* webView)
 {
-    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), NULL);
-
-    WebKitWebViewPrivate* priv = webView->priv;
-    return priv->copy_target_list;
+    return pasteboardHelperInstance()->targetList();
 }
 
 /**
@@ -3406,10 +3431,7 @@ GtkTargetList* webkit_web_view_get_copy_target_list(WebKitWebView* webView)
  **/
 GtkTargetList* webkit_web_view_get_paste_target_list(WebKitWebView* webView)
 {
-    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), NULL);
-
-    WebKitWebViewPrivate* priv = webView->priv;
-    return priv->paste_target_list;
+    return pasteboardHelperInstance()->targetList();
 }
 
 /**
@@ -3973,3 +3995,27 @@ WebKitHitTestResult* webkit_web_view_get_hit_test_result(WebKitWebView* webView,
 
     return kit(mev.hitTestResult());
 }
+
+/**
+ * webkit_web_view_get_icon_uri:
+ * @web_view: the #WebKitWebView object
+ *
+ * Obtains the URI for the favicon for the given #WebKitWebView, or
+ * %NULL if there is none.
+ *
+ * Return value: the URI for the favicon, or %NULL
+ *
+ * Since: 1.1.18
+ */
+G_CONST_RETURN gchar* webkit_web_view_get_icon_uri(WebKitWebView* webView)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), NULL);
+
+    Page* corePage = core(webView);
+    String iconURL = iconDatabase()->iconURLForPageURL(corePage->mainFrame()->loader()->url().prettyURL());
+
+    WebKitWebViewPrivate* priv = webView->priv;
+    g_free(priv->iconURI);
+    priv->iconURI = g_strdup(iconURL.utf8().data());
+    return priv->iconURI;
+}
diff --git a/WebKit/gtk/webkit/webkitwebview.h b/WebKit/gtk/webkit/webkitwebview.h
index 1297695..8dd7f39 100644
--- a/WebKit/gtk/webkit/webkitwebview.h
+++ b/WebKit/gtk/webkit/webkitwebview.h
@@ -366,6 +366,10 @@ webkit_web_view_get_view_source_mode            (WebKitWebView        *web_view)
 WEBKIT_API WebKitHitTestResult*
 webkit_web_view_get_hit_test_result             (WebKitWebView        *webView,
                                                  GdkEventButton       *event);
+
+WEBKIT_API G_CONST_RETURN gchar *
+webkit_web_view_get_icon_uri                    (WebKitWebView        *webView);
+
 G_END_DECLS
 
 #endif
diff --git a/WebKit/haiku/ChangeLog b/WebKit/haiku/ChangeLog
index 457e3f4..2aa4ad7 100644
--- a/WebKit/haiku/ChangeLog
+++ b/WebKit/haiku/ChangeLog
@@ -1,3 +1,69 @@
+2009-12-06  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Build fix. Add in FrameLoaderClientHaiku the declaration of three functions introduced in r51644.
+
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::dispatchDidPushStateWithinPage):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidReplaceStateWithinPage):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        * WebCoreSupport/InspectorClientHaiku.cpp:
+        (WebCore::InspectorClientHaiku::populateSetting):
+        (WebCore::InspectorClientHaiku::storeSetting):
+        * WebCoreSupport/InspectorClientHaiku.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::dispatchDidAddBackForwardItem): Add an empty implementation. Method added to FrameLoaderClient by Android (see bug).
+        (WebCore::FrameLoaderClientHaiku::dispatchDidRemoveBackForwardItem): ditto.
+        (WebCore::FrameLoaderClientHaiku::dispatchDidChangeBackForwardIndex): ditto.
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Update for changes to FrameLoaderClient
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Reviewed by Dave Hyatt.
+
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::dispatchDidClearWindowObjectInWorld):
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+        Replaced windowObjectCleared with this function. Does nothing if the
+        passed-in world is not the mainThreadNormalWorld().
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        Added stub implementation for new ChromeClient function.
+
+        * WebCoreSupport/ChromeClientHaiku.cpp:
+        (WebCore::ChromeClientHaiku::focusedNodeChanged):
+        * WebCoreSupport/ChromeClientHaiku.h:
+
 2009-10-07  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
diff --git a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp
index 4820d78..24f0b52 100644
--- a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp
+++ b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.cpp
@@ -98,6 +98,10 @@ void ChromeClientHaiku::takeFocus(FocusDirection)
     notImplemented();
 }
 
+void ChromeClientHaiku::focusedNodeChanged(Node*)
+{
+}
+
 Page* ChromeClientHaiku::createWindow(Frame*, const FrameLoadRequest&, const WebCore::WindowFeatures&)
 {
     notImplemented();
diff --git a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h
index a6f57eb..ecd66de 100644
--- a/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h
+++ b/WebKit/haiku/WebCoreSupport/ChromeClientHaiku.h
@@ -57,6 +57,8 @@ namespace WebCore {
         bool canTakeFocus(FocusDirection);
         void takeFocus(FocusDirection);
 
+        void focusedNodeChanged(Node*);
+
         Page* createWindow(Frame*, const FrameLoadRequest&, const WebCore::WindowFeatures&);
         Page* createModalDialog(Frame*, const FrameLoadRequest&);
         void show();
diff --git a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
index 9ade67b..3a84c4f 100644
--- a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
+++ b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
@@ -42,6 +42,7 @@
 #include "Page.h"
 #include "PlatformString.h"
 #include "ResourceRequest.h"
+#include "ScriptController.h"
 #include "WebView.h"
 
 #include <Message.h>
@@ -207,6 +208,21 @@ void FrameLoaderClientHaiku::dispatchDidChangeLocationWithinPage()
     notImplemented();
 }
 
+void FrameLoaderClientHaiku::dispatchDidPushStateWithinPage()
+{
+    notImplemented();
+}
+
+void FrameLoaderClientHaiku::dispatchDidReplaceStateWithinPage()
+{
+    notImplemented();
+}
+
+void FrameLoaderClientHaiku::dispatchDidPopStateWithinPage()
+{
+    notImplemented();
+}
+
 void FrameLoaderClientHaiku::dispatchWillClose()
 {
     notImplemented();
@@ -771,8 +787,11 @@ String FrameLoaderClientHaiku::overrideMediaType() const
     return String();
 }
 
-void FrameLoaderClientHaiku::windowObjectCleared()
+void FrameLoaderClientHaiku::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 {
+    if (world != mainThreadNormalWorld())
+        return;
+
     if (m_webView) {
         BMessage message(JAVASCRIPT_WINDOW_OBJECT_CLEARED);
         m_messenger->SendMessage(&message);
diff --git a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
index d91320c..2ffde8f 100644
--- a/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
+++ b/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
@@ -94,9 +94,11 @@ namespace WebCore {
         virtual void dispatchDidHandleOnloadEvents();
         virtual void dispatchDidReceiveServerRedirectForProvisionalLoad();
         virtual void dispatchDidCancelClientRedirect();
-        virtual void dispatchWillPerformClientRedirect(const KURL&, double interval,
-                                                       double fireDate);
+        virtual void dispatchWillPerformClientRedirect(const KURL&, double interval, double fireDate);
         virtual void dispatchDidChangeLocationWithinPage();
+        virtual void dispatchDidPushStateWithinPage();
+        virtual void dispatchDidReplaceStateWithinPage();
+        virtual void dispatchDidPopStateWithinPage();
         virtual void dispatchWillClose();
         virtual void dispatchDidReceiveIcon();
         virtual void dispatchDidStartProvisionalLoad();
@@ -231,7 +233,7 @@ namespace WebCore {
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType);
         virtual String overrideMediaType() const;
 
-        virtual void windowObjectCleared();
+        virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
         virtual void documentElementAvailable();
 
         virtual void didPerformFirstNavigation() const;
diff --git a/WebKit/haiku/WebCoreSupport/InspectorClientHaiku.cpp b/WebKit/haiku/WebCoreSupport/InspectorClientHaiku.cpp
index 4064c51..f06e96b 100644
--- a/WebKit/haiku/WebCoreSupport/InspectorClientHaiku.cpp
+++ b/WebKit/haiku/WebCoreSupport/InspectorClientHaiku.cpp
@@ -105,17 +105,12 @@ void InspectorClientHaiku::inspectorWindowObjectCleared()
     notImplemented();
 }
 
-void InspectorClientHaiku::populateSetting(const String& key, InspectorController::Setting&)
+void InspectorClientHaiku::populateSetting(const String& key, String* value)
 {
     notImplemented();
 }
 
-void InspectorClientHaiku::storeSetting(const String& key, const InspectorController::Setting&)
-{
-    notImplemented();
-}
-
-void InspectorClientHaiku::removeSetting(const String& key)
+void InspectorClientHaiku::storeSetting(const String& key, const String& value)
 {
     notImplemented();
 }
diff --git a/WebKit/haiku/WebCoreSupport/InspectorClientHaiku.h b/WebKit/haiku/WebCoreSupport/InspectorClientHaiku.h
index 792ef40..8788a5f 100644
--- a/WebKit/haiku/WebCoreSupport/InspectorClientHaiku.h
+++ b/WebKit/haiku/WebCoreSupport/InspectorClientHaiku.h
@@ -61,9 +61,8 @@ namespace WebCore {
 
         virtual void inspectedURLChanged(const String& newURL);
 
-        virtual void populateSetting(const String& key, InspectorController::Setting&);
-        virtual void storeSetting(const String& key, const InspectorController::Setting&);
-        virtual void removeSetting(const String& key);
+        virtual void populateSetting(const WebCore::String& key, WebCore::String* value);
+        virtual void storeSetting(const WebCore::String& key, const WebCore::String& value);
 
         virtual void inspectorWindowObjectCleared();
     };
diff --git a/WebKit/mac/ChangeLog b/WebKit/mac/ChangeLog
index 9104b89..b05f2a8 100644
--- a/WebKit/mac/ChangeLog
+++ b/WebKit/mac/ChangeLog
@@ -1,3 +1,933 @@
+2009-12-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Mac build fix. Unreviewed.
+
+        Re-adds code that was mistakenly removed from my last patch.
+
+        * WebCoreSupport/WebPluginHalterClient.mm:
+        Add necessary #import.
+
+        * WebView/WebDelegateImplementationCaching.h:
+        Declare a new overload of CallUIDelegateReturningBoolean.
+
+        * WebView/WebDelegateImplementationCaching.mm:
+        (CallDelegateReturningBoolean):
+        Add a new overload with different arguments.
+        (CallUIDelegateReturningBoolean):
+        Ditto.
+
+2009-12-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Pass more information about a plug-in to the PluginHalterDelegate
+
+        Reviewed by Adam Roben.
+
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (WebHaltablePlugin::isWindowed):
+        Return false - the Mac doesn't really have windowed plug-ins.
+        (WebHaltablePlugin::pluginName):
+        Return the name from the plug-in package.
+
+        * WebCoreSupport/WebPluginHalterClient.h:
+        Update for new parameters.
+
+        * WebCoreSupport/WebPluginHalterClient.mm:
+        (WebPluginHalterClient::shouldHaltPlugin):
+        Ditto; pass them when making the delegate call.
+
+        * WebView/WebUIDelegatePrivate.h:
+        Update for new parameters.
+
+2009-12-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7295070> WebKit video fullscreen keeps playing after closing the window
+        
+        Fix a leak of the QTMovieView when exiting fullscreen video, and remove the
+        old workaround.
+
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController windowDidLoad]): Set the movie view as the contentView directly.
+        (-[WebVideoFullscreenController setMediaElement:WebCore::]): Cast the contentView to a movie view.
+        (-[WebVideoFullscreenController windowDidExitFullscreen]): Remove the old workaround.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Removed.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Added.
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-12-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7450481> One compositing test keeps DRT in "compositing mode", breaks repaint tests
+
+        The counter that WebView used to keep track of the number of enclosed WebHTMLViews using
+        accelerated compositing was hard to manage, and maintained incorrectly in a number of cases.
+        This caused one compositing test make DumpRenderTree think that all subsequent tests
+        were compositing too.
+        
+        Replace this counter with notifications, which are only fired if a client (DRT) requests them. The
+        notification informs the client that a WebHTMLView entered compositing mode (or an already-
+        compositing WebHTML was added); it does not say when a view becomes uncomposited, or all
+        compositing subviews were removed, since this is tricky to get right.
+        
+        Change -[WebView _isUsingAcceleratedCompositing] to manually walk the frames, and
+        return YES if any document view is composited.
+
+        * WebKit.exp:
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView close]):
+        (-[WebHTMLView viewDidMoveToSuperview]):
+        (-[WebHTMLView attachRootLayer:]):
+        (-[WebHTMLView detachRootLayer]):
+        * WebView/WebView.mm:
+        (+[WebView automaticallyNotifiesObserversForKey:]):
+        (-[WebView _postsAcceleratedCompositingNotifications]):
+        (-[WebView _setPostsAcceleratedCompositingNotifications:]):
+        (-[WebView _isUsingAcceleratedCompositing]):
+        * WebView/WebViewData.h:
+        * WebView/WebViewInternal.h:
+        * WebView/WebViewPrivate.h:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * WebView/WebView.mm:
+        (aeDescFromJSValue):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchDidPushStateWithinPage):
+        (WebFrameLoaderClient::dispatchDidReplaceStateWithinPage):
+        (WebFrameLoaderClient::dispatchDidPopStateWithinPage):
+        * WebView/WebDelegateImplementationCaching.h:
+        * WebView/WebFrameLoadDelegatePrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _cacheFrameLoadDelegateImplementations]):
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        * WebCoreSupport/WebInspectorClient.h:
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController showWindow:]):
+        (-[WebInspectorWindowController attach]):
+        (-[WebInspectorWindowController detach]):
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] notifyHistoryItemChanged() should pass a pointer to the HistoryItem that changed.
+        https://bugs.webkit.org/show_bug.cgi?id=31915
+
+        * History/WebHistoryItem.mm:
+        (WKNotifyHistoryItemChanged): Update WKNotifyHistoryItemChanged() to add the new HistoryItem parameter added in the WebCore portion of this patch.
+        * History/WebHistoryItemInternal.h: ditto.
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchDidAddBackForwardItem): Add an empty implementation. Method added to FrameLoaderClient by Android (see bug).
+        (WebFrameLoaderClient::dispatchDidRemoveBackForwardItem): ditto.
+        (WebFrameLoaderClient::dispatchDidChangeBackForwardIndex): ditto.
+
+2009-12-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix a mistake in the previous change
+
+        * WebView/WebView.mm:
+        (+[WebView _viewClass:andRepresentationClass:forMIMEType:allowingPlugins:]):
+        Make sure to include the image types’ view and representation classes
+        even when plug-ins are not allowed.
+
+2009-12-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fixed <rdar://problem/7254127> WebKit can load plug-ins even when
+        plug-ins are disabled
+
+        Ensure that the shared WebPluginDatabase is not instantiated if no
+        WebViews are used that have plug-ins enabled.
+
+        * DefaultDelegates/WebDefaultPolicyDelegate.m:
+        (-[WebDefaultPolicyDelegate webView:decidePolicyForMIMEType:request:frame:decisionListener:]):
+        Call -[WebView _canShowMIMEType:] on the WebView instead of calling the
+        class method.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::canShowMIMEType): Ditto.
+        (WebFrameLoaderClient::transitionToCommittedForNewPage): Call
+        -[WebFrameView _viewClassForMIMEType:] on the WebView instead of calling
+        the class method.
+        (WebFrameLoaderClient::objectContentType): Ditto.
+
+        * WebView/WebDataSource.mm:
+        (+[WebDataSource _representationClassForMIMEType:allowingPlugins:]):
+        Added the allowPlugins parameter, which is passed through to
+        +[WebView _viewClass:andRepresentationClass:forMIMEType:allowingPlugins:].
+        (-[WebDataSource _makeRepresentation]): Pass an allowPlugins value
+        based on the WebView’s preferences.
+
+        * WebView/WebFrameView.mm:
+        (-[WebFrameView _makeDocumentViewForDataSource:]): Call
+        -[WebFrameView _viewClassForMIMEType:] instead of calling the class
+        method.
+        (+[WebFrameView _viewClassForMIMEType:allowingPlugins:]): Added the
+        allowPlugins parameter, which is passed through to
+        +[WebView _viewClass:andRepresentationClass:forMIMEType:allowingPlugins:].
+        (-[WebFrameView _viewClassForMIMEType:]): Added. Passes an allowPlugins
+        value based on the WebView’s preferences.
+
+        * WebView/WebFrameViewInternal.h:
+        * WebView/WebView.mm:
+        (+[WebView _viewClass:andRepresentationClass:forMIMEType:allowingPlugins:]):
+        Added the allowPlugins parameter. If false, skip the instantiation of
+        the shared WebPluginDatabase.
+        (-[WebView _viewClass:andRepresentationClass:forMIMEType:]): Pass an
+        allowPlugins value based on the WebView’s preferences.
+        (+[WebView _canShowMIMEType:allowingPlugins:]): Passes allowPlugins to
+        +_viewClass:andRepresentationClass:forMIMEType:allowingPlugins:.
+        (+[WebView canShowMIMEType:]): Changed to pass YES to
+        +_canShowMIMEType:allowingPlugins:.
+        (-[WebView _canShowMIMEType:]): Added. Passes an allowPlugins value
+        based on the WebView’s preferences.
+        (-[WebView _pluginForMIMEType:]): Return nil if plug-ins are disabled.
+        (-[WebView _pluginForExtension:]): Ditto.
+        (-[WebView _isMIMETypeRegisteredAsPlugin:]): Return NO if plug-ins are
+        disabled.
+        * WebView/WebViewInternal.h:
+
+2009-12-02  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a crash when scrolling a frame that goes away mid-scroll.
+
+        <rdar://problem/7400263>
+
+        Reviewed by John Sullivan.
+
+        * WebView/WebDynamicScrollBarsView.mm:
+        (-[WebDynamicScrollBarsView scrollWheel:]): Retain self incase the last
+        reference is released when calling super.
+
+2009-11-13  Timothy Hatcher  <timothy@apple.com>
+
+        Migrate DOMHTMLInputElementPrivate.h as a private header.
+
+        Reviewed by Darin Adler.
+
+        * MigrateHeaders.make:
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add API used by the new 'sampleSVGAnimationForElementAtTime' DRT method,
+        forwarding the call to SVGDocumentExtensions, if SVG is enabled.
+
+        Implemented just like the existing pauseAnimation* methods for CSS animations.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _pauseSVGAnimation:onSMILNode:atTime:]):
+        * WebView/WebFramePrivate.h:
+
+2009-12-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Simplify [WebView userAgentForURL:].  No need to call into helper function.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::userAgent):
+        * WebView/WebView.mm:
+        (-[WebView userAgentForURL:]):
+        * WebView/WebViewInternal.h:
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+
+        Since WebCore no longer needs to explicitly specify the world on entry to JSC DebuggerCallFrame::evaluate can be called directly.
+
+        * WebView/WebScriptDebugDelegate.mm:
+        (-[WebScriptCallFrame evaluateWebScript:]):
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31844
+        SocketStreamHandleCFNet should support CONNECT proxy credentials
+
+        * WebCoreSupport/WebSystemInterface.m: (InitWebCoreSystemInterface): Add WKSI methods.
+
+2009-11-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        DocumentMarkers need to be educated about transforms
+        https://bugs.webkit.org/show_bug.cgi?id=31751
+        
+        Find highlight is incorrect with transforms
+        <rdar://problem/6358394>
+        
+        Allow callers to specify that Frame::selectionTextRects() takes transforms into account
+        when computing the set of rects that encompass a selection. For transformed elemenets, the
+        selection rect will be the bounding box of the selected content.
+        
+        Fix DocumentMarkers to cache rects in absolute coordinates, rather than painting coordinates.
+        
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView selectionTextRects]):
+        Pass RespectTransforms to get a list of rects with transforms taken into account.
+
+2009-11-23  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Adam Roben.
+        
+        <rdar://problem/7401503>
+        
+        Added a workaround for plug-ins not drawing immediately.
+        
+        * Plugins/WebBaseNetscapePluginView.mm: Added new constant.
+        (-[WebBaseNetscapePluginView _clearSubstituteImage]): Added.
+        (-[WebBaseNetscapePluginView resumeFromHalt]): Call above new method.
+
+2009-11-20  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make sure to export WebSerializedJSValue.
+
+        * WebKit.exp:
+
+2009-11-20  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt and Jon Honeycutt.
+
+        Add support for WebSerializedJSValue to WebKit.  This object wraps the SerializedScriptValue functionality in WebCore
+        and exposes the ability to do JS value serialization/deserialization to WebKit clients.
+
+        * WebView/WebSerializedJSValue.h: Added.
+        * WebView/WebSerializedJSValue.mm: Added.
+        (-[WebSerializedJSValue initWithValue:context:]):
+        (-[WebSerializedJSValue deserialize:]):
+        (-[WebSerializedJSValue dealloc]):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for 'math' role
+        https://bugs.webkit.org/show_bug.cgi?id=31706
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory AXARIAContentGroupText:]):
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        * WebCoreSupport/WebSystemInterface.m:
+        (InitWebCoreSystemInterface):
+            Add QTMovieHasClosedCaptions and QTMovieSetShowClosedCaptions.
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory localizedMediaControlElementString:]):
+        (-[WebViewFactory localizedMediaControlElementHelpText:]):
+            Add accessibility help strings for media controller closed caption button.
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory validationMessageValueMissingText]):
+        (-[WebViewFactory validationMessageTypeMismatchText]):
+        (-[WebViewFactory validationMessagePatternMismatchText]):
+        (-[WebViewFactory validationMessageTooLongText]):
+        (-[WebViewFactory validationMessageRangeUnderflowText]):
+        (-[WebViewFactory validationMessageRangeOverflowText]):
+        (-[WebViewFactory validationMessageStepMismatchText]):
+
+2009-11-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Make the Mac Geolocation API async.
+
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::requestGeolocationPermissionForFrame):
+        (-[WebGeolocationPolicyListener initWithGeolocation:]):
+        (-[WebGeolocationPolicyListener allow]):
+        (-[WebGeolocationPolicyListener deny]):
+        Add WebGeolocationPolicyListener implementation of the new WebGeolocationPolicyListener
+        protocol and use if to implement requestGeolocationPermissionForFrame using the new async
+        API.
+        
+        * WebCoreSupport/WebGeolocation.mm: Removed.
+        * WebCoreSupport/WebGeolocationInternal.h: Removed.
+        * WebCoreSupport/WebGeolocationMock.mm: Remove bogus include.
+        * WebCoreSupport/WebGeolocationPrivate.h: Removed.
+        * WebView/WebUIDelegatePrivate.h: Remove requestGeolocationPermission and add
+        WebGeolocationPolicyListener protocol and decidePolicyForGeolocationRequestFromOrigin delegate
+        method.
+
+2009-11-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add Preferences for WebKitShowDebugBorders and WebKitShowRepaintCounter
+        https://bugs.webkit.org/show_bug.cgi?id=31601
+
+        These are used to debug accelerated compositing layers
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        (-[WebPreferences showDebugBorders]):
+        (-[WebPreferences setShowDebugBorders:]):
+        (-[WebPreferences showRepaintCounter]):
+        (-[WebPreferences setShowRepaintCounter:]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2009-11-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make DRT show web inspector for tests in inspector/ folder.
+        - Updated DRT to show/close inspector for all tests under /inspector
+        - Introduced LayoutTestController::setTimelineProfilingEnabled and
+          WebInspector::setTimelineProfilingEnabled beside setJavaScriptProfilingEnabled
+        - Removed reload on each inspector test
+        - Renamed fast/inspector to fast/inspector-support in order not to trigger
+        inspector for those.
+        - Reimplemented timeline tests in order to get rid of reload there.
+        - Moved tests that don't require harness into the fast group.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31472
+
+        * WebInspector/WebInspector.h:
+        * WebInspector/WebInspector.mm:
+        (-[WebInspector isTimelineProfilingEnabled]):
+        (-[WebInspector setTimelineProfilingEnabled:]):
+
+2009-11-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="directory"
+        https://bugs.webkit.org/show_bug.cgi?id=31516
+
+        Fix a spelling error in the comment of a localized (accessibility) string.
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory AXARIAContentGroupText:]):
+
+2009-11-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7287487> 
+        Do not use QuickTime version to detect media controller theme
+
+        * WebCoreSupport/WebSystemInterface.m:
+        (InitWebCoreSystemInterface): Initialize wkMediaControllerThemeAvailable.
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Tell the WebFrameLoadDelegate when window objects in isolated worlds
+        are cleared
+
+        Fixes <http://webkit.org/b/31124>.
+
+        Reviewed by Dave Hyatt.
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Replaced windowObjectCleared with this function. If the delegate
+        implements it, call
+        -webView:didClearWindowObjectForFrame:inScriptWorld:. Otherwise, if
+        the passed-in world is the mainThreadNormalWorld(), call
+        -webView:didClearWindowObject:forFrame:.
+
+        * WebView/WebDelegateImplementationCaching.h: Added a new entry in the
+        frame load delegate implementation cache for the new delegate method.
+
+        * WebView/WebFrameLoadDelegatePrivate.h:
+        * WebView/WebScriptWorld.mm:
+        (allWorlds): Added. Returns a HashMap of all the WebScriptWorlds in
+        existence.
+        (-[WebScriptWorld initWithWorld:]): Add ourselves to allWorlds().
+        (-[WebScriptWorld dealloc]): Remove ourselves from allWorlds().
+        (+[WebScriptWorld findOrCreateWorld:]): Returns the existing
+        WebScriptWorld for this DOMWrapperWorld, or a new one if one doesn't
+        already exist.
+
+        * WebView/WebScriptWorldInternal.h: Declared +findOrCreateWorld:.
+
+        * WebView/WebView.mm:
+        (-[WebView _cacheFrameLoadDelegateImplementations]): Cache the
+        implementation of the new frame load delegate method.
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Finish replacing worldIDs with world objects
+
+        The only remaining use of worldIDs was in a method only used by DRT
+        for the isolated worlds tests.
+
+        Fixes <http://webkit.org/b/31414> Replace worldIDs with world objects
+
+        Reviewed by Mark Rowe.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:withGlobalObject:inScriptWorld:]):
+        * WebView/WebFramePrivate.h:
+        Renamed from
+        _stringByEvaluatingJavaScriptInIsolatedWorld:WithGobalObject:FromString:.
+        Now takes a WebScriptWorld instead of a worldID, so we don't need to
+        maintain a map of worldID -> world anymore.
+
+2009-11-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        When exiting full-screen video, rather than resetting the system UI
+        mode, restore it to what it was when full-screen mode was entered.
+
+        * WebView/WebVideoFullscreenController.h: Cleaned up style, removed
+        unnecessary imports, and added _savedUIMode and _savedUIOptions ivars.
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController delegate]): Cleaned up style.
+        (-[WebVideoFullscreenController setDelegate:]): Ditto.
+        (-[WebVideoFullscreenController windowDidExitFullscreen]): Restore the
+        system UI mode.
+        (-[WebVideoFullscreenController windowDidEnterFullscreen]): Save the
+        system UI mode.
+        * WebView/WebView.mm: Added now-necessary import.
+
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * Misc/WebCoreStatistics.mm:
+        (-[WebFrame renderTreeAsExternalRepresentation]):
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        WebScriptWorld is the new object that represents a world.  The only
+        place worldID is still used is in -[WebFrame
+        _stringByEvaluatingJavaScriptInIsolatedWorld:WithGlobalObject:FromString:],
+        but that will change soon.
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        * WebKit.exp: Export WebScriptWorld.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _stringByEvaluatingJavaScriptInIsolatedWorld:WithGlobalObject:FromString:]):
+        Moved the bizarre world caching/creation logic that DRT depends on
+        here from the findWorld function in ScriptController.cpp. Updated to
+        use ScriptController::executeScriptInWorld instead of
+        ScriptController::executeScriptInIsolatedWorld.
+        (-[WebFrame _contextForWorld:]): Renamed from contextForWorldID:. Now
+        takes a WebScriptWorld.
+
+        * WebView/WebFramePrivate.h: Replaced contextForWorldID: with
+        _contextForWorld:.
+
+        * WebView/WebScriptWorld.h: Added.
+        * WebView/WebScriptWorld.mm: Added.
+        (-[WebScriptWorld initWithWorld:]): Store the passed-in world in our
+        _private member.
+        (-[WebScriptWorld init]): Create a new DOMWrapperWorld and pass it to
+        -initWithWorld:.
+        (-[WebScriptWorld dealloc]): Release _private.
+        (+[WebScriptWorld standardWorld]): Returns a shared instance that
+        represents WebCore's mainThreadNormalWorld().
+        (+[WebScriptWorld world]): Returns a new instance.
+        (core): Returns the DOMWrapperWorld for this WebScriptWorld.
+
+        * WebView/WebScriptWorldInternal.h: Added.
+
+        * WebView/WebView.mm:
+        (+[WebView _addUserScriptToGroup:world:source:url:whitelist:blacklist:injectionTime:]):
+        (+[WebView _addUserStyleSheetToGroup:world:source:url:whitelist:blacklist:]):
+        (+[WebView _removeUserScriptFromGroup:world:url:]):
+        (+[WebView _removeUserStyleSheetFromGroup:world:url:]):
+        (+[WebView _removeUserScriptsFromGroup:world:]):
+        (+[WebView _removeUserStyleSheetsFromGroup:world:]):
+        * WebView/WebViewPrivate.h:
+        Changed these functions to take a WebScriptWorld instead of a worldID.
+
+2009-11-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA: add alert type roles
+        https://bugs.webkit.org/show_bug.cgi?id=31392
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory AXARIAContentGroupText:]):
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Removed method draggedImage:movedTo:
+
+        * WebView/WebFrame.mm:
+        * WebView/WebFrameInternal.h:
+        * WebView/WebHTMLView.mm:
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Small WebKit part of:
+        Fix for <rdar://problem/7059710> 
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=31196 Implement -webkit-
+        color-correction for CSS colors
+
+        * Misc/WebKitNSStringExtras.mm:
+        (-[NSString _web_drawAtPoint:font:textColor:]): setFillColor now 
+        requires callers to pass a ColorSpace.
+
+2009-11-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Carlson and Darin Adler.
+
+        WebKit part of making full-screen video pause during scrubbing.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h: Added _isScrubbing
+        ivar.
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController dealloc]): Assert that
+        _isScrubbing is NO.
+        (-[WebVideoFullscreenHUDWindowController endScrubbing]): Call
+        HTMLMediaElement::endScrubbing().
+        (-[WebVideoFullscreenHUDWindowController timelinePositionChanged:]):
+        If scrubbing has just begun, call HTMLMediaElement::beginScrubbing()
+        and schedule -endScrubbing to be called when mouse tracking ends.
+
+2009-11-09  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Track "can have scrollbar" state within FrameView independently of the
+        individual scrollbar states in ScrollView.
+
+        rdar://problem/7215132, https://bugs.webkit.org/show_bug.cgi?id=29167
+        REGRESSION (r48064): mint.com loses scrollbars after coming out of
+        edit mode.
+
+        rdar://problem/7314421, https://bugs.webkit.org/show_bug.cgi?id=30517
+        REGRESSION (r48064): Extra scroll bars in GarageBand Lesson Store.
+
+        Test: fast/overflow/scrollbar-restored.html
+
+        * WebView/WebFrameView.mm:
+        (-[WebFrameView _install]):
+
+2009-11-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Made the full-screen video HUD appear when playback stops, such as when
+        the end of the video is reached.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h: Cleaned up.
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController scheduleTimeUpdate]): Updated
+        for the renaming of -updateRate to -updatePlayButton.
+        (-[WebVideoFullscreenHUDWindowController updatePlayButton]): Renamed
+        -updateRate to this.
+        (-[WebVideoFullscreenHUDWindowController updateRate]): This method now
+        responds to changes to the playback rate by updating the play button
+        and showing or hiding the HUD as necessary.
+        (-[WebVideoFullscreenHUDWindowController togglePlaying:]): Now only
+        toggles playing. UI updates are driven by -updateRate being called.
+        (-[WebVideoFullscreenHUDWindowController playing]): Cleaned up.
+
+2009-11-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by John Sullivan and Mark Rowe.
+
+        <rdar://problem/7356733> Voiceover does not read correct media controller time values
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory localizedMediaTimeDescription:]):
+
+2009-11-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Made the remaining time display show negative zero at the end of the
+        video.
+
+        Made other cleanup.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h: Reverted the types of
+        _timeline and _volumeSlider to the more generic NSControl.
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController scheduleTimeUpdate]): Cleaned
+        up style.
+        (-[WebVideoFullscreenHUDWindowController windowDidLoad]): Added an
+        assertion that the cast to NSButton * is legal. Removed casts.
+        (-[WebVideoFullscreenHUDWindowController updateTime]): Use
+        -setValue:forKey: instead of an NSSlider method.
+        (timeToString): Changed to support only non-negative values and
+        simplified.
+        (-[WebVideoFullscreenHUDWindowController remainingTimeText]): Always
+        prepend a “-” to the time.
+
+2009-11-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        WebKit part of making the appearance of the full-screen video HUD match
+        QuickTime Player X’s HUD.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h: Removed unnecessary
+        #import statements, cleaned up style, and changed _timeline,
+        _volumeSlider and _playButton to have more specific types.
+        * WebView/WebVideoFullscreenHUDWindowController.mm: Updated #import
+        statements.
+        (webkit_CGFloor): Added this helper function.
+        (-[WebVideoFullscreenHUDWindowController init]): Cleaned up style.
+        (createTimeTextField): Changed to use the bold system font.
+        (-[WebVideoFullscreenHUDWindowController windowDidLoad]): Changed the
+        subviews’ metrics and the text fields’ text alignment.
+        (-[WebVideoFullscreenHUDWindowController updateTime]): Avoid conversion
+        from double to float.
+        (stringToTimeTextAttributed): Removed this useless function that
+        returned an NSAttributedString masquerading as an NSString.
+        (-[WebVideoFullscreenHUDWindowController remainingTimeText]): Removed
+        call to stringToTimeTextAttributed().
+        (-[WebVideoFullscreenHUDWindowController elapsedTimeText]): Ditto.
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Support ARIA "tab" roles
+        https://bugs.webkit.org/show_bug.cgi?id=30842
+
+        * WebCoreSupport/WebViewFactory.mm:
+        (-[WebViewFactory AXARIAContentGroupText:]):
+
+2009-11-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Made the space bar toggle playing state in full-screen video when
+        modifier keys are down. Made it do so without highlighting the
+        Play/Pause button.
+
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController keyDown:]):
+
+2009-11-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Made the full-screen video HUD respond to the up and down arrow keys by
+        increasing and decreasing the volume by 1/10 of the range or, when
+        combined with the Option key, all the way up or down.
+
+        Made the volume buttons in the full-screen video HUD match the behavior
+        of their equivalents in the QuickTime Player HUD by turning the volume
+        all the way up or down.
+
+        Made the volume slider update immediately when the keyboard or volume
+        buttons are used to change the volume, rather than at the nearest 1/4
+        second interval.
+
+        Made the elapsed and remaining time displays update immediately when the
+        play head is dragged across the timeline, rather than at 1/4 second
+        intervals.
+
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController keyDown:]): Handle the up and
+        down arrow keys.
+        (-[WebVideoFullscreenHUDWindowController windowDidLoad]): Changed the
+        actions of the volume up and volume down buttons.
+        (-[WebVideoFullscreenHUDWindowController setCurrentTime:]): Call
+        -updateTime.
+        (-[WebVideoFullscreenHUDWindowController setVolumeToZero:]): Added this
+        action for the volume down button.
+        (-[WebVideoFullscreenHUDWindowController setVolumeToMaximum:]): Added
+        this action for the volume up button.
+        (-[WebVideoFullscreenHUDWindowController decrementVolume]): No longer
+        and action method.
+        (-[WebVideoFullscreenHUDWindowController incrementVolume]): Ditto.
+        (-[WebVideoFullscreenHUDWindowController setVolume:]): Call
+        -updateVolume.
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        Added stub implementation for new ChromeClient function.
+
+        * WebCoreSupport/WebChromeClient.h:
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::focusedNodeChanged):
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Validate the stopSpeaking: selector so that is not always enabled when a WebView is first responder.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView validateUserInterfaceItemWithoutDelegate:]):
+
+2009-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30932
+        <rdar://problem/7350269>
+        
+        REGRESSION: Crash when turning on Private Browsing on site with flash.
+        
+        Null check setValue.
+        
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView privateBrowsingModeDidChange]):
+
+2009-10-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Refactor some duplicate plug-in clean up code into shared functions.
+
+        * Plugins/WebPluginController.mm:
+        (-[WebPluginController stopOnePlugin:]): New, stop a plug-in.
+        (-[WebPluginController destroyOnePlugin:]): New, destroy plug-in.
+        (-[WebPluginController stopAllPlugins]): Call stopOnePlugin.
+        (-[WebPluginController destroyPlugin:]): Call stopOnePlugin and destroyOnePlugin.
+        (-[WebPluginController destroyAllPlugins]): Call destroyOnePlugin.
+
 2009-10-28  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Simon Fraser.
diff --git a/WebKit/mac/Configurations/FeatureDefines.xcconfig b/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 42aa3cf..cd462d6 100644
--- a/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -44,14 +44,13 @@ ENABLE_DATAGRID = ENABLE_DATAGRID;
 ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
 ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
-ENABLE_FILTERS = ;
+ENABLE_FILTERS = ENABLE_FILTERS;
 ENABLE_GEOLOCATION = ;
 ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
 ENABLE_MATHML = ;
 ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
-ENABLE_RUBY = ENABLE_RUBY;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
@@ -67,4 +66,4 @@ ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebKit/mac/Configurations/Version.xcconfig b/WebKit/mac/Configurations/Version.xcconfig
index fabc009..b3bf41d 100644
--- a/WebKit/mac/Configurations/Version.xcconfig
+++ b/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 4;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebKit/mac/DefaultDelegates/WebDefaultPolicyDelegate.m b/WebKit/mac/DefaultDelegates/WebDefaultPolicyDelegate.m
index c832993..6de2792 100644
--- a/WebKit/mac/DefaultDelegates/WebDefaultPolicyDelegate.m
+++ b/WebKit/mac/DefaultDelegates/WebDefaultPolicyDelegate.m
@@ -66,11 +66,11 @@ static WebDefaultPolicyDelegate *sharedDelegate = nil;
         BOOL isDirectory = NO;
         BOOL exists = [[NSFileManager defaultManager] fileExistsAtPath:[[request URL] path] isDirectory:&isDirectory];
 
-        if (exists && !isDirectory && [WebView canShowMIMEType:type])
+        if (exists && !isDirectory && [wv _canShowMIMEType:type])
             [listener use];
         else
             [listener ignore];
-    } else if ([WebView canShowMIMEType:type])
+    } else if ([wv _canShowMIMEType:type])
         [listener use];
     else
         [listener ignore];
diff --git a/WebKit/mac/MigrateHeaders.make b/WebKit/mac/MigrateHeaders.make
index 9e78367..072da65 100644
--- a/WebKit/mac/MigrateHeaders.make
+++ b/WebKit/mac/MigrateHeaders.make
@@ -106,6 +106,7 @@ all : \
     $(PUBLIC_HEADERS_DIR)/DOMHTMLIFrameElement.h \
     $(PUBLIC_HEADERS_DIR)/DOMHTMLImageElement.h \
     $(PUBLIC_HEADERS_DIR)/DOMHTMLInputElement.h \
+    $(PRIVATE_HEADERS_DIR)/DOMHTMLInputElementPrivate.h \
     $(INTERNAL_HEADERS_DIR)/DOMHTMLInputElementInternal.h \
     $(PUBLIC_HEADERS_DIR)/DOMHTMLIsIndexElement.h \
     $(PUBLIC_HEADERS_DIR)/DOMHTMLLIElement.h \
diff --git a/WebKit/mac/Misc/WebCoreStatistics.mm b/WebKit/mac/Misc/WebCoreStatistics.mm
index 6bac46e..f204ddb 100644
--- a/WebKit/mac/Misc/WebCoreStatistics.mm
+++ b/WebKit/mac/Misc/WebCoreStatistics.mm
@@ -242,7 +242,7 @@ using namespace WebCore;
 
 - (NSString *)renderTreeAsExternalRepresentation
 {
-    return externalRepresentation(_private->coreFrame->contentRenderer());
+    return externalRepresentation(_private->coreFrame);
 }
 
 - (NSString *)counterValueForElement:(DOMElement*)element
diff --git a/WebKit/mac/Misc/WebKitNSStringExtras.mm b/WebKit/mac/Misc/WebKitNSStringExtras.mm
index 5eb3e1f..da46630 100644
--- a/WebKit/mac/Misc/WebKitNSStringExtras.mm
+++ b/WebKit/mac/Misc/WebKitNSStringExtras.mm
@@ -93,7 +93,7 @@ static BOOL canUseFastRenderer(const UniChar *buffer, unsigned length)
         CGFloat blue;
         CGFloat alpha;
         [[textColor colorUsingColorSpaceName:NSDeviceRGBColorSpace] getRed:&red green:&green blue:&blue alpha:&alpha];
-        graphicsContext.setFillColor(makeRGBA(red * 255, green * 255, blue * 255, alpha * 255));
+        graphicsContext.setFillColor(makeRGBA(red * 255, green * 255, blue * 255, alpha * 255), DeviceColorSpace);
 
         webCoreFont.drawText(&graphicsContext, run, FloatPoint(point.x, (flipped ? point.y : (-1 * point.y))));
 
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
index 0b4d56a..bf8b80b 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
@@ -64,6 +64,8 @@
 #define LoginWindowDidSwitchFromUserNotification    @"WebLoginWindowDidSwitchFromUserNotification"
 #define LoginWindowDidSwitchToUserNotification      @"WebLoginWindowDidSwitchToUserNotification"
 
+static const NSTimeInterval ClearSubstituteImageDelay = 0.5;
+
 using namespace WebCore;
 
 class WebHaltablePlugin : public HaltablePlugin {
@@ -77,6 +79,8 @@ private:
     virtual void halt();
     virtual void restart();
     virtual Node* node() const;
+    virtual bool isWindowed() const;
+    virtual String pluginName() const;
 
     WebBaseNetscapePluginView* m_view;
 };
@@ -96,6 +100,16 @@ Node* WebHaltablePlugin::node() const
     return [m_view element];
 }
 
+bool WebHaltablePlugin::isWindowed() const
+{
+    return false;
+}
+
+String WebHaltablePlugin::pluginName() const
+{
+    return [[m_view pluginPackage] name];
+}
+
 @implementation WebBaseNetscapePluginView
 
 + (void)initialize
@@ -498,6 +512,19 @@ Node* WebHaltablePlugin::node() const
     _hasBeenHalted = YES;
 }
 
+- (void)_clearSubstituteImage
+{
+    Element* element = [self element];
+    if (!element)
+        return;
+    
+    RenderObject* renderer = element->renderer();
+    if (!renderer)
+        return;
+    
+    toRenderWidget(renderer)->showSubstituteImage(0);
+}
+
 - (void)resumeFromHalt
 {
     ASSERT(_isHalted);
@@ -508,7 +535,9 @@ Node* WebHaltablePlugin::node() const
         _isHalted = NO;
     
     ASSERT([self element]->renderer());
-    toRenderWidget([self element]->renderer())->showSubstituteImage(0);
+    // FIXME 7417484: This is a workaround for plug-ins not drawing immediately. We'd like to detect when the
+    // plug-in actually draws instead of just assuming it will do so within 0.5 seconds of being restarted.
+    [self performSelector:@selector(_clearSubstituteImage) withObject:nil afterDelay:ClearSubstituteImageDelay];
 }
 
 - (BOOL)isHalted
diff --git a/WebKit/mac/Plugins/WebNetscapePluginView.mm b/WebKit/mac/Plugins/WebNetscapePluginView.mm
index 135d45a..3ce5e39 100644
--- a/WebKit/mac/Plugins/WebNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebNetscapePluginView.mm
@@ -849,7 +849,8 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
     [self willCallPlugInFunction];
     {
         JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-        [_pluginPackage.get() pluginFuncs]->setvalue(plugin, NPNVprivateModeBool, &value);
+        if ([_pluginPackage.get() pluginFuncs]->setvalue)
+            [_pluginPackage.get() pluginFuncs]->setvalue(plugin, NPNVprivateModeBool, &value);
     }
     [self didCallPlugInFunction];
 }
diff --git a/WebKit/mac/Plugins/WebPluginController.mm b/WebKit/mac/Plugins/WebPluginController.mm
index 357cf7b..4343119 100644
--- a/WebKit/mac/Plugins/WebPluginController.mm
+++ b/WebKit/mac/Plugins/WebPluginController.mm
@@ -135,6 +135,28 @@ static NSMutableSet *pluginViews = nil;
     [super dealloc];
 }
 
+- (void)stopOnePlugin:(NSView *)view
+{
+    if ([view respondsToSelector:@selector(webPlugInStop)]) {
+        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        [view webPlugInStop];
+    } else if ([view respondsToSelector:@selector(pluginStop)]) {
+        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        [view pluginStop];
+    }
+}
+
+- (void)destroyOnePlugin:(NSView *)view
+{
+    if ([view respondsToSelector:@selector(webPlugInDestroy)]) {
+        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        [view webPlugInDestroy];
+    } else if ([view respondsToSelector:@selector(pluginDestroy)]) {
+        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        [view pluginDestroy];
+    }
+}
+
 - (void)startAllPlugins
 {
     if (_started)
@@ -167,16 +189,9 @@ static NSMutableSet *pluginViews = nil;
     }
     
     int i, count = [_views count];
-    for (i = 0; i < count; i++) {
-        id aView = [_views objectAtIndex:i];
-        if ([aView respondsToSelector:@selector(webPlugInStop)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-            [aView webPlugInStop];
-        } else if ([aView respondsToSelector:@selector(pluginStop)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-            [aView pluginStop];
-        }
-    }
+    for (i = 0; i < count; i++)
+        [self stopOnePlugin:[_views objectAtIndex:i]];
+
     _started = NO;
 }
 
@@ -228,23 +243,9 @@ static NSMutableSet *pluginViews = nil;
 - (void)destroyPlugin:(NSView *)view
 {
     if ([_views containsObject:view]) {
-        if (_started) {
-            if ([view respondsToSelector:@selector(webPlugInStop)]) {
-                JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-                [view webPlugInStop];
-            } else if ([view respondsToSelector:@selector(pluginStop)]) {
-                JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-                [view pluginStop];
-            }
-        }
-        
-        if ([view respondsToSelector:@selector(webPlugInDestroy)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-            [view webPlugInDestroy];
-        } else if ([view respondsToSelector:@selector(pluginDestroy)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-            [view pluginDestroy];
-        }
+        if (_started)
+            [self stopOnePlugin:view];
+        [self destroyOnePlugin:view];
         
 #if ENABLE(NETSCAPE_PLUGIN_API)
         if (Frame* frame = core([self webFrame]))
@@ -290,13 +291,7 @@ static void cancelOutstandingCheck(const void *item, void *context)
     int i, count = [_views count];
     for (i = 0; i < count; i++) {
         id aView = [_views objectAtIndex:i];
-        if ([aView respondsToSelector:@selector(webPlugInDestroy)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-            [aView webPlugInDestroy];
-        } else if ([aView respondsToSelector:@selector(pluginDestroy)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-            [aView pluginDestroy];
-        }
+        [self destroyOnePlugin:aView];
         
 #if ENABLE(NETSCAPE_PLUGIN_API)
         if (Frame* frame = core([self webFrame]))
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.h b/WebKit/mac/WebCoreSupport/WebChromeClient.h
index a8f22f6..ca2863e 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.h
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.h
@@ -53,6 +53,8 @@ public:
     virtual bool canTakeFocus(WebCore::FocusDirection);
     virtual void takeFocus(WebCore::FocusDirection);
 
+    virtual void focusedNodeChanged(WebCore::Node*);
+
     virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&);
     virtual void show();
 
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.mm b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
index c107299..58323bb 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
@@ -35,7 +35,6 @@
 #import "WebElementDictionary.h"
 #import "WebFrameInternal.h"
 #import "WebFrameView.h"
-#import "WebGeolocationInternal.h"
 #import "WebHTMLViewInternal.h"
 #import "WebHistoryInternal.h"
 #import "WebKitPrefix.h"
@@ -91,12 +90,20 @@
 
 using namespace WebCore;
 
-@interface WebOpenPanelResultListener : NSObject <WebOpenPanelResultListener> {
+@interface WebOpenPanelResultListener : NSObject <WebOpenPanelResultListener>
+{
     FileChooser* _chooser;
 }
 - (id)initWithChooser:(PassRefPtr<FileChooser>)chooser;
 @end
 
+@interface WebGeolocationPolicyListener : NSObject <WebGeolocationPolicyListener>
+{
+    RefPtr<Geolocation> _geolocation;
+}
+- (id)initWithGeolocation:(Geolocation*)geolocation;
+@end
+
 WebChromeClient::WebChromeClient(WebView *webView) 
     : m_webView(webView)
 {
@@ -172,6 +179,10 @@ void WebChromeClient::takeFocus(FocusDirection direction)
     }
 }
 
+void WebChromeClient::focusedNodeChanged(Node*)
+{
+}
+
 Page* WebChromeClient::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features)
 {
     NSURLRequest *URLRequest = nil;
@@ -753,11 +764,19 @@ void WebChromeClient::requestGeolocationPermissionForFrame(Frame* frame, Geoloca
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
+    SEL selector = @selector(webView:decidePolicyForGeolocationRequestFromOrigin:frame:listener:);
+    if (![[m_webView UIDelegate] respondsToSelector:selector]) {
+        geolocation->setIsAllowed(false);
+        return;
+    }
+
     WebSecurityOrigin *webOrigin = [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:frame->document()->securityOrigin()];
-    WebGeolocation *webGeolocation = [[WebGeolocation alloc] _initWithWebCoreGeolocation:geolocation];
-    CallUIDelegate(m_webView, @selector(webView:frame:requestGeolocationPermission:securityOrigin:), kit(frame), webGeolocation, webOrigin);
+    WebGeolocationPolicyListener* listener = [[WebGeolocationPolicyListener alloc] initWithGeolocation:geolocation];
+
+    CallUIDelegate(m_webView, selector, webOrigin, kit(frame), listener);
+
     [webOrigin release];
-    [webGeolocation release];
+    [listener release];
 
     END_BLOCK_OBJC_EXCEPTIONS;
 }
@@ -823,3 +842,25 @@ void WebChromeClient::requestGeolocationPermissionForFrame(Frame* frame, Geoloca
 }
 
 @end
+
+@implementation WebGeolocationPolicyListener
+
+- (id)initWithGeolocation:(Geolocation*)geolocation
+{
+    if (!(self = [super init]))
+        return nil;
+    _geolocation = geolocation;
+    return self;
+}
+
+- (void)allow
+{
+    _geolocation->setIsAllowed(true);
+}
+
+- (void)deny
+{
+    _geolocation->setIsAllowed(false);
+}
+
+@end
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
index cf6eb0b..2774783 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
@@ -91,6 +91,10 @@ private:
     virtual void dispatchDidCancelClientRedirect();
     virtual void dispatchWillPerformClientRedirect(const WebCore::KURL&, double interval, double fireDate);
     virtual void dispatchDidChangeLocationWithinPage();
+    virtual void dispatchDidPushStateWithinPage();
+    virtual void dispatchDidReplaceStateWithinPage();
+    virtual void dispatchDidPopStateWithinPage();
+    
     virtual void dispatchWillClose();
     virtual void dispatchDidReceiveIcon();
     virtual void dispatchDidStartProvisionalLoad();
@@ -194,7 +198,7 @@ private:
     virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL& url, const WebCore::String& mimeType);
     virtual WebCore::String overrideMediaType() const;
     
-    virtual void windowObjectCleared();
+    virtual void dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*);
     virtual void documentElementAvailable();
     virtual void didPerformFirstNavigation() const;
 
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index efd1f68..9816e01 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -69,6 +69,7 @@
 #import "WebPolicyDelegatePrivate.h"
 #import "WebPreferences.h"
 #import "WebResourceLoadDelegate.h"
+#import "WebScriptWorldInternal.h"
 #import "WebSecurityOriginInternal.h"
 #import "WebUIDelegate.h"
 #import "WebUIDelegatePrivate.h"
@@ -128,6 +129,7 @@
 
 using namespace WebCore;
 using namespace HTMLNames;
+using namespace std;
 
 #if ENABLE(MAC_JAVA_BRIDGE)
 @interface NSView (WebJavaPluginDetails)
@@ -536,6 +538,30 @@ void WebFrameLoaderClient::dispatchDidChangeLocationWithinPage()
         CallFrameLoadDelegate(implementations->didChangeLocationWithinPageForFrameFunc, webView, @selector(webView:didChangeLocationWithinPageForFrame:), m_webFrame.get());
 }
 
+void WebFrameLoaderClient::dispatchDidPushStateWithinPage()
+{
+    WebView *webView = getWebView(m_webFrame.get());
+    WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
+    if (implementations->didPushStateWithinPageForFrameFunc)
+        CallFrameLoadDelegate(implementations->didPushStateWithinPageForFrameFunc, webView, @selector(webView:didPushStateWithinPageForFrame:), m_webFrame.get());
+}
+
+void WebFrameLoaderClient::dispatchDidReplaceStateWithinPage()
+{
+    WebView *webView = getWebView(m_webFrame.get());
+    WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
+    if (implementations->didReplaceStateWithinPageForFrameFunc)
+        CallFrameLoadDelegate(implementations->didReplaceStateWithinPageForFrameFunc, webView, @selector(webView:didReplaceStateWithinPageForFrame:), m_webFrame.get());
+}
+
+void WebFrameLoaderClient::dispatchDidPopStateWithinPage()
+{
+    WebView *webView = getWebView(m_webFrame.get());
+    WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
+    if (implementations->didPopStateWithinPageForFrameFunc)
+        CallFrameLoadDelegate(implementations->didPopStateWithinPageForFrameFunc, webView, @selector(webView:didPopStateWithinPageForFrame:), m_webFrame.get());
+}
+
 void WebFrameLoaderClient::dispatchWillClose()
 {
     WebView *webView = getWebView(m_webFrame.get());   
@@ -963,7 +989,7 @@ bool WebFrameLoaderClient::canHandleRequest(const ResourceRequest& request) cons
 
 bool WebFrameLoaderClient::canShowMIMEType(const String& MIMEType) const
 {
-    return [WebView canShowMIMEType:MIMEType];
+    return [getWebView(m_webFrame.get()) _canShowMIMEType:MIMEType];
 }
 
 bool WebFrameLoaderClient::representationExistsForURLScheme(const String& URLScheme) const
@@ -1127,7 +1153,7 @@ void WebFrameLoaderClient::transitionToCommittedForNewPage()
 
     if (usesDocumentViews) {
         // FIXME (Viewless): I assume we want the equivalent of this optimization for viewless mode too.
-        bool willProduceHTMLView = [[WebFrameView class] _viewClassForMIMEType:[dataSource _responseMIMEType]] == [WebHTMLView class];
+        bool willProduceHTMLView = [m_webFrame->_private->webFrameView _viewClassForMIMEType:[dataSource _responseMIMEType]] == [WebHTMLView class];
         bool canSkipCreation = core(m_webFrame.get())->loader()->committingFirstRealLoad() && willProduceHTMLView;
         if (canSkipCreation) {
             [[m_webFrame->_private->webFrameView documentView] setDataSource:dataSource];
@@ -1234,7 +1260,7 @@ String WebFrameLoaderClient::userAgent(const KURL& url)
     if (!webView)
         return String("");
 
-    return [webView _userAgentForURL:url];
+    return [webView userAgentForURL:url];
 }
 
 static const MouseEvent* findMouseEvent(const Event* event)
@@ -1375,7 +1401,7 @@ ObjectContentType WebFrameLoaderClient::objectContentType(const KURL& url, const
         return ObjectContentOtherPlugin;
     }
 
-    if ([WebFrameView _viewClassForMIMEType:type])
+    if ([m_webFrame->_private->webFrameView _viewClassForMIMEType:type])
         return ObjectContentFrame;
     
     return ObjectContentNone;
@@ -1701,12 +1727,23 @@ String WebFrameLoaderClient::overrideMediaType() const
 void WebFrameLoaderClient::documentElementAvailable() {
 }
 
-void WebFrameLoaderClient::windowObjectCleared()
+void WebFrameLoaderClient::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 {
-    Frame *frame = core(m_webFrame.get());
-    ScriptController *script = frame->script();
     WebView *webView = getWebView(m_webFrame.get());
     WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
+
+    if (implementations->didClearWindowObjectForFrameInScriptWorldFunc) {
+        CallFrameLoadDelegate(implementations->didClearWindowObjectForFrameInScriptWorldFunc,
+            webView, @selector(webView:didClearWindowObjectForFrame:inScriptWorld:), m_webFrame.get(), [WebScriptWorld findOrCreateWorld:world]);
+        return;
+    }
+
+    if (world != mainThreadNormalWorld())
+        return;
+
+    Frame *frame = core(m_webFrame.get());
+    ScriptController *script = frame->script();
+
     if (implementations->didClearWindowObjectForFrameFunc) {
         CallFrameLoadDelegate(implementations->didClearWindowObjectForFrameFunc, webView, @selector(webView:didClearWindowObject:forFrame:),
             script->windowScriptObject(), m_webFrame.get());
diff --git a/WebKit/mac/WebCoreSupport/WebGeolocation.mm b/WebKit/mac/WebCoreSupport/WebGeolocation.mm
deleted file mode 100644
index 89d6ad9..0000000
--- a/WebKit/mac/WebCoreSupport/WebGeolocation.mm
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#import "WebGeolocationInternal.h"
-#import <WebCore/Geolocation.h>
-
-using namespace WebCore;
-
-@implementation WebGeolocation (WebInternal)
-
-- (id)_initWithWebCoreGeolocation:(WebCoreGeolocation *)geolocation
-{
-    ASSERT(geolocation);
-
-    self = [super init];
-    if (self) {
-        geolocation->ref();
-        _private = reinterpret_cast<WebGeolocationPrivate*>(geolocation);
-    }
-    return self;
-}
-
-@end
-
-@implementation WebGeolocation
-
-- (BOOL)shouldClearCache
-{
-    return reinterpret_cast<Geolocation*>(_private)->shouldClearCache();
-}
-
-- (void)setIsAllowed:(BOOL)allowed
-{
-    reinterpret_cast<Geolocation*>(_private)->setIsAllowed(allowed);
-}
-
-- (void)dealloc
-{
-    if (_private)
-        reinterpret_cast<Geolocation*>(_private)->deref();
-    [super dealloc];
-}
-
-@end
diff --git a/WebKit/mac/WebCoreSupport/WebGeolocationMock.mm b/WebKit/mac/WebCoreSupport/WebGeolocationMock.mm
index 95b4301..32e8d0d 100644
--- a/WebKit/mac/WebCoreSupport/WebGeolocationMock.mm
+++ b/WebKit/mac/WebCoreSupport/WebGeolocationMock.mm
@@ -25,7 +25,6 @@
 
 #import "WebGeolocationMockPrivate.h"
 
-#import "WebGeolocationInternal.h"
 #import <WebCore/GeolocationServiceMock.h>
 #import <WebCore/Geoposition.h>
 #import <WebCore/PositionError.h>
diff --git a/WebKit/mac/WebCoreSupport/WebInspectorClient.h b/WebKit/mac/WebCoreSupport/WebInspectorClient.h
index 7487728..64621f8 100644
--- a/WebKit/mac/WebCoreSupport/WebInspectorClient.h
+++ b/WebKit/mac/WebCoreSupport/WebInspectorClient.h
@@ -62,9 +62,8 @@ public:
     virtual void hideHighlight();
     virtual void inspectedURLChanged(const WebCore::String& newURL);
 
-    virtual void populateSetting(const WebCore::String& key, WebCore::InspectorController::Setting&);
-    virtual void storeSetting(const WebCore::String& key, const WebCore::InspectorController::Setting&);
-    virtual void removeSetting(const WebCore::String& key);
+    virtual void populateSetting(const WebCore::String& key, WebCore::String* value);
+    virtual void storeSetting(const WebCore::String& key, const WebCore::String& value);
 
     virtual void inspectorWindowObjectCleared();
 
diff --git a/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index 6a4f67d..01515b1 100644
--- a/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -327,8 +327,8 @@ void WebInspectorClient::inspectorWindowObjectCleared()
     _visible = YES;
     
     // If no preference is set - default to an attached window. This is important for inspector LayoutTests.
-    InspectorController::Setting shouldAttach = [_inspectedWebView page]->inspectorController()->setting(inspectorStartsAttachedName);
-    _shouldAttach = (shouldAttach.type() == InspectorController::Setting::BooleanType) ? shouldAttach.booleanValue() : true;
+    String shouldAttach = [_inspectedWebView page]->inspectorController()->setting(inspectorStartsAttachedName);
+    _shouldAttach = shouldAttach != "false";
 
     if (_shouldAttach) {
         WebFrameView *frameView = [[_inspectedWebView mainFrame] frameView];
@@ -362,7 +362,7 @@ void WebInspectorClient::inspectorWindowObjectCleared()
     if (_attachedToInspectedWebView)
         return;
 
-    [_inspectedWebView page]->inspectorController()->setSetting(inspectorStartsAttachedName, InspectorController::Setting(true));
+    [_inspectedWebView page]->inspectorController()->setSetting(inspectorStartsAttachedName, "true");
     _movingWindows = YES;
 
     [self close];
@@ -376,7 +376,7 @@ void WebInspectorClient::inspectorWindowObjectCleared()
     if (!_attachedToInspectedWebView)
         return;
 
-    [_inspectedWebView page]->inspectorController()->setSetting(inspectorStartsAttachedName, InspectorController::Setting(false));
+    [_inspectedWebView page]->inspectorController()->setSetting(inspectorStartsAttachedName, "false");
     _movingWindows = YES;
 
     [self close];
diff --git a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
index 0bab4e3..a0d398d 100644
--- a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
+++ b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
@@ -27,6 +27,7 @@
 
 namespace WebCore {
     class Node;
+    class String;
 }
 
 @class WebView;
@@ -35,7 +36,7 @@ class WebPluginHalterClient : public WebCore::PluginHalterClient {
 public:
     WebPluginHalterClient(WebView *);
     
-    virtual bool shouldHaltPlugin(WebCore::Node*) const;
+    virtual bool shouldHaltPlugin(WebCore::Node*, bool, const WebCore::String&) const;
     virtual bool enabled() const;
     
 private:
diff --git a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
index b83e4c8..0c87d19 100644
--- a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
@@ -28,6 +28,7 @@
 #import "DOMNodeInternal.h"
 #import "WebDelegateImplementationCaching.h"
 #import "WebView.h"
+#import <WebCore/PlatformString.h>
 
 using namespace WebCore;
 
@@ -37,10 +38,10 @@ WebPluginHalterClient::WebPluginHalterClient(WebView *webView)
     ASSERT_ARG(webView, webView);
 }
 
-bool WebPluginHalterClient::shouldHaltPlugin(Node* pluginNode) const
+bool WebPluginHalterClient::shouldHaltPlugin(Node* pluginNode, bool isWindowed, const String& pluginName) const
 {
-    ASSERT_ARG(pluginNode, pluginNode);    
-    return CallUIDelegateReturningBoolean(NO, m_webView, @selector(webView:shouldHaltPlugin:), kit(pluginNode));
+    ASSERT_ARG(pluginNode, pluginNode);
+    return CallUIDelegateReturningBoolean(NO, m_webView, @selector(webView:shouldHaltPlugin:isWindowed:pluginName:), kit(pluginNode), isWindowed, (NSString *)pluginName);
 }
 
 bool WebPluginHalterClient::enabled() const
diff --git a/WebKit/mac/WebCoreSupport/WebSystemInterface.m b/WebKit/mac/WebCoreSupport/WebSystemInterface.m
index f957814..f2a215d 100644
--- a/WebKit/mac/WebCoreSupport/WebSystemInterface.m
+++ b/WebKit/mac/WebCoreSupport/WebSystemInterface.m
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,6 +41,7 @@ void InitWebCoreSystemInterface(void)
 
     INIT(AdvanceDefaultButtonPulseAnimation);
     INIT(CGContextGetShouldSmoothFonts);
+    INIT(CopyCONNECTProxyResponse);
     INIT(CreateCustomCFReadStream);
     INIT(CreateNSURLConnectionDelegateProxy);
     INIT(DrawCapsLockIndicator);
@@ -62,8 +63,11 @@ void InitWebCoreSystemInterface(void)
     INIT(InitializeMaximumHTTPConnectionCountPerHost);
     INIT(IsLatchingWheelEvent);
     INIT(MeasureMediaUIPart);
+    INIT(MediaControllerThemeAvailable);
     INIT(PopupMenu);
     INIT(SetCGFontRenderingMode);
+    INIT(SetCONNECTProxyAuthorizationForStream);
+    INIT(SetCONNECTProxyForStream);
     INIT(SetDragImage);
     INIT(SetNSURLConnectionDefersCallbacks);
     INIT(SetNSURLRequestShouldContentSniff);
@@ -79,6 +83,8 @@ void InitWebCoreSystemInterface(void)
     INIT(QTMovieMaxTimeLoadedChangeNotification);
     INIT(QTMovieMaxTimeSeekable);
     INIT(QTMovieGetType);
+    INIT(QTMovieHasClosedCaptions);
+    INIT(QTMovieSetShowClosedCaptions);
     INIT(QTMovieViewSetDrawSynchronously);
 
 #ifndef BUILDING_ON_TIGER
diff --git a/WebKit/mac/WebCoreSupport/WebViewFactory.mm b/WebKit/mac/WebCoreSupport/WebViewFactory.mm
index 79b2959..99729dc 100644
--- a/WebKit/mac/WebCoreSupport/WebViewFactory.mm
+++ b/WebKit/mac/WebCoreSupport/WebViewFactory.mm
@@ -555,6 +555,12 @@
 
 - (NSString *)AXARIAContentGroupText:(NSString *)ariaType
 {
+    if ([ariaType isEqualToString:@"ARIAApplicationAlert"])
+        return UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
+    if ([ariaType isEqualToString:@"ARIAApplicationAlertDialog"])
+        return UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
+    if ([ariaType isEqualToString:@"ARIAApplicationDialog"])
+        return UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
     if ([ariaType isEqualToString:@"ARIAApplicationLog"])
         return UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
     if ([ariaType isEqualToString:@"ARIAApplicationMarquee"])
@@ -587,6 +593,10 @@
         return UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");    
     if ([ariaType isEqualToString:@"ARIAUserInterfaceTooltip"])
         return UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
+    if ([ariaType isEqualToString:@"ARIATabPanel"])
+        return UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
+    if ([ariaType isEqualToString:@"ARIADocumentMath"])
+        return UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
     return nil;
 }
 
@@ -684,6 +694,11 @@
         return UI_STRING("fast forward", "accessibility role description for fast forward button");
     if ([name isEqualToString:@"SeekBackButton"])
         return UI_STRING("fast reverse", "accessibility role description for fast reverse button");
+    if ([name isEqualToString:@"ShowClosedCaptionsButton"])
+        return UI_STRING("show closed captions", "accessibility role description for show closed captions button");
+    if ([name isEqualToString:@"HideClosedCaptionsButton"])
+        return UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
+
     ASSERT_NOT_REACHED();
     return @"";
 }
@@ -723,6 +738,10 @@
         return UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
     if ([name isEqualToString:@"FullscreenButton"])
         return UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
+    if ([name isEqualToString:@"ShowClosedCaptionsButton"])
+        return UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
+    if ([name isEqualToString:@"HideClosedCaptionsButton"])
+        return UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
     ASSERT_NOT_REACHED();
     return @"";
 }
@@ -730,7 +749,7 @@
 - (NSString*)localizedMediaTimeDescription:(float)time
 {
     if (!isfinite(time))
-        return UI_STRING("indefinite time", "string for an indefinite movie time");
+        return UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
 
     int seconds = (int)fabsf(time); 
     int days = seconds / (60 * 60 * 24);
@@ -739,13 +758,48 @@
     seconds %= 60;
 
     if (days)
-        return [NSString stringWithFormat:UI_STRING("date.format.for.days", "string for days, hours, minutes & seconds"), days, hours, minutes, seconds];
+        return [NSString stringWithFormat:UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds];
     else if (hours)
-        return [NSString stringWithFormat:UI_STRING("date.format.for.hours", "string for hours, minutes & seconds"), hours, minutes, seconds];
+        return [NSString stringWithFormat:UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds];
     else if (minutes)
-        return [NSString stringWithFormat:UI_STRING("date.format.for.minutes", "string for minutes & seconds"), minutes, seconds];
+        return [NSString stringWithFormat:UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds];
+
+    return [NSString stringWithFormat:UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds];
+}
+
+- (NSString *)validationMessageValueMissingText
+{
+    return UI_STRING("value missing", "Validation message for required form control elements that have no value");
+}
+
+- (NSString *)validationMessageTypeMismatchText
+{
+    return UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
+}
+
+- (NSString *)validationMessagePatternMismatchText
+{
+    return UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
+}
+
+- (NSString *)validationMessageTooLongText
+{
+    return UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
+}
 
-    return [NSString stringWithFormat:UI_STRING("date.format.for.seconds", "string for seconds"), seconds];
+- (NSString *)validationMessageRangeUnderflowText
+{
+    return UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
+}
+
+- (NSString *)validationMessageRangeOverflowText
+{
+    return UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
+}
+
+- (NSString *)validationMessageStepMismatchText
+{
+    return UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
 }
 
 @end
diff --git a/WebKit/mac/WebInspector/WebInspector.h b/WebKit/mac/WebInspector/WebInspector.h
index c16726d..fa13c8d 100644
--- a/WebKit/mac/WebInspector/WebInspector.h
+++ b/WebKit/mac/WebInspector/WebInspector.h
@@ -49,6 +49,8 @@
 
 - (BOOL)isJavaScriptProfilingEnabled;
 - (void)setJavaScriptProfilingEnabled:(BOOL)enabled;
+- (BOOL)isTimelineProfilingEnabled;
+- (void)setTimelineProfilingEnabled:(BOOL)enabled;
 
 - (BOOL)isProfilingJavaScript;
 - (void)toggleProfilingJavaScript:(id)sender;
diff --git a/WebKit/mac/WebInspector/WebInspector.mm b/WebKit/mac/WebInspector/WebInspector.mm
index ccb09c5..258dd01 100644
--- a/WebKit/mac/WebInspector/WebInspector.mm
+++ b/WebKit/mac/WebInspector/WebInspector.mm
@@ -148,6 +148,25 @@ using namespace WebCore;
         page->inspectorController()->disableProfiler();
 }
 
+- (BOOL)isTimelineProfilingEnabled
+{
+    if (Page* page = core(_webView))
+        return page->inspectorController()->timelineAgent() ? YES : NO;
+    return NO;
+}
+
+- (void)setTimelineProfilingEnabled:(BOOL)enabled
+{
+    Page* page = core(_webView);
+    if (!page)
+        return;
+
+    if (enabled)
+        page->inspectorController()->startTimelineProfiler();
+    else
+        page->inspectorController()->stopTimelineProfiler();
+}
+
 - (void)close:(id)sender 
 {
     if (Page* page = core(_webView))
diff --git a/WebKit/mac/WebKit.exp b/WebKit/mac/WebKit.exp
index 12507d0..3aa270f 100644
--- a/WebKit/mac/WebKit.exp
+++ b/WebKit/mac/WebKit.exp
@@ -28,7 +28,9 @@
 .objc_class_name_WebRenderNode
 .objc_class_name_WebResource
 .objc_class_name_WebScriptCallFrame
+.objc_class_name_WebScriptWorld
 .objc_class_name_WebSecurityOrigin
+.objc_class_name_WebSerializedJSValue
 .objc_class_name_WebStringTruncator
 .objc_class_name_WebTextIterator
 .objc_class_name_WebURLsWithTitles
@@ -117,3 +119,4 @@ _WebViewDidEndEditingNotification
 _WebViewProgressEstimateChangedNotification
 _WebViewProgressFinishedNotification
 _WebViewProgressStartedNotification
+__WebViewDidStartAcceleratedCompositingNotification
diff --git a/WebKit/mac/WebView/WebDataSource.mm b/WebKit/mac/WebView/WebDataSource.mm
index b83139d..ecd89f7 100644
--- a/WebKit/mac/WebView/WebDataSource.mm
+++ b/WebKit/mac/WebView/WebDataSource.mm
@@ -140,10 +140,10 @@ static inline void addTypesFromClass(NSMutableDictionary *allTypes, Class objCCl
     }
 }
 
-+ (Class)_representationClassForMIMEType:(NSString *)MIMEType
++ (Class)_representationClassForMIMEType:(NSString *)MIMEType allowingPlugins:(BOOL)allowPlugins
 {
     Class repClass;
-    return [WebView _viewClass:nil andRepresentationClass:&repClass forMIMEType:MIMEType] ? repClass : nil;
+    return [WebView _viewClass:nil andRepresentationClass:&repClass forMIMEType:MIMEType allowingPlugins:allowPlugins] ? repClass : nil;
 }
 @end
 
@@ -340,7 +340,7 @@ static inline void addTypesFromClass(NSMutableDictionary *allTypes, Class objCCl
 
 - (void)_makeRepresentation
 {
-    Class repClass = [[self class] _representationClassForMIMEType:[self _responseMIMEType]];
+    Class repClass = [[self class] _representationClassForMIMEType:[self _responseMIMEType] allowingPlugins:[[[self _webView] preferences] arePlugInsEnabled]];
     
     // Check if the data source was already bound?
     if (![[self representation] isKindOfClass:repClass]) {
diff --git a/WebKit/mac/WebView/WebDelegateImplementationCaching.h b/WebKit/mac/WebView/WebDelegateImplementationCaching.h
index edf3cad..3ad064c 100644
--- a/WebKit/mac/WebView/WebDelegateImplementationCaching.h
+++ b/WebKit/mac/WebView/WebDelegateImplementationCaching.h
@@ -49,6 +49,7 @@ struct WebResourceDelegateImplementationCache {
 
 struct WebFrameLoadDelegateImplementationCache {
     IMP didClearWindowObjectForFrameFunc;
+    IMP didClearWindowObjectForFrameInScriptWorldFunc;
     IMP didClearInspectorWindowObjectForFrameFunc;
     IMP windowScriptObjectAvailableFunc;
     IMP didHandleOnloadEventsForFrameFunc;
@@ -56,6 +57,9 @@ struct WebFrameLoadDelegateImplementationCache {
     IMP didCancelClientRedirectForFrameFunc;
     IMP willPerformClientRedirectToURLDelayFireDateForFrameFunc;
     IMP didChangeLocationWithinPageForFrameFunc;
+    IMP didPushStateWithinPageForFrameFunc;
+    IMP didReplaceStateWithinPageForFrameFunc;
+    IMP didPopStateWithinPageForFrameFunc;
     IMP willCloseFrameFunc;
     IMP didStartProvisionalLoadForFrameFunc;
     IMP didReceiveTitleForFrameFunc;
@@ -110,6 +114,7 @@ BOOL CallUIDelegateReturningBoolean(BOOL, WebView *, SEL);
 BOOL CallUIDelegateReturningBoolean(BOOL, WebView *, SEL, id);
 BOOL CallUIDelegateReturningBoolean(BOOL, WebView *, SEL, id, id);
 BOOL CallUIDelegateReturningBoolean(BOOL, WebView *, SEL, id, BOOL);
+BOOL CallUIDelegateReturningBoolean(BOOL, WebView *, SEL, id, BOOL, id);
 
 id CallFrameLoadDelegate(IMP, WebView *, SEL);
 id CallFrameLoadDelegate(IMP, WebView *, SEL, id);
diff --git a/WebKit/mac/WebView/WebDelegateImplementationCaching.mm b/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
index 486d094..54c4c33 100644
--- a/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
+++ b/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
@@ -233,6 +233,20 @@ static inline BOOL CallDelegateReturningBoolean(BOOL result, WebView *self, id d
     return result;
 }
 
+static inline BOOL CallDelegateReturningBoolean(BOOL result, WebView *self, id delegate, SEL selector, id object, BOOL boolean, id object2)
+{
+    if (!delegate || ![delegate respondsToSelector:selector])
+        return result;
+    if (!self->_private->catchesDelegateExceptions)
+        return reinterpret_cast<BOOL (*)(id, SEL, WebView *, id, BOOL, id)>(objc_msgSend)(delegate, selector, self, object, boolean, object2);
+    @try {
+        return reinterpret_cast<BOOL (*)(id, SEL, WebView *, id, BOOL, id)>(objc_msgSend)(delegate, selector, self, object, boolean, object2);
+    } @catch(id exception) {
+        ReportDiscardedDelegateException(selector, exception);
+    }
+    return result;
+}
+
 static inline BOOL CallDelegateReturningBoolean(BOOL result, WebView *self, id delegate, SEL selector, id object1, id object2)
 {
     if (!delegate || ![delegate respondsToSelector:selector])
@@ -456,6 +470,11 @@ BOOL CallUIDelegateReturningBoolean(BOOL result, WebView *self, SEL selector, id
     return CallDelegateReturningBoolean(result, self, self->_private->UIDelegate, selector, object, boolean);
 }
 
+BOOL CallUIDelegateReturningBoolean(BOOL result, WebView *self, SEL selector, id object, BOOL boolean, id object2)
+{
+    return CallDelegateReturningBoolean(result, self, self->_private->UIDelegate, selector, object, boolean, object2);
+}
+
 BOOL CallUIDelegateReturningBoolean(BOOL result, WebView *self, SEL selector, id object1, id object2)
 {
     return CallDelegateReturningBoolean(result, self, self->_private->UIDelegate, selector, object1, object2);
diff --git a/WebKit/mac/WebView/WebDynamicScrollBarsView.mm b/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
index 3c28e3c..b4424e1 100644
--- a/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
+++ b/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
@@ -354,6 +354,10 @@ static const unsigned cMaxUpdateScrollbarsPass = 2;
         }
     }
 
+    // Calling super can release the last reference. <rdar://problem/7400263>
+    // Hold a reference so the code following the super call will not crash.
+    [self retain];
+
     [super scrollWheel:event];
 
     if (!isLatchingEvent) {
@@ -363,6 +367,8 @@ static const unsigned cMaxUpdateScrollbarsPass = 2;
         verticallyPinnedByPreviousWheelEvent = (verticalPosition == 0.0 || verticalPosition == 1.0);
         horizontallyPinnedByPreviousWheelEvent = (horizontalPosition == 0.0 || horizontalPosition == 1.0);
     }
+
+    [self release];
 }
 
 - (BOOL)accessibilityIsIgnored 
diff --git a/WebKit/mac/WebView/WebFrame.mm b/WebKit/mac/WebView/WebFrame.mm
index 94fe997..58400d6 100644
--- a/WebKit/mac/WebView/WebFrame.mm
+++ b/WebKit/mac/WebView/WebFrame.mm
@@ -49,6 +49,7 @@
 #import "WebNSObjectExtras.h"
 #import "WebNSURLExtras.h"
 #import "WebScriptDebugger.h"
+#import "WebScriptWorldInternal.h"
 #import "WebViewInternal.h"
 #import <JavaScriptCore/APICast.h>
 #import <WebCore/AXObjectCache.h>
@@ -78,6 +79,7 @@
 #import <WebCore/RuntimeApplicationChecks.h>
 #import <WebCore/ScriptValue.h>
 #import <WebCore/SmartReplace.h>
+#import <WebCore/SVGSMILElement.h>
 #import <WebCore/TextIterator.h>
 #import <WebCore/ThreadCheck.h>
 #import <WebCore/TypingCommand.h>
@@ -923,20 +925,6 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     _private->coreFrame->computeAndSetTypingStyle(core(style), undoAction);
 }
 
-- (void)_dragSourceMovedTo:(NSPoint)windowLoc
-{
-    if (!_private->coreFrame)
-        return;
-    FrameView* view = _private->coreFrame->view();
-    if (!view)
-        return;
-    ASSERT([getWebView(self) _usesDocumentViews]);
-    // FIXME: These are fake modifier keys here, but they should be real ones instead.
-    PlatformMouseEvent event(IntPoint(windowLoc), globalPoint(windowLoc, [view->platformWidget() window]),
-        LeftButton, MouseEventMoved, 0, false, false, false, false, currentTime());
-    _private->coreFrame->eventHandler()->dragSourceMovedTo(event);
-}
-
 - (void)_dragSourceEndedAt:(NSPoint)windowLoc operation:(NSDragOperation)operation
 {
     if (!_private->coreFrame)
@@ -1129,6 +1117,29 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     return controller->pauseTransitionAtTime(coreNode->renderer(), name, time);
 }
 
+// Pause a given SVG animation on the target node at a specific time.
+// This method is only intended to be used for testing the SVG animation system.
+- (BOOL)_pauseSVGAnimation:(NSString*)elementId onSMILNode:(DOMNode *)node atTime:(NSTimeInterval)time
+{
+    Frame* frame = core(self);
+    if (!frame)
+        return false;
+ 
+    Document* document = frame->document();
+    if (!document || !document->svgExtensions())
+        return false;
+
+    Node* coreNode = core(node);
+    if (!coreNode || !SVGSMILElement::isSMILElement(coreNode))
+        return false;
+
+#if ENABLE(SVG)
+    return document->accessSVGExtensions()->sampleAnimationAtTime(elementId, static_cast<SVGSMILElement*>(coreNode), time);
+#else
+    return false;
+#endif
+}
+
 - (unsigned) _numberOfActiveAnimations
 {
     Frame* frame = core(self);
@@ -1204,7 +1215,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     return SecurityOrigin::canLoad(URL, String(), _private->coreFrame->document());
 }
 
-- (NSString *)_stringByEvaluatingJavaScriptInIsolatedWorld:(unsigned)worldID WithGlobalObject:(JSObjectRef)globalObjectRef FromString:(NSString *)string
+- (NSString *)_stringByEvaluatingJavaScriptFromString:(NSString *)string withGlobalObject:(JSObjectRef)globalObjectRef inScriptWorld:(WebScriptWorld *)world
 {
     // Start off with some guess at a frame and a global object, we'll try to do better...!
     JSDOMWindow* anyWorldGlobalObject = _private->coreFrame->script()->globalObject(mainThreadNormalWorld());
@@ -1217,7 +1228,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     // Get the frame frome the global object we've settled on.
     Frame* frame = anyWorldGlobalObject->impl()->frame();
     ASSERT(frame->document());
-    JSValue result = frame->script()->executeScriptInIsolatedWorld(worldID, string, true).jsValue();
+    JSValue result = frame->script()->executeScriptInWorld(core(world), string, true).jsValue();
 
     if (!frame) // In case the script removed our frame from the page.
         return @"";
@@ -1232,12 +1243,15 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     return String(result.toString(anyWorldGlobalObject->globalExec()));
 }
 
-- (JSGlobalContextRef)contextForWorldID:(unsigned)worldID;
+- (JSGlobalContextRef)_globalContextForScriptWorld:(WebScriptWorld *)world
 {
     Frame* coreFrame = _private->coreFrame;
     if (!coreFrame)
         return 0;
-    return toGlobalRef(coreFrame->script()->globalObject(worldID)->globalExec());
+    DOMWrapperWorld* coreWorld = core(world);
+    if (!coreWorld)
+        return 0;
+    return toGlobalRef(coreFrame->script()->globalObject(coreWorld)->globalExec());
 }
 
 @end
diff --git a/WebKit/mac/WebView/WebFrameInternal.h b/WebKit/mac/WebView/WebFrameInternal.h
index 10a3015..0dcf19b 100644
--- a/WebKit/mac/WebView/WebFrameInternal.h
+++ b/WebKit/mac/WebView/WebFrameInternal.h
@@ -155,7 +155,6 @@ WebView *getWebView(WebFrame *webFrame);
 - (DOMCSSStyleDeclaration *)_typingStyle;
 - (void)_setTypingStyle:(DOMCSSStyleDeclaration *)style withUndoAction:(WebCore::EditAction)undoAction;
 
-- (void)_dragSourceMovedTo:(NSPoint)windowLoc;
 - (void)_dragSourceEndedAt:(NSPoint)windowLoc operation:(NSDragOperation)operation;
 
 - (BOOL)_canProvideDocumentSource;
diff --git a/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h b/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h
index 80fa08a..2359cc6 100644
--- a/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h
+++ b/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h
@@ -28,6 +28,7 @@
 
 #import <WebKit/WebFrameLoadDelegate.h>
 
+@class WebScriptWorld;
 @class WebSecurityOrigin;
 
 @interface NSObject (WebFrameLoadDelegatePrivate)
@@ -36,4 +37,10 @@
 
 - (void)webView:(WebView *)webView didRunInsecureContent:(WebSecurityOrigin *)origin;
 
+- (void)webView:(WebView *)webView didClearWindowObjectForFrame:(WebFrame *)frame inScriptWorld:(WebScriptWorld *)world;
+
+- (void)webView:(WebView *)webView didPushStateWithinPageForFrame:(WebFrame *)frame;
+- (void)webView:(WebView *)webView didReplaceStateWithinPageForFrame:(WebFrame *)frame;
+- (void)webView:(WebView *)webView didPopStateWithinPageForFrame:(WebFrame *)frame;
+
 @end
diff --git a/WebKit/mac/WebView/WebFramePrivate.h b/WebKit/mac/WebView/WebFramePrivate.h
index be13430..462686f 100644
--- a/WebKit/mac/WebView/WebFramePrivate.h
+++ b/WebKit/mac/WebView/WebFramePrivate.h
@@ -39,6 +39,7 @@
 @class DOMNode;
 @class WebIconFetcher;
 @class WebScriptObject;
+@class WebScriptWorld;
 
 // Keys for accessing the values in the page cache dictionary.
 extern NSString *WebPageCacheEntryDateKey;
@@ -96,8 +97,8 @@ typedef enum {
 - (void)_recursive_pauseNullEventsForAllNetscapePlugins;
 #endif
 
-- (NSString *)_stringByEvaluatingJavaScriptInIsolatedWorld:(unsigned)worldID WithGlobalObject:(JSObjectRef)globalObject FromString:(NSString *)string;
-- (JSGlobalContextRef)contextForWorldID:(unsigned)worldID;
+- (NSString *)_stringByEvaluatingJavaScriptFromString:(NSString *)string withGlobalObject:(JSObjectRef)globalObject inScriptWorld:(WebScriptWorld *)world;
+- (JSGlobalContextRef)_globalContextForScriptWorld:(WebScriptWorld *)world;
 
 // Pause a given CSS animation or transition on the target node at a specific time.
 // If the animation or transition is already paused, it will update its pause time.
@@ -105,6 +106,10 @@ typedef enum {
 - (BOOL)_pauseAnimation:(NSString*)name onNode:(DOMNode *)node atTime:(NSTimeInterval)time;
 - (BOOL)_pauseTransitionOfProperty:(NSString*)name onNode:(DOMNode*)node atTime:(NSTimeInterval)time;
 
+// Pause a given SVG animation on the target node at a specific time.
+// This method is only intended to be used for testing the SVG animation system.
+- (BOOL)_pauseSVGAnimation:(NSString*)elementId onSMILNode:(DOMNode *)node atTime:(NSTimeInterval)time;
+
 // Returns the total number of currently running animations (includes both CSS transitions and CSS animations).
 - (unsigned) _numberOfActiveAnimations;
 
diff --git a/WebKit/mac/WebView/WebFrameView.mm b/WebKit/mac/WebView/WebFrameView.mm
index c300586..4638418 100644
--- a/WebKit/mac/WebView/WebFrameView.mm
+++ b/WebKit/mac/WebView/WebFrameView.mm
@@ -156,7 +156,7 @@ enum {
     NSString* MIMEType = [dataSource _responseMIMEType];
     if (!MIMEType)
         MIMEType = @"text/html";
-    Class viewClass = [[self class] _viewClassForMIMEType:MIMEType];
+    Class viewClass = [self _viewClassForMIMEType:MIMEType];
     NSView <WebDocumentView> *documentView;
     if (viewClass) {
         // If the dataSource's representation has already been created, and it is also the
@@ -244,10 +244,15 @@ static inline void addTypesFromClass(NSMutableDictionary *allTypes, Class objCCl
     return [[[self _viewTypesAllowImageTypeOmission:YES] _webkit_objectForMIMEType:MIMEType] isSubclassOfClass:[WebHTMLView class]];
 }
 
-+ (Class)_viewClassForMIMEType:(NSString *)MIMEType
++ (Class)_viewClassForMIMEType:(NSString *)MIMEType allowingPlugins:(BOOL)allowPlugins
 {
     Class viewClass;
-    return [WebView _viewClass:&viewClass andRepresentationClass:nil forMIMEType:MIMEType] ? viewClass : nil;
+    return [WebView _viewClass:&viewClass andRepresentationClass:nil forMIMEType:MIMEType allowingPlugins:allowPlugins] ? viewClass : nil;
+}
+
+- (Class)_viewClassForMIMEType:(NSString *)MIMEType
+{
+    return [[self class] _viewClassForMIMEType:MIMEType allowingPlugins:[[[self _webView] preferences] arePlugInsEnabled]];
 }
 
 - (void)_install
@@ -273,6 +278,8 @@ static inline void addTypesFromClass(NSMutableDictionary *allTypes, Class objCCl
         owner->setWidget(view);
         // Now the render part owns the view, so we don't any more.
     }
+
+    view->updateCanHaveScrollbars();
 }
 
 @end
diff --git a/WebKit/mac/WebView/WebFrameViewInternal.h b/WebKit/mac/WebView/WebFrameViewInternal.h
index 726b62e..9d7fd80 100644
--- a/WebKit/mac/WebView/WebFrameViewInternal.h
+++ b/WebKit/mac/WebView/WebFrameViewInternal.h
@@ -39,7 +39,8 @@
 - (void)_setWebFrame:(WebFrame *)webFrame;
 - (float)_verticalPageScrollDistance;
 + (NSMutableDictionary *)_viewTypesAllowImageTypeOmission:(BOOL)allowImageTypeOmission;
-+ (Class)_viewClassForMIMEType:(NSString *)MIMEType;
+- (Class)_viewClassForMIMEType:(NSString *)MIMEType;
++ (Class)_viewClassForMIMEType:(NSString *)MIMEType allowingPlugins:(BOOL)allowPlugins;
 + (BOOL)_canShowMIMETypeAsHTML:(NSString *)MIMEType;
 - (WebDynamicScrollBarsView *)_scrollView;
 - (void)_install;
diff --git a/WebKit/mac/WebView/WebHTMLView.mm b/WebKit/mac/WebView/WebHTMLView.mm
index 936b6d7..5dc66ee 100644
--- a/WebKit/mac/WebView/WebHTMLView.mm
+++ b/WebKit/mac/WebView/WebHTMLView.mm
@@ -1976,11 +1976,6 @@ static void _updateMouseoverTimerCallback(CFRunLoopTimerRef timer, void *info)
     // remove tooltips before clearing _private so removeTrackingRect: will work correctly
     [self removeAllToolTips];
 
-#if USE(ACCELERATED_COMPOSITING)
-    if (_private->layerHostingView)
-        [[self _webView] _stoppedAcceleratedCompositingForFrame:[self _frame]];
-#endif
-
     [_private clear];
 
     Page* page = core([self _webView]);
@@ -2666,7 +2661,10 @@ WEBCORE_COMMAND(yankAndSelect)
     
     if (action == @selector(_lookUpInDictionaryFromMenu:))
         return [self _hasSelection];
-    
+
+    if (action == @selector(stopSpeaking:))
+        return [NSApp isSpeaking];
+
 #ifndef BUILDING_ON_TIGER
     if (action == @selector(toggleGrammarChecking:)) {
         // FIXME 4799134: WebView is the bottleneck for this grammar-checking logic, but we must validate 
@@ -2885,6 +2883,14 @@ WEBCORE_COMMAND(yankAndSelect)
 {
     if ([self superview] != nil)
         [self addSuperviewObservers];
+
+#if USE(ACCELERATED_COMPOSITING)
+    if ([self superview] && [self _isUsingAcceleratedCompositing]) {
+        WebView *webView = [self _webView];
+        if ([webView _postsAcceleratedCompositingNotifications])
+            [[NSNotificationCenter defaultCenter] postNotificationName:_WebViewDidStartAcceleratedCompositingNotification object:webView userInfo:nil];
+    }
+#endif
 }
 
 - (void)viewWillMoveToWindow:(NSWindow *)window
@@ -3441,21 +3447,6 @@ done:
     return (NSDragOperation)page->dragController()->sourceDragOperation();
 }
 
-- (void)draggedImage:(NSImage *)image movedTo:(NSPoint)screenLoc
-{
-    ASSERT(![self _webView] || [self _isTopHTMLView]);
-    
-    NSPoint windowImageLoc = [[self window] convertScreenToBase:screenLoc];
-    NSPoint windowMouseLoc = windowImageLoc;
-    
-    if (Page* page = core([self _webView])) {
-        DragController* dragController = page->dragController();
-        NSPoint windowMouseLoc = NSMakePoint(windowImageLoc.x + dragController->dragOffset().x(), windowImageLoc.y + dragController->dragOffset().y());
-    }
-    
-    [[self _frame] _dragSourceMovedTo:windowMouseLoc];
-}
-
 - (void)draggedImage:(NSImage *)anImage endedAt:(NSPoint)aPoint operation:(NSDragOperation)operation
 {
     ASSERT(![self _webView] || [self _isTopHTMLView]);
@@ -5425,7 +5416,6 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
         [hostingView release];
         // hostingView is owned by being a subview of self
         _private->layerHostingView = hostingView;
-        [[self _webView] _startedAcceleratedCompositingForFrame:[self _frame]];
     }
 
     // Make a container layer, which will get sized/positioned by AppKit and CA.
@@ -5454,6 +5444,9 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
     // Parent our root layer in the container layer
     [viewLayer addSublayer:layer];
     
+    if ([[self _webView] _postsAcceleratedCompositingNotifications])
+        [[NSNotificationCenter defaultCenter] postNotificationName:_WebViewDidStartAcceleratedCompositingNotification object:[self _webView] userInfo:nil];
+    
 #if defined(BUILDING_ON_LEOPARD)
     [self _updateLayerHostingViewPosition];
 #endif
@@ -5466,7 +5459,6 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
         [_private->layerHostingView setWantsLayer:NO];
         [_private->layerHostingView removeFromSuperview];
         _private->layerHostingView = nil;
-        [[self _webView] _stoppedAcceleratedCompositingForFrame:[self _frame]];
     }
 }
 
@@ -5923,7 +5915,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     
     Vector<FloatRect> list;
     if (Frame* coreFrame = core([self _frame]))
-        coreFrame->selectionTextRects(list);
+        coreFrame->selectionTextRects(list, Frame::RespectTransforms);
 
     unsigned size = list.size();
     NSMutableArray *result = [[[NSMutableArray alloc] initWithCapacity:size] autorelease];
diff --git a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index 4a87337..d295323 100644
--- a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -85,6 +85,8 @@
 #define WebKitZoomsTextOnlyPreferenceKey @"WebKitZoomsTextOnly"
 #define WebKitXSSAuditorEnabledPreferenceKey @"WebKitXSSAuditorEnabled"
 #define WebKitAcceleratedCompositingEnabledPreferenceKey @"WebKitAcceleratedCompositingEnabled"
+#define WebKitShowDebugBordersPreferenceKey @"WebKitShowDebugBorders"
+#define WebKitShowRepaintCounterPreferenceKey @"WebKitShowRepaintCounter"
 #define WebKitWebGLEnabledPreferenceKey @"WebKitWebGLEnabled"
 #define WebKitPluginAllowedRunTimePreferenceKey @"WebKitPluginAllowedRunTime"
 
diff --git a/WebKit/mac/WebView/WebPreferences.mm b/WebKit/mac/WebView/WebPreferences.mm
index 4914340..6b55ea3 100644
--- a/WebKit/mac/WebView/WebPreferences.mm
+++ b/WebKit/mac/WebView/WebPreferences.mm
@@ -351,6 +351,8 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitZoomsTextOnlyPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitXSSAuditorEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAcceleratedCompositingEnabledPreferenceKey,
+        [NSNumber numberWithBool:NO], WebKitShowDebugBordersPreferenceKey,
+        [NSNumber numberWithBool:NO], WebKitShowRepaintCounterPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitWebGLEnabledPreferenceKey,
         [NSNumber numberWithUnsignedInt:4], WebKitPluginAllowedRunTimePreferenceKey,
         nil];
@@ -1151,6 +1153,26 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:enabled forKey:WebKitAcceleratedCompositingEnabledPreferenceKey];
 }
 
+- (BOOL)showDebugBorders
+{
+    return [self _boolValueForKey:WebKitShowDebugBordersPreferenceKey];
+}
+
+- (void)setShowDebugBorders:(BOOL)enabled
+{
+    [self _setBoolValue:enabled forKey:WebKitShowDebugBordersPreferenceKey];
+}
+
+- (BOOL)showRepaintCounter
+{
+    return [self _boolValueForKey:WebKitShowRepaintCounterPreferenceKey];
+}
+
+- (void)setShowRepaintCounter:(BOOL)enabled
+{
+    [self _setBoolValue:enabled forKey:WebKitShowRepaintCounterPreferenceKey];
+}
+
 - (BOOL)webGLEnabled
 {
     return [self _boolValueForKey:WebKitWebGLEnabledPreferenceKey];
diff --git a/WebKit/mac/WebView/WebPreferencesPrivate.h b/WebKit/mac/WebView/WebPreferencesPrivate.h
index c558cbb..3cea78b 100644
--- a/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -149,6 +149,12 @@ extern NSString *WebPreferencesRemovedNotification;
 - (BOOL)acceleratedCompositingEnabled;
 - (void)setAcceleratedCompositingEnabled:(BOOL)enabled;
 
+- (BOOL)showDebugBorders;
+- (void)setShowDebugBorders:(BOOL)show;
+
+- (BOOL)showRepaintCounter;
+- (void)setShowRepaintCounter:(BOOL)show;
+
 - (BOOL)webGLEnabled;
 - (void)setWebGLEnabled:(BOOL)enabled;
 
diff --git a/WebKit/mac/WebView/WebScriptDebugDelegate.mm b/WebKit/mac/WebView/WebScriptDebugDelegate.mm
index ef2cb67..8489c9b 100644
--- a/WebKit/mac/WebView/WebScriptDebugDelegate.mm
+++ b/WebKit/mac/WebView/WebScriptDebugDelegate.mm
@@ -249,7 +249,7 @@ NSString * const WebScriptErrorLineNumberKey = @"WebScriptErrorLineNumber";
     }
 
     JSValue exception;
-    JSValue result = DebuggerCallFrame_evaluateInWorld(*_private->debuggerCallFrame, String(script), exception);
+    JSValue result = _private->debuggerCallFrame->evaluate(String(script), exception);
     if (exception)
         return [self _convertValueToObjcValue:exception];
     return result ? [self _convertValueToObjcValue:result] : nil;
diff --git a/WebKit/mac/WebView/WebScriptWorld.h b/WebKit/mac/WebView/WebScriptWorld.h
new file mode 100644
index 0000000..9204975
--- /dev/null
+++ b/WebKit/mac/WebView/WebScriptWorld.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+@class WebScriptWorldPrivate;
+
+@interface WebScriptWorld : NSObject {
+@private
+    WebScriptWorldPrivate *_private;
+}
+
++ (WebScriptWorld *)standardWorld;
++ (WebScriptWorld *)world;
+@end
diff --git a/WebKit/mac/WebView/WebScriptWorld.mm b/WebKit/mac/WebView/WebScriptWorld.mm
new file mode 100644
index 0000000..0310701
--- /dev/null
+++ b/WebKit/mac/WebView/WebScriptWorld.mm
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebScriptWorld.h"
+
+#import "WebScriptWorldInternal.h"
+#import <WebCore/JSDOMBinding.h>
+#import <WebCore/ScriptController.h>
+#import <wtf/RefPtr.h>
+
+using namespace WebCore;
+
+@interface WebScriptWorldPrivate : NSObject {
+@public
+    RefPtr<DOMWrapperWorld> world;
+}
+@end
+
+@implementation WebScriptWorldPrivate
+@end
+
+typedef HashMap<DOMWrapperWorld*, WebScriptWorld*> WorldMap;
+static WorldMap& allWorlds()
+{
+    static WorldMap& map = *new WorldMap;
+    return map;
+}
+
+@implementation WebScriptWorld
+
+- (id)initWithWorld:(PassRefPtr<DOMWrapperWorld>)world
+{
+    ASSERT_ARG(world, world);
+    if (!world)
+        return nil;
+
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _private = [[WebScriptWorldPrivate alloc] init];
+    _private->world = world;
+
+    ASSERT_ARG(world, !allWorlds().contains(_private->world.get()));
+    allWorlds().add(_private->world.get(), self);
+
+    return self;
+}
+
+- (id)init
+{
+    return [self initWithWorld:ScriptController::createWorld()];
+}
+
+- (void)dealloc
+{
+    ASSERT(allWorlds().contains(_private->world.get()));
+    allWorlds().remove(_private->world.get());
+
+    [_private release];
+    _private = nil;
+    [super dealloc];
+}
+
++ (WebScriptWorld *)standardWorld
+{
+    static WebScriptWorld *world = [[WebScriptWorld alloc] initWithWorld:mainThreadNormalWorld()];
+    return world;
+}
+
++ (WebScriptWorld *)world
+{
+    return [[[self alloc] init] autorelease];
+}
+
+@end
+
+@implementation WebScriptWorld (WebInternal)
+
+DOMWrapperWorld* core(WebScriptWorld *world)
+{
+    return world ? world->_private->world.get() : 0;
+}
+
++ (WebScriptWorld *)findOrCreateWorld:(DOMWrapperWorld*) world
+{
+    ASSERT_ARG(world, world);
+
+    if (world == mainThreadNormalWorld())
+        return [self standardWorld];
+
+    if (WebScriptWorld *existingWorld = allWorlds().get(world))
+        return existingWorld;
+
+    return [[[self alloc] initWithWorld:world] autorelease];
+}
+
+@end
diff --git a/WebKit/mac/WebView/WebScriptWorldInternal.h b/WebKit/mac/WebView/WebScriptWorldInternal.h
new file mode 100644
index 0000000..785d9c0
--- /dev/null
+++ b/WebKit/mac/WebView/WebScriptWorldInternal.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebScriptWorld.h"
+
+namespace WebCore {
+    class DOMWrapperWorld;
+}
+
+WebCore::DOMWrapperWorld* core(WebScriptWorld *);
+
+@interface WebScriptWorld (WebInternal)
++ (WebScriptWorld *)findOrCreateWorld:(WebCore::DOMWrapperWorld*)world;
+@end
diff --git a/WebKit/mac/WebView/WebSerializedJSValue.h b/WebKit/mac/WebView/WebSerializedJSValue.h
new file mode 100644
index 0000000..5094776
--- /dev/null
+++ b/WebKit/mac/WebView/WebSerializedJSValue.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+@class WebSerializedJSValuePrivate;
+
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef const struct OpaqueJSValue* JSValueRef;
+
+@interface WebSerializedJSValue : NSObject {
+@private
+    WebSerializedJSValuePrivate *_private;
+}
+
+- (id)initWithValue:(JSValueRef)object context:(JSContextRef)sourceContext exception:(JSValueRef*)exception;
+- (JSValueRef)deserialize:(JSContextRef)destinationContext;
+
+@end
diff --git a/WebKit/mac/WebView/WebSerializedJSValue.mm b/WebKit/mac/WebView/WebSerializedJSValue.mm
new file mode 100644
index 0000000..af96aa4
--- /dev/null
+++ b/WebKit/mac/WebView/WebSerializedJSValue.mm
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebSerializedJSValue.h"
+
+#import <WebCore/SerializedScriptValue.h>
+#import <wtf/RefPtr.h>
+
+using namespace WebCore;
+
+@interface WebSerializedJSValuePrivate : NSObject {
+@public
+    RefPtr<SerializedScriptValue> value;
+}
+@end
+
+@implementation WebSerializedJSValuePrivate
+@end
+
+@implementation WebSerializedJSValue
+
+- (id)initWithValue:(JSValueRef)value context:(JSContextRef)sourceContext exception:(JSValueRef*)exception;
+{
+    ASSERT_ARG(value, value);
+    ASSERT_ARG(sourceContext, sourceContext);
+
+    if (!value || !sourceContext) {
+        [self release];
+        return nil;
+    }
+
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _private = [[WebSerializedJSValuePrivate alloc] init];
+    
+    _private->value = SerializedScriptValue::create(sourceContext, value, exception);
+    if (!_private->value) {
+        [self release];
+        return nil;
+    }
+
+    return self;
+}
+
+- (JSValueRef)deserialize:(JSContextRef)destinationContext
+{
+    if (!_private || !_private->value)
+        return 0;    
+    return _private->value->deserialize(destinationContext, 0);
+}
+
+- (void)dealloc
+{
+    [_private release];
+    _private = nil;
+    [super dealloc];
+}
+
+@end
+
diff --git a/WebKit/mac/WebView/WebUIDelegatePrivate.h b/WebKit/mac/WebView/WebUIDelegatePrivate.h
index 0715475..a130b18 100644
--- a/WebKit/mac/WebView/WebUIDelegatePrivate.h
+++ b/WebKit/mac/WebView/WebUIDelegatePrivate.h
@@ -87,9 +87,14 @@ enum {
     WebMenuItemTagChangeBack,
     WebMenuItemTagBaseApplication = 10000
 };
-@class WebGeolocation;
+
 @class WebSecurityOrigin;
 
+@protocol WebGeolocationPolicyListener <NSObject>
+- (void)allow;
+- (void)deny;
+@end
+
 @interface NSObject (WebUIDelegatePrivate)
 
 - (void)webView:(WebView *)webView addMessageToConsole:(NSDictionary *)message;
@@ -109,7 +114,7 @@ enum {
 - (void)webView:(WebView *)sender willPopupMenu:(NSMenu *)menu;
 - (void)webView:(WebView *)sender contextMenuItemSelected:(NSMenuItem *)item forElement:(NSDictionary *)element;
 - (void)webView:(WebView *)sender saveFrameView:(WebFrameView *)frameView showingPanel:(BOOL)showingPanel;
-- (BOOL)webView:(WebView *)sender shouldHaltPlugin:(DOMNode *)pluginNode;
+- (BOOL)webView:(WebView *)sender shouldHaltPlugin:(DOMNode *)pluginNode isWindowed:(BOOL)isWindowed pluginName:(NSString *)pluginName;
 /*!
     @method webView:frame:exceededDatabaseQuotaForSecurityOrigin:database:
     @param sender The WebView sending the delegate method.
@@ -124,7 +129,17 @@ enum {
 - (BOOL)webView:(WebView *)sender shouldReplaceUploadFile:(NSString *)path usingGeneratedFilename:(NSString **)filename;
 - (NSString *)webView:(WebView *)sender generateReplacementFile:(NSString *)path;
 
-- (BOOL)webView:(WebView *)sender frame:(WebFrame *)frame requestGeolocationPermission:(WebGeolocation *)geolocation securityOrigin:(WebSecurityOrigin *)origin;
+/*!
+    @method webView:decidePolicyForGeolocationRequestFromOrigin:frame:listener:
+    @abstract 
+    @param webView The WebView sending the delegate method.
+    @param origin The security origin that would like to use Geolocation.
+    @param frame The WebFrame whose JavaScript initiated this call.
+    @param listener The object to call when the decision is made
+*/
+- (void)webView:(WebView *)webView decidePolicyForGeolocationRequestFromOrigin:(WebSecurityOrigin *)origin
+                                                                         frame:(WebFrame *)frame
+                                                                      listener:(id<WebGeolocationPolicyListener>)listener;
 
 - (void)webView:(WebView *)sender formStateDidChangeForNode:(DOMNode *)node;
 - (void)webView:(WebView *)sender formDidFocusNode:(DOMNode *)node;
diff --git a/WebKit/mac/WebView/WebVideoFullscreenController.h b/WebKit/mac/WebView/WebVideoFullscreenController.h
index bb6a083..2e0c4c3 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenController.h
+++ b/WebKit/mac/WebView/WebVideoFullscreenController.h
@@ -10,47 +10,50 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #if ENABLE(VIDEO)
 
-#import <Cocoa/Cocoa.h>
 #import <wtf/RefPtr.h>
-#import <WebCore/HTMLMediaElement.h>
+
+namespace WebCore {
+    class HTMLMediaElement;
+}
 
 @protocol WebVideoFullscreenControllerDelegate;
 @class WebVideoFullscreenHUDWindowController;
 @class WebWindowFadeAnimation;
 
-@interface WebVideoFullscreenController : NSWindowController
-{
+@interface WebVideoFullscreenController : NSWindowController {
 @private
     RefPtr<WebCore::HTMLMediaElement> _mediaElement; // (retain)
-    id<WebVideoFullscreenControllerDelegate> _delegate; // (assign)
+    id <WebVideoFullscreenControllerDelegate> _delegate; // (assign)
 
     NSWindow *_backgroundFullscreenWindow; // (retain)
-    WebVideoFullscreenHUDWindowController* _hudController; // (retain)
+    WebVideoFullscreenHUDWindowController *_hudController; // (retain)
 
     WebWindowFadeAnimation *_fadeAnimation; // (retain)
 
     BOOL _isEndingFullscreen;
     BOOL _isWindowLoaded;
     BOOL _forceDisableAnimation;
+    SystemUIMode _savedUIMode;
+    SystemUIOptions _savedUIOptions;
 }
 
-- (id<WebVideoFullscreenControllerDelegate>)delegate;
-- (void)setDelegate:(id<WebVideoFullscreenControllerDelegate>)delegate;
+- (id <WebVideoFullscreenControllerDelegate>)delegate;
+- (void)setDelegate:(id <WebVideoFullscreenControllerDelegate>)delegate;
 
 - (void)setMediaElement:(WebCore::HTMLMediaElement*)mediaElement;
 - (WebCore::HTMLMediaElement*)mediaElement;
@@ -60,5 +63,4 @@
 
 @end
 
-#endif
-
+#endif // ENABLE(VIDEO)
diff --git a/WebKit/mac/WebView/WebVideoFullscreenController.mm b/WebKit/mac/WebView/WebVideoFullscreenController.mm
index fe07f3e..946da90 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenController.mm
+++ b/WebKit/mac/WebView/WebVideoFullscreenController.mm
@@ -10,34 +10,30 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #if ENABLE(VIDEO)
 
-#import <QTKit/QTKit.h>
-#import <objc/objc-runtime.h>
-#import <HIToolbox/HIToolbox.h>
-
-#import <wtf/UnusedParam.h>
-#import <WebCore/SoftLinking.h>
-#import <WebCore/IntRect.h>
-
 #import "WebVideoFullscreenController.h"
-#import "WebVideoFullscreenHUDWindowController.h"
-#import "WebKitSystemInterface.h"
+
 #import "WebTypesInternal.h"
+#import "WebVideoFullscreenHUDWindowController.h"
 #import "WebWindowAnimation.h"
+#import <QTKit/QTKit.h>
+#import <WebCore/HTMLMediaElement.h>
+#import <WebCore/SoftLinking.h>
+#import <objc/objc-runtime.h>
 
 SOFT_LINK_FRAMEWORK(QTKit)
 SOFT_LINK_CLASS(QTKit, QTMovieView)
@@ -53,11 +49,8 @@ SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
 {
     SEL _controllerActionOnAnimationEnd;
     WebWindowScaleAnimation *_fullscreenAnimation; // (retain)
-    QTMovieView *_movieView; // (retain)
 }
 - (void)animateFromRect:(NSRect)startRect toRect:(NSRect)endRect withSubAnimation:(NSAnimation *)subAnimation controllerAction:(SEL)controllerAction;
-- (QTMovieView *)movieView;
-- (void)setMovieView:(QTMovieView *)movieView;
 @end
 
 @interface WebVideoFullscreenController(HUDWindowControllerDelegate) <WebVideoFullscreenHUDWindowControllerDelegate>
@@ -94,7 +87,7 @@ SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
     WebVideoFullscreenWindow *window = [self fullscreenWindow];
     QTMovieView *view = [[getQTMovieViewClass() alloc] init];
     [view setFillColor:[NSColor clearColor]];
-    [window setMovieView:view];
+    [window setContentView:view];
     [view setControllerVisible:NO];
     [view setPreservesAspectRatio:YES];
     if (_mediaElement)
@@ -113,10 +106,10 @@ SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
 {
     _mediaElement = mediaElement;
     if ([self isWindowLoaded]) {
-        QTMovieView *movieView = [[self fullscreenWindow] movieView];
+        QTMovieView *movieView = (QTMovieView *)[[self fullscreenWindow] contentView];
         QTMovie *movie = _mediaElement->platformMedia().qtMovie;
 
-        ASSERT(movieView);
+        ASSERT(movieView && [movieView isKindOfClass:[getQTMovieViewClass() class]]);
         ASSERT(movie);
         [movieView setMovie:movie];
         [[NSNotificationCenter defaultCenter] addObserver:self
@@ -126,12 +119,12 @@ SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
     }
 }
 
-- (id<WebVideoFullscreenControllerDelegate>)delegate
+- (id <WebVideoFullscreenControllerDelegate>)delegate
 {
     return _delegate;
 }
 
-- (void)setDelegate:(id<WebVideoFullscreenControllerDelegate>)delegate;
+- (void)setDelegate:(id <WebVideoFullscreenControllerDelegate>)delegate;
 {
     _delegate = delegate;
 }
@@ -148,13 +141,10 @@ SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
 
 - (void)windowDidExitFullscreen
 {
-    // If we don't clear the movie, underlying movie data structures are leaked and the movie keeps playing <rdar://problem/7295070>
-    [[[self fullscreenWindow] movieView] setMovie:nil];
-
     [self clearFadeAnimation];
     [[self window] close];
     [self setWindow:nil];
-    SetSystemUIMode(kUIModeNormal, 0);
+    SetSystemUIMode(_savedUIMode, _savedUIOptions);
     [_hudController setDelegate:nil];
     [_hudController release];
     _hudController = nil;
@@ -174,6 +164,7 @@ SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
     _hudController = [[WebVideoFullscreenHUDWindowController alloc] init];
     [_hudController setDelegate:self];
 
+    GetSystemUIMode(&_savedUIMode, &_savedUIOptions);
     SetSystemUIMode(kUIModeAllSuppressed , 0);
     [NSCursor setHiddenUntilMouseMoves:YES];
     
@@ -340,20 +331,6 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
     [super dealloc];
 }
 
-- (QTMovieView *)movieView
-{
-    return _movieView;
-}
-
-- (void)setMovieView:(QTMovieView *)movieView
-{
-    if (_movieView == movieView)
-        return;
-    [_movieView release];
-    _movieView = [movieView retain];
-    [self setContentView:_movieView];
-}
-
 - (BOOL)resignFirstResponder
 {
     return NO;
diff --git a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
index 1ffa596..a3d74d2 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
+++ b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
@@ -10,44 +10,47 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #if ENABLE(VIDEO)
 
-#import <Cocoa/Cocoa.h>
-#import <WebCore/HTMLMediaElement.h>
+namespace WebCore {
+    class HTMLMediaElement;
+}
 
 @protocol WebVideoFullscreenHUDWindowControllerDelegate;
 
-@interface WebVideoFullscreenHUDWindowController : NSWindowController {
-@private
-    id<WebVideoFullscreenHUDWindowControllerDelegate> _delegate;
+@interface WebVideoFullscreenHUDWindowController : NSWindowController
+{
+    id <WebVideoFullscreenHUDWindowControllerDelegate> _delegate;
     NSTimer *_timelineUpdateTimer;
 #if !defined(BUILDING_ON_TIGER)
     NSTrackingArea *_area;
 #endif
     BOOL _mouseIsInHUD;
     BOOL _isEndingFullscreen;
+    BOOL _isScrubbing;
 
     NSControl *_timeline;
     NSTextField *_remainingTimeText;
     NSTextField *_elapsedTimeText;
     NSControl *_volumeSlider;
-    NSControl *_playButton;
+    NSButton *_playButton;
 }
-- (id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate;
-- (void)setDelegate:(id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate;
+
+- (id <WebVideoFullscreenHUDWindowControllerDelegate>)delegate;
+- (void)setDelegate:(id <WebVideoFullscreenHUDWindowControllerDelegate>)delegate;
 - (void)fadeWindowIn;
 - (void)fadeWindowOut;
 - (void)closeWindow;
diff --git a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
index c61ae7c..82cb1bf 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
+++ b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
@@ -10,48 +10,56 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #if ENABLE(VIDEO)
 
 #import "WebVideoFullscreenHUDWindowController.h"
 
-#import <QTKit/QTKit.h>
 #import "WebKitSystemInterface.h"
 #import "WebTypesInternal.h"
-#import <wtf/RetainPtr.h>
-#import <limits>
+#import <JavaScriptCore/RetainPtr.h>
+#import <JavaScriptCore/UnusedParam.h>
+#import <WebCore/HTMLMediaElement.h>
 
+using namespace WebCore;
 using namespace std;
 
+static inline CGFloat webkit_CGFloor(CGFloat value)
+{
+    if (sizeof(value) == sizeof(float))
+        return floorf(value);
+    return floor(value);
+}
+
 #define HAVE_MEDIA_CONTROL (!defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD))
 
 @interface WebVideoFullscreenHUDWindowController (Private) <NSWindowDelegate>
 
-- (void)keyDown:(NSEvent *)event;
-
 - (void)updateTime;
 - (void)timelinePositionChanged:(id)sender;
 - (float)currentTime;
 - (void)setCurrentTime:(float)currentTime;
 - (double)duration;
 
-- (double)maxVolume;
 - (void)volumeChanged:(id)sender;
+- (double)maxVolume;
 - (double)volume;
 - (void)setVolume:(double)volume;
+- (void)decrementVolume;
+- (void)incrementVolume;
 
+- (void)updatePlayButton;
 - (void)togglePlaying:(id)sender;
 - (BOOL)playing;
 - (void)setPlaying:(BOOL)playing;
@@ -65,11 +73,6 @@ using namespace std;
 - (void)exitFullscreen:(id)sender;
 @end
 
-
-//
-// HUD Window
-//
-
 @interface WebVideoFullscreenHUDWindow : NSWindow
 @end
 
@@ -136,10 +139,6 @@ using namespace std;
 
 @end
 
-//
-// HUD Window Controller
-//
-
 static const CGFloat windowHeight = 59;
 static const CGFloat windowWidth = 438;
 
@@ -149,7 +148,7 @@ static const NSTimeInterval HUDWindowFadeOutDelay = 3;
 
 - (id)init
 {
-    NSWindow* window = [[WebVideoFullscreenHUDWindow alloc] initWithContentRect:NSMakeRect(0, 0, windowWidth, windowHeight)
+    NSWindow *window = [[WebVideoFullscreenHUDWindow alloc] initWithContentRect:NSMakeRect(0, 0, windowWidth, windowHeight)
                             styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
     self = [super initWithWindow:window];
     [window setDelegate:self];
@@ -166,6 +165,7 @@ static const NSTimeInterval HUDWindowFadeOutDelay = 3;
 #if !defined(BUILDING_ON_TIGER)
     ASSERT(!_area);
 #endif
+    ASSERT(!_isScrubbing);
     [_timeline release];
     [_remainingTimeText release];
     [_elapsedTimeText release];
@@ -186,18 +186,38 @@ static const NSTimeInterval HUDWindowFadeOutDelay = 3;
 
 - (void)keyDown:(NSEvent *)event
 {
-    if ([[event characters] isEqualToString:@" "])
-        [_playButton performClick:self];
-    else
-        [super keyDown:event];
+    NSString *charactersIgnoringModifiers = [event charactersIgnoringModifiers];
+    if ([charactersIgnoringModifiers length] == 1) {
+        switch ([charactersIgnoringModifiers characterAtIndex:0]) {
+            case ' ':
+                [self togglePlaying:nil];
+                return;
+            case NSUpArrowFunctionKey:
+                if ([event modifierFlags] & NSAlternateKeyMask)
+                    [self setVolume:[self maxVolume]];
+                else
+                    [self incrementVolume];
+                return;
+            case NSDownArrowFunctionKey:
+                if ([event modifierFlags] & NSAlternateKeyMask)
+                    [self setVolume:0];
+                else
+                    [self decrementVolume];
+                return;
+            default:
+                break;
+        }
+    }
+
+    [super keyDown:event];
 }
 
-- (id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate
+- (id <WebVideoFullscreenHUDWindowControllerDelegate>)delegate
 {
     return _delegate;
 }
 
-- (void)setDelegate:(id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate
+- (void)setDelegate:(id <WebVideoFullscreenHUDWindowControllerDelegate>)delegate
 {
     _delegate = delegate;
 }
@@ -208,7 +228,7 @@ static const NSTimeInterval HUDWindowFadeOutDelay = 3;
 
     // First, update right away, then schedule future update
     [self updateTime];
-    [self updateRate];
+    [self updatePlayButton];
 
     [_timelineUpdateTimer invalidate];
     [_timelineUpdateTimer release];
@@ -216,7 +236,7 @@ static const NSTimeInterval HUDWindowFadeOutDelay = 3;
     // Note that this creates a retain cycle between the window and us.
     _timelineUpdateTimer = [[NSTimer timerWithTimeInterval:0.25 target:self selector:@selector(updateTime) userInfo:nil repeats:YES] retain];
 #if defined(BUILDING_ON_TIGER)
-    [[NSRunLoop currentRunLoop] addTimer:_timelineUpdateTimer forMode:(NSString*)kCFRunLoopCommonModes];
+    [[NSRunLoop currentRunLoop] addTimer:_timelineUpdateTimer forMode:(NSString *)kCFRunLoopCommonModes];
 #else
     [[NSRunLoop currentRunLoop] addTimer:_timelineUpdateTimer forMode:NSRunLoopCommonModes];
 #endif
@@ -306,7 +326,7 @@ static NSTextField *createTimeTextField(NSRect frame)
     NSTextField *textField = [[NSTextField alloc] initWithFrame:frame];
     [textField setTextColor:[NSColor whiteColor]];
     [textField setBordered:NO];
-    [textField setFont:[NSFont systemFontOfSize:10]];
+    [textField setFont:[NSFont boldSystemFontOfSize:10]];
     [textField setDrawsBackground:NO];
     [textField setBezeled:NO];
     [textField setEditable:NO];
@@ -316,10 +336,25 @@ static NSTextField *createTimeTextField(NSRect frame)
 
 - (void)windowDidLoad
 {
-    static const CGFloat kMargin = 9;
-    static const CGFloat kMarginTop = 9;
-    static const CGFloat kButtonSize = 25;
-    static const CGFloat kButtonMiniSize = 16;
+    static const CGFloat horizontalMargin = 10;
+    static const CGFloat playButtonWidth = 41;
+    static const CGFloat playButtonHeight = 35;
+    static const CGFloat playButtonTopMargin = 4;
+    static const CGFloat volumeSliderWidth = 50;
+    static const CGFloat volumeSliderHeight = 13;
+    static const CGFloat volumeButtonWidth = 18;
+    static const CGFloat volumeButtonHeight = 16;
+    static const CGFloat volumeUpButtonLeftMargin = 4;
+    static const CGFloat volumeControlsTopMargin = 13;
+    static const CGFloat exitFullScreenButtonWidth = 25;
+    static const CGFloat exitFullScreenButtonHeight = 21;
+    static const CGFloat exitFullScreenButtonTopMargin = 11;
+    static const CGFloat timelineWidth = 315;
+    static const CGFloat timelineHeight = 14;
+    static const CGFloat timelineBottomMargin = 7;
+    static const CGFloat timeTextFieldWidth = 54;
+    static const CGFloat timeTextFieldHeight = 13;
+    static const CGFloat timeTextFieldHorizontalMargin = 7;
 
     NSWindow *window = [self window];
     ASSERT(window);
@@ -331,53 +366,48 @@ static NSTextField *createTimeTextField(NSRect frame)
 #endif
     [window setContentView:background];
 #if !defined(BUILDING_ON_TIGER)
-    _area = [[NSTrackingArea alloc] initWithRect:[background bounds] options:NSTrackingMouseEnteredAndExited|NSTrackingActiveAlways owner:self userInfo:nil];
+    _area = [[NSTrackingArea alloc] initWithRect:[background bounds] options:NSTrackingMouseEnteredAndExited | NSTrackingActiveAlways owner:self userInfo:nil];
     [background addTrackingArea:_area];
 #endif
     [background release];    
 
-    NSView *contentView = [[self window] contentView];
+    NSView *contentView = [window contentView];
 
-    CGFloat top = windowHeight - kMarginTop;
-    CGFloat center = (windowWidth - kButtonSize) / 2;
-    _playButton = createControlWithMediaUIControlType(WKMediaUIControlPlayPauseButton, NSMakeRect(center, top - kButtonSize, kButtonSize, kButtonSize));
+    CGFloat center = webkit_CGFloor((windowWidth - playButtonWidth) / 2);
+    _playButton = (NSButton *)createControlWithMediaUIControlType(WKMediaUIControlPlayPauseButton, NSMakeRect(center, windowHeight - playButtonTopMargin - playButtonHeight, playButtonWidth, playButtonHeight));
+    ASSERT([_playButton isKindOfClass:[NSButton class]]);
     [_playButton setTarget:self];
     [_playButton setAction:@selector(togglePlaying:)];
     [contentView addSubview:_playButton];
 
-    CGFloat closeToRight = windowWidth - 2 * kMargin - kButtonMiniSize;
-    NSControl *exitFullscreenButton = createControlWithMediaUIControlType(WKMediaUIControlExitFullscreenButton, NSMakeRect(closeToRight, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
+    CGFloat closeToRight = windowWidth - horizontalMargin - exitFullScreenButtonWidth;
+    NSControl *exitFullscreenButton = createControlWithMediaUIControlType(WKMediaUIControlExitFullscreenButton, NSMakeRect(closeToRight, windowHeight - exitFullScreenButtonTopMargin - exitFullScreenButtonHeight, exitFullScreenButtonWidth, exitFullScreenButtonHeight));
     [exitFullscreenButton setAction:@selector(exitFullscreen:)];
     [exitFullscreenButton setTarget:self];
     [contentView addSubview:exitFullscreenButton];
     [exitFullscreenButton release];
     
-    CGFloat left = kMargin;
-    NSControl *volumeDownButton = createControlWithMediaUIControlType(WKMediaUIControlVolumeDownButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
+    CGFloat volumeControlsBottom = windowHeight - volumeControlsTopMargin - volumeButtonHeight;
+    CGFloat left = horizontalMargin;
+    NSControl *volumeDownButton = createControlWithMediaUIControlType(WKMediaUIControlVolumeDownButton, NSMakeRect(left, volumeControlsBottom, volumeButtonWidth, volumeButtonHeight));
     [contentView addSubview:volumeDownButton];
     [volumeDownButton setTarget:self];
-    [volumeDownButton setAction:@selector(decrementVolume:)];
+    [volumeDownButton setAction:@selector(setVolumeToZero:)];
     [volumeDownButton release];
 
-    static const int volumeSliderWidth = 50;
-
-    left = kMargin + kButtonMiniSize;
-    _volumeSlider = createControlWithMediaUIControlType(WKMediaUIControlSlider, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, volumeSliderWidth, kButtonMiniSize));
+    left += volumeButtonWidth;
+    _volumeSlider = createControlWithMediaUIControlType(WKMediaUIControlSlider, NSMakeRect(left, volumeControlsBottom + webkit_CGFloor((volumeButtonHeight - volumeSliderHeight) / 2), volumeSliderWidth, volumeSliderHeight));
     [_volumeSlider setValue:[NSNumber numberWithDouble:[self maxVolume]] forKey:@"maxValue"];
     [_volumeSlider setTarget:self];
     [_volumeSlider setAction:@selector(volumeChanged:)];
     [contentView addSubview:_volumeSlider];
 
-    left = kMargin + kButtonMiniSize + volumeSliderWidth + kButtonMiniSize / 2;
-    NSControl *volumeUpButton = createControlWithMediaUIControlType(WKMediaUIControlVolumeUpButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
+    left += volumeSliderWidth + volumeUpButtonLeftMargin;
+    NSControl *volumeUpButton = createControlWithMediaUIControlType(WKMediaUIControlVolumeUpButton, NSMakeRect(left, volumeControlsBottom, volumeButtonWidth, volumeButtonHeight));
     [volumeUpButton setTarget:self];
-    [volumeUpButton setAction:@selector(incrementVolume:)];
+    [volumeUpButton setAction:@selector(setVolumeToMaximum:)];
     [contentView addSubview:volumeUpButton];
     [volumeUpButton release];
-    
-    static const int timeTextWidth = 50;
-    static const int sliderHeight = 13;
-    static const int sliderMarginFixup = 4;
 
 #ifdef HAVE_MEDIA_CONTROL
     _timeline = WKCreateMediaUIControl(WKMediaUIControlTimeline);
@@ -386,26 +416,21 @@ static NSTextField *createTimeTextField(NSRect frame)
 #endif
     [_timeline setTarget:self];
     [_timeline setAction:@selector(timelinePositionChanged:)];
-    [_timeline setFrame:NSMakeRect(kMargin + timeTextWidth + kMargin/2, kMargin - sliderMarginFixup, windowWidth - 2 * (kMargin - sliderMarginFixup) - kMargin * 2 - 2 * timeTextWidth, sliderHeight)];
+    [_timeline setFrame:NSMakeRect(webkit_CGFloor((windowWidth - timelineWidth) / 2), timelineBottomMargin, timelineWidth, timelineHeight)];
     [contentView addSubview:_timeline];
 
-    static const int timeTextHeight = 11;
-
-    _elapsedTimeText = createTimeTextField(NSMakeRect(kMargin, kMargin, timeTextWidth, timeTextHeight));
+    _elapsedTimeText = createTimeTextField(NSMakeRect(timeTextFieldHorizontalMargin, timelineBottomMargin, timeTextFieldWidth, timeTextFieldHeight));
+    [_elapsedTimeText setAlignment:NSLeftTextAlignment];
     [contentView addSubview:_elapsedTimeText];
 
-    _remainingTimeText = createTimeTextField(NSMakeRect(windowWidth - kMargin - timeTextWidth, kMargin, timeTextWidth, timeTextHeight));
+    _remainingTimeText = createTimeTextField(NSMakeRect(windowWidth - timeTextFieldHorizontalMargin - timeTextFieldWidth, timelineBottomMargin, timeTextFieldWidth, timeTextFieldHeight));
+    [_remainingTimeText setAlignment:NSRightTextAlignment];
     [contentView addSubview:_remainingTimeText];
-    
+
     [window recalculateKeyViewLoop];
     [window setInitialFirstResponder:_playButton];
     [window center];
 }
-                                
-/*
- *  Bindings
- *
- */
 
 - (void)updateVolume
 {
@@ -417,19 +442,31 @@ static NSTextField *createTimeTextField(NSRect frame)
     [self updateVolume];
 
     [_timeline setFloatValue:[self currentTime]];
-    [(NSSlider*)_timeline setMaxValue:[self duration]];
+    [_timeline setValue:[NSNumber numberWithDouble:[self duration]] forKey:@"maxValue"];
 
     [_remainingTimeText setStringValue:[self remainingTimeText]];
     [_elapsedTimeText setStringValue:[self elapsedTimeText]];
 }
 
-- (void)fastForward
+- (void)endScrubbing
 {
+    ASSERT(_isScrubbing);
+    _isScrubbing = NO;
+    if (HTMLMediaElement* mediaElement = [_delegate mediaElement])
+        mediaElement->endScrubbing();
 }
 
 - (void)timelinePositionChanged:(id)sender
 {
     [self setCurrentTime:[_timeline floatValue]];
+    if (!_isScrubbing) {
+        _isScrubbing = YES;
+        if (HTMLMediaElement* mediaElement = [_delegate mediaElement])
+            mediaElement->beginScrubbing();
+        static NSArray *endScrubbingModes = [[NSArray alloc] initWithObjects:NSDefaultRunLoopMode, NSModalPanelRunLoopMode, nil];
+        // Schedule -endScrubbing for when leaving mouse tracking mode.
+        [[NSRunLoop currentRunLoop] performSelector:@selector(endScrubbing) target:self argument:nil order:0 modes:endScrubbingModes];
+    }
 }
 
 - (float)currentTime
@@ -443,6 +480,7 @@ static NSTextField *createTimeTextField(NSRect frame)
         return;
     WebCore::ExceptionCode e;
     [_delegate mediaElement]->setCurrentTime(currentTime, e);
+    [self updateTime];
 }
 
 - (double)duration
@@ -461,7 +499,17 @@ static NSTextField *createTimeTextField(NSRect frame)
     [self setVolume:[_volumeSlider doubleValue]];
 }
 
-- (void)decrementVolume:(id)sender
+- (void)setVolumeToZero:(id)sender
+{
+    [self setVolume:0];
+}
+
+- (void)setVolumeToMaximum:(id)sender
+{
+    [self setVolume:[self maxVolume]];
+}
+
+- (void)decrementVolume
 {
     if (![_delegate mediaElement])
         return;
@@ -470,7 +518,7 @@ static NSTextField *createTimeTextField(NSRect frame)
     [self setVolume:max(volume, 0.)];
 }
 
-- (void)incrementVolume:(id)sender
+- (void)incrementVolume
 {
     if (![_delegate mediaElement])
         return;
@@ -492,32 +540,40 @@ static NSTextField *createTimeTextField(NSRect frame)
     if ([_delegate mediaElement]->muted())
         [_delegate mediaElement]->setMuted(false);
     [_delegate mediaElement]->setVolume(volume / [self maxVolume], e);
+    [self updateVolume];
 }
 
-- (void)updateRate
+- (void)updatePlayButton
 {
     [_playButton setIntValue:[self playing]];
 }
 
-- (void)togglePlaying:(id)sender
+- (void)updateRate
 {
-    BOOL nowPlaying = [self playing];
-    [self setPlaying:!nowPlaying];
+    BOOL playing = [self playing];
 
-    // Keep HUD visible when paused
-    if (!nowPlaying)
+    // Keep the HUD visible when paused.
+    if (!playing)
         [self fadeWindowIn];
     else if (!_mouseIsInHUD) {
         [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(fadeWindowOut) object:nil];
         [self performSelector:@selector(fadeWindowOut) withObject:nil afterDelay:HUDWindowFadeOutDelay];
     }
+    [self updatePlayButton];
+}
+
+- (void)togglePlaying:(id)sender
+{
+    [self setPlaying:![self playing]];
 }
 
 - (BOOL)playing
 {
-    if (![_delegate mediaElement])
-        return false;
-    return ![_delegate mediaElement]->canPlay();
+    HTMLMediaElement* mediaElement = [_delegate mediaElement];
+    if (!mediaElement)
+        return NO;
+
+    return !mediaElement->canPlay();
 }
 
 - (void)setPlaying:(BOOL)playing
@@ -533,46 +589,29 @@ static NSTextField *createTimeTextField(NSRect frame)
 
 static NSString *timeToString(double time)
 {
+    ASSERT_ARG(time, time >= 0);
+
     if (!isfinite(time))
         time = 0;
-    int seconds = (int)fabsf(time); 
+
+    int seconds = fabs(time); 
     int hours = seconds / (60 * 60);
     int minutes = (seconds / 60) % 60;
     seconds %= 60;
-    if (hours) {
-        if (hours > 9)
-            return [NSString stringWithFormat:@"%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds];
-        else
-            return [NSString stringWithFormat:@"%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds];
-    }
-    else
-        return [NSString stringWithFormat:@"%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds];
-    
-}
 
-static NSString *stringToTimeTextAttributed(NSString *string, NSTextAlignment align)
-{
-    NSShadow *blackShadow = [[NSShadow alloc] init];
-    [blackShadow setShadowColor:[NSColor blackColor]];
-    [blackShadow setShadowBlurRadius:0];
-    [blackShadow setShadowOffset:NSMakeSize(0, -1)];
-    NSMutableParagraphStyle *style = [[NSMutableParagraphStyle alloc] init];
-    [style setAlignment:align];
-    NSDictionary *dict = [NSDictionary dictionaryWithObjectsAndKeys:blackShadow, NSShadowAttributeName, style, NSParagraphStyleAttributeName, nil];
-    [style release];
-    [blackShadow release];
+    if (hours)
+        return [NSString stringWithFormat:@"%d:%02d:%02d", hours, minutes, seconds];
 
-    NSAttributedString *attrString = [[NSAttributedString alloc] initWithString:string attributes:dict];
-    return [attrString autorelease];    
+    return [NSString stringWithFormat:@"%02d:%02d", minutes, seconds];    
 }
 
 - (NSString *)remainingTimeText
 {
-    if (![_delegate mediaElement])
+    HTMLMediaElement* mediaElement = [_delegate mediaElement];
+    if (!mediaElement)
         return @"";
 
-    // Negative number
-    return stringToTimeTextAttributed(timeToString([_delegate mediaElement]->currentTime() - [_delegate mediaElement]->duration()), NSLeftTextAlignment);
+    return [@"-" stringByAppendingString:timeToString(mediaElement->duration() - mediaElement->currentTime())];
 }
 
 - (NSString *)elapsedTimeText
@@ -580,13 +619,10 @@ static NSString *stringToTimeTextAttributed(NSString *string, NSTextAlignment al
     if (![_delegate mediaElement])
         return @"";
 
-    return stringToTimeTextAttributed(timeToString([_delegate mediaElement]->currentTime()), NSRightTextAlignment);
+    return timeToString([_delegate mediaElement]->currentTime());
 }
 
-/*
- *  Tracking area callbacks
- *
- */
+#pragma mark NSResponder
 
 - (void)mouseEntered:(NSEvent *)theEvent
 {
@@ -601,11 +637,6 @@ static NSString *stringToTimeTextAttributed(NSString *string, NSTextAlignment al
     [self fadeWindowIn];
 }
 
-/*
- *  Other Interface callbacks
- *
- */
-
 - (void)rewind:(id)sender
 {
     if (![_delegate mediaElement])
@@ -627,10 +658,7 @@ static NSString *stringToTimeTextAttributed(NSString *string, NSTextAlignment al
     [_delegate requestExitFullscreen]; 
 }
 
-/*
- *  Window callback
- *
- */
+#pragma mark NSWindowDelegate
 
 - (void)windowDidExpose:(NSNotification *)notification
 {
diff --git a/WebKit/mac/WebView/WebView.mm b/WebKit/mac/WebView/WebView.mm
index 25da631..33ea069 100644
--- a/WebKit/mac/WebView/WebView.mm
+++ b/WebKit/mac/WebView/WebView.mm
@@ -90,6 +90,7 @@
 #import "WebPreferenceKeysPrivate.h"
 #import "WebPreferencesPrivate.h"
 #import "WebScriptDebugDelegate.h"
+#import "WebScriptWorldInternal.h"
 #import "WebSystemInterface.h"
 #import "WebTextCompletionController.h"
 #import "WebTextIterator.h"
@@ -115,6 +116,7 @@
 #import <WebCore/FrameTree.h>
 #import <WebCore/FrameView.h>
 #import <WebCore/GCController.h>
+#import <WebCore/HTMLMediaElement.h>
 #import <WebCore/HTMLNames.h>
 #import <WebCore/HistoryItem.h>
 #import <WebCore/IconDatabase.h>
@@ -319,10 +321,6 @@ macro(yankAndSelect) \
 #define AppleKeyboardUIMode CFSTR("AppleKeyboardUIMode")
 #define UniversalAccessDomain CFSTR("com.apple.universalaccess")
 
-#if USE(ACCELERATED_COMPOSITING)
-#define UsingAcceleratedCompositingProperty @"_isUsingAcceleratedCompositing"
-#endif            
-
 static BOOL s_didSetCacheModel;
 static WebCacheModel s_cacheModel = WebCacheModelDocumentViewer;
 
@@ -398,6 +396,8 @@ NSString *_WebMainFrameTitleKey =       @"mainFrameTitle";
 NSString *_WebMainFrameURLKey =         @"mainFrameURL";
 NSString *_WebMainFrameDocumentKey =    @"mainFrameDocument";
 
+NSString *_WebViewDidStartAcceleratedCompositingNotification = @"_WebViewDidStartAcceleratedCompositing";
+
 @interface WebProgressItem : NSObject
 {
 @public
@@ -820,17 +820,20 @@ static bool runningTigerMail()
     return uniqueExtensions;
 }
 
-+ (BOOL)_viewClass:(Class *)vClass andRepresentationClass:(Class *)rClass forMIMEType:(NSString *)MIMEType
++ (BOOL)_viewClass:(Class *)vClass andRepresentationClass:(Class *)rClass forMIMEType:(NSString *)MIMEType allowingPlugins:(BOOL)allowPlugins
 {
     MIMEType = [MIMEType lowercaseString];
     Class viewClass = [[WebFrameView _viewTypesAllowImageTypeOmission:YES] _webkit_objectForMIMEType:MIMEType];
     Class repClass = [[WebDataSource _repTypesAllowImageTypeOmission:YES] _webkit_objectForMIMEType:MIMEType];
-    
+
     if (!viewClass || !repClass || [[WebPDFView supportedMIMETypes] containsObject:MIMEType]) {
         // Our optimization to avoid loading the plug-in DB and image types for the HTML case failed.
-        // Load the plug-in DB allowing plug-ins to install types.
-        [WebPluginDatabase sharedDatabase];
-            
+
+        if (allowPlugins) {
+            // Load the plug-in DB allowing plug-ins to install types.
+            [WebPluginDatabase sharedDatabase];
+        }
+
         // Load the image types and get the view class and rep class. This should be the fullest picture of all handled types.
         viewClass = [[WebFrameView _viewTypesAllowImageTypeOmission:NO] _webkit_objectForMIMEType:MIMEType];
         repClass = [[WebDataSource _repTypesAllowImageTypeOmission:NO] _webkit_objectForMIMEType:MIMEType];
@@ -855,7 +858,7 @@ static bool runningTigerMail()
 
 - (BOOL)_viewClass:(Class *)vClass andRepresentationClass:(Class *)rClass forMIMEType:(NSString *)MIMEType
 {
-    if ([[self class] _viewClass:vClass andRepresentationClass:rClass forMIMEType:MIMEType])
+    if ([[self class] _viewClass:vClass andRepresentationClass:rClass forMIMEType:MIMEType allowingPlugins:[[[self _webView] preferences] arePlugInsEnabled]])
         return YES;
 
     if (_private->pluginDatabase) {
@@ -1301,6 +1304,8 @@ static bool fastDocumentTeardownEnabled()
     settings->setXSSAuditorEnabled([preferences isXSSAuditorEnabled]);
     settings->setEnforceCSSMIMETypeInStrictMode(!WKAppVersionCheckLessThan(@"com.apple.iWeb", -1, 2.1));
     settings->setAcceleratedCompositingEnabled([preferences acceleratedCompositingEnabled]);
+    settings->setShowDebugBorders([preferences showDebugBorders]);
+    settings->setShowRepaintCounter([preferences showRepaintCounter]);
     settings->setPluginAllowedRunTime([preferences pluginAllowedRunTime]);
     settings->setWebGLEnabled([preferences webGLEnabled]);
 }
@@ -1346,7 +1351,11 @@ static inline IMP getMethod(id o, SEL s)
 
     cache->didCancelClientRedirectForFrameFunc = getMethod(delegate, @selector(webView:didCancelClientRedirectForFrame:));
     cache->didChangeLocationWithinPageForFrameFunc = getMethod(delegate, @selector(webView:didChangeLocationWithinPageForFrame:));
+    cache->didPushStateWithinPageForFrameFunc = getMethod(delegate, @selector(webView:didPushStateWithinPageForFrame:));
+    cache->didReplaceStateWithinPageForFrameFunc = getMethod(delegate, @selector(webView:didReplaceStateWithinPageForFrame:));
+    cache->didPopStateWithinPageForFrameFunc = getMethod(delegate, @selector(webView:didPopStateWithinPageForFrame:));
     cache->didClearWindowObjectForFrameFunc = getMethod(delegate, @selector(webView:didClearWindowObject:forFrame:));
+    cache->didClearWindowObjectForFrameInScriptWorldFunc = getMethod(delegate, @selector(webView:didClearWindowObjectForFrame:inScriptWorld:));
     cache->didClearInspectorWindowObjectForFrameFunc = getMethod(delegate, @selector(webView:didClearInspectorWindowObject:forFrame:));
     cache->didCommitLoadForFrameFunc = getMethod(delegate, @selector(webView:didCommitLoadForFrame:));
     cache->didFailLoadWithErrorForFrameFunc = getMethod(delegate, @selector(webView:didFailLoadWithError:forFrame:));
@@ -1542,9 +1551,6 @@ static inline IMP getMethod(id o, SEL s)
     if (!manualNotifyKeys)
         manualNotifyKeys = [[NSSet alloc] initWithObjects:_WebMainFrameURLKey, _WebIsLoadingKey, _WebEstimatedProgressKey,
             _WebCanGoBackKey, _WebCanGoForwardKey, _WebMainFrameTitleKey, _WebMainFrameIconKey, _WebMainFrameDocumentKey,
-#if USE(ACCELERATED_COMPOSITING)
-            UsingAcceleratedCompositingProperty, // used by DRT
-#endif            
             nil];
     if ([manualNotifyKeys containsObject:key])
         return NO;
@@ -2089,10 +2095,35 @@ static inline IMP getMethod(id o, SEL s)
     return handCursor().impl();
 }
 
+- (BOOL)_postsAcceleratedCompositingNotifications
+{
+#if USE(ACCELERATED_COMPOSITING)
+    return _private->postsAcceleratedCompositingNotifications;
+#else
+    return NO;
+#endif
+
+}
+- (void)_setPostsAcceleratedCompositingNotifications:(BOOL)flag
+{
+#if USE(ACCELERATED_COMPOSITING)
+    _private->postsAcceleratedCompositingNotifications = flag;
+#endif
+}
+
 - (BOOL)_isUsingAcceleratedCompositing
 {
 #if USE(ACCELERATED_COMPOSITING)
-    return _private->acceleratedFramesCount > 0;
+    Frame* coreFrame = [self _mainCoreFrame];
+    if (_private->usesDocumentViews) {
+        for (Frame* frame = coreFrame; frame; frame = frame->tree()->traverseNext(coreFrame)) {
+            NSView *documentView = [[kit(frame) frameView] documentView];
+            if ([documentView isKindOfClass:[WebHTMLView class]] && [(WebHTMLView *)documentView _isUsingAcceleratedCompositing])
+                return YES;
+        }
+    }
+
+    return NO;
 #else
     return NO;
 #endif
@@ -2175,36 +2206,36 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     return patternsVector;
 }
 
-+ (void)_addUserScriptToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url
++ (void)_addUserScriptToGroup:(NSString *)groupName world:(WebScriptWorld *)world source:(NSString *)source url:(NSURL *)url
                     whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime
 {
     String group(groupName);
-    if (group.isEmpty() || worldID == UINT_MAX)
+    if (group.isEmpty())
         return;
     
     PageGroup* pageGroup = PageGroup::pageGroup(group);
     if (!pageGroup)
         return;
     
-    pageGroup->addUserScriptToWorld(worldID, source, url, toStringVector(whitelist), toStringVector(blacklist), 
+    pageGroup->addUserScriptToWorld(core(world), source, url, toStringVector(whitelist), toStringVector(blacklist), 
                                     injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
 }
 
-+ (void)_addUserStyleSheetToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url
++ (void)_addUserStyleSheetToGroup:(NSString *)groupName world:(WebScriptWorld *)world source:(NSString *)source url:(NSURL *)url
                         whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist
 {
     String group(groupName);
-    if (group.isEmpty() || worldID == UINT_MAX)
+    if (group.isEmpty())
         return;
     
     PageGroup* pageGroup = PageGroup::pageGroup(group);
     if (!pageGroup)
         return;
 
-    pageGroup->addUserStyleSheetToWorld(worldID, source, url, toStringVector(whitelist), toStringVector(blacklist));
+    pageGroup->addUserStyleSheetToWorld(core(world), source, url, toStringVector(whitelist), toStringVector(blacklist));
 }
 
-+ (void)_removeUserScriptFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url
++ (void)_removeUserScriptFromGroup:(NSString *)groupName world:(WebScriptWorld *)world url:(NSURL *)url
 {
     String group(groupName);
     if (group.isEmpty())
@@ -2214,10 +2245,10 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->removeUserScriptFromWorld(worldID, url);
+    pageGroup->removeUserScriptFromWorld(core(world), url);
 }
 
-+ (void)_removeUserStyleSheetFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url
++ (void)_removeUserStyleSheetFromGroup:(NSString *)groupName world:(WebScriptWorld *)world url:(NSURL *)url
 {
     String group(groupName);
     if (group.isEmpty())
@@ -2227,10 +2258,10 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->removeUserStyleSheetFromWorld(worldID, url);
+    pageGroup->removeUserStyleSheetFromWorld(core(world), url);
 }
 
-+ (void)_removeUserScriptsFromGroup:(NSString *)groupName worldID:(unsigned)worldID
++ (void)_removeUserScriptsFromGroup:(NSString *)groupName world:(WebScriptWorld *)world
 {
     String group(groupName);
     if (group.isEmpty())
@@ -2240,10 +2271,10 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->removeUserScriptsFromWorld(worldID);
+    pageGroup->removeUserScriptsFromWorld(core(world));
 }
 
-+ (void)_removeUserStyleSheetsFromGroup:(NSString *)groupName worldID:(unsigned)worldID
++ (void)_removeUserStyleSheetsFromGroup:(NSString *)groupName world:(WebScriptWorld *)world
 {
     String group(groupName);
     if (group.isEmpty())
@@ -2253,7 +2284,7 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->removeUserStyleSheetsFromWorld(worldID);
+    pageGroup->removeUserStyleSheetsFromWorld(core(world));
 }
 
 + (void)_removeAllUserContentFromGroup:(NSString *)groupName
@@ -2374,13 +2405,26 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     PageGroup::closeLocalStorage();
 }
 
++ (BOOL)_canShowMIMEType:(NSString *)MIMEType allowingPlugins:(BOOL)allowPlugins
+{
+    return [self _viewClass:nil andRepresentationClass:nil forMIMEType:MIMEType allowingPlugins:allowPlugins];
+}
+
 + (BOOL)canShowMIMEType:(NSString *)MIMEType
 {
-    return [self _viewClass:nil andRepresentationClass:nil forMIMEType:MIMEType];
+    return [self _canShowMIMEType:MIMEType allowingPlugins:YES];
+}
+
+- (BOOL)_canShowMIMEType:(NSString *)MIMEType
+{
+    return [[self class] _canShowMIMEType:MIMEType allowingPlugins:[[[self _webView] preferences] arePlugInsEnabled]];
 }
 
 - (WebBasePluginPackage *)_pluginForMIMEType:(NSString *)MIMEType
 {
+    if (![_private->preferences arePlugInsEnabled])
+        return nil;
+
     WebBasePluginPackage *pluginPackage = [[WebPluginDatabase sharedDatabase] pluginForMIMEType:MIMEType];
     if (pluginPackage)
         return pluginPackage;
@@ -2393,6 +2437,9 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
 
 - (WebBasePluginPackage *)_pluginForExtension:(NSString *)extension
 {
+    if (![_private->preferences arePlugInsEnabled])
+        return nil;
+
     WebBasePluginPackage *pluginPackage = [[WebPluginDatabase sharedDatabase] pluginForExtension:extension];
     if (pluginPackage)
         return pluginPackage;
@@ -2424,6 +2471,9 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
 
 - (BOOL)_isMIMETypeRegisteredAsPlugin:(NSString *)MIMEType
 {
+    if (![_private->preferences arePlugInsEnabled])
+        return NO;
+
     if ([[WebPluginDatabase sharedDatabase] isMIMETypeRegistered:MIMEType])
         return YES;
         
@@ -3192,7 +3242,14 @@ static bool needsWebViewInitThreadWorkaround()
 // Get the appropriate user-agent string for a particular URL.
 - (NSString *)userAgentForURL:(NSURL *)url
 {
-    return [self _userAgentForURL:KURL([url absoluteURL])];
+    if (_private->useSiteSpecificSpoofing) {
+        // No current site-specific spoofs.
+    }
+
+    if (_private->userAgent.isNull())
+        _private->userAgent = [[self class] _standardUserAgentWithApplicationName:_private->applicationNameForUserAgent];
+
+    return _private->userAgent;
 }
 
 - (void)setHostWindow:(NSWindow *)hostWindow
@@ -4009,7 +4066,7 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
     if (jsValue.isBoolean())
         return [NSAppleEventDescriptor descriptorWithBoolean:jsValue.getBoolean()];
     if (jsValue.isString())
-        return [NSAppleEventDescriptor descriptorWithString:String(jsValue.getString())];
+        return [NSAppleEventDescriptor descriptorWithString:String(jsValue.getString(exec))];
     if (jsValue.isNumber()) {
         double value = jsValue.uncheckedGetNumber();
         int intValue = value;
@@ -5294,19 +5351,6 @@ static WebFrameView *containingFrameView(NSView *view)
 }
 #endif // ENABLE(ICONDATABASE)
 
-// Get the appropriate user-agent string for a particular URL.
-- (WebCore::String)_userAgentForURL:(const WebCore::KURL&)url
-{
-    if (_private->useSiteSpecificSpoofing) {
-        // No current site-specific spoofs.
-    }
-
-    if (_private->userAgent.isNull())
-        _private->userAgent = [[self class] _standardUserAgentWithApplicationName:_private->applicationNameForUserAgent];
-
-    return _private->userAgent;
-}
-
 - (void)_addObject:(id)object forIdentifier:(unsigned long)identifier
 {
     ASSERT(!_private->identifierMap.contains(identifier));
@@ -5417,28 +5461,6 @@ static WebFrameView *containingFrameView(NSView *view)
     _private->needsOneShotDrawingSynchronization = needsSynchronization;
 }
 
-- (void)_startedAcceleratedCompositingForFrame:(WebFrame*)webFrame
-{
-    BOOL entering = _private->acceleratedFramesCount == 0;
-    if (entering)
-        [self willChangeValueForKey:UsingAcceleratedCompositingProperty];
-    ++_private->acceleratedFramesCount;
-    if (entering)
-        [self didChangeValueForKey:UsingAcceleratedCompositingProperty];
-}
-
-- (void)_stoppedAcceleratedCompositingForFrame:(WebFrame*)webFrame
-{
-    BOOL leaving = _private->acceleratedFramesCount == 1;
-    ASSERT(_private->acceleratedFramesCount > 0);
-    
-    if (leaving)
-        [self willChangeValueForKey:UsingAcceleratedCompositingProperty];
-    --_private->acceleratedFramesCount;
-    if (leaving)
-        [self didChangeValueForKey:UsingAcceleratedCompositingProperty];
-}
-
 - (BOOL)_syncCompositingChanges
 {
     Frame* frame = [self _mainCoreFrame];
diff --git a/WebKit/mac/WebView/WebViewData.h b/WebKit/mac/WebView/WebViewData.h
index 6ec94a7..37024c7 100644
--- a/WebKit/mac/WebView/WebViewData.h
+++ b/WebKit/mac/WebView/WebViewData.h
@@ -141,8 +141,7 @@ extern int pluginDatabaseClientCount;
     // When this flag is set, next time a WebHTMLView draws, it needs to temporarily disable screen updates
     // so that the NSView drawing is visually synchronized with CALayer updates.
     BOOL needsOneShotDrawingSynchronization;
-    // Number of WebHTMLViews using accelerated compositing. Used to implement _isUsingAcceleratedCompositing.
-    int acceleratedFramesCount;
+    BOOL postsAcceleratedCompositingNotifications;
     // Run loop observer used to implement the compositing equivalent of -viewWillDraw
     CFRunLoopObserverRef layerSyncRunLoopObserver;
 #endif
diff --git a/WebKit/mac/WebView/WebViewInternal.h b/WebKit/mac/WebView/WebViewInternal.h
index 15596db..6c2ae50 100644
--- a/WebKit/mac/WebView/WebViewInternal.h
+++ b/WebKit/mac/WebView/WebViewInternal.h
@@ -67,7 +67,6 @@ namespace WebCore {
 - (WebCore::Frame*)_mainCoreFrame;
 - (WebFrame *)_selectedOrMainFrame;
 
-- (WebCore::String)_userAgentForURL:(const WebCore::KURL&)url;
 - (WebCore::KeyboardUIMode)_keyboardUIMode;
 
 - (BOOL)_becomingFirstResponderFromOutside;
@@ -82,8 +81,6 @@ namespace WebCore {
 #if USE(ACCELERATED_COMPOSITING)
 - (BOOL)_needsOneShotDrawingSynchronization;
 - (void)_setNeedsOneShotDrawingSynchronization:(BOOL)needsSynchronization;
-- (void)_startedAcceleratedCompositingForFrame:(WebFrame*)webFrame;
-- (void)_stoppedAcceleratedCompositingForFrame:(WebFrame*)webFrame;
 - (void)_scheduleCompositingLayerSync;
 #endif
 
@@ -116,8 +113,10 @@ namespace WebCore {
 - (void)_pushPerformingProgrammaticFocus;
 - (void)_popPerformingProgrammaticFocus;
 - (void)_didStartProvisionalLoadForFrame:(WebFrame *)frame;
-+ (BOOL)_viewClass:(Class *)vClass andRepresentationClass:(Class *)rClass forMIMEType:(NSString *)MIMEType;
++ (BOOL)_viewClass:(Class *)vClass andRepresentationClass:(Class *)rClass forMIMEType:(NSString *)MIMEType allowingPlugins:(BOOL)allowPlugins;
 - (BOOL)_viewClass:(Class *)vClass andRepresentationClass:(Class *)rClass forMIMEType:(NSString *)MIMEType;
++ (BOOL)_canShowMIMEType:(NSString *)MIMEType allowingPlugins:(BOOL)allowPlugins;
+- (BOOL)_canShowMIMEType:(NSString *)MIMEType;
 + (NSString *)_MIMETypeForFile:(NSString *)path;
 - (WebDownload *)_downloadURL:(NSURL *)URL;
 + (NSString *)_generatedMIMETypeForURLScheme:(NSString *)URLScheme;
diff --git a/WebKit/mac/WebView/WebViewPrivate.h b/WebKit/mac/WebView/WebViewPrivate.h
index 99bd5fa..0622d4c 100644
--- a/WebKit/mac/WebView/WebViewPrivate.h
+++ b/WebKit/mac/WebView/WebViewPrivate.h
@@ -45,6 +45,7 @@
 @class WebFrame;
 @class WebInspector;
 @class WebPreferences;
+@class WebScriptWorld;
 @class WebTextIterator;
 
 @protocol WebFormDelegate;
@@ -66,6 +67,9 @@ extern NSString *WebElementIsContentEditableKey; // NSNumber indicating whether
 // other WebElementDictionary keys
 extern NSString *WebElementLinkIsLiveKey;        // NSNumber of BOOL indictating whether the link is live or not
 
+// One of the subviews of the WebView entered compositing mode.
+extern NSString *_WebViewDidStartAcceleratedCompositingNotification;
+
 #if ENABLE_DASHBOARD_SUPPORT
 typedef enum {
     WebDashboardBehaviorAlwaysSendMouseEventsToAllWindows,
@@ -460,6 +464,8 @@ Could be worth adding to the API.
 + (NSCursor *)_pointingHandCursor;
 
 // SPI for DumpRenderTree
+- (BOOL)_postsAcceleratedCompositingNotifications;
+- (void)_setPostsAcceleratedCompositingNotifications:(BOOL)flag;
 - (BOOL)_isUsingAcceleratedCompositing;
 
 // SPI for PluginHalter
@@ -479,12 +485,12 @@ Could be worth adding to the API.
 // Removes all white list entries created with _whiteListAccessFromOrigin.
 + (void)_resetOriginAccessWhiteLists;
 
-+ (void)_addUserScriptToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime;
-+ (void)_addUserStyleSheetToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist;
-+ (void)_removeUserScriptFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url;
-+ (void)_removeUserStyleSheetFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url;
-+ (void)_removeUserScriptsFromGroup:(NSString *)groupName worldID:(unsigned)worldID;
-+ (void)_removeUserStyleSheetsFromGroup:(NSString *)groupName worldID:(unsigned)worldID;
++ (void)_addUserScriptToGroup:(NSString *)groupName world:(WebScriptWorld *)world source:(NSString *)source url:(NSURL *)url whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime;
++ (void)_addUserStyleSheetToGroup:(NSString *)groupName world:(WebScriptWorld *)world source:(NSString *)source url:(NSURL *)url whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist;
++ (void)_removeUserScriptFromGroup:(NSString *)groupName world:(WebScriptWorld *)world url:(NSURL *)url;
++ (void)_removeUserStyleSheetFromGroup:(NSString *)groupName world:(WebScriptWorld *)world url:(NSURL *)url;
++ (void)_removeUserScriptsFromGroup:(NSString *)groupName world:(WebScriptWorld *)world;
++ (void)_removeUserStyleSheetsFromGroup:(NSString *)groupName world:(WebScriptWorld *)world;
 + (void)_removeAllUserContentFromGroup:(NSString *)groupName;
 
 /*!
diff --git a/WebKit/qt/Api/headers.pri b/WebKit/qt/Api/headers.pri
index 5a95c67..1a42597 100644
--- a/WebKit/qt/Api/headers.pri
+++ b/WebKit/qt/Api/headers.pri
@@ -8,7 +8,6 @@ WEBKIT_API_HEADERS = $$PWD/qwebframe.h \
                      $$PWD/qwebdatabase.h \
                      $$PWD/qwebsecurityorigin.h \
                      $$PWD/qwebelement.h \
-                     $$PWD/qwebplugindatabase.h \
                      $$PWD/qwebpluginfactory.h \
                      $$PWD/qwebhistory.h \
                      $$PWD/qwebinspector.h \
diff --git a/WebKit/qt/Api/qcookiejar.cpp b/WebKit/qt/Api/qcookiejar.cpp
deleted file mode 100644
index a02fe78..0000000
--- a/WebKit/qt/Api/qcookiejar.cpp
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
-    Copyright (C) 2007 Staikos Computing Services Inc.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "qcookiejar.h"
-#include <QCoreApplication>
-uint qHash(const QUrl&);
-#include <QHash>
-#include <QPointer>
-
-class QCookieJarPrivate {
-    public:
-        QCookieJarPrivate()
-        {
-            enabled = true;
-        }
-        bool enabled;
-        QHash<QUrl, QString> jar;
-};
-
-
-uint qHash(const QUrl& url)
-{
-    return qHash(url.toString());
-}
-
-
-QCookieJar::QCookieJar()
-: QObject(), d(new QCookieJarPrivate)
-{
-}
-
-
-QCookieJar::~QCookieJar()
-{
-    delete d;
-}
-
-
-void QCookieJar::setCookies(const QUrl& url, const QUrl& policyUrl, const QString& value)
-{
-    Q_UNUSED(policyUrl)
-    d->jar.insert(url, value);
-}
-
-
-QString QCookieJar::cookies(const QUrl& url)
-{
-    return d->jar.value(url);
-}
-
-
-bool QCookieJar::isEnabled() const
-{
-    return d->enabled;
-}
-
-
-void QCookieJar::setEnabled(bool enabled)
-{
-    d->enabled = enabled;
-}
-
-
-static QPointer<QCookieJar> gJar;
-static bool gRoutineAdded = false;
-
-static void gCleanupJar()
-{
-    delete gJar;
-}
-
-
-void QCookieJar::setCookieJar(QCookieJar* jar)
-{
-    if (!gRoutineAdded) {
-        qAddPostRoutine(gCleanupJar);
-        gRoutineAdded = true;
-    }
-    delete gJar;
-    gJar = jar;
-}
-
-
-QCookieJar* QCookieJar::cookieJar()
-{
-    if (!gJar)
-        setCookieJar(new QCookieJar);
-
-    return gJar;
-}
diff --git a/WebKit/qt/Api/qcookiejar.h b/WebKit/qt/Api/qcookiejar.h
deleted file mode 100644
index 7885cc1..0000000
--- a/WebKit/qt/Api/qcookiejar.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
-    Copyright (C) 2007 Staikos Computing Services Inc.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef QCOOKIEJAR_H
-#define QCOOKIEJAR_H
-
-#include <QtCore/qobject.h>
-#include <QtCore/qurl.h>
-#include "qwebkitglobal.h"
-
-class QCookieJarPrivate;
-
-class QWEBKIT_EXPORT QCookieJar : public QObject {
-    Q_OBJECT
-
-    Q_PROPERTY(bool enabled READ isEnabled WRITE setEnabled)
-public:
-    QCookieJar();
-    ~QCookieJar();
-
-    virtual void setCookies(const QUrl& url, const QUrl& policyUrl, const QString& value);
-    virtual QString cookies(const QUrl& url);
-
-    bool isEnabled() const;
-
-    static void setCookieJar(QCookieJar* jar);
-    static QCookieJar* cookieJar();
-
-public slots:
-    virtual void setEnabled(bool enabled);
-
-private:
-    friend class QCookieJarPrivate;
-    QCookieJarPrivate* d;
-};
-
-
-#endif
diff --git a/WebKit/qt/Api/qgraphicswebview.cpp b/WebKit/qt/Api/qgraphicswebview.cpp
index 50a0986..b25b53b 100644
--- a/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/WebKit/qt/Api/qgraphicswebview.cpp
@@ -39,13 +39,13 @@ public:
     QGraphicsWebViewPrivate(QGraphicsWebView* parent)
         : q(parent)
         , page(0)
-        , interactive(true)
-        , progress(1.0)
     {}
 
+    virtual ~QGraphicsWebViewPrivate();
     virtual void scroll(int dx, int dy, const QRect&);
     virtual void update(const QRect& dirtyRect);
     virtual void setInputMethodEnabled(bool enable);
+    virtual bool inputMethodEnabled() const;
 #if QT_VERSION >= 0x040600
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable);
 #endif
@@ -61,26 +61,14 @@ public:
 
     virtual QObject* pluginParent() const;
 
-    void _q_doLoadProgress(int progress);
     void _q_doLoadFinished(bool success);
-    void _q_setStatusBarMessage(const QString& message);
 
     QGraphicsWebView* q;
     QWebPage* page;
-
-    QString statusBarMessage;
-    bool interactive;
-    qreal progress;
 };
 
-void QGraphicsWebViewPrivate::_q_doLoadProgress(int progress)
+QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate()
 {
-    if (qFuzzyCompare(this->progress, qreal(progress / 100.)))
-        return;
-
-    this->progress = progress / 100.;
-
-    emit q->progressChanged(this->progress);
 }
 
 void QGraphicsWebViewPrivate::_q_doLoadFinished(bool success)
@@ -105,8 +93,20 @@ void QGraphicsWebViewPrivate::update(const QRect & dirtyRect)
 
 void QGraphicsWebViewPrivate::setInputMethodEnabled(bool enable)
 {
-    q->setAttribute(Qt::WA_InputMethodEnabled, enable);
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    q->setFlag(QGraphicsItem::ItemAcceptsInputMethod, enable);
+#endif
 }
+
+bool QGraphicsWebViewPrivate::inputMethodEnabled() const
+{
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    return q->flags() & QGraphicsItem::ItemAcceptsInputMethod;
+#else
+    return false;
+#endif
+}
+
 #if QT_VERSION >= 0x040600
 void QGraphicsWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool enable)
 {
@@ -156,22 +156,78 @@ QObject* QGraphicsWebViewPrivate::pluginParent() const
     return q;
 }
 
-void QGraphicsWebViewPrivate::_q_setStatusBarMessage(const QString& s)
-{
-    statusBarMessage = s;
-    emit q->statusChanged();
-}
-
 /*!
     \class QGraphicsWebView
-    \brief The QGraphicsWebView class allows web content to be added to a GraphicsView.
+    \brief The QGraphicsWebView class allows Web content to be added to a GraphicsView.
     \since 4.6
 
-    A WebGraphicsItem renders web content based on a URL or set data.
+    An instance of this class renders Web content from a URL or supplied as data, using
+    features of the QtWebKit module.
+
+    If the width and height of the item are not set, they will default to 800 and 600,
+    respectively. If the Web page contents is larger than that, scrollbars will be shown
+    if not disabled explicitly.
+
+    \section1 Browser Features
+
+    Many of the functions, signals and properties provided by QWebView are also available
+    for this item, making it simple to adapt existing code to use QGraphicsWebView instead
+    of QWebView.
 
-    If the width and height of the item is not set, they will
-    dynamically adjust to a size appropriate for the content.
-    This width may be large (eg. 980) for typical online web pages.
+    The item uses a QWebPage object to perform the rendering of Web content, and this can
+    be obtained with the page() function, enabling the document itself to be accessed and
+    modified.
+
+    As with QWebView, the item records the browsing history using a QWebHistory object,
+    accessible using the history() function. The QWebSettings object that defines the
+    configuration of the browser can be obtained with the settings() function, enabling
+    features like plugin support to be customized for each item.
+
+    \sa QWebView, QGraphicsTextItem
+*/
+
+/*!
+    \fn void QGraphicsWebView::titleChanged(const QString &title)
+
+    This signal is emitted whenever the \a title of the main frame changes.
+
+    \sa title()
+*/
+
+/*!
+    \fn void QGraphicsWebView::urlChanged(const QUrl &url)
+
+    This signal is emitted when the \a url of the view changes.
+
+    \sa url(), load()
+*/
+
+/*!
+    \fn void QGraphicsWebView::iconChanged()
+
+    This signal is emitted whenever the icon of the page is loaded or changes.
+
+    In order for icons to be loaded, you will need to set an icon database path
+    using QWebSettings::setIconDatabasePath().
+
+    \sa icon(), QWebSettings::setIconDatabasePath()
+*/
+
+/*!
+    \fn void QGraphicsWebView::loadStarted()
+
+    This signal is emitted when a new load of the page is started.
+
+    \sa loadProgress(), loadFinished()
+*/
+
+/*!
+    \fn void QGraphicsWebView::loadFinished(bool ok)
+
+    This signal is emitted when a load of the page is finished.
+    \a ok will indicate whether the load was successful or any error occurred.
+
+    \sa loadStarted()
 */
 
 /*!
@@ -186,12 +242,13 @@ QGraphicsWebView::QGraphicsWebView(QGraphicsItem* parent)
 #if QT_VERSION >= 0x040600
     setFlag(QGraphicsItem::ItemUsesExtendedStyleOption, true);
 #endif
+    setAcceptDrops(true);
     setAcceptHoverEvents(true);
     setFocusPolicy(Qt::StrongFocus);
 }
 
 /*!
-    Destroys the web graphicsitem.
+    Destroys the item.
 */
 QGraphicsWebView::~QGraphicsWebView()
 {
@@ -272,6 +329,24 @@ QVariant QGraphicsWebView::itemChange(GraphicsItemChange change, const QVariant&
 
 /*! \reimp
 */
+QSizeF QGraphicsWebView::sizeHint(Qt::SizeHint which, const QSizeF& constraint) const
+{
+    if (which == Qt::PreferredSize)
+        return QSizeF(800, 600); // ###
+    return QGraphicsWidget::sizeHint(which, constraint);
+}
+
+/*! \reimp
+*/
+QVariant QGraphicsWebView::inputMethodQuery(Qt::InputMethodQuery query) const
+{
+    if (d->page)
+        return d->page->inputMethodQuery(query);
+    return QVariant();
+}
+
+/*! \reimp
+*/
 bool QGraphicsWebView::event(QEvent* event)
 {
     // Re-implemented in order to allows fixing event-related bugs in patch releases.
@@ -293,7 +368,6 @@ bool QGraphicsWebView::event(QEvent* event)
 #endif // QT_NO_CONTEXTMENU
         {
 #ifndef QT_NO_CURSOR
-#if QT_VERSION >= 0x040400
             if (event->type() == QEvent::CursorChange) {
                 // An unsetCursor will set the cursor to Qt::ArrowCursor.
                 // Thus this cursor change might be a QWidget::unsetCursor()
@@ -307,7 +381,6 @@ bool QGraphicsWebView::event(QEvent* event)
                     d->resetCursor();
             }
 #endif
-#endif
         }
     }
     return QGraphicsWidget::event(event);
@@ -345,20 +418,22 @@ void QGraphicsWebView::setPage(QWebPage* page)
 
     QWebFrame* mainFrame = d->page->mainFrame();
 
-    connect(mainFrame, SIGNAL(titleChanged(const QString&)),
-            this, SIGNAL(titleChanged(const QString&)));
+    connect(mainFrame, SIGNAL(titleChanged(QString)),
+            this, SIGNAL(titleChanged(QString)));
     connect(mainFrame, SIGNAL(iconChanged()),
             this, SIGNAL(iconChanged()));
-    connect(mainFrame, SIGNAL(urlChanged(const QUrl&)),
-            this, SIGNAL(urlChanged(const QUrl&)));
+    connect(mainFrame, SIGNAL(urlChanged(QUrl)),
+            this, SIGNAL(urlChanged(QUrl)));
     connect(d->page, SIGNAL(loadStarted()),
             this, SIGNAL(loadStarted()));
     connect(d->page, SIGNAL(loadProgress(int)),
-            this, SLOT(_q_doLoadProgress(int)));
+            this, SIGNAL(loadProgress(int)));
     connect(d->page, SIGNAL(loadFinished(bool)),
             this, SLOT(_q_doLoadFinished(bool)));
-    connect(d->page, SIGNAL(statusBarMessage(const QString&)),
-            this, SLOT(_q_setStatusBarMessage(const QString&)));
+    connect(d->page, SIGNAL(statusBarMessage(QString)),
+            this, SIGNAL(statusBarMessage(QString)));
+    connect(d->page, SIGNAL(linkClicked(QUrl)),
+            this, SIGNAL(linkClicked(QUrl)));
 }
 
 /*!
@@ -429,7 +504,6 @@ void QGraphicsWebView::setZoomFactor(qreal factor)
         return;
 
     page()->mainFrame()->setZoomFactor(factor);
-    emit zoomFactorChanged();
 }
 
 qreal QGraphicsWebView::zoomFactor() const
@@ -466,21 +540,6 @@ void QGraphicsWebView::setGeometry(const QRectF& rect)
 }
 
 /*!
-    \property QGraphicsWebView::status
-    \brief the load status message.
-
-    Provides the latest status message set during the load of a URL.
-    Commonly shown by Status Bar widgets.
-
-    \sa statusChanged()
-*/
-
-QString QGraphicsWebView::status() const
-{
-    return d->statusBarMessage;
-}
-
-/*!
     Convenience slot that stops loading the document.
 
     \sa reload(), loadFinished()
@@ -527,15 +586,6 @@ void QGraphicsWebView::reload()
 }
 
 /*!
-    \property QGraphicsWebView::progress
-    \brief the progress of loading the current URL, from 0 to 1.
-*/
-qreal QGraphicsWebView::progress() const
-{
-    return d->progress;
-}
-
-/*!
     Loads the specified \a url and displays it.
 
     \note The view remains the same until enough data has arrived to display the new \a url.
@@ -567,15 +617,14 @@ void QGraphicsWebView::load(const QNetworkRequest& request,
 }
 
 /*!
-    \property QGraphicsWebView::html
-    This property provides an HTML interface to the text in the webview.
+    Sets the content of the web view to the specified \a html.
 
-    When setting this property, external objects such as stylesheets or images
-    referenced in the HTML document are located relative to \a baseUrl.
+    External objects such as stylesheets or images referenced in the HTML
+    document are located relative to \a baseUrl.
 
     The \a html is loaded immediately; external objects are loaded asynchronously.
 
-    When using these methods, WebKit assumes that external resources such as
+    When using this method, WebKit assumes that external resources such as
     JavaScript programs or style sheets are encoded in UTF-8 unless otherwise
     specified. For example, the encoding of an external script can be specified
     through the charset attribute of the HTML script tag. Alternatively, the
@@ -588,11 +637,6 @@ void QGraphicsWebView::setHtml(const QString& html, const QUrl& baseUrl)
     page()->mainFrame()->setHtml(html, baseUrl);
 }
 
-QString QGraphicsWebView::toHtml() const
-{
-    return page()->mainFrame()->toHtml();
-}
-
 /*!
     Sets the content of the web graphicsitem to the specified content \a data. If the \a mimeType argument
     is empty it is currently assumed that the content is HTML but in future versions we may introduce
@@ -622,22 +666,19 @@ QWebHistory* QGraphicsWebView::history() const
 }
 
 /*!
-  \property QGraphicsWebView::interactive
-  \brief controls whether the item responds to mouse and key events.
-*/
+    \property QGraphicsWebView::modified
+    \brief whether the document was modified by the user
 
-bool QGraphicsWebView::isInteractive() const
-{
-    return d->interactive;
-}
+    Parts of HTML documents can be editable for example through the
+    \c{contenteditable} attribute on HTML elements.
 
-void QGraphicsWebView::setInteractive(bool allowed)
+    By default, this property is false.
+*/
+bool QGraphicsWebView::isModified() const
 {
-    if (d->interactive == allowed)
-        return;
-
-    d->interactive = allowed;
-    emit interactivityChanged();
+    if (d->page)
+        return d->page->isModified();
+    return false;
 }
 
 /*!
@@ -654,11 +695,53 @@ QWebSettings* QGraphicsWebView::settings() const
     return page()->settings();
 }
 
+/*!
+    Returns a pointer to a QAction that encapsulates the specified web action \a action.
+*/
+QAction *QGraphicsWebView::pageAction(QWebPage::WebAction action) const
+{
+    return page()->action(action);
+}
+
+/*!
+    Triggers the specified \a action. If it is a checkable action the specified
+    \a checked state is assumed.
+
+    \sa pageAction()
+*/
+void QGraphicsWebView::triggerPageAction(QWebPage::WebAction action, bool checked)
+{
+    page()->triggerAction(action, checked);
+}
+
+/*!
+    Finds the specified string, \a subString, in the page, using the given \a options.
+
+    If the HighlightAllOccurrences flag is passed, the function will highlight all occurrences
+    that exist in the page. All subsequent calls will extend the highlight, rather than
+    replace it, with occurrences of the new string.
+
+    If the HighlightAllOccurrences flag is not passed, the function will select an occurrence
+    and all subsequent calls will replace the current occurrence with the next one.
+
+    To clear the selection, just pass an empty string.
+
+    Returns true if \a subString was found; otherwise returns false.
+
+    \sa QWebPage::selectedText(), QWebPage::selectionChanged()
+*/
+bool QGraphicsWebView::findText(const QString &subString, QWebPage::FindFlags options)
+{
+    if (d->page)
+        return d->page->findText(subString, options);
+    return false;
+}
+
 /*! \reimp
 */
 void QGraphicsWebView::hoverMoveEvent(QGraphicsSceneHoverEvent* ev)
 {
-    if (d->interactive && d->page) {
+    if (d->page) {
         const bool accepted = ev->isAccepted();
         QMouseEvent me = QMouseEvent(QEvent::MouseMove,
                 ev->pos().toPoint(), Qt::NoButton,
@@ -682,7 +765,7 @@ void QGraphicsWebView::hoverLeaveEvent(QGraphicsSceneHoverEvent* ev)
 */
 void QGraphicsWebView::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
 {
-    if (d->interactive && d->page) {
+    if (d->page) {
         const bool accepted = ev->isAccepted();
         d->page->event(ev);
         ev->setAccepted(accepted);
@@ -696,7 +779,7 @@ void QGraphicsWebView::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
 */
 void QGraphicsWebView::mousePressEvent(QGraphicsSceneMouseEvent* ev)
 {
-    if (d->interactive && d->page) {
+    if (d->page) {
         const bool accepted = ev->isAccepted();
         d->page->event(ev);
         ev->setAccepted(accepted);
@@ -710,7 +793,7 @@ void QGraphicsWebView::mousePressEvent(QGraphicsSceneMouseEvent* ev)
 */
 void QGraphicsWebView::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
 {
-    if (d->interactive && d->page) {
+    if (d->page) {
         const bool accepted = ev->isAccepted();
         d->page->event(ev);
         ev->setAccepted(accepted);
@@ -724,7 +807,7 @@ void QGraphicsWebView::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
 */
 void QGraphicsWebView::mouseDoubleClickEvent(QGraphicsSceneMouseEvent* ev)
 {
-    if (d->interactive && d->page) {
+    if (d->page) {
         const bool accepted = ev->isAccepted();
         d->page->event(ev);
         ev->setAccepted(accepted);
@@ -738,7 +821,7 @@ void QGraphicsWebView::mouseDoubleClickEvent(QGraphicsSceneMouseEvent* ev)
 */
 void QGraphicsWebView::keyPressEvent(QKeyEvent* ev)
 {
-    if (d->interactive && d->page)
+    if (d->page)
         d->page->event(ev);
 
     if (!ev->isAccepted())
@@ -749,7 +832,7 @@ void QGraphicsWebView::keyPressEvent(QKeyEvent* ev)
 */
 void QGraphicsWebView::keyReleaseEvent(QKeyEvent* ev)
 {
-    if (d->interactive && d->page)
+    if (d->page)
         d->page->event(ev);
 
     if (!ev->isAccepted())
@@ -791,10 +874,8 @@ bool QGraphicsWebView::focusNextPrevChild(bool next)
 void QGraphicsWebView::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
-    //if (d->page)
-    //    d->page->event(ev);
-    //Just remove this line below when the code above is working
-    Q_UNUSED(ev);
+    if (d->page)
+        d->page->event(ev);
 #else
     Q_UNUSED(ev);
 #endif
@@ -805,7 +886,7 @@ void QGraphicsWebView::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
 void QGraphicsWebView::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
-    if (d->interactive && d->page) {
+    if (d->page) {
         const bool accepted = ev->isAccepted();
         d->page->event(ev);
         ev->setAccepted(accepted);
@@ -823,7 +904,7 @@ void QGraphicsWebView::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
 void QGraphicsWebView::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
-    if (d->interactive && d->page) {
+    if (d->page) {
         const bool accepted = ev->isAccepted();
         d->page->event(ev);
         ev->setAccepted(accepted);
@@ -841,7 +922,7 @@ void QGraphicsWebView::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
 void QGraphicsWebView::dropEvent(QGraphicsSceneDragDropEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
-    if (d->interactive && d->page) {
+    if (d->page) {
         const bool accepted = ev->isAccepted();
         d->page->event(ev);
         ev->setAccepted(accepted);
@@ -872,7 +953,7 @@ void QGraphicsWebView::contextMenuEvent(QGraphicsSceneContextMenuEvent* ev)
 */
 void QGraphicsWebView::wheelEvent(QGraphicsSceneWheelEvent* ev)
 {
-    if (d->interactive && d->page) {
+    if (d->page) {
         const bool accepted = ev->isAccepted();
         d->page->event(ev);
         ev->setAccepted(accepted);
@@ -887,11 +968,40 @@ void QGraphicsWebView::wheelEvent(QGraphicsSceneWheelEvent* ev)
 */
 void QGraphicsWebView::inputMethodEvent(QInputMethodEvent* ev)
 {
-    if (d->interactive && d->page)
+    if (d->page)
         d->page->event(ev);
 
     if (!ev->isAccepted())
         QGraphicsItem::inputMethodEvent(ev);
 }
 
+/*!
+    \fn void QGraphicsWebView::statusBarMessage(const QString& text)
+
+    This signal is emitted when the statusbar \a text is changed by the page.
+*/
+
+/*!
+    \fn void QGraphicsWebView::loadProgress(int progress)
+
+    This signal is emitted every time an element in the web page
+    completes loading and the overall loading progress advances.
+
+    This signal tracks the progress of all child frames.
+
+    The current value is provided by \a progress and scales from 0 to 100,
+    which is the default range of QProgressBar.
+
+    \sa loadStarted(), loadFinished()
+*/
+
+/*!
+    \fn void QGraphicsWebView::linkClicked(const QUrl &url)
+
+    This signal is emitted whenever the user clicks on a link and the page's linkDelegationPolicy
+    property is set to delegate the link handling for the specified \a url.
+
+    \sa QWebPage::linkDelegationPolicy()
+*/
+
 #include "moc_qgraphicswebview.cpp"
diff --git a/WebKit/qt/Api/qgraphicswebview.h b/WebKit/qt/Api/qgraphicswebview.h
index 43cf59a..f3afb4c 100644
--- a/WebKit/qt/Api/qgraphicswebview.h
+++ b/WebKit/qt/Api/qgraphicswebview.h
@@ -21,6 +21,7 @@
 #define QGraphicsWebView_h
 
 #include "qwebkitglobal.h"
+#include "qwebpage.h"
 #include <QtCore/qurl.h>
 #include <QtGui/qevent.h>
 #include <QtGui/qgraphicswidget.h>
@@ -39,17 +40,14 @@ class QWEBKIT_EXPORT QGraphicsWebView : public QGraphicsWidget {
 
     Q_PROPERTY(QString title READ title NOTIFY titleChanged)
     Q_PROPERTY(QIcon icon READ icon NOTIFY iconChanged)
-    Q_PROPERTY(qreal zoomFactor READ zoomFactor WRITE setZoomFactor NOTIFY zoomFactorChanged)
-    Q_PROPERTY(QString status READ status NOTIFY statusChanged)
+    Q_PROPERTY(qreal zoomFactor READ zoomFactor WRITE setZoomFactor)
 
-    Q_PROPERTY(QString html READ toHtml WRITE setHtml)
     Q_PROPERTY(QUrl url READ url WRITE setUrl NOTIFY urlChanged)
-    Q_PROPERTY(qreal progress READ progress NOTIFY progressChanged)
 
-    Q_PROPERTY(bool interactive READ isInteractive WRITE setInteractive NOTIFY interactivityChanged)
+    Q_PROPERTY(bool modified READ isModified)
 
 public:
-    QGraphicsWebView(QGraphicsItem* parent = 0);
+    explicit QGraphicsWebView(QGraphicsItem* parent = 0);
     ~QGraphicsWebView();
 
     QWebPage* page() const;
@@ -64,15 +62,11 @@ public:
     qreal zoomFactor() const;
     void setZoomFactor(qreal);
 
-    bool isInteractive() const;
-    void setInteractive(bool);
-
-    qreal progress() const;
+    bool isModified() const;
 
     void load(const QUrl &url);
     void load(const QNetworkRequest& request, QNetworkAccessManager::Operation operation = QNetworkAccessManager::GetOperation, const QByteArray& body = QByteArray());
 
-    QString toHtml() const;
     void setHtml(const QString& html, const QUrl& baseUrl = QUrl());
     // FIXME: Consider rename to setHtml?
     void setContent(const QByteArray& data, const QString& mimeType = QString(), const QUrl& baseUrl = QUrl());
@@ -80,7 +74,10 @@ public:
     QWebHistory* history() const;
     QWebSettings* settings() const;
 
-    QString status() const;
+    QAction* pageAction(QWebPage::WebAction action) const;
+    void triggerPageAction(QWebPage::WebAction action, bool checked = false);
+
+    bool findText(const QString& subString, QWebPage::FindFlags options = 0);
 
     virtual void setGeometry(const QRectF& rect);
     virtual void updateGeometry();
@@ -88,6 +85,10 @@ public:
     virtual QVariant itemChange(GraphicsItemChange change, const QVariant& value);
     virtual bool event(QEvent*);
 
+    virtual QSizeF sizeHint(Qt::SizeHint which, const QSizeF& constraint) const;
+
+    virtual QVariant inputMethodQuery(Qt::InputMethodQuery query) const;
+
 public Q_SLOTS:
     void stop();
     void back();
@@ -98,13 +99,12 @@ Q_SIGNALS:
     void loadStarted();
     void loadFinished(bool);
 
-    void progressChanged(qreal);
-    void interactivityChanged();
+    void loadProgress(int progress);
     void urlChanged(const QUrl&);
     void titleChanged(const QString&);
     void iconChanged();
-    void statusChanged();
-    void zoomFactorChanged();
+    void statusBarMessage(const QString& message);
+    void linkClicked(const QUrl&);
 
 protected:
     virtual void mousePressEvent(QGraphicsSceneMouseEvent*);
@@ -133,9 +133,7 @@ protected:
     virtual bool sceneEvent(QEvent*);
 
 private:
-    Q_PRIVATE_SLOT(d, void _q_doLoadProgress(int progress))
     Q_PRIVATE_SLOT(d, void _q_doLoadFinished(bool success))
-    Q_PRIVATE_SLOT(d, void _q_setStatusBarMessage(const QString& message))
 
     QGraphicsWebViewPrivate* const d;
     friend class QGraphicsWebViewPrivate;
diff --git a/WebKit/qt/Api/qwebelement.cpp b/WebKit/qt/Api/qwebelement.cpp
index 6305d10..441bec7 100644
--- a/WebKit/qt/Api/qwebelement.cpp
+++ b/WebKit/qt/Api/qwebelement.cpp
@@ -99,6 +99,14 @@ public:
     It is possible to replace the contents of child elements using
     setPlainText() and setInnerXml(). To replace the element itself and its
     contents, use setOuterXml().
+
+    \section1 Examples
+
+    The \l{DOM Traversal Example} shows one way to traverse documents in a running
+    example.
+
+    The \l{Simple Selector Example} can be used to experiment with the searching
+    features of this class and provides sample code you can start working with.
 */
 
 /*!
@@ -195,8 +203,7 @@ bool QWebElement::isNull() const
     \a selectorQuery. If there are no matching elements, an empty list is
     returned.
 
-    \l{http://www.w3.org/TR/REC-CSS2/selector.html#q1}{Standard CSS2 selector}
-    syntax is used for the query.
+    \l{Standard CSS2 selector} syntax is used for the query.
 
     \note This search is performed recursively.
 
@@ -211,8 +218,7 @@ QWebElementCollection QWebElement::findAll(const QString &selectorQuery) const
     Returns the first child element that matches the given CSS selector
     \a selectorQuery.
 
-    \l{http://www.w3.org/TR/REC-CSS2/selector.html#q1}{Standard CSS2 selector}
-    syntax is used for the query.
+    \l{Standard CSS2 selector} syntax is used for the query.
 
     \note This search is performed recursively.
 
@@ -453,6 +459,30 @@ bool QWebElement::hasAttributes() const
 }
 
 /*!
+    Return the list of attributes for the namespace given as \a namespaceUri.
+
+    \sa attribute(), setAttribute()
+*/
+QStringList QWebElement::attributeNames(const QString& namespaceUri) const
+{
+    if (!m_element)
+        return QStringList();
+
+    QStringList attributeNameList;
+    const NamedNodeMap* const attrs = m_element->attributes(/* read only = */ true);
+    if (attrs) {
+        const String namespaceUriString(namespaceUri); // convert QString -> String once
+        const unsigned attrsCount = attrs->length();
+        for (unsigned i = 0; i < attrsCount; ++i) {
+            const Attribute* const attribute = attrs->attributeItem(i);
+            if (namespaceUriString == attribute->namespaceURI())
+                attributeNameList.append(attribute->localName());
+        }
+    }
+    return attributeNameList;
+}
+
+/*!
     Returns true if the element has keyboard input focus; otherwise, returns false
 
     \sa setFocus()
@@ -1661,22 +1691,6 @@ QList<QWebElement> QWebElementCollection::toList() const
     QWebElementCollection provides STL style const iterators for fast low-level access to the elements.
 
     QWebElementCollection::const_iterator allows you to iterate over a QWebElementCollection.
-
-    The default QWebElementCollection::const_iterator constructors creates an uninitialized iterator. You must initialize
-    it using a QWebElementCollection function like QWebElementCollection::begin() or QWebElementCollection::end() before you
-    can start iterating.
-*/
-
-/*!
-    \fn QWebElementCollection::const_iterator::const_iterator()
-
-    Constructs an uninitialized iterator.
-
-    Functions like operator*() and operator++() should not be called on
-    an uninitialized iterator. Use operator=() to assign a value
-    to it before using it.
-
-    \sa QWebElementCollection::begin()
 */
 
 /*!
@@ -1824,3 +1838,193 @@ QList<QWebElement> QWebElementCollection::toList() const
     Returns true if the element pointed to by this iterator is greater than or equal to the
     element pointed to by the \a other iterator.
 */
+
+/*!
+    \fn QWebElementCollection::iterator QWebElementCollection::begin()
+
+    Returns an STL-style iterator pointing to the first element in the collection.
+
+    \sa end()
+*/
+
+/*!
+    \fn QWebElementCollection::iterator QWebElementCollection::end()
+
+    Returns an STL-style iterator pointing to the imaginary element after the
+    last element in the list.
+
+    \sa begin()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::constBegin() const
+
+    Returns an STL-style iterator pointing to the first element in the collection.
+
+    \sa end()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::constEnd() const
+
+    Returns an STL-style iterator pointing to the imaginary element after the
+    last element in the list.
+
+    \sa begin()
+*/
+
+/*!
+    \class QWebElementCollection::iterator
+    \since 4.6
+    \brief The QWebElementCollection::iterator class provides an STL-style iterator for QWebElementCollection.
+
+    QWebElementCollection provides STL style iterators for fast low-level access to the elements.
+
+    QWebElementCollection::iterator allows you to iterate over a QWebElementCollection.
+*/
+
+/*!
+    \fn QWebElementCollection::iterator::iterator(const iterator &other)
+
+    Constructs a copy of \a other.
+*/
+
+/*!
+    \fn QWebElementCollection::iterator::iterator(const QWebElementCollection *collection, int index)
+    \internal
+*/
+
+/*!
+    \fn const QWebElement QWebElementCollection::iterator::operator*() const
+
+    Returns the current element.
+*/
+
+/*!
+    \fn bool QWebElementCollection::iterator::operator==(const iterator &other) const
+
+    Returns true if \a other points to the same item as this iterator;
+    otherwise returns false.
+
+    \sa operator!=()
+*/
+
+/*!
+    \fn bool QWebElementCollection::iterator::operator!=(const iterator &other) const
+
+    Returns true if \a other points to a different element than this;
+    iterator; otherwise returns false.
+
+    \sa operator==()
+*/
+
+/*!
+    \fn QWebElementCollection::iterator &QWebElementCollection::iterator::operator++()
+
+    The prefix ++ operator (\c{++it}) advances the iterator to the next element in the collection
+    and returns an iterator to the new current element.
+
+    Calling this function on QWebElementCollection::end() leads to undefined results.
+
+    \sa operator--()
+*/
+
+/*!
+    \fn QWebElementCollection::iterator QWebElementCollection::iterator::operator++(int)
+
+    \overload
+
+    The postfix ++ operator (\c{it++}) advances the iterator to the next element in the collection
+    and returns an iterator to the previously current element.
+
+    Calling this function on QWebElementCollection::end() leads to undefined results.
+*/
+
+/*!
+    \fn QWebElementCollection::iterator &QWebElementCollection::iterator::operator--()
+
+    The prefix -- operator (\c{--it}) makes the preceding element current and returns an
+    iterator to the new current element.
+
+    Calling this function on QWebElementCollection::begin() leads to undefined results.
+
+    \sa operator++()
+*/
+
+/*!
+    \fn QWebElementCollection::iterator QWebElementCollection::iterator::operator--(int)
+
+    \overload
+
+    The postfix -- operator (\c{it--}) makes the preceding element current and returns
+    an iterator to the previously current element.
+*/
+
+/*!
+    \fn QWebElementCollection::iterator &QWebElementCollection::iterator::operator+=(int j)
+
+    Advances the iterator by \a j elements. If \a j is negative, the iterator goes backward.
+
+    \sa operator-=(), operator+()
+*/
+
+/*!
+    \fn QWebElementCollection::iterator &QWebElementCollection::iterator::operator-=(int j)
+
+    Makes the iterator go back by \a j elements. If \a j is negative, the iterator goes forward.
+
+    \sa operator+=(), operator-()
+*/
+
+/*!
+    \fn QWebElementCollection::iterator QWebElementCollection::iterator::operator+(int j) const
+
+    Returns an iterator to the element at \a j positions forward from this iterator. If \a j
+    is negative, the iterator goes backward.
+
+    \sa operator-(), operator+=()
+*/
+
+/*!
+    \fn QWebElementCollection::iterator QWebElementCollection::iterator::operator-(int j) const
+
+    Returns an iterator to the element at \a j positiosn backward from this iterator.
+    If \a j is negative, the iterator goes forward.
+
+    \sa operator+(), operator-=()
+*/
+
+/*!
+    \fn int QWebElementCollection::iterator::operator-(iterator other) const
+
+    Returns the number of elements between the item point to by \a other
+    and the element pointed to by this iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::iterator::operator<(const iterator &other) const
+
+    Returns true if the element pointed to by this iterator is less than the element pointed to
+    by the \a other iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::iterator::operator<=(const iterator &other) const
+
+    Returns true if the element pointed to by this iterator is less than or equal to the
+    element pointed to by the \a other iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::iterator::operator>(const iterator &other) const
+
+    Returns true if the element pointed to by this iterator is greater than the element pointed to
+    by the \a other iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::iterator::operator>=(const iterator &other) const
+
+    Returns true if the element pointed to by this iterator is greater than or equal to the
+    element pointed to by the \a other iterator.
+*/
diff --git a/WebKit/qt/Api/qwebelement.h b/WebKit/qt/Api/qwebelement.h
index a18d262..3833070 100644
--- a/WebKit/qt/Api/qwebelement.h
+++ b/WebKit/qt/Api/qwebelement.h
@@ -21,6 +21,7 @@
 #define QWEBELEMENT_H
 
 #include <QString>
+#include <QStringList>
 #include <QRect>
 #include <QVariant>
 #include <QExplicitlySharedDataPointer>
@@ -72,6 +73,7 @@ public:
     void removeAttribute(const QString& name);
     void removeAttributeNS(const QString& namespaceUri, const QString& name);
     bool hasAttributes() const;
+    QStringList attributeNames(const QString& namespaceUri = QString()) const;
 
     QStringList classes() const;
     bool hasClass(const QString& name) const;
@@ -177,6 +179,7 @@ public:
 
     int count() const;
     QWebElement at(int i) const;
+    inline QWebElement operator[](int i) const { return at(i); }
 
     inline QWebElement first() const { return at(0); }
     inline QWebElement last() const { return at(count() - 1); }
@@ -185,39 +188,69 @@ public:
 
     class const_iterator {
        public:
-           int i;
-           const QWebElementCollection *s;
-
-           inline const_iterator(const QWebElementCollection *collection, int index) : i(index), s(collection) {}
-           inline const_iterator(const const_iterator &o) : i(o.i), s(o.s) {}
+           inline const_iterator(const QWebElementCollection* collection, int index) : i(index), collection(collection) {}
+           inline const_iterator(const const_iterator& o) : i(o.i), collection(o.collection) {}
 
-           inline const QWebElement operator*() const { return s->at(i); }
+           inline const QWebElement operator*() const { return collection->at(i); }
 
-           inline bool operator==(const const_iterator& o) const { return i == o.i && s == o.s; }
-           inline bool operator!=(const const_iterator& o) const { return i != o.i || s != o.s; }
+           inline bool operator==(const const_iterator& o) const { return i == o.i && collection == o.collection; }
+           inline bool operator!=(const const_iterator& o) const { return i != o.i || collection != o.collection; }
            inline bool operator<(const const_iterator& o) const { return i < o.i; }
            inline bool operator<=(const const_iterator& o) const { return i <= o.i; }
            inline bool operator>(const const_iterator& o) const { return i > o.i; }
            inline bool operator>=(const const_iterator& o) const { return i >= o.i; }
 
-           inline const_iterator &operator++() { ++i; return *this; }
-           inline const_iterator operator++(int) { const_iterator n(s, i); ++i; return n; }
-           inline const_iterator &operator--() { i--; return *this; }
-           inline const_iterator operator--(int) { const_iterator n(s, i); i--; return n; }
-           inline const_iterator &operator+=(int j) { i += j; return *this; }
-           inline const_iterator &operator-=(int j) { i -= j; return *this; }
-           inline const_iterator operator+(int j) const { return const_iterator(s, i + j); }
-           inline const_iterator operator-(int j) const { return const_iterator(s, i - j); }
+           inline const_iterator& operator++() { ++i; return *this; }
+           inline const_iterator operator++(int) { const_iterator n(collection, i); ++i; return n; }
+           inline const_iterator& operator--() { i--; return *this; }
+           inline const_iterator operator--(int) { const_iterator n(collection, i); i--; return n; }
+           inline const_iterator& operator+=(int j) { i += j; return *this; }
+           inline const_iterator& operator-=(int j) { i -= j; return *this; }
+           inline const_iterator operator+(int j) const { return const_iterator(collection, i + j); }
+           inline const_iterator operator-(int j) const { return const_iterator(collection, i - j); }
            inline int operator-(const_iterator j) const { return i - j.i; }
        private:
-            inline const_iterator() : i(0), s(0) {}
+            int i;
+            const QWebElementCollection* const collection;
     };
     friend class const_iterator;
 
-    inline const_iterator begin() const { return const_iterator(this, 0); }
-    inline const_iterator end() const { return const_iterator(this, count()); }
-    inline QWebElement operator[](int i) const { return at(i); }
+    inline const_iterator begin() const { return constBegin(); }
+    inline const_iterator end() const { return constEnd(); }
+    inline const_iterator constBegin() const { return const_iterator(this, 0); }
+    inline const_iterator constEnd() const { return const_iterator(this, count()); };
+
+    class iterator {
+    public:
+        inline iterator(const QWebElementCollection* collection, int index) : i(index), collection(collection) {}
+        inline iterator(const iterator& o) : i(o.i), collection(o.collection) {}
+
+        inline QWebElement operator*() const { return collection->at(i); }
+
+        inline bool operator==(const iterator& o) const { return i == o.i && collection == o.collection; }
+        inline bool operator!=(const iterator& o) const { return i != o.i || collection != o.collection; }
+        inline bool operator<(const iterator& o) const { return i < o.i; }
+        inline bool operator<=(const iterator& o) const { return i <= o.i; }
+        inline bool operator>(const iterator& o) const { return i > o.i; }
+        inline bool operator>=(const iterator& o) const { return i >= o.i; }
+
+        inline iterator& operator++() { ++i; return *this; }
+        inline iterator operator++(int) { iterator n(collection, i); ++i; return n; }
+        inline iterator& operator--() { i--; return *this; }
+        inline iterator operator--(int) { iterator n(collection, i); i--; return n; }
+        inline iterator& operator+=(int j) { i += j; return *this; }
+        inline iterator& operator-=(int j) { i -= j; return *this; }
+        inline iterator operator+(int j) const { return iterator(collection, i + j); }
+        inline iterator operator-(int j) const { return iterator(collection, i - j); }
+        inline int operator-(iterator j) const { return i - j.i; }
+    private:
+        int i;
+        const QWebElementCollection* const collection;
+    };
+    friend class iterator;
 
+    inline iterator begin() { return iterator(this, 0); }
+    inline iterator end()  { return iterator(this, count()); }
 private:
     QExplicitlySharedDataPointer<QWebElementCollectionPrivate> d;
 };
diff --git a/WebKit/qt/Api/qwebframe.cpp b/WebKit/qt/Api/qwebframe.cpp
index 606dae4..ef97c3b 100644
--- a/WebKit/qt/Api/qwebframe.cpp
+++ b/WebKit/qt/Api/qwebframe.cpp
@@ -56,6 +56,7 @@
 #include "Scrollbar.h"
 #include "SelectionController.h"
 #include "SubstituteData.h"
+#include "SVGSMILElement.h"
 #include "htmlediting.h"
 #include "markup.h"
 #include "qt_instance.h"
@@ -77,14 +78,7 @@
 #include <qpainter.h>
 #include <qprinter.h>
 #include <qregion.h>
-
-#if QT_VERSION < 0x040400
-#include "qwebnetworkinterface.h"
-#endif
-
-#if QT_VERSION >= 0x040400
 #include <qnetworkrequest.h>
-#endif
 
 using namespace WebCore;
 
@@ -93,6 +87,11 @@ QT_BEGIN_NAMESPACE
 extern Q_GUI_EXPORT int qt_defaultDpi();
 QT_END_NAMESPACE
 
+bool QWEBKIT_EXPORT qt_drt_hasDocumentElement(QWebFrame* qframe)
+{
+    return QWebFramePrivate::core(qframe)->document()->documentElement();
+}
+
 void QWEBKIT_EXPORT qt_drt_setJavaScriptProfilingEnabled(QWebFrame* qframe, bool enabled)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -150,6 +149,31 @@ bool QWEBKIT_EXPORT qt_drt_pauseTransitionOfProperty(QWebFrame *qframe, const QS
     return controller->pauseTransitionAtTime(coreNode->renderer(), propertyName, time);
 }
 
+// Pause a given SVG animation on the target node at a specific time.
+// This method is only intended to be used for testing the SVG animation system.
+bool QWEBKIT_EXPORT qt_drt_pauseSVGAnimation(QWebFrame *qframe, const QString &animationId, double time, const QString &elementId)
+{
+#if !ENABLE(SVG)
+    return false;
+#else
+    Frame* frame = QWebFramePrivate::core(qframe);
+    if (!frame)
+        return false;
+
+    Document* doc = frame->document();
+    Q_ASSERT(doc);
+
+    if (!doc->svgExtensions())
+        return false;
+
+    Node* coreNode = doc->getElementById(animationId);
+    if (!coreNode || !SVGSMILElement::isSMILElement(coreNode))
+        return false;
+
+    return doc->accessSVGExtensions()->sampleAnimationAtTime(elementId, static_cast<SVGSMILElement*>(coreNode), time);
+#endif
+}
+
 // Returns the total number of currently running animations (includes both CSS transitions and CSS animations).
 int QWEBKIT_EXPORT qt_drt_numberOfActiveAnimations(QWebFrame *qframe)
 {
@@ -243,7 +267,7 @@ WebCore::Scrollbar* QWebFramePrivate::verticalScrollBar() const
     return frame->view()->verticalScrollbar();
 }
 
-void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer layer, const QRegion &clip)
+void QWebFramePrivate::renderContentsLayerAbsoluteCoords(GraphicsContext* context, const QRegion& clip)
 {
     if (!frame->view() || !frame->contentRenderer())
         return;
@@ -252,15 +276,42 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer l
     if (vector.isEmpty())
         return;
 
-    GraphicsContext context(painter);
-    if (context.paintingDisabled() && !context.updatingControlTints())
+    QPainter* painter = context->platformContext();
+
+    WebCore::FrameView* view = frame->view();
+    view->layoutIfNeededRecursive();
+
+    for (int i = 0; i < vector.size(); ++i) {
+        const QRect& clipRect = vector.at(i);
+
+        painter->save();
+        painter->setClipRect(clipRect, Qt::IntersectClip);
+
+        context->save();
+        view->paintContents(context, clipRect);
+        context->restore();
+
+        painter->restore();
+    }
+}
+
+void QWebFramePrivate::renderRelativeCoords(GraphicsContext* context, QWebFrame::RenderLayer layer, const QRegion& clip)
+{
+    if (!frame->view() || !frame->contentRenderer())
         return;
 
+    QVector<QRect> vector = clip.rects();
+    if (vector.isEmpty())
+        return;
+
+    QPainter* painter = context->platformContext();
+
     WebCore::FrameView* view = frame->view();
     view->layoutIfNeededRecursive();
 
     for (int i = 0; i < vector.size(); ++i) {
         const QRect& clipRect = vector.at(i);
+
         QRect intersectedRect = clipRect.intersected(view->frameRect());
 
         painter->save();
@@ -270,39 +321,41 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer l
         int y = view->y();
 
         if (layer & QWebFrame::ContentsLayer) {
-            context.save();
+            context->save();
 
             int scrollX = view->scrollX();
             int scrollY = view->scrollY();
 
             QRect rect = intersectedRect;
-            context.translate(x, y);
+            context->translate(x, y);
             rect.translate(-x, -y);
-            context.translate(-scrollX, -scrollY);
+            context->translate(-scrollX, -scrollY);
             rect.translate(scrollX, scrollY);
-            context.clip(view->visibleContentRect());
+            context->clip(view->visibleContentRect());
 
-            view->paintContents(&context, rect);
+            view->paintContents(context, rect);
 
-            context.restore();
+            context->restore();
         }
 
         if (layer & QWebFrame::ScrollBarLayer
             && !view->scrollbarsSuppressed()
             && (view->horizontalScrollbar() || view->verticalScrollbar())) {
-            context.save();
+            context->save();
 
             QRect rect = intersectedRect;
-            context.translate(x, y);
+            context->translate(x, y);
             rect.translate(-x, -y);
 
-            view->paintScrollbars(&context, rect);
+            view->paintScrollbars(context, rect);
 
-            context.restore();
+            context->restore();
         }
 
+#if ENABLE(PAN_SCROLLING)
         if (layer & QWebFrame::PanIconLayer)
-            view->paintPanScrollIcon(&context);
+            view->paintPanScrollIcon(context);
+#endif
 
         painter->restore();
     }
@@ -324,7 +377,7 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer l
     the HTML content readily available, you can use setHtml() instead.
 
     The page() function returns a pointer to the web page object. See
-    \l{Elements of QWebView} for an explanation of how web
+    \l{QWebView}{Elements of QWebView} for an explanation of how web
     frames are related to a web page and web view.
 
     The QWebFrame class also offers methods to retrieve both the URL currently
@@ -356,6 +409,19 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer l
     \sa QWebPage
 */
 
+/*!
+    \enum QWebFrame::RenderLayer
+
+    This enum describes the layers available for rendering using \l{QWebFrame::}{render()}.
+    The layers can be OR-ed together from the following list:
+
+    \value ContentsLayer The web content of the frame
+    \value ScrollBarLayer The scrollbars of the frame
+    \value PanIconLayer The icon used when panning the frame
+
+    \value AllLayers Includes all the above layers
+*/
+
 QWebFrame::QWebFrame(QWebPage *parent, QWebFrameData *frameData)
     : QObject(parent)
     , d(new QWebFramePrivate)
@@ -471,7 +537,9 @@ QString QWebFrame::toPlainText() const
         d->frame->view()->layout();
 
     Element *documentElement = d->frame->document()->documentElement();
-    return documentElement->innerText();
+    if (documentElement)
+        return documentElement->innerText();
+    return QString();
 }
 
 /*!
@@ -483,7 +551,7 @@ QString QWebFrame::renderTreeDump() const
     if (d->frame->view() && d->frame->view()->layoutPending())
         d->frame->view()->layout();
 
-    return externalRepresentation(d->frame->contentRenderer());
+    return externalRepresentation(d->frame);
 }
 
 /*!
@@ -655,51 +723,9 @@ QWebPage *QWebFrame::page() const
 */
 void QWebFrame::load(const QUrl &url)
 {
-#if QT_VERSION < 0x040400
-    load(QWebNetworkRequest(ensureAbsoluteUrl(url)));
-#else
     load(QNetworkRequest(ensureAbsoluteUrl(url)));
-#endif
-}
-
-#if QT_VERSION < 0x040400
-/*!
-  Loads a network request, \a req, into this frame.
-
-  \note The view remains the same until enough data has arrived to display the new url.
-*/
-void QWebFrame::load(const QWebNetworkRequest &req)
-{
-    if (d->parentFrame())
-        d->page->d->insideOpenCall = true;
-
-    QUrl url = ensureAbsoluteUrl(req.url());
-    QHttpRequestHeader httpHeader = req.httpHeader();
-    QByteArray postData = req.postData();
-
-    WebCore::ResourceRequest request(url);
-
-    QString method = httpHeader.method();
-    if (!method.isEmpty())
-        request.setHTTPMethod(method);
-
-    QList<QPair<QString, QString> > values = httpHeader.values();
-    for (int i = 0; i < values.size(); ++i) {
-        const QPair<QString, QString> &val = values.at(i);
-        request.addHTTPHeaderField(val.first, val.second);
-    }
-
-    if (!postData.isEmpty())
-        request.setHTTPBody(WebCore::FormData::create(postData.constData(), postData.size()));
-
-    d->frame->loader()->load(request, false);
-
-    if (d->parentFrame())
-        d->page->d->insideOpenCall = false;
 }
 
-#else
-
 /*!
   Loads a network request, \a req, into this frame, using the method specified in \a
   operation.
@@ -734,6 +760,11 @@ void QWebFrame::load(const QNetworkRequest &req,
         case QNetworkAccessManager::PostOperation:
             request.setHTTPMethod("POST");
             break;
+#if QT_VERSION >= 0x040600
+        case QNetworkAccessManager::DeleteOperation:
+            request.setHTTPMethod("DELETE");
+            break;
+#endif
         case QNetworkAccessManager::UnknownOperation:
             // eh?
             break;
@@ -753,7 +784,6 @@ void QWebFrame::load(const QNetworkRequest &req,
     if (d->parentFrame())
         d->page->d->insideOpenCall = false;
 }
-#endif
 
 /*!
   Sets the content of this frame to \a html. \a baseUrl is optional and used to resolve relative
@@ -862,11 +892,13 @@ void QWebFrame::setScrollBarPolicy(Qt::Orientation orientation, Qt::ScrollBarPol
         d->horizontalScrollBarPolicy = policy;
         if (d->frame->view()) {
             d->frame->view()->setHorizontalScrollbarMode((ScrollbarMode)policy);
+            d->frame->view()->updateCanHaveScrollbars();
         }
     } else {
         d->verticalScrollBarPolicy = policy;
         if (d->frame->view()) {
             d->frame->view()->setVerticalScrollbarMode((ScrollbarMode)policy);
+            d->frame->view()->updateCanHaveScrollbars();
         }
     }
 }
@@ -999,29 +1031,41 @@ void QWebFrame::setScrollPosition(const QPoint &pos)
 
 void QWebFrame::render(QPainter* painter, RenderLayer layer, const QRegion& clip)
 {
+    GraphicsContext context(painter);
+    if (context.paintingDisabled() && !context.updatingControlTints())
+        return;
+
     if (!clip.isEmpty())
-        d->renderPrivate(painter, layer, clip);
+        d->renderRelativeCoords(&context, layer, clip);
     else if (d->frame->view())
-        d->renderPrivate(painter, layer, QRegion(d->frame->view()->frameRect()));
+        d->renderRelativeCoords(&context, layer, QRegion(d->frame->view()->frameRect()));
 }
 
 /*!
   Render the frame into \a painter clipping to \a clip.
 */
-void QWebFrame::render(QPainter *painter, const QRegion &clip)
+void QWebFrame::render(QPainter* painter, const QRegion& clip)
 {
-    d->renderPrivate(painter, AllLayers, clip);
+    GraphicsContext context(painter);
+    if (context.paintingDisabled() && !context.updatingControlTints())
+        return;
+
+    d->renderRelativeCoords(&context, AllLayers, clip);
 }
 
 /*!
   Render the frame into \a painter.
 */
-void QWebFrame::render(QPainter *painter)
+void QWebFrame::render(QPainter* painter)
 {
     if (!d->frame->view())
         return;
 
-    d->renderPrivate(painter, AllLayers, QRegion(d->frame->view()->frameRect()));
+    GraphicsContext context(painter);
+    if (context.paintingDisabled() && !context.updatingControlTints())
+        return;
+
+    d->renderRelativeCoords(&context, AllLayers, QRegion(d->frame->view()->frameRect()));
 }
 
 /*!
diff --git a/WebKit/qt/Api/qwebframe.h b/WebKit/qt/Api/qwebframe.h
index 08285f8..c2a6e9b 100644
--- a/WebKit/qt/Api/qwebframe.h
+++ b/WebKit/qt/Api/qwebframe.h
@@ -26,9 +26,7 @@
 #include <QtCore/qvariant.h>
 #include <QtGui/qicon.h>
 #include <QtScript/qscriptengine.h>
-#if QT_VERSION >= 0x040400
 #include <QtNetwork/qnetworkaccessmanager.h>
-#endif
 #include "qwebkitglobal.h"
 
 QT_BEGIN_NAMESPACE
@@ -123,13 +121,9 @@ public:
     QWebPage *page() const;
 
     void load(const QUrl &url);
-#if QT_VERSION < 0x040400
-    void load(const QWebNetworkRequest &request);
-#else
     void load(const QNetworkRequest &request,
               QNetworkAccessManager::Operation operation = QNetworkAccessManager::GetOperation,
               const QByteArray &body = QByteArray());
-#endif
     void setHtml(const QString &html, const QUrl &baseUrl = QUrl());
     void setContent(const QByteArray &data, const QString &mimeType = QString(), const QUrl &baseUrl = QUrl());
 
diff --git a/WebKit/qt/Api/qwebframe_p.h b/WebKit/qt/Api/qwebframe_p.h
index 081e65d..045c70e 100644
--- a/WebKit/qt/Api/qwebframe_p.h
+++ b/WebKit/qt/Api/qwebframe_p.h
@@ -25,6 +25,7 @@
 #include "qwebpage_p.h"
 
 #include "EventHandler.h"
+#include "GraphicsContext.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "qwebelement.h"
@@ -81,7 +82,8 @@ public:
     static WebCore::Frame* core(QWebFrame*);
     static QWebFrame* kit(WebCore::Frame*);
 
-    void renderPrivate(QPainter*, QWebFrame::RenderLayer, const QRegion& clip);
+    void renderRelativeCoords(WebCore::GraphicsContext*, QWebFrame::RenderLayer, const QRegion& clip);
+    void renderContentsLayerAbsoluteCoords(WebCore::GraphicsContext*, const QRegion& clip);
 
     QWebFrame *q;
     Qt::ScrollBarPolicy horizontalScrollBarPolicy;
diff --git a/WebKit/qt/Api/qwebhistory.cpp b/WebKit/qt/Api/qwebhistory.cpp
index f765daa..d852012 100644
--- a/WebKit/qt/Api/qwebhistory.cpp
+++ b/WebKit/qt/Api/qwebhistory.cpp
@@ -494,22 +494,16 @@ QDataStream& operator<<(QDataStream& target, const QWebHistory& history)
 {
     QWebHistoryPrivate* d = history.d;
 
-    QByteArray buffer;
-    QDataStream stream(&buffer, QIODevice::WriteOnly);
-
     int version = DefaultHistoryVersion;
 
-    stream << version;
-    stream << history.count() << history.currentItemIndex();
+    target << version;
+    target << history.count() << history.currentItemIndex();
 
     const WebCore::HistoryItemVector &items = d->lst->entries();
     for (unsigned i = 0; i < items.size(); i++)
-        items[i].get()->saveState(stream, version);
-
-    if (stream.status() != QDataStream::Ok)
-        buffer = QByteArray();  // make buffer isNull()==true and isEmpty()==true
+        items[i].get()->saveState(target, version);
 
-    return target << buffer;
+    return target;
 }
 
 /*!
@@ -526,18 +520,14 @@ QDataStream& operator>>(QDataStream& source, QWebHistory& history)
 {
     QWebHistoryPrivate* d = history.d;
 
-    QByteArray buffer;
-    source >> buffer;
-
-    QDataStream stream(buffer);
     int version;
 
-    stream >> version;
+    source >> version;
 
     if (version == 1) {
         int count;
         int currentIndex;
-        stream >> count >> currentIndex;
+        source >> count >> currentIndex;
 
         history.clear();
         // only if there are elements
@@ -546,7 +536,7 @@ QDataStream& operator>>(QDataStream& source, QWebHistory& history)
             WebCore::HistoryItem* nullItem = d->lst->currentItem();
             for (int i = 0; i < count; i++) {
                 WTF::PassRefPtr<WebCore::HistoryItem> item = WebCore::HistoryItem::create();
-                item->restoreState(stream, version);
+                item->restoreState(source, version);
                 d->lst->addItem(item);
             }
             d->lst->removeItem(nullItem);
diff --git a/WebKit/qt/Api/qwebinspector.cpp b/WebKit/qt/Api/qwebinspector.cpp
index 4578dc9..f43cbbf 100644
--- a/WebKit/qt/Api/qwebinspector.cpp
+++ b/WebKit/qt/Api/qwebinspector.cpp
@@ -50,6 +50,7 @@
 
     \section1 Resources
 
+    This class acts mostly as a container and a controller for the inspector.
     Most of the resources needed by the inspector are owned by the associated
     QWebPage and are allocated the first time that:
     \list
@@ -57,11 +58,6 @@
         \o the QWebInspector is shown.
     \endlist
 
-    This class acts mostly as a container and a controller for the inspector.
-    You can defer the creation and association of the QWebInspector until
-    the first emission of QWebPage::webInspectorTriggered() to save additional
-    resources.
-
     \section1 Inspector configuration persistence
 
     The inspector allows the user to configure some options through its
@@ -188,9 +184,3 @@ void QWebInspectorPrivate::adjustFrontendSize(const QSize& size)
         frontend->resize(size);
 }
 
-/*!
-    \fn void QWebInspector::windowTitleChanged(const QString& newTitle);
-
-    This is emitted to signal that this widget's title changed to \a newTitle.
-*/
-
diff --git a/WebKit/qt/Api/qwebinspector.h b/WebKit/qt/Api/qwebinspector.h
index bb5bd64..a5c1ed5 100644
--- a/WebKit/qt/Api/qwebinspector.h
+++ b/WebKit/qt/Api/qwebinspector.h
@@ -39,9 +39,6 @@ public:
     QSize sizeHint() const;
     bool event(QEvent*);
 
-Q_SIGNALS:
-    void windowTitleChanged(const QString& newTitle);
-
 protected:
     void resizeEvent(QResizeEvent* event);
     void showEvent(QShowEvent* event);
diff --git a/WebKit/qt/Api/qwebkitglobal.h b/WebKit/qt/Api/qwebkitglobal.h
index 0885bdc..9e8979f 100644
--- a/WebKit/qt/Api/qwebkitglobal.h
+++ b/WebKit/qt/Api/qwebkitglobal.h
@@ -40,15 +40,4 @@
 #  endif
 #endif
 
-#if QT_VERSION < 0x040400
-    #ifndef QT_BEGIN_NAMESPACE
-    #define QT_BEGIN_NAMESPACE
-    #endif
-
-    #ifndef QT_END_NAMESPACE
-    #define QT_END_NAMESPACE
-    #endif
-#endif
-
-
 #endif // QWEBKITGLOBAL_H
diff --git a/WebKit/qt/Api/qwebnetworkinterface.cpp b/WebKit/qt/Api/qwebnetworkinterface.cpp
deleted file mode 100644
index cf99183..0000000
--- a/WebKit/qt/Api/qwebnetworkinterface.cpp
+++ /dev/null
@@ -1,1315 +0,0 @@
-/*
-    Copyright (C) 2006 Enrico Ros <enrico.ros@m31engineering.it>
-    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
-    Copyright (C) 2007 Staikos Computing Services Inc.  <info@staikos.net>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include <qglobal.h>
-#if QT_VERSION < 0x040400
-#include "qwebframe.h"
-#include "qwebnetworkinterface.h"
-#include "qwebnetworkinterface_p.h"
-#include "qwebpage.h"
-#include "qcookiejar.h"
-#include <qdebug.h>
-#include <qfile.h>
-#include <qnetworkproxy.h>
-#include <qurl.h>
-#include <QAuthenticator>
-#include <QCoreApplication>
-#include <QSslError>
-
-#include "ResourceHandle.h"
-#include "ResourceHandleClient.h"
-#include "ResourceHandleInternal.h"
-#include "MIMETypeRegistry.h"
-#include "CookieJar.h"
-
-#if 0
-#define DEBUG qDebug
-#else
-#define DEBUG if (1) {} else qDebug
-#endif
-
-static QWebNetworkInterface *s_default_interface = 0;
-static QWebNetworkManager *s_manager = 0;
-
-using namespace WebCore;
-
-uint qHash(const HostInfo &info)
-{
-    return qHash(info.host) + info.port;
-}
-
-static bool operator==(const HostInfo &i1, const HostInfo &i2)
-{
-    return i1.port == i2.port && i1.host == i2.host;
-}
-
-enum ParserState {
-    State_Begin,
-    State_FirstChar,
-    State_SecondChar
-};
-
-/*
- * Decode URLs without doing any charset conversion.
- *
- * Most simple approach to do it without any lookahead.
- */
-static QByteArray decodePercentEncoding(const QByteArray& input)
-{
-    int actualLength = 0;
-    QByteArray tmpVal;
-    QByteArray output;
-    ParserState state = State_Begin;
-
-    output.resize(input.length());
-    tmpVal.resize(2);
-
-    for (int i = 0; i < input.length(); ++i)
-        if (state == State_Begin) {
-            if (input.at(i) == '%')
-                state = State_FirstChar;
-            else
-                output[actualLength++] = input[i];
-        } else if (state == State_FirstChar) {
-            state = State_SecondChar;
-            tmpVal[0] = input[i];
-        } else if (state == State_SecondChar) {
-            state = State_Begin;
-            tmpVal[1] = input[i];
-            output[actualLength++] = tmpVal.toShort(0, 16);
-        }
-
-    output.resize(actualLength);
-    return output;
-}
-
-void QWebNetworkRequestPrivate::init(const WebCore::ResourceRequest &resourceRequest)
-{
-    KURL url = resourceRequest.url();
-    QUrl qurl = QString(url.string());
-    init(resourceRequest.httpMethod(), qurl, &resourceRequest);
-}
-
-void QWebNetworkRequestPrivate::init(const QString& method, const QUrl& url, const WebCore::ResourceRequest* resourceRequest)
-{
-    httpHeader = QHttpRequestHeader(method, url.toString(QUrl::RemoveScheme|QUrl::RemoveAuthority));
-    httpHeader.setValue(QLatin1String("Connection"), QLatin1String("Keep-Alive"));
-    setURL(url);
-
-    if (resourceRequest) {
-        httpHeader.setValue(QLatin1String("User-Agent"), resourceRequest->httpUserAgent());
-        const QString scheme = url.scheme().toLower();
-        if (scheme == QLatin1String("http") || scheme == QLatin1String("https")) {
-            QString cookies = QCookieJar::cookieJar()->cookies(resourceRequest->url());
-            if (!cookies.isEmpty())
-                httpHeader.setValue(QLatin1String("Cookie"), cookies);
-        }
-
-
-        const HTTPHeaderMap& loaderHeaders = resourceRequest->httpHeaderFields();
-        HTTPHeaderMap::const_iterator end = loaderHeaders.end();
-        for (HTTPHeaderMap::const_iterator it = loaderHeaders.begin(); it != end; ++it)
-            httpHeader.setValue(it->first, it->second);
-
-        // handle and perform a 'POST' request
-        if (method == "POST") {
-            Vector<char> data;
-            resourceRequest->httpBody()->flatten(data);
-            postData = QByteArray(data.data(), data.size());
-            httpHeader.setValue(QLatin1String("content-length"), QString::number(postData.size()));
-        }
-    }
-}
-
-void QWebNetworkRequestPrivate::setURL(const QUrl& u)
-{
-    url = u;
-    int port = url.port();
-    const QString scheme = u.scheme();
-    if (port > 0 && (port != 80 || scheme != "http") && (port != 443 || scheme != "https"))
-        httpHeader.setValue(QLatin1String("Host"), url.host() + QLatin1Char(':') + QString::number(port));
-    else
-        httpHeader.setValue(QLatin1String("Host"), url.host());
-}
-
-/*!
-  \class QWebNetworkRequest
-  \internal
-
-  The QWebNetworkRequest class represents a request for data from the network with all the
-  necessary information needed for retrieval. This includes the url, extra HTTP header fields
-  as well as data for a HTTP POST request.
-*/
-
-QWebNetworkRequest::QWebNetworkRequest()
-    : d(new QWebNetworkRequestPrivate)
-{
-}
-
-QWebNetworkRequest::QWebNetworkRequest(const QUrl& url, Method method, const QByteArray& postData)
-    : d(new QWebNetworkRequestPrivate)
-{
-    d->init(method == Get ? "GET" : "POST", url);
-    d->postData = postData;
-}
-
-QWebNetworkRequest::QWebNetworkRequest(const QWebNetworkRequest &other)
-    : d(new QWebNetworkRequestPrivate(*other.d))
-{
-}
-
-QWebNetworkRequest &QWebNetworkRequest::operator=(const QWebNetworkRequest& other)
-{
-    *d = *other.d;
-    return *this;
-}
-
-/*!
-  \internal
-*/
-QWebNetworkRequest::QWebNetworkRequest(const QWebNetworkRequestPrivate& priv)
-    : d(new QWebNetworkRequestPrivate(priv))
-{
-}
-
-/*!
-  \internal
-*/
-QWebNetworkRequest::QWebNetworkRequest(const WebCore::ResourceRequest& request)
-    : d(new QWebNetworkRequestPrivate)
-{
-    d->init(request);
-}
-
-QWebNetworkRequest::~QWebNetworkRequest()
-{
-    delete d;
-}
-
-/*!
-  \internal
-  The requested URL
-*/
-QUrl QWebNetworkRequest::url() const
-{
-    return d->url;
-}
-
-/*!
-   \internal
-   Sets the URL to request.
-
-   Note that setting the URL also sets the "Host" field in the HTTP header.
-*/
-void QWebNetworkRequest::setUrl(const QUrl& url)
-{
-    d->setURL(url);
-}
-
-/*!
-   \internal
-   The http request header information.
-*/
-QHttpRequestHeader QWebNetworkRequest::httpHeader() const
-{
-    return d->httpHeader;
-}
-
-void QWebNetworkRequest::setHttpHeader(const QHttpRequestHeader& header) const
-{
-    d->httpHeader = header;
-}
-
-QString QWebNetworkRequest::httpHeaderField(const QString& key) const
-{
-    return d->httpHeader.value(key);
-}
-
-void QWebNetworkRequest::setHttpHeaderField(const QString& key, const QString& value)
-{
-    d->httpHeader.setValue(key, value);
-}
-
-/*!
-    \internal
-    Post data sent with HTTP POST requests.
-*/
-QByteArray QWebNetworkRequest::postData() const
-{
-    return d->postData;
-}
-
-void QWebNetworkRequest::setPostData(const QByteArray& data)
-{
-    d->postData = data;
-}
-
-/*!
-  \class QWebNetworkJob
-  \internal
-
-  The QWebNetworkJob class represents a network job, that needs to be
-  processed by the QWebNetworkInterface.
-
-  This class is only required when implementing a new network layer (or
-  support for a special protocol) using QWebNetworkInterface.
-
-  QWebNetworkJob objects are created and owned by the QtWebKit library.
-  Most of it's properties are read-only.
-
-  The job is reference counted. This can be used to ensure that the job doesn't
-  get deleted while it's still stored in some data structure.
-*/
-
-/*!
-  \internal
-*/
-QWebNetworkJob::QWebNetworkJob()
-    : d(new QWebNetworkJobPrivate)
-{
-}
-
-/*!
-  \internal
-*/
-QWebNetworkJob::~QWebNetworkJob()
-{
-    delete d;
-    d = 0;
-}
-
-/*!
-  \internal
-  The requested URL
-*/
-QUrl QWebNetworkJob::url() const
-{
-    return d->request.url;
-}
-
-/*!
-  \internal
-  Post data associated with the job
-*/
-QByteArray QWebNetworkJob::postData() const
-{
-    return d->request.postData;
-}
-
-/*!
-  \internal
-  The HTTP request header that should be used to download the job.
-*/
-QHttpRequestHeader QWebNetworkJob::httpHeader() const
-{
-    return d->request.httpHeader;
-}
-
-/*!
-  \internal
-  The complete network request that should be used to download the job.
-*/
-QWebNetworkRequest QWebNetworkJob::request() const
-{
-    return QWebNetworkRequest(d->request);
-}
-
-/*!
-  \internal
-  The HTTP response header received from the network.
-*/
-QHttpResponseHeader QWebNetworkJob::response() const
-{
-    return d->response;
-}
-
-/*!
-  \internal
-  The last error of the Job.
-*/
-QString QWebNetworkJob::errorString() const
-{
-    return d->errorString;
-}
-
-/*!
-  \internal
-  Sets the HTTP reponse header. The response header has to be called before
-  emitting QWebNetworkInterface::started.
-*/
-void QWebNetworkJob::setResponse(const QHttpResponseHeader& response)
-{
-    d->response = response;
-}
-
-void QWebNetworkJob::setErrorString(const QString& errorString)
-{
-    d->errorString = errorString;
-}
-
-/*!
-  \internal
-  returns true if the job has been cancelled by the WebKit framework
-*/
-bool QWebNetworkJob::cancelled() const
-{
-    return !d->resourceHandle;
-}
-
-/*!
-  \internal
-  reference the job.
-*/
-void QWebNetworkJob::ref()
-{
-    ++d->ref;
-}
-
-/*!
-  \internal
-  derefence the job.
-
-  If the reference count drops to 0 this method also deletes the job.
-
-  Returns false if the reference count has dropped to 0.
-*/
-bool QWebNetworkJob::deref()
-{
-    if (!--d->ref) {
-        delete this;
-        return false;
-    }
-    return true;
-}
-
-/*!
-   \internal
-   Returns the network interface that is associated with this job.
-*/
-QWebNetworkInterface *QWebNetworkJob::networkInterface() const
-{
-    return d->interface;
-}
-
-/*!
-   \internal
-   Returns the network interface that is associated with this job.
-*/
-QWebFrame *QWebNetworkJob::frame() const
-{
-    if (!d->resourceHandle) {
-        ResourceHandleInternal *rhi = d->resourceHandle->getInternal();
-        if (rhi)
-            return rhi->m_frame;
-    }
-    return 0;
-}
-
-QWebNetworkJob::JobStatus QWebNetworkJob::status() const
-{
-    return d->jobStatus;
-}
-
-void QWebNetworkJob::setStatus(const JobStatus& status)
-{
-    d->jobStatus = status;
-}
-
-/*!
-  \class QWebNetworkManager
-  \internal
-*/
-QWebNetworkManager::QWebNetworkManager()
-    : QObject(0)
-    , m_scheduledWork(false)
-{
-    connect(this, SIGNAL(scheduleWork()), SLOT(doWork()), Qt::QueuedConnection);
-}
-
-QWebNetworkManager *QWebNetworkManager::self()
-{
-    // ensure everything's constructed and connected
-    QWebNetworkInterface::defaultInterface();
-
-    return s_manager;
-}
-
-bool QWebNetworkManager::add(ResourceHandle* handle, QWebNetworkInterface* interface, JobMode jobMode)
-{
-    if (!interface)
-        interface = s_default_interface;
-
-    ASSERT(interface);
-
-    QWebNetworkJob *job = new QWebNetworkJob();
-    handle->getInternal()->m_job = job;
-    job->d->resourceHandle = handle;
-    job->d->interface = interface;
-
-    job->d->request.init(handle->request());
-
-    const QString method = handle->getInternal()->m_request.httpMethod();
-    if (method != "POST" && method != "GET" && method != "HEAD") {
-        qWarning("REQUEST: [%s]\n", qPrintable(job->d->request.httpHeader.toString()));
-        return false;
-    }
-
-    DEBUG() << "QWebNetworkManager::add:" <<  job->d->request.httpHeader.toString();
-
-    if (jobMode == SynchronousJob) {
-        Q_ASSERT(!m_synchronousJobs.contains(job));
-        m_synchronousJobs[job] = 1;
-    }
-
-    interface->addJob(job);
-
-    return true;
-}
-
-void QWebNetworkManager::cancel(ResourceHandle* handle)
-{
-    QWebNetworkJob *job = handle->getInternal()->m_job;
-    if (!job)
-        return;
-    DEBUG() << "QWebNetworkManager::cancel:" <<  job->d->request.httpHeader.toString();
-    job->d->resourceHandle = 0;
-    job->d->interface->cancelJob(job);
-    handle->getInternal()->m_job = 0;
-}
-
-/*!
-  \internal
-*/
-void QWebNetworkManager::started(QWebNetworkJob* job)
-{
-    Q_ASSERT(job->d);
-    Q_ASSERT(job->status() == QWebNetworkJob::JobCreated ||
-             job->status() == QWebNetworkJob::JobRecreated);
-
-    job->setStatus(QWebNetworkJob::JobStarted);
-    ResourceHandleClient* client = 0;
-
-    if (!job->d->resourceHandle)
-        return;
-
-    client = job->d->resourceHandle->client();
-    if (!client)
-        return;
-
-    DEBUG() << "ResourceHandleManager::receivedResponse:";
-    DEBUG() << job->d->response.toString();
-
-    QStringList cookies = job->d->response.allValues("Set-Cookie");
-    KURL url(job->url());
-
-    foreach (QString c, cookies)
-        QCookieJar::cookieJar()->setCookies(url, url, c);
-
-    QString contentType = job->d->response.value("Content-Type");
-    QString encoding;
-    int idx = contentType.indexOf(QLatin1Char(';'));
-    if (idx > 0) {
-        QString remainder = contentType.mid(idx + 1).toLower();
-        contentType = contentType.left(idx).trimmed();
-
-        idx = remainder.indexOf("charset");
-        if (idx >= 0) {
-            idx = remainder.indexOf(QLatin1Char('='), idx);
-            if (idx >= 0)
-                encoding = remainder.mid(idx + 1).trimmed();
-        }
-    }
-    if (contentType.isEmpty()) {
-        // let's try to guess from the extension
-        QString extension = job->d->request.url.path();
-        int index = extension.lastIndexOf(QLatin1Char('.'));
-        if (index > 0) {
-            extension = extension.mid(index + 1);
-            contentType = MIMETypeRegistry::getMIMETypeForExtension(extension);
-        }
-    }
-//     qDebug() << "Content-Type=" << contentType;
-//     qDebug() << "Encoding=" << encoding;
-
-
-    ResourceResponse response(url, contentType,
-                              0 /* FIXME */,
-                              encoding,
-                              String() /* FIXME */);
-
-    int statusCode = job->d->response.statusCode();
-    if (job->url().scheme() != QLatin1String("file"))
-        response.setHTTPStatusCode(statusCode);
-    else if (statusCode == 404)
-        response.setHTTPStatusCode(statusCode);
-
-    /* Fill in the other fields */
-
-    if (statusCode >= 300 && statusCode < 400) {
-        // we're on a redirect page! if the 'Location:' field is valid, we redirect
-        QString location = job->d->response.value("location");
-        DEBUG() << "Redirection";
-        if (!location.isEmpty()) {
-            QUrl newUrl = job->d->request.url.resolved(location);
-            if (job->d->resourceHandle) {
-                ResourceRequest newRequest = job->d->resourceHandle->request();
-                newRequest.setURL(KURL(newUrl));
-                if (client)
-                    client->willSendRequest(job->d->resourceHandle, newRequest, response);
-            }
-
-            QString method;
-            if (statusCode == 302 || statusCode == 303) {
-                // this is standard-correct for 303 and practically-correct (no standard-correct) for 302
-                // also, it's required for Yahoo's login process for flickr.com which responds to a POST
-                // with a 302 which must be GET'ed
-                method = "GET";
-                job->d->request.httpHeader.setContentLength(0);
-            } else
-                method = job->d->request.httpHeader.method();
-
-            job->d->request.httpHeader.setRequest(method,
-                                                  newUrl.toString(QUrl::RemoveScheme|QUrl::RemoveAuthority));
-            job->d->request.setURL(newUrl);
-            job->d->redirected = true;
-            return;
-        }
-    }
-
-    if (client)
-        client->didReceiveResponse(job->d->resourceHandle, response);
-
-}
-
-void QWebNetworkManager::data(QWebNetworkJob* job, const QByteArray& data)
-{
-    Q_ASSERT(job->status() == QWebNetworkJob::JobStarted ||
-             job->status() == QWebNetworkJob::JobReceivingData);
-
-    job->setStatus(QWebNetworkJob::JobReceivingData);
-    ResourceHandleClient* client = 0;
-
-    if (!job->d->resourceHandle)
-        return;
-
-    client = job->d->resourceHandle->client();
-    if (!client)
-        return;
-
-    if (job->d->redirected)
-        return; // don't emit the "Document has moved here" type of HTML
-
-    DEBUG() << "receivedData" << job->d->request.url.path();
-    client->didReceiveData(job->d->resourceHandle, data.constData(), data.length(), data.length() /*FixMe*/);
-}
-
-void QWebNetworkManager::finished(QWebNetworkJob* job, int errorCode)
-{
-    Q_ASSERT(errorCode == 1 ||
-             job->status() == QWebNetworkJob::JobStarted ||
-             job->status() == QWebNetworkJob::JobReceivingData);
-
-    if (m_synchronousJobs.contains(job))
-        m_synchronousJobs.remove(job);
-
-    job->setStatus(QWebNetworkJob::JobFinished);
-    ResourceHandleClient* client = 0;
-    if (job->d->resourceHandle) {
-        client = job->d->resourceHandle->client();
-        if (!client)
-            return;
-    } else {
-        job->deref();
-        return;
-    }
-
-    DEBUG() << "receivedFinished" << errorCode << job->url();
-
-    if (job->d->redirected) {
-        job->d->redirected = false;
-        job->setStatus(QWebNetworkJob::JobRecreated);
-        job->d->interface->addJob(job);
-        return;
-    }
-
-    if (job->d->resourceHandle)
-        job->d->resourceHandle->getInternal()->m_job = 0;
-
-    if (client) {
-        if (errorCode) {
-            //FIXME: error setting error was removed from ResourceHandle
-            client->didFail(job->d->resourceHandle,
-                            ResourceError(job->d->request.url.host(), job->d->response.statusCode(),
-                                          job->d->request.url.toString(), job->d->errorString));
-        } else
-            client->didFinishLoading(job->d->resourceHandle);
-    }
-
-    DEBUG() << "receivedFinished done" << job->d->request.url;
-
-    job->deref();
-}
-
-void QWebNetworkManager::addHttpJob(QWebNetworkJob* job)
-{
-    HostInfo hostInfo(job->url());
-    WebCoreHttp *httpConnection = m_hostMapping.value(hostInfo);
-    if (!httpConnection) {
-        // #### fix custom ports
-        DEBUG() << "   new connection to" << hostInfo.host << hostInfo.port;
-        httpConnection = new WebCoreHttp(this, hostInfo);
-        QObject::connect(httpConnection, SIGNAL(connectionClosed(const WebCore::HostInfo&)),
-                         this, SLOT(httpConnectionClosed(const WebCore::HostInfo&)));
-
-        m_hostMapping[hostInfo] = httpConnection;
-    }
-    httpConnection->request(job);
-}
-
-void QWebNetworkManager::cancelHttpJob(QWebNetworkJob* job)
-{
-    WebCoreHttp *httpConnection = m_hostMapping.value(job->url());
-    if (httpConnection)
-        httpConnection->cancel(job);
-}
-
-void QWebNetworkManager::httpConnectionClosed(const WebCore::HostInfo& info)
-{
-    WebCoreHttp *connection = m_hostMapping.take(info);
-    connection->deleteLater();
-}
-
-void QWebNetworkInterfacePrivate::sendFileData(QWebNetworkJob* job, int statusCode, const QByteArray& data)
-{
-    int error = statusCode >= 400 ? 1 : 0;
-    if (!job->cancelled()) {
-        QHttpResponseHeader response;
-        response.setStatusLine(statusCode);
-        response.setContentLength(data.length());
-        job->setResponse(response);
-        q->started(job);
-        if (!data.isEmpty())
-            q->data(job, data);
-    }
-    q->finished(job, error);
-}
-
-void QWebNetworkInterfacePrivate::parseDataUrl(QWebNetworkJob* job)
-{
-    QByteArray data = job->url().toString().toLatin1();
-    //qDebug() << "handling data url:" << data;
-
-    ASSERT(data.startsWith("data:"));
-
-    // Here's the syntax of data URLs:
-    // dataurl    := "data:" [ mediatype ] [ ";base64" ] "," data
-    // mediatype  := [ type "/" subtype ] *( ";" parameter )
-    // data       := *urlchar
-    // parameter  := attribute "=" value
-    QByteArray header;
-    bool base64 = false;
-
-    int index = data.indexOf(',');
-    if (index != -1) {
-        header = data.mid(5, index - 5).toLower();
-        //qDebug() << "header=" << header;
-        data = data.mid(index+1);
-        //qDebug() << "data=" << data;
-
-        if (header.endsWith(";base64")) {
-            //qDebug() << "base64";
-            base64 = true;
-            header = header.left(header.length() - 7);
-            //qDebug() << "mime=" << header;
-        }
-    } else
-        data = QByteArray();
-
-    if (base64)
-        data = QByteArray::fromBase64(data);
-    else
-        data = decodePercentEncoding(data);
-
-    if (header.isEmpty())
-        header = "text/plain;charset=US-ASCII";
-    int statusCode = 200;
-    QHttpResponseHeader response;
-    response.setContentType(header);
-    response.setContentLength(data.size());
-    job->setResponse(response);
-
-    int error = statusCode >= 400 ? 1 : 0;
-    q->started(job);
-    if (!data.isEmpty())
-        q->data(job, data);
-    q->finished(job, error);
-}
-
-void QWebNetworkManager::queueStart(QWebNetworkJob* job)
-{
-    Q_ASSERT(job->d);
-
-    QMutexLocker locker(&m_queueMutex);
-    job->ref();
-    m_pendingWork.append(new JobWork(job));
-    doScheduleWork();
-}
-
-void QWebNetworkManager::queueData(QWebNetworkJob* job, const QByteArray& data)
-{
-    ASSERT(job->d);
-
-    QMutexLocker locker(&m_queueMutex);
-    job->ref();
-    m_pendingWork.append(new JobWork(job, data));
-    doScheduleWork();
-}
-
-void QWebNetworkManager::queueFinished(QWebNetworkJob* job, int errorCode)
-{
-    Q_ASSERT(job->d);
-
-    QMutexLocker locker(&m_queueMutex);
-    job->ref();
-    m_pendingWork.append(new JobWork(job, errorCode));
-    doScheduleWork();
-}
-
-void QWebNetworkManager::doScheduleWork()
-{
-    if (!m_scheduledWork) {
-        m_scheduledWork = true;
-        emit scheduleWork();
-    }
-}
-
-
-/*
- * We will work on a copy of m_pendingWork. While dispatching m_pendingWork
- * new work will be added that will be handled at a later doWork call. doWork
- * will be called we set m_scheduledWork to false early in this method.
- */
-void QWebNetworkManager::doWork()
-{
-    m_queueMutex.lock();
-    m_scheduledWork = false;
-    bool hasSyncJobs = m_synchronousJobs.size();
-    const QHash<QWebNetworkJob*, int> syncJobs = m_synchronousJobs;
-    m_queueMutex.unlock();
-
-    foreach (JobWork* work, m_pendingWork) {
-        if (hasSyncJobs && !syncJobs.contains(work->job))
-            continue;
-
-        if (work->workType == JobWork::JobStarted)
-            started(work->job);
-        else if (work->workType == JobWork::JobData) {
-            // This job was not yet started
-            if (static_cast<int>(work->job->status()) < QWebNetworkJob::JobStarted)
-                continue;
-
-            data(work->job, work->data);
-        } else if (work->workType == JobWork::JobFinished) {
-            // This job was not yet started... we have no idea if data comes by...
-            // and it won't start in case of errors
-            if (static_cast<int>(work->job->status()) < QWebNetworkJob::JobStarted && work->errorCode != 1)
-                continue;
-
-            finished(work->job, work->errorCode);
-        }
-
-        m_queueMutex.lock();
-        m_pendingWork.removeAll(work);
-        m_queueMutex.unlock();
-
-        work->job->deref();
-        delete work;
-    }
-
-    m_queueMutex.lock();
-    if (hasSyncJobs && !m_synchronousJobs.size())
-        doScheduleWork();
-    m_queueMutex.unlock();
-}
-
-/*!
-  \class QWebNetworkInterface
-  \internal
-
-  The QWebNetworkInterface class provides an abstraction layer for
-  WebKit's network interface.  It allows to completely replace or
-  extend the builtin network layer.
-
-  QWebNetworkInterface contains two virtual methods, addJob and
-  cancelJob that have to be reimplemented when implementing your own
-  networking layer.
-
-  QWebNetworkInterface can by default handle the http, https, file and
-  data URI protocols.
-
-*/
-
-static bool gRoutineAdded = false;
-
-static void gCleanupInterface()
-{
-    delete s_default_interface;
-    s_default_interface = 0;
-}
-
-/*!
-  \internal
-  Sets a new default interface that will be used by all of WebKit
-  for downloading data from the internet.
-*/
-void QWebNetworkInterface::setDefaultInterface(QWebNetworkInterface* defaultInterface)
-{
-    if (s_default_interface == defaultInterface)
-        return;
-    if (s_default_interface)
-        delete s_default_interface;
-    s_default_interface = defaultInterface;
-    if (!gRoutineAdded) {
-        qAddPostRoutine(gCleanupInterface);
-        gRoutineAdded = true;
-    }
-}
-
-/*!
-  \internal
-  Returns the default interface that will be used by WebKit. If no
-  default interface has been set, QtWebkit will create an instance of
-  QWebNetworkInterface to do the work.
-*/
-QWebNetworkInterface *QWebNetworkInterface::defaultInterface()
-{
-    if (!s_default_interface)
-        setDefaultInterface(new QWebNetworkInterface);
-
-    return s_default_interface;
-}
-
-
-/*!
-  \internal
-  Constructs a QWebNetworkInterface object.
-*/
-QWebNetworkInterface::QWebNetworkInterface(QObject* parent)
-    : QObject(parent)
-{
-    d = new QWebNetworkInterfacePrivate;
-    d->q = this;
-
-    if (!s_manager)
-        s_manager = new QWebNetworkManager;
-}
-
-/*!
-  \internal
-  Destructs the QWebNetworkInterface object.
-*/
-QWebNetworkInterface::~QWebNetworkInterface()
-{
-    delete d;
-}
-
-/*!
-  \internal
-  This virtual method gets called whenever QtWebkit needs to add a
-  new job to download.
-
-  The QWebNetworkInterface should process this job, by first emitting
-  the started signal, then emitting data repeatedly as new data for
-  the Job is available, and finally ending the job with emitting a
-  finished signal.
-
-  After the finished signal has been emitted, the QWebNetworkInterface
-  is not allowed to access the job anymore.
-*/
-void QWebNetworkInterface::addJob(QWebNetworkJob* job)
-{
-    QString protocol = job->url().scheme();
-    if (protocol == QLatin1String("http") || protocol == QLatin1String("https")) {
-        QWebNetworkManager::self()->addHttpJob(job);
-        return;
-    }
-
-    // "file", "data" and all unhandled stuff go through here
-    //DEBUG() << "fileRequest";
-    DEBUG() << "FileLoader::request" << job->url();
-
-    if (job->cancelled()) {
-        d->sendFileData(job, 400, QByteArray());
-        return;
-    }
-
-    QUrl url = job->url();
-    if (protocol == QLatin1String("data")) {
-        d->parseDataUrl(job);
-        return;
-    }
-
-    int statusCode = 200;
-    QByteArray data;
-    QString path = url.path();
-    if (protocol == QLatin1String("qrc")) {
-        protocol = "file";
-        path.prepend(QLatin1Char(':'));
-    }
-
-    if (!(protocol.isEmpty() || protocol == QLatin1String("file"))) {
-        statusCode = 404;
-    } else {
-        // we simply ignore post data here.
-        QFile f(path);
-        DEBUG() << "opening" << QString(url.path());
-
-        if (f.open(QIODevice::ReadOnly)) {
-            QHttpResponseHeader response;
-            response.setStatusLine(200);
-            job->setResponse(response);
-            data = f.readAll();
-        } else
-            statusCode = 404;
-    }
-
-    if (statusCode == 404) {
-        QHttpResponseHeader response;
-        response.setStatusLine(404);
-        job->setResponse(response);
-    }
-
-    d->sendFileData(job, statusCode, data);
-}
-
-/*!
-  \internal
-  This virtual method gets called whenever QtWebkit needs to cancel a
-  new job.
-
-  The QWebNetworkInterface acknowledge the canceling of the job, by
-  emitting the finished signal with an error code of 1. After emitting
-  the finished signal, the interface should not access the job
-  anymore.
-*/
-void QWebNetworkInterface::cancelJob(QWebNetworkJob* job)
-{
-    QString protocol = job->url().scheme();
-    if (protocol == QLatin1String("http") || protocol == QLatin1String("https"))
-        QWebNetworkManager::self()->cancelHttpJob(job);
-}
-
-/*!
-  \internal
-*/
-void QWebNetworkInterface::started(QWebNetworkJob* job)
-{
-    Q_ASSERT(s_manager);
-    s_manager->queueStart(job);
-}
-
-/*!
-  \internal
-*/
-void QWebNetworkInterface::data(QWebNetworkJob* job, const QByteArray& data)
-{
-    Q_ASSERT(s_manager);
-    s_manager->queueData(job, data);
-}
-
-/*!
-  \internal
-*/
-void QWebNetworkInterface::finished(QWebNetworkJob* job, int errorCode)
-{
-    Q_ASSERT(s_manager);
-    s_manager->queueFinished(job, errorCode);
-}
-
-/*!
-  \fn void QWebNetworkInterface::sslErrors(QWebFrame *frame, const QUrl& url, const QList<QSslError>& errors, bool *continueAnyway);
-  \internal
-
-   Signal is emitted when an SSL error occurs.
-*/
-
-/*!
-  \fn void QWebNetworkInterface::authenticate(QWebFrame *frame, const QUrl& url, const QString& hostname, quint16 port, QAuthenticator *auth);
-  \internal
-
-  Signal is emitted when network authentication is required.
-*/
-
-/*!
-  \fn void QWebNetworkInterface::authenticateProxy(QWebFrame *frame, const QUrl& url, const QNetworkProxy& proxy, QAuthenticator *auth);
-  \internal
-
-  Signal is emitted when proxy authentication is required.
-*/
-
-/////////////////////////////////////////////////////////////////////////////
-WebCoreHttp::WebCoreHttp(QObject* parent, const HostInfo& hi)
-    : QObject(parent)
-    , info(hi)
-    , m_inCancel(false)
-{
-    for (int i = 0; i < 2; ++i) {
-        connection[i].http = new QHttp(info.host, (hi.protocol == QLatin1String("https")) ? QHttp::ConnectionModeHttps : QHttp::ConnectionModeHttp, info.port);
-        connect(connection[i].http, SIGNAL(responseHeaderReceived(const QHttpResponseHeader&)),
-                this, SLOT(onResponseHeaderReceived(const QHttpResponseHeader&)));
-        connect(connection[i].http, SIGNAL(readyRead(const QHttpResponseHeader&)),
-                this, SLOT(onReadyRead()));
-        connect(connection[i].http, SIGNAL(requestFinished(int, bool)),
-                this, SLOT(onRequestFinished(int, bool)));
-        connect(connection[i].http, SIGNAL(done(bool)),
-                this, SLOT(onDone(bool)));
-        connect(connection[i].http, SIGNAL(stateChanged(int)),
-                this, SLOT(onStateChanged(int)));
-        connect(connection[i].http, SIGNAL(authenticationRequired(const QString&, quint16, QAuthenticator*)),
-                this, SLOT(onAuthenticationRequired(const QString&, quint16, QAuthenticator*)));
-        connect(connection[i].http, SIGNAL(proxyAuthenticationRequired(const QNetworkProxy&, QAuthenticator*)),
-                this, SLOT(onProxyAuthenticationRequired(const QNetworkProxy&, QAuthenticator*)));
-        connect(connection[i].http, SIGNAL(sslErrors(const QList<QSslError>&)),
-                this, SLOT(onSslErrors(const QList<QSslError>&)));
-    }
-}
-
-WebCoreHttp::~WebCoreHttp()
-{
-    connection[0].http->deleteLater();
-    connection[1].http->deleteLater();
-}
-
-void WebCoreHttp::request(QWebNetworkJob* job)
-{
-    m_pendingRequests.append(job);
-    scheduleNextRequest();
-}
-
-void WebCoreHttp::scheduleNextRequest()
-{
-    int c = 0;
-    for (; c < 2; ++c) {
-        if (!connection[c].current)
-            break;
-    }
-    if (c >= 2)
-        return;
-
-    QWebNetworkJob *job = 0;
-    while (!job && !m_pendingRequests.isEmpty()) {
-        job = m_pendingRequests.takeFirst();
-        if (job->cancelled()) {
-            job->networkInterface()->finished(job, 1);
-            job = 0;
-        }
-    }
-    if (!job)
-        return;
-
-    QHttp* http = connection[c].http;
-
-    connection[c].current = job;
-    connection[c].id = -1;
-#ifndef QT_NO_NETWORKPROXY
-    int proxyId = http->setProxy(job->frame()->page()->networkProxy());
-#endif
-
-    QByteArray postData = job->postData();
-    if (!postData.isEmpty())
-        connection[c].id = http->request(job->httpHeader(), postData);
-    else
-        connection[c].id = http->request(job->httpHeader());
-
-    DEBUG() << "WebCoreHttp::scheduleNextRequest: using connection" << c;
-    DEBUG() << job->httpHeader().toString();
-//     DEBUG() << job->request.toString();
-}
-
-int WebCoreHttp::getConnection()
-{
-    QObject* o = sender();
-    int c;
-    if (o == connection[0].http) {
-        c = 0;
-    } else {
-        Q_ASSERT(o == connection[1].http);
-        c = 1;
-    }
-    Q_ASSERT(connection[c].current);
-    return c;
-}
-
-void WebCoreHttp::onResponseHeaderReceived(const QHttpResponseHeader& resp)
-{
-    QHttp* http = qobject_cast<QHttp*>(sender());
-    if (!http->currentId()) {
-        qDebug() << "ERROR!  Invalid job id.  Why?"; // foxnews.com triggers this
-        return;
-    }
-    int c = getConnection();
-    QWebNetworkJob* job = connection[c].current;
-    DEBUG() << "WebCoreHttp::slotResponseHeaderReceived connection=" << c;
-    DEBUG() << resp.toString();
-
-    job->setResponse(resp);
-
-    job->networkInterface()->started(job);
-}
-
-void WebCoreHttp::onReadyRead()
-{
-    QHttp* http = qobject_cast<QHttp*>(sender());
-    if (!http->currentId()) {
-        qDebug() << "ERROR!  Invalid job id.  Why?"; // foxnews.com triggers this
-        return;
-    }
-    int c = getConnection();
-    QWebNetworkJob* job = connection[c].current;
-    Q_ASSERT(http == connection[c].http);
-    //DEBUG() << "WebCoreHttp::slotReadyRead connection=" << c;
-
-    QByteArray data;
-    data.resize(http->bytesAvailable());
-    http->read(data.data(), data.length());
-    job->networkInterface()->data(job, data);
-}
-
-void WebCoreHttp::onRequestFinished(int id, bool error)
-{
-    int c = getConnection();
-    if (connection[c].id != id)
-        return;
-
-    QWebNetworkJob* job = connection[c].current;
-    if (!job) {
-        scheduleNextRequest();
-        return;
-    }
-
-    QHttp* http = connection[c].http;
-    DEBUG() << "WebCoreHttp::slotFinished connection=" << c << error << job;
-    if (error) {
-        DEBUG() << "   error: " << http->errorString();
-        job->setErrorString(http->errorString());
-    }
-
-    if (!error && http->bytesAvailable()) {
-        QByteArray data;
-        data.resize(http->bytesAvailable());
-        http->read(data.data(), data.length());
-        job->networkInterface()->data(job, data);
-    }
-
-    job->networkInterface()->finished(job, error ? 1 : 0);
-    connection[c].current = 0;
-    connection[c].id = -1;
-    scheduleNextRequest();
-}
-
-void WebCoreHttp::onDone(bool error)
-{
-    DEBUG() << "WebCoreHttp::onDone" << error;
-}
-
-void WebCoreHttp::onStateChanged(int state)
-{
-    DEBUG() << "State changed to" << state << "and connections are" << connection[0].current << connection[1].current;
-    if (state == QHttp::Closing || state == QHttp::Unconnected) {
-        if (!m_inCancel && m_pendingRequests.isEmpty()
-            && !connection[0].current && !connection[1].current)
-            emit connectionClosed(info);
-    }
-}
-
-void WebCoreHttp::cancel(QWebNetworkJob* request)
-{
-    bool doEmit = true;
-    m_inCancel = true;
-    for (int i = 0; i < 2; ++i) {
-        if (request == connection[i].current) {
-            connection[i].http->abort();
-            doEmit = false;
-        }
-    }
-    if (!m_pendingRequests.removeAll(request))
-        doEmit = false;
-    m_inCancel = false;
-
-    if (doEmit)
-        request->networkInterface()->finished(request, 1);
-
-    if (m_pendingRequests.isEmpty()
-        && !connection[0].current && !connection[1].current)
-        emit connectionClosed(info);
-}
-
-void WebCoreHttp::onSslErrors(const QList<QSslError>& errors)
-{
-    int c = getConnection();
-    QWebNetworkJob *job = connection[c].current;
-    if (job) {
-        bool continueAnyway = false;
-        emit job->networkInterface()->sslErrors(job->frame(), job->url(), errors, &continueAnyway);
-#ifndef QT_NO_OPENSSL
-        if (continueAnyway)
-            connection[c].http->ignoreSslErrors();
-#endif
-    }
-}
-
-void WebCoreHttp::onAuthenticationRequired(const QString& hostname, quint16 port, QAuthenticator* auth)
-{
-    int c = getConnection();
-    QWebNetworkJob *job = connection[c].current;
-    if (job) {
-        emit job->networkInterface()->authenticate(job->frame(), job->url(), hostname, port, auth);
-        if (auth->isNull())
-            connection[c].http->abort();
-    }
-}
-
-void WebCoreHttp::onProxyAuthenticationRequired(const QNetworkProxy& proxy, QAuthenticator* auth)
-{
-    int c = getConnection();
-    QWebNetworkJob *job = connection[c].current;
-    if (job) {
-        emit job->networkInterface()->authenticateProxy(job->frame(), job->url(), proxy, auth);
-        if (auth->isNull())
-            connection[c].http->abort();
-    }
-}
-
-HostInfo::HostInfo(const QUrl& url)
-    : protocol(url.scheme())
-    , host(url.host())
-    , port(url.port())
-{
-    if (port < 0) {
-        if (protocol == QLatin1String("http"))
-            port = 80;
-        else if (protocol == QLatin1String("https"))
-            port = 443;
-    }
-}
-
-#endif
diff --git a/WebKit/qt/Api/qwebnetworkinterface.h b/WebKit/qt/Api/qwebnetworkinterface.h
deleted file mode 100644
index 7f96155..0000000
--- a/WebKit/qt/Api/qwebnetworkinterface.h
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
-    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef QWEBNETWORKINTERFACE_H
-#define QWEBNETWORKINTERFACE_H
-
-#include <QtCore/qobject.h>
-#include <QtCore/qurl.h>
-#include <QtNetwork/qhttp.h>
-#include <QtCore/qbytearray.h>
-
-#include "qwebkitglobal.h"
-
-#if QT_VERSION < 0x040400
-
-class QAuthenticator;
-class QNetworkProxy;
-class QSslError;
-class QWebFrame;
-class QWebNetworkJobPrivate;
-class QWebNetworkInterface;
-class QWebObjectPluginConnector;
-
-namespace WebCore {
-    class WebCoreHttp;
-    class ResourceRequest;
-    class FrameLoaderClientQt;
-}
-
-struct QWebNetworkRequestPrivate;
-class QWEBKIT_EXPORT QWebNetworkRequest {
-public:
-    enum Method {
-        Get,
-        Post
-        //Head
-    };
-
-    QWebNetworkRequest();
-    explicit QWebNetworkRequest(const QUrl &url, Method method = Get, const QByteArray &postData = QByteArray());
-    QWebNetworkRequest(const QWebNetworkRequest &other);
-
-    QWebNetworkRequest &operator=(const QWebNetworkRequest &other);
-    ~QWebNetworkRequest();
-
-    QUrl url() const;
-    void setUrl(const QUrl &url);
-
-    QHttpRequestHeader httpHeader() const;
-    void setHttpHeader(const QHttpRequestHeader &header) const;
-
-    QString httpHeaderField(const QString &key) const;
-    void setHttpHeaderField(const QString &key, const QString &value);
-
-    QByteArray postData() const;
-    void setPostData(const QByteArray &data);
-
-private:
-    explicit QWebNetworkRequest(const QWebNetworkRequestPrivate &priv);
-    explicit QWebNetworkRequest(const WebCore::ResourceRequest &request);
-    friend class QWebNetworkJob;
-    friend class WebCore::FrameLoaderClientQt;
-
-    QWebNetworkRequestPrivate *d;
-    friend class QWebObjectPluginConnector;
-};
-
-class QWEBKIT_EXPORT QWebNetworkJob {
-public:
-
-    QUrl url() const;
-    QByteArray postData() const;
-    QHttpRequestHeader httpHeader() const;
-    QWebNetworkRequest request() const;
-    QString errorString() const;
-
-    QHttpResponseHeader response() const;
-    void setResponse(const QHttpResponseHeader &response);
-    void setErrorString(const QString&);
-
-    bool cancelled() const;
-
-    void ref();
-    bool deref();
-
-    QWebNetworkInterface *networkInterface() const;
-
-    QWebFrame *frame() const;
-
-protected:
-    enum JobStatus {
-        JobCreated,
-        JobRecreated,
-        JobStarted,
-        JobReceivingData,
-        JobFinished
-    };
-
-    JobStatus status() const;
-    void setStatus(const JobStatus&);
-
-private:
-    QWebNetworkJob();
-    ~QWebNetworkJob();
-
-    friend class QWebNetworkManager;
-    friend class QWebObjectPluginConnector;
-    friend class QWebNetworkJobPrivate;
-
-    QWebNetworkJobPrivate *d;
-};
-
-class QWebNetworkInterfacePrivate;
-
-class QWEBKIT_EXPORT QWebNetworkInterface : public QObject {
-    Q_OBJECT
-public:
-    QWebNetworkInterface(QObject *parent = 0);
-    ~QWebNetworkInterface();
-
-    static void setDefaultInterface(QWebNetworkInterface *defaultInterface);
-    static QWebNetworkInterface *defaultInterface();
-
-    virtual void addJob(QWebNetworkJob *job);
-    virtual void cancelJob(QWebNetworkJob *job);
-
-protected:
-    void started(QWebNetworkJob*);
-    void data(QWebNetworkJob*, const QByteArray &data);
-    void finished(QWebNetworkJob*, int errorCode);
-
-signals:
-    void sslErrors(QWebFrame *frame, const QUrl& url, const QList<QSslError>& errors, bool *continueAnyway);
-    void authenticate(QWebFrame *frame, const QUrl& url, const QString& hostname, quint16 port, QAuthenticator *auth);
-    void authenticateProxy(QWebFrame *frame, const QUrl& url, const QNetworkProxy& proxy, QAuthenticator *auth);
-
-private:
-    friend class QWebNetworkInterfacePrivate;
-    friend class WebCore::WebCoreHttp;
-    QWebNetworkInterfacePrivate *d;
-};
-
-#endif
-
-#endif
diff --git a/WebKit/qt/Api/qwebnetworkinterface_p.h b/WebKit/qt/Api/qwebnetworkinterface_p.h
deleted file mode 100644
index aec104b..0000000
--- a/WebKit/qt/Api/qwebnetworkinterface_p.h
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
-    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef QWEBNETWORKINTERFACE_P_H
-#define QWEBNETWORKINTERFACE_P_H
-
-#include "qwebnetworkinterface.h"
-#if QT_VERSION < 0x040400
-#include <qthread.h>
-#include <qmutex.h>
-
-namespace WebCore {
-    struct HostInfo;
-    class ResourceRequest;
-};
-uint qHash(const WebCore::HostInfo &info);
-#include <qhash.h>
-
-namespace WebCore {
-    class ResourceHandle;
-}
-
-struct QWebNetworkRequestPrivate {
-    QUrl url;
-    QHttpRequestHeader httpHeader;
-    QByteArray postData;
-
-    void init(const WebCore::ResourceRequest &resourceRequest);
-    void init(const QString &method, const QUrl &url, const WebCore::ResourceRequest *resourceRequest = 0);
-    void setURL(const QUrl &u);
-};
-
-class QWebNetworkJobPrivate {
-public:
-    QWebNetworkJobPrivate()
-        : ref(1)
-        , resourceHandle(0)
-        , redirected(false)
-        , interface(0)
-        , jobStatus(QWebNetworkJob::JobCreated)
-        {}
-    int ref;
-
-    QWebNetworkRequestPrivate request;
-    QHttpResponseHeader response;
-
-    WebCore::ResourceHandle *resourceHandle;
-    bool redirected;
-
-    QWebNetworkInterface *interface;
-    QWebNetworkJob::JobStatus jobStatus;
-    QString errorString;
-};
-
-class QWebNetworkManager : public QObject {
-    Q_OBJECT
-public:
-    enum JobMode {
-        AsynchronousJob,
-        SynchronousJob
-    };
-
-    static QWebNetworkManager *self();
-
-    bool add(WebCore::ResourceHandle *resourceHandle, QWebNetworkInterface *interface, JobMode = AsynchronousJob);
-    void cancel(WebCore::ResourceHandle *resourceHandle);
-
-    void addHttpJob(QWebNetworkJob *job);
-    void cancelHttpJob(QWebNetworkJob *job);
-
-protected:
-    void queueStart(QWebNetworkJob*);
-    void queueData(QWebNetworkJob*, const QByteArray&);
-    void queueFinished(QWebNetworkJob*, int errorCode);
-
-private:
-    void started(QWebNetworkJob *);
-    void data(QWebNetworkJob *, const QByteArray &data);
-    void finished(QWebNetworkJob *, int errorCode);
-    void doScheduleWork();
-
-signals:
-    void fileRequest(QWebNetworkJob*);
-    void scheduleWork();
-
-private slots:
-    void httpConnectionClosed(const WebCore::HostInfo &);
-    void doWork();
-
-private:
-    friend class QWebNetworkInterface;
-    QWebNetworkManager();
-    QHash<WebCore::HostInfo, WebCore::WebCoreHttp *> m_hostMapping;
-
-    struct JobWork {
-        enum WorkType {
-            JobStarted,
-            JobData,
-            JobFinished
-        };
-
-        explicit JobWork(QWebNetworkJob* _job)
-            : workType(JobStarted)
-            , errorCode(-1)
-            , job(_job)
-        {}
-
-        explicit JobWork(QWebNetworkJob* _job, int _errorCode)
-            : workType(JobFinished)
-            , errorCode(_errorCode)
-            , job(_job)
-        {}
-
-        explicit JobWork(QWebNetworkJob* _job, const QByteArray& _data)
-            : workType(JobData)
-            , errorCode(-1)
-            , job(_job)
-            , data(_data)
-        {}
-
-        const WorkType workType;
-        int errorCode;
-        QByteArray data;
-        QWebNetworkJob* job;
-    };
-
-    QMutex m_queueMutex;
-    bool m_scheduledWork;
-    QList<JobWork*> m_pendingWork;
-    QHash<QWebNetworkJob*, int> m_synchronousJobs;
-};
-
-
-namespace WebCore {
-
-    class NetworkLoader;
-
-    struct HostInfo {
-        HostInfo() {}
-        HostInfo(const QUrl& url);
-        QString protocol;
-        QString host;
-        int port;
-    };
-
-    class WebCoreHttp : public QObject {
-        Q_OBJECT
-    public:
-        WebCoreHttp(QObject* parent, const HostInfo&);
-        ~WebCoreHttp();
-
-        void request(QWebNetworkJob* resource);
-        void cancel(QWebNetworkJob*);
-
-    signals:
-        void connectionClosed(const WebCore::HostInfo&);
-
-    private slots:
-        void onResponseHeaderReceived(const QHttpResponseHeader& resp);
-        void onReadyRead();
-        void onRequestFinished(int, bool);
-        void onDone(bool);
-        void onStateChanged(int);
-        void onSslErrors(const QList<QSslError>&);
-        void onAuthenticationRequired(const QString& hostname, quint16 port, QAuthenticator*);
-        void onProxyAuthenticationRequired(const QNetworkProxy& proxy, QAuthenticator*);
-
-        void scheduleNextRequest();
-
-        int getConnection();
-
-    public:
-        HostInfo info;
-    private:
-        QList<QWebNetworkJob*> m_pendingRequests;
-        struct HttpConnection {
-            HttpConnection() : http(0), current(0), id(-1) {}
-            QHttp* http;
-            QWebNetworkJob* current;
-            int id; // the QHttp id
-        };
-        HttpConnection connection[2];
-        bool m_inCancel;
-    };
-
-}
-
-class QWebNetworkInterfacePrivate {
-public:
-    void sendFileData(QWebNetworkJob* job, int statusCode, const QByteArray& data);
-    void parseDataUrl(QWebNetworkJob* job);
-
-    QWebNetworkInterface* q;
-};
-
-#endif
-
-#endif
diff --git a/WebKit/qt/Api/qwebpage.cpp b/WebKit/qt/Api/qwebpage.cpp
index 0b122b4..ba6b9f3 100644
--- a/WebKit/qt/Api/qwebpage.cpp
+++ b/WebKit/qt/Api/qwebpage.cpp
@@ -78,6 +78,7 @@
 #include "Cache.h"
 #include "runtime/InitializeThreading.h"
 #include "PageGroup.h"
+#include "QWebPageClient.h"
 
 #include <QApplication>
 #include <QBasicTimer>
@@ -101,11 +102,10 @@
 #include <QStyle>
 #include <QSysInfo>
 #include <QTextCharFormat>
-#if QT_VERSION >= 0x040400
 #include <QNetworkAccessManager>
 #include <QNetworkRequest>
-#else
-#include "qwebnetworkinterface.h"
+#if defined(Q_WS_X11)
+#include <QX11Info>
 #endif
 
 using namespace WebCore;
@@ -138,6 +138,102 @@ QString QWEBKIT_EXPORT qt_webpage_groupName(QWebPage* page)
     return page->handle()->page->groupName();
 }
 
+class QWebPageWidgetClient : public QWebPageClient {
+public:
+    QWebPageWidgetClient(QWidget* view)
+        : view(view)
+    {
+        Q_ASSERT(view);
+    }
+
+    virtual void scroll(int dx, int dy, const QRect&);
+    virtual void update(const QRect& dirtyRect);
+    virtual void setInputMethodEnabled(bool enable);
+    virtual bool inputMethodEnabled() const;
+#if QT_VERSION >= 0x040600
+    virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable);
+#endif
+
+#ifndef QT_NO_CURSOR
+    virtual QCursor cursor() const;
+    virtual void updateCursor(const QCursor& cursor);
+#endif
+
+    virtual QPalette palette() const;
+    virtual int screenNumber() const;
+    virtual QWidget* ownerWidget() const;
+
+    virtual QObject* pluginParent() const;
+
+    QWidget* view;
+};
+
+void QWebPageWidgetClient::scroll(int dx, int dy, const QRect& rectToScroll)
+{
+    view->scroll(qreal(dx), qreal(dy), rectToScroll);
+}
+
+void QWebPageWidgetClient::update(const QRect & dirtyRect)
+{
+    view->update(dirtyRect);
+}
+
+void QWebPageWidgetClient::setInputMethodEnabled(bool enable)
+{
+    view->setAttribute(Qt::WA_InputMethodEnabled, enable);
+}
+
+bool QWebPageWidgetClient::inputMethodEnabled() const
+{
+    return view->testAttribute(Qt::WA_InputMethodEnabled);
+}
+
+#if QT_VERSION >= 0x040600
+void QWebPageWidgetClient::setInputMethodHint(Qt::InputMethodHint hint, bool enable)
+{
+    if (enable)
+        view->setInputMethodHints(view->inputMethodHints() | hint);
+    else
+        view->setInputMethodHints(view->inputMethodHints() & ~hint);
+}
+#endif
+#ifndef QT_NO_CURSOR
+QCursor QWebPageWidgetClient::cursor() const
+{
+    return view->cursor();
+}
+
+void QWebPageWidgetClient::updateCursor(const QCursor& cursor)
+{
+    view->setCursor(cursor);
+}
+#endif
+
+QPalette QWebPageWidgetClient::palette() const
+{
+    return view->palette();
+}
+
+int QWebPageWidgetClient::screenNumber() const
+{
+#if defined(Q_WS_X11)
+    if (view)
+        return view->x11Info().screen();
+#endif
+
+    return 0;
+}
+
+QWidget* QWebPageWidgetClient::ownerWidget() const
+{
+    return view;
+}
+
+QObject* QWebPageWidgetClient::pluginParent() const
+{
+    return view;
+}
+
 // Lookup table mapping QWebPage::WebActions to the associated Editor commands
 static const char* editorCommandWebActions[] =
 {
@@ -266,11 +362,11 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
 #if QT_VERSION < 0x040600
     , view(0)
 #endif
+    , clickCausedFocus(false)
+    , viewportSize(QSize(0, 0))
     , inspectorFrontend(0)
     , inspector(0)
     , inspectorIsInternalOnly(false)
-    , viewportSize(QSize(0, 0))
-    , clickCausedFocus(false)
 {
     WebCore::InitializeLoggingChannelsIfNecessary();
     JSC::initializeThreading();
@@ -288,11 +384,7 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     undoStack = 0;
 #endif
     mainFrame = 0;
-#if QT_VERSION < 0x040400
-    networkInterface = 0;
-#else
     networkManager = 0;
-#endif
     pluginFactory = 0;
     insideOpenCall = false;
     forwardUnsupportedContent = false;
@@ -321,15 +413,6 @@ QWebPagePrivate::~QWebPagePrivate()
     delete page;
 }
 
-#if QT_VERSION < 0x040400
-bool QWebPagePrivate::acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, QWebPage::NavigationType type)
-{
-    if (insideOpenCall
-        && frame == mainFrame)
-        return true;
-    return q->acceptNavigationRequest(frame, request, type);
-}
-#else
 bool QWebPagePrivate::acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &request, QWebPage::NavigationType type)
 {
     if (insideOpenCall
@@ -337,7 +420,6 @@ bool QWebPagePrivate::acceptNavigationRequest(QWebFrame *frame, const QNetworkRe
         return true;
     return q->acceptNavigationRequest(frame, request, type);
 }
-#endif
 
 void QWebPagePrivate::createMainFrame()
 {
@@ -764,13 +846,18 @@ void QWebPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
 void QWebPagePrivate::handleSoftwareInputPanel(Qt::MouseButton button)
 {
 #if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
-    if (q->view() && q->view()->testAttribute(Qt::WA_InputMethodEnabled)
+    Frame* frame = page->focusController()->focusedFrame();
+    if (!frame)
+        return;
+
+    if (client && client->inputMethodEnabled()
+        && frame->document()->focusedNode()
         && button == Qt::LeftButton && qApp->autoSipEnabled()) {
         QStyle::RequestSoftwareInputPanel behavior = QStyle::RequestSoftwareInputPanel(
-            q->view()->style()->styleHint(QStyle::SH_RequestSoftwareInputPanel));
+            client->ownerWidget()->style()->styleHint(QStyle::SH_RequestSoftwareInputPanel));
         if (!clickCausedFocus || behavior == QStyle::RSIP_OnMouseClick) {
             QEvent event(QEvent::RequestSoftwareInputPanel);
-            QApplication::sendEvent(q->view(), &event);
+            QApplication::sendEvent(client->ownerWidget(), &event);
         }
     }
 
@@ -962,11 +1049,9 @@ void QWebPagePrivate::keyReleaseEvent(QKeyEvent *ev)
 void QWebPagePrivate::focusInEvent(QFocusEvent*)
 {
     FocusController *focusController = page->focusController();
-    Frame *frame = focusController->focusedFrame();
     focusController->setActive(true);
-    if (frame)
-        focusController->setFocused(true);
-    else
+    focusController->setFocused(true);
+    if (!focusController->focusedFrame())
         focusController->setFocusedFrame(QWebFramePrivate::core(mainFrame));
 }
 
@@ -1210,16 +1295,16 @@ bool QWebPagePrivate::handleScrolling(QKeyEvent *ev, Frame *frame)
         granularity = ScrollByPage;
         direction = ScrollDown;
     } else if (ev == QKeySequence::MoveToPreviousPage
-               || (ev->key() == Qt::Key_Space) && (ev->modifiers() & Qt::ShiftModifier)) {
+               || ((ev->key() == Qt::Key_Space) && (ev->modifiers() & Qt::ShiftModifier))) {
         granularity = ScrollByPage;
         direction = ScrollUp;
     } else
 #endif // QT_NO_SHORTCUT
-    if (ev->key() == Qt::Key_Up && ev->modifiers() & Qt::ControlModifier
+    if ((ev->key() == Qt::Key_Up && ev->modifiers() & Qt::ControlModifier)
                || ev->key() == Qt::Key_Home) {
         granularity = ScrollByDocument;
         direction = ScrollUp;
-    } else if (ev->key() == Qt::Key_Down && ev->modifiers() & Qt::ControlModifier
+    } else if ((ev->key() == Qt::Key_Down && ev->modifiers() & Qt::ControlModifier)
                || ev->key() == Qt::Key_End) {
         granularity = ScrollByDocument;
         direction = ScrollDown;
@@ -1378,8 +1463,6 @@ QWebInspector* QWebPagePrivate::getOrCreateInspector()
     if (!inspector) {
         QWebInspector* insp = new QWebInspector;
         insp->setPage(q);
-        insp->connect(q, SIGNAL(webInspectorTriggered(const QWebElement&)), SLOT(show()));
-        insp->show(); // The inspector is expected to be shown on inspection
         inspectorIsInternalOnly = true;
 
         Q_ASSERT(inspector); // Associated through QWebInspector::setPage(q)
@@ -1584,7 +1667,7 @@ InspectorController* QWebPagePrivate::inspectorController()
 */
 
 /*!
-    Constructs an empty QWebView with parent \a parent.
+    Constructs an empty QWebPage with parent \a parent.
 */
 QWebPage::QWebPage(QObject *parent)
     : QObject(parent)
@@ -1607,8 +1690,14 @@ QWebPage::~QWebPage()
     FrameLoader *loader = d->mainFrame->d->frame->loader();
     if (loader)
         loader->detachFromParent();
-    if (d->inspector)
-        d->inspector->setPage(0);
+    if (d->inspector) {
+        // Since we have to delete an internal inspector,
+        // call setInspector(0) directly to prevent potential crashes
+        if (d->inspectorIsInternalOnly)
+            d->setInspector(0);
+        else
+            d->inspector->setPage(0);
+    }
     delete d;
 }
 
@@ -1672,6 +1761,15 @@ void QWebPage::setView(QWidget *view)
 {
     if (this->view() != view) {
         d->view = view;
+        if (!view) {
+            delete d->client;
+            d->client = 0;
+        } else {
+            if (!d->client) 
+                d->client = new QWebPageWidgetClient(view);
+            else
+                static_cast<QWebPageWidgetClient*>(d->client)->view = view;
+        }
         setViewportSize(view ? view->size() : QSize(0, 0));
     }
 }
@@ -1916,11 +2014,9 @@ void QWebPage::triggerAction(WebAction action, bool)
             editor->setBaseWritingDirection(RightToLeftWritingDirection);
             break;
         case InspectElement: {
-            QWebElement inspectedElement(QWebElement::enclosingElement(d->hitTestResult.d->innerNonSharedNode.get()));
-            emit webInspectorTriggered(inspectedElement);
-
             if (!d->hitTestResult.isNull()) {
                 d->getOrCreateInspector(); // Make sure the inspector is created
+                d->inspector->show(); // The inspector is expected to be shown on inspection
                 d->page->inspectorController()->inspect(d->hitTestResult.d->innerNonSharedNode.get());
             }
             break;
@@ -2019,11 +2115,7 @@ void QWebPage::setPreferredContentsSize(const QSize &size) const
 
     \sa createWindow()
 */
-#if QT_VERSION >= 0x040400
 bool QWebPage::acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &request, QWebPage::NavigationType type)
-#else
-bool QWebPage::acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, QWebPage::NavigationType type)
-#endif
 {
     Q_UNUSED(frame)
     if (type == NavigationTypeLinkClicked) {
@@ -2111,27 +2203,19 @@ QAction *QWebPage::action(WebAction action) const
 
         case Back:
             text = contextMenuItemTagGoBack();
-#if QT_VERSION >= 0x040400
             icon = style->standardIcon(QStyle::SP_ArrowBack);
-#endif
             break;
         case Forward:
             text = contextMenuItemTagGoForward();
-#if QT_VERSION >= 0x040400
             icon = style->standardIcon(QStyle::SP_ArrowForward);
-#endif
             break;
         case Stop:
             text = contextMenuItemTagStop();
-#if QT_VERSION >= 0x040400
             icon = style->standardIcon(QStyle::SP_BrowserStop);
-#endif
             break;
         case Reload:
             text = contextMenuItemTagReload();
-#if QT_VERSION >= 0x040400
             icon = style->standardIcon(QStyle::SP_BrowserReload);
-#endif
             break;
 
         case Cut:
@@ -2661,6 +2745,17 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
     as a result of the user clicking on a "file upload" button in a HTML form where multiple
     file selection is allowed.
 
+    \omitvalue ErrorPageExtension (introduced in Qt 4.6)
+*/
+
+/*!
+    \enum QWebPage::ErrorDomain
+    \since 4.6
+    \internal
+
+    \value QtNetwork
+    \value Http
+    \value WebKit
 */
 
 /*!
@@ -2711,6 +2806,12 @@ void QWebPage::updatePositionDependentActions(const QPoint &pos)
 */
 
 /*!
+    \fn QWebPage::ErrorPageExtensionReturn::ErrorPageExtensionReturn()
+
+    Constructs a new error page object.
+*/
+
+/*!
     \class QWebPage::ChooseMultipleFilesExtensionOption
     \since 4.5
     \brief The ChooseMultipleFilesExtensionOption class describes the option
@@ -2844,35 +2945,6 @@ QString QWebPage::chooseFile(QWebFrame *parentFrame, const QString& suggestedFil
 #endif
 }
 
-#if QT_VERSION < 0x040400 && !defined qdoc
-
-void QWebPage::setNetworkInterface(QWebNetworkInterface *interface)
-{
-    d->networkInterface = interface;
-}
-
-QWebNetworkInterface *QWebPage::networkInterface() const
-{
-    if (d->networkInterface)
-        return d->networkInterface;
-    else
-        return QWebNetworkInterface::defaultInterface();
-}
-
-#ifndef QT_NO_NETWORKPROXY
-void QWebPage::setNetworkProxy(const QNetworkProxy& proxy)
-{
-    d->networkProxy = proxy;
-}
-
-QNetworkProxy QWebPage::networkProxy() const
-{
-    return d->networkProxy;
-}
-#endif
-
-#else
-
 /*!
     Sets the QNetworkAccessManager \a manager responsible for serving network requests for this
     QWebPage.
@@ -2906,8 +2978,6 @@ QNetworkAccessManager *QWebPage::networkAccessManager() const
     return d->networkManager;
 }
 
-#endif
-
 /*!
     Sets the QWebPluginFactory \a factory responsible for creating plugins embedded into this
     QWebPage.
@@ -2955,7 +3025,7 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
     Q_UNUSED(url)
     QString ua = QLatin1String("Mozilla/5.0 ("
 
-    // Plastform
+    // Platform
 #ifdef Q_WS_MAC
     "Macintosh"
 #elif defined Q_WS_QWS
@@ -2964,19 +3034,22 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
     "Windows"
 #elif defined Q_WS_X11
     "X11"
+#elif defined Q_OS_SYMBIAN
+    "SymbianOS"
 #else
     "Unknown"
 #endif
-    "; "
+    // Placeholder for Platform Version
+    "%1; "
 
     // Placeholder for security strength (N or U)
-    "%1; "
+    "%2; "
 
     // Subplatform"
 #ifdef Q_OS_AIX
     "AIX"
 #elif defined Q_OS_WIN32
-    "%2"
+    "%3"
 #elif defined Q_OS_DARWIN
 #ifdef __i386__ || __x86_64__
     "Intel Mac OS X"
@@ -3028,6 +3101,8 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
     "Sun Solaris"
 #elif defined Q_OS_ULTRIX
     "DEC Ultrix"
+#elif defined Q_WS_S60
+    "Series60"
 #elif defined Q_OS_UNIX
     "UNIX BSD/SYSV system"
 #elif defined Q_OS_UNIXWARE
@@ -3035,7 +3110,28 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
 #else
     "Unknown"
 #endif
-    "; ");
+    // Placeholder for SubPlatform Version
+    "%4; ");
+
+    // Platform Version
+    QString osVer;
+#ifdef Q_OS_SYMBIAN
+    QSysInfo::SymbianVersion symbianVersion = QSysInfo::symbianVersion();
+    switch (symbianVersion) {
+    case QSysInfo::SV_9_2:
+        osVer = "/9.2";
+        break;
+    case QSysInfo::SV_9_3:
+        osVer = "/9.3";
+        break;
+    case QSysInfo::SV_9_4:
+        osVer = "/9.4";
+        break;
+    default: 
+        osVer = "Unknown";
+    }
+#endif
+    ua = ua.arg(osVer);
 
     QChar securityStrength(QLatin1Char('N'));
 #if !defined(QT_NO_OPENSSL)
@@ -3099,6 +3195,26 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
     ua = QString(ua).arg(ver);
 #endif
 
+    // SubPlatform Version
+    QString subPlatformVer;
+#ifdef Q_OS_SYMBIAN
+    QSysInfo::S60Version s60Version = QSysInfo::s60Version();
+    switch (s60Version) {
+    case QSysInfo::SV_S60_3_1:
+        subPlatformVer = "/3.1";
+        break;
+    case QSysInfo::SV_S60_3_2:
+        subPlatformVer = "/3.2";
+        break;
+    case QSysInfo::SV_S60_5_0:
+        subPlatformVer = "/5.0";
+        break;
+    default: 
+        subPlatformVer = " Unknown";
+    }
+#endif
+    ua = ua.arg(subPlatformVer);
+
     // Language
     QLocale locale;
     if (view())
@@ -3116,11 +3232,9 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
     QString appName = QCoreApplication::applicationName();
     if (!appName.isEmpty()) {
         ua.append(appName);
-#if QT_VERSION >= 0x040400
         QString appVer = QCoreApplication::applicationVersion();
         if (!appVer.isEmpty())
             ua.append(QLatin1Char('/') + appVer);
-#endif
     } else {
         // Qt version
         ua.append(QLatin1String("Qt/"));
@@ -3321,24 +3435,6 @@ quint64 QWebPage::bytesReceived() const
 */
 
 /*!
-    \fn void QWebPage::webInspectorTriggered(const QWebElement& inspectedElement);
-    \since 4.6
-
-    This signal is emitted when the user triggered an inspection through the
-    context menu. If a QWebInspector is associated to this page, it should be
-    visible to the user after this signal has been emitted.
-
-    If still no QWebInspector is associated to this QWebPage after the emission
-    of this signal, a privately owned inspector will be shown to the user.
-
-    \note \a inspectedElement contains the QWebElement under the context menu.
-    It is not garanteed to be the same as the focused element in the web
-    inspector.
-
-    \sa QWebInspector
-*/
-
-/*!
     \fn void QWebPage::toolBarVisibilityChangeRequested(bool visible)
 
     This signal is emitted whenever the visibility of the toolbar in a web browser
@@ -3389,16 +3485,6 @@ quint64 QWebPage::bytesReceived() const
 */
 
 /*!
-  \since 4.6
-  \fn void QWebPage::networkRequestStarted(QWebFrame* frame, QNetworkRequest* request);
-  \preliminary
-
-  This signal is emitted when a \a frame of the current page requests a web resource. The application
-  may want to associate the \a request with the \a frame that initiated it by storing the \a frame
-  as an attribute of the \a request.
-*/
-
-/*!
   \fn QWebPagePrivate* QWebPage::handle() const
   \internal
 */
diff --git a/WebKit/qt/Api/qwebpage.h b/WebKit/qt/Api/qwebpage.h
index f2bbde0..4766cbd 100644
--- a/WebKit/qt/Api/qwebpage.h
+++ b/WebKit/qt/Api/qwebpage.h
@@ -208,20 +208,8 @@ public:
     QUndoStack *undoStack() const;
 #endif
 
-#if QT_VERSION < 0x040400 && !defined(qdoc)
-    void setNetworkInterface(QWebNetworkInterface *interface);
-    QWebNetworkInterface *networkInterface() const;
-
-    // #### why is this in the page itself?
-#ifndef QT_NO_NETWORKPROXY
-    void setNetworkProxy(const QNetworkProxy& proxy);
-    QNetworkProxy networkProxy() const;
-#endif
-
-#else
     void setNetworkAccessManager(QNetworkAccessManager *manager);
     QNetworkAccessManager *networkAccessManager() const;
-#endif
 
     void setPluginFactory(QWebPluginFactory *factory);
     QWebPluginFactory *pluginFactory() const;
@@ -329,16 +317,13 @@ Q_SIGNALS:
     void windowCloseRequested();
     void printRequested(QWebFrame *frame);
     void linkClicked(const QUrl &url);
-    void webInspectorTriggered(const QWebElement& inspectedElement);
 
     void toolBarVisibilityChangeRequested(bool visible);
     void statusBarVisibilityChangeRequested(bool visible);
     void menuBarVisibilityChangeRequested(bool visible);
 
-#if QT_VERSION >= 0x040400
     void unsupportedContent(QNetworkReply *reply);
     void downloadRequested(const QNetworkRequest &request);
-#endif
 
     void microFocusChanged();
     void contentsChanged();
@@ -347,17 +332,11 @@ Q_SIGNALS:
     void saveFrameStateRequested(QWebFrame* frame, QWebHistoryItem* item);
     void restoreFrameStateRequested(QWebFrame* frame);
 
-    void networkRequestStarted(QWebFrame* frame, QNetworkRequest* request);
-
 protected:
     virtual QWebPage *createWindow(WebWindowType type);
     virtual QObject *createPlugin(const QString &classid, const QUrl &url, const QStringList &paramNames, const QStringList &paramValues);
 
-#if QT_VERSION >= 0x040400
     virtual bool acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &request, NavigationType type);
-#else
-    virtual bool acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, NavigationType type);
-#endif
     virtual QString chooseFile(QWebFrame *originatingFrame, const QString& oldFile);
     virtual void javaScriptAlert(QWebFrame *originatingFrame, const QString& msg);
     virtual bool javaScriptConfirm(QWebFrame *originatingFrame, const QString& msg);
diff --git a/WebKit/qt/Api/qwebpage_p.h b/WebKit/qt/Api/qwebpage_p.h
index f0f842d..5d97da4 100644
--- a/WebKit/qt/Api/qwebpage_p.h
+++ b/WebKit/qt/Api/qwebpage_p.h
@@ -151,18 +151,8 @@ public:
 
     bool clickCausedFocus;
 
-#if QT_VERSION < 0x040400
-    bool acceptNavigationRequest(QWebFrame *frame, const QWebNetworkRequest &request, QWebPage::NavigationType type);
-
-    QWebNetworkInterface *networkInterface;
-#ifndef QT_NO_NETWORKPROXY
-    QNetworkProxy networkProxy;
-#endif
-
-#else
     bool acceptNavigationRequest(QWebFrame *frame, const QNetworkRequest &request, QWebPage::NavigationType type);
     QNetworkAccessManager *networkManager;
-#endif
 
     bool forwardUnsupportedContent;
     QWebPage::LinkDelegationPolicy linkPolicy;
diff --git a/WebKit/qt/Api/qwebplugindatabase.cpp b/WebKit/qt/Api/qwebplugindatabase.cpp
index 623895f..758e257 100644
--- a/WebKit/qt/Api/qwebplugindatabase.cpp
+++ b/WebKit/qt/Api/qwebplugindatabase.cpp
@@ -18,7 +18,7 @@
 */
 
 #include "config.h"
-#include "qwebplugindatabase.h"
+#include "qwebplugindatabase_p.h"
 
 #include "PluginDatabase.h"
 #include "PluginPackage.h"
@@ -26,6 +26,7 @@
 using namespace WebCore;
 
 /*!
+    \internal
     \typedef QWebPluginInfo::MimeType
     \since 4.6
     \brief Represents a single MIME type supported by a plugin.
@@ -33,6 +34,7 @@ using namespace WebCore;
 
 /*!
     \class QWebPluginInfo
+    \internal
     \since 4.6
     \brief The QWebPluginInfo class represents a single Netscape plugin.
 
@@ -232,6 +234,7 @@ QWebPluginInfo &QWebPluginInfo::operator=(const QWebPluginInfo& other)
 
 /*!
     \class QWebPluginDatabase
+    \internal
     \since 4.6
     \brief The QWebPluginDatabase class provides an interface for managing
     Netscape plugins used by WebKit in QWebPages.
diff --git a/WebKit/qt/Api/qwebplugindatabase.h b/WebKit/qt/Api/qwebplugindatabase_p.h
index b22c3de..b22c3de 100644
--- a/WebKit/qt/Api/qwebplugindatabase.h
+++ b/WebKit/qt/Api/qwebplugindatabase_p.h
diff --git a/WebKit/qt/Api/qwebsettings.cpp b/WebKit/qt/Api/qwebsettings.cpp
index ffa21e4..9a5ab46 100644
--- a/WebKit/qt/Api/qwebsettings.cpp
+++ b/WebKit/qt/Api/qwebsettings.cpp
@@ -22,7 +22,7 @@
 
 #include "qwebpage.h"
 #include "qwebpage_p.h"
-#include "qwebplugindatabase.h"
+#include "qwebplugindatabase_p.h"
 
 #include "Cache.h"
 #include "CrossOriginPreflightResultCache.h"
@@ -62,8 +62,6 @@ public:
     QString localStoragePath;
     QString offlineWebApplicationCachePath;
     qint64 offlineStorageDefaultQuota;
-    float printingMinimumShrinkFactor;
-    float printingMaximumShrinkFactor;
 
     void apply();
     WebCore::Settings* settings;
@@ -81,6 +79,7 @@ static WebGraphicHash* graphics()
         hash->insert(QWebSettings::MissingPluginGraphic, QPixmap(QLatin1String(":webkit/resources/nullPlugin.png")));
         hash->insert(QWebSettings::DefaultFrameIconGraphic, QPixmap(QLatin1String(":webkit/resources/urlIcon.png")));
         hash->insert(QWebSettings::TextAreaSizeGripCornerGraphic, QPixmap(QLatin1String(":webkit/resources/textAreaResizeCorner.png")));
+        hash->insert(QWebSettings::DeleteButtonGraphic, QPixmap(QLatin1String(":webkit/resources/deleteButton.png")));
     }
 
     return hash;
@@ -176,12 +175,6 @@ void QWebSettingsPrivate::apply()
         QString storagePath = !localStoragePath.isEmpty() ? localStoragePath : global->localStoragePath;
         settings->setLocalStorageDatabasePath(storagePath);
 
-        float minimumShrinkFactor = printingMinimumShrinkFactor > 0.0f ? printingMinimumShrinkFactor : global->printingMinimumShrinkFactor;
-        settings->setPrintingMinimumShrinkFactor(minimumShrinkFactor);
-
-        float maximumShrinkFactor = printingMaximumShrinkFactor > 0.0f ? printingMaximumShrinkFactor : global->printingMaximumShrinkFactor;
-        settings->setPrintingMaximumShrinkFactor(maximumShrinkFactor);
-
         value = attributes.value(QWebSettings::ZoomTextOnly,
                                  global->attributes.value(QWebSettings::ZoomTextOnly));
         settings->setZoomsTextOnly(value);
@@ -206,10 +199,7 @@ void QWebSettingsPrivate::apply()
         value = attributes.value(QWebSettings::LocalContentCanAccessRemoteUrls,
                                       global->attributes.value(QWebSettings::LocalContentCanAccessRemoteUrls));
         settings->setAllowUniversalAccessFromFileURLs(value);
-
-        value = attributes.value(QWebSettings::SessionStorageEnabled,
-                                    global->attributes.value(QWebSettings::SessionStorageEnabled));
-        settings->setSessionStorageEnabled(value);
+        settings->setUsesPageCache(WebCore::pageCache()->capacity());
     } else {
         QList<QWebSettingsPrivate*> settings = *::allSettings();
         for (int i = 0; i < settings.count(); ++i)
@@ -273,7 +263,7 @@ QWebSettings* QWebSettings::globalSettings()
     setOfflineStoragePath() with an appropriate file path, and can limit the quota
     for each application by calling setOfflineStorageDefaultQuota().
 
-    \sa QWebPage::settings(), QWebView::settings(), {Browser}
+    \sa QWebPage::settings(), QWebView::settings(), {Web Browser}
 */
 
 /*!
@@ -350,9 +340,9 @@ QWebSettings* QWebSettings::globalSettings()
         web application cache feature is enabled or not. Disabled by default.
     \value LocalStorageEnabled Specifies whether support for the HTML 5
         local storage feature is enabled or not. Disabled by default.
+    \value LocalStorageDatabaseEnabled \e{This enum value is deprecated.} Use
+        QWebSettings::LocalStorageEnabled instead.
     \value LocalContentCanAccessRemoteUrls Specifies whether locally loaded documents are allowed to access remote urls.
-    \value SessionStorageEnabled Specifies whether support for the HTML 5
-        session storage feature is enabled or not. Enabled by default.                
 */
 
 /*!
@@ -383,11 +373,8 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::OfflineWebApplicationCacheEnabled, false);
     d->attributes.insert(QWebSettings::LocalStorageEnabled, false);
     d->attributes.insert(QWebSettings::LocalContentCanAccessRemoteUrls, false);
-    d->attributes.insert(QWebSettings::SessionStorageEnabled, true);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
     d->defaultTextEncoding = QLatin1String("iso-8859-1");
-    d->printingMinimumShrinkFactor = 0.0f;
-    d->printingMaximumShrinkFactor = 0.0f;
 }
 
 /*!
@@ -502,60 +489,6 @@ QString QWebSettings::defaultTextEncoding() const
 }
 
 /*!
-    \since 4.7 
-    Specifies minimum shrink fator allowed for printing. If set to 0 a
-    default value is used.
-
-    When printing, content will be shrunk to reduce page usage, it
-    will reduced by a factor between printingMinimumShrinkFactor and
-    printingMaximumShrinkFactor. 
-
-    \sa printingMinimumShrinkFactor()
-    \sa setPrintingMaximumShrinkFactor()
-    \sa printingMaximumShrinkFactor()
-*/
-void QWebSettings::setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor)
-{
-    d->printingMinimumShrinkFactor = printingMinimumShrinkFactor;
-    d->apply();
-}
-
-/*!
-    \since 4.7 
-    returns the minimum shrink factor used for printing.
-
-    \sa setPrintingMinimumShrinkFactor()
-*/
-float QWebSettings::printingMinimumShrinkFactor() const
-{
-    return d->printingMinimumShrinkFactor;
-}
-
-/*!
-    \since 4.7 
-    Specifies maximum shrink fator allowed for printing. If set to 0 a
-    default value is used.
-
-    \sa setPrintingMinimumShrinkFactor()
-*/
-void QWebSettings::setPrintingMaximumShrinkFactor(float printingMaximumShrinkFactor)
-{
-    d->printingMaximumShrinkFactor = printingMaximumShrinkFactor;
-    d->apply();
-}
-
-/*!
-    \since 4.7 
-    returns the maximum shrink factor used for printing.
-
-    \sa setPrintingMinimumShrinkFactor()
-*/
-float QWebSettings::printingMaximumShrinkFactor() const
-{
-    return d->printingMaximumShrinkFactor;
-}
-
-/*!
     Sets the path of the icon database to \a path. The icon database is used
     to store "favicons" associated with web sites.
 
@@ -625,9 +558,9 @@ QIcon QWebSettings::iconForUrl(const QUrl& url)
     return* icon;
 }
 
-/*!
+/*
     Returns the plugin database object.
-*/
+
 QWebPluginDatabase *QWebSettings::pluginDatabase()
 {
     static QWebPluginDatabase* database = 0;
@@ -635,6 +568,7 @@ QWebPluginDatabase *QWebSettings::pluginDatabase()
         database = new QWebPluginDatabase();
     return database;
 }
+*/
 
 /*!
     Sets \a graphic to be drawn when QtWebKit needs to draw an image of the
@@ -710,7 +644,9 @@ void QWebSettings::clearMemoryCaches()
 */
 void QWebSettings::setMaximumPagesInCache(int pages)
 {
+    QWebSettingsPrivate* global = QWebSettings::globalSettings()->d;
     WebCore::pageCache()->setCapacity(qMax(0, pages));
+    global->apply();
 }
 
 /*!
diff --git a/WebKit/qt/Api/qwebsettings.h b/WebKit/qt/Api/qwebsettings.h
index e68ea53..69f3b11 100644
--- a/WebKit/qt/Api/qwebsettings.h
+++ b/WebKit/qt/Api/qwebsettings.h
@@ -67,14 +67,14 @@ public:
         LocalStorageDatabaseEnabled = LocalStorageEnabled,
 #endif
         LocalContentCanAccessRemoteUrls,
-        SessionStorageEnabled,
         DnsPrefetchEnabled
     };
     enum WebGraphic {
         MissingImageGraphic,
         MissingPluginGraphic,
         DefaultFrameIconGraphic,
-        TextAreaSizeGripCornerGraphic
+        TextAreaSizeGripCornerGraphic,
+        DeleteButtonGraphic
     };
     enum FontSize {
         MinimumFontSize,
@@ -103,18 +103,12 @@ public:
     void setDefaultTextEncoding(const QString &encoding);
     QString defaultTextEncoding() const;
 
-    void setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor);
-    float printingMinimumShrinkFactor() const;
-
-    void setPrintingMaximumShrinkFactor(float printingMaximimShrinkFactor);
-    float printingMaximumShrinkFactor() const;
-
     static void setIconDatabasePath(const QString &location);
     static QString iconDatabasePath();
     static void clearIconDatabase();
     static QIcon iconForUrl(const QUrl &url);
 
-    static QWebPluginDatabase *pluginDatabase();
+    //static QWebPluginDatabase *pluginDatabase();
 
     static void setWebGraphic(WebGraphic type, const QPixmap &graphic);
     static QPixmap webGraphic(WebGraphic type);
diff --git a/WebKit/qt/Api/qwebview.cpp b/WebKit/qt/Api/qwebview.cpp
index 4fa073d..7bc3168 100644
--- a/WebKit/qt/Api/qwebview.cpp
+++ b/WebKit/qt/Api/qwebview.cpp
@@ -32,11 +32,8 @@
 #include "qprinter.h"
 #include "qdir.h"
 #include "qfile.h"
-#if defined(Q_WS_X11)
-#include <QX11Info>
-#endif
 
-class QWebViewPrivate : public QWebPageClient {
+class QWebViewPrivate {
 public:
     QWebViewPrivate(QWebView *view)
         : view(view)
@@ -46,24 +43,6 @@ public:
         Q_ASSERT(view);
     }
 
-    virtual void scroll(int dx, int dy, const QRect&);
-    virtual void update(const QRect& dirtyRect);
-    virtual void setInputMethodEnabled(bool enable);
-#if QT_VERSION >= 0x040600
-    virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable);
-#endif
-
-#ifndef QT_NO_CURSOR
-    virtual QCursor cursor() const;
-    virtual void updateCursor(const QCursor& cursor);
-#endif
-
-    virtual QPalette palette() const;
-    virtual int screenNumber() const;
-    virtual QWidget* ownerWidget() const;
-
-    virtual QObject* pluginParent() const;
-
     void _q_pageDestroyed();
 
     QWebView *view;
@@ -72,66 +51,6 @@ public:
     QPainter::RenderHints renderHints;
 };
 
-void QWebViewPrivate::scroll(int dx, int dy, const QRect& rectToScroll)
-{
-    view->scroll(qreal(dx), qreal(dy), rectToScroll);
-}
-
-void QWebViewPrivate::update(const QRect & dirtyRect)
-{
-    view->update(dirtyRect);
-}
-
-void QWebViewPrivate::setInputMethodEnabled(bool enable)
-{
-    view->setAttribute(Qt::WA_InputMethodEnabled, enable);
-}
-#if QT_VERSION >= 0x040600
-void QWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool enable)
-{
-    if (enable)
-        view->setInputMethodHints(view->inputMethodHints() | hint);
-    else
-        view->setInputMethodHints(view->inputMethodHints() & ~hint);
-}
-#endif
-#ifndef QT_NO_CURSOR
-QCursor QWebViewPrivate::cursor() const
-{
-    return view->cursor();
-}
-
-void QWebViewPrivate::updateCursor(const QCursor& cursor)
-{
-    view->setCursor(cursor);
-}
-#endif
-
-QPalette QWebViewPrivate::palette() const
-{
-    return view->palette();
-}
-
-int QWebViewPrivate::screenNumber() const
-{
-#if defined(Q_WS_X11)
-    if (view)
-        return view->x11Info().screen();
-#endif
-
-    return 0;
-}
-
-QWidget* QWebViewPrivate::ownerWidget() const
-{
-    return view;
-}
-
-QObject* QWebViewPrivate::pluginParent() const
-{
-    return view;
-}
-
 void QWebViewPrivate::_q_pageDestroyed()
 {
     page = 0;
@@ -151,7 +70,7 @@ void QWebViewPrivate::_q_pageDestroyed()
     It can be used in various applications to display web content live from the
     Internet.
 
-    The image below shows QWebView previewed in \QD with the Trolltech website.
+    The image below shows QWebView previewed in \QD with a Nokia website.
 
     \image qwebview-url.png
 
@@ -251,6 +170,7 @@ QWebView::~QWebView()
 #else
         d->page->d->view = 0;
 #endif
+        delete d->page->d->client;
         d->page->d->client = 0;
     }
 
@@ -296,16 +216,15 @@ void QWebView::setPage(QWebPage* page)
     d->page = page;
     if (d->page) {
         d->page->setView(this);
-        d->page->d->client = d; // set the page client
         d->page->setPalette(palette());
         // #### connect signals
         QWebFrame *mainFrame = d->page->mainFrame();
-        connect(mainFrame, SIGNAL(titleChanged(const QString&)),
-                this, SIGNAL(titleChanged(const QString&)));
+        connect(mainFrame, SIGNAL(titleChanged(QString)),
+                this, SIGNAL(titleChanged(QString)));
         connect(mainFrame, SIGNAL(iconChanged()),
                 this, SIGNAL(iconChanged()));
-        connect(mainFrame, SIGNAL(urlChanged(const QUrl &)),
-                this, SIGNAL(urlChanged(const QUrl &)));
+        connect(mainFrame, SIGNAL(urlChanged(QUrl)),
+                this, SIGNAL(urlChanged(QUrl)));
 
         connect(d->page, SIGNAL(loadStarted()),
                 this, SIGNAL(loadStarted()));
@@ -313,10 +232,10 @@ void QWebView::setPage(QWebPage* page)
                 this, SIGNAL(loadProgress(int)));
         connect(d->page, SIGNAL(loadFinished(bool)),
                 this, SIGNAL(loadFinished(bool)));
-        connect(d->page, SIGNAL(statusBarMessage(const QString &)),
-                this, SIGNAL(statusBarMessage(const QString &)));
-        connect(d->page, SIGNAL(linkClicked(const QUrl &)),
-                this, SIGNAL(linkClicked(const QUrl &)));
+        connect(d->page, SIGNAL(statusBarMessage(QString)),
+                this, SIGNAL(statusBarMessage(QString)));
+        connect(d->page, SIGNAL(linkClicked(QUrl)),
+                this, SIGNAL(linkClicked(QUrl)));
 
         connect(d->page, SIGNAL(microFocusChanged()),
                 this, SLOT(updateMicroFocus()));
@@ -328,84 +247,11 @@ void QWebView::setPage(QWebPage* page)
 }
 
 /*!
-    Returns a valid URL from a user supplied \a string if one can be deducted.
-    In the case that is not possible, an invalid QUrl() is returned.
-
-    \since 4.6
-
-    Most applications that can browse the web, allow the user to input a URL
-    in the form of a plain string. This string can be manually typed into
-    a location bar, obtained from the clipboard, or passed in via command
-    line arguments.
-
-    When the string is not already a valid URL, a best guess is performed,
-    making various web related assumptions.
-
-    In the case the string corresponds to a valid file path on the system,
-    a file:// URL is constructed, using QUrl::fromLocalFile().
-
-    If that is not the case, an attempt is made to turn the string into a
-    http:// or ftp:// URL. The latter in the case the string starts with
-    'ftp'. The result is then passed through QUrl's tolerant parser, and
-    in the case or success, a valid QUrl is returned, or else a QUrl().
-
-    \section1 Examples:
-
-    \list
-    \o webkit.org becomes http://webkit.org
-    \o ftp.webkit.org becomes ftp://ftp.webkit.org
-    \o localhost becomes http://localhost
-    \o /home/user/test.html becomes file:///home/user/test.html (if exists)
-    \endlist
-
-    \section2 Tips when dealing with URLs and strings:
-
-    \list
-    \o When creating a QString from a QByteArray or a char*, always use
-      QString::fromUtf8().
-    \o Do not use QUrl(string), nor QUrl::toString() anywhere where the URL might
-       be used, such as in the location bar, as those functions loose data.
-       Instead use QUrl::fromEncoded() and QUrl::toEncoded(), respectively.
-    \endlist
- */
-QUrl QWebView::guessUrlFromString(const QString &string)
-{
-    QString trimmedString = string.trimmed();
-
-    // Check the most common case of a valid url with scheme and host first
-    QUrl url = QUrl::fromEncoded(trimmedString.toUtf8(), QUrl::TolerantMode);
-    if (url.isValid() && !url.scheme().isEmpty() && !url.host().isEmpty())
-        return url;
-
-    // Absolute files that exists
-    if (QDir::isAbsolutePath(trimmedString) && QFile::exists(trimmedString))
-        return QUrl::fromLocalFile(trimmedString);
-
-    // If the string is missing the scheme or the scheme is not valid prepend a scheme
-    QString scheme = url.scheme();
-    if (scheme.isEmpty() || scheme.contains(QLatin1Char('.')) || scheme == QLatin1String("localhost")) {
-        // Do not do anything for strings such as "foo", only "foo.com"
-        int dotIndex = trimmedString.indexOf(QLatin1Char('.'));
-        if (dotIndex != -1 || trimmedString.startsWith(QLatin1String("localhost"))) {
-            const QString hostscheme = trimmedString.left(dotIndex).toLower();
-            QByteArray scheme = (hostscheme == QLatin1String("ftp")) ? "ftp" : "http";
-            trimmedString = QLatin1String(scheme) + QLatin1String("://") + trimmedString;
-        }
-        url = QUrl::fromEncoded(trimmedString.toUtf8(), QUrl::TolerantMode);
-    }
-
-    if (url.isValid())
-        return url;
-
-    return QUrl();
-}
-
-/*!
     Loads the specified \a url and displays it.
 
     \note The view remains the same until enough data has arrived to display the new \a url.
 
-    \sa setUrl(), url(), urlChanged(), guessUrlFromString()
+    \sa setUrl(), url(), urlChanged(), QUrl::fromUserInput()
 */
 void QWebView::load(const QUrl &url)
 {
@@ -424,19 +270,11 @@ void QWebView::load(const QUrl &url)
     \sa url(), urlChanged()
 */
 
-#if QT_VERSION < 0x040400 && !defined(qdoc)
-void QWebView::load(const QWebNetworkRequest &request)
-#else
 void QWebView::load(const QNetworkRequest &request,
                     QNetworkAccessManager::Operation operation,
                     const QByteArray &body)
-#endif
 {
-    page()->mainFrame()->load(request
-#if QT_VERSION >= 0x040400
-                              , operation, body
-#endif
-                             );
+    page()->mainFrame()->load(request, operation, body);
 }
 
 /*!
@@ -790,7 +628,6 @@ bool QWebView::event(QEvent *e)
         if (e->type() == QEvent::ShortcutOverride) {
             d->page->event(e);
 #ifndef QT_NO_CURSOR
-#if QT_VERSION >= 0x040400
         } else if (e->type() == QEvent::CursorChange) {
             // An unsetCursor will set the cursor to Qt::ArrowCursor.
             // Thus this cursor change might be a QWidget::unsetCursor()
@@ -801,8 +638,7 @@ bool QWebView::event(QEvent *e)
             // WebCore.
             // FIXME: Add a QEvent::CursorUnset or similar to Qt.
             if (cursor().shape() == Qt::ArrowCursor)
-                d->resetCursor();
-#endif
+                d->page->d->client->resetCursor();
 #endif
         } else if (e->type() == QEvent::Leave)
             d->page->event(e);
@@ -913,8 +749,12 @@ void QWebView::paintEvent(QPaintEvent *ev)
 }
 
 /*!
-    This function is called whenever WebKit wants to create a new window of the given \a type, for example as a result of
-    a JavaScript request to open a document in a new window.
+    This function is called from the createWindow() method of the associated QWebPage,
+    each time the page wants to create a new window of the given \a type. This might
+    be the result, for example, of a JavaScript request to open a document in a new window.
+
+    \note If the createWindow() method of the associated page is reimplemented, this
+    method is not called, unless explicitly done so in the reimplementation.
 
     \sa QWebPage::createWindow()
 */
@@ -1128,7 +968,7 @@ void QWebView::changeEvent(QEvent *e)
 /*!
     \fn void QWebView::statusBarMessage(const QString& text)
 
-    This signal is emitted when the statusbar \a text is changed by the page.
+    This signal is emitted when the status bar \a text is changed by the page.
 */
 
 /*!
diff --git a/WebKit/qt/Api/qwebview.h b/WebKit/qt/Api/qwebview.h
index b63a593..d7910d9 100644
--- a/WebKit/qt/Api/qwebview.h
+++ b/WebKit/qt/Api/qwebview.h
@@ -27,9 +27,7 @@
 #include <QtGui/qicon.h>
 #include <QtGui/qpainter.h>
 #include <QtCore/qurl.h>
-#if QT_VERSION >= 0x040400
 #include <QtNetwork/qnetworkaccessmanager.h>
-#endif
 
 QT_BEGIN_NAMESPACE
 class QNetworkRequest;
@@ -65,16 +63,10 @@ public:
     QWebPage* page() const;
     void setPage(QWebPage* page);
 
-    static QUrl guessUrlFromString(const QString& string);
-
     void load(const QUrl& url);
-#if QT_VERSION < 0x040400 && !defined(qdoc)
-    void load(const QWebNetworkRequest& request);
-#else
     void load(const QNetworkRequest& request,
               QNetworkAccessManager::Operation operation = QNetworkAccessManager::GetOperation,
               const QByteArray &body = QByteArray());
-#endif
     void setHtml(const QString& html, const QUrl& baseUrl = QUrl());
     void setContent(const QByteArray& data, const QString& mimeType = QString(), const QUrl& baseUrl = QUrl());
 
diff --git a/WebKit/qt/ChangeLog b/WebKit/qt/ChangeLog
index 67cf7f3..2c2722b 100644
--- a/WebKit/qt/ChangeLog
+++ b/WebKit/qt/ChangeLog
@@ -1,3 +1,1237 @@
+2009-12-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Improve the autotests of QtWebkit
+        https://bugs.webkit.org/show_bug.cgi?id=32216
+
+        Remove the calls to qWait() of the autotest of QWebView
+
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::reusePage):
+
+2009-12-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Improve the autotests of QtWebkit
+        https://bugs.webkit.org/show_bug.cgi?id=32216
+
+        Refactor tst_qwebframe to remove qWait() and use
+        the function waitForSignal() from util.h
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-12-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Improve the autotests of QtWebkit
+        https://bugs.webkit.org/show_bug.cgi?id=32216
+
+        Refactor the test of QGraphicsWebView:
+        -make waitForSignal() available to all the tests.
+        -remove QTest::qWait()
+
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::crashOnViewlessWebPages):
+        * tests/util.h:
+        (waitForSignal):
+
+2009-12-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins: Force windowless mode when there is no native window handle
+        
+        Inject wmode=opaque while instantiating the plugin for the case when the
+        webpage is not backed by a native window handle.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32059
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2009-12-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Corrects QtLauncher style
+
+        * QtLauncher/main.cpp:
+        (WebPage::acceptNavigationRequest):
+        (MainWindow::MainWindow):
+        (MainWindow::webPage):
+        (MainWindow::webView):
+        (MainWindow::changeLocation):
+        (MainWindow::loadFinished):
+        (MainWindow::showLinkHover):
+        (MainWindow::zoomIn):
+        (MainWindow::zoomOut):
+        (MainWindow::print):
+        (MainWindow::setEditable):
+        (MainWindow::dumpHtml):
+        (MainWindow::selectElements):
+        (MainWindow::newWindow):
+        (MainWindow::setupUI):
+        (WebPage::createWindow):
+        (WebPage::createPlugin):
+        (main):
+
+2009-12-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtLauncher: add a menu to show or hide the web inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=32149
+
+        * QtLauncher/main.cpp:
+        (WebInspector::WebInspector):
+        (WebInspector::showEvent):
+        (WebInspector::hideEvent):
+        (MainWindow::MainWindow):
+        (MainWindow::setupUI):
+
+2009-12-04  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Split out the renderPrivate in two methods, one for working on
+        relative coordinates (relative to the viewport) and one for
+        working on absolute coordinates. The latter is more effecient
+        for implementing tiling, as you don't need translate the coords,
+        and because it avoid clipping to the viewport.
+
+        No behaviour changes, so no new tests.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderContentsLayerAbsoluteCoords):
+        (QWebFramePrivate::renderRelativeCoords):
+        (QWebFrame::render):
+        * Api/qwebframe_p.h:
+
+2009-12-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow removing 'qrc' as a local security origin scheme
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+
+2009-12-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Clean up argument parsing in the QtLauncher
+
+        * QtLauncher/main.cpp:
+
+2009-12-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Prevent the inspector from closing its wrapping widget.
+        This is not necessary anymore since we now hide the embedded
+        close button.
+        https://bugs.webkit.org/show_bug.cgi?id=32149
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::showWindow):
+        (WebCore::InspectorClientQt::closeWindow):
+
+2009-12-03  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix compilation when SVG is disabled.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_pauseSVGAnimation):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidPushStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidReplaceStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::populateSetting):
+        (WebCore::InspectorClientQt::storeSetting):
+        (WebCore::variantToSetting):
+        (WebCore::settingToVariant):
+        * WebCoreSupport/InspectorClientQt.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidAddBackForwardItem): Add an empty implementation. Method added to FrameLoaderClient by Android (see bug).
+        (WebCore::FrameLoaderClientQt::dispatchDidRemoveBackForwardItem): ditto.
+        (WebCore::FrameLoaderClientQt::dispatchDidChangeBackForwardIndex): ditto.
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix Qt build.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_pauseSVGAnimation):
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add API used by the new 'sampleSVGAnimationForElementAtTime' DRT method,
+        forwarding the call to SVGDocumentExtensions, if SVG is enabled.
+
+        Implemented just like the existing pauseAnimation* methods for CSS animations.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_pauseSVGAnimation):
+
+2009-12-01  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31898
+
+        Makes QtLauncher default to the http scheme for URLs.
+
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+        (MainWindow::changeLocation):
+        (main):
+
+2009-11-30  Abhinav Mithal  <abhinav.mithal@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt][Symbian] Report SymbianOS in user agent string for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=31961
+
+        * Api/qwebpage.cpp:
+        (QWebPage::userAgentForUrl):
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix minor waning in QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=31963
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (ErrorPage::extension): Remove info wariable as it is
+        not used.
+
+2009-11-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] SoftwareInputPanelRequest event sent when clicking in newly loaded page
+
+        https://bugs.webkit.org/show_bug.cgi?id=31401
+
+        Don't set the event unless there is a focused node we can use
+        for editing afterwards.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::handleSoftwareInputPanel):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2009-11-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        Removed unused ICO image plugin handler.
+
+        * Plugins/ICOHandler.cpp: Removed.
+        * Plugins/ICOHandler.h: Removed.
+        * Plugins/Plugins.pro: Removed.
+
+2009-11-12  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Do not show the QWidget when the WebCore::Widget is hidden
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        The clipping code was making a QWidget visible even if the
+        WebCore::Widget was hidden. Fix the bug by calling setVisible
+        only if the WebCore::Widget Widget::isSelfVisible.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::QtPluginWidget::show): Override WebCore::Widget::show to call handleVisibility
+        (WebCore::QtPluginWidget::handleVisibility): New method to call setVisible when we are visible
+        (FrameLoaderClientQt::createPlugin): Hide the QWidget by default
+
+2009-11-23  David Boddie  <dboddie@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Updated the QWebElement documentation with links to examples and
+        external resources.
+        Fixed the project file for the webelement snippet and tidied up the
+        markers used for quoting the code.
+
+        * Api/qwebelement.cpp:
+        * docs/webkitsnippets/webelement/main.cpp:
+        (findAll):
+        * docs/webkitsnippets/webelement/webelement.pro:
+
+2009-11-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Wrong runtime instance objects of wrapped QObjects may be used if
+        the wrapped object died before the gc removed the instance.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31681
+
+        Added a unit-test to verify that wrapping a QObject with the
+        same identity as a previously but now dead object works.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-11-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add instantiation tests for QWebInspector.
+
+        * tests/qwebinspector/qwebinspector.pro: Added.
+        * tests/qwebinspector/tst_qwebinspector.cpp: Added.
+        (tst_QWebInspector::attachAndDestroy):
+        * tests/tests.pro:
+
+2009-11-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix QWebInspector destruction problem.
+        https://bugs.webkit.org/show_bug.cgi?id=31664
+
+        * Api/qwebpage.cpp:
+        (QWebPage::~QWebPage):
+
+2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Normalize signal and slot signatures.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::setPage):
+        * Api/qwebview.cpp:
+        (QWebView::setPage):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::setFrame):
+        * docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp:
+        (wrapInFunction):
+        * tests/qwebframe/tst_qwebframe.cpp:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::modified):
+        (tst_QWebPage::database):
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        * Api/qcookiejar.cpp: Removed.
+        * Api/qcookiejar.h: Removed.
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::event):
+        * Api/qwebframe.cpp:
+        (QWebFrame::load):
+        * Api/qwebframe.h:
+        * Api/qwebkitglobal.h:
+        * Api/qwebnetworkinterface.cpp: Removed.
+        * Api/qwebnetworkinterface.h: Removed.
+        * Api/qwebnetworkinterface_p.h: Removed.
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        (QWebPagePrivate::acceptNavigationRequest):
+        (QWebPage::acceptNavigationRequest):
+        (QWebPage::action):
+        (QWebPage::userAgentForUrl):
+        * Api/qwebpage.h:
+        * Api/qwebpage_p.h:
+        * Api/qwebview.cpp:
+        (QWebView::load):
+        (QWebView::event):
+        * Api/qwebview.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::print):
+        (MainWindow::setupUI):
+        (main):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::download):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction):
+        (WebCore::FrameLoaderClientQt::startDownload):
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2009-11-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add support for displaying deleteButton.
+        https://bugs.webkit.org/show_bug.cgi?id=31560
+
+        Test: LayoutTests/editing/deleting/5408255.html
+
+        * Api/qwebsettings.cpp:
+        (graphics):
+        * Api/qwebsettings.h:
+
+2009-11-18  Paul Olav Tvete  <paul.tvete@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make the QWebElement::render() test pass when pixmaps aren't 32 bit.
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::render):
+
+2009-11-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Clarify and simplify the legal section in the overview documentation,
+        after review with our legal team.
+
+        * docs/qtwebkit.qdoc:
+
+2009-11-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add QtLauncher support for opening links in the default browser
+
+        This can be triggered by either the context menu or by clicking a link
+        while holding down the Alt key. Opening a link in a new windows is
+        triggered by holding down Shift.
+
+        * QtLauncher/main.cpp:
+
+2009-11-17  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QGLLauncher does not support drag&drop of local files
+        https://bugs.webkit.org/show_bug.cgi?id=31057
+
+        Enable accepting files in QGraphicsWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::QGraphicsWebView):
+        (QGraphicsWebView::dragEnterEvent):
+
+2009-11-17  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] better test coverage for ErrorPageExtension
+        https://bugs.webkit.org/show_bug.cgi?id=31583
+
+        Improved the coverage of current ErrorPageExtension tests by
+        adding autotests involving frameset and iframes.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (ErrorPage::extension): Make the ErrorPageExtension
+        to work for all frames, not only the main frame.
+        (tst_QWebPage::errorPageExtension): Stop using
+        the 'frameset.html' resouce in this method since
+        an autotest specific for frameset's is being added.
+        (tst_QWebPage::errorPageExtensionInIFrames): Added.
+        (tst_QWebPage::errorPageExtensionInFrameset): Added.
+
+2009-11-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        API documentation fixes.
+
+        * Api/qgraphicswebview.cpp: Removed duplicate docs.
+        * Api/qwebelement.cpp: Added missing docs.
+        * Api/qwebsettings.cpp: Ditto.
+
+2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Broken back/forward after using ErrorPageExtension to set error page
+        https://bugs.webkit.org/show_bug.cgi?id=30573
+
+        Implemented autotests for covering the back/forward
+        reset problem involving error pages.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::errorPageExtension):
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Update for changes to FrameLoaderClient
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Reviewed by Dave Hyatt.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidClearWindowObjectInWorld):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+        Replaced windowObjectCleared with this function. Does nothing if the
+        passed-in world is not the mainThreadNormalWorld().
+
+2009-11-13  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable Page Cache if setMaximumPagesInCache needs it.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=31266.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::setMaximumPagesInCache):
+
+2009-11-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix initial QWebView focus behavior.
+
+        focusController->setFocused(true) was not always called.
+        https://bugs.webkit.org/show_bug.cgi?id=31466
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::focusInEvent):
+
+2009-11-13  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Update documentation for the Qt API
+
+        * Api/qgraphicswebview.cpp:
+        * Api/qwebelement.cpp:
+        * Api/qwebframe.cpp:
+        * Api/qwebsettings.cpp:
+        * Api/qwebview.cpp:
+
+2009-11-13  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use correct install-path when running qdoc3
+
+        * docs/docs.pri:
+
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::renderTreeDump):
+
+2009-11-12  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Jan Alonzo.
+
+        [Qt] Various doc fixes
+        https://bugs.webkit.org/show_bug.cgi?id=31358
+
+        QWebPage's constructor docs are mentioning "QWebView":
+        "Constructs an empty QWebView with parent".
+
+        * Api/qwebpage.cpp:
+
+2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Custom printing shrink factors
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        This reverts commit r49769. The public API for this needs to be reviewed
+        before its inclusion in Qt.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
+2009-11-11  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Various doc fixes
+        https://bugs.webkit.org/show_bug.cgi?id=31358
+
+        Fixed wrong documentation: item's dimensions do fit to Web page
+        content by default.
+
+        Kenneth agreed to land this as a followup patch to the
+        just landed documentation patch.
+
+        * Api/qgraphicswebview.cpp:
+
+2009-11-11  David Boddie  <dboddie@trolltech.com>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Various doc fixes
+        https://bugs.webkit.org/show_bug.cgi?id=31323
+
+        Fixed and synchronized QWebView related documentation.
+
+        * Api/qgraphicswebview.cpp:
+        * Api/qwebview.cpp:
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed buildbot fix.
+
+        Export a method to the DRT to know if the document has a
+        document element.
+
+        * Api/qwebframe.cpp:
+        (qt_drt_hasDocumentElement):
+
+2009-11-11  Liang QI  <liang.qi@nokia.com>
+
+        [Qt] Fix tst_qwebpage and tst_qwebframe compilation on Symbian.
+
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebframe/tst_qwebframe.cpp:
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebpage/tst_qwebpage.cpp:
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a crash in the layout test plugins/document-open.html
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::toPlainText):
+
+2009-11-11  Warwick Allison  <warwick.allison@nokia.com>, Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Regression: Preserve the parent of plugin objects when using
+        QtWebKit with only a QWebPage.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin): Don't reparent
+        plugins to 0.
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (PluginCounterPage::PluginCounterPage): Initialize m_pluginParent to 0.
+        (PluginCounterPage::~PluginCounterPage): Delete the plugin parent later
+        (after the page)
+        (PluginTracerPage::createPlugin): Assign a dummy parent to the plugin.
+        (PluginTracerPage::PluginTracerPage): Set up the plugin parent.
+        (tst_QWebPage::createViewlessPlugin): Verify that for viewless pages the
+        plugin parent remains unchanged.
+
+2009-11-11  David Boddie  <dboddie@trolltech.com>
+
+        [Qt] Doc: Added internal or hidden placeholder documentation.
+
+        * Api/qwebpage.cpp:
+
+2009-11-11  Martin Smith  <msmith@trolltech.com>
+
+        [Qt] doc: Changed Trolltech to Nokia
+
+        * Api/qwebview.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31323
+        Fix a few compiler warnings
+
+        * tests/qwebframe/tst_qwebframe.cpp: Add extra brackets 
+        to make it explicit where the else case belongs
+
+2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix enabling of software input panel when activating editable elements
+        in QGraphicsWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::inputMethodEnabled): Implement method to
+        query for input method support.
+        * Api/qwebpage.cpp:
+        (QWebPageWidgetClient::inputMethodEnabled): Ditto for QWidget.
+        (QWebPagePrivate::handleSoftwareInputPanel): Don't use view() to
+        test for input method support. Instead query using QWebPageClient
+        and send the SIPR event to the ownerWidget() instead of the view().
+        The latter is null for QGraphicsWebView.
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (EventSpy::EventSpy):
+        (EventSpy::eventFilter):
+        (tst_QWebPage::inputMethods): Modify the test to verify that SIPR
+        events are dispatched when activating focusable content.
+
+2009-11-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed documentation fixes.
+
+        Added a few improvements from Jocelyn Turcotte to the
+        createWindow docs.
+
+        * Api/qwebview.cpp:
+
+2009-11-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed documentation fix.
+
+        [Qt] Make qwebpage's createWindow not qwebview dependent.
+        https://bugs.webkit.org/show_bug.cgi?id=30771
+
+        Update documentation to make it clear that a reimplementation
+        of the createWindow method of the associated QWebPage can
+        result in the QWebView::createWindow method to never be called.
+
+        * Api/qwebview.cpp:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Few classes have virtual functions but non-virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=31269
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate): Add virtual
+        destructor.
+
+2009-11-09  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30628
+        Add an API to get all the attributes from a QWebElement.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::attributesName):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::listAttributes):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::handleScrolling):
+
+2009-11-09  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Track "can have scrollbar" state within FrameView independently of the
+        individual scrollbar states in ScrollView.
+
+        rdar://problem/7215132, https://bugs.webkit.org/show_bug.cgi?id=29167
+        REGRESSION (r48064): mint.com loses scrollbars after coming out of
+        edit mode.
+
+        rdar://problem/7314421, https://bugs.webkit.org/show_bug.cgi?id=30517
+        REGRESSION (r48064): Extra scroll bars in GarageBand Lesson Store.
+
+        Test: fast/overflow/scrollbar-restored.html
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::setScrollBarPolicy):
+
+2009-11-09  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30772
+        Add a non-const iterator to QWebElementCollection.
+        Move the two attributes of the iterator to private.
+
+        * Api/qwebelement.h:
+        (const_iterator::begin):
+        (const_iterator::end):
+        (const_iterator::constBegin):
+        (const_iterator::constEnd):
+        (const_iterator::iterator::iterator):
+        (const_iterator::iterator::operator*):
+        (const_iterator::iterator::operator==):
+        (const_iterator::iterator::operator!=):
+        (const_iterator::iterator::operator<):
+        (const_iterator::iterator::operator<=):
+        (const_iterator::iterator::operator>):
+        (const_iterator::iterator::operator>=):
+        (const_iterator::iterator::operator++):
+        (const_iterator::iterator::operator--):
+        (const_iterator::iterator::operator+=):
+        (const_iterator::iterator::operator-=):
+        (const_iterator::iterator::operator+):
+        (const_iterator::iterator::operator-):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::nonConstIterator):
+        (tst_QWebElement::constIterator):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Remove the sessionStorage setting (per Page)
+        https://bugs.webkit.org/show_bug.cgi?id=31249
+
+        This setting allows to run sessionStorage on/off on a per page
+        basis. Remove this prematurely exposed API.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::database):
+        (tst_QWebPage::testOptionalJSObjects):
+
+2009-11-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove the QWebPage:webInspectorTriggered signal.
+        User customization of the communication between QWebPage
+        and QWebInspector will be properly designed in the next version.
+        https://bugs.webkit.org/show_bug.cgi?id=30773
+
+        * Api/qwebinspector.cpp:
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::getOrCreateInspector):
+        (QWebPage::triggerAction):
+        * Api/qwebpage.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+
+2009-11-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added a missing re-implementation of QGraphicsItem::inputMethodQuery().
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::inputMethodQuery):
+        * Api/qgraphicswebview.h:
+
+2009-11-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Provide a dummy re-implementation of QGraphicsLayoutItem::sizeHint(),
+        similar to QWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::sizeHint):
+        * Api/qgraphicswebview.h:
+
+2009-11-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Removed zoomFactoryChanged() signal and added
+        linkClicked() to QGraphicsWebView, for consistency with
+        QWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::setPage):
+        (QGraphicsWebView::setZoomFactor):
+        * Api/qgraphicswebview.h:
+
+2009-11-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added QGraphicsWebView::findText() for convenience and consistency
+        with QWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::findText):
+        * Api/qgraphicswebview.h:
+
+2009-11-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added QGraphicsWebView::pageAction() and triggerPageAction(), for
+        consistency with QWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::pageAction):
+        (QGraphicsWebView::triggerPageAction):
+        * Api/qgraphicswebview.h:
+
+2009-11-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Removed QGraphicsWebView::toHtml() after API review.
+
+        That's consistent with QWebView and also based on the assumption that
+        toHtml() is called less frequently than setHtml().
+
+        * Api/qgraphicswebview.cpp:
+        * Api/qgraphicswebview.h:
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::qgraphicswebview):
+
+2009-11-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Removed the interactive property of QGraphicsWebView.
+
+        There are clearly use-cases for this feature, but it will require
+        more work to make this fully work with an enum to have fine-grained
+        control over the interactivity levels. For now it is easy to achieve
+        in user-code what the boolean property did.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::QGraphicsWebViewPrivate):
+        (QGraphicsWebView::hoverMoveEvent):
+        (QGraphicsWebView::mouseMoveEvent):
+        (QGraphicsWebView::mousePressEvent):
+        (QGraphicsWebView::mouseReleaseEvent):
+        (QGraphicsWebView::mouseDoubleClickEvent):
+        (QGraphicsWebView::keyPressEvent):
+        (QGraphicsWebView::keyReleaseEvent):
+        (QGraphicsWebView::dragLeaveEvent):
+        (QGraphicsWebView::dragMoveEvent):
+        (QGraphicsWebView::dropEvent):
+        (QGraphicsWebView::wheelEvent):
+        (QGraphicsWebView::inputMethodEvent):
+        * Api/qgraphicswebview.h:
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::qgraphicswebview):
+
+2009-11-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make the QGraphicsWebView constructor explicit.
+
+        * Api/qgraphicswebview.h:
+
+2009-11-05  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add support for Shift-PageUp and Shift-PageDown key events.
+        https://bugs.webkit.org/show_bug.cgi?id=31166
+
+        Test: LayoutTests/editing/selection/shrink-selection-after-shift-pagedown.html
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleKeyboardEvent):
+
+2009-11-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Last Qt 4.5 build fix (*sigh*)
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (inputMethodHints): inputMethodHints() is only used for 
+        Qt 4.6, so guard the whole function.
+
+2009-11-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Another prospective build fix against Qt 4.5 (build bot)
+
+        Don't compile & run the QGraphicsWebView portion of the
+        input methods auto test with Qt 4.5.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods_data):
+        (inputMethodHints):
+        (inputMethodEnabled):
+        (tst_QWebPage::inputMethods):
+
+2009-11-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective build fix against Qt 4.5 (build bot)
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::setInputMethodEnabled): Guard the
+        use of Qt 4.6 specific API with #ifdefs.
+
+2009-11-01  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Fix enabling of input method support on QGraphicsWebView.
+        https://bugs.webkit.org/show_bug.cgi?id=30605
+
+        Instead of setting the unsupported widget attribute on the
+        QGraphicsWidget in setInputMethodEnabled() set the 
+        ItemAcceptsInputMethod GraphicsItem flag directly.
+
+        Changed the existing input method auto test to run once
+        on a QWebView and once on a QGraphicsWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::setInputMethodEnabled):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods_data):
+        (inputMethodHints):
+        (inputMethodEnabled):
+        (tst_QWebPage::inputMethods):
+
+2009-11-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        Added QGraphicsWebView::modified property, for consistency
+        with QWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::isModified):
+        * Api/qgraphicswebview.h:
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::qgraphicswebview):
+
+2009-11-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        Removed status and progress properties of QGraphicsWebView.
+        Added loadProgress and statusBarMessage signals instead,
+        after API review.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::QGraphicsWebViewPrivate):
+        (QGraphicsWebView::setPage):
+        * Api/qgraphicswebview.h:
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::qgraphicswebview):
+
+2009-11-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] REGRESSION: Allow applications to use their own QWidget bypassing QWebView.
+        https://bugs.webkit.org/show_bug.cgi?id=30979
+
+        Decouple QWebViewPrivate from QWebPageClient, and automatically create
+        QWebPageWidgetClient whenever the view is QWidget based.
+
+        * Api/qwebpage.cpp:
+        (QWebPageWidgetClient::QWebPageWidgetClient):
+        (QWebPageWidgetClient::scroll):
+        (QWebPageWidgetClient::update):
+        (QWebPageWidgetClient::setInputMethodEnabled):
+        (QWebPageWidgetClient::setInputMethodHint):
+        (QWebPageWidgetClient::cursor):
+        (QWebPageWidgetClient::updateCursor):
+        (QWebPageWidgetClient::palette):
+        (QWebPageWidgetClient::screenNumber):
+        (QWebPageWidgetClient::ownerWidget):
+        (QWebPageWidgetClient::pluginParent):
+        (QWebPage::setView):
+        * Api/qwebview.cpp:
+        (QWebView::~QWebView):
+        (QWebView::setPage):
+        (QWebView::event):
+
+2009-11-03  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix build of unit-test after r50454.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make QWebPluginDatabase private API for now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30775
+
+        * Api/headers.pri:
+        * Api/qwebplugindatabase.cpp:
+        * Api/qwebplugindatabase_p.h: Renamed from WebKit/qt/Api/qwebplugindatabase.h.
+        * Api/qwebsettings.cpp:
+        * Api/qwebsettings.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::setupUI):
+        * tests/tests.pro:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Oops, also remove the API docs of the removed networkRequestStarted() signal.
+
+        * Api/qwebpage.cpp:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Replace the QWebPage::networkRequestStarted() signal with the originatingObject
+        property set to the QWebFrame that belongs to the request.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction):
+        (WebCore::FrameLoaderClientQt::startDownload):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::loadFinished):
+        (TestNetworkManager::createRequest):
+        (tst_QWebPage::originatingObjectInNetworkRequests):
+
+2009-11-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        QWebView crash fix.
+
+        The QWebView should not crash if the stop() method is called from
+        a function triggered by the loadProgress signal.
+
+        A null pointer protection was added in the ProgressTracker::incrementProgress.
+
+        New autotest was created.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29425
+
+        * tests/qwebview/tst_qwebview.cpp:
+        (WebViewCrashTest::WebViewCrashTest):
+        (WebViewCrashTest::loading):
+        (tst_QWebView::crashTests):
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate): Reorder initialization list 
+        to fix compiler warnings.
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::FrameLoaderClientQt): Ditto.
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        Added stub implementation for new ChromeClient function.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::focusedNodeChanged):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2009-10-30  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Remove the QWebInspector::windowTitleChanged signal,
+        QEvent::WindowTitleChange can be used to achieve the same.
+        https://bugs.webkit.org/show_bug.cgi?id=30927
+
+        * Api/qwebinspector.cpp:
+        * Api/qwebinspector.h:
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::updateWindowTitle):
+
+2009-10-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Implement DELETE HTTP method for XmlHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=30894
+
+        No new tests as this functionality is already tested by the
+        xmlhttprequest LayoutTests. As this patch depends on an unreleased
+        version of the dependent QtNetwork library and the tests will be
+        enabled later once the dependent library is released (and the
+        buildbot is updated).
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::load):
+
+2009-10-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Remove QWebView::guessUrlFromString() and replace its use
+        with the new QUrl::fromUserInput() if using Qt 4.6 or newer.
+
+        * Api/qwebview.cpp:
+        * Api/qwebview.h:
+        * QGVLauncher/main.cpp:
+        (urlFromUserInput):
+        (WebPage::applyProxy):
+        (MainWindow::load):
+        * QtLauncher/main.cpp:
+        (urlFromUserInput):
+        (MainWindow::MainWindow):
+        (MainWindow::changeLocation):
+        * tests/qwebview/tst_qwebview.cpp:
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Serialize directly to the stream, and not first to an QByteArray,
+        that is later serialized. That is slower and also uses more bytes.
+
+        * Api/qwebhistory.cpp:
+        (operator<<):
+        (operator>>):
+
 2009-10-28  Shinichiro Hamaji  <hamaji@chromium.org>
 
         Reviewed by Eric Seidel.
diff --git a/WebKit/qt/Plugins/ICOHandler.cpp b/WebKit/qt/Plugins/ICOHandler.cpp
deleted file mode 100644
index d7fae07..0000000
--- a/WebKit/qt/Plugins/ICOHandler.cpp
+++ /dev/null
@@ -1,460 +0,0 @@
-/*
- * kimgio import filter for MS Windows .ico files
- *
- * Distributed under the terms of the LGPL
- * Copyright (c) 2000 Malte Starostik <malte@kde.org>
- *
- */
-
-#include "config.h"
-#include "ICOHandler.h"
-
-#include <cstring>
-#include <cstdlib>
-#include <algorithm>
-#include <vector>
-
-#include <QtGui/QImage>
-#include <QtGui/QBitmap>
-#include <QtGui/QApplication>
-#include <QtCore/QVector>
-#include <QtGui/QDesktopWidget>
-
-namespace
-{
-    // Global header (see http://www.daubnet.com/formats/ICO.html)
-    struct IcoHeader
-    {
-        enum Type { Icon = 1, Cursor };
-        quint16 reserved;
-        quint16 type;
-        quint16 count;
-    };
-
-    inline QDataStream& operator >>( QDataStream& s, IcoHeader& h )
-    {
-        return s >> h.reserved >> h.type >> h.count;
-    }
-
-    // Based on qt_read_dib et al. from qimage.cpp
-    // (c) 1992-2002 Nokia Corporation and/or its subsidiary(-ies).
-    struct BMP_INFOHDR
-    {
-        static const quint32 Size = 40;
-        quint32  biSize;                // size of this struct
-        quint32  biWidth;               // pixmap width
-        quint32  biHeight;              // pixmap height
-        quint16  biPlanes;              // should be 1
-        quint16  biBitCount;            // number of bits per pixel
-        enum Compression { RGB = 0 };
-        quint32  biCompression;         // compression method
-        quint32  biSizeImage;           // size of image
-        quint32  biXPelsPerMeter;       // horizontal resolution
-        quint32  biYPelsPerMeter;       // vertical resolution
-        quint32  biClrUsed;             // number of colors used
-        quint32  biClrImportant;        // number of important colors
-    };
-    const quint32 BMP_INFOHDR::Size;
-
-    QDataStream& operator >>( QDataStream &s, BMP_INFOHDR &bi )
-    {
-        s >> bi.biSize;
-        if ( bi.biSize == BMP_INFOHDR::Size )
-        {
-            s >> bi.biWidth >> bi.biHeight >> bi.biPlanes >> bi.biBitCount;
-            s >> bi.biCompression >> bi.biSizeImage;
-            s >> bi.biXPelsPerMeter >> bi.biYPelsPerMeter;
-            s >> bi.biClrUsed >> bi.biClrImportant;
-        }
-        return s;
-    }
-
-#if 0
-    QDataStream &operator<<( QDataStream &s, const BMP_INFOHDR &bi )
-    {
-        s << bi.biSize;
-        s << bi.biWidth << bi.biHeight;
-        s << bi.biPlanes;
-        s << bi.biBitCount;
-        s << bi.biCompression;
-        s << bi.biSizeImage;
-        s << bi.biXPelsPerMeter << bi.biYPelsPerMeter;
-        s << bi.biClrUsed << bi.biClrImportant;
-        return s;
-    }
-#endif
-
-    // Header for every icon in the file
-    struct IconRec
-    {
-        unsigned char width;
-        unsigned char height;
-        quint16 colors;
-        quint16 hotspotX;
-        quint16 hotspotY;
-        quint32 size;
-        quint32 offset;
-    };
-
-    inline QDataStream& operator >>( QDataStream& s, IconRec& r )
-    {
-        return s >> r.width >> r.height >> r.colors
-                 >> r.hotspotX >> r.hotspotY >> r.size >> r.offset;
-    }
-
-    struct LessDifference
-    {
-        LessDifference( unsigned s, unsigned c )
-            : size( s ), colors( c ) {}
-
-        bool operator ()( const IconRec& lhs, const IconRec& rhs ) const
-        {
-            // closest size match precedes everything else
-            if ( std::abs( int( lhs.width - size ) ) <
-                 std::abs( int( rhs.width - size ) ) ) return true;
-            else if ( std::abs( int( lhs.width - size ) ) >
-                 std::abs( int( rhs.width - size ) ) ) return false;
-            else if ( colors == 0 )
-            {
-                // high/true color requested
-                if ( lhs.colors == 0 ) return true;
-                else if ( rhs.colors == 0 ) return false;
-                else return lhs.colors > rhs.colors;
-            }
-            else
-            {
-                // indexed icon requested
-                if ( lhs.colors == 0 && rhs.colors == 0 ) return false;
-                else if ( lhs.colors == 0 ) return false;
-                else return std::abs( int( lhs.colors - colors ) ) <
-                            std::abs( int( rhs.colors - colors ) );
-            }
-        }
-        unsigned size;
-        unsigned colors;
-    };
-
-    bool loadFromDIB( QDataStream& stream, const IconRec& rec, QImage& icon )
-    {
-        BMP_INFOHDR header;
-        stream >> header;
-        if ( stream.atEnd() || header.biSize != BMP_INFOHDR::Size ||
-             header.biSize > rec.size ||
-             header.biCompression != BMP_INFOHDR::RGB ||
-             ( header.biBitCount != 1 && header.biBitCount != 4 &&
-               header.biBitCount != 8 && header.biBitCount != 24 &&
-               header.biBitCount != 32 ) ) return false;
-
-        unsigned paletteSize, paletteEntries;
-
-        if (header.biBitCount > 8)
-        {
-            paletteEntries = 0;
-            paletteSize    = 0;
-        }
-        else
-        {
-            paletteSize    = (1 << header.biBitCount);
-            paletteEntries = paletteSize;
-            if (header.biClrUsed && header.biClrUsed < paletteSize)
-                paletteEntries = header.biClrUsed;
-        }
-
-        // Always create a 32-bit image to get the mask right
-        // Note: this is safe as rec.width, rec.height are bytes
-        icon = QImage( rec.width, rec.height, QImage::Format_ARGB32 );
-        if ( icon.isNull() ) return false;
-
-        QVector< QRgb > colorTable( paletteSize );
-
-        colorTable.fill( QRgb( 0 ) );
-        for ( unsigned i = 0; i < paletteEntries; ++i )
-        {
-            unsigned char rgb[ 4 ];
-            stream.readRawData( reinterpret_cast< char* >( &rgb ),
-                                 sizeof( rgb ) );
-            colorTable[ i ] = qRgb( rgb[ 2 ], rgb[ 1 ], rgb[ 0 ] );
-        }
-
-        unsigned bpl = ( rec.width * header.biBitCount + 31 ) / 32 * 4;
-
-        unsigned char* buf = new unsigned char[ bpl ];
-        for ( unsigned y = rec.height; !stream.atEnd() && y--; )
-        {
-            stream.readRawData( reinterpret_cast< char* >( buf ), bpl );
-            unsigned char* pixel = buf;
-            QRgb* p = reinterpret_cast< QRgb* >( icon.scanLine( y ) );
-            switch ( header.biBitCount )
-            {
-                case 1:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = colorTable[
-                            ( pixel[ x / 8 ] >> ( 7 - ( x & 0x07 ) ) ) & 1 ];
-                    break;
-                case 4:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        if ( x & 1 ) *p++ = colorTable[ pixel[ x / 2 ] & 0x0f ];
-                        else *p++ = colorTable[ pixel[ x / 2 ] >> 4 ];
-                    break;
-                case 8:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = colorTable[ pixel[ x ] ];
-                    break;
-                case 24:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = qRgb( pixel[ 3 * x + 2 ],
-                                     pixel[ 3 * x + 1 ],
-                                     pixel[ 3 * x ] );
-                    break;
-                case 32:
-                    for ( unsigned x = 0; x < rec.width; ++x )
-                        *p++ = qRgba( pixel[ 4 * x + 2 ],
-                                      pixel[ 4 * x + 1 ],
-                                      pixel[ 4 * x ],
-                                      pixel[ 4 * x  + 3] );
-                    break;
-            }
-        }
-        delete[] buf;
-
-        if ( header.biBitCount < 32 )
-        {
-            // Traditional 1-bit mask
-            bpl = ( rec.width + 31 ) / 32 * 4;
-            buf = new unsigned char[ bpl ];
-            for ( unsigned y = rec.height; y--; )
-            {
-                stream.readRawData( reinterpret_cast< char* >( buf ), bpl );
-                QRgb* p = reinterpret_cast< QRgb* >( icon.scanLine( y ) );
-                for ( unsigned x = 0; x < rec.width; ++x, ++p )
-                    if ( ( ( buf[ x / 8 ] >> ( 7 - ( x & 0x07 ) ) ) & 1 ) )
-                        *p &= RGB_MASK;
-            }
-            delete[] buf;
-        }
-        return true;
-    }
-}
-
-ICOHandler::ICOHandler()
-{
-}
-
-bool ICOHandler::canRead() const
-{
-    return canRead(device());
-}
-
-bool ICOHandler::read(QImage *outImage)
-{
-
-    qint64 offset = device()->pos();
-
-    QDataStream stream( device() );
-    stream.setByteOrder( QDataStream::LittleEndian );
-    IcoHeader header;
-    stream >> header;
-    if ( stream.atEnd() || !header.count ||
-         ( header.type != IcoHeader::Icon && header.type != IcoHeader::Cursor) )
-        return false;
-
-    unsigned requestedSize = 32;
-    unsigned requestedColors =  QApplication::desktop()->depth() > 8 ? 0 : QApplication::desktop()->depth();
-    int requestedIndex = -1;
-#if 0
-    if ( io->parameters() )
-    {
-        QStringList params = QString(io->parameters()).split( ';', QString::SkipEmptyParts );
-        QMap< QString, QString > options;
-        for ( QStringList::ConstIterator it = params.begin();
-              it != params.end(); ++it )
-        {
-            QStringList tmp = (*it).split( '=', QString::SkipEmptyParts );
-            if ( tmp.count() == 2 ) options[ tmp[ 0 ] ] = tmp[ 1 ];
-        }
-        if ( options[ "index" ].toUInt() )
-            requestedIndex = options[ "index" ].toUInt();
-        if ( options[ "size" ].toUInt() )
-            requestedSize = options[ "size" ].toUInt();
-        if ( options[ "colors" ].toUInt() )
-            requestedColors = options[ "colors" ].toUInt();
-    }
-#endif
-
-    typedef std::vector< IconRec > IconList;
-    IconList icons;
-    for ( unsigned i = 0; i < header.count; ++i )
-    {
-        if ( stream.atEnd() )
-            return false;
-        IconRec rec;
-        stream >> rec;
-        icons.push_back( rec );
-    }
-    IconList::const_iterator selected;
-    if (requestedIndex >= 0) {
-        selected = std::min( icons.begin() + requestedIndex, icons.end() );
-    } else {
-        selected = std::min_element( icons.begin(), icons.end(),
-                                     LessDifference( requestedSize, requestedColors ) );
-    }
-    if ( stream.atEnd() || selected == icons.end() ||
-         offset + selected->offset > device()->size() )
-        return false;
-
-    device()->seek( offset + selected->offset );
-    QImage icon;
-    if ( loadFromDIB( stream, *selected, icon ) )
-    {
-#ifndef QT_NO_IMAGE_TEXT
-        icon.setText( "X-Index", 0, QString::number( selected - icons.begin() ) );
-        if ( header.type == IcoHeader::Cursor )
-        {
-            icon.setText( "X-HotspotX", 0, QString::number( selected->hotspotX ) );
-            icon.setText( "X-HotspotY", 0, QString::number( selected->hotspotY ) );
-        }
-#endif
-        *outImage = icon;
-        return true;
-    }
-    return false;
-}
-
-bool ICOHandler::write(const QImage &/*image*/)
-{
-#if 0
-    if (image.isNull())
-        return;
-
-    QByteArray dibData;
-    QDataStream dib(dibData, QIODevice::ReadWrite);
-    dib.setByteOrder(QDataStream::LittleEndian);
-
-    QImage pixels = image;
-    QImage mask;
-    if (io->image().hasAlphaBuffer())
-        mask = image.createAlphaMask();
-    else
-        mask = image.createHeuristicMask();
-    mask.invertPixels();
-    for ( int y = 0; y < pixels.height(); ++y )
-        for ( int x = 0; x < pixels.width(); ++x )
-            if ( mask.pixel( x, y ) == 0 ) pixels.setPixel( x, y, 0 );
-
-    if (!qt_write_dib(dib, pixels))
-        return;
-
-   uint hdrPos = dib.device()->at();
-    if (!qt_write_dib(dib, mask))
-        return;
-    memmove(dibData.data() + hdrPos, dibData.data() + hdrPos + BMP_WIN + 8, dibData.size() - hdrPos - BMP_WIN - 8);
-    dibData.resize(dibData.size() - BMP_WIN - 8);
-
-    QDataStream ico(device());
-    ico.setByteOrder(QDataStream::LittleEndian);
-    IcoHeader hdr;
-    hdr.reserved = 0;
-    hdr.type = Icon;
-    hdr.count = 1;
-    ico << hdr.reserved << hdr.type << hdr.count;
-    IconRec rec;
-    rec.width = image.width();
-    rec.height = image.height();
-    if (image.numColors() <= 16)
-        rec.colors = 16;
-    else if (image.depth() <= 8)
-        rec.colors = 256;
-    else
-        rec.colors = 0;
-    rec.hotspotX = 0;
-    rec.hotspotY = 0;
-    rec.dibSize = dibData.size();
-    ico << rec.width << rec.height << rec.colors
-        << rec.hotspotX << rec.hotspotY << rec.dibSize;
-    rec.dibOffset = ico.device()->at() + sizeof(rec.dibOffset);
-    ico << rec.dibOffset;
-
-    BMP_INFOHDR dibHeader;
-    dib.device()->at(0);
-    dib >> dibHeader;
-    dibHeader.biHeight = image.height() << 1;
-    dib.device()->at(0);
-    dib << dibHeader;
-
-    ico.writeRawBytes(dibData.data(), dibData.size());
-    return true;
-#endif
-    return false;
-}
-
-QByteArray ICOHandler::name() const
-{
-    return "ico";
-}
-
-bool ICOHandler::canRead(QIODevice *device)
-{
-    if (!device) {
-        qWarning("ICOHandler::canRead() called with no device");
-        return false;
-    }
-
-    const qint64 oldPos = device->pos();
-
-    char head[8];
-    qint64 readBytes = device->read(head, sizeof(head));
-    const bool readOk = readBytes == sizeof(head);
-
-    if (device->isSequential()) {
-        while (readBytes > 0)
-            device->ungetChar(head[readBytes-- - 1]);
-    } else {
-        device->seek(oldPos);
-    }
-
-    if ( !readOk )
-        return false;
-
-    return head[2] == '\001' && head[3] == '\000' && // type should be 1
-        ( head[6] == 16 || head[6] == 32 || head[6] == 64 ) && // width can only be one of those
-        ( head[7] == 16 || head[7] == 32 || head[7] == 64 );   // same for height
-}
-
-class ICOPlugin : public QImageIOPlugin
-{
-public:
-    QStringList keys() const;
-    Capabilities capabilities(QIODevice *device, const QByteArray &format) const;
-    QImageIOHandler *create(QIODevice *device, const QByteArray &format = QByteArray()) const;
-};
-
-QStringList ICOPlugin::keys() const
-{
-    return QStringList() << "ico" << "ICO";
-}
-
-QImageIOPlugin::Capabilities ICOPlugin::capabilities(QIODevice *device, const QByteArray &format) const
-{
-    if (format == "ico" || format == "ICO")
-        return Capabilities(CanRead);
-    if (!format.isEmpty())
-        return 0;
-    if (!device->isOpen())
-        return 0;
-
-    Capabilities cap;
-    if (device->isReadable() && ICOHandler::canRead(device))
-        cap |= CanRead;
-    return cap;
-}
-
-QImageIOHandler *ICOPlugin::create(QIODevice *device, const QByteArray &format) const
-{
-    QImageIOHandler *handler = new ICOHandler;
-    handler->setDevice(device);
-    handler->setFormat(format);
-    return handler;
-}
-
-Q_EXPORT_STATIC_PLUGIN(ICOPlugin)
-Q_EXPORT_PLUGIN2(qtwebico, ICOPlugin)
diff --git a/WebKit/qt/Plugins/ICOHandler.h b/WebKit/qt/Plugins/ICOHandler.h
deleted file mode 100644
index 4f1f1d6..0000000
--- a/WebKit/qt/Plugins/ICOHandler.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * ico.h - kimgio import filter for MS Windows .ico files
- *
- * Distributed under the terms of the LGPL
- * Copyright (c) 2000 Malte Starostik <malte@kde.org>
- *
- */
-
-// You can use QImageIO::setParameters() to request a specific
-// Icon out of an .ico file:
-//
-// Options consist of a name=value pair and are separated by a semicolon.
-// Available options are:
-//     size=<size>   select the icon that most closely matches <size> (pixels)
-//                   default: 32
-//     colors=<num>  select the icon that has <num> colors (or comes closest)
-//                   default: 1 << display depth or 0 (RGB) if display depth > 8
-//     index=<index> select the indexth icon from the file. If this option
-//                   is present, the size and colors options will be ignored.
-//                   default: none
-// If both size and colors are given, size takes precedence.
-//
-// The old format is still supported:
-//     the parameters consist of a single string in the form
-//     "<size>[:<colors>]" which correspond to the options above
-//
-// If an icon was returned (i.e. the file is valid and the index option
-// if present was not out of range), the icon's index within the .ico
-// file is returned in the text tag "X-Index" of the image.
-// If the icon is in fact a cursor, its hotspot coordinates are returned
-// in the text tags "X-HotspotX" and "X-HotspotY".
-
-#ifndef _ICOHANDLER_H_
-#define _ICOHANDLER_H_
-
-#include <QtGui/QImageIOPlugin>
-
-class ICOHandler : public QImageIOHandler
-{
-public:
-    ICOHandler();
-
-    bool canRead() const;
-    bool read(QImage *image);
-    bool write(const QImage &image);
-
-    QByteArray name() const;
-
-    static bool canRead(QIODevice *device);
-};
-
-#endif
diff --git a/WebKit/qt/Plugins/Plugins.pro b/WebKit/qt/Plugins/Plugins.pro
deleted file mode 100644
index a9b4f82..0000000
--- a/WebKit/qt/Plugins/Plugins.pro
+++ /dev/null
@@ -1,14 +0,0 @@
-TEMPLATE = lib
-TARGET = qtwebico
-CONFIG += plugin
-HEADERS += ICOHandler.h
-SOURCES += ICOHandler.cpp
-
-include(../../WebKit.pri)
-
-contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols 
-unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
-
-target.path = $$[QT_INSTALL_PLUGINS]/imageformats
-INSTALLS += target
-
diff --git a/WebKit/qt/QGVLauncher/main.cpp b/WebKit/qt/QGVLauncher/main.cpp
index 3632a33..2021cb6 100644
--- a/WebKit/qt/QGVLauncher/main.cpp
+++ b/WebKit/qt/QGVLauncher/main.cpp
@@ -50,6 +50,20 @@
 #include <qwebsettings.h>
 #include <qwebview.h>
 
+static QUrl urlFromUserInput(const QString& string)
+{
+    QString input(string);
+    QFileInfo fi(input);
+    if (fi.exists() && fi.isRelative())
+        input = fi.absoluteFilePath();
+
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    return QUrl::fromUserInput(input);
+#else
+    return QUrl(input);
+#endif
+}
+
 class WebView : public QGraphicsWebView {
     Q_OBJECT
     Q_PROPERTY(qreal yRotation READ yRotation WRITE setYRotation)
@@ -93,7 +107,7 @@ public:
 private:
     void applyProxy()
     {
-        QUrl proxyUrl = QWebView::guessUrlFromString(qgetenv("http_proxy"));
+        QUrl proxyUrl = urlFromUserInput(qgetenv("http_proxy"));
 
         if (proxyUrl.isValid() && !proxyUrl.host().isEmpty()) {
             int proxyPort = (proxyUrl.port() > 0) ? proxyUrl.port() : 8080;
@@ -278,7 +292,7 @@ public:
 
     void load(const QString& url)
     {
-        QUrl deducedUrl = guessUrlFromString(url);
+        QUrl deducedUrl = urlFromUserInput(url);
         if (!deducedUrl.isValid())
             deducedUrl = QUrl("http://" + url + "/");
 
@@ -287,16 +301,6 @@ public:
         scene->webView()->setFocus(Qt::OtherFocusReason);
     }
 
-    QUrl guessUrlFromString(const QString& string)
-    {
-        QString input(string);
-        QFileInfo fi(input);
-        if (fi.exists() && fi.isRelative())
-            input = fi.absoluteFilePath();
-
-        return QWebView::guessUrlFromString(input);
-    }
-
     QWebPage* page() const
     {
         return scene->webView()->page();
diff --git a/WebKit/qt/QtLauncher/main.cpp b/WebKit/qt/QtLauncher/main.cpp
index e3c6116..2286712 100644
--- a/WebKit/qt/QtLauncher/main.cpp
+++ b/WebKit/qt/QtLauncher/main.cpp
@@ -30,18 +30,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <qwebpage.h>
-#include <qwebview.h>
-#include <qwebframe.h>
-#include <qwebsettings.h>
-#include <qwebplugindatabase.h>
-#include <qwebelement.h>
-#include <qwebinspector.h>
-
 #include <QtGui>
-#include <QDebug>
 #include <QtNetwork/QNetworkProxy>
-#if QT_VERSION >= 0x040400 && !defined(QT_NO_PRINTER)
+#include <QtNetwork/QNetworkRequest>
+#if !defined(QT_NO_PRINTER)
 #include <QPrintPreviewDialog>
 #endif
 
@@ -49,17 +41,78 @@
 #include <QtUiTools/QUiLoader>
 #endif
 
-#include <QVector>
-#include <QTextStream>
+#include <QDebug>
 #include <QFile>
+#include <QTextStream>
+#include <QVector>
+
 #include <cstdio>
+#include <qwebelement.h>
+#include <qwebframe.h>
+#include <qwebinspector.h>
+#include <qwebpage.h>
+#include <qwebsettings.h>
+#include <qwebview.h>
+
 
 #ifndef NDEBUG
 void QWEBKIT_EXPORT qt_drt_garbageCollector_collect();
 #endif
 
-class WebPage : public QWebPage
+static QUrl urlFromUserInput(const QString& input)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    return QUrl::fromUserInput(input);
+#else
+    return QUrl(input);
+#endif
+}
+
+class WebView : public QWebView {
+    Q_OBJECT
+public:
+    WebView(QWidget* parent) : QWebView(parent) {}
+
+protected:
+    virtual void contextMenuEvent(QContextMenuEvent* event)
+    {
+        QMenu* menu = page()->createStandardContextMenu();
+
+        QWebHitTestResult r = page()->mainFrame()->hitTestContent(event->pos());
+
+        if (!r.linkUrl().isEmpty()) {
+            QAction* newTabAction = menu->addAction(tr("Open in Default &Browser"), this, SLOT(openUrlInDefaultBrowser()));
+            newTabAction->setData(r.linkUrl());
+            menu->insertAction(menu->actions().at(2), newTabAction);
+        }
+
+        menu->exec(mapToGlobal(event->pos()));
+        delete menu;
+    }
+
+    virtual void mousePressEvent(QMouseEvent* event)
+    {
+        mouseButtons = event->buttons();
+        keyboardModifiers = event->modifiers();
+
+        QWebView::mousePressEvent(event);
+    }
+
+public slots:
+    void openUrlInDefaultBrowser(const QUrl &url = QUrl())
+    {
+        if (QAction* action = qobject_cast<QAction*>(sender()))
+            QDesktopServices::openUrl(action->data().toUrl());
+        else
+            QDesktopServices::openUrl(url);
+    }
+
+public:
+    Qt::MouseButtons mouseButtons;
+    Qt::KeyboardModifiers keyboardModifiers;
+};
+
+class WebPage : public QWebPage {
 public:
     WebPage(QWidget *parent) : QWebPage(parent) {}
 
@@ -72,13 +125,49 @@ public:
         return false;
     }
     virtual bool extension(Extension extension, const ExtensionOption *option, ExtensionReturn *output);
+
+
+    virtual bool acceptNavigationRequest(QWebFrame* frame, const QNetworkRequest &request, NavigationType type)
+    {
+        WebView* webView = static_cast<WebView*>(view());
+        if (webView->keyboardModifiers & Qt::ShiftModifier) {
+            QWebPage* page = createWindow(QWebPage::WebBrowserWindow);
+            page->mainFrame()->load(request);
+            return false;
+        }
+        if (webView->keyboardModifiers & Qt::AltModifier) {
+            webView->openUrlInDefaultBrowser(request.url());
+            return false;
+        }
+
+        return QWebPage::acceptNavigationRequest(frame, request, type);
+    }
 };
 
-class MainWindow : public QMainWindow
-{
+class WebInspector : public QWebInspector {
     Q_OBJECT
 public:
-    MainWindow(QString url = QString()): currentZoom(100) {
+    WebInspector(QWidget* parent) : QWebInspector(parent) {}
+signals:
+    void visibleChanged(bool nowVisible);
+protected:
+    void showEvent(QShowEvent* event)
+    {
+        QWebInspector::showEvent(event);
+        emit visibleChanged(true);
+    }
+    void hideEvent(QHideEvent* event)
+    {
+        QWebInspector::hideEvent(event);
+        emit visibleChanged(false);
+    }
+};
+
+class MainWindow : public QMainWindow {
+    Q_OBJECT
+public:
+    MainWindow(QString url = QString()): currentZoom(100)
+    {
         setAttribute(Qt::WA_DeleteOnClose);
         if (qgetenv("QTLAUNCHER_USE_ARGB_VISUALS").toInt() == 1)
             setAttribute(Qt::WA_TranslucentBackground);
@@ -86,7 +175,7 @@ public:
         QSplitter* splitter = new QSplitter(Qt::Vertical, this);
         setCentralWidget(splitter);
 
-        view = new QWebView(splitter);
+        view = new WebView(splitter);
         WebPage* page = new WebPage(view);
         view->setPage(page);
         connect(view, SIGNAL(loadFinished(bool)),
@@ -97,16 +186,16 @@ public:
                 this, SLOT(showLinkHover(const QString&, const QString&)));
         connect(view->page(), SIGNAL(windowCloseRequested()), this, SLOT(close()));
 
-        inspector = new QWebInspector(splitter);
+        inspector = new WebInspector(splitter);
         inspector->setPage(page);
         inspector->hide();
         connect(this, SIGNAL(destroyed()), inspector, SLOT(deleteLater()));
-        connect(page, SIGNAL(webInspectorTriggered(const QWebElement&)), inspector, SLOT(show()));
 
         setupUI();
 
         // set the proxy to the http_proxy env variable - if present
-        QUrl proxyUrl = view->guessUrlFromString(qgetenv("http_proxy"));
+        QUrl proxyUrl = urlFromUserInput(qgetenv("http_proxy"));
+
         if (proxyUrl.isValid() && !proxyUrl.host().isEmpty()) {
             int proxyPort = (proxyUrl.port() > 0)  ? proxyUrl.port() : 8080;
             page->networkAccessManager()->setProxy(QNetworkProxy(QNetworkProxy::HttpProxy, proxyUrl.host(), proxyPort));
@@ -116,11 +205,12 @@ public:
         if (fi.exists() && fi.isRelative())
             url = fi.absoluteFilePath();
 
-        QUrl qurl = view->guessUrlFromString(url);
+        QUrl qurl = urlFromUserInput(url);
+        if (qurl.scheme().isEmpty())
+            qurl = QUrl("http://" + url + "/");
         if (qurl.isValid()) {
             urlEdit->setText(qurl.toEncoded());
             view->load(qurl);
-
         }
 
         // the zoom values are chosen to be like in Mozilla Firefox 3
@@ -129,27 +219,33 @@ public:
         zoomLevels << 110 << 120 << 133 << 150 << 170 << 200 << 240 << 300;
     }
 
-    QWebPage* webPage() const {
+    QWebPage* webPage() const
+    {
         return view->page();
     }
 
-    QWebView* webView() const {
+    QWebView* webView() const
+    {
         return view;
     }
 
 protected slots:
 
-    void changeLocation() {
+    void changeLocation()
+    {
         QString string = urlEdit->text();
-        QUrl url = view->guessUrlFromString(string);
-        if (!url.isValid())
+        QUrl url = urlFromUserInput(string);
+        if (url.scheme().isEmpty())
             url = QUrl("http://" + string + "/");
-        urlEdit->setText(url.toEncoded());
-        view->load(url);
-        view->setFocus(Qt::OtherFocusReason);
+        if (url.isValid()) {
+            urlEdit->setText(url.toEncoded());
+            view->load(url);
+            view->setFocus(Qt::OtherFocusReason);
+        }
     }
 
-    void loadFinished() {
+    void loadFinished()
+    {
         urlEdit->setText(view->url().toString());
 
         QUrl::FormattingOptions opts;
@@ -166,7 +262,8 @@ protected slots:
         urlModel.setStringList(urlList);
     }
 
-    void showLinkHover(const QString &link, const QString &toolTip) {
+    void showLinkHover(const QString &link, const QString &toolTip)
+    {
         statusBar()->showMessage(link);
 #ifndef QT_NO_TOOLTIP
         if (!toolTip.isEmpty())
@@ -174,22 +271,24 @@ protected slots:
 #endif
     }
 
-    void zoomIn() {
+    void zoomIn()
+    {
         int i = zoomLevels.indexOf(currentZoom);
         Q_ASSERT(i >= 0);
         if (i < zoomLevels.count() - 1)
             currentZoom = zoomLevels[i + 1];
 
-        view->setZoomFactor(qreal(currentZoom)/100.0);
+        view->setZoomFactor(qreal(currentZoom) / 100.0);
     }
 
-    void zoomOut() {
+    void zoomOut()
+    {
         int i = zoomLevels.indexOf(currentZoom);
         Q_ASSERT(i >= 0);
         if (i > 0)
             currentZoom = zoomLevels[i - 1];
 
-        view->setZoomFactor(qreal(currentZoom)/100.0);
+        view->setZoomFactor(qreal(currentZoom) / 100.0);
     }
 
     void resetZoom()
@@ -203,8 +302,9 @@ protected slots:
         view->page()->settings()->setAttribute(QWebSettings::ZoomTextOnly, b);
     }
 
-    void print() {
-#if QT_VERSION >= 0x040400 && !defined(QT_NO_PRINTER)
+    void print()
+    {
+#if !defined(QT_NO_PRINTER)
         QPrintPreviewDialog dlg(this);
         connect(&dlg, SIGNAL(paintRequested(QPrinter *)),
                 view, SLOT(print(QPrinter *)));
@@ -228,11 +328,13 @@ protected slots:
         }
     }
 
-    void setEditable(bool on) {
+    void setEditable(bool on)
+    {
         view->page()->setContentEditable(on);
         formatMenuAction->setVisible(on);
     }
 
+    /*
     void dumpPlugins() {
         QList<QWebPluginInfo> plugins = QWebSettings::pluginDatabase()->plugins();
         foreach (const QWebPluginInfo plugin, plugins) {
@@ -242,12 +344,15 @@ protected slots:
             }
         }
     }
+    */
 
-    void dumpHtml() {
+    void dumpHtml()
+    {
         qDebug() << "HTML: " << view->page()->mainFrame()->toHtml();
     }
 
-    void selectElements() {
+    void selectElements()
+    {
         bool ok;
         QString str = QInputDialog::getText(this, "Select elements", "Choose elements",
                                             QLineEdit::Normal, "a", &ok);
@@ -262,8 +367,9 @@ protected slots:
 
 public slots:
 
-    void newWindow(const QString &url = QString()) {
-        MainWindow *mw = new MainWindow(url);
+    void newWindow(const QString &url = QString())
+    {
+        MainWindow* mw = new MainWindow(url);
         mw->show();
     }
 
@@ -273,7 +379,8 @@ private:
     int currentZoom;
 
     // create the status bar, tool bar & menu
-    void setupUI() {
+    void setupUI()
+    {
         progress = new QProgressBar(this);
         progress->setRange(0, 100);
         progress->setMinimumSize(100, 20);
@@ -289,26 +396,24 @@ private:
         urlEdit->setSizePolicy(QSizePolicy::Expanding, urlEdit->sizePolicy().verticalPolicy());
         connect(urlEdit, SIGNAL(returnPressed()),
                 SLOT(changeLocation()));
-        QCompleter *completer = new QCompleter(this);
+        QCompleter* completer = new QCompleter(this);
         urlEdit->setCompleter(completer);
         completer->setModel(&urlModel);
 
-        QToolBar *bar = addToolBar("Navigation");
+        QToolBar* bar = addToolBar("Navigation");
         bar->addAction(view->pageAction(QWebPage::Back));
         bar->addAction(view->pageAction(QWebPage::Forward));
         bar->addAction(view->pageAction(QWebPage::Reload));
         bar->addAction(view->pageAction(QWebPage::Stop));
         bar->addWidget(urlEdit);
 
-        QMenu *fileMenu = menuBar()->addMenu("&File");
-        QAction *newWindow = fileMenu->addAction("New Window", this, SLOT(newWindow()));
-#if QT_VERSION >= 0x040400
+        QMenu* fileMenu = menuBar()->addMenu("&File");
+        QAction* newWindow = fileMenu->addAction("New Window", this, SLOT(newWindow()));
         fileMenu->addAction(tr("Print"), this, SLOT(print()), QKeySequence::Print);
-#endif
         QAction* screenshot = fileMenu->addAction("Screenshot", this, SLOT(screenshot()));
         fileMenu->addAction("Close", this, SLOT(close()));
 
-        QMenu *editMenu = menuBar()->addMenu("&Edit");
+        QMenu* editMenu = menuBar()->addMenu("&Edit");
         editMenu->addAction(view->pageAction(QWebPage::Undo));
         editMenu->addAction(view->pageAction(QWebPage::Redo));
         editMenu->addSeparator();
@@ -316,30 +421,30 @@ private:
         editMenu->addAction(view->pageAction(QWebPage::Copy));
         editMenu->addAction(view->pageAction(QWebPage::Paste));
         editMenu->addSeparator();
-        QAction *setEditable = editMenu->addAction("Set Editable", this, SLOT(setEditable(bool)));
+        QAction* setEditable = editMenu->addAction("Set Editable", this, SLOT(setEditable(bool)));
         setEditable->setCheckable(true);
 
-        QMenu *viewMenu = menuBar()->addMenu("&View");
+        QMenu* viewMenu = menuBar()->addMenu("&View");
         viewMenu->addAction(view->pageAction(QWebPage::Stop));
         viewMenu->addAction(view->pageAction(QWebPage::Reload));
         viewMenu->addSeparator();
-        QAction *zoomIn = viewMenu->addAction("Zoom &In", this, SLOT(zoomIn()));
-        QAction *zoomOut = viewMenu->addAction("Zoom &Out", this, SLOT(zoomOut()));
-        QAction *resetZoom = viewMenu->addAction("Reset Zoom", this, SLOT(resetZoom()));
-        QAction *zoomTextOnly = viewMenu->addAction("Zoom Text Only", this, SLOT(toggleZoomTextOnly(bool)));
+        QAction* zoomIn = viewMenu->addAction("Zoom &In", this, SLOT(zoomIn()));
+        QAction* zoomOut = viewMenu->addAction("Zoom &Out", this, SLOT(zoomOut()));
+        QAction* resetZoom = viewMenu->addAction("Reset Zoom", this, SLOT(resetZoom()));
+        QAction* zoomTextOnly = viewMenu->addAction("Zoom Text Only", this, SLOT(toggleZoomTextOnly(bool)));
         zoomTextOnly->setCheckable(true);
         zoomTextOnly->setChecked(false);
         viewMenu->addSeparator();
         viewMenu->addAction("Dump HTML", this, SLOT(dumpHtml()));
-        viewMenu->addAction("Dump plugins", this, SLOT(dumpPlugins()));
+        //viewMenu->addAction("Dump plugins", this, SLOT(dumpPlugins()));
 
-        QMenu *formatMenu = new QMenu("F&ormat", this);
+        QMenu* formatMenu = new QMenu("F&ormat", this);
         formatMenuAction = menuBar()->addMenu(formatMenu);
         formatMenuAction->setVisible(false);
         formatMenu->addAction(view->pageAction(QWebPage::ToggleBold));
         formatMenu->addAction(view->pageAction(QWebPage::ToggleItalic));
         formatMenu->addAction(view->pageAction(QWebPage::ToggleUnderline));
-        QMenu *writingMenu = formatMenu->addMenu(tr("Writing Direction"));
+        QMenu* writingMenu = formatMenu->addMenu(tr("Writing Direction"));
         writingMenu->addAction(view->pageAction(QWebPage::SetTextDirectionDefault));
         writingMenu->addAction(view->pageAction(QWebPage::SetTextDirectionLeftToRight));
         writingMenu->addAction(view->pageAction(QWebPage::SetTextDirectionRightToLeft));
@@ -362,17 +467,21 @@ private:
         view->pageAction(QWebPage::ToggleItalic)->setShortcut(QKeySequence(Qt::CTRL | Qt::Key_I));
         view->pageAction(QWebPage::ToggleUnderline)->setShortcut(QKeySequence(Qt::CTRL | Qt::Key_U));
 
-        QMenu *toolsMenu = menuBar()->addMenu("&Tools");
+        QMenu* toolsMenu = menuBar()->addMenu("&Tools");
         toolsMenu->addAction("Select elements...", this, SLOT(selectElements()));
+        QAction* showInspectorAction = toolsMenu->addAction("Show inspector", inspector, SLOT(setVisible(bool)));
+        showInspectorAction->setCheckable(true);
+        showInspectorAction->setShortcuts(QList<QKeySequence>() << QKeySequence(tr("F12")));
+        showInspectorAction->connect(inspector, SIGNAL(visibleChanged(bool)), SLOT(setChecked(bool)));
 
     }
 
-    QWebView *view;
-    QLineEdit *urlEdit;
-    QProgressBar *progress;
-    QWebInspector* inspector;
+    QWebView* view;
+    QLineEdit* urlEdit;
+    QProgressBar* progress;
+    WebInspector* inspector;
 
-    QAction *formatMenuAction;
+    QAction* formatMenuAction;
 
     QStringList urlList;
     QStringListModel urlModel;
@@ -389,14 +498,14 @@ bool WebPage::extension(Extension extension, const ExtensionOption *option, Exte
     return true;
 }
 
-QWebPage *WebPage::createWindow(QWebPage::WebWindowType)
+QWebPage* WebPage::createWindow(QWebPage::WebWindowType)
 {
-    MainWindow *mw = new MainWindow;
+    MainWindow* mw = new MainWindow;
     mw->show();
     return mw->webPage();
 }
 
-QObject *WebPage::createPlugin(const QString &classId, const QUrl &url, const QStringList &paramNames, const QStringList &paramValues)
+QObject* WebPage::createPlugin(const QString &classId, const QUrl &url, const QStringList &paramNames, const QStringList &paramValues)
 {
     Q_UNUSED(url);
     Q_UNUSED(paramNames);
@@ -410,8 +519,7 @@ QObject *WebPage::createPlugin(const QString &classId, const QUrl &url, const QS
 #endif
 }
 
-class URLLoader : public QObject
-{
+class URLLoader : public QObject {
     Q_OBJECT
 public:
     URLLoader(QWebView* view, const QString& inputFileName)
@@ -492,14 +600,12 @@ int launcherMain(const QApplication& app)
 int main(int argc, char **argv)
 {
     QApplication app(argc, argv);
-    QString url = QString("%1/%2").arg(QDir::homePath()).arg(QLatin1String("index.html"));
+    QString defaultUrl = QString("file://%1/%2").arg(QDir::homePath()).arg(QLatin1String("index.html"));
 
     QWebSettings::setMaximumPagesInCache(4);
 
     app.setApplicationName("QtLauncher");
-#if QT_VERSION >= 0x040400
     app.setApplicationVersion("0.1");
-#endif
 
     QWebSettings::setObjectCacheCapacities((16*1024*1024) / 8, (16*1024*1024) / 8, 16*1024*1024);
 
@@ -521,21 +627,28 @@ int main(int argc, char **argv)
             exit(0);
         }
         MainWindow* window = new MainWindow;
-        QWebView *view = window->webView();
+        QWebView* view = window->webView();
         URLLoader loader(view, listFile);
         QObject::connect(view, SIGNAL(loadFinished(bool)), &loader, SLOT(loadNext()));
         loader.loadNext();
         window->show();
         launcherMain(app);
     } else {
-        if (args.count() > 1)
-            url = args.at(1);
-
-        MainWindow* window = new MainWindow(url);
+        MainWindow* window = 0;
+
+        // Look though the args for something we can open
+        for (int i = 1; i < args.count(); i++) {
+            if (!args.at(i).startsWith("-")) {
+                if (!window)
+                    window = new MainWindow(args.at(i));
+                else
+                    window->newWindow(args.at(i));
+            }
+        }
 
-        // Opens every given urls in new windows
-        for (int i = 2; i < args.count(); i++)
-            window->newWindow(args.at(i));
+        // If not, just open the default URL
+        if (!window)
+            window = new MainWindow(defaultUrl);
 
         window->show();
         launcherMain(app);
diff --git a/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index 26cf6f6..eb7ac9a 100644
--- a/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -141,6 +141,11 @@ void ChromeClientQt::takeFocus(FocusDirection)
 }
 
 
+void ChromeClientQt::focusedNodeChanged(WebCore::Node*)
+{
+}
+
+
 Page* ChromeClientQt::createWindow(Frame*, const FrameLoadRequest& request, const WindowFeatures& features)
 {
     QWebPage *newPage = m_webPage->createWindow(features.dialog ? QWebPage::WebModalDialog : QWebPage::WebBrowserWindow);
diff --git a/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 196c4fc..939fe04 100644
--- a/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -63,6 +63,8 @@ namespace WebCore {
         virtual bool canTakeFocus(FocusDirection);
         virtual void takeFocus(FocusDirection);
 
+        virtual void focusedNodeChanged(Node*);
+
         virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&);
         virtual void show();
 
diff --git a/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index 34241f0..3091a43 100644
--- a/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -407,28 +407,38 @@ void EditorClientQt::handleKeyboardEvent(KeyboardEvent* event)
             case VK_LEFT:
                 if (kevent->shiftKey())
                     frame->editor()->command("MoveLeftAndModifySelection").execute();
-                else frame->editor()->command("MoveLeft").execute();
+                else
+                    frame->editor()->command("MoveLeft").execute();
                 break;
             case VK_RIGHT:
                 if (kevent->shiftKey())
                     frame->editor()->command("MoveRightAndModifySelection").execute();
-                else frame->editor()->command("MoveRight").execute();
+                else
+                    frame->editor()->command("MoveRight").execute();
                 break;
             case VK_UP:
                 if (kevent->shiftKey())
                     frame->editor()->command("MoveUpAndModifySelection").execute();
-                else frame->editor()->command("MoveUp").execute();
+                else
+                    frame->editor()->command("MoveUp").execute();
                 break;
             case VK_DOWN:
                 if (kevent->shiftKey())
                     frame->editor()->command("MoveDownAndModifySelection").execute();
-                else frame->editor()->command("MoveDown").execute();
+                else
+                    frame->editor()->command("MoveDown").execute();
                 break;
             case VK_PRIOR:  // PageUp
-                frame->editor()->command("MovePageUp").execute();
+                if (kevent->shiftKey())
+                    frame->editor()->command("MovePageUpAndModifySelection").execute();
+                else
+                    frame->editor()->command("MovePageUp").execute();
                 break;
             case VK_NEXT:  // PageDown
-                frame->editor()->command("MovePageDown").execute();
+                if (kevent->shiftKey())
+                    frame->editor()->command("MovePageDownAndModifySelection").execute();
+                else
+                    frame->editor()->command("MovePageDown").execute();
                 break;
             case VK_TAB:
                 return;
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 8749ada..3c30ab5 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -1,9 +1,10 @@
 /*
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  * Coypright (C) 2008 Holger Hans Peter Freyther
+ * Coypright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * All rights reserved.
  *
@@ -53,8 +54,9 @@
 #include "QNetworkReplyHandler.h"
 #include "ResourceHandleInternal.h"
 #include "ResourceHandle.h"
-#include "Settings.h"
+#include "ScriptController.h"
 #include "ScriptString.h"
+#include "Settings.h"
 #include "QWebPageClient.h"
 
 #include "qwebpage.h"
@@ -68,14 +70,10 @@
 
 #include <QCoreApplication>
 #include <QDebug>
-#if QT_VERSION >= 0x040400
 #include <QGraphicsScene>
 #include <QGraphicsWidget>
 #include <QNetworkRequest>
 #include <QNetworkReply>
-#else
-#include "qwebnetworkinterface_p.h"
-#endif
 #include "qwebhistory_p.h"
 
 static bool dumpFrameLoaderCallbacks = false;
@@ -145,9 +143,9 @@ namespace WebCore
 FrameLoaderClientQt::FrameLoaderClientQt()
     : m_frame(0)
     , m_webFrame(0)
+    , m_firstData(false)
     , m_pluginView(0)
     , m_hasSentResponseToPlugin(false)
-    , m_firstData(false)
     , m_loadError (ResourceError())
 {
 }
@@ -176,8 +174,8 @@ void FrameLoaderClientQt::setFrame(QWebFrame* webFrame, Frame* frame)
             m_webFrame->page(), SIGNAL(loadFinished(bool)));
     connect(this, SIGNAL(loadFinished(bool)),
             m_webFrame, SIGNAL(loadFinished(bool)));
-    connect(this, SIGNAL(titleChanged(const QString&)),
-            m_webFrame, SIGNAL(titleChanged(const QString&)));
+    connect(this, SIGNAL(titleChanged(QString)),
+            m_webFrame, SIGNAL(titleChanged(QString)));
 }
 
 QWebFrame* FrameLoaderClientQt::webFrame() const
@@ -307,6 +305,29 @@ void FrameLoaderClientQt::dispatchDidChangeLocationWithinPage()
     m_webFrame->page()->d->updateNavigationActions();
 }
 
+void FrameLoaderClientQt::dispatchDidPushStateWithinPage()
+{
+    if (dumpFrameLoaderCallbacks)
+        printf("%s - dispatchDidPushStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        
+    notImplemented();
+}
+
+void FrameLoaderClientQt::dispatchDidReplaceStateWithinPage()
+{
+    if (dumpFrameLoaderCallbacks)
+        printf("%s - dispatchDidReplaceStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        
+    notImplemented();
+}
+
+void FrameLoaderClientQt::dispatchDidPopStateWithinPage()
+{
+    if (dumpFrameLoaderCallbacks)
+        printf("%s - dispatchDidPopStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        
+    notImplemented();
+}
 
 void FrameLoaderClientQt::dispatchWillClose()
 {
@@ -600,8 +621,11 @@ bool FrameLoaderClientQt::canHandleRequest(const WebCore::ResourceRequest&) cons
     return true;
 }
 
-void FrameLoaderClientQt::windowObjectCleared()
+void FrameLoaderClientQt::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 {
+    if (world != mainThreadNormalWorld())
+        return;
+
     if (dumpFrameLoaderCallbacks)
         printf("%s - didClearWindowObjectForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
@@ -789,7 +813,6 @@ WTF::PassRefPtr<WebCore::DocumentLoader> FrameLoaderClientQt::createDocumentLoad
 
 void FrameLoaderClientQt::download(WebCore::ResourceHandle* handle, const WebCore::ResourceRequest&, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&)
 {
-#if QT_VERSION >= 0x040400
     if (!m_webFrame)
         return;
 
@@ -802,7 +825,6 @@ void FrameLoaderClientQt::download(WebCore::ResourceHandle* handle, const WebCor
         else
             reply->abort();
     }
-#endif
 }
 
 void FrameLoaderClientQt::assignIdentifierToInitialRequest(unsigned long identifier, WebCore::DocumentLoader*, const WebCore::ResourceRequest& request)
@@ -955,11 +977,7 @@ void FrameLoaderClientQt::dispatchDecidePolicyForMIMEType(FramePolicyFunction fu
 void FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction(FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState>, const WebCore::String&)
 {
     Q_ASSERT(m_webFrame);
-#if QT_VERSION < 0x040400
-    QWebNetworkRequest r(request);
-#else
-    QNetworkRequest r(request.toNetworkRequest());
-#endif
+    QNetworkRequest r(request.toNetworkRequest(m_webFrame));
     QWebPage* page = m_webFrame->page();
 
     if (!page->d->acceptNavigationRequest(0, r, QWebPage::NavigationType(action.type()))) {
@@ -980,11 +998,7 @@ void FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction(FramePolicyFunc
 void FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction(FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState>)
 {
     Q_ASSERT(m_webFrame);
-#if QT_VERSION < 0x040400
-    QWebNetworkRequest r(request);
-#else
-    QNetworkRequest r(request.toNetworkRequest());
-#endif
+    QNetworkRequest r(request.toNetworkRequest(m_webFrame));
     QWebPage*page = m_webFrame->page();
 
     if (!page->d->acceptNavigationRequest(m_webFrame, r, QWebPage::NavigationType(action.type()))) {
@@ -1009,12 +1023,10 @@ void FrameLoaderClientQt::dispatchUnableToImplementPolicy(const WebCore::Resourc
 
 void FrameLoaderClientQt::startDownload(const WebCore::ResourceRequest& request)
 {
-#if QT_VERSION >= 0x040400
     if (!m_webFrame)
         return;
 
-    emit m_webFrame->page()->downloadRequested(request.toNetworkRequest());
-#endif
+    emit m_webFrame->page()->downloadRequested(request.toNetworkRequest(m_webFrame));
 }
 
 PassRefPtr<Frame> FrameLoaderClientQt::createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
@@ -1131,9 +1143,25 @@ public:
         QRegion clipRegion = QRegion(clipRect);
         platformWidget()->setMask(clipRegion);
 
+        handleVisibility();
+    }
+
+    virtual void show()
+    {
+        Widget::show();
+        handleVisibility();
+    }
+
+private:
+    void handleVisibility()
+    {
+        if (!isVisible())
+            return;
+
         // if setMask is set with an empty QRegion, no clipping will
         // be performed, so in that case we hide the platformWidget
-        platformWidget()->setVisible(!clipRegion.isEmpty());
+        QRegion mask = platformWidget()->mask();
+        platformWidget()->setVisible(!mask.isEmpty());
     }
 };
 
@@ -1234,23 +1262,21 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
 #endif // QT_NO_STYLE_STYLESHEET
     }
 
-#if QT_VERSION >= 0x040400
         if (!object) {
             QWebPluginFactory* factory = m_webFrame->page()->pluginFactory();
             if (factory)
                 object = factory->create(mimeType, qurl, params, values);
         }
-#endif
 
         if (object) {
             QWidget* widget = qobject_cast<QWidget*>(object);
             if (widget) {
-                QWidget* parentWidget;
+                QWidget* parentWidget = 0;
                 if (m_webFrame->page()->d->client)
                     parentWidget = qobject_cast<QWidget*>(m_webFrame->page()->d->client->pluginParent());
-                else
-                    parentWidget = 0;  // The plug-in won't be fully functional because the QWebView doesn't exist.
-                widget->setParent(parentWidget);
+                if (parentWidget) // don't reparent to nothing (i.e. keep whatever parent QWebPage::createPlugin() chose.
+                    widget->setParent(parentWidget);
+                widget->hide();
                 RefPtr<QtPluginWidget> w = adoptRef(new QtPluginWidget());
                 w->setPlatformWidget(widget);
                 // Make sure it's invisible until properly placed into the layout
@@ -1260,13 +1286,12 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
 #if QT_VERSION >= 0x040600
             QGraphicsWidget* graphicsWidget = qobject_cast<QGraphicsWidget*>(object);
             if (graphicsWidget) {
-                QGraphicsObject* parentWidget;
+                QGraphicsObject* parentWidget = 0;
                 if (m_webFrame->page()->d->client)
                     parentWidget = qobject_cast<QGraphicsObject*>(m_webFrame->page()->d->client->pluginParent());
-                else
-                    parentWidget = 0;  // The plug-in won't be fully functional because the QWebView doesn't exist.
                 graphicsWidget->hide();
-                graphicsWidget->setParentItem(parentWidget);
+                if (parentWidget) // don't reparent to nothing (i.e. keep whatever parent QWebPage::createPlugin() chose.
+                    graphicsWidget->setParentItem(parentWidget);
                 RefPtr<QtPluginGraphicsWidget> w = QtPluginGraphicsWidget::create(graphicsWidget);
                 // Make sure it's invisible until properly placed into the layout
                 w->setFrameRect(IntRect(0, 0, 0, 0));
@@ -1276,8 +1301,23 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
             // FIXME: make things work for widgetless plugins as well
             delete object;
     } else { // NPAPI Plugins
+        Vector<String> params = paramNames;
+        Vector<String> values = paramValues;
+        if (mimeType == "application/x-shockwave-flash") {
+            QWebPageClient* client = m_webFrame->page()->d->client;
+            if (!client || !qobject_cast<QWidget*>(client->pluginParent())) {
+                // inject wmode=opaque when there is no client or the client is not a QWebView
+                size_t wmodeIndex = params.find("wmode");
+                if (wmodeIndex == -1) {
+                    params.append("wmode");
+                    values.append("opaque");
+                } else
+                    values[wmodeIndex] = "opaque";
+            }
+        }
+
         RefPtr<PluginView> pluginView = PluginView::create(m_frame, pluginSize, element, url,
-            paramNames, paramValues, mimeType, loadManually);
+            params, values, mimeType, loadManually);
         return pluginView;
     }
 
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index fe7590d..32b9caa 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -103,6 +103,9 @@ namespace WebCore {
         virtual void dispatchDidCancelClientRedirect();
         virtual void dispatchWillPerformClientRedirect(const KURL&, double interval, double fireDate);
         virtual void dispatchDidChangeLocationWithinPage();
+        virtual void dispatchDidPushStateWithinPage();
+        virtual void dispatchDidReplaceStateWithinPage();
+        virtual void dispatchDidPopStateWithinPage();
         virtual void dispatchWillClose();
         virtual void dispatchDidReceiveIcon();
         virtual void dispatchDidStartProvisionalLoad();
@@ -199,7 +202,7 @@ namespace WebCore {
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType);
         virtual String overrideMediaType() const;
 
-        virtual void windowObjectCleared();
+        virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
         virtual void documentElementAvailable();
         virtual void didPerformFirstNavigation() const;
 
diff --git a/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index 12f405c..d5683c4 100644
--- a/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -50,8 +50,8 @@ namespace WebCore {
 static const QLatin1String settingStoragePrefix("Qt/QtWebKit/QWebInspector/");
 static const QLatin1String settingStorageTypeSuffix(".type");
 
-static InspectorController::Setting variantToSetting(const QVariant& qvariant);
-static QVariant settingToVariant(const InspectorController::Setting& icSetting);
+static String variantToSetting(const QVariant& qvariant);
+static QVariant settingToVariant(const String& value);
 
 class InspectorClientWebPage : public QWebPage {
     Q_OBJECT
@@ -113,16 +113,11 @@ void InspectorClientQt::showWindow()
     updateWindowTitle();
 
     m_inspectedWebPage->d->inspectorController()->setWindowVisible(true, true);
-    // We don't allow the inspector to ask for widget visibility itself because showWindow is
-    // not always called when we want.
-    // Inspecting an element or calling QWebInspector::show() should already have made the
-    // widget visible.
 }
 
 void InspectorClientQt::closeWindow()
 {
-    if (m_inspectedWebPage->d->inspector)
-        m_inspectedWebPage->d->inspector->close();
+    m_inspectedWebPage->d->inspectorController()->setWindowVisible(false);
 }
 
 void InspectorClientQt::attachWindow()
@@ -166,11 +161,10 @@ void InspectorClientQt::updateWindowTitle()
     if (m_inspectedWebPage->d->inspector) {
         QString caption = QCoreApplication::translate("QWebPage", "Web Inspector - %2").arg(m_inspectedURL);
         m_inspectedWebPage->d->inspector->setWindowTitle(caption);
-        emit m_inspectedWebPage->d->inspector->windowTitleChanged(caption);
     }
 }
 
-void InspectorClientQt::populateSetting(const String& key, InspectorController::Setting& setting)
+void InspectorClientQt::populateSetting(const String& key, String* setting)
 {
     QSettings qsettings;
     if (qsettings.status() == QSettings::AccessError) {
@@ -184,10 +178,10 @@ void InspectorClientQt::populateSetting(const String& key, InspectorController::
     QString storedValueType = qsettings.value(settingKey + settingStorageTypeSuffix).toString();
     QVariant storedValue = qsettings.value(settingKey);
     storedValue.convert(QVariant::nameToType(storedValueType.toAscii().data()));
-    setting = variantToSetting(storedValue);
+    *setting = variantToSetting(storedValue);
 }
 
-void InspectorClientQt::storeSetting(const String& key, const InspectorController::Setting& setting)
+void InspectorClientQt::storeSetting(const String& key, const String& setting)
 {
     QSettings qsettings;
     if (qsettings.status() == QSettings::AccessError) {
@@ -202,70 +196,24 @@ void InspectorClientQt::storeSetting(const String& key, const InspectorControlle
     qsettings.setValue(settingKey + settingStorageTypeSuffix, QVariant::typeToName(valueToStore.type()));
 }
 
-void InspectorClientQt::removeSetting(const String&)
+static String variantToSetting(const QVariant& qvariant)
 {
-    notImplemented();
-}
-
-static InspectorController::Setting variantToSetting(const QVariant& qvariant)
-{
-    InspectorController::Setting retVal;
+    String retVal;
 
     switch (qvariant.type()) {
     case QVariant::Bool:
-        retVal.set(qvariant.toBool());
-        break;
-    case QVariant::Double:
-        retVal.set(qvariant.toDouble());
-        break;
-    case QVariant::Int:
-        retVal.set((long)qvariant.toInt());
-        break;
+        retVal = qvariant.toBool() ? "true" : "false";
     case QVariant::String:
-        retVal.set(qvariant.toString());
-        break;
-    case QVariant::StringList: {
-        QStringList qsList = qvariant.toStringList();
-        int listCount = qsList.count();
-        Vector<String> vector(listCount);
-        for (int i = 0; i < listCount; ++i)
-            vector[i] = qsList[i];
-        retVal.set(vector);
-        break;
-    }
+        retVal = qvariant.toString();
     }
 
     return retVal;
 }
 
-static QVariant settingToVariant(const InspectorController::Setting& icSetting)
+static QVariant settingToVariant(const String& setting)
 {
     QVariant retVal;
-
-    switch (icSetting.type()) {
-    case InspectorController::Setting::StringType:
-        retVal.setValue(static_cast<QString>(icSetting.string()));
-        break;
-    case InspectorController::Setting::StringVectorType: {
-        const Vector<String>& vector = icSetting.stringVector();
-        Vector<String>::const_iterator iter;
-        QStringList qsList;
-        for (iter = vector.begin(); iter != vector.end(); ++iter)
-            qsList << *iter;
-        retVal.setValue(qsList);
-        break;
-    }
-    case InspectorController::Setting::DoubleType:
-        retVal.setValue(icSetting.doubleValue());
-        break;
-    case InspectorController::Setting::IntegerType:
-        retVal.setValue((int)icSetting.integerValue());
-        break;
-    case InspectorController::Setting::BooleanType:
-        retVal.setValue(icSetting.booleanValue());
-        break;
-    }
-
+    retVal.setValue(static_cast<QString>(setting));
     return retVal;
 }
 
diff --git a/WebKit/qt/WebCoreSupport/InspectorClientQt.h b/WebKit/qt/WebCoreSupport/InspectorClientQt.h
index ccf8b69..923bab4 100644
--- a/WebKit/qt/WebCoreSupport/InspectorClientQt.h
+++ b/WebKit/qt/WebCoreSupport/InspectorClientQt.h
@@ -66,9 +66,8 @@ namespace WebCore {
         virtual void hideHighlight();
         virtual void inspectedURLChanged(const String& newURL);
 
-        virtual void populateSetting(const String& key, InspectorController::Setting&);
-        virtual void storeSetting(const String& key, const InspectorController::Setting&);
-        virtual void removeSetting(const String& key);
+        virtual void populateSetting(const String& key, String* value);
+        virtual void storeSetting(const String& key, const String& value);
 
         virtual void inspectorWindowObjectCleared();
 
diff --git a/WebKit/qt/docs/docs.pri b/WebKit/qt/docs/docs.pri
index 4a8c165..804817b 100644
--- a/WebKit/qt/docs/docs.pri
+++ b/WebKit/qt/docs/docs.pri
@@ -1,9 +1,9 @@
 include(../../../WebKit.pri)
 
 unix {
-    QDOC = SRCDIR=$$PWD/../../.. OUTPUT_DIR=$$OUTPUT_DIR $$(QTDIR)/tools/qdoc3/qdoc3
+    QDOC = SRCDIR=$$PWD/../../.. OUTPUT_DIR=$$OUTPUT_DIR $$(QTDIR)/bin/qdoc3
 } else {
-    QDOC = $$(QTDIR)\tools\qdoc3\release\qdoc3.exe
+    QDOC = $$(QTDIR)\bin\qdoc3.exe
 }
 
 unix {
diff --git a/WebKit/qt/docs/qtwebkit.qdoc b/WebKit/qt/docs/qtwebkit.qdoc
index 09dfae5..411762a 100644
--- a/WebKit/qt/docs/qtwebkit.qdoc
+++ b/WebKit/qt/docs/qtwebkit.qdoc
@@ -25,13 +25,10 @@
 
     Qt Commercial Edition licensees that wish to distribute applications that
     use the QtWebKit module need to be aware of their obligations under the
-    GNU Lesser General Public License (LGPL). 
+    GNU Library General Public License (LGPL).
 
     Developers using the Open Source Edition can choose to redistribute
-    the module under the appropriate version of the GNU LGPL; version 2.1
-    for applications and libraries licensed under the GNU GPL version 2,
-    or version 3 for applications and libraries licensed under the GNU
-    GPL version 2.
+    the module under the appropriate version of the GNU LGPL.
 
     \legalese
     WebKit is licensed under the GNU Library General Public License.
diff --git a/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp b/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp
index 0ba1cad..a6b6620 100644
--- a/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp
+++ b/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp
@@ -10,7 +10,7 @@ void wrapInFunction()
     QWebInspector *inspector = new QWebInspector;
     inspector->setPage(page);
 
-    connect(page, SIGNAL(webInspectorTriggered(const QWebElement&)), inspector, SLOT(show()));
+    connect(page, SIGNAL(webInspectorTriggered(QWebElement)), inspector, SLOT(show()));
 //! [0]
 
 }
diff --git a/WebKit/qt/docs/webkitsnippets/webelement/main.cpp b/WebKit/qt/docs/webkitsnippets/webelement/main.cpp
index d437a6f..2707ffb 100644
--- a/WebKit/qt/docs/webkitsnippets/webelement/main.cpp
+++ b/WebKit/qt/docs/webkitsnippets/webelement/main.cpp
@@ -22,7 +22,6 @@
 #include <qwebview.h>
 #include <qwebframe.h>
 #include <qwebelement.h>
-#include <qdebug.h>
 
 static QWebFrame *frame;
 
@@ -53,9 +52,10 @@ static void findAll()
        </p>
     */
 
+//! [FindAll intro]
     QList<QWebElement> allSpans = document.findAll("span");
     QList<QWebElement> introSpans = document.findAll("p.intro span");
-//! [FindAll]
+//! [FindAll intro] //! [FindAll]
 }
 
 int main(int argc, char *argv[])
diff --git a/WebKit/qt/docs/webkitsnippets/webelement/webelement.pro b/WebKit/qt/docs/webkitsnippets/webelement/webelement.pro
index f9b403b..8ca4b59 100644
--- a/WebKit/qt/docs/webkitsnippets/webelement/webelement.pro
+++ b/WebKit/qt/docs/webkitsnippets/webelement/webelement.pro
@@ -1,5 +1,8 @@
 TEMPLATE = app
 CONFIG -= app_bundle
+CONFIG(QTDIR_build) {
+    QT       += webkit
+}
 SOURCES   = main.cpp
 include(../../../../../WebKit.pri)
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
index 4bdb7f5..657e09f 100644
--- a/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
+++ b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -17,36 +17,13 @@
     Boston, MA 02110-1301, USA.
 */
 
+#include "../util.h"
 #include <QtTest/QtTest>
-
 #include <QGraphicsView>
 #include <qgraphicswebview.h>
 #include <qwebpage.h>
 #include <qwebframe.h>
 
-/**
- * Starts an event loop that runs until the given signal is received.
- * Optionally the event loop
- * can return earlier on a timeout.
- *
- * \return \p true if the requested signal was received
- *         \p false on timeout
- */
-static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
-{
-    QEventLoop loop;
-    QObject::connect(obj, signal, &loop, SLOT(quit()));
-    QTimer timer;
-    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
-    if (timeout > 0) {
-        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
-        timer.setSingleShot(true);
-        timer.start(timeout);
-    }
-    loop.exec();
-    return timeoutSpy.isEmpty();
-}
-
 class tst_QGraphicsWebView : public QObject
 {
     Q_OBJECT
@@ -63,21 +40,17 @@ void tst_QGraphicsWebView::qgraphicswebview()
     item.title();
     item.icon();
     item.zoomFactor();
-    item.isInteractive();
-    item.progress();
-    item.toHtml();
     item.history();
     item.settings();
-    item.status();
     item.page();
     item.setPage(0);
     item.page();
     item.setUrl(QUrl());
     item.setZoomFactor(0);
-    item.setInteractive(true);
     item.load(QUrl());
     item.setHtml(QString());
     item.setContent(QByteArray());
+    item.isModified();
 }
 
 class WebPage : public QWebPage
@@ -117,7 +90,7 @@ void tst_QGraphicsWebView::crashOnViewlessWebPages()
     view.setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
     view.resize(600, 480);
     webView->resize(view.geometry().size());
-    QTest::qWait(200);
+    QCoreApplication::processEvents();
     view.show();
 
     page->mainFrame()->setHtml(QString("data:text/html,"
@@ -126,7 +99,7 @@ void tst_QGraphicsWebView::crashOnViewlessWebPages()
                                                 "<frame src=\"data:text/html,bar\">"
                                             "</frameset>"));
 
-    QVERIFY(::waitForSignal(page, SIGNAL(loadFinished(bool))));
+    QVERIFY(waitForSignal(page, SIGNAL(loadFinished(bool))));
 }
 
 QTEST_MAIN(tst_QGraphicsWebView)
diff --git a/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index cf83fe8..e9dae18 100644
--- a/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -68,9 +68,12 @@ private slots:
     void simpleCollection();
     void attributes();
     void attributesNS();
+    void listAttributes();
     void classes();
     void namespaceURI();
     void iteration();
+    void nonConstIterator();
+    void constIterator();
     void foreachManipulation();
     void emptyCollection();
     void appendCollection();
@@ -185,6 +188,29 @@ void tst_QWebElement::attributesNS()
     QCOMPARE(svg.attributeNS("http://www.w3.org/2000/svg", "foobar", "defaultblah"), QString("true"));
 }
 
+void tst_QWebElement::listAttributes()
+{
+    QString content = "<html xmlns=\"http://www.w3.org/1999/xhtml\" "
+                      "xmlns:svg=\"http://www.w3.org/2000/svg\">"
+                      "<body><svg:svg foo=\"\" svg:bar=\"\">"
+                      "</svg:svg></body></html>";
+
+    m_mainFrame->setContent(content.toUtf8(), "application/xhtml+xml");
+
+    QWebElement svg = m_mainFrame->findFirstElement("svg");
+    QVERIFY(!svg.isNull());
+
+    QVERIFY(svg.attributeNames().contains("foo"));
+    QVERIFY(svg.attributeNames("http://www.w3.org/2000/svg").contains("bar"));
+
+    svg.setAttributeNS("http://www.w3.org/2000/svg", "svg:foobar", "true");
+    QVERIFY(svg.attributeNames().contains("foo"));
+    QStringList attributes = svg.attributeNames("http://www.w3.org/2000/svg");
+    QCOMPARE(attributes.size(), 2);
+    QVERIFY(attributes.contains("bar"));
+    QVERIFY(attributes.contains("foobar"));
+}
+
 void tst_QWebElement::classes()
 {
     m_mainFrame->setHtml("<body><p class=\"a b c d a c\">Test");
@@ -305,6 +331,37 @@ void tst_QWebElement::iteration()
     QCOMPARE(paras.at(1), paras.last());
 }
 
+void tst_QWebElement::nonConstIterator()
+{
+    QString html = "<body><p>first para</p><p>second para</p></body>";
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement();
+    QWebElementCollection paras = body.findAll("p");
+
+    QWebElementCollection::iterator it = paras.begin();
+    QCOMPARE(*it, paras.at(0));
+    ++it;
+    (*it).encloseWith("<div>");
+    QCOMPARE(*it, paras.at(1));
+    ++it;
+    QCOMPARE(it,  paras.end());
+}
+
+void tst_QWebElement::constIterator()
+{
+    QString html = "<body><p>first para</p><p>second para</p></body>";
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement();
+    const QWebElementCollection paras = body.findAll("p");
+
+    QWebElementCollection::const_iterator it = paras.begin();
+    QCOMPARE(*it, paras.at(0));
+    ++it;
+    QCOMPARE(*it, paras.at(1));
+    ++it;
+    QCOMPARE(it,  paras.end());
+}
+
 void tst_QWebElement::foreachManipulation()
 {
     QString html = "<body><p>first para</p><p>second para</p></body>";
@@ -938,7 +995,10 @@ void tst_QWebElement::render()
     QImage testImage(resource.width(), resource.height(), QImage::Format_ARGB32);
     QPainter painter0(&testImage);
     painter0.fillRect(imageRect, Qt::white);
-    painter0.drawImage(0, 0, resource);
+    // render() uses pixmaps internally, and pixmaps might have bit depths
+    // other than 32, giving different pixel values due to rounding.
+    QPixmap pix = QPixmap::fromImage(resource);
+    painter0.drawPixmap(0, 0, pix);
     painter0.end();
 
     QImage image1(resource.width(), resource.height(), QImage::Format_ARGB32);
diff --git a/WebKit/qt/tests/qwebframe/qwebframe.pro b/WebKit/qt/tests/qwebframe/qwebframe.pro
index 0e540e5..b8734cd 100644
--- a/WebKit/qt/tests/qwebframe/qwebframe.pro
+++ b/WebKit/qt/tests/qwebframe/qwebframe.pro
@@ -5,7 +5,7 @@ SOURCES  += tst_qwebframe.cpp
 RESOURCES += qwebframe.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-DEFINES += SRCDIR=\\\"$$PWD/resources\\\"
+!symbian:DEFINES += SRCDIR=\\\"$$PWD/resources\\\"
 
 symbian {
     TARGET.UID3 = 0xA000E53D
diff --git a/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 7cc62b0..7c13fd0 100644
--- a/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -38,35 +38,9 @@
 #endif
 #include "../util.h"
 
-//TESTED_CLASS=
-//TESTED_FILES=
-
-// Task 160192
-/**
- * Starts an event loop that runs until the given signal is received.
- Optionally the event loop
- * can return earlier on a timeout.
- *
- * \return \p true if the requested signal was received
- *         \p false on timeout
- */
-static bool waitForSignal(QObject* obj, const char* signal, int timeout = 0)
-{
-    QEventLoop loop;
-    QObject::connect(obj, signal, &loop, SLOT(quit()));
-    QTimer timer;
-    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
-    if (timeout > 0) {
-        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
-        timer.setSingleShot(true);
-        timer.start(timeout);
-    }
-    loop.exec();
-    return timeoutSpy.isEmpty();
-}
-
-/* Mostly a test for the JavaScript related parts of QWebFrame */
-
+#if defined(Q_OS_SYMBIAN)
+# define SRCDIR ""
+#endif
 
 struct CustomType {
     QString string;
@@ -600,6 +574,7 @@ private slots:
     void render();
     void scrollPosition();
     void evaluateWillCauseRepaint();
+    void qObjectWrapperWithSameIdentity();
 
 private:
     QString  evalJS(const QString&s) {
@@ -2238,7 +2213,7 @@ protected:
     virtual QNetworkReply* createRequest(Operation op, const QNetworkRequest& request, QIODevice* outgoingData)
     {
         QString url = request.url().toString();
-        if (op == QNetworkAccessManager::GetOperation)
+        if (op == QNetworkAccessManager::GetOperation) {
             if (url == "qrc:/test1.html" ||  url == "http://abcdef.abcdef/")
                 return new FakeReply(request, this);
 #ifndef QT_NO_OPENSSL
@@ -2249,6 +2224,7 @@ protected:
                 return reply;
             }
 #endif
+       }
 
         return QNetworkAccessManager::createRequest(op, request, outgoingData);
     }
@@ -2265,19 +2241,19 @@ void tst_QWebFrame::requestedUrl()
     page.setNetworkAccessManager(networkManager);
 
     frame->setUrl(QUrl("qrc:/test1.html"));
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 1);
     QCOMPARE(frame->requestedUrl(), QUrl("qrc:/test1.html"));
     QCOMPARE(frame->url(), QUrl("qrc:/test2.html"));
 
     frame->setUrl(QUrl("qrc:/non-existent.html"));
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 2);
     QCOMPARE(frame->requestedUrl(), QUrl("qrc:/non-existent.html"));
     QCOMPARE(frame->url(), QUrl("qrc:/non-existent.html"));
 
     frame->setUrl(QUrl("http://abcdef.abcdef"));
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 3);
     QCOMPARE(frame->requestedUrl(), QUrl("http://abcdef.abcdef/"));
     QCOMPARE(frame->url(), QUrl("http://abcdef.abcdef/"));
@@ -2286,9 +2262,9 @@ void tst_QWebFrame::requestedUrl()
     qRegisterMetaType<QList<QSslError> >("QList<QSslError>");
     qRegisterMetaType<QNetworkReply* >("QNetworkReply*");
 
-    QSignalSpy spy2(page.networkAccessManager(), SIGNAL(sslErrors(QNetworkReply*, const QList<QSslError>&)));
+    QSignalSpy spy2(page.networkAccessManager(), SIGNAL(sslErrors(QNetworkReply*,QList<QSslError>)));
     frame->setUrl(QUrl("qrc:/fake-ssl-error.html"));
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy2.count(), 1);
     QCOMPARE(frame->requestedUrl(), QUrl("qrc:/fake-ssl-error.html"));
     QCOMPARE(frame->url(), QUrl("qrc:/fake-ssl-error.html"));
@@ -2346,7 +2322,7 @@ void tst_QWebFrame::setHtmlWithResource()
     // in few seconds, the image should be completey loaded
     QSignalSpy spy(&page, SIGNAL(loadFinished(bool)));
     frame->setHtml(html);
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 1);
 
     QCOMPARE(frame->evaluateJavaScript("document.images.length").toInt(), 1);
@@ -2365,7 +2341,7 @@ void tst_QWebFrame::setHtmlWithResource()
 
     // in few seconds, the CSS should be completey loaded
     frame->setHtml(html2);
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.size(), 2);
 
     QWebElement p = frame->documentElement().findAll("p").at(0);
@@ -2383,7 +2359,7 @@ void tst_QWebFrame::setHtmlWithBaseURL()
     QSignalSpy spy(&page, SIGNAL(loadFinished(bool)));
 
     frame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(spy.count(), 1);
 
     QCOMPARE(frame->evaluateJavaScript("document.images.length").toInt(), 1);
@@ -2494,15 +2470,15 @@ void tst_QWebFrame::popupFocus()
     combo->hidePopup();
     QTRY_VERIFY(view.hasFocus() && !combo->view()->hasFocus()); // Focus should be back on the WebView
 
-    // triple the flashing time, should at least blink twice already
-    int delay = qApp->cursorFlashTime() * 3;
+    // double the flashing time, should at least blink once already
+    int delay = qApp->cursorFlashTime() * 2;
 
     // focus the lineedit and check if it blinks
     QTest::mouseClick(&view, Qt::LeftButton, 0, QPoint(200, 25));
     m_popupTestView = &view;
     view.installEventFilter( this );
     QTest::qWait(delay);
-    QVERIFY2(m_popupTestPaintCount >= 4,
+    QVERIFY2(m_popupTestPaintCount >= 3,
              "The input field should have a blinking caret");
 }
 
@@ -2646,7 +2622,7 @@ void tst_QWebFrame::hasSetFocus()
     QSignalSpy loadSpy(m_page, SIGNAL(loadFinished(bool)));
     m_page->mainFrame()->setHtml(html);
 
-    QTest::qWait(200);
+    waitForSignal(m_page->mainFrame(), SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(loadSpy.size(), 1);
 
     QList<QWebFrame*> children = m_page->mainFrame()->childFrames();
@@ -2656,7 +2632,7 @@ void tst_QWebFrame::hasSetFocus()
                       "</body></html>");
     frame->setHtml(innerHtml);
 
-    QTest::qWait(200);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)), 200);
     QCOMPARE(loadSpy.size(), 2);
 
     m_page->mainFrame()->setFocus();
@@ -2743,16 +2719,51 @@ void tst_QWebFrame::evaluateWillCauseRepaint()
     view.setHtml(html);
     view.show();
 
-    QTest::qWait(200);
+    QTest::qWaitForWindowShown(&view);
 
     view.page()->mainFrame()->evaluateJavaScript(
         "document.getElementById('junk').style.display = 'none';");
 
-    ::waitForSignal(view.page(), SIGNAL(repaintRequested( const QRect &)));
-
-    QTest::qWait(2000);
+    ::waitForSignal(view.page(), SIGNAL(repaintRequested(QRect)));
 }
 
+class TestFactory : public QObject
+{
+    Q_OBJECT
+public:
+    TestFactory()
+        : obj(0), counter(0)
+    {}
+
+    Q_INVOKABLE QObject* getNewObject()
+    {
+        delete obj;
+        obj = new QObject(this);
+        obj->setObjectName(QLatin1String("test") + QString::number(++counter));
+        return obj;
+
+    }
+
+    QObject* obj;
+    int counter;
+};
+
+void tst_QWebFrame::qObjectWrapperWithSameIdentity()
+{
+    m_view->setHtml("<script>function triggerBug() { document.getElementById('span1').innerText = test.getNewObject().objectName; }</script>"
+                    "<body><span id='span1'>test</span></body>");
+
+    QWebFrame* mainFrame = m_view->page()->mainFrame();
+    QCOMPARE(mainFrame->toPlainText(), QString("test"));
+
+    mainFrame->addToJavaScriptWindowObject("test", new TestFactory, QScriptEngine::ScriptOwnership);
+
+    mainFrame->evaluateJavaScript("triggerBug();");
+    QCOMPARE(mainFrame->toPlainText(), QString("test1"));
+
+    mainFrame->evaluateJavaScript("triggerBug();");
+    QCOMPARE(mainFrame->toPlainText(), QString("test2"));
+}
 
 QTEST_MAIN(tst_QWebFrame)
 #include "tst_qwebframe.moc"
diff --git a/WebKit/qt/tests/qwebinspector/qwebinspector.pro b/WebKit/qt/tests/qwebinspector/qwebinspector.pro
new file mode 100644
index 0000000..520887e
--- /dev/null
+++ b/WebKit/qt/tests/qwebinspector/qwebinspector.pro
@@ -0,0 +1,6 @@
+TEMPLATE = app
+TARGET = tst_qwebinspector
+include(../../../../WebKit.pri)
+SOURCES  += tst_qwebinspector.cpp
+QT += testlib network
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/WebKit/qt/tests/qwebinspector/tst_qwebinspector.cpp b/WebKit/qt/tests/qwebinspector/tst_qwebinspector.cpp
new file mode 100644
index 0000000..12cd630
--- /dev/null
+++ b/WebKit/qt/tests/qwebinspector/tst_qwebinspector.cpp
@@ -0,0 +1,68 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <QtTest/QtTest>
+
+#include <qdir.h>
+#include <qwebinspector.h>
+#include <qwebpage.h>
+#include <qwebsettings.h>
+
+class tst_QWebInspector : public QObject {
+    Q_OBJECT
+
+private slots:
+    void attachAndDestroy();
+};
+
+void tst_QWebInspector::attachAndDestroy()
+{
+    {   // External inspector + manual destruction of page first
+        QWebPage* page = new QWebPage();
+        page->settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+        QWebInspector* inspector = new QWebInspector();
+        inspector->setPage(page);
+        page->updatePositionDependentActions(QPoint(0, 0));
+        page->triggerAction(QWebPage::InspectElement);
+
+        delete page;
+        delete inspector;
+    }
+    {   // External inspector + manual destruction of inspector first
+        QWebPage* page = new QWebPage();
+        page->settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+        QWebInspector* inspector = new QWebInspector();
+        inspector->setPage(page);
+        page->updatePositionDependentActions(QPoint(0, 0));
+        page->triggerAction(QWebPage::InspectElement);
+
+        delete inspector;
+        delete page;
+    }
+    {   // Internal inspector
+        QWebPage page;
+        page.settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+        page.updatePositionDependentActions(QPoint(0, 0));
+        page.triggerAction(QWebPage::InspectElement);
+    }
+}
+
+QTEST_MAIN(tst_QWebInspector)
+
+#include "tst_qwebinspector.moc"
diff --git a/WebKit/qt/tests/qwebpage/qwebpage.pro b/WebKit/qt/tests/qwebpage/qwebpage.pro
index 6b28efd..7853b28 100644
--- a/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -5,7 +5,7 @@ SOURCES  += tst_qwebpage.cpp
 RESOURCES  += tst_qwebpage.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-DEFINES += SRCDIR=\\\"$$PWD/\\\"
+!symbian:DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
 symbian {
     TARGET.UID3 = 0xA000E53E
diff --git a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 0cf85ee..2a52631 100644
--- a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -21,6 +21,9 @@
 
 #include <QtTest/QtTest>
 
+#include <qgraphicsscene.h>
+#include <qgraphicsview.h>
+#include <qgraphicswebview.h>
 #include <qwebelement.h>
 #include <qwebpage.h>
 #include <qwidget.h>
@@ -37,6 +40,10 @@
 #include <QPushButton>
 #include <QDir>
 
+#if defined(Q_OS_SYMBIAN)
+# define SRCDIR ""
+#endif
+
 // Will try to wait for the condition while allowing event processing
 #define QTRY_COMPARE(__expr, __expected) \
     do { \
@@ -78,6 +85,22 @@ static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
     return timeoutSpy.isEmpty();
 }
 
+class EventSpy : public QObject, public QList<QEvent::Type>
+{
+    Q_OBJECT
+public:
+    EventSpy(QObject* objectToSpy)
+    {
+        objectToSpy->installEventFilter(this);
+    }
+
+    virtual bool eventFilter(QObject* receiver, QEvent* event)
+    {
+        append(event->type());
+        return false;
+    }
+};
+
 class tst_QWebPage : public QObject
 {
     Q_OBJECT
@@ -120,15 +143,20 @@ private slots:
     void testOptionalJSObjects();
     void testEnablePersistentStorage();
     void consoleOutput();
+    void inputMethods_data();
     void inputMethods();
     void defaultTextEncoding();
     void errorPageExtension();
+    void errorPageExtensionInIFrames();
+    void errorPageExtensionInFrameset();
 
     void crashTests_LazyInitializationOfMainFrame();
 
     void screenshot_data();
     void screenshot();
 
+    void originatingObjectInNetworkRequests();
+
 private:
     QWebView* m_view;
     QWebPage* m_page;
@@ -234,7 +262,6 @@ void tst_QWebPage::loadFinished()
 {
     qRegisterMetaType<QWebFrame*>("QWebFrame*");
     qRegisterMetaType<QNetworkRequest*>("QNetworkRequest*");
-    QSignalSpy spyNetworkRequestStarted(m_page, SIGNAL(networkRequestStarted(QWebFrame*, QNetworkRequest*)));
     QSignalSpy spyLoadStarted(m_view, SIGNAL(loadStarted()));
     QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
 
@@ -245,7 +272,6 @@ void tst_QWebPage::loadFinished()
 
     QTest::qWait(3000);
 
-    QVERIFY(spyNetworkRequestStarted.count() > 1);
     QVERIFY(spyLoadStarted.count() > 1);
     QVERIFY(spyLoadFinished.count() > 1);
 
@@ -346,9 +372,11 @@ public:
     TestNetworkManager(QObject* parent) : QNetworkAccessManager(parent) {}
 
     QList<QUrl> requestedUrls;
+    QList<QNetworkRequest> requests;
 
 protected:
     virtual QNetworkReply* createRequest(Operation op, const QNetworkRequest &request, QIODevice* outgoingData) {
+        requests.append(request);
         requestedUrls.append(request.url());
         return QNetworkAccessManager::createRequest(op, request, outgoingData);
     }
@@ -422,7 +450,7 @@ void tst_QWebPage::modified()
     m_page->mainFrame()->setUrl(QUrl("data:text/html,<body>This is fourth page"));
     QVERIFY(m_page->history()->count() == 2);
     m_page->mainFrame()->setUrl(QUrl("data:text/html,<body>This is fifth page"));
-    QVERIFY(::waitForSignal(m_page, SIGNAL(saveFrameStateRequested(QWebFrame*, QWebHistoryItem*))));
+    QVERIFY(::waitForSignal(m_page, SIGNAL(saveFrameStateRequested(QWebFrame*,QWebHistoryItem*))));
 }
 
 void tst_QWebPage::contextMenuCrash()
@@ -450,7 +478,6 @@ void tst_QWebPage::database()
     QVERIFY(QWebSettings::offlineStorageDefaultQuota() == 1024 * 1024);
 
     m_page->settings()->setAttribute(QWebSettings::LocalStorageEnabled, true);
-    m_page->settings()->setAttribute(QWebSettings::SessionStorageEnabled, true);
     m_page->settings()->setAttribute(QWebSettings::OfflineStorageDatabaseEnabled, true);
 
     QString dbFileName = path + "Databases.db";
@@ -459,7 +486,7 @@ void tst_QWebPage::database()
         QFile::remove(dbFileName);
 
     qRegisterMetaType<QWebFrame*>("QWebFrame*");
-    QSignalSpy spy(m_page, SIGNAL(databaseQuotaExceeded(QWebFrame *, QString)));
+    QSignalSpy spy(m_page, SIGNAL(databaseQuotaExceeded(QWebFrame*,QString)));
     m_view->setHtml(QString("<html><head><script>var db; db=openDatabase('testdb', '1.0', 'test database API', 50000); </script></head><body><div></div></body></html>"), QUrl("http://www.myexample.com"));
     QTRY_COMPARE(spy.count(), 1);
     m_page->mainFrame()->evaluateJavaScript("var db2; db2=openDatabase('testdb', '1.0', 'test database API', 50000);");
@@ -637,20 +664,41 @@ class PluginCounterPage : public QWebPage {
 public:
     int m_count;
     QPointer<QObject> m_widget;
-    PluginCounterPage(QObject* parent = 0) : QWebPage(parent), m_count(0), m_widget(0)
+    QObject* m_pluginParent;
+    PluginCounterPage(QObject* parent = 0)
+        : QWebPage(parent)
+        , m_count(0)
+        , m_widget(0)
+        , m_pluginParent(0)
     {
        settings()->setAttribute(QWebSettings::PluginsEnabled, true);
     }
+    ~PluginCounterPage()
+    {
+        if (m_pluginParent)
+            m_pluginParent->deleteLater();
+    }
 };
 
 template<class T>
 class PluginTracerPage : public PluginCounterPage {
 public:
-    PluginTracerPage(QObject* parent = 0) : PluginCounterPage(parent) {}
+    PluginTracerPage(QObject* parent = 0)
+        : PluginCounterPage(parent)
+    {
+        // this is a dummy parent object for the created plugin
+        m_pluginParent = new T;
+    }
     virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&)
     {
         m_count++;
-        return m_widget = new T();
+        m_widget = new T;
+        // need a cast to the specific type, as QObject::setParent cannot be called,
+        // because it is not virtual. Instead it is necesary to call QWidget::setParent,
+        // which also takes a QWidget* instead of a QObject*. Therefore we need to
+        // upcast to T*, which is a QWidget.
+        static_cast<T*>(m_widget.data())->setParent(static_cast<T*>(m_pluginParent));
+        return m_widget;
     }
 };
 
@@ -716,6 +764,8 @@ void tst_QWebPage::createViewlessPlugin()
     page->mainFrame()->setHtml(content);
     QCOMPARE(page->m_count, 1);
     QVERIFY(page->m_widget);
+    QVERIFY(page->m_pluginParent);
+    QVERIFY(page->m_widget->parent() == page->m_pluginParent);
     delete page;
 
 }
@@ -1262,28 +1312,101 @@ void tst_QWebPage::frameAt()
     frameAtHelper(webPage, webPage->mainFrame(), webPage->mainFrame()->pos());
 }
 
+void tst_QWebPage::inputMethods_data()
+{
+    QTest::addColumn<QString>("viewType");
+    QTest::newRow("QWebView") << "QWebView";
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    QTest::newRow("QGraphicsWebView") << "QGraphicsWebView";
+#endif
+}
+
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+static Qt::InputMethodHints inputMethodHints(QObject* object)
+{
+    if (QGraphicsObject* o = qobject_cast<QGraphicsObject*>(object))
+        return o->inputMethodHints();
+    if (QWidget* w = qobject_cast<QWidget*>(object))
+        return w->inputMethodHints();
+    return Qt::InputMethodHints();
+}
+#endif
+
+static bool inputMethodEnabled(QObject* object)
+{
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    if (QGraphicsObject* o = qobject_cast<QGraphicsObject*>(object))
+        return o->flags() & QGraphicsItem::ItemAcceptsInputMethod;
+#endif
+    if (QWidget* w = qobject_cast<QWidget*>(object))
+        return w->testAttribute(Qt::WA_InputMethodEnabled);
+    return false;
+}
+
 void tst_QWebPage::inputMethods()
 {
-    m_view->page()->mainFrame()->setHtml("<html><body>" \
+    QFETCH(QString, viewType);
+    QWebPage* page = new QWebPage;
+    QObject* view = 0;
+    QObject* container = 0;
+    if (viewType == "QWebView") {
+        QWebView* wv = new QWebView;
+        wv->setPage(page);
+        view = wv;
+        container = view;
+    }
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    else if (viewType == "QGraphicsWebView") {
+        QGraphicsWebView* wv = new QGraphicsWebView;
+        wv->setPage(page);
+        view = wv;
+
+        QGraphicsView* gv = new QGraphicsView;
+        QGraphicsScene* scene = new QGraphicsScene(gv);
+        gv->setScene(scene);
+        scene->addItem(wv);
+        wv->setGeometry(QRect(0, 0, 500, 500));
+
+        container = gv;
+    }
+#endif
+    else
+        QVERIFY2(false, "Unknown view type");
+
+    page->mainFrame()->setHtml("<html><body>" \
                                             "<input type='text' id='input1' style='font-family: serif' value='' maxlength='20'/><br>" \
                                             "<input type='password'/>" \
                                             "</body></html>");
-    m_view->page()->mainFrame()->setFocus();
+    page->mainFrame()->setFocus();
+
+    EventSpy viewEventSpy(container);
 
-    QWebElementCollection inputs = m_view->page()->mainFrame()->documentElement().findAll("input");
+    QWebElementCollection inputs = page->mainFrame()->documentElement().findAll("input");
 
     QMouseEvent evpres(QEvent::MouseButtonPress, inputs.at(0).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
-    m_view->page()->event(&evpres);
+    page->event(&evpres);
     QMouseEvent evrel(QEvent::MouseButtonRelease, inputs.at(0).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
-    m_view->page()->event(&evrel);
+    page->event(&evrel);
+
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    QVERIFY(!viewEventSpy.contains(QEvent::RequestSoftwareInputPanel));
+#endif
+    viewEventSpy.clear();
+
+    page->event(&evpres);
+    page->event(&evrel);
+
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    QVERIFY(viewEventSpy.contains(QEvent::RequestSoftwareInputPanel));
+#endif
 
     //ImMicroFocus
-    QVariant variant = m_view->page()->inputMethodQuery(Qt::ImMicroFocus);
+    QVariant variant = page->inputMethodQuery(Qt::ImMicroFocus);
     QRect focusRect = variant.toRect();
     QVERIFY(inputs.at(0).geometry().contains(variant.toRect().topLeft()));
 
     //ImFont
-    variant = m_view->page()->inputMethodQuery(Qt::ImFont);
+    variant = page->inputMethodQuery(Qt::ImFont);
     QFont font = variant.value<QFont>();
     QCOMPARE(QString("-webkit-serif"), font.family());
 
@@ -1292,45 +1415,45 @@ void tst_QWebPage::inputMethods()
     //Insert text.
     {
         QInputMethodEvent eventText("QtWebKit", inputAttributes);
-        QSignalSpy signalSpy(m_view->page(), SIGNAL(microFocusChanged()));
-        m_view->page()->event(&eventText);
+        QSignalSpy signalSpy(page, SIGNAL(microFocusChanged()));
+        page->event(&eventText);
         QCOMPARE(signalSpy.count(), 0);
     }
 
     {
         QInputMethodEvent eventText("", inputAttributes);
         eventText.setCommitString(QString("QtWebKit"), 0, 0);
-        m_view->page()->event(&eventText);
+        page->event(&eventText);
     }
 
 #if QT_VERSION >= 0x040600
     //ImMaximumTextLength
-    variant = m_view->page()->inputMethodQuery(Qt::ImMaximumTextLength);
+    variant = page->inputMethodQuery(Qt::ImMaximumTextLength);
     QCOMPARE(20, variant.toInt());
 
     //Set selection
     inputAttributes << QInputMethodEvent::Attribute(QInputMethodEvent::Selection, 3, 2, QVariant());
     QInputMethodEvent eventSelection("",inputAttributes);
-    m_view->page()->event(&eventSelection);
+    page->event(&eventSelection);
 
     //ImAnchorPosition
-    variant = m_view->page()->inputMethodQuery(Qt::ImAnchorPosition);
+    variant = page->inputMethodQuery(Qt::ImAnchorPosition);
     int anchorPosition =  variant.toInt();
     QCOMPARE(anchorPosition, 3);
 
     //ImCursorPosition
-    variant = m_view->page()->inputMethodQuery(Qt::ImCursorPosition);
+    variant = page->inputMethodQuery(Qt::ImCursorPosition);
     int cursorPosition =  variant.toInt();
     QCOMPARE(cursorPosition, 5);
 
     //ImCurrentSelection
-    variant = m_view->page()->inputMethodQuery(Qt::ImCurrentSelection);
+    variant = page->inputMethodQuery(Qt::ImCurrentSelection);
     QString selectionValue = variant.value<QString>();
     QCOMPARE(selectionValue, QString("eb"));
 #endif
 
     //ImSurroundingText
-    variant = m_view->page()->inputMethodQuery(Qt::ImSurroundingText);
+    variant = page->inputMethodQuery(Qt::ImSurroundingText);
     QString value = variant.value<QString>();
     QCOMPARE(value, QString("QtWebKit"));
 
@@ -1341,29 +1464,46 @@ void tst_QWebPage::inputMethods()
         QInputMethodEvent::Attribute newSelection(QInputMethodEvent::Selection, 0, 0, QVariant());
         attributes.append(newSelection);
         QInputMethodEvent event("composition", attributes);
-        m_view->page()->event(&event);
+        page->event(&event);
     }
 
     // A ongoing composition should not change the surrounding text before it is committed.
-    variant = m_view->page()->inputMethodQuery(Qt::ImSurroundingText);
+    variant = page->inputMethodQuery(Qt::ImSurroundingText);
     value = variant.value<QString>();
     QCOMPARE(value, QString("QtWebKit"));
 #endif
 
     //ImhHiddenText
     QMouseEvent evpresPassword(QEvent::MouseButtonPress, inputs.at(1).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
-    m_view->page()->event(&evpresPassword);
+    page->event(&evpresPassword);
     QMouseEvent evrelPassword(QEvent::MouseButtonRelease, inputs.at(1).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
-    m_view->page()->event(&evrelPassword);
+    page->event(&evrelPassword);
 
-    QVERIFY(m_view->testAttribute(Qt::WA_InputMethodEnabled));
+    QVERIFY(inputMethodEnabled(view));
 #if QT_VERSION >= 0x040600
-    QVERIFY(m_view->inputMethodHints() & Qt::ImhHiddenText);
+    QVERIFY(inputMethodHints(view) & Qt::ImhHiddenText);
+
+    page->event(&evpres);
+    page->event(&evrel);
+    QVERIFY(!(inputMethodHints(view) & Qt::ImhHiddenText));
+#endif
+
+    page->mainFrame()->setHtml("<html><body><p>nothing to input here");
+    viewEventSpy.clear();
+
+    QWebElement para = page->mainFrame()->findFirstElement("p");
+    {
+        QMouseEvent evpres(QEvent::MouseButtonPress, para.geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
+        page->event(&evpres);
+        QMouseEvent evrel(QEvent::MouseButtonRelease, para.geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
+        page->event(&evrel);
+    }
 
-    m_view->page()->event(&evpres);
-    m_view->page()->event(&evrel);
-    QVERIFY(!(m_view->inputMethodHints() & Qt::ImhHiddenText));
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    QVERIFY(!viewEventSpy.contains(QEvent::RequestSoftwareInputPanel));
 #endif
+
+    delete container;
 }
 
 // import a little DRT helper function to trigger the garbage collector
@@ -1394,10 +1534,17 @@ void tst_QWebPage::protectBindingsRuntimeObjectsFromCollector()
 void tst_QWebPage::localURLSchemes()
 {
     int i = QWebSecurityOrigin::localSchemes().size();
+
     QWebSecurityOrigin::removeLocalScheme("file");
     QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
     QWebSecurityOrigin::addLocalScheme("file");
     QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+
+    QWebSecurityOrigin::removeLocalScheme("qrc");
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i - 1);
+    QWebSecurityOrigin::addLocalScheme("qrc");
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+
     QString myscheme = "myscheme";
     QWebSecurityOrigin::addLocalScheme(myscheme);
     QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i + 1);
@@ -1438,11 +1585,6 @@ void tst_QWebPage::testOptionalJSObjects()
     QCOMPARE(testFlag(webPage2, QWebSettings::LocalStorageEnabled, "localStorage", true),  true);
     QCOMPARE(testFlag(webPage1, QWebSettings::LocalStorageEnabled, "localStorage", false), false);
     QCOMPARE(testFlag(webPage2, QWebSettings::LocalStorageEnabled, "localStorage", false), true);
-
-    QCOMPARE(testFlag(webPage1, QWebSettings::SessionStorageEnabled, "sessionStorage", false), false);
-    QCOMPARE(testFlag(webPage2, QWebSettings::SessionStorageEnabled, "sessionStorage", true),  true);
-    QCOMPARE(testFlag(webPage1, QWebSettings::SessionStorageEnabled, "sessionStorage", false), false);
-    QCOMPARE(testFlag(webPage2, QWebSettings::SessionStorageEnabled, "sessionStorage", false), true);
 }
 
 void tst_QWebPage::testEnablePersistentStorage()
@@ -1508,15 +1650,10 @@ public:
 
     virtual bool extension(Extension, const ExtensionOption* option, ExtensionReturn* output)
     {
-        const ErrorPageExtensionOption* info = static_cast<const ErrorPageExtensionOption*>(option);
         ErrorPageExtensionReturn* errorPage = static_cast<ErrorPageExtensionReturn*>(output);
 
-        if (info->frame == mainFrame()) {
-            errorPage->content = "data:text/html,error";
-            return true;
-        }
-
-        return false;
+        errorPage->content = "data:text/html,error";
+        return true;
     }
 };
 
@@ -1527,11 +1664,10 @@ void tst_QWebPage::errorPageExtension()
 
     QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
 
-    page->mainFrame()->load(QUrl("qrc:///frametest/index.html"));
+    m_view->setUrl(QUrl("data:text/html,foo"));
     QTRY_COMPARE(spyLoadFinished.count(), 1);
 
     page->mainFrame()->setUrl(QUrl("http://non.existent/url"));
-    QTest::qWait(2000);
     QTRY_COMPARE(spyLoadFinished.count(), 2);
     QCOMPARE(page->mainFrame()->toPlainText(), QString("data:text/html,error"));
     QCOMPARE(page->history()->count(), 2);
@@ -1539,6 +1675,53 @@ void tst_QWebPage::errorPageExtension()
     QCOMPARE(page->history()->canGoBack(), true);
     QCOMPARE(page->history()->canGoForward(), false);
 
+    page->triggerAction(QWebPage::Back);
+    QTest::qWait(2000);
+    QCOMPARE(page->history()->canGoBack(), false);
+    QCOMPARE(page->history()->canGoForward(), true);
+
+    page->triggerAction(QWebPage::Forward);
+    QTest::qWait(2000);
+    QCOMPARE(page->history()->canGoBack(), true);
+    QCOMPARE(page->history()->canGoForward(), false);
+
+    page->triggerAction(QWebPage::Back);
+    QTest::qWait(2000);
+    QCOMPARE(page->history()->canGoBack(), false);
+    QCOMPARE(page->history()->canGoForward(), true);
+    QCOMPARE(page->history()->currentItem().url(), QUrl("data:text/html,foo"));
+
+    m_view->setPage(0);
+}
+
+void tst_QWebPage::errorPageExtensionInIFrames()
+{
+    ErrorPage* page = new ErrorPage;
+    m_view->setPage(page);
+
+    m_view->setHtml(QString("data:text/html,"
+                            "<h1>h1</h1>"
+                            "<iframe src='data:text/html,<p/>p'></iframe>"
+                            "<iframe src='non-existent.html'></iframe>"));
+    QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
+    QTRY_COMPARE(spyLoadFinished.count(), 1);
+
+    QCOMPARE(page->mainFrame()->childFrames()[1]->toPlainText(), QString("data:text/html,error"));
+
+    m_view->setPage(0);
+}
+
+void tst_QWebPage::errorPageExtensionInFrameset()
+{
+    ErrorPage* page = new ErrorPage;
+    m_view->setPage(page);
+
+    m_view->load(QUrl("qrc:///frametest/index.html"));
+
+    QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
+    QTRY_COMPARE(spyLoadFinished.count(), 1);
+    QCOMPARE(page->mainFrame()->childFrames()[1]->toPlainText(), QString("data:text/html,error"));
+
     m_view->setPage(0);
 }
 
@@ -1609,5 +1792,27 @@ void tst_QWebPage::screenshot()
     QDir::setCurrent(QApplication::applicationDirPath());
 }
 
+void tst_QWebPage::originatingObjectInNetworkRequests()
+{
+    TestNetworkManager* networkManager = new TestNetworkManager(m_page);
+    m_page->setNetworkAccessManager(networkManager);
+    networkManager->requests.clear();
+
+    m_view->setHtml(QString("data:text/html,<frameset cols=\"25%,75%\"><frame src=\"data:text/html,"
+                            "<head><meta http-equiv='refresh' content='1'></head>foo \">"
+                            "<frame src=\"data:text/html,bar\"></frameset>"), QUrl());
+    QVERIFY(::waitForSignal(m_view, SIGNAL(loadFinished(bool))));
+
+    QCOMPARE(networkManager->requests.count(), 2);
+
+    QList<QWebFrame*> childFrames = m_page->mainFrame()->childFrames();
+    QCOMPARE(childFrames.count(), 2);
+
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    for (int i = 0; i < 2; ++i)
+        QVERIFY(qobject_cast<QWebFrame*>(networkManager->requests.at(i).originatingObject()) == childFrames.at(i));
+#endif
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/WebKit/qt/tests/qwebview/data/frame_a.html b/WebKit/qt/tests/qwebview/data/frame_a.html
new file mode 100644
index 0000000..9ff68f1
--- /dev/null
+++ b/WebKit/qt/tests/qwebview/data/frame_a.html
@@ -0,0 +1,2 @@
+<a href="http://google.com" target="frame_b"><img src="" width=100 height=100 alt="Google"></a>
+<a href="http://yahoo.com" target="frame_b"><img src="" width=100 height=100 alt="Yahoo"></a>
diff --git a/WebKit/qt/tests/qwebview/data/index.html b/WebKit/qt/tests/qwebview/data/index.html
new file mode 100644
index 0000000..c53ad09
--- /dev/null
+++ b/WebKit/qt/tests/qwebview/data/index.html
@@ -0,0 +1,4 @@
+<frameset cols="25%,75%">
+   <frame src="frame_a.html" name="frame_a">
+   <frame src="frame_b.html" name="frame_b">
+</frameset>
diff --git a/WebKit/qt/tests/qwebview/qwebview.pro b/WebKit/qt/tests/qwebview/qwebview.pro
index e67bb7a..735537b 100644
--- a/WebKit/qt/tests/qwebview/qwebview.pro
+++ b/WebKit/qt/tests/qwebview/qwebview.pro
@@ -4,6 +4,7 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qwebview.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+RESOURCES  += tst_qwebview.qrc
 DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
 symbian {
diff --git a/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index 9204223..bd2f185 100644
--- a/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -20,6 +20,7 @@
 */
 
 #include <qtest.h>
+#include "../util.h"
 
 #include <qpainter.h>
 #include <qwebview.h>
@@ -41,12 +42,12 @@ public slots:
 
 private slots:
     void renderHints();
-    void guessUrlFromString_data();
-    void guessUrlFromString();
     void getWebKitVersion();
 
     void reusePage_data();
     void reusePage();
+
+    void crashTests();
 };
 
 // This will be called before the first test function is executed.
@@ -105,68 +106,6 @@ void tst_QWebView::renderHints()
     QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
 }
 
-void tst_QWebView::guessUrlFromString_data()
-{
-    QTest::addColumn<QString>("string");
-    QTest::addColumn<QUrl>("guessUrlFromString");
-
-    // Null
-    QTest::newRow("null") << QString() << QUrl();
-
-    // File
-    QDirIterator it(QDir::homePath());
-    QString fileString;
-    int c = 0;
-    while (it.hasNext()) {
-        it.next();
-        QTest::newRow(QString("file-%1").arg(c++).toLatin1()) << it.filePath() << QUrl::fromLocalFile(it.filePath());
-    }
-
-    // basic latin1
-    QTest::newRow("unicode-0") << QString::fromUtf8("å.com/") << QUrl::fromEncoded(QString::fromUtf8("http://å.com/").toUtf8(), QUrl::TolerantMode);
-    // unicode
-    QTest::newRow("unicode-1") << QString::fromUtf8("λ.com/") << QUrl::fromEncoded(QString::fromUtf8("http://λ.com/").toUtf8(), QUrl::TolerantMode);
-
-    // no scheme
-    QTest::newRow("add scheme-0") << "webkit.org" << QUrl("http://webkit.org");
-    QTest::newRow("add scheme-1") << "www.webkit.org" << QUrl("http://www.webkit.org");
-    QTest::newRow("add scheme-2") << "ftp.webkit.org" << QUrl("ftp://ftp.webkit.org");
-    QTest::newRow("add scheme-3") << "webkit" << QUrl("webkit");
-
-    // QUrl's tolerant parser should already handle this
-    QTest::newRow("not-encoded-0") << "http://webkit.org/test page.html" << QUrl("http://webkit.org/test%20page.html");
-
-    // Make sure the :80, i.e. port doesn't screw anything up
-    QUrl portUrl("http://webkit.org");
-    portUrl.setPort(80);
-    QTest::newRow("port-0") << "webkit.org:80" << portUrl;
-    QTest::newRow("port-1") << "http://webkit.org:80" << portUrl;
-
-    // mailto doesn't have a ://, but is valid
-    QUrl mailto("ben@meyerhome.net");
-    mailto.setScheme("mailto");
-    QTest::newRow("mailto") << "mailto:ben@meyerhome.net" << mailto;
-
-    // misc
-    QTest::newRow("localhost-0") << "localhost" << QUrl("http://localhost");
-    QTest::newRow("localhost-1") << "localhost:80" << QUrl("http://localhost:80");
-    QTest::newRow("spaces-0") << "  http://webkit.org/test page.html " << QUrl("http://webkit.org/test%20page.html");
-
-    // FYI: The scheme in the resulting url user
-    QUrl authUrl("user:pass@domain.com");
-    QTest::newRow("misc-1") << "user:pass@domain.com" << authUrl;
-}
-
-// public static QUrl guessUrlFromString(QString const& string)
-void tst_QWebView::guessUrlFromString()
-{
-    QFETCH(QString, string);
-    QFETCH(QUrl, guessUrlFromString);
-
-    QUrl url = QWebView::guessUrlFromString(string);
-    QCOMPARE(url, guessUrlFromString);
-}
-
 void tst_QWebView::getWebKitVersion()
 {
     QVERIFY(qWebKitVersion().toDouble() > 0);
@@ -193,18 +132,18 @@ void tst_QWebView::reusePage()
     mainFrame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
     if (html.contains("</embed>")) {
         // some reasonable time for the PluginStream to feed test.swf to flash and start painting
-        QTest::qWait(2000);
+        waitForSignal(view1, SIGNAL(loadFinished(bool)), 2000);
     }
 
     view1->show();
-    QTest::qWait(2000);
+    QTest::qWaitForWindowShown(view1);
     delete view1;
     QVERIFY(page != 0); // deleting view must not have deleted the page, since it's not a child of view
 
     QWebView *view2 = new QWebView;
     view2->setPage(page);
     view2->show(); // in Windowless mode, you should still be able to see the plugin here
-    QTest::qWait(2000);
+    QTest::qWaitForWindowShown(view2);
     delete view2;
 
     delete page; // must not crash
@@ -212,6 +151,46 @@ void tst_QWebView::reusePage()
     QDir::setCurrent(QApplication::applicationDirPath());
 }
 
+// Class used in crashTests
+class WebViewCrashTest : public QObject {
+    Q_OBJECT
+    QWebView* m_view;
+public:
+    bool m_executed;
+
+
+    WebViewCrashTest(QWebView* view)
+      : m_view(view)
+      , m_executed(false)
+    {
+        view->connect(view, SIGNAL(loadProgress(int)), this, SLOT(loading(int)));
+    }
+
+private slots:
+    void loading(int progress)
+    {
+        if (progress >= 20 && progress < 90) {
+            QVERIFY(!m_executed);
+            m_view->stop();
+            m_executed = true;
+        }
+    }
+};
+
+
+// Should not crash.
+void tst_QWebView::crashTests()
+{
+    // Test if loading can be stopped in loadProgress handler without crash.
+    // Test page should have frames.
+    QWebView view;
+    WebViewCrashTest tester(&view);
+    QUrl url("qrc:///data/index.html");
+    view.load(url);
+    QTRY_VERIFY(tester.m_executed); // If fail it means that the test wasn't executed.
+}
+
+
 QTEST_MAIN(tst_QWebView)
 #include "tst_qwebview.moc"
 
diff --git a/WebKit/qt/tests/qwebview/tst_qwebview.qrc b/WebKit/qt/tests/qwebview/tst_qwebview.qrc
new file mode 100644
index 0000000..ede34a9
--- /dev/null
+++ b/WebKit/qt/tests/qwebview/tst_qwebview.qrc
@@ -0,0 +1,7 @@
+<!DOCTYPE RCC><RCC version="1.0">
+<qresource>
+    <file>data/index.html</file>
+    <file>data/frame_a.html</file>
+</qresource>
+</RCC>
+
diff --git a/WebKit/qt/tests/tests.pro b/WebKit/qt/tests/tests.pro
index 81cc8f3..b967ca9 100644
--- a/WebKit/qt/tests/tests.pro
+++ b/WebKit/qt/tests/tests.pro
@@ -1,4 +1,4 @@
 
 TEMPLATE = subdirs
-SUBDIRS = qwebframe qwebpage qwebelement qgraphicswebview qwebhistoryinterface qwebplugindatabase qwebview qwebhistory
+SUBDIRS = qwebframe qwebpage qwebelement qgraphicswebview qwebhistoryinterface qwebview qwebhistory qwebinspector
 greaterThan(QT_MINOR_VERSION, 4): SUBDIRS += benchmarks/painting/tst_painting.pro benchmarks/loading/tst_loading.pro
diff --git a/WebKit/qt/tests/util.h b/WebKit/qt/tests/util.h
index 7f7e613..15af262 100644
--- a/WebKit/qt/tests/util.h
+++ b/WebKit/qt/tests/util.h
@@ -18,6 +18,33 @@
 */
 // Functions and macros that really need to be in QTestLib
 
+#include <QEventLoop>
+#include <QSignalSpy>
+#include <QTimer>
+
+/**
+ * Starts an event loop that runs until the given signal is received.
+ * Optionally the event loop
+ * can return earlier on a timeout.
+ *
+ * \return \p true if the requested signal was received
+ *         \p false on timeout
+ */
+static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
+{
+    QEventLoop loop;
+    QObject::connect(obj, signal, &loop, SLOT(quit()));
+    QTimer timer;
+    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
+    if (timeout > 0) {
+        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
+        timer.setSingleShot(true);
+        timer.start(timeout);
+    }
+    loop.exec();
+    return timeoutSpy.isEmpty();
+}
+
 // Will try to wait for the condition while allowing event processing
 #define QTRY_VERIFY(__expr) \
     do { \
@@ -45,4 +72,3 @@
         } \
         QCOMPARE(__expr, __expected); \
     } while(0)
-
diff --git a/WebKit/win/AccessibleBase.cpp b/WebKit/win/AccessibleBase.cpp
index 55cbab3..47b8369 100644
--- a/WebKit/win/AccessibleBase.cpp
+++ b/WebKit/win/AccessibleBase.cpp
@@ -190,11 +190,9 @@ HRESULT STDMETHODCALLTYPE AccessibleBase::get_accDescription(VARIANT vChild, BST
     if (FAILED(hr))
         return hr;
 
-    // TODO: Description, for SELECT subitems, should be a string describing
-    // the position of the item in its group and of the group in the list (see
-    // Firefox).
-    if (*description = BString(wrapper(childObj)->description()).release())
+    if (*description = BString(childObj->descriptionForMSAA()).release())
         return S_OK;
+
     return S_FALSE;
 }
 
@@ -211,6 +209,13 @@ HRESULT STDMETHODCALLTYPE AccessibleBase::get_accRole(VARIANT vChild, VARIANT* p
     if (FAILED(hr))
         return hr;
 
+    String roleString = childObj->stringRoleForMSAA();
+    if (!roleString.isEmpty()) {
+        V_VT(pvRole) = VT_BSTR;
+        V_BSTR(pvRole) = BString(roleString).release();
+        return S_OK;
+    }
+
     pvRole->vt = VT_I4;
     pvRole->lVal = wrapper(childObj)->role();
     return S_OK;
@@ -232,7 +237,7 @@ HRESULT STDMETHODCALLTYPE AccessibleBase::get_accState(VARIANT vChild, VARIANT*
     pvState->vt = VT_I4;
     pvState->lVal = 0;
 
-    if (childObj->isAnchor())
+    if (childObj->isLinked())
         pvState->lVal |= STATE_SYSTEM_LINKED;
 
     if (childObj->isHovered())
@@ -514,26 +519,12 @@ HRESULT STDMETHODCALLTYPE AccessibleBase::accDoDefaultAction(VARIANT vChild)
 // AccessibleBase
 String AccessibleBase::name() const
 {
-    return m_object->title();
+    return m_object->nameForMSAA();
 }
 
 String AccessibleBase::value() const
 {
-    return m_object->stringValue();
-}
-
-String AccessibleBase::description() const
-{
-    String desc = m_object->accessibilityDescription();
-    if (desc.isNull())
-        return desc;
-
-    // From the Mozilla MSAA implementation:
-    // "Signal to screen readers that this description is speakable and is not
-    // a formatted positional information description. Don't localize the
-    // 'Description: ' part of this string, it will be parsed out by assistive
-    // technologies."
-    return "Description: " + desc;
+    return m_object->stringValueForMSAA();
 }
 
 static long MSAARole(AccessibilityRole role)
diff --git a/WebKit/win/AccessibleBase.h b/WebKit/win/AccessibleBase.h
index c69c57d..3b6bce8 100644
--- a/WebKit/win/AccessibleBase.h
+++ b/WebKit/win/AccessibleBase.h
@@ -95,7 +95,6 @@ protected:
 
     virtual WebCore::String name() const;
     virtual WebCore::String value() const;
-    virtual WebCore::String description() const;
     virtual long role() const;
 
     HRESULT getAccessibilityObjectForChild(VARIANT vChild, WebCore::AccessibilityObject*&) const;
diff --git a/WebKit/win/CFDictionaryPropertyBag.cpp b/WebKit/win/CFDictionaryPropertyBag.cpp
index 32457f1..f4fb5b3 100644
--- a/WebKit/win/CFDictionaryPropertyBag.cpp
+++ b/WebKit/win/CFDictionaryPropertyBag.cpp
@@ -33,7 +33,7 @@
 // CFDictionaryPropertyBag -----------------------------------------------
 
 CFDictionaryPropertyBag::CFDictionaryPropertyBag()
-: m_refCount(1)
+: m_refCount(0)
 {
     gClassCount++;
     gClassNameCount.add("CFDictionaryPropertyBag");
@@ -45,10 +45,9 @@ CFDictionaryPropertyBag::~CFDictionaryPropertyBag()
     gClassNameCount.remove("CFDictionaryPropertyBag");
 }
 
-CFDictionaryPropertyBag* CFDictionaryPropertyBag::createInstance()
+COMPtr<CFDictionaryPropertyBag> CFDictionaryPropertyBag::createInstance()
 {
-    CFDictionaryPropertyBag* instance = new CFDictionaryPropertyBag();
-    return instance;
+    return new CFDictionaryPropertyBag;
 }
 
 void CFDictionaryPropertyBag::setDictionary(CFMutableDictionaryRef dictionary)
diff --git a/WebKit/win/CFDictionaryPropertyBag.h b/WebKit/win/CFDictionaryPropertyBag.h
index 23763b3..3cac464 100644
--- a/WebKit/win/CFDictionaryPropertyBag.h
+++ b/WebKit/win/CFDictionaryPropertyBag.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,42 +23,37 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CFDictionaryPropertyBag_H
-#define CFDictionaryPropertyBag_H
+#ifndef CFDictionaryPropertyBag_h
+#define CFDictionaryPropertyBag_h
 
-#include <CoreFoundation/CoreFoundation.h>
+#include <WebCore/COMPtr.h>
 #include <wtf/RetainPtr.h>
 
-class CFDictionaryPropertyBag : public IPropertyBag
-{
-public:
-    static CFDictionaryPropertyBag* createInstance();
-protected:
-    CFDictionaryPropertyBag();
-    ~CFDictionaryPropertyBag();
+typedef struct __CFDictionary* CFMutableDictionaryRef;
 
+class CFDictionaryPropertyBag : public IPropertyBag {
 public:
-    // IUnknown
-    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
-    virtual ULONG STDMETHODCALLTYPE AddRef(void);
-    virtual ULONG STDMETHODCALLTYPE Release(void);
+    static COMPtr<CFDictionaryPropertyBag> createInstance();
 
-    // IPropertyBag
-    virtual /* [local] */ HRESULT STDMETHODCALLTYPE Read( 
-        /* [in] */ LPCOLESTR pszPropName,
-        /* [out][in] */ VARIANT *pVar,
-        /* [in] */ IErrorLog *pErrorLog);
-        
-    virtual HRESULT STDMETHODCALLTYPE Write( 
-        /* [in] */ LPCOLESTR pszPropName,
-        /* [in] */ VARIANT *pVar);
+    // IUnknown
+    virtual ULONG STDMETHODCALLTYPE AddRef();
+    virtual ULONG STDMETHODCALLTYPE Release();
 
     void setDictionary(CFMutableDictionaryRef dictionary);
     CFMutableDictionaryRef dictionary() const;
 
 private:
+    CFDictionaryPropertyBag();
+    ~CFDictionaryPropertyBag();
+
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void** ppvObject);
+
+    // IPropertyBag
+    virtual HRESULT STDMETHODCALLTYPE Read(LPCOLESTR pszPropName, VARIANT*, IErrorLog*);
+    virtual HRESULT STDMETHODCALLTYPE Write(LPCOLESTR pszPropName, VARIANT*);
+
     RetainPtr<CFMutableDictionaryRef> m_dictionary;
     ULONG m_refCount;
 };
 
-#endif
\ No newline at end of file
+#endif // CFDictionaryPropertyBag_h
diff --git a/WebKit/win/ChangeLog b/WebKit/win/ChangeLog
index 6253010..95705a9 100644
--- a/WebKit/win/ChangeLog
+++ b/WebKit/win/ChangeLog
@@ -1,3 +1,997 @@
+2009-12-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Pass more information about a plug-in to the PluginHalterDelegate
+
+        Reviewed by Adam Roben.
+
+        * Interfaces/IWebPluginHalterDelegate.idl:
+        Add new parameters.
+
+        * WebCoreSupport/WebPluginHalterClient.cpp:
+        (WebPluginHalterClient::shouldHaltPlugin):
+        Update for new parameters. Pass them when making the delegate call.
+
+        * WebCoreSupport/WebPluginHalterClient.h:
+        Update for new parameters.
+
+2009-12-09  Brent Fulgham  <bfulgham@webkit.org>
+
+        Revert incorrect commit-box update r51911.
+        It mistakenly set the selectAll implementation in the
+        deslectAll method. 
+
+        * WebFrame.cpp:
+        (WebFrame::deselectAll):
+
+2009-12-09  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Provide an implementation for 'selectAll'
+        https://bugs.webkit.org/show_bug.cgi?id=32296
+
+        * WebFrame.cpp:
+        (WebFrame::selectAll): Implement "SelectAll" command.
+
+2009-12-09  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Provide an implementation for 'selectAll'
+        https://bugs.webkit.org/show_bug.cgi?id=32296
+
+        * WebFrame.cpp:
+        (WebFrame::selectAll): Implement "SelectAll" command.
+
+2009-12-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Delay load DLLs for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        If the DLLs (d3d9 and QuartzCore). are not present it
+        turns off accelerated compositing and avoids calling 
+        any of the functions in the DLLs.
+
+        * WebView.cpp:
+        * WebView.h:
+
+2009-12-08  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * Interfaces/WebKit.idl: Touched this to force Interfaces.vcproj to rebuild.
+
+2009-12-08  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        Split two-clause assertions into two separate assertions.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLInputElement::isTextField):
+        Split a two-clause assertion into two separate assertions.
+        (DOMHTMLInputElement::rectOnScreen):
+        Added the two assertions here that all other functions in this group shared.
+        (DOMHTMLInputElement::selectedRange):
+        Split a two-clause assertion into two separate assertions.
+        (DOMHTMLInputElement::setAutofilled):
+        Split a two-clause assertion into two separate assertions.
+        (DOMHTMLInputElement::isAutofilled):
+        Split a two-clause assertion into two separate assertions.
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Win.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebKit.vcproj/WebKit.vcproj:
+
+2009-12-08  John Sullivan  <sullivan@apple.com>
+
+        Add isAutofilled getter to match existing setter.
+
+        Reviewed by Ada Chan.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLInputElement::isAutofilled):
+        Implemented new cover function.
+        
+        * DOMHTMLClasses.h:
+        Declared new cover function.
+        
+        * Interfaces/DOMPrivate.idl:
+        Declared new interface.
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix part III).
+
+        * WebView.cpp:
+        (WebView::stringByEvaluatingJavaScriptFromString):
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix part II).
+
+        * WebView.cpp:
+        (WebView::stringByEvaluatingJavaScriptFromString):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * Interfaces/IWebFrameLoadDelegatePrivate2.idl:
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidPushStateWithinPage):
+        (WebFrameLoaderClient::dispatchDidReplaceStateWithinPage):
+        (WebFrameLoaderClient::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/WebFrameLoaderClient.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        * WebCoreSupport/WebInspectorClient.cpp:
+        (WebInspectorClient::attachWindow):
+        (WebInspectorClient::detachWindow):
+        (WebInspectorClient::showWindowWithoutNotifications):
+        * WebCoreSupport/WebInspectorClient.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidAddBackForwardItem): Add an empty implementation. Method added to FrameLoaderClient by Android (see bug).
+        (WebFrameLoaderClient::dispatchDidRemoveBackForwardItem): ditto.
+        (WebFrameLoaderClient::dispatchDidChangeBackForwardIndex): ditto.
+        * WebCoreSupport/WebFrameLoaderClient.h:
+
+2009-12-02  Timothy Hatcher  <timothy@apple.com>
+
+        Move setValueForUser to the end of the DOMHTMLInputElement interface
+        so it is fine for binary compatibility.
+
+        Directed by Steve Falkenburg.
+
+        * Interfaces/DOMHTML.idl:
+
+2009-12-02  Timothy Hatcher  <timothy@apple.com>
+
+        Expose setValueForUser for the COM DOMHTMLInputElement.
+
+        <rdar://problem/6760590> Would like a way to detect a login form AutoFill from JavaScript
+
+        Reviewed by Dan Bernstein.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLInputElement::setValueForUser):
+        * Interfaces/DOMHTML.idl:
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix windows build.
+
+        * WebFrame.cpp:
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add API used by the new 'sampleSVGAnimationForElementAtTime' DRT method,
+        forwarding the call to SVGDocumentExtensions, if SVG is enabled.
+
+        Implemented just like the existing pauseAnimation* methods for CSS animations.
+
+        * Interfaces/IWebFramePrivate.idl:
+        * WebFrame.cpp:
+        (WebFrame::pauseSVGAnimation):
+        * WebFrame.h:
+
+2009-11-30  Adam Roben  <aroben@apple.com>
+
+        Fix double-free of BSTRs passed to WebNavigationData::createInstance
+
+        WebFrameLoaderClient::updateGlobalHistory was converting
+        WebCore::Strings to WebCore::BStrings, then passing them to
+        WebNavigationData::createInstance. But the latter function takes BSTR
+        parameters and adopts them into WebCore::BStrings. So the end result
+        was that two WebCore::BStrings would end up freeing each underlying
+        BSTR.
+
+        The fix is to only convert to WebCore::BString inside
+        WebNavigationData.
+
+        Fixes <http://webkit.org/b/31998> <rdar://problem/7383452> REGRESSION
+        (r49564): Crash in updateGlobalHistory when running Javascript iBench
+        test
+
+        I couldn't find a way to reproduce this in DumpRenderTree.
+
+        Reviewed by Steve Falkenburg.
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::updateGlobalHistory): Pass WebCore::Strings to
+        WebNavigationData::createInstance.
+
+        * WebNavigationData.cpp:
+        (WebNavigationData::WebNavigationData):
+        (WebNavigationData::createInstance):
+        * WebNavigationData.h:
+        Changed to take const WebCore::String&s instead of BSTRs and to
+        convert the Strings to BStrings at this level.
+
+2009-11-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit clients that don't implement didClearWindowObjectForFrameInScriptWorld should fall back to didClearWindowObject
+        https://bugs.webkit.org/show_bug.cgi?id=31986
+
+        * WebFrame.cpp:
+        (WebFrame::dispatchDidClearWindowObjectInWorld): Fall back if E_NOTIMPL returned.
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Another Windows build fix
+        
+        Got rid of d3d.lib and d3dx9.lib dependency. Not needed until
+        we turn on ACCELERATED_COMPOSITING
+
+        * WebKit.vcproj/WebKit.vcproj:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Fixed Windows build
+        
+        Got rid of QuartzCore.lib dependency. Not needed until
+        we turn on ACCELERATED_COMPOSITING
+
+        * WebKit.vcproj/WebKit.vcproj:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+        
+        This is the WebKit side of the implementation. It plumbs the root layer
+        from WebCore. It also makes changes to WebView which places the 
+        backing store of the page into the root compositing layer so it is 
+        properly composited with all the other layers. This deals with resizing, 
+        scrolling, and incremental repaint of the page.
+
+        * WebCoreSupport/WebChromeClient.cpp:
+        (WebChromeClient::attachRootGraphicsLayer):
+        (WebChromeClient::scheduleCompositingLayerSync):
+        * WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient::setNeedsOneShotDrawingSynchronization):
+        * WebKit.vcproj/WebKit.vcproj:
+        * WebView.cpp:
+        (WebView::WebView):
+        (WebView::close):
+        (WebView::repaint):
+        (WebView::scrollBackingStore):
+        (WebView::paint):
+        (WebViewWndProc):
+        (WebView::setRootChildLayer):
+        (WebView::setAcceleratedCompositing):
+        (WebView::setRootLayerContents):
+        * WebView.h:
+        (WebView::isAcceleratedCompositing):
+        (WebView::resizeLayerWindow):
+        (WebView::layerWindowBecameVisible):
+        (WebView::setRootLayerNeedsDisplay):
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        * GEN_DOMObject.cpp:
+        * WebScriptObject.cpp:
+
+2009-11-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix. Unreviewed.
+
+        * Interfaces/IWebSerializedJSValue.idl:
+
+2009-11-20  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        DOMElement::tagName() is unimplemented
+
+        https://bugs.webkit.org/show_bug.cgi?id=31746
+
+        Reviewed by Darin Adler.
+
+        * DOMCoreClasses.cpp:
+        (DOMElement::tagName):
+        Create a BString from the element's tag name, and release its BSTR
+        into result.
+
+2009-11-20  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        DOMNode::childNodes() is unimplemented
+
+        https://bugs.webkit.org/show_bug.cgi?id=31745
+
+        Reviewed by Darin Adler.
+
+        * DOMCoreClasses.cpp:
+        (DOMNode::childNodes):
+        Create a DOMNodeList from the node's child nodes.
+
+2009-11-20  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Change WebSerializedJSValue on Windows to have a zero-argument createInstance call.  Move the
+        serialization into a separate serialize() function that can be called after the object has been
+        created.
+
+        Fix a typo in serialize() caused when fixing build bustage (put a ! back in).
+
+        * Interfaces/IWebSerializedJSValue.idl:
+        * WebSerializedJSValue.cpp:
+        (WebSerializedJSValue::WebSerializedJSValue):
+        (WebSerializedJSValue::createInstance):
+        (WebSerializedJSValue::serialize):
+        (WebSerializedJSValue::deserialize):
+        * WebSerializedJSValue.h:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Another go at the Windows Build Fix - this is a couple steps of it,
+        so a little more involved than most build fixes.
+
+        * Interfaces/IWebSerializedJSValue.idl:
+        * Interfaces/JavaScriptCoreAPITypes.idl:
+        * WebKit.vcproj/Interfaces.vcproj:
+        * WebSerializedJSValue.cpp:
+        (WebSerializedJSValue::deserialize):
+        * WebSerializedJSValue.h:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Build fix for Windows - only declare JSContextRef once, instead
+        of in two different idl files. Create a new file to hold the
+        definition of JSContextRef.
+
+        * Interfaces/IWebFrameLoadDelegate.idl:
+        * Interfaces/IWebSerializedJSValue.idl:
+        * Interfaces/JavaScriptCoreAPITypes.idl: Added.
+        * Interfaces/WebKit.idl:
+        * WebKit.vcproj/Interfaces.vcproj:
+
+2009-11-20  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt and Jon Honeycutt.
+
+        Add support for WebSerializedJSValue to WebKit.  This object wraps the SerializedScriptValue functionality in WebCore
+        and exposes the ability to do JS value serialization/deserialization to WebKit clients.
+
+        * Interfaces/IWebSerializedJSValue.idl: Added.
+        * Interfaces/WebKit.idl:
+        * WebKit.vcproj/WebKit.vcproj:
+        * WebSerializedJSValue.cpp: Added.
+        (WebSerializedJSValue::WebSerializedJSValue):
+        (WebSerializedJSValue::~WebSerializedJSValue):
+        (WebSerializedJSValue::createInstance):
+        (WebSerializedJSValue::AddRef):
+        (WebSerializedJSValue::Release):
+        (WebSerializedJSValue::QueryInterface):
+        (WebSerializedJSValue::deserialize):
+        * WebSerializedJSValue.h: Added.
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * WebDownloadCFNet.cpp:
+        (WebDownload::init):
+        (WebDownload::initWithRequest):
+        (WebDownload::initToResumeWithBundle):
+        Update for loaderRunLoop() now being in its own header.
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        * WebCoreLocalizedStrings.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+            Add accessibility help strings for media controller closed caption button.
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        * WebCoreLocalizedStrings.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Changes associated with renaming RenderTextControl::isUserEdited.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLInputElement::isUserEdited): Formerly named isUserEdited.
+        (DOMHTMLTextAreaElement::isUserEdited): Ditto.
+
+2009-11-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Implement DOMHTMLInputElement::replaceCharactersInRange().
+
+        https://bugs.webkit.org/show_bug.cgi?id=31492
+
+        Reviewed by Dan Bernstein.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLInputElement::replaceCharactersInRange):
+        Get the text of the input field. Replace the given range with the
+        replacement text, and set this new string as the input element's value.
+        Select from index to the end of the field. This matches the
+        implementation in the Obj-C bindings.
+
+2009-11-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        DOMHTMLOptionElement is missing some functionality.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31491
+
+        Reviewed by Dan Bernstein.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLOptionElement::text):
+        Cast m_element to an HTMLOptionElement, and call its text() function.
+        (DOMHTMLOptionElement::label):
+        Ditto, for label().
+
+2009-11-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        DOMHTMLSelectElement is missing some implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31489
+
+        Reviewed by Dan Bernstein.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLSelectElement::options):
+        Cast m_element to an HTMLSelectElement. If it has no options, return
+        E_FAIL. Otherwise, create a DOMHTMLOptionsCollection to wrap the
+        options, and return it.
+        (DOMHTMLSelectElement::activateItemAtIndex):
+        If the index is out of bounds, return E_FAIL. Otherwise, select the
+        item.
+
+2009-11-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        DOMHTMLOptionsCollection is missing some implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31488
+
+        Reviewed by Dan Bernstein.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLOptionsCollection::DOMHTMLOptionsCollection):
+        Initialize m_collection.
+        (DOMHTMLOptionsCollection::createInstance):
+        Create a DOMHTMLOptionsCollection. If we fail to query for
+        IDOMHTMLOptionsCollection, delete it, and return 0. Otherwise, return
+        the result.
+        (DOMHTMLOptionsCollection::length):
+        (DOMHTMLOptionsCollection::item):
+        Create a DOMNode for the WebCore Node. If this is 0, return E_FAIL.
+        (DOMHTMLOptionsCollection::namedItem):
+        Correct the signature of this function.
+
+        * DOMHTMLClasses.h:
+        Declare DOMHTMLOptionsCollection::createInstance(). Correct the
+        signature of namedItem() to match IDOMHTMLOptionsCollection. Add a
+        member to DOMHTMLOptionsCollection to hold the WebCore object.
+
+2009-11-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        DOMHTMLInputElement::rectOnScreen() returns the wrong rect
+
+        https://bugs.webkit.org/show_bug.cgi?id=31487
+
+        Reviewed by Darin Adler.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLInputElement::rectOnScreen):
+        Return the rect on screen, not the rect in the window.
+
+2009-11-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by NOBODY - Build Fix.
+
+        Correct build error in Debug_Cairo target after @49705.
+
+        * WebKit.vcproj/WebKit.vcproj: Revise JavaScriptCore.lib
+          dependency to have proper "_debug" suffix needed by
+          the Debug_Cairo target.
+
+2009-11-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by NOBODY - Build Fix.
+
+        Touch files to try to fix the build.
+
+        * Interfaces/IWebInspector.idl:
+        * Interfaces/WebKit.idl:
+        * WebKit.vcproj/Interfaces.vcproj:
+
+2009-11-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make DRT show web inspector for tests in inspector/ folder.
+        - Updated DRT to show/close inspector for all tests under /inspector
+        - Introduced LayoutTestController::setTimelineProfilingEnabled and
+          WebInspector::setTimelineProfilingEnabled beside setJavaScriptProfilingEnabled
+        - Removed reload on each inspector test
+        - Renamed fast/inspector to fast/inspector-support in order not to trigger
+        inspector for those.
+        - Reimplemented timeline tests in order to get rid of reload there.
+        - Moved tests that don't require harness into the fast group.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31472
+
+        * Interfaces/IWebInspector.idl:
+        * WebInspector.cpp:
+        (WebInspector::isTimelineProfilingEnabled):
+        (WebInspector::setTimelineProfilingEnabled):
+        * WebInspector.h:
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        * Interfaces/WebKit.idl: Touch this to force interfaces to rebuild.
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Tell the WebFrameLoadDelegate when window objects in isolated worlds
+        are cleared
+
+        Fixes <http://webkit.org/b/31124>.
+
+        Reviewed by Dave Hyatt.
+
+        * Interfaces/IWebFrameLoadDelegatePrivate2.idl: Added
+        didClearWindowObjectForFrameInScriptWorld.
+
+        * WebFrame.cpp:
+        (WebFrame::dispatchDidClearWindowObjectInWorld):
+        * WebFrame.h:
+        Replaced windowObjectCleared with this function. If the delegate
+        implements IWebFrameLoadDelegatePrivate2, call
+        didClearWindowObjectForFrameInScriptWorld. Otherwise, if the passed-in
+        world is the mainThreadNormalWorld(), call
+        didClearWindowObjectForFrame.
+
+        * WebScriptWorld.cpp:
+        (allWorlds): Added. Returns a HashMap of all the WebScriptWorlds in
+        existence.
+        (WebScriptWorld::WebScriptWorld): Add ourselves to allWorlds().
+        (WebScriptWorld::~WebScriptWorld): Remove ourselves from allWorlds().
+        (WebScriptWorld::standardWorld): Added this non-COM getter for the
+        standard world, which the COM getter now calls through to.
+        (WebScriptWorld::findOrCreateWorld): Added. Returns the existing
+        WebScriptWorld for this DOMWrapperWorld, or a new one if one doesn't
+        already exist.
+
+        * WebScriptWorld.h: Added new standardWorld overload, made one
+        overload of createInstance private, and added findOrCreateWorld.
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        * Interfaces/WebKit.idl: Un-sort the #includes again. Apparently they
+        are order-dependent!
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Touch WebKit.idl to fix the Windows build
+
+        * Interfaces/WebKit.idl: Sorted #includes.
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Finish replacing worldIDs with world objects
+
+        The only remaining use of worldIDs was in a method only used by DRT
+        for the isolated worlds tests.
+
+        Fixes <http://webkit.org/b/31414> Replace worldIDs with world objects
+
+        Reviewed by Mark Rowe.
+
+        * Interfaces/IWebFramePrivate.idl:
+        * WebFrame.cpp:
+        (WebFrame::stringByEvaluatingJavaScriptInScriptWorld):
+        * WebFrame.h:
+        Renamed from stringByEvaluatingJavaScriptInIsolatedWorld. Now takes an
+        IWebScriptWorld instead of a worldID, so we don't need to maintain a
+        map of worldID -> world anymore.
+
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * WebFrame.cpp:
+        (WebFrame::renderTreeAsExternalRepresentation):
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        WebScriptWorld is the new object that represents a world.  The only
+        place worldID is still used is in
+        IWebFramePrivate::stringByEvaluatingJavaScriptInIsolatedWorld, but
+        that will change soon.
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        * ForEachCoClass.h: Added WebScriptWorld.
+
+        * Interfaces/IWebFramePrivate.idl: Replaced contextForWorldID with
+        contextForWorld.
+
+        * Interfaces/IWebScriptWorld.idl: Added.
+
+        * Interfaces/IWebViewPrivate.idl: Changed the user script/stylesheet
+        functions to take an IWebScriptWorld instead of a worldID.
+
+        * Interfaces/WebKit.idl: Added WebScriptWorld.
+
+        * WebFrame.cpp:
+        (WebFrame::contextForWorld): Renamed from contextForWorldID. Now takes
+        an IWebScriptWorld.
+        (WebFrame::stringByEvaluatingJavaScriptInIsolatedWorld): Moved the
+        bizarre world caching/creation logic that DRT depends on here from the
+        findWorld function in ScriptController.cpp. Updated to use
+        ScriptController::executeScriptInWorld instead of
+        ScriptController::executeScriptInIsolatedWorld.
+
+        * WebFrame.h: Replaced contextForWorldID with contextForWorld.
+
+        * WebScriptWorld.cpp: Added.
+        (WebScriptWorld::WebScriptWorld):
+        (WebScriptWorld::~WebScriptWorld):
+        (WebScriptWorld::createInstance):
+        (WebScriptWorld::AddRef):
+        (WebScriptWorld::Release):
+        (WebScriptWorld::QueryInterface):
+        Standard COM class implementations.
+
+        (WebScriptWorld::standardWorld): Returns a shared instance that represents
+        WebCore's mainThreadNormalWorld().
+
+        * WebScriptWorld.h: Added.
+        (WebScriptWorld::world): Simple getter.
+
+        * WebKit.vcproj/Interfaces.vcproj: Added IWebScriptWorld.idl.
+
+        * WebKit.vcproj/WebKit.vcproj: Added WebScriptWorld.
+
+        * WebKitClassFactory.cpp: Added WebScriptWorld.
+
+        * WebView.cpp:
+        (WebView::addUserScriptToGroup):
+        (WebView::addUserStyleSheetToGroup):
+        (WebView::removeUserScriptFromGroup):
+        (WebView::removeUserStyleSheetFromGroup):
+        (WebView::removeUserScriptsFromGroup):
+        (WebView::removeUserStyleSheetsFromGroup):
+        * WebView.h:
+        Changed these functions to take an IWebScriptWorld instead of a worldID.
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Small clean-up in WebView's user content functions
+
+        Preparation for <http://webkit.org/b/31414> Implement new SPI for
+        dealing with user scripts/stylesheets and isolated worlds
+
+        Reviewed by Dave Hyatt.
+
+        * WebView.cpp:
+        (toString):
+        (toKURL):
+        Added these helper functions to convert BSTRs to WebCore types.
+
+        (toStringVector):
+        (WebView::addUserScriptToGroup):
+        (WebView::addUserStyleSheetToGroup):
+        (WebView::removeUserScriptFromGroup):
+        (WebView::removeUserStyleSheetFromGroup):
+        (WebView::removeUserScriptsFromGroup):
+        (WebView::removeUserStyleSheetsFromGroup):
+        (WebView::removeAllUserContentFromGroup):
+        Use the new helper functions.
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * WebKitGraphics.cpp:
+        (WebDrawText):
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Modified WebDropSource::QueryContinueDrag so as to not call EventHandler::dragSourceMovedTo.
+
+        * WebDropSource.cpp:
+        (WebDropSource::QueryContinueDrag): Removed call to EventHandler::dragSourceMovedTo.
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31312
+        Decouple authentication panel callbacks from ResourceHandle
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge):
+        * WebURLAuthenticationChallenge.cpp:
+        (WebURLAuthenticationChallenge::initWithAuthenticationChallenge):
+        (WebURLAuthenticationChallenge::sender):
+        * WebURLAuthenticationChallengeSender.cpp:
+        (WebURLAuthenticationChallengeSender::WebURLAuthenticationChallengeSender):
+        (WebURLAuthenticationChallengeSender::createInstance):
+        (WebURLAuthenticationChallengeSender::authenticationClient):
+        * WebURLAuthenticationChallengeSender.h:
+        * WebURLAuthenticationChallengeSenderCFNet.cpp:
+        (WebURLAuthenticationChallengeSender::cancelAuthenticationChallenge):
+        (WebURLAuthenticationChallengeSender::continueWithoutCredentialForAuthenticationChallenge):
+        (WebURLAuthenticationChallengeSender::useCredential):
+        Adjusted for WebCore changes.
+
+2009-11-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by NOBODY - Build Fix.
+
+        Updated fillRoundedRect to take a ColorSpace argument.
+
+        * WebCoreSupport/WebDragClient.cpp:
+        (WebDragClient::createDragImageForLink):
+
+2009-11-08  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Holger Freyther.
+
+        ResourceRequest to be class instead of struct
+        https://bugs.webkit.org/show_bug.cgi?id=30670
+
+        Started as a compilation fix for Symbian where the compiler makes a distinction between
+        class and struct in function argument signatures.
+        Changed forward declaration of ResourceRequest to have class in the forward
+        declaration instead of struct.
+
+        * WebDownload.h:
+
+2009-11-05  Adam Roben  <aroben@apple.com>
+
+        Make CFDictionaryPropertyBag::createInstance return a COMPtr
+
+        I also cleaned up CFDictionaryPropertyBag's class declaration a little
+        while I was at it.
+
+        Part of <http://webkit.org/b/25294> <rdar://problem/6803127> All
+        WebKit/win classes should return COMPtrs from their static constructor
+        members
+
+        Reviewed by Steve Falkenburg.
+
+        * CFDictionaryPropertyBag.cpp:
+        (CFDictionaryPropertyBag::CFDictionaryPropertyBag): Changed to
+        initialize m_refCount to 0. m_refCount gets increased to 1 by
+        createInstance.
+        (CFDictionaryPropertyBag::createInstance): Changed to return a COMPtr.
+
+        * CFDictionaryPropertyBag.h:
+          - Updated copyright years
+          - Fixed header guard to match current style
+          - Replaced #include of CoreFoundation.h with forward-declaration of
+            CFMutableDictionaryRef
+          - Added #include of COMPtr.h
+          - Fixed opening brace placement in class declaration
+          - Made createInstance return a COMPtr
+          - Made constructor/destructor private
+          - Made QueryInterface and IPropertyBag functions private
+          - Removed unnecessary parameter names and MIDL comments
+
+        * WebCache.cpp:
+        (WebCache::statistics): Updated for change to
+        CFDictionaryPropertyBag::createInstance. Now uses releaseRef to place
+        the IPropertyBag pointers into the s array.
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidFailToStartPlugin):
+        * WebDatabaseManager.cpp:
+        (WebDatabaseManager::dispatchDidModifyDatabase):
+        * WebFrame.cpp:
+        (WebFrame::createJavaAppletWidget):
+        Updated for change to CFDictionaryPropertyBag::createInstance.
+
+        * WebHistory.cpp: Removed releaseUserInfo, which is no longer needed.
+        That function was also doing an unnecessary call to setDictionary(0).
+        (createUserInfoFromArray):
+        (createUserInfoFromHistoryItem):
+        Changed to return COMPtr.
+
+        (WebHistory::loadFromURL): Updated for change to
+        CFDictionaryPropertyBag::createInstance.
+
+        (WebHistory::removeAllItems): Updated for change to
+        CFDictionaryPropertyBag::createInstance, which fixed a leak! We had
+        forgotten to call releaseUserInfo here.
+
+        (WebHistory::removeItem):
+        (WebHistory::addItem):
+        (WebHistory::visitedURL):
+        * WebIconDatabase.cpp:
+        (postDidAddIconNotification):
+        Updated for change to CFDictionaryPropertyBag::createInstance.
+
+        * WebKitClassFactory.cpp:
+        (releaseRefFromCreateInstance): Added this overloaded function
+        template to abstract away the difference between createInstance
+        functions that return a ref'd pointer and createInstance functions
+        that return a COMPtr.
+        (WebKitClassFactory::CreateInstance): Changed to use
+        releaseRefFromCreateInstance.
+
+2009-11-03  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        WebActionModifierFlagsKey should return an unsigned, because
+        flags imply a bitmask, and that is what other classes expect from
+        it.
+
+        * WebActionPropertyBag.cpp:
+        (WebActionPropertyBag::Read):
+
+2009-11-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by John Sullivan and Mark Rowe.
+
+        <rdar://problem/7356733> Voiceover does not read correct media controller time values
+
+        * WebCoreLocalizedStrings.cpp:
+        (WebCore::localizedMediaTimeDescription):
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of headings is not correct
+
+        https://bugs.webkit.org/show_bug.cgi?id=30937
+
+        Reviewed by Alice Liu.
+
+        * AccessibleBase.cpp:
+        (AccessibleBase::get_accDescription):
+        Call the object's descriptionForMSAA(). Moved the comment to the
+        WebCore file.
+        (AccessibleBase::get_accRole):
+        If the object has a string role, return that. Otherwise, return the
+        integer role.
+
+        * AccessibleBase.h:
+        Removed description(), as this was moved to WebCore.
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of links is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=30928
+
+        Reviewed by Darin Adler.
+
+        * AccessibleBase.cpp:
+        (AccessibleBase::get_accState):
+        Check whether the element is linked, instead of whether the node is an
+        anchor, so the child "linkable" elements of anchor elements will also
+        be "linked".
+        (AccessibleBase::name):
+        Return the name for MSAA.
+        (AccessibleBase::value):
+        Return the string value for MSAA.
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        Added stub implementation for new ChromeClient function.
+
+        * WebCoreSupport/WebChromeClient.cpp:
+        (WebChromeClient::focusedNodeChanged):
+        * WebCoreSupport/WebChromeClient.h:
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * WebKit.vcproj/WebKit.vcproj:
+
+2009-10-29  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        <http://webkit.org/b/30938> REGRESSION(r50233): Windows nightlies crash on launch due to changes
+        to IWebFramePrivate vtable ordering
+
+        * Interfaces/IWebFramePrivate.idl: Move the newly-added method to the end of the interface so that
+        it doesn't affect the ordering of the vtable.
+
 2009-10-28  Steve Falkenburg  <sfalken@apple.com>
 
         Reviewed by Sam "Horatio" Weinig.
diff --git a/WebKit/win/DOMCoreClasses.cpp b/WebKit/win/DOMCoreClasses.cpp
index f4018c6..8ea7c84 100644
--- a/WebKit/win/DOMCoreClasses.cpp
+++ b/WebKit/win/DOMCoreClasses.cpp
@@ -150,10 +150,16 @@ HRESULT STDMETHODCALLTYPE DOMNode::parentNode(
 }
 
 HRESULT STDMETHODCALLTYPE DOMNode::childNodes( 
-    /* [retval][out] */ IDOMNodeList** /*result*/)
+    /* [retval][out] */ IDOMNodeList** result)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    if (!m_node)
+        return E_FAIL;
+
+    if (!result)
+        return E_POINTER;
+
+    *result = DOMNodeList::createInstance(m_node->childNodes().get());
+    return *result ? S_OK : E_FAIL;
 }
 
 HRESULT STDMETHODCALLTYPE DOMNode::firstChild( 
@@ -828,10 +834,16 @@ HRESULT STDMETHODCALLTYPE DOMElement::lineBoxRects(
 // IDOMElement ----------------------------------------------------------------
 
 HRESULT STDMETHODCALLTYPE DOMElement::tagName( 
-        /* [retval][out] */ BSTR* /*result*/)
+        /* [retval][out] */ BSTR* result)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    if (!m_element)
+        return E_FAIL;
+
+    if (!result)
+        return E_POINTER;
+
+    *result = BString(m_element->tagName()).release();
+    return S_OK;
 }
     
 HRESULT STDMETHODCALLTYPE DOMElement::getAttribute( 
diff --git a/WebKit/win/DOMHTMLClasses.cpp b/WebKit/win/DOMHTMLClasses.cpp
index 9ce6004..4889ba9 100644
--- a/WebKit/win/DOMHTMLClasses.cpp
+++ b/WebKit/win/DOMHTMLClasses.cpp
@@ -39,6 +39,7 @@
 #include <WebCore/HTMLInputElement.h>
 #include <WebCore/HTMLNames.h>
 #include <WebCore/HTMLOptionElement.h>
+#include <WebCore/HTMLOptionsCollection.h>
 #include <WebCore/HTMLSelectElement.h>
 #include <WebCore/HTMLTextAreaElement.h>
 #include <WebCore/IntRect.h>
@@ -134,11 +135,34 @@ HRESULT STDMETHODCALLTYPE DOMHTMLOptionsCollection::QueryInterface(REFIID riid,
 
 // DOMHTMLOptionsCollection ---------------------------------------------------
 
+DOMHTMLOptionsCollection::DOMHTMLOptionsCollection(WebCore::HTMLOptionsCollection* collection)
+    : m_collection(collection)
+{
+}
+
+IDOMHTMLOptionsCollection* DOMHTMLOptionsCollection::createInstance(WebCore::HTMLOptionsCollection* collection)
+{
+    if (!collection)
+        return 0;
+
+    IDOMHTMLOptionsCollection* optionsCollection = 0;
+    DOMHTMLOptionsCollection* newCollection = new DOMHTMLOptionsCollection(collection);
+    if (FAILED(newCollection->QueryInterface(IID_IDOMHTMLOptionsCollection, (void**)&optionsCollection))) {
+        delete newCollection;
+        return 0;
+    }
+
+    return optionsCollection;
+}
+
 HRESULT STDMETHODCALLTYPE DOMHTMLOptionsCollection::length( 
-    /* [retval][out] */ unsigned int* /*result*/)
+    /* [retval][out] */ unsigned int* result)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    if (!result)
+        return E_POINTER;
+
+    *result = m_collection->length();
+    return S_OK;
 }
 
 HRESULT STDMETHODCALLTYPE DOMHTMLOptionsCollection::setLength( 
@@ -149,16 +173,20 @@ HRESULT STDMETHODCALLTYPE DOMHTMLOptionsCollection::setLength(
 }
 
 HRESULT STDMETHODCALLTYPE DOMHTMLOptionsCollection::item( 
-    /* [in] */ unsigned int /*index*/,
-    /* [retval][out] */ IDOMNode** /*result*/)
+    /* [in] */ unsigned int index,
+    /* [retval][out] */ IDOMNode** result)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    if (!result)
+        return E_POINTER;
+
+    *result = DOMNode::createInstance(m_collection->item(index));
+
+    return *result ? S_OK : E_FAIL;
 }
 
 HRESULT STDMETHODCALLTYPE DOMHTMLOptionsCollection::namedItem( 
     /* [in] */ BSTR /*name*/,
-    /* [retval][out] */ IDOMNode* /*result*/)
+    /* [retval][out] */ IDOMNode** /*result*/)
 {
     ASSERT_NOT_REACHED();
     return E_NOTIMPL;
@@ -667,10 +695,22 @@ HRESULT STDMETHODCALLTYPE DOMHTMLSelectElement::form(
 }
     
 HRESULT STDMETHODCALLTYPE DOMHTMLSelectElement::options( 
-        /* [retval][out] */ IDOMHTMLOptionsCollection** /*result*/)
+        /* [retval][out] */ IDOMHTMLOptionsCollection** result)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    if (!result)
+        return E_POINTER;
+
+    *result = 0;
+
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(selectTag));
+    HTMLSelectElement* selectElement = static_cast<HTMLSelectElement*>(m_element);
+
+    if (!selectElement->options())
+        return E_FAIL;
+
+    *result = DOMHTMLOptionsCollection::createInstance(selectElement->options().get());
+    return S_OK;
 }
     
 HRESULT STDMETHODCALLTYPE DOMHTMLSelectElement::disabled( 
@@ -761,10 +801,17 @@ HRESULT STDMETHODCALLTYPE DOMHTMLSelectElement::remove(
 // DOMHTMLSelectElement - IFormsAutoFillTransitionSelect ----------------------
 
 HRESULT STDMETHODCALLTYPE DOMHTMLSelectElement::activateItemAtIndex( 
-    /* [in] */ int /*index*/)
+    /* [in] */ int index)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;    
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(selectTag));
+    HTMLSelectElement* selectElement = static_cast<HTMLSelectElement*>(m_element);
+
+    if (index >= selectElement->length())
+        return E_FAIL;
+
+    selectElement->setSelectedIndex(index);
+    return S_OK;
 }
 
 // DOMHTMLOptionElement - IUnknown --------------------------------------------
@@ -805,10 +852,19 @@ HRESULT STDMETHODCALLTYPE DOMHTMLOptionElement::setDefaultSelected(
 }
     
 HRESULT STDMETHODCALLTYPE DOMHTMLOptionElement::text( 
-        /* [retval][out] */ BSTR* /*result*/)
+        /* [retval][out] */ BSTR* result)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    if (!result)
+        return E_POINTER;
+
+    *result = 0;
+
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(optionTag));
+    HTMLOptionElement* optionElement = static_cast<HTMLOptionElement*>(m_element);
+
+    *result = BString(optionElement->text()).release();
+    return S_OK;
 }
     
 HRESULT STDMETHODCALLTYPE DOMHTMLOptionElement::index( 
@@ -833,10 +889,19 @@ HRESULT STDMETHODCALLTYPE DOMHTMLOptionElement::setDisabled(
 }
     
 HRESULT STDMETHODCALLTYPE DOMHTMLOptionElement::label( 
-        /* [retval][out] */ BSTR* /*result*/)
+        /* [retval][out] */ BSTR* result)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    if (!result)
+        return E_POINTER;
+
+    *result = 0;
+
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(optionTag));
+    HTMLOptionElement* optionElement = static_cast<HTMLOptionElement*>(m_element);
+
+    *result = BString(optionElement->label()).release();
+    return S_OK;
 }
     
 HRESULT STDMETHODCALLTYPE DOMHTMLOptionElement::setLabel( 
@@ -1160,7 +1225,17 @@ HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::setValue(
     inputElement->setValue(String((UChar*) value, SysStringLen(value)));
     return S_OK;
 }
-    
+
+HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::setValueForUser(
+        /* [in] */ BSTR value)
+{
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(inputTag));
+    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(m_element);
+    inputElement->setValueForUser(String(static_cast<UChar*>(value), SysStringLen(value)));
+    return S_OK;
+}
+
 HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::select( void)
 {
     ASSERT(m_element && m_element->hasTagName(inputTag));
@@ -1216,7 +1291,8 @@ HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::selectionEnd(
 HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::isTextField(
     /* [retval][out] */ BOOL* result)
 {
-    ASSERT(m_element && m_element->hasTagName(inputTag));
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(inputTag));
     HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(m_element);
     *result = inputElement->isTextField() ? TRUE : FALSE;
     return S_OK;
@@ -1225,36 +1301,51 @@ HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::isTextField(
 HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::rectOnScreen( 
     /* [retval][out] */ LPRECT rect)
 {
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(inputTag));
     rect->left = rect->top = rect->right = rect->bottom = 0;
     RenderObject* renderer = m_element->renderer();
     FrameView* view = m_element->document()->view();
     if (!renderer || !view)
         return E_FAIL;
 
-    IntRect coreRect = renderer->absoluteBoundingBoxRect();
-    coreRect.setLocation(view->contentsToWindow(coreRect.location()));
+    IntRect coreRect = view->contentsToScreen(renderer->absoluteBoundingBoxRect());
     rect->left = coreRect.x();
     rect->top = coreRect.y();
     rect->right = coreRect.right();
     rect->bottom = coreRect.bottom();
+
     return S_OK;
 }
 
 HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::replaceCharactersInRange( 
-    /* [in] */ int /*startTarget*/,
-    /* [in] */ int /*endTarget*/,
-    /* [in] */ BSTR /*replacementString*/,
-    /* [in] */ int /*index*/)
+    /* [in] */ int startTarget,
+    /* [in] */ int endTarget,
+    /* [in] */ BSTR replacementString,
+    /* [in] */ int index)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    if (!replacementString)
+        return E_POINTER;
+
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(inputTag));
+    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(m_element);
+
+    String newValue = inputElement->value();
+    String webCoreReplacementString(static_cast<UChar*>(replacementString), SysStringLen(replacementString));
+    newValue.replace(startTarget, endTarget - startTarget, webCoreReplacementString);
+    inputElement->setValue(newValue);
+    inputElement->setSelectionRange(index, newValue.length());
+
+    return S_OK;
 }
 
 HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::selectedRange( 
     /* [out] */ int* start,
     /* [out] */ int* end)
 {
-    ASSERT(m_element && m_element->hasTagName(inputTag));
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(inputTag));
     HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(m_element);
     *start = inputElement->selectionStart();
     *end = inputElement->selectionEnd();
@@ -1264,12 +1355,23 @@ HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::selectedRange(
 HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::setAutofilled( 
     /* [in] */ BOOL filled)
 {
-    ASSERT(m_element && m_element->hasTagName(inputTag));
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(inputTag));
     HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(m_element);
     inputElement->setAutofilled(!!filled);
     return S_OK;
 }
 
+HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::isAutofilled(
+    /* [retval][out] */ BOOL* result)
+{
+    ASSERT(m_element);
+    ASSERT(m_element->hasTagName(inputTag));
+    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(m_element);
+    *result = inputElement->isAutofilled() ? TRUE : FALSE;
+    return S_OK;
+}
+
 // DOMHTMLInputElement -- IFormPromptAdditions ------------------------------------
 
 HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::isUserEdited( 
@@ -1284,7 +1386,7 @@ HRESULT STDMETHODCALLTYPE DOMHTMLInputElement::isUserEdited(
     if (FAILED(isTextField(&textField)) || !textField)
         return S_OK;
     RenderObject* renderer = m_element->renderer();
-    if (renderer && toRenderTextControl(renderer)->isUserEdited())
+    if (renderer && toRenderTextControl(renderer)->lastChangeWasUserEdit())
         *result = TRUE;
     return S_OK;
 }
@@ -1481,7 +1583,7 @@ HRESULT STDMETHODCALLTYPE DOMHTMLTextAreaElement::isUserEdited(
     *result = FALSE;
     ASSERT(m_element);
     RenderObject* renderer = m_element->renderer();
-    if (renderer && toRenderTextControl(renderer)->isUserEdited())
+    if (renderer && toRenderTextControl(renderer)->lastChangeWasUserEdit())
         *result = TRUE;
     return S_OK;
 }
diff --git a/WebKit/win/DOMHTMLClasses.h b/WebKit/win/DOMHTMLClasses.h
index ddc3dd1..f520c3c 100644
--- a/WebKit/win/DOMHTMLClasses.h
+++ b/WebKit/win/DOMHTMLClasses.h
@@ -34,6 +34,7 @@
 
 namespace WebCore {
     class HTMLCollection;
+    class HTMLOptionsCollection;
 }
 
 class DOMHTMLCollection : public DOMObject, public IDOMHTMLCollection
@@ -99,6 +100,9 @@ protected:
 
 class DOMHTMLOptionsCollection : public DOMObject, public IDOMHTMLOptionsCollection
 {
+public:
+    static IDOMHTMLOptionsCollection* createInstance(WebCore::HTMLOptionsCollection*);
+
     // IUnknown
     virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
     virtual ULONG STDMETHODCALLTYPE AddRef(void) { return DOMObject::AddRef(); }
@@ -149,7 +153,12 @@ class DOMHTMLOptionsCollection : public DOMObject, public IDOMHTMLOptionsCollect
     
     virtual HRESULT STDMETHODCALLTYPE namedItem( 
         /* [in] */ BSTR name,
-        /* [retval][out] */ IDOMNode *result);
+        /* [retval][out] */ IDOMNode **result);
+
+private:
+    DOMHTMLOptionsCollection(WebCore::HTMLOptionsCollection*);
+
+    RefPtr<WebCore::HTMLOptionsCollection> m_collection;
 };
 
 class DOMHTMLDocument : public DOMDocument, public IDOMHTMLDocument
@@ -2011,9 +2020,15 @@ public:
     virtual HRESULT STDMETHODCALLTYPE setAutofilled( 
         /* [in] */ BOOL filled);
 
+    virtual HRESULT STDMETHODCALLTYPE isAutofilled(
+        /* [retval][out] */ BOOL *result);
+    
     // IFormPromptAdditions
     virtual HRESULT STDMETHODCALLTYPE isUserEdited( 
         /* [retval][out] */ BOOL *result);
+
+    virtual HRESULT STDMETHODCALLTYPE setValueForUser(
+        /* [in] */ BSTR value);
 };
 
 class DOMHTMLTextAreaElement : public DOMHTMLElement, public IDOMHTMLTextAreaElement, public IFormPromptAdditions
diff --git a/WebKit/win/ForEachCoClass.h b/WebKit/win/ForEachCoClass.h
index 26f4a6c..39f8e32 100644
--- a/WebKit/win/ForEachCoClass.h
+++ b/WebKit/win/ForEachCoClass.h
@@ -63,6 +63,7 @@
     macro(WebCoreStatistics) \
     macro(WebCookieManager) \
     macro(WebWorkersPrivate) \
+    macro(WebScriptWorld) \
     // end of macro
 
 // Everything below this point is deprecated. Please do not use.
diff --git a/WebKit/win/GEN_DOMObject.cpp b/WebKit/win/GEN_DOMObject.cpp
index bb108a4..c8d0e3c 100644
--- a/WebKit/win/GEN_DOMObject.cpp
+++ b/WebKit/win/GEN_DOMObject.cpp
@@ -26,10 +26,11 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "WebKitDLL.h"
-
+#include "config.h"
 #include "GEN_DOMObject.h"
 
+#include "WebKitDLL.h"
+
 #include <wtf/Assertions.h>
 
 // DOMObject ------------------------------------------------------------
diff --git a/WebKit/win/Interfaces/DOMHTML.idl b/WebKit/win/Interfaces/DOMHTML.idl
index 6c276aa..7ccb682 100644
--- a/WebKit/win/Interfaces/DOMHTML.idl
+++ b/WebKit/win/Interfaces/DOMHTML.idl
@@ -800,6 +800,11 @@ interface IDOMHTMLInputElement : IDOMElement
     // attribute long selectionEnd;
     HRESULT setSelectionEnd([in] long end);
     HRESULT selectionEnd([out, retval] long* end);
+
+    /*
+        - (void)setValueForUser:(NSString *)value;
+    */
+    HRESULT setValueForUser([in] BSTR value);
 }
 
 /*
diff --git a/WebKit/win/Interfaces/DOMPrivate.idl b/WebKit/win/Interfaces/DOMPrivate.idl
index 7210943..3365565 100644
--- a/WebKit/win/Interfaces/DOMPrivate.idl
+++ b/WebKit/win/Interfaces/DOMPrivate.idl
@@ -51,9 +51,8 @@ interface IDOMElementPrivate : IUnknown
 
 /*
     All the methods in this category are used by Safari forms autofill and should not be used for any other purpose.
-    They are stopgap measures until we finish transitioning form controls to not use NSView. Each one should become
-    replaceable by public DOM API, and when that happens Safari will switch to implementations using that public API,
-    and these will be deleted.
+    Each one should eventually be replaced by public DOM API, and when that happens Safari will switch to implementations 
+    using that public API, and these will be deleted.
 
     @interface DOMHTMLInputElement(FormsAutoFillTransition)
 */
@@ -89,6 +88,11 @@ interface IFormsAutoFillTransition : IUnknown
         - (void)_setAutofilled:(BOOL)filled;
     */
     HRESULT setAutofilled([in] BOOL filled);
+
+    /*
+        - (BOOL)_isAutofilled;
+    */
+    HRESULT isAutofilled([out, retval] BOOL* result);
 }
 
 /*
diff --git a/WebKit/win/Interfaces/IWebFrameLoadDelegate.idl b/WebKit/win/Interfaces/IWebFrameLoadDelegate.idl
index 66ac241..9847151 100644
--- a/WebKit/win/Interfaces/IWebFrameLoadDelegate.idl
+++ b/WebKit/win/Interfaces/IWebFrameLoadDelegate.idl
@@ -29,18 +29,9 @@ import "ocidl.idl";
 import "IWebScriptObject.idl";
 import "IWebView.idl";
 import "IWebFrame.idl";
+import "JavaScriptCoreAPITypes.idl";
 #endif
 
-cpp_quote("// this is done to get midl to treat the JavaScriptCore API types as pointer types")
-cpp_quote("#if 0")
-typedef void* JSContextRef;
-typedef void* JSObjectRef;
-cpp_quote("#else")
-cpp_quote("typedef struct OpaqueJSValue* JSObjectRef;")
-cpp_quote("typedef const struct OpaqueJSContext* JSContextRef;")
-cpp_quote("#endif")
-
-
 interface IWebError;
 interface IWebFrame;
 interface IWebScriptObject;
diff --git a/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl b/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl
index d646528..7e07c55 100644
--- a/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl
+++ b/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl
@@ -31,8 +31,9 @@ import "IWebView.idl";
 #endif
 
 interface IWebFrame;
-interface IWebView;
+interface IWebScriptWorld;
 interface IWebSecurityOrigin;
+interface IWebView;
 
 [
     object,
@@ -45,4 +46,10 @@ interface IWebFrameLoadDelegatePrivate2 : IWebFrameLoadDelegatePrivate
     HRESULT didDisplayInsecureContent([in] IWebView* sender);
 
     HRESULT didRunInsecureContent([in] IWebView* sender, [in] IWebSecurityOrigin* origin);
+
+    HRESULT didClearWindowObjectForFrameInScriptWorld([in] IWebView* webView, [in] IWebFrame* frame, [in] IWebScriptWorld*);
+
+    HRESULT didPushStateWithinPageForFrame([in] IWebView* webView, [in] IWebFrame* frame);
+    HRESULT didReplaceStateWithinPageForFrame([in] IWebView* webView, [in] IWebFrame* frame);
+    HRESULT didPopStateWithinPageForFrame([in] IWebView* webView, [in] IWebFrame* frame);
 }
diff --git a/WebKit/win/Interfaces/IWebFramePrivate.idl b/WebKit/win/Interfaces/IWebFramePrivate.idl
index d56239b..3ba71c8 100755
--- a/WebKit/win/Interfaces/IWebFramePrivate.idl
+++ b/WebKit/win/Interfaces/IWebFramePrivate.idl
@@ -32,6 +32,7 @@ import "IWebFrame.idl";
 interface IWebFrame;
 interface IWebIconFetcher;
 interface IWebIconFetcherDelegate;
+interface IWebScriptWorld;
 
 typedef enum {
     WebFrameLoadTypeStandard,
@@ -57,7 +58,6 @@ typedef enum {
 interface IWebFramePrivate : IUnknown
 {
     HRESULT renderTreeAsExternalRepresentation([out, retval] BSTR* result);
-    HRESULT counterValueForElementById([in] BSTR id, [out, retval] BSTR* result);
     HRESULT scrollOffset([out, retval] SIZE* offset);
 
     // FIXME: This shouldn't be needed once IWebDocumentView is implemented.
@@ -89,13 +89,16 @@ interface IWebFramePrivate : IUnknown
 
     HRESULT pauseAnimation([in] BSTR animationName, [in] IDOMNode* node, [in] double secondsFromNow, [out, retval] BOOL* animationWasRunning);
     HRESULT pauseTransition([in] BSTR propertyName, [in] IDOMNode* node, [in] double secondsFromNow, [out, retval] BOOL* transitionWasRunning);
+    HRESULT pauseSVGAnimation([in] BSTR elementId, [in] IDOMNode* node, [in] double secondsFromNow, [out, retval] BOOL* animationWasRunning);
     HRESULT numberOfActiveAnimations([out, retval] UINT* number);
 
     HRESULT isDisplayingStandaloneImage([out, retval] BOOL* result);
 
     HRESULT allowsFollowingLink([in] BSTR url, [out, retval] BOOL* result);
 
-    HRESULT stringByEvaluatingJavaScriptInIsolatedWorld([in] unsigned worldID, [in] OLE_HANDLE jsGlobalObject, [in] BSTR script, [out, retval] BSTR* result);
+    [local] HRESULT stringByEvaluatingJavaScriptInScriptWorld([in] IWebScriptWorld*, [in] JSObjectRef globalObject, [in] BSTR script, [out, retval] BSTR* result);
+
+    [local] JSGlobalContextRef globalContextForScriptWorld([in] IWebScriptWorld*);
 
-    [local] JSGlobalContextRef contextForWorldID([in] unsigned worldID);
+    HRESULT counterValueForElementById([in] BSTR id, [out, retval] BSTR* result);
 }
diff --git a/WebKit/win/Interfaces/IWebInspector.idl b/WebKit/win/Interfaces/IWebInspector.idl
index e31376c..4523205 100644
--- a/WebKit/win/Interfaces/IWebInspector.idl
+++ b/WebKit/win/Interfaces/IWebInspector.idl
@@ -54,4 +54,7 @@ interface IWebInspector : IUnknown
 
     HRESULT isJavaScriptProfilingEnabled(BOOL* isProfilingEnabled);
     HRESULT setJavaScriptProfilingEnabled(BOOL enabled);
+
+    HRESULT isTimelineProfilingEnabled(BOOL* isEnabled);
+    HRESULT setTimelineProfilingEnabled(BOOL enabled);
 }
diff --git a/WebKit/win/Interfaces/IWebPluginHalterDelegate.idl b/WebKit/win/Interfaces/IWebPluginHalterDelegate.idl
index f79e304..e113da8 100644
--- a/WebKit/win/Interfaces/IWebPluginHalterDelegate.idl
+++ b/WebKit/win/Interfaces/IWebPluginHalterDelegate.idl
@@ -39,5 +39,5 @@ interface IWebView;
 ]
 interface IWebPluginHalterDelegate : IUnknown
 {
-    HRESULT shouldHaltPlugin([in] IWebView* webView, [in] IDOMNode*, [out, retval] BOOL* result);
+    HRESULT shouldHaltPlugin([in] IWebView* webView, [in] IDOMNode*, [in] BOOL isWindowed, [in] BSTR pluginName, [out, retval] BOOL* result);
 }
diff --git a/WebKit/win/Interfaces/IWebScriptWorld.idl b/WebKit/win/Interfaces/IWebScriptWorld.idl
new file mode 100644
index 0000000..255255c
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebScriptWorld.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+#endif
+
+[
+    object,
+    oleautomation,
+    uuid(EBD45575-8184-4f22-B849-A5FE88336055),
+    pointer_default(unique)
+]
+interface IWebScriptWorld : IUnknown {
+    HRESULT standardWorld([out, retval] IWebScriptWorld**);
+}
diff --git a/WebKit/win/Interfaces/IWebSerializedJSValue.idl b/WebKit/win/Interfaces/IWebSerializedJSValue.idl
new file mode 100644
index 0000000..eddef62
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebSerializedJSValue.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+import "JavaScriptCoreAPITypes.idl";
+#endif
+
+[
+    object,
+    oleautomation,
+    uuid(13B3F50A-C996-61A7-2247-3DCC88FB0B84),
+    pointer_default(unique)
+]
+interface IWebSerializedJSValue : IUnknown {
+    [local] HRESULT serialize([in] JSContextRef context, [in] JSValueRef value, [out, retval] JSValueRef* exception);
+    [local] HRESULT deserialize([in] JSContextRef context, [out, retval] JSValueRef* value);
+}
diff --git a/WebKit/win/Interfaces/IWebViewPrivate.idl b/WebKit/win/Interfaces/IWebViewPrivate.idl
index d95f92b..1c8cea2 100644
--- a/WebKit/win/Interfaces/IWebViewPrivate.idl
+++ b/WebKit/win/Interfaces/IWebViewPrivate.idl
@@ -184,18 +184,17 @@ interface IWebViewPrivate : IUnknown
     */
     HRESULT MIMETypeForExtension([in] BSTR extension, [out, retval] BSTR* mimeType);
 
-    // For the following functions, 0 < worldID < UINT_MAX.
-    HRESULT addUserScriptToGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR source, [in] BSTR url,
+    HRESULT addUserScriptToGroup([in] BSTR groupName, [in] IWebScriptWorld*, [in] BSTR source, [in] BSTR url,
                                  [in] unsigned whitelistCount, [in, size_is(whitelistCount)] BSTR* whitelist,
                                  [in] unsigned blacklistCount, [in, size_is(blacklistCount)] BSTR* blacklist,
                                  [in] WebUserScriptInjectionTime injectionTime);
-    HRESULT addUserStyleSheetToGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR source, [in] BSTR url,
+    HRESULT addUserStyleSheetToGroup([in] BSTR groupName, [in] IWebScriptWorld*, [in] BSTR source, [in] BSTR url,
                                      [in] unsigned whitelistCount, [in, size_is(whitelistCount)] BSTR* whitelist,
                                      [in] unsigned blacklistCount, [in, size_is(blacklistCount)] BSTR* blacklist);
-    HRESULT removeUserScriptFromGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR url);
-    HRESULT removeUserStyleSheetFromGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR url);
-    HRESULT removeUserScriptsFromGroup([in] BSTR groupName, [in] unsigned worldID);
-    HRESULT removeUserStyleSheetsFromGroup([in] BSTR groupName, [in] unsigned worldID);
+    HRESULT removeUserScriptFromGroup([in] BSTR groupName, [in] IWebScriptWorld*, [in] BSTR url);
+    HRESULT removeUserStyleSheetFromGroup([in] BSTR groupName, [in] IWebScriptWorld*, [in] BSTR url);
+    HRESULT removeUserScriptsFromGroup([in] BSTR groupName, [in] IWebScriptWorld*);
+    HRESULT removeUserStyleSheetsFromGroup([in] BSTR groupName, [in] IWebScriptWorld*);
     HRESULT removeAllUserContentFromGroup([in] BSTR groupName);
 
     HRESULT setPluginHalterDelegate([in] IWebPluginHalterDelegate* d);
diff --git a/WebKit/win/Interfaces/JavaScriptCoreAPITypes.idl b/WebKit/win/Interfaces/JavaScriptCoreAPITypes.idl
new file mode 100755
index 0000000..f2ef1f1
--- /dev/null
+++ b/WebKit/win/Interfaces/JavaScriptCoreAPITypes.idl
@@ -0,0 +1,40 @@
+/*

+ * Copyright (C) 2009 Apple Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1.  Redistributions of source code must retain the above copyright

+ *     notice, this list of conditions and the following disclaimer.

+ * 2.  Redistributions in binary form must reproduce the above copyright

+ *     notice, this list of conditions and the following disclaimer in the

+ *     documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY

+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON

+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#ifndef DO_NO_IMPORTS

+import "oaidl.idl";

+import "ocidl.idl";

+#endif

+

+cpp_quote("// this is done to get midl to treat the JavaScriptCore API types as pointer types")

+cpp_quote("#if 0")

+typedef void* JSContextRef;

+typedef void* JSObjectRef;

+typedef void* JSValueRef;

+cpp_quote("#else")

+cpp_quote("typedef const struct OpaqueJSValue* JSValueRef;")

+cpp_quote("typedef struct OpaqueJSValue* JSObjectRef;")

+cpp_quote("typedef const struct OpaqueJSContext* JSContextRef;")

+cpp_quote("#endif")

+

diff --git a/WebKit/win/Interfaces/WebKit.idl b/WebKit/win/Interfaces/WebKit.idl
index cdd24b3..7b308db 100644
--- a/WebKit/win/Interfaces/WebKit.idl
+++ b/WebKit/win/Interfaces/WebKit.idl
@@ -24,7 +24,7 @@
  */
 
 cpp_quote("/*")
-cpp_quote(" * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.")
+cpp_quote(" * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.")
 cpp_quote(" *")
 cpp_quote(" * Redistribution and use in source and binary forms, with or without")
 cpp_quote(" * modification, are permitted provided that the following conditions")
@@ -56,6 +56,7 @@ import "oaidl.idl";
 import "ocidl.idl";
 
 #include "WebScrollbarTypes.idl"
+#include "JavaScriptCoreAPITypes.idl"
 #include "IWebScriptObject.idl"
 #include "DOMCSS.idl"
 #include "DOMCore.idl"
@@ -113,9 +114,11 @@ import "ocidl.idl";
 #include "IWebResource.idl"
 #include "IWebResourceLoadDelegate.idl"
 #include "IWebResourceLoadDelegatePrivate.idl"
+#include "IWebScriptWorld.idl"
 #include "IWebScrollBarDelegatePrivate.idl"
 #include "IWebScrollBarPrivate.idl"
 #include "IWebSecurityOrigin.idl"
+#include "IWebSerializedJSValue.idl"
 #include "IWebTextRenderer.idl"
 #include "IWebUIDelegate.idl"
 #include "IWebUIDelegate2.idl"
@@ -271,4 +274,14 @@ library WebKit
     coclass WebWorkersPrivate{
         [default] interface IWebWorkersPrivate;
     }
+
+    [uuid(D3C301EE-D59A-49c0-A43A-9EA01CDB1590)]
+    coclass WebScriptWorld {
+        [default] interface IWebScriptWorld;
+    }
+    
+    [uuid(13C45703-A3B3-8797-276B-75632F6165C3)]
+    coclass WebSerializedJSValue {
+        [default] interface IWebSerializedJSValue;
+    }
 }
diff --git a/WebKit/win/WebActionPropertyBag.cpp b/WebKit/win/WebActionPropertyBag.cpp
index 31252a5..c2b9e10 100644
--- a/WebKit/win/WebActionPropertyBag.cpp
+++ b/WebKit/win/WebActionPropertyBag.cpp
@@ -142,7 +142,7 @@ HRESULT STDMETHODCALLTYPE WebActionPropertyBag::Read(LPCOLESTR pszPropName, VARI
     }
     if (isEqual(pszPropName, WebActionModifierFlagsKey)) {
         if (const UIEventWithKeyState* keyEvent = findEventWithKeyState(const_cast<Event*>(m_action.event()))) {
-            int modifiers = 0;
+            unsigned modifiers = 0;
 
             if (keyEvent->ctrlKey())
                 modifiers |= MK_CONTROL;
@@ -151,8 +151,8 @@ HRESULT STDMETHODCALLTYPE WebActionPropertyBag::Read(LPCOLESTR pszPropName, VARI
             if (keyEvent->altKey())
                 modifiers |= MK_ALT;
 
-            V_VT(pVar) = VT_I4;
-            V_I4(pVar) = modifiers;
+            V_VT(pVar) = VT_UI4;
+            V_UI4(pVar) = modifiers;
             return S_OK;
         }
     }
diff --git a/WebKit/win/WebCache.cpp b/WebKit/win/WebCache.cpp
index c7351b0..d82fc43 100644
--- a/WebKit/win/WebCache.cpp
+++ b/WebKit/win/WebCache.cpp
@@ -129,9 +129,9 @@ HRESULT STDMETHODCALLTYPE WebCache::statistics(
     value.adoptCF(CFNumberCreate(0, kCFNumberIntType, &stat.scripts.count));
     CFDictionaryAddValue(dictionary.get(), scriptsKey, value.get());
 
-    CFDictionaryPropertyBag* propBag = CFDictionaryPropertyBag::createInstance();
+    COMPtr<CFDictionaryPropertyBag> propBag = CFDictionaryPropertyBag::createInstance();
     propBag->setDictionary(dictionary.get());
-    s[0] = propBag;
+    s[0] = propBag.releaseRef();
 
     dictionary.adoptCF(CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
 
@@ -153,7 +153,7 @@ HRESULT STDMETHODCALLTYPE WebCache::statistics(
 
     propBag = CFDictionaryPropertyBag::createInstance();
     propBag->setDictionary(dictionary.get());
-    s[1] = propBag;
+    s[1] = propBag.releaseRef();
 
     dictionary.adoptCF(CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
 
@@ -175,7 +175,7 @@ HRESULT STDMETHODCALLTYPE WebCache::statistics(
 
     propBag = CFDictionaryPropertyBag::createInstance();
     propBag->setDictionary(dictionary.get());
-    s[2] = propBag;
+    s[2] = propBag.releaseRef();
 
     dictionary.adoptCF(CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
 
@@ -197,7 +197,7 @@ HRESULT STDMETHODCALLTYPE WebCache::statistics(
 
     propBag = CFDictionaryPropertyBag::createInstance();
     propBag->setDictionary(dictionary.get());
-    s[3] = propBag;
+    s[3] = propBag.releaseRef();
 
     return S_OK;
 }
diff --git a/WebKit/win/WebCoreLocalizedStrings.cpp b/WebKit/win/WebCoreLocalizedStrings.cpp
index 03d03e7..9ee22db 100644
--- a/WebKit/win/WebCoreLocalizedStrings.cpp
+++ b/WebKit/win/WebCoreLocalizedStrings.cpp
@@ -151,6 +151,10 @@ String WebCore::localizedMediaControlElementString(const String& name)
         return String(LPCTSTR_UI_STRING("fast forward", "accessibility role description for fast forward button"));
     if (name == "SeekBackButton")
         return String(LPCTSTR_UI_STRING("fast reverse", "accessibility role description for fast reverse button"));
+    if (name == "ShowClosedCaptionsButton")
+        return String(LPCTSTR_UI_STRING("show closed captions", "accessibility role description for show closed captions button"));
+    if (name == "HideClosedCaptionsButton")
+        return String(LPCTSTR_UI_STRING("hide closed captions", "accessibility role description for hide closed captions button"));
 
     ASSERT_NOT_REACHED();
     return String();
@@ -190,6 +194,10 @@ String WebCore::localizedMediaControlElementHelpText(const String& name)
         return String(LPCTSTR_UI_STRING("seek quickly forward", "accessibility help text for fast forward button"));
     if (name == "FullscreenButton")
         return String(LPCTSTR_UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button"));
+    if (name == "ShowClosedCaptionsButton")
+        return String(LPCTSTR_UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button"));
+    if (name == "HideClosedCaptionsButton")
+        return String(LPCTSTR_UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button"));
 
     ASSERT_NOT_REACHED();
     return String();
@@ -198,7 +206,7 @@ String WebCore::localizedMediaControlElementHelpText(const String& name)
 String WebCore::localizedMediaTimeDescription(float time)
 {
     if (!isfinite(time))
-        return String(LPCTSTR_UI_STRING("indefinite time", "string for an indefinite movie time"));
+        return String(LPCTSTR_UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value"));
 
     int seconds = (int)fabsf(time);
     int days = seconds / (60 * 60 * 24);
@@ -207,27 +215,34 @@ String WebCore::localizedMediaTimeDescription(float time)
     seconds %= 60;
 
     if (days) {
-        static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("date.format.for.days", "string for days, hours, minutes & seconds"));
+        static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"));
         RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormat(0, 0, format.get(), days, hours, minutes, seconds));
         return result.get();
     }
 
     if (hours) {
-        static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("date.format.for.hours", "string for hours, minutes & seconds"));
+        static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"));
         RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormat(0, 0, format.get(), hours, minutes, seconds));
         return result.get();
     }
 
     if (minutes) {
-        static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("date.format.for.minutes", "string for minutes & seconds"));
+        static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"));
         RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormat(0, 0, format.get(), minutes, seconds));
         return result.get();
     }
 
-    static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("date.format.for.seconds", "string for seconds"));
+    static RetainPtr<CFStringRef> format(AdoptCF, UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"));
     RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormat(0, 0, format.get(), seconds));
     return result.get();
 }
 
 #endif  // ENABLE(VIDEO)
 
+String WebCore::validationMessageValueMissingText() { return String(LPCTSTR_UI_STRING("value missing", "Validation message for required form control elements that have no value")); }
+String WebCore::validationMessageTypeMismatchText() { return String(LPCTSTR_UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type")); }
+String WebCore::validationMessagePatternMismatchText() { return String(LPCTSTR_UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern")); }
+String WebCore::validationMessageTooLongText() { return String(LPCTSTR_UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length")); }
+String WebCore::validationMessageRangeUnderflowText() { return String(LPCTSTR_UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum")); }
+String WebCore::validationMessageRangeOverflowText() { return String(LPCTSTR_UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum")); }
+String WebCore::validationMessageStepMismatchText() { return String(LPCTSTR_UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute")); }
diff --git a/WebKit/win/WebCoreSupport/WebChromeClient.cpp b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
index 0bae1ae..6e82caf 100644
--- a/WebKit/win/WebCoreSupport/WebChromeClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
@@ -156,6 +156,10 @@ void WebChromeClient::takeFocus(FocusDirection direction)
     }
 }
 
+void WebChromeClient::focusedNodeChanged(Node*)
+{
+}
+
 static COMPtr<IPropertyBag> createWindowFeaturesPropertyBag(const WindowFeatures& features)
 {
     HashMap<String, COMVariant> map;
@@ -750,6 +754,19 @@ void WebChromeClient::requestGeolocationPermissionForFrame(Frame*, Geolocation*)
     notImplemented();
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+void WebChromeClient::attachRootGraphicsLayer(Frame* frame, GraphicsLayer* graphicsLayer)
+{
+    m_webView->setRootChildLayer(graphicsLayer ? graphicsLayer->platformLayer() : 0);
+}
+
+void WebChromeClient::scheduleCompositingLayerSync()
+{
+    m_webView->setRootLayerNeedsDisplay();
+}
+
+#endif
+
 COMPtr<IWebUIDelegate> WebChromeClient::uiDelegate()
 {
     COMPtr<IWebUIDelegate> delegate;
diff --git a/WebKit/win/WebCoreSupport/WebChromeClient.h b/WebKit/win/WebCoreSupport/WebChromeClient.h
index d01e47d..e0c59ae 100644
--- a/WebKit/win/WebCoreSupport/WebChromeClient.h
+++ b/WebKit/win/WebCoreSupport/WebChromeClient.h
@@ -55,6 +55,8 @@ public:
     virtual bool canTakeFocus(WebCore::FocusDirection);
     virtual void takeFocus(WebCore::FocusDirection);
 
+    virtual void focusedNodeChanged(WebCore::Node*);
+
     virtual WebCore::Page* createWindow(WebCore::Frame*, const WebCore::FrameLoadRequest&, const WebCore::WindowFeatures&);
     virtual void show();
 
@@ -130,6 +132,17 @@ public:
 
     virtual PassOwnPtr<WebCore::HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
 
+#if USE(ACCELERATED_COMPOSITING)
+        // Pass 0 as the GraphicsLayer to detatch the root layer.
+        virtual void attachRootGraphicsLayer(WebCore::Frame*, WebCore::GraphicsLayer*);
+        // Sets a flag to specify that the next time content is drawn to the window,
+        // the changes appear on the screen in synchrony with updates to GraphicsLayers.
+        virtual void setNeedsOneShotDrawingSynchronization() { }
+        // Sets a flag to specify that the view needs to be updated, so we need
+        // to do an eager layout before the drawing.
+        virtual void scheduleCompositingLayerSync();
+#endif
+
     virtual void scrollRectIntoView(const WebCore::IntRect&, const WebCore::ScrollView*) const {}
 
     virtual void requestGeolocationPermissionForFrame(WebCore::Frame*, WebCore::Geolocation*);
diff --git a/WebKit/win/WebCoreSupport/WebDragClient.cpp b/WebKit/win/WebCoreSupport/WebDragClient.cpp
index 8451bd6..773e392 100644
--- a/WebKit/win/WebCoreSupport/WebDragClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebDragClient.cpp
@@ -295,7 +295,7 @@ DragImageRef WebDragClient::createDragImageForLink(KURL& url, const String& inLa
     static const Color backgroundColor(140, 140, 140);
     static const IntSize radii(DRAG_LABEL_RADIUS, DRAG_LABEL_RADIUS);
     IntRect rect(0, 0, imageSize.width(), imageSize.height());
-    context.fillRoundedRect(rect, radii, radii, radii, radii, backgroundColor);
+    context.fillRoundedRect(rect, radii, radii, radii, radii, backgroundColor, DeviceColorSpace);
  
     // Draw the text
     static const Color topColor(0, 0, 0, 255); //original alpha = 0.75
diff --git a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
index cb3aed0..b927c72 100644
--- a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -143,7 +143,7 @@ bool WebFrameLoaderClient::shouldUseCredentialStorage(DocumentLoader* loader, un
 void WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(DocumentLoader* loader, unsigned long identifier, const AuthenticationChallenge& challenge)
 {
 #if USE(CFNETWORK)
-    ASSERT(challenge.sourceHandle());
+    ASSERT(challenge.authenticationClient());
 
     WebView* webView = m_webFrame->webView();
     COMPtr<IWebResourceLoadDelegate> resourceLoadDelegate;
@@ -155,7 +155,7 @@ void WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(DocumentLoa
 
     // If the ResourceLoadDelegate doesn't exist or fails to handle the call, we tell the ResourceHandle
     // to continue without credential - this is the best approximation of Mac behavior
-    challenge.sourceHandle()->receivedRequestToContinueWithoutCredential(challenge);
+    challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);
 #else
    notImplemented();
 #endif
@@ -306,6 +306,47 @@ void WebFrameLoaderClient::dispatchDidChangeLocationWithinPage()
         frameLoadDelegate->didChangeLocationWithinPageForFrame(webView, m_webFrame);
 }
 
+void WebFrameLoaderClient::dispatchDidPushStateWithinPage()
+{
+    WebView* webView = m_webFrame->webView();
+    COMPtr<IWebFrameLoadDelegatePrivate> frameLoadDelegatePriv;
+    if (FAILED(webView->frameLoadDelegatePrivate(&frameLoadDelegatePriv)) || !frameLoadDelegatePriv)
+        return;
+
+    COMPtr<IWebFrameLoadDelegatePrivate2> frameLoadDelegatePriv2(Query, frameLoadDelegatePriv);
+    if (!frameLoadDelegatePriv2)
+        return;
+
+    frameLoadDelegatePriv2->didPushStateWithinPageForFrame(webView, m_webFrame);
+}
+
+void WebFrameLoaderClient::dispatchDidReplaceStateWithinPage()
+{
+    WebView* webView = m_webFrame->webView();
+    COMPtr<IWebFrameLoadDelegatePrivate> frameLoadDelegatePriv;
+    if (FAILED(webView->frameLoadDelegatePrivate(&frameLoadDelegatePriv)) || !frameLoadDelegatePriv)
+        return;
+
+    COMPtr<IWebFrameLoadDelegatePrivate2> frameLoadDelegatePriv2(Query, frameLoadDelegatePriv);
+    if (!frameLoadDelegatePriv2)
+        return;
+
+    frameLoadDelegatePriv2->didReplaceStateWithinPageForFrame(webView, m_webFrame);
+}
+
+void WebFrameLoaderClient::dispatchDidPopStateWithinPage()
+{
+    WebView* webView = m_webFrame->webView();
+    COMPtr<IWebFrameLoadDelegatePrivate> frameLoadDelegatePriv;
+    if (FAILED(webView->frameLoadDelegatePrivate(&frameLoadDelegatePriv)) || !frameLoadDelegatePriv)
+        return;
+
+    COMPtr<IWebFrameLoadDelegatePrivate2> frameLoadDelegatePriv2(Query, frameLoadDelegatePriv);
+    if (!frameLoadDelegatePriv2)
+        return;
+
+    frameLoadDelegatePriv2->didPopStateWithinPageForFrame(webView, m_webFrame);
+}
 void WebFrameLoaderClient::dispatchWillClose()
 {
     WebView* webView = m_webFrame->webView();
@@ -500,14 +541,11 @@ void WebFrameLoaderClient::updateGlobalHistory()
     webView->historyDelegate(&historyDelegate);
 
     if (historyDelegate) {
-        BString url(loader->urlForHistory());
-        BString title(loader->title());
-        BString redirectSource(loader->clientRedirectSourceForHistory());
         COMPtr<IWebURLResponse> urlResponse(AdoptCOM, WebURLResponse::createInstance(loader->response()));
         COMPtr<IWebURLRequest> urlRequest(AdoptCOM, WebMutableURLRequest::createInstance(loader->originalRequestCopy()));
         
         COMPtr<IWebNavigationData> navigationData(AdoptCOM, WebNavigationData::createInstance(
-            url, title, urlRequest.get(), urlResponse.get(), loader->substituteData().isValid(), redirectSource));
+            loader->urlForHistory(), loader->title(), urlRequest.get(), urlResponse.get(), loader->substituteData().isValid(), loader->clientRedirectSourceForHistory()));
 
         historyDelegate->didNavigateWithNavigationData(webView, navigationData.get(), m_webFrame);
         return;
@@ -759,7 +797,7 @@ void WebFrameLoaderClient::dispatchDidFailToStartPlugin(const PluginView* plugin
         }
     }
 
-    COMPtr<CFDictionaryPropertyBag> userInfoBag(AdoptCOM, CFDictionaryPropertyBag::createInstance());
+    COMPtr<CFDictionaryPropertyBag> userInfoBag = CFDictionaryPropertyBag::createInstance();
     userInfoBag->setDictionary(userInfo.get());
  
     int errorCode = 0;
diff --git a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
index 21599bc..f1fb5f7 100644
--- a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
+++ b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
@@ -65,6 +65,9 @@ public:
     virtual void dispatchDidCancelClientRedirect();
     virtual void dispatchWillPerformClientRedirect(const WebCore::KURL&, double interval, double fireDate);
     virtual void dispatchDidChangeLocationWithinPage();
+    virtual void dispatchDidPushStateWithinPage();
+    virtual void dispatchDidReplaceStateWithinPage();
+    virtual void dispatchDidPopStateWithinPage();
     virtual void dispatchWillClose();
     virtual void dispatchDidReceiveIcon();
     virtual void dispatchDidStartProvisionalLoad();
diff --git a/WebKit/win/WebCoreSupport/WebInspectorClient.cpp b/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
index 75a76f2..0dd6e58 100644
--- a/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
@@ -233,7 +233,7 @@ void WebInspectorClient::attachWindow()
     if (m_attached)
         return;
 
-    m_inspectedWebView->page()->inspectorController()->setSetting(inspectorStartsAttachedName, InspectorController::Setting(true));
+    m_inspectedWebView->page()->inspectorController()->setSetting(inspectorStartsAttachedName, "true");
 
     closeWindowWithoutNotifications();
     showWindowWithoutNotifications();
@@ -244,7 +244,7 @@ void WebInspectorClient::detachWindow()
     if (!m_attached)
         return;
 
-    m_inspectedWebView->page()->inspectorController()->setSetting(inspectorStartsAttachedName, InspectorController::Setting(false));
+    m_inspectedWebView->page()->inspectorController()->setSetting(inspectorStartsAttachedName, "false");
 
     closeWindowWithoutNotifications();
     showWindowWithoutNotifications();
@@ -350,8 +350,8 @@ void WebInspectorClient::showWindowWithoutNotifications()
     ASSERT(m_inspectedWebViewHwnd);
 
     // If no preference is set - default to an attached window. This is important for inspector LayoutTests.
-    InspectorController::Setting shouldAttach = m_inspectedWebView->page()->inspectorController()->setting(inspectorStartsAttachedName);
-    m_shouldAttachWhenShown = shouldAttach.type() == InspectorController::Setting::BooleanType ? shouldAttach.booleanValue() : true;
+    String shouldAttach = m_inspectedWebView->page()->inspectorController()->setting(inspectorStartsAttachedName);
+    m_shouldAttachWhenShown = shouldAttach != "false";
 
     if (!m_shouldAttachWhenShown) {
         // Put the Inspector's WebView inside our window and show it.
diff --git a/WebKit/win/WebCoreSupport/WebInspectorClient.h b/WebKit/win/WebCoreSupport/WebInspectorClient.h
index 8965e87..3f65b0a 100644
--- a/WebKit/win/WebCoreSupport/WebInspectorClient.h
+++ b/WebKit/win/WebCoreSupport/WebInspectorClient.h
@@ -66,9 +66,8 @@ public:
 
     virtual void inspectedURLChanged(const WebCore::String& newURL);
 
-    virtual void populateSetting(const WebCore::String& key, WebCore::InspectorController::Setting&);
-    virtual void storeSetting(const WebCore::String& key, const WebCore::InspectorController::Setting&);
-    virtual void removeSetting(const WebCore::String& key);
+    virtual void populateSetting(const WebCore::String& key, WebCore::String* value);
+    virtual void storeSetting(const WebCore::String& key, const WebCore::String& value);
 
     virtual void inspectorWindowObjectCleared();
 
diff --git a/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp b/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp
index 78daf8d..995b05d 100644
--- a/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp
@@ -32,7 +32,7 @@
 #include <WebCore/Node.h>
 #include <wtf/Assertions.h>
 
-using WebCore::Node;
+using namespace WebCore;
 
 WebPluginHalterClient::WebPluginHalterClient(WebView* webView)
     : m_webView(webView)
@@ -40,7 +40,7 @@ WebPluginHalterClient::WebPluginHalterClient(WebView* webView)
     ASSERT_ARG(webView, webView);
 }
 
-bool WebPluginHalterClient::shouldHaltPlugin(WebCore::Node* n) const
+bool WebPluginHalterClient::shouldHaltPlugin(Node* n, bool isWindowed, const String& pluginName) const
 {
     ASSERT_ARG(n, n);
 
@@ -51,7 +51,7 @@ bool WebPluginHalterClient::shouldHaltPlugin(WebCore::Node* n) const
     COMPtr<IDOMNode> domNode(AdoptCOM, DOMNode::createInstance(n));
 
     BOOL shouldHalt;
-    if (FAILED(d->shouldHaltPlugin(m_webView, domNode.get(), &shouldHalt)))
+    if (FAILED(d->shouldHaltPlugin(m_webView, domNode.get(), isWindowed, BString(pluginName), &shouldHalt)))
         return false;
 
     return shouldHalt;
diff --git a/WebKit/win/WebCoreSupport/WebPluginHalterClient.h b/WebKit/win/WebCoreSupport/WebPluginHalterClient.h
index 7d05fe9..da3d28a 100644
--- a/WebKit/win/WebCoreSupport/WebPluginHalterClient.h
+++ b/WebKit/win/WebCoreSupport/WebPluginHalterClient.h
@@ -30,6 +30,7 @@
 
 namespace WebCore {
     class Node;
+    class String;
 }
 
 class WebView;
@@ -38,7 +39,7 @@ class WebPluginHalterClient : public WebCore::PluginHalterClient {
 public:
     WebPluginHalterClient(WebView* webView);
 
-    virtual bool shouldHaltPlugin(WebCore::Node* n) const;
+    virtual bool shouldHaltPlugin(WebCore::Node* n, bool isWindowed, const WebCore::String& pluginName) const;
     virtual bool enabled() const;
 
 private:
diff --git a/WebKit/win/WebDatabaseManager.cpp b/WebKit/win/WebDatabaseManager.cpp
index a531997..989f33c 100644
--- a/WebKit/win/WebDatabaseManager.cpp
+++ b/WebKit/win/WebDatabaseManager.cpp
@@ -364,7 +364,7 @@ void WebDatabaseManager::dispatchDidModifyDatabase(SecurityOrigin* origin, const
     RetainPtr<CFStringRef> str(AdoptCF, databaseName.createCFString());
     CFDictionarySetValue(userInfo.get(), databaseNameKey, str.get());
 
-    COMPtr<CFDictionaryPropertyBag> userInfoBag(AdoptCOM, CFDictionaryPropertyBag::createInstance());
+    COMPtr<CFDictionaryPropertyBag> userInfoBag = CFDictionaryPropertyBag::createInstance();
     userInfoBag->setDictionary(userInfo.get());
 
     notifyCenter->postNotificationName(databaseDidModifyOriginName, securityOrigin.get(), userInfoBag.get());
diff --git a/WebKit/win/WebDownload.h b/WebKit/win/WebDownload.h
index 58c13e9..71aebfe 100644
--- a/WebKit/win/WebDownload.h
+++ b/WebKit/win/WebDownload.h
@@ -38,7 +38,7 @@
 namespace WebCore {
     class KURL;
     class ResourceHandle;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
 }
 
diff --git a/WebKit/win/WebDownloadCFNet.cpp b/WebKit/win/WebDownloadCFNet.cpp
index 144a6a5..d1ff23d 100644
--- a/WebKit/win/WebDownloadCFNet.cpp
+++ b/WebKit/win/WebDownloadCFNet.cpp
@@ -48,6 +48,7 @@
 #include <WebCore/AuthenticationCF.h>
 #include <WebCore/BString.h>
 #include <WebCore/CredentialStorage.h>
+#include <WebCore/LoaderRunLoopCF.h>
 #include <WebCore/ResourceError.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/ResourceRequest.h>
@@ -116,7 +117,7 @@ void WebDownload::init(const KURL& url, IWebDownloadDelegate* delegate)
     m_download.adoptCF(CFURLDownloadCreate(0, cfRequest, &client));
 
     CFURLDownloadScheduleWithCurrentMessageQueue(m_download.get());
-    CFURLDownloadScheduleDownloadWithRunLoop(m_download.get(), ResourceHandle::loaderRunLoop(), kCFRunLoopDefaultMode);
+    CFURLDownloadScheduleDownloadWithRunLoop(m_download.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
 
     LOG(Download, "WebDownload - Initialized download of url %s in WebDownload %p", url.string().utf8().data(), this);
 }
@@ -154,7 +155,7 @@ HRESULT STDMETHODCALLTYPE WebDownload::initWithRequest(
     }
 
     CFURLDownloadScheduleWithCurrentMessageQueue(m_download.get());
-    CFURLDownloadScheduleDownloadWithRunLoop(m_download.get(), ResourceHandle::loaderRunLoop(), kCFRunLoopDefaultMode);
+    CFURLDownloadScheduleDownloadWithRunLoop(m_download.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
 
     LOG(Download, "WebDownload - initWithRequest complete, started download of url %s", webRequest->resourceRequest().url().string().utf8().data());
     return S_OK;
@@ -200,7 +201,7 @@ HRESULT STDMETHODCALLTYPE WebDownload::initToResumeWithBundle(
         m_destination = String();
     
     CFURLDownloadScheduleWithCurrentMessageQueue(m_download.get());
-    CFURLDownloadScheduleDownloadWithRunLoop(m_download.get(), ResourceHandle::loaderRunLoop(), kCFRunLoopDefaultMode);
+    CFURLDownloadScheduleDownloadWithRunLoop(m_download.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
 
     LOG(Download, "WebDownload - initWithRequest complete, resumed download of bundle %s", String(bundlePath, SysStringLen(bundlePath)).ascii().data());
     return S_OK;
diff --git a/WebKit/win/WebDropSource.cpp b/WebKit/win/WebDropSource.cpp
index 5c26b37..294c337 100644
--- a/WebKit/win/WebDropSource.cpp
+++ b/WebKit/win/WebDropSource.cpp
@@ -107,9 +107,7 @@ STDMETHODIMP WebDropSource::QueryContinueDrag(BOOL fEscapePressed, DWORD grfKeyS
     if (fEscapePressed || !(grfKeyState & (MK_LBUTTON|MK_RBUTTON))) {
         m_dropped = !fEscapePressed;
         return fEscapePressed? DRAGDROP_S_CANCEL : DRAGDROP_S_DROP;
-    } else if (Page* page = m_webView->page())
-        if (Frame* frame = page->mainFrame()) 
-            frame->eventHandler()->dragSourceMovedTo(generateMouseEvent(m_webView.get(), true));
+    }
 
     return S_OK;
 }
diff --git a/WebKit/win/WebFrame.cpp b/WebKit/win/WebFrame.cpp
index 0a1f6d0..9063fde 100644
--- a/WebKit/win/WebFrame.cpp
+++ b/WebKit/win/WebFrame.cpp
@@ -29,29 +29,30 @@
 #include "WebFrame.h"
 
 #include "CFDictionaryPropertyBag.h"
-#include "COMPtr.h"
 #include "COMPropertyBag.h"
-#include "DefaultPolicyDelegate.h"
+#include "COMPtr.h"
 #include "DOMCoreClasses.h"
+#include "DefaultPolicyDelegate.h"
 #include "HTMLFrameOwnerElement.h"
 #include "MarshallingHelpers.h"
 #include "WebActionPropertyBag.h"
 #include "WebChromeClient.h"
+#include "WebDataSource.h"
 #include "WebDocumentLoader.h"
 #include "WebDownload.h"
-#include "WebError.h"
-#include "WebMutableURLRequest.h"
 #include "WebEditorClient.h"
+#include "WebError.h"
 #include "WebFramePolicyListener.h"
 #include "WebHistory.h"
+#include "WebHistoryItem.h"
 #include "WebIconFetcher.h"
 #include "WebKit.h"
 #include "WebKitStatisticsPrivate.h"
+#include "WebMutableURLRequest.h"
 #include "WebNotificationCenter.h"
-#include "WebView.h"
-#include "WebDataSource.h"
-#include "WebHistoryItem.h"
+#include "WebScriptWorld.h"
 #include "WebURLResponse.h"
+#include "WebView.h"
 #pragma warning( push, 0 )
 #include <WebCore/BString.h>
 #include <WebCore/Cache.h>
@@ -91,6 +92,7 @@
 #include <WebCore/RenderView.h>
 #include <WebCore/RenderTreeAsText.h>
 #include <WebCore/Settings.h>
+#include <WebCore/SVGSMILElement.h>
 #include <WebCore/TextIterator.h>
 #include <WebCore/JSDOMBinding.h>
 #include <WebCore/ScriptController.h>
@@ -118,6 +120,7 @@ extern "C" {
 
 using namespace WebCore;
 using namespace HTMLNames;
+using namespace std;
 
 using JSC::JSGlobalObject;
 using JSC::JSLock;
@@ -490,14 +493,17 @@ JSGlobalContextRef STDMETHODCALLTYPE WebFrame::globalContext()
     return toGlobalRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
 }
 
-JSGlobalContextRef STDMETHODCALLTYPE WebFrame::contextForWorldID(
-    /* [in] */ unsigned worldID)
+JSGlobalContextRef WebFrame::globalContextForScriptWorld(IWebScriptWorld* iWorld)
 {
     Frame* coreFrame = core(this);
     if (!coreFrame)
         return 0;
 
-    return toGlobalRef(coreFrame->script()->globalObject(worldID)->globalExec());
+    COMPtr<WebScriptWorld> world(Query, iWorld);
+    if (!world)
+        return 0;
+
+    return toGlobalRef(coreFrame->script()->globalObject(world->world())->globalExec());
 }
 
 HRESULT STDMETHODCALLTYPE WebFrame::loadRequest( 
@@ -820,7 +826,7 @@ HRESULT STDMETHODCALLTYPE WebFrame::renderTreeAsExternalRepresentation(
     if (!coreFrame)
         return E_FAIL;
 
-    *result = BString(externalRepresentation(coreFrame->contentRenderer())).release();
+    *result = BString(externalRepresentation(coreFrame)).release();
     return S_OK;
 }
 
@@ -980,7 +986,14 @@ HRESULT STDMETHODCALLTYPE WebFrame::selectedString(
 
 HRESULT STDMETHODCALLTYPE WebFrame::selectAll()
 {
-    return E_NOTIMPL;
+    Frame* coreFrame = core(this);
+    if (!coreFrame)
+        return E_FAIL;
+
+    if (!coreFrame->editor()->command("SelectAll").execute())
+        return E_FAIL;
+
+    return S_OK;
 }
 
 HRESULT STDMETHODCALLTYPE WebFrame::deselectAll()
@@ -1151,6 +1164,34 @@ HRESULT WebFrame::pauseTransition(BSTR propertyName, IDOMNode* node, double seco
     return S_OK;
 }
 
+HRESULT WebFrame::pauseSVGAnimation(BSTR elementId, IDOMNode* node, double secondsFromNow, BOOL* animationWasRunning)
+{
+    if (!node || !animationWasRunning)
+        return E_POINTER;
+
+    *animationWasRunning = FALSE;
+
+    Frame* frame = core(this);
+    if (!frame)
+        return E_FAIL;
+
+    Document* document = frame->document();
+    if (!document || !document->svgExtensions())
+        return E_FAIL;
+
+    COMPtr<DOMNode> domNode(Query, node);
+    if (!domNode || !SVGSMILElement::isSMILElement(domNode->node()))
+        return E_FAIL;
+
+#if ENABLE(SVG)
+    *animationWasRunning = document->accessSVGExtensions()->sampleAnimationAtTime(String(elementId, SysStringLen(elementId)), static_cast<SVGSMILElement*>(domNode->node()), secondsFromNow);
+#else
+    *animationWasRunning = FALSE;
+#endif
+
+    return S_OK;
+}
+
 HRESULT WebFrame::numberOfActiveAnimations(UINT* number)
 {
     if (!number)
@@ -1691,7 +1732,7 @@ PassRefPtr<Widget> WebFrame::createJavaAppletWidget(const IntSize& pluginSize, H
     if (FAILED(d->webView->resourceLoadDelegate(&resourceLoadDelegate)))
         return pluginView;
 
-    COMPtr<CFDictionaryPropertyBag> userInfoBag(AdoptCOM, CFDictionaryPropertyBag::createInstance());
+    COMPtr<CFDictionaryPropertyBag> userInfoBag = CFDictionaryPropertyBag::createInstance();
 
     ResourceError resourceError(String(WebKitErrorDomain), WebKitErrorJavaUnavailable, String(), String());
     COMPtr<IWebError> error(AdoptCOM, WebError::createInstance(resourceError, userInfoBag.get()));
@@ -1712,7 +1753,7 @@ String WebFrame::overrideMediaType() const
     return String();
 }
 
-void WebFrame::windowObjectCleared()
+void WebFrame::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 {
     Frame* coreFrame = core(this);
     ASSERT(coreFrame);
@@ -1722,14 +1763,22 @@ void WebFrame::windowObjectCleared()
         return;
 
     COMPtr<IWebFrameLoadDelegate> frameLoadDelegate;
-    if (SUCCEEDED(d->webView->frameLoadDelegate(&frameLoadDelegate))) {
-        JSContextRef context = toRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
-        JSObjectRef windowObject = toRef(coreFrame->script()->globalObject(mainThreadNormalWorld()));
-        ASSERT(windowObject);
+    if (FAILED(d->webView->frameLoadDelegate(&frameLoadDelegate)))
+        return;
 
-        if (FAILED(frameLoadDelegate->didClearWindowObject(d->webView, context, windowObject, this)))
-            frameLoadDelegate->windowScriptObjectAvailable(d->webView, context, windowObject);
-    }
+    COMPtr<IWebFrameLoadDelegatePrivate2> delegatePrivate(Query, frameLoadDelegate);
+    if (delegatePrivate && delegatePrivate->didClearWindowObjectForFrameInScriptWorld(d->webView, this, WebScriptWorld::findOrCreateWorld(world).get()) != E_NOTIMPL)
+        return;
+
+    if (world != mainThreadNormalWorld())
+        return;
+
+    JSContextRef context = toRef(coreFrame->script()->globalObject(world)->globalExec());
+    JSObjectRef windowObject = toRef(coreFrame->script()->globalObject(world));
+    ASSERT(windowObject);
+
+    if (FAILED(frameLoadDelegate->didClearWindowObject(d->webView, context, windowObject, this)))
+        frameLoadDelegate->windowScriptObjectAvailable(d->webView, context, windowObject);
 }
 
 void WebFrame::documentElementAvailable()
@@ -2169,18 +2218,20 @@ HRESULT STDMETHODCALLTYPE WebFrame::isDescendantOfFrame(
     return S_OK;
 }
 
-HRESULT STDMETHODCALLTYPE WebFrame::stringByEvaluatingJavaScriptInIsolatedWorld(
-    /* [in] */ unsigned int worldID,
-    /* [in] */ OLE_HANDLE jsGlobalObject,
-    /* [in] */ BSTR script,
-    /* [retval][out] */ BSTR* evaluationResult)
+HRESULT WebFrame::stringByEvaluatingJavaScriptInScriptWorld(IWebScriptWorld* iWorld, JSObjectRef globalObjectRef, BSTR script, BSTR* evaluationResult)
 {
     if (!evaluationResult)
         return E_POINTER;
     *evaluationResult = 0;
 
+    if (!iWorld)
+        return E_POINTER;
+
+    COMPtr<WebScriptWorld> world(Query, iWorld);
+    if (!world)
+        return E_INVALIDARG;
+
     Frame* coreFrame = core(this);
-    JSObjectRef globalObjectRef = reinterpret_cast<JSObjectRef>(jsGlobalObject);
     String string = String(script, SysStringLen(script));
 
     // Start off with some guess at a frame and a global object, we'll try to do better...!
@@ -2194,7 +2245,7 @@ HRESULT STDMETHODCALLTYPE WebFrame::stringByEvaluatingJavaScriptInIsolatedWorld(
     // Get the frame frome the global object we've settled on.
     Frame* frame = anyWorldGlobalObject->impl()->frame();
     ASSERT(frame->document());
-    JSValue result = frame->script()->executeScriptInIsolatedWorld(worldID, string, true).jsValue();
+    JSValue result = frame->script()->executeScriptInWorld(world->world(), string, true).jsValue();
 
     if (!frame) // In case the script removed our frame from the page.
         return S_OK;
diff --git a/WebKit/win/WebFrame.h b/WebKit/win/WebFrame.h
index d0f6adf..91b8e14 100644
--- a/WebKit/win/WebFrame.h
+++ b/WebKit/win/WebFrame.h
@@ -240,6 +240,7 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE pauseAnimation(BSTR animationName, IDOMNode*, double secondsFromNow, BOOL* animationWasRunning);
     virtual HRESULT STDMETHODCALLTYPE pauseTransition(BSTR propertyName, IDOMNode*, double secondsFromNow, BOOL* transitionWasRunning);
+    virtual HRESULT STDMETHODCALLTYPE pauseSVGAnimation(BSTR elementId, IDOMNode*, double secondsFromNow, BOOL* animationWasRunning);
     virtual HRESULT STDMETHODCALLTYPE numberOfActiveAnimations(UINT*);
 
     virtual HRESULT STDMETHODCALLTYPE isDisplayingStandaloneImage(BOOL*);
@@ -248,14 +249,8 @@ public:
         /* [in] */ BSTR url,
         /* [retval][out] */ BOOL* result);
 
-    virtual HRESULT STDMETHODCALLTYPE stringByEvaluatingJavaScriptInIsolatedWorld( 
-        /* [in] */ unsigned int worldID,
-        /* [in] */ OLE_HANDLE jsGlobalObject,
-        /* [in] */ BSTR script,
-        /* [retval][out] */ BSTR* evaluationResult);
-
-    virtual /* [local] */ JSGlobalContextRef STDMETHODCALLTYPE contextForWorldID(
-        /* [in] */ unsigned worldID);
+    virtual HRESULT STDMETHODCALLTYPE stringByEvaluatingJavaScriptInScriptWorld(IWebScriptWorld*, JSObjectRef globalObjectRef, BSTR script, BSTR* evaluationResult);
+    virtual JSGlobalContextRef STDMETHODCALLTYPE globalContextForScriptWorld(IWebScriptWorld*);
 
     // IWebDocumentText
     virtual HRESULT STDMETHODCALLTYPE supportsTextEncoding( 
@@ -318,7 +313,7 @@ public:
     virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL& url, const WebCore::String& mimeType);
     virtual WebCore::String overrideMediaType() const;
 
-    virtual void windowObjectCleared();
+    virtual void dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*);
     virtual void documentElementAvailable();
     virtual void didPerformFirstNavigation() const;
 
diff --git a/WebKit/win/WebHistory.cpp b/WebKit/win/WebHistory.cpp
index deb75e5..5383a0c 100644
--- a/WebKit/win/WebHistory.cpp
+++ b/WebKit/win/WebHistory.cpp
@@ -96,7 +96,7 @@ static bool areEqualOrClose(double d1, double d2)
     return (diff < .000001 && diff > -.000001);
 }
 
-static CFDictionaryPropertyBag* createUserInfoFromArray(BSTR notificationStr, CFArrayRef arrayItem)
+static COMPtr<CFDictionaryPropertyBag> createUserInfoFromArray(BSTR notificationStr, CFArrayRef arrayItem)
 {
     RetainPtr<CFMutableDictionaryRef> dictionary(AdoptCF, 
         CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
@@ -104,28 +104,19 @@ static CFDictionaryPropertyBag* createUserInfoFromArray(BSTR notificationStr, CF
     RetainPtr<CFStringRef> key(AdoptCF, MarshallingHelpers::BSTRToCFStringRef(notificationStr));
     CFDictionaryAddValue(dictionary.get(), key.get(), arrayItem);
 
-    CFDictionaryPropertyBag* result = CFDictionaryPropertyBag::createInstance();
+    COMPtr<CFDictionaryPropertyBag> result = CFDictionaryPropertyBag::createInstance();
     result->setDictionary(dictionary.get());
     return result;
 }
 
-static CFDictionaryPropertyBag* createUserInfoFromHistoryItem(BSTR notificationStr, IWebHistoryItem* item)
+static COMPtr<CFDictionaryPropertyBag> createUserInfoFromHistoryItem(BSTR notificationStr, IWebHistoryItem* item)
 {
     // reference counting of item added to the array is managed by the CFArray value callbacks
     RetainPtr<CFArrayRef> itemList(AdoptCF, CFArrayCreate(0, (const void**) &item, 1, &MarshallingHelpers::kIUnknownArrayCallBacks));
-    CFDictionaryPropertyBag* info = createUserInfoFromArray(notificationStr, itemList.get());
+    COMPtr<CFDictionaryPropertyBag> info = createUserInfoFromArray(notificationStr, itemList.get());
     return info;
 }
 
-static void releaseUserInfo(CFDictionaryPropertyBag* userInfo)
-{
-    // free the dictionary
-    userInfo->setDictionary(0);
-    int result = userInfo->Release();
-    (void)result;
-    ASSERT(result == 0);   // make sure no one else holds a reference to the userInfo.
-}
-
 // WebHistory -----------------------------------------------------------------
 
 WebHistory::WebHistory()
@@ -264,9 +255,8 @@ HRESULT STDMETHODCALLTYPE WebHistory::loadFromURL(
         goto exit;
 
     if (CFArrayGetCount(discardedItems.get()) > 0) {
-        CFDictionaryPropertyBag* userInfo = createUserInfoFromArray(getNotificationString(kWebHistoryItemsDiscardedWhileLoadingNotification), discardedItems.get());
-        hr = postNotification(kWebHistoryItemsDiscardedWhileLoadingNotification, userInfo);
-        releaseUserInfo(userInfo);
+        COMPtr<CFDictionaryPropertyBag> userInfo = createUserInfoFromArray(getNotificationString(kWebHistoryItemsDiscardedWhileLoadingNotification), discardedItems.get());
+        hr = postNotification(kWebHistoryItemsDiscardedWhileLoadingNotification, userInfo.get());
         if (FAILED(hr))
             goto exit;
     }
@@ -465,8 +455,8 @@ HRESULT STDMETHODCALLTYPE WebHistory::removeAllItems( void)
 
     PageGroup::removeAllVisitedLinks();
 
-    CFDictionaryPropertyBag* userInfo = createUserInfoFromArray(getNotificationString(kWebHistoryAllItemsRemovedNotification), allItems.get());
-    return postNotification(kWebHistoryAllItemsRemovedNotification, userInfo);
+    COMPtr<CFDictionaryPropertyBag> userInfo = createUserInfoFromArray(getNotificationString(kWebHistoryAllItemsRemovedNotification), allItems.get());
+    return postNotification(kWebHistoryAllItemsRemovedNotification, userInfo.get());
 }
 
 HRESULT STDMETHODCALLTYPE WebHistory::orderedLastVisitedDays( 
@@ -644,10 +634,9 @@ HRESULT WebHistory::removeItem(IWebHistoryItem* entry)
     if (FAILED(hr))
         return hr;
 
-    CFDictionaryPropertyBag* userInfo = createUserInfoFromHistoryItem(
+    COMPtr<CFDictionaryPropertyBag> userInfo = createUserInfoFromHistoryItem(
         getNotificationString(kWebHistoryItemsRemovedNotification), entry);
-    hr = postNotification(kWebHistoryItemsRemovedNotification, userInfo);
-    releaseUserInfo(userInfo);
+    hr = postNotification(kWebHistoryItemsRemovedNotification, userInfo.get());
 
     return hr;
 }
@@ -695,10 +684,9 @@ HRESULT WebHistory::addItem(IWebHistoryItem* entry, bool discardDuplicate, bool*
 
     CFDictionarySetValue(m_entriesByURL.get(), urlString.get(), entry);
 
-    CFDictionaryPropertyBag* userInfo = createUserInfoFromHistoryItem(
+    COMPtr<CFDictionaryPropertyBag> userInfo = createUserInfoFromHistoryItem(
         getNotificationString(kWebHistoryItemsAddedNotification), entry);
-    hr = postNotification(kWebHistoryItemsAddedNotification, userInfo);
-    releaseUserInfo(userInfo);
+    hr = postNotification(kWebHistoryItemsAddedNotification, userInfo.get());
 
     if (added)
         *added = true;
@@ -754,10 +742,9 @@ void WebHistory::visitedURL(const KURL& url, const String& title, const String&
     COMPtr<WebHistoryItem> item(Query, entry);
     item->historyItem()->setRedirectURLs(0);
 
-    CFDictionaryPropertyBag* userInfo = createUserInfoFromHistoryItem(
+    COMPtr<CFDictionaryPropertyBag> userInfo = createUserInfoFromHistoryItem(
         getNotificationString(kWebHistoryItemsAddedNotification), entry);
-    postNotification(kWebHistoryItemsAddedNotification, userInfo);
-    releaseUserInfo(userInfo);
+    postNotification(kWebHistoryItemsAddedNotification, userInfo.get());
 }
 
 HRESULT WebHistory::itemForURLString(
diff --git a/WebKit/win/WebIconDatabase.cpp b/WebKit/win/WebIconDatabase.cpp
index 315db9e..9b87c2b 100644
--- a/WebKit/win/WebIconDatabase.cpp
+++ b/WebKit/win/WebIconDatabase.cpp
@@ -358,7 +358,7 @@ static void postDidAddIconNotification(const String& pageURL, WebIconDatabase* i
     RetainPtr<CFStringRef> url(AdoptCF, pageURL.createCFString());
     CFDictionaryAddValue(dictionary.get(), WebIconDatabase::iconDatabaseNotificationUserInfoURLKey(), url.get());
 
-    COMPtr<CFDictionaryPropertyBag> userInfo(AdoptCOM, CFDictionaryPropertyBag::createInstance());
+    COMPtr<CFDictionaryPropertyBag> userInfo = CFDictionaryPropertyBag::createInstance();
     userInfo->setDictionary(dictionary.get());
 
     IWebNotificationCenter* notifyCenter = WebNotificationCenter::defaultCenterInternal();
diff --git a/WebKit/win/WebInspector.cpp b/WebKit/win/WebInspector.cpp
index 97587f9..e4ac32b 100644
--- a/WebKit/win/WebInspector.cpp
+++ b/WebKit/win/WebInspector.cpp
@@ -272,3 +272,38 @@ HRESULT STDMETHODCALLTYPE  WebInspector::evaluateInFrontend(ULONG callId, BSTR b
     page->inspectorController()->evaluateForTestInFrontend(callId, script);
     return S_OK;
 }
+
+HRESULT STDMETHODCALLTYPE WebInspector::isTimelineProfilingEnabled(BOOL* isEnabled)
+{
+    if (!isEnabled)
+        return E_POINTER;
+
+    *isEnabled = FALSE;
+
+    if (!m_webView)
+        return S_OK;
+
+    Page* page = m_webView->page();
+    if (!page)
+        return S_OK;
+
+    *isEnabled = page->inspectorController()->timelineAgent() != 0;
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE WebInspector::setTimelineProfilingEnabled(BOOL enabled)
+{
+    if (!m_webView)
+        return S_OK;
+
+    Page* page = m_webView->page();
+    if (!page)
+        return S_OK;
+
+    if (enabled)
+        page->inspectorController()->startTimelineProfiler();
+    else
+        page->inspectorController()->stopTimelineProfiler();
+
+    return S_OK;
+}
diff --git a/WebKit/win/WebInspector.h b/WebKit/win/WebInspector.h
index 4f9bedb..053a593 100644
--- a/WebKit/win/WebInspector.h
+++ b/WebKit/win/WebInspector.h
@@ -59,9 +59,12 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE isJavaScriptProfilingEnabled(BOOL* isProfilingEnabled);
     virtual HRESULT STDMETHODCALLTYPE setJavaScriptProfilingEnabled(BOOL);
-    
+
     virtual HRESULT STDMETHODCALLTYPE evaluateInFrontend(ULONG callId, BSTR script);
 
+    virtual HRESULT STDMETHODCALLTYPE isTimelineProfilingEnabled(BOOL* isEnabled);
+    virtual HRESULT STDMETHODCALLTYPE setTimelineProfilingEnabled(BOOL);
+
 private:
     WebInspector(WebView*);
     ~WebInspector();
diff --git a/WebKit/win/WebKit.vcproj/Interfaces.vcproj b/WebKit/win/WebKit.vcproj/Interfaces.vcproj
index 75c7c11..ca9b2a4 100644
--- a/WebKit/win/WebKit.vcproj/Interfaces.vcproj
+++ b/WebKit/win/WebKit.vcproj/Interfaces.vcproj
@@ -1324,6 +1324,26 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebScriptWorld.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\IWebScrollBarDelegatePrivate.idl"

 			>

 			<FileConfiguration

@@ -1663,6 +1683,26 @@
 				/>

 			</FileConfiguration>

 		</File>

+        <File

+			RelativePath="..\Interfaces\JavaScriptCoreAPITypes.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

 	</Files>

 	<Globals>

 	</Globals>

diff --git a/WebKit/win/WebKit.vcproj/WebKit.vcproj b/WebKit/win/WebKit.vcproj/WebKit.vcproj
index 121f773..5846813 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.vcproj
+++ b/WebKit/win/WebKit.vcproj/WebKit.vcproj
@@ -40,7 +40,7 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_FILTERS;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

 				DisableSpecificWarnings="4819"

@@ -117,7 +117,7 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_FILTERS;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

 				DisableSpecificWarnings="4819"

@@ -193,7 +193,7 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_FILTERS;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

 				Detect64BitPortabilityProblems="false"

@@ -215,7 +215,7 @@
 				Name="VCLinkerTool"

 				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib JavaScriptCore$(WebKitDLLConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib msimg32.lib QTMovieWin$(WebKitConfigSuffix).lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib comsuppw.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

-				AdditionalLibraryDirectories=""

+				AdditionalLibraryDirectories="$(DXSDK_DIR)\Lib\x86"

 				ModuleDefinitionFile="WebKit$(WebKitDLLConfigSuffix).def"

 				DelayLoadDLLs="comdlg32.dll;usp10.dll;comctl32.dll;version.dll;libxslt$(LibraryConfigSuffix).dll;SQLite3$(LibraryConfigSuffix).dll;msimg32.dll;QTMovieWin$(WebKitConfigSuffix).dll;iphlpapi.dll;rpcrt4.dll"

 			/>

@@ -270,7 +270,7 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_FILTERS;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

 				DisableSpecificWarnings="4819"

@@ -289,7 +289,7 @@
 			/>

 			<Tool

 				Name="VCLinkerTool"

-				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CFLite_Debug.lib JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib msimg32.lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib comsuppw.lib"

+				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CFLite_Debug.lib JavaScriptCore$(WebKitConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib msimg32.lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib comsuppw.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

 				AdditionalLibraryDirectories=""

 				ModuleDefinitionFile="WebKit_Cairo$(WebKitDLLConfigSuffix).def"

@@ -350,7 +350,7 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_FILTERS;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

 				DisableSpecificWarnings="4819"

@@ -426,7 +426,7 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

-				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_FILTERS;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

 				UsePrecompiledHeader="2"

 				PrecompiledHeaderThrough="WebKitPrefix.h"

 				Detect64BitPortabilityProblems="false"

@@ -722,6 +722,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\WebScriptWorld.h"

+				>

+			</File>

+                        <File

+				RelativePath="..\WebSerializedJSValue.h"

+				>

+			</File>

+			<File

 				RelativePath="..\WebKitStatistics.h"

 				>

 			</File>

@@ -790,6 +798,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\WebScriptWorld.h"

+				>

+			</File>

+			<File

 				RelativePath="..\WebScrollBar.h"

 				>

 			</File>

@@ -1090,6 +1102,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\WebScriptWorld.cpp"

+				>

+			</File>

+                        <File

+				RelativePath="..\WebSerializedJSValue.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\WebKitStatistics.cpp"

 				>

 			</File>

@@ -1122,6 +1142,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\WebScriptWorld.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\WebScrollBar.cpp"

 				>

 			</File>

diff --git a/WebKit/win/WebKitClassFactory.cpp b/WebKit/win/WebKitClassFactory.cpp
index c2143b5..b233a5c 100644
--- a/WebKit/win/WebKitClassFactory.cpp
+++ b/WebKit/win/WebKitClassFactory.cpp
@@ -27,8 +27,8 @@
 #include "WebKitDLL.h"
 #include "WebKitClassFactory.h"
 
-#include "ForEachCoClass.h"
 #include "CFDictionaryPropertyBag.h"
+#include "ForEachCoClass.h"
 #include "WebArchive.h"
 #include "WebCache.h"
 #include "WebCookieManager.h"
@@ -42,11 +42,12 @@
 #include "WebIconDatabase.h"
 #include "WebJavaScriptCollector.h"
 #include "WebKit.h"
-#include "WebScrollBar.h"
 #include "WebKitStatistics.h"
 #include "WebMutableURLRequest.h"
 #include "WebNotificationCenter.h"
 #include "WebPreferences.h"
+#include "WebScriptWorld.h"
+#include "WebScrollBar.h"
 #include "WebTextRenderer.h"
 #include "WebURLCredential.h"
 #include "WebURLProtectionSpace.h"
@@ -126,6 +127,19 @@ ULONG STDMETHODCALLTYPE WebKitClassFactory::Release(void)
     return newRef;
 }
 
+// FIXME: Remove these functions once all createInstance() functions return COMPtr.
+template <typename T>
+static T* releaseRefFromCreateInstance(T* object)
+{
+    return object;
+}
+
+template <typename T>
+static T* releaseRefFromCreateInstance(COMPtr<T> object)
+{
+    return object.releaseRef();
+}
+
 // IClassFactory --------------------------------------------------------------
 
 HRESULT STDMETHODCALLTYPE WebKitClassFactory::CreateInstance(IUnknown* pUnkOuter, REFIID riid, void** ppvObject)
@@ -138,7 +152,7 @@ HRESULT STDMETHODCALLTYPE WebKitClassFactory::CreateInstance(IUnknown* pUnkOuter
 
 #define INITIALIZE_IF_CLASS(cls) \
     if (IsEqualGUID(m_targetClass, CLSID_##cls)) \
-        unknown = static_cast<I##cls*>(cls::createInstance()); \
+        unknown = static_cast<I##cls*>(releaseRefFromCreateInstance(cls::createInstance())); \
     else \
     // end of macro
 
diff --git a/WebKit/win/WebKitGraphics.cpp b/WebKit/win/WebKitGraphics.cpp
index 9727ee6..03fe903 100644
--- a/WebKit/win/WebKitGraphics.cpp
+++ b/WebKit/win/WebKitGraphics.cpp
@@ -114,7 +114,7 @@ void WebDrawText(WebTextRenderInfo* info)
         // Set shadow setting
         if (info->structSize == sizeof(WebTextRenderInfo) &&
             (info->shadowOffset.cx || info->shadowOffset.cy || info->shadowBlur || info->shadowColor))
-            context.setShadow(info->shadowOffset, info->shadowBlur, info->shadowColor);
+            context.setShadow(info->shadowOffset, info->shadowBlur, info->shadowColor, DeviceColorSpace);
 
         WebCoreDrawTextAtPoint(context, drawString, info->pt, makeFont(*(info->description)), info->color, info->underlinedIndex);
         context.restore();
diff --git a/WebKit/win/WebKitPrefix.cpp b/WebKit/win/WebKitPrefix.cpp
index 193e9f6..e82b88d 100644
--- a/WebKit/win/WebKitPrefix.cpp
+++ b/WebKit/win/WebKitPrefix.cpp
@@ -27,4 +27,3 @@
  */
 
 #include "WebKitPrefix.h"
-
diff --git a/WebKit/win/WebNavigationData.cpp b/WebKit/win/WebNavigationData.cpp
index 1ae3fe5..1ea028c 100644
--- a/WebKit/win/WebNavigationData.cpp
+++ b/WebKit/win/WebNavigationData.cpp
@@ -27,8 +27,7 @@
 #include "WebKitDLL.h"
 #include "WebNavigationData.h"
 
-#include <WebCore/BString.h>
-using WebCore::BString;
+using namespace WebCore;
 
 // IUnknown -------------------------------------------------------------------
 
@@ -62,19 +61,18 @@ ULONG STDMETHODCALLTYPE WebNavigationData::Release(void)
 
 // WebNavigationData -------------------------------------------------------------------
 
-WebNavigationData::WebNavigationData(BSTR url, BSTR title, IWebURLRequest* request, IWebURLResponse* response, bool hasSubstituteData, BSTR clientRedirectSource)
+WebNavigationData::WebNavigationData(const String& url, const String& title, IWebURLRequest* request, IWebURLResponse* response, bool hasSubstituteData, const String& clientRedirectSource)
     : m_refCount(0)
+    , m_url(url)
+    , m_title(title)
     , m_request(request)
     , m_response(response)
     , m_hasSubstituteData(hasSubstituteData)
+    , m_clientRedirectSource(clientRedirectSource)
 
 {
     gClassCount++;
     gClassNameCount.add("WebNavigationData");
-
-    m_url.adoptBSTR(url);
-    m_title.adoptBSTR(title);
-    m_clientRedirectSource.adoptBSTR(clientRedirectSource);
 }
 
 WebNavigationData::~WebNavigationData()
@@ -83,7 +81,7 @@ WebNavigationData::~WebNavigationData()
     gClassNameCount.remove("WebNavigationData");
 }
 
-WebNavigationData* WebNavigationData::createInstance(BSTR url, BSTR title, IWebURLRequest* request, IWebURLResponse* response, bool hasSubstituteData, BSTR clientRedirectSource)
+WebNavigationData* WebNavigationData::createInstance(const String& url, const String& title, IWebURLRequest* request, IWebURLResponse* response, bool hasSubstituteData, const String& clientRedirectSource)
 {
     WebNavigationData* instance = new WebNavigationData(url, title, request, response, hasSubstituteData, clientRedirectSource);
     instance->AddRef();
diff --git a/WebKit/win/WebNavigationData.h b/WebKit/win/WebNavigationData.h
index 0443fd7..d00912c 100644
--- a/WebKit/win/WebNavigationData.h
+++ b/WebKit/win/WebNavigationData.h
@@ -33,9 +33,9 @@
 
 class WebNavigationData : public IWebNavigationData {
 public:
-    static WebNavigationData* createInstance(BSTR, BSTR, IWebURLRequest*, IWebURLResponse*, bool, BSTR);
+    static WebNavigationData* createInstance(const WebCore::String& url, const WebCore::String& title, IWebURLRequest*, IWebURLResponse*, bool hasSubstituteData, const WebCore::String& clientRedirectSource);
 private:
-    WebNavigationData(BSTR url, BSTR title, IWebURLRequest*, IWebURLResponse*, bool hasSubstituteData, BSTR clientRedirectSource);
+    WebNavigationData(const WebCore::String& url, const WebCore::String& title, IWebURLRequest*, IWebURLResponse*, bool hasSubstituteData, const WebCore::String& clientRedirectSource);
     ~WebNavigationData();
 
 public:
diff --git a/WebKit/win/WebScriptObject.cpp b/WebKit/win/WebScriptObject.cpp
index 55d92e7..9306eb1 100644
--- a/WebKit/win/WebScriptObject.cpp
+++ b/WebKit/win/WebScriptObject.cpp
@@ -23,10 +23,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "WebKitDLL.h"
-
+#include "config.h"
 #include "WebScriptObject.h"
 
+#include "WebKitDLL.h"
+
 #include <wtf/Assertions.h>
 
 // WebScriptObject ------------------------------------------------------------
diff --git a/WebKit/win/WebScriptWorld.cpp b/WebKit/win/WebScriptWorld.cpp
new file mode 100644
index 0000000..03eede7
--- /dev/null
+++ b/WebKit/win/WebScriptWorld.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebKitDLL.h"
+#include "WebScriptWorld.h"
+
+#include <WebCore/JSDOMBinding.h>
+#include <WebCore/ScriptController.h>
+
+using namespace WebCore;
+
+typedef HashMap<DOMWrapperWorld*, WebScriptWorld*> WorldMap;
+static WorldMap& allWorlds()
+{
+    static WorldMap& map = *new WorldMap;
+    return map;
+}
+
+inline WebScriptWorld::WebScriptWorld(PassRefPtr<DOMWrapperWorld> world)
+    : m_refCount(0)
+    , m_world(world)
+{
+    ASSERT_ARG(world, m_world);
+
+    ASSERT_ARG(world, !allWorlds().contains(m_world.get()));
+    allWorlds().add(m_world.get(), this);
+
+    ++gClassCount;
+    gClassNameCount.add("WebScriptWorld");
+}
+
+WebScriptWorld::~WebScriptWorld()
+{
+    ASSERT(allWorlds().contains(m_world.get()));
+    allWorlds().remove(m_world.get());
+
+    --gClassCount;
+    gClassNameCount.remove("WebScriptWorld");
+}
+
+WebScriptWorld* WebScriptWorld::standardWorld()
+{
+    static WebScriptWorld* standardWorld = createInstance(mainThreadNormalWorld()).releaseRef();
+    return standardWorld;
+}
+
+COMPtr<WebScriptWorld> WebScriptWorld::createInstance()
+{
+    return createInstance(ScriptController::createWorld());
+}
+
+COMPtr<WebScriptWorld> WebScriptWorld::createInstance(PassRefPtr<DOMWrapperWorld> world)
+{
+    return new WebScriptWorld(world);
+}
+
+COMPtr<WebScriptWorld> WebScriptWorld::findOrCreateWorld(DOMWrapperWorld* world)
+{
+    if (world == mainThreadNormalWorld())
+        return standardWorld();
+
+    if (WebScriptWorld* existingWorld = allWorlds().get(world))
+        return existingWorld;
+
+    return createInstance(world);
+}
+
+ULONG WebScriptWorld::AddRef()
+{
+    return ++m_refCount;
+}
+
+ULONG WebScriptWorld::Release()
+{
+    ULONG newRefCount = --m_refCount;
+    if (!newRefCount)
+        delete this;
+    return newRefCount;
+}
+
+HRESULT WebScriptWorld::QueryInterface(REFIID riid, void** ppvObject)
+{
+    if (!ppvObject)
+        return E_POINTER;
+    *ppvObject = 0;
+
+    if (IsEqualIID(riid, __uuidof(WebScriptWorld)))
+        *ppvObject = this;
+    else if (IsEqualIID(riid, __uuidof(IWebScriptWorld)))
+        *ppvObject = static_cast<IWebScriptWorld*>(this);
+    else if (IsEqualIID(riid, IID_IUnknown))
+        *ppvObject = static_cast<IUnknown*>(this);
+    else
+        return E_NOINTERFACE;
+
+    AddRef();
+    return S_OK;
+}
+
+HRESULT WebScriptWorld::standardWorld(IWebScriptWorld** outWorld)
+{
+    if (!outWorld)
+        return E_POINTER;
+
+    *outWorld = standardWorld();
+    (*outWorld)->AddRef();
+    return S_OK;
+}
diff --git a/WebKit/win/WebScriptWorld.h b/WebKit/win/WebScriptWorld.h
new file mode 100644
index 0000000..b800225
--- /dev/null
+++ b/WebKit/win/WebScriptWorld.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScriptWorld_h
+#define WebScriptWorld_h
+
+#include <WebCore/COMPtr.h>
+
+namespace WebCore {
+    class DOMWrapperWorld;
+}
+
+class WebScriptWorld : public Noncopyable, public IWebScriptWorld {
+public:
+    static WebScriptWorld* standardWorld();
+    static COMPtr<WebScriptWorld> createInstance();
+
+    static COMPtr<WebScriptWorld> findOrCreateWorld(WebCore::DOMWrapperWorld*);
+
+    virtual ULONG STDMETHODCALLTYPE AddRef();
+    virtual ULONG STDMETHODCALLTYPE Release();
+
+    WebCore::DOMWrapperWorld* world() const { return m_world.get(); }
+
+private:
+    static COMPtr<WebScriptWorld> createInstance(PassRefPtr<WebCore::DOMWrapperWorld>);
+
+    WebScriptWorld(PassRefPtr<WebCore::DOMWrapperWorld>);
+    ~WebScriptWorld();
+
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void** ppvObject);
+    virtual HRESULT STDMETHODCALLTYPE standardWorld(IWebScriptWorld**);
+
+    ULONG m_refCount;
+    RefPtr<WebCore::DOMWrapperWorld> m_world;
+};
+
+#endif // WebScriptWorld_h
diff --git a/WebKit/win/WebSerializedJSValue.cpp b/WebKit/win/WebSerializedJSValue.cpp
new file mode 100644
index 0000000..307df90
--- /dev/null
+++ b/WebKit/win/WebSerializedJSValue.cpp
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebKitDLL.h"
+#include "WebSerializedJSValue.h"
+
+#include <WebCore/SerializedScriptValue.h>
+
+using namespace WebCore;
+
+WebSerializedJSValue::WebSerializedJSValue()
+    : m_refCount(0)
+{
+    ++gClassCount;
+    gClassNameCount.add("WebSerializedJSValue");
+}
+
+WebSerializedJSValue::~WebSerializedJSValue()
+{
+    --gClassCount;
+    gClassNameCount.remove("WebSerializedJSValue");
+}
+
+COMPtr<WebSerializedJSValue> WebSerializedJSValue::createInstance()
+{
+    return new WebSerializedJSValue();
+}
+
+ULONG WebSerializedJSValue::AddRef()
+{
+    return ++m_refCount;
+}
+
+ULONG WebSerializedJSValue::Release()
+{
+    ULONG newRefCount = --m_refCount;
+    if (!newRefCount)
+        delete this;
+    return newRefCount;
+}
+
+HRESULT WebSerializedJSValue::QueryInterface(REFIID riid, void** ppvObject)
+{
+    if (!ppvObject)
+        return E_POINTER;
+    *ppvObject = 0;
+
+    if (IsEqualIID(riid, __uuidof(WebSerializedJSValue)))
+        *ppvObject = this;
+    else if (IsEqualIID(riid, __uuidof(IWebSerializedJSValue)))
+        *ppvObject = static_cast<IWebSerializedJSValue*>(this);
+    else if (IsEqualIID(riid, IID_IUnknown))
+        *ppvObject = static_cast<IUnknown*>(this);
+    else
+        return E_NOINTERFACE;
+
+    AddRef();
+    return S_OK;
+}
+
+HRESULT WebSerializedJSValue::serialize(JSContextRef sourceContext, JSValueRef value, JSValueRef* exception)
+{
+    ASSERT_ARG(value, value);
+    ASSERT_ARG(sourceContext, sourceContext);
+
+    if (!value || !sourceContext)
+        return E_POINTER;
+
+    m_value = SerializedScriptValue::create(sourceContext, value, exception);
+        
+    return S_OK;
+}
+
+HRESULT WebSerializedJSValue::deserialize(JSContextRef destinationContext, JSValueRef* outValue)
+{
+    if (!outValue)
+        return E_POINTER;
+
+    if (!m_value)
+        *outValue = 0;
+    else
+        *outValue = m_value->deserialize(destinationContext, 0);
+
+    return S_OK;
+}
diff --git a/WebKit/win/WebSerializedJSValue.h b/WebKit/win/WebSerializedJSValue.h
new file mode 100644
index 0000000..d39323c
--- /dev/null
+++ b/WebKit/win/WebSerializedJSValue.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSerializedJSValue_h
+#define WebSerializedJSValue_h
+
+#include <WebCore/COMPtr.h>
+
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef const struct OpaqueJSValue* JSValueRef;
+
+namespace WebCore {
+    class SerializedScriptValue;
+}
+
+class WebSerializedJSValue : public Noncopyable, public IWebSerializedJSValue {
+public:
+    static COMPtr<WebSerializedJSValue> createInstance();
+
+    virtual ULONG STDMETHODCALLTYPE AddRef();
+    virtual ULONG STDMETHODCALLTYPE Release();
+
+    virtual HRESULT STDMETHODCALLTYPE serialize(JSContextRef, JSValueRef value, JSValueRef* exception);
+    virtual HRESULT STDMETHODCALLTYPE deserialize(JSContextRef, JSValueRef* result);
+
+private:
+    WebSerializedJSValue();
+    ~WebSerializedJSValue();
+
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void** ppvObject);
+
+    ULONG m_refCount;
+    RefPtr<WebCore::SerializedScriptValue> m_value;
+};
+
+#endif // WebSerializedJSValue_h
diff --git a/WebKit/win/WebURLAuthenticationChallenge.cpp b/WebKit/win/WebURLAuthenticationChallenge.cpp
index 7c37501..c711450 100644
--- a/WebKit/win/WebURLAuthenticationChallenge.cpp
+++ b/WebKit/win/WebURLAuthenticationChallenge.cpp
@@ -172,7 +172,7 @@ HRESULT STDMETHODCALLTYPE WebURLAuthenticationChallenge::initWithAuthenticationC
         return E_NOINTERFACE;
 
 #if USE(CFNETWORK)
-    m_authenticationChallenge = AuthenticationChallenge(webChallenge->authenticationChallenge().cfURLAuthChallengeRef(), webSender->resourceHandle());
+    m_authenticationChallenge = AuthenticationChallenge(webChallenge->authenticationChallenge().cfURLAuthChallengeRef(), webSender->authenticationClient());
 
     return S_OK;
 #else
@@ -220,8 +220,8 @@ HRESULT STDMETHODCALLTYPE WebURLAuthenticationChallenge::sender(
     /* [out, retval] */ IWebURLAuthenticationChallengeSender** sender)
 {
     if (!m_sender) {
-        ResourceHandle* handle = m_authenticationChallenge.sourceHandle();
-        m_sender.adoptRef(WebURLAuthenticationChallengeSender::createInstance(handle));
+        AuthenticationClient* client = m_authenticationChallenge.authenticationClient();
+        m_sender.adoptRef(WebURLAuthenticationChallengeSender::createInstance(client));
     }
 
     return m_sender.copyRefTo(sender);
diff --git a/WebKit/win/WebURLAuthenticationChallengeSender.cpp b/WebKit/win/WebURLAuthenticationChallengeSender.cpp
index 4d4d4cd..1257d41 100644
--- a/WebKit/win/WebURLAuthenticationChallengeSender.cpp
+++ b/WebKit/win/WebURLAuthenticationChallengeSender.cpp
@@ -34,18 +34,18 @@
 #include "WebURLCredential.h"
 
 #pragma warning(push, 0)
-#include <WebCore/ResourceHandle.h>
+#include <WebCore/AuthenticationClient.h>
 #pragma warning(pop)
 
 using namespace WebCore;
 
 // WebURLAuthenticationChallengeSender ----------------------------------------------------------------
 
-WebURLAuthenticationChallengeSender::WebURLAuthenticationChallengeSender(PassRefPtr<ResourceHandle> handle)
+WebURLAuthenticationChallengeSender::WebURLAuthenticationChallengeSender(PassRefPtr<AuthenticationClient> client)
     : m_refCount(0)
-    , m_handle(handle)
+    , m_client(client)
 {
-    ASSERT(m_handle);
+    ASSERT(m_client);
     gClassCount++;
     gClassNameCount.add("WebURLAuthenticationChallengeSender");
 }
@@ -56,9 +56,9 @@ WebURLAuthenticationChallengeSender::~WebURLAuthenticationChallengeSender()
     gClassNameCount.remove("WebURLAuthenticationChallengeSender");
 }
 
-WebURLAuthenticationChallengeSender* WebURLAuthenticationChallengeSender::createInstance(PassRefPtr<WebCore::ResourceHandle> handle)
+WebURLAuthenticationChallengeSender* WebURLAuthenticationChallengeSender::createInstance(PassRefPtr<WebCore::AuthenticationClient> client)
 {
-    WebURLAuthenticationChallengeSender* instance = new WebURLAuthenticationChallengeSender(handle);
+    WebURLAuthenticationChallengeSender* instance = new WebURLAuthenticationChallengeSender(client);
     instance->AddRef();
     return instance;
 }
@@ -97,8 +97,8 @@ ULONG STDMETHODCALLTYPE WebURLAuthenticationChallengeSender::Release(void)
 
 // WebURLAuthenticationChallengeSender ----------------------------------------------------------------
 
-ResourceHandle* WebURLAuthenticationChallengeSender::resourceHandle() const
+AuthenticationClient* WebURLAuthenticationChallengeSender::authenticationClient() const
 {
-    return m_handle.get();
+    return m_client.get();
 }
 
diff --git a/WebKit/win/WebURLAuthenticationChallengeSender.h b/WebKit/win/WebURLAuthenticationChallengeSender.h
index cfb8cc3..5ccd0c5 100644
--- a/WebKit/win/WebURLAuthenticationChallengeSender.h
+++ b/WebKit/win/WebURLAuthenticationChallengeSender.h
@@ -32,16 +32,16 @@
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
-    class ResourceHandle;
+    class AuthenticationClient;
 }
 
 class DECLSPEC_UUID("5CACD637-F82F-491F-947A-5DCA38AA0FEA") WebURLAuthenticationChallengeSender
     : public IWebURLAuthenticationChallengeSender
 {
 public:
-    static WebURLAuthenticationChallengeSender* createInstance(PassRefPtr<WebCore::ResourceHandle>);
+    static WebURLAuthenticationChallengeSender* createInstance(PassRefPtr<WebCore::AuthenticationClient>);
 private:
-    WebURLAuthenticationChallengeSender(PassRefPtr<WebCore::ResourceHandle>);
+    WebURLAuthenticationChallengeSender(PassRefPtr<WebCore::AuthenticationClient>);
     ~WebURLAuthenticationChallengeSender();
 public:
     // IUnknown
@@ -60,12 +60,12 @@ public:
         /* [in] */ IWebURLCredential* credential, 
         /* [in] */ IWebURLAuthenticationChallenge* challenge);
 
-    WebCore::ResourceHandle* resourceHandle() const;
+    WebCore::AuthenticationClient* authenticationClient() const;
 
 private:
     ULONG m_refCount;
 
-    RefPtr<WebCore::ResourceHandle> m_handle;
+    RefPtr<WebCore::AuthenticationClient> m_client;
 };
 
 #endif
diff --git a/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp b/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp
index 21f79e0..f756391 100644
--- a/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp
+++ b/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp
@@ -34,7 +34,7 @@
 #include "WebURLCredential.h"
 
 #pragma warning(push, 0)
-#include <WebCore/ResourceHandle.h>
+#include <WebCore/AuthenticationClient.h>
 #pragma warning(pop)
 
 using namespace WebCore;
@@ -48,7 +48,7 @@ HRESULT STDMETHODCALLTYPE WebURLAuthenticationChallengeSender::cancelAuthenticat
     if (!webChallenge)
         return E_FAIL;
 
-    m_handle->receivedCancellation(webChallenge->authenticationChallenge());
+    m_client->receivedCancellation(webChallenge->authenticationChallenge());
     return S_OK;
 }
 
@@ -59,7 +59,7 @@ HRESULT STDMETHODCALLTYPE WebURLAuthenticationChallengeSender::continueWithoutCr
     if (!webChallenge)
         return E_FAIL;
 
-    m_handle->receivedRequestToContinueWithoutCredential(webChallenge->authenticationChallenge());
+    m_client->receivedRequestToContinueWithoutCredential(webChallenge->authenticationChallenge());
     return S_OK;
 }
 
@@ -75,6 +75,6 @@ HRESULT STDMETHODCALLTYPE WebURLAuthenticationChallengeSender::useCredential(
     if (!credential || FAILED(credential->QueryInterface(__uuidof(WebURLCredential), (void**)&webCredential)))
         return E_FAIL;
 
-    m_handle->receivedCredential(webChallenge->authenticationChallenge(), webCredential->credential());
+    m_client->receivedCredential(webChallenge->authenticationChallenge(), webCredential->credential());
     return S_OK;
 }
diff --git a/WebKit/win/WebView.cpp b/WebKit/win/WebView.cpp
index e2f3fae..d98d390 100644
--- a/WebKit/win/WebView.cpp
+++ b/WebKit/win/WebView.cpp
@@ -31,17 +31,17 @@
 #include "DOMCoreClasses.h"
 #include "MarshallingHelpers.h"
 #include "SoftLinking.h"
+#include "WebBackForwardList.h"
+#include "WebChromeClient.h"
+#include "WebContextMenuClient.h"
+#include "WebCoreTextRenderer.h"
 #include "WebDatabaseManager.h"
 #include "WebDocumentLoader.h"
 #include "WebDownload.h"
+#include "WebDragClient.h"
 #include "WebEditorClient.h"
 #include "WebElementPropertyBag.h"
 #include "WebFrame.h"
-#include "WebBackForwardList.h"
-#include "WebChromeClient.h"
-#include "WebContextMenuClient.h"
-#include "WebCoreTextRenderer.h"
-#include "WebDragClient.h"
 #include "WebIconDatabase.h"
 #include "WebInspector.h"
 #include "WebInspectorClient.h"
@@ -52,6 +52,7 @@
 #include "WebNotificationCenter.h"
 #include "WebPluginHalterClient.h"
 #include "WebPreferences.h"
+#include "WebScriptWorld.h"
 #include "WindowsTouch.h"
 #pragma warning( push, 0 )
 #include <WebCore/ApplicationCacheStorage.h>
@@ -270,7 +271,6 @@ static const int maxToolTipWidth = 250;
 static const int delayBeforeDeletingBackingStoreMsec = 5000;
 
 static ATOM registerWebView();
-static LRESULT CALLBACK WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
 
 static void initializeStaticObservers();
 
@@ -294,34 +294,37 @@ enum {
 bool WebView::s_allowSiteSpecificHacks = false;
 
 WebView::WebView()
-: m_refCount(0)
-, m_hostWindow(0)
-, m_viewWindow(0)
-, m_mainFrame(0)
-, m_page(0)
-, m_hasCustomDropTarget(false)
-, m_useBackForwardList(true)
-, m_userAgentOverridden(false)
-, m_zoomMultiplier(1.0f)
-, m_mouseActivated(false)
-, m_dragData(0)
-, m_currentCharacterCode(0)
-, m_isBeingDestroyed(false)
-, m_paintCount(0)
-, m_hasSpellCheckerDocumentTag(false)
-, m_smartInsertDeleteEnabled(false)
-, m_didClose(false)
-, m_inIMEComposition(0)
-, m_toolTipHwnd(0)
-, m_closeWindowTimer(this, &WebView::closeWindowTimerFired)
-, m_topLevelParent(0)
-, m_deleteBackingStoreTimerActive(false)
-, m_transparent(false)
-, m_selectTrailingWhitespaceEnabled(false)
-, m_lastPanX(0)
-, m_lastPanY(0)
-, m_xOverpan(0)
-, m_yOverpan(0)
+    : m_refCount(0)
+    , m_hostWindow(0)
+    , m_viewWindow(0)
+    , m_mainFrame(0)
+    , m_page(0)
+    , m_hasCustomDropTarget(false)
+    , m_useBackForwardList(true)
+    , m_userAgentOverridden(false)
+    , m_zoomMultiplier(1.0f)
+    , m_mouseActivated(false)
+    , m_dragData(0)
+    , m_currentCharacterCode(0)
+    , m_isBeingDestroyed(false)
+    , m_paintCount(0)
+    , m_hasSpellCheckerDocumentTag(false)
+    , m_smartInsertDeleteEnabled(false)
+    , m_didClose(false)
+    , m_inIMEComposition(0)
+    , m_toolTipHwnd(0)
+    , m_closeWindowTimer(this, &WebView::closeWindowTimerFired)
+    , m_topLevelParent(0)
+    , m_deleteBackingStoreTimerActive(false)
+    , m_transparent(false)
+    , m_selectTrailingWhitespaceEnabled(false)
+    , m_lastPanX(0)
+    , m_lastPanY(0)
+    , m_xOverpan(0)
+    , m_yOverpan(0)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_isAcceleratedCompositing(false)
+#endif
 {
     JSC::initializeThreading();
 
@@ -617,6 +620,10 @@ HRESULT STDMETHODCALLTYPE WebView::close()
 
     m_didClose = true;
 
+#if USE(ACCELERATED_COMPOSITING)
+    setAcceleratedCompositing(false);
+#endif
+
     WebNotificationCenter::defaultCenterInternal()->postNotificationName(_bstr_t(WebViewWillCloseNotification).GetBSTR(), static_cast<IWebView*>(this), 0);
 
     if (m_uiDelegatePrivate)
@@ -676,6 +683,11 @@ HRESULT STDMETHODCALLTYPE WebView::close()
 
 void WebView::repaint(const WebCore::IntRect& windowRect, bool contentChanged, bool immediate, bool repaintContentOnly)
 {
+#if USE(ACCELERATED_COMPOSITING)
+    if (isAcceleratedCompositing())
+        setRootLayerNeedsDisplay();
+#endif
+
     if (!repaintContentOnly) {
         RECT rect = windowRect;
         ::InvalidateRect(m_viewWindow, &rect, false);
@@ -794,7 +806,6 @@ void WebView::scrollBackingStore(FrameView* frameView, int dx, int dy, const Int
     // Clean up.
     ::DeleteDC(bitmapDC);
     ::ReleaseDC(m_viewWindow, windowDC);
-
 }
 
 // This emulates the Mac smarts for painting rects intelligently.  This is very
@@ -927,18 +938,25 @@ void WebView::paint(HDC dc, LPARAM options)
     // Update our backing store if needed.
     updateBackingStore(frameView, bitmapDC, backingStoreCompletelyDirty, windowsToPaint);
 
-    // Now we blit the updated backing store
-    IntRect windowDirtyRect = rcPaint;
-    
-    // Apply the same heuristic for this update region too.
-    Vector<IntRect> blitRects;
-    if (region && regionType == COMPLEXREGION)
-        getUpdateRects(region.get(), windowDirtyRect, blitRects);
-    else
-        blitRects.append(windowDirtyRect);
+#if USE(ACCELERATED_COMPOSITING)
+    if (!isAcceleratedCompositing()) {
+#endif
+        // Now we blit the updated backing store
+        IntRect windowDirtyRect = rcPaint;
+        
+        // Apply the same heuristic for this update region too.
+        Vector<IntRect> blitRects;
+        if (region && regionType == COMPLEXREGION)
+            getUpdateRects(region.get(), windowDirtyRect, blitRects);
+        else
+            blitRects.append(windowDirtyRect);
 
-    for (unsigned i = 0; i < blitRects.size(); ++i)
-        paintIntoWindow(bitmapDC, hdc, blitRects[i]);
+        for (unsigned i = 0; i < blitRects.size(); ++i)
+            paintIntoWindow(bitmapDC, hdc, blitRects[i]);
+#if USE(ACCELERATED_COMPOSITING)
+    } else
+        updateRootLayerContents();
+#endif
 
     ::DeleteDC(bitmapDC);
 
@@ -1805,7 +1823,7 @@ bool WebView::keyPress(WPARAM charCode, LPARAM keyData, bool systemKeyDown)
     return frame->eventHandler()->keyEvent(keyEvent);
 }
 
-static bool registerWebViewWindowClass()
+bool WebView::registerWebViewWindowClass()
 {
     static bool haveRegisteredWindowClass = false;
     if (haveRegisteredWindowClass)
@@ -1849,7 +1867,7 @@ static HWND findTopLevelParent(HWND window)
     return 0;
 }
 
-static LRESULT CALLBACK WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+LRESULT CALLBACK WebView::WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
     LRESULT lResult = 0;
     LONG_PTR longPtr = GetWindowLongPtr(hWnd, 0);
@@ -1941,22 +1959,31 @@ static LRESULT CALLBACK WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, L
 
             if (lParam != 0) {
                 webView->deleteBackingStore();
+#if USE(ACCELERATED_COMPOSITING)
+                if (webView->isAcceleratedCompositing())
+                    webView->resizeLayerRenderer();
+#endif
                 if (Frame* coreFrame = core(mainFrameImpl))
                     coreFrame->view()->resize(LOWORD(lParam), HIWORD(lParam));
             }
             break;
         case WM_SHOWWINDOW:
             lResult = DefWindowProc(hWnd, message, wParam, lParam);
-            if (wParam == 0)
+            if (wParam == 0) {
                 // The window is being hidden (e.g., because we switched tabs).
                 // Null out our backing store.
                 webView->deleteBackingStore();
+            }
+#if USE(ACCELERATED_COMPOSITING)
+            else if (webView->isAcceleratedCompositing())
+                webView->layerRendererBecameVisible();
+#endif
             break;
         case WM_SETFOCUS: {
             COMPtr<IWebUIDelegate> uiDelegate;
             COMPtr<IWebUIDelegatePrivate> uiDelegatePrivate;
-            if (SUCCEEDED(webView->uiDelegate(&uiDelegate)) && uiDelegate &&
-                SUCCEEDED(uiDelegate->QueryInterface(IID_IWebUIDelegatePrivate, (void**) &uiDelegatePrivate)) && uiDelegatePrivate)
+            if (SUCCEEDED(webView->uiDelegate(&uiDelegate)) && uiDelegate
+                && SUCCEEDED(uiDelegate->QueryInterface(IID_IWebUIDelegatePrivate, (void**) &uiDelegatePrivate)) && uiDelegatePrivate)
                 uiDelegatePrivate->webViewReceivedFocus(webView);
 
             FocusController* focusController = webView->page()->focusController();
@@ -1975,8 +2002,8 @@ static LRESULT CALLBACK WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, L
             COMPtr<IWebUIDelegate> uiDelegate;
             COMPtr<IWebUIDelegatePrivate> uiDelegatePrivate;
             HWND newFocusWnd = reinterpret_cast<HWND>(wParam);
-            if (SUCCEEDED(webView->uiDelegate(&uiDelegate)) && uiDelegate &&
-                SUCCEEDED(uiDelegate->QueryInterface(IID_IWebUIDelegatePrivate, (void**) &uiDelegatePrivate)) && uiDelegatePrivate)
+            if (SUCCEEDED(webView->uiDelegate(&uiDelegate)) && uiDelegate
+                && SUCCEEDED(uiDelegate->QueryInterface(IID_IWebUIDelegatePrivate, (void**) &uiDelegatePrivate)) && uiDelegatePrivate)
                 uiDelegatePrivate->webViewLostFocus(webView, (OLE_HANDLE)(ULONG64)newFocusWnd);
 
             FocusController* focusController = webView->page()->focusController();
@@ -2040,7 +2067,11 @@ static LRESULT CALLBACK WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, L
                 RECT windowRect;
                 ::GetClientRect(hWnd, &windowRect);
                 ::InvalidateRect(hWnd, &windowRect, false);
-            }
+#if USE(ACCELERATED_COMPOSITING)
+                if (webView->isAcceleratedCompositing())
+                    webView->setRootLayerNeedsDisplay();
+#endif
+           }
             break;
         case WM_MOUSEACTIVATE:
             webView->setMouseActivated(true);
@@ -2055,9 +2086,9 @@ static LRESULT CALLBACK WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, L
                 if (lpMsg->message == WM_KEYDOWN)
                     keyCode = (UINT) lpMsg->wParam;
             }
-            if (SUCCEEDED(webView->uiDelegate(&uiDelegate)) && uiDelegate &&
-                SUCCEEDED(uiDelegate->QueryInterface(IID_IWebUIDelegatePrivate, (void**) &uiDelegatePrivate)) && uiDelegatePrivate &&
-                SUCCEEDED(uiDelegatePrivate->webViewGetDlgCode(webView, keyCode, &dlgCode)))
+            if (SUCCEEDED(webView->uiDelegate(&uiDelegate)) && uiDelegate
+                && SUCCEEDED(uiDelegate->QueryInterface(IID_IWebUIDelegatePrivate, (void**) &uiDelegatePrivate)) && uiDelegatePrivate
+                && SUCCEEDED(uiDelegatePrivate->webViewGetDlgCode(webView, keyCode, &dlgCode)))
                 return dlgCode;
             handled = false;
             break;
@@ -2876,7 +2907,8 @@ HRESULT STDMETHODCALLTYPE WebView::stringByEvaluatingJavaScriptFromString(
         return E_FAIL;
     else if (scriptExecutionResult.isString()) {
         JSLock lock(JSC::SilenceAssertionsOnly);
-        *result = BString(String(scriptExecutionResult.getString()));
+        JSC::ExecState* exec = coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec();
+        *result = BString(String(scriptExecutionResult.getString(exec)));
     }
 
     return S_OK;
@@ -5469,6 +5501,16 @@ HRESULT WebView::setCanStartPlugins(BOOL canStartPlugins)
     return S_OK;
 }
 
+static String toString(BSTR bstr)
+{
+    return String(bstr, SysStringLen(bstr));
+}
+
+static KURL toKURL(BSTR bstr)
+{
+    return KURL(KURL(), toString(bstr));
+}
+
 static PassOwnPtr<Vector<String> > toStringVector(unsigned patternsCount, BSTR* patterns)
 {
     // Convert the patterns into a Vector.
@@ -5476,17 +5518,21 @@ static PassOwnPtr<Vector<String> > toStringVector(unsigned patternsCount, BSTR*
         return 0;
     Vector<String>* patternsVector = new Vector<String>;
     for (unsigned i = 0; i < patternsCount; ++i)
-        patternsVector->append(String(patterns[i], SysStringLen(patterns[i])));
+        patternsVector->append(toString(patterns[i]));
     return patternsVector;
 }
 
-HRESULT WebView::addUserScriptToGroup(BSTR groupName, unsigned worldID, BSTR source, BSTR url, 
+HRESULT WebView::addUserScriptToGroup(BSTR groupName, IWebScriptWorld* iWorld, BSTR source, BSTR url, 
                                       unsigned whitelistCount, BSTR* whitelist,
                                       unsigned blacklistCount, BSTR* blacklist,
                                       WebUserScriptInjectionTime injectionTime)
 {
-    String group(groupName, SysStringLen(groupName));
-    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+    COMPtr<WebScriptWorld> world(Query, iWorld);
+    if (!world)
+        return E_POINTER;
+
+    String group = toString(groupName);
+    if (group.isEmpty())
         return E_INVALIDARG;
 
     PageGroup* pageGroup = PageGroup::pageGroup(group);
@@ -5494,19 +5540,23 @@ HRESULT WebView::addUserScriptToGroup(BSTR groupName, unsigned worldID, BSTR sou
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->addUserScriptToWorld(worldID, String(source, SysStringLen(source)), KURL(KURL(), String(url, SysStringLen(url))),
+    pageGroup->addUserScriptToWorld(world->world(), toString(source), toKURL(url),
                                     toStringVector(whitelistCount, whitelist), toStringVector(blacklistCount, blacklist),
                                     injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
 
     return S_OK;
 }
 
-HRESULT WebView::addUserStyleSheetToGroup(BSTR groupName, unsigned worldID, BSTR source, BSTR url,
+HRESULT WebView::addUserStyleSheetToGroup(BSTR groupName, IWebScriptWorld* iWorld, BSTR source, BSTR url,
                                           unsigned whitelistCount, BSTR* whitelist,
                                           unsigned blacklistCount, BSTR* blacklist)
 {
-    String group(groupName, SysStringLen(groupName));
-    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+    COMPtr<WebScriptWorld> world(Query, iWorld);
+    if (!world)
+        return E_POINTER;
+
+    String group = toString(groupName);
+    if (group.isEmpty())
         return E_INVALIDARG;
 
     PageGroup* pageGroup = PageGroup::pageGroup(group);
@@ -5514,16 +5564,20 @@ HRESULT WebView::addUserStyleSheetToGroup(BSTR groupName, unsigned worldID, BSTR
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->addUserStyleSheetToWorld(worldID, String(source, SysStringLen(source)), KURL(KURL(), String(url, SysStringLen(url))),
+    pageGroup->addUserStyleSheetToWorld(world->world(), toString(source), toKURL(url),
                                         toStringVector(whitelistCount, whitelist), toStringVector(blacklistCount, blacklist));
 
     return S_OK;
 }
 
-HRESULT WebView::removeUserScriptFromGroup(BSTR groupName, unsigned worldID, BSTR url)
+HRESULT WebView::removeUserScriptFromGroup(BSTR groupName, IWebScriptWorld* iWorld, BSTR url)
 {
-    String group(groupName, SysStringLen(groupName));
-    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+    COMPtr<WebScriptWorld> world(Query, iWorld);
+    if (!world)
+        return E_POINTER;
+
+    String group = toString(groupName);
+    if (group.isEmpty())
         return E_INVALIDARG;
 
     PageGroup* pageGroup = PageGroup::pageGroup(group);
@@ -5531,15 +5585,19 @@ HRESULT WebView::removeUserScriptFromGroup(BSTR groupName, unsigned worldID, BST
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->removeUserScriptFromWorld(worldID, KURL(KURL(), String(url, SysStringLen(url))));
+    pageGroup->removeUserScriptFromWorld(world->world(), toKURL(url));
 
     return S_OK;
 }
 
-HRESULT WebView::removeUserStyleSheetFromGroup(BSTR groupName, unsigned worldID, BSTR url)
+HRESULT WebView::removeUserStyleSheetFromGroup(BSTR groupName, IWebScriptWorld* iWorld, BSTR url)
 {
-    String group(groupName, SysStringLen(groupName));
-    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+    COMPtr<WebScriptWorld> world(Query, iWorld);
+    if (!world)
+        return E_POINTER;
+
+    String group = toString(groupName);
+    if (group.isEmpty())
         return E_INVALIDARG;
 
     PageGroup* pageGroup = PageGroup::pageGroup(group);
@@ -5547,15 +5605,19 @@ HRESULT WebView::removeUserStyleSheetFromGroup(BSTR groupName, unsigned worldID,
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->removeUserStyleSheetFromWorld(worldID, KURL(KURL(), String(url, SysStringLen(url))));
+    pageGroup->removeUserStyleSheetFromWorld(world->world(), toKURL(url));
 
     return S_OK;
 }
 
-HRESULT WebView::removeUserScriptsFromGroup(BSTR groupName, unsigned worldID)
+HRESULT WebView::removeUserScriptsFromGroup(BSTR groupName, IWebScriptWorld* iWorld)
 {
-    String group(groupName, SysStringLen(groupName));
-    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+    COMPtr<WebScriptWorld> world(Query, iWorld);
+    if (!world)
+        return E_POINTER;
+
+    String group = toString(groupName);
+    if (group.isEmpty())
         return E_INVALIDARG;
 
     PageGroup* pageGroup = PageGroup::pageGroup(group);
@@ -5563,14 +5625,18 @@ HRESULT WebView::removeUserScriptsFromGroup(BSTR groupName, unsigned worldID)
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->removeUserScriptsFromWorld(worldID);
+    pageGroup->removeUserScriptsFromWorld(world->world());
     return S_OK;
 }
 
-HRESULT WebView::removeUserStyleSheetsFromGroup(BSTR groupName, unsigned worldID)
+HRESULT WebView::removeUserStyleSheetsFromGroup(BSTR groupName, IWebScriptWorld* iWorld)
 {
-    String group(groupName, SysStringLen(groupName));
-    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+    COMPtr<WebScriptWorld> world(Query, iWorld);
+    if (!world)
+        return E_POINTER;
+
+    String group = toString(groupName);
+    if (group.isEmpty())
         return E_INVALIDARG;
 
     PageGroup* pageGroup = PageGroup::pageGroup(group);
@@ -5578,13 +5644,13 @@ HRESULT WebView::removeUserStyleSheetsFromGroup(BSTR groupName, unsigned worldID
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->removeUserStyleSheetsFromWorld(worldID);
+    pageGroup->removeUserStyleSheetsFromWorld(world->world());
     return S_OK;
 }
 
 HRESULT WebView::removeAllUserContentFromGroup(BSTR groupName)
 {
-    String group(groupName, SysStringLen(groupName));
+    String group = toString(groupName);
     if (group.isEmpty())
         return E_INVALIDARG;
 
@@ -5663,6 +5729,70 @@ void WebView::downloadURL(const KURL& url)
     download->start();
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+void WebView::setRootChildLayer(WebCore::PlatformLayer* layer)
+{
+    setAcceleratedCompositing(layer ? true : false);
+    if (m_layerRenderer)
+        m_layerRenderer->setRootChildLayer(layer);
+}
+
+void WebView::setAcceleratedCompositing(bool accelerated)
+{
+    if (m_isAcceleratedCompositing == accelerated || !WKCACFLayerRenderer::acceleratedCompositingAvailable())
+        return;
+
+    if (accelerated) {
+        m_layerRenderer = WKCACFLayerRenderer::create();
+        if (m_layerRenderer) {
+            m_isAcceleratedCompositing = true;
+
+            // Create the root layer
+            ASSERT(m_viewWindow);
+            m_layerRenderer->setHostWindow(m_viewWindow);
+            updateRootLayerContents();
+        }
+    } else {
+        m_layerRenderer = 0;
+        m_isAcceleratedCompositing = false;
+    }
+}
+
+void WebView::updateRootLayerContents()
+{
+    if (!m_backingStoreBitmap || !m_layerRenderer)
+        return;
+
+    // Get the backing store into a CGImage
+    BITMAP bitmap;
+    GetObject(m_backingStoreBitmap.get(), sizeof(bitmap), &bitmap);
+    int bmSize = bitmap.bmWidthBytes * bitmap.bmHeight;
+    RetainPtr<CFDataRef> data(AdoptCF, 
+                                CFDataCreateWithBytesNoCopy(
+                                        0, static_cast<UInt8*>(bitmap.bmBits),
+                                        bmSize, kCFAllocatorNull));
+    RetainPtr<CGDataProviderRef> cgData(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
+    RetainPtr<CGColorSpaceRef> space(AdoptCF, CGColorSpaceCreateDeviceRGB());
+    RetainPtr<CGImageRef> backingStoreImage(AdoptCF, CGImageCreate(bitmap.bmWidth, bitmap.bmHeight,
+                                     8, bitmap.bmBitsPixel, 
+                                     bitmap.bmWidthBytes, space.get(), 
+                                     kCGBitmapByteOrder32Little | kCGImageAlphaNoneSkipFirst,
+                                     cgData.get(), 0, false, 
+                                     kCGRenderingIntentDefault));
+
+    // Hand the CGImage to CACF for compositing
+    m_layerRenderer->setRootContents(backingStoreImage.get());
+
+    // Set the frame and scroll position
+    Frame* coreFrame = core(m_mainFrame);
+    if (!coreFrame)
+        return;
+    FrameView* frameView = coreFrame->view();
+
+    m_layerRenderer->setScrollFrame(frameView->layoutWidth(), frameView->layoutHeight(), 
+                                 frameView->scrollX(), frameView->scrollY());
+}
+#endif
 
 HRESULT STDMETHODCALLTYPE WebView::setPluginHalterDelegate(IWebPluginHalterDelegate* d)
 {
diff --git a/WebKit/win/WebView.h b/WebKit/win/WebView.h
index b4c1239..4bdc98f 100644
--- a/WebKit/win/WebView.h
+++ b/WebKit/win/WebView.h
@@ -34,6 +34,8 @@
 #include <WebCore/IntRect.h>
 #include <WebCore/Timer.h>
 #include <WebCore/WindowMessageListener.h>
+#include <WebCore/WKCACFLayer.h>
+#include <WebCore/WKCACFLayerRenderer.h>
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 
@@ -740,17 +742,17 @@ public:
     virtual HRESULT STDMETHODCALLTYPE setCanStartPlugins(
         /* [in] */ BOOL canStartPlugins);
 
-    virtual HRESULT STDMETHODCALLTYPE addUserScriptToGroup(BSTR groupName, unsigned worldID, BSTR source, BSTR url,
+    virtual HRESULT STDMETHODCALLTYPE addUserScriptToGroup(BSTR groupName, IWebScriptWorld*, BSTR source, BSTR url,
                                                            unsigned whitelistCount, BSTR* whitelist, 
                                                            unsigned blacklistCount, BSTR* blacklist,
                                                            WebUserScriptInjectionTime);
-    virtual HRESULT STDMETHODCALLTYPE addUserStyleSheetToGroup(BSTR groupName, unsigned worldID, BSTR source, BSTR url,
+    virtual HRESULT STDMETHODCALLTYPE addUserStyleSheetToGroup(BSTR groupName, IWebScriptWorld*, BSTR source, BSTR url,
                                                                unsigned whitelistCount, BSTR* whitelist, 
                                                                unsigned blacklistCount, BSTR* blacklist);
-    virtual HRESULT STDMETHODCALLTYPE removeUserScriptFromGroup(BSTR groupName, unsigned worldID, BSTR url);
-    virtual HRESULT STDMETHODCALLTYPE removeUserStyleSheetFromGroup(BSTR groupName, unsigned worldID, BSTR url);
-    virtual HRESULT STDMETHODCALLTYPE removeUserScriptsFromGroup(BSTR groupName, unsigned worldID);
-    virtual HRESULT STDMETHODCALLTYPE removeUserStyleSheetsFromGroup(BSTR groupName, unsigned worldID);
+    virtual HRESULT STDMETHODCALLTYPE removeUserScriptFromGroup(BSTR groupName, IWebScriptWorld*, BSTR url);
+    virtual HRESULT STDMETHODCALLTYPE removeUserStyleSheetFromGroup(BSTR groupName, IWebScriptWorld*, BSTR url);
+    virtual HRESULT STDMETHODCALLTYPE removeUserScriptsFromGroup(BSTR groupName, IWebScriptWorld*);
+    virtual HRESULT STDMETHODCALLTYPE removeUserStyleSheetsFromGroup(BSTR groupName, IWebScriptWorld*);
     virtual HRESULT STDMETHODCALLTYPE removeAllUserContentFromGroup(BSTR groupName);
 
     virtual HRESULT STDMETHODCALLTYPE setPluginHalterDelegate(IWebPluginHalterDelegate*);
@@ -861,6 +863,11 @@ public:
 
     void downloadURL(const WebCore::KURL&);
 
+#if USE(ACCELERATED_COMPOSITING)
+    void setRootLayerNeedsDisplay() { if (m_layerRenderer) m_layerRenderer->setNeedsDisplay(); }
+    void setRootChildLayer(WebCore::PlatformLayer* layer);
+#endif
+
 private:
     void setZoomMultiplier(float multiplier, bool isTextOnly);
     float zoomMultiplier(bool isTextOnly);
@@ -885,6 +892,9 @@ private:
     DWORD m_lastDropEffect;
 
 protected:
+    static bool registerWebViewWindowClass();
+    static LRESULT CALLBACK WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
+
     HIMC getIMMContext();
     void releaseIMMContext(HIMC);
     static bool allowSiteSpecificHacks() { return s_allowSiteSpecificHacks; } 
@@ -970,6 +980,17 @@ protected:
     long m_lastPanY;
     long m_xOverpan;
     long m_yOverpan;
+
+#if USE(ACCELERATED_COMPOSITING)
+    bool isAcceleratedCompositing() const { return m_isAcceleratedCompositing; }
+    void setAcceleratedCompositing(bool);
+    void updateRootLayerContents();
+    void resizeLayerRenderer() { m_layerRenderer->resize(); }
+    void layerRendererBecameVisible() { m_layerRenderer->createRenderer(); }
+
+    OwnPtr<WebCore::WKCACFLayerRenderer> m_layerRenderer;
+    bool m_isAcceleratedCompositing;
+#endif
 };
 
 #endif
diff --git a/WebKit/wx/ChangeLog b/WebKit/wx/ChangeLog
index f2cc27f..e6ed389 100644
--- a/WebKit/wx/ChangeLog
+++ b/WebKit/wx/ChangeLog
@@ -1,3 +1,155 @@
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::createPlugin):
+        (WebCore::FrameLoaderClientWx::redirectDataToPlugin):
+        * WebView.cpp:
+        (wxWebView::Create):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::dispatchDidPushStateWithinPage):
+        (WebCore::FrameLoaderClientWx::dispatchDidReplaceStateWithinPage):
+        (WebCore::FrameLoaderClientWx::dispatchDidPopStateWithinPage):
+        * WebKitSupport/FrameLoaderClientWx.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        * WebKitSupport/InspectorClientWx.cpp:
+        (WebCore::InspectorClientWx::populateSetting):
+        (WebCore::InspectorClientWx::storeSetting):
+        * WebKitSupport/InspectorClientWx.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::dispatchDidAddBackForwardItem): Add an empty implementation. Method added to FrameLoaderClient by Android (see bug).
+        (WebCore::FrameLoaderClientWx::dispatchDidRemoveBackForwardItem): ditto.
+        (WebCore::FrameLoaderClientWx::dispatchDidChangeBackForwardIndex): ditto.
+        * WebKitSupport/FrameLoaderClientWx.h:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        * WebKitSupport/DragClientWx.cpp:
+
+2009-11-18  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Enable wx plugin support using the Windows implementation as a base.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31636
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::FrameLoaderClientWx):
+        (WebCore::FrameLoaderClientWx::finishedLoading):
+        (WebCore::FrameLoaderClientWx::committedLoad):
+        (WebCore::FrameLoaderClientWx::createPlugin):
+        (WebCore::FrameLoaderClientWx::redirectDataToPlugin):
+        (WebCore::FrameLoaderClientWx::shouldUsePluginDocument):
+        * WebKitSupport/FrameLoaderClientWx.h:
+        * WebView.cpp:
+        (wxWebView::Create):
+
+2009-11-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after r50923 change to externalRepresentation.
+
+        * WebFrame.cpp:
+        (wxWebFrame::GetExternalRepresentation):
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Update for changes to FrameLoaderClient
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Reviewed by Dave Hyatt.
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::dispatchDidClearWindowObjectInWorld):
+        * WebKitSupport/FrameLoaderClientWx.h:
+        Replaced windowObjectCleared with this function. Does nothing if the
+        passed-in world is not the mainThreadNormalWorld().
+
+2009-11-10  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add sanity checks to RunScript to ensure it doesn't run when the document hasn't yet
+        loaded nor when JavaScript is disabled.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31309
+
+        * WebFrame.cpp:
+        (wxWebFrame::RunScript):
+
+2009-11-04  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Fix an assert on shutdown when wxWebView has captured the mouse,
+        and make sure wxWebView's right click handling is only active when 
+        the WebCore popup menu is used.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31131
+
+        * WebView.cpp:
+        (wxWebView::~wxWebView):
+        (wxWebView::OnContextMenuEvents):
+        (wxWebView::OnMenuSelectEvents):
+
+2009-11-04  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Eric Seidel.
+
+        [wx] Small cleanup: avoid unnecessary wxString::mb_str() calls.
+
+        * WebFrame.cpp:
+        (wxWebFrame::SetPageSource):
+        (wxWebFrame::LoadURL):
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        Added stub implementation for new ChromeClient function.
+
+        * WebKitSupport/ChromeClientWx.cpp:
+        (WebCore::ChromeClientWx::focusedNodeChanged):
+        * WebKitSupport/ChromeClientWx.h:
+
 2009-10-23  Kevin Ollivier  <kevino@theolliviers.com>
 
         wx build fix. Update the globalObject calls after changes.
diff --git a/WebKit/wx/WebFrame.cpp b/WebKit/wx/WebFrame.cpp
index 9018d37..bd983f6 100644
--- a/WebKit/wx/WebFrame.cpp
+++ b/WebKit/wx/WebFrame.cpp
@@ -146,9 +146,9 @@ wxString wxWebFrame::GetPageSource()
 void wxWebFrame::SetPageSource(const wxString& source, const wxString& baseUrl)
 {
     if (m_impl->frame && m_impl->frame->loader()) {
-        WebCore::KURL url(WebCore::KURL(), static_cast<const char*>(baseUrl.mb_str(wxConvUTF8)));
+        WebCore::KURL url(WebCore::KURL(), baseUrl);
 
-        wxCharBuffer charBuffer(source.mb_str(wxConvUTF8));
+        const wxCharBuffer charBuffer(source.utf8_str());
         const char* contents = charBuffer;
 
         WTF::PassRefPtr<WebCore::SharedBuffer> sharedBuffer = WebCore::SharedBuffer::create(contents, strlen(contents));
@@ -181,16 +181,25 @@ wxString wxWebFrame::GetExternalRepresentation()
     if (m_impl->frame->view() && m_impl->frame->view()->layoutPending())
         m_impl->frame->view()->layout();
 
-    return externalRepresentation(m_impl->frame->contentRenderer());
+    return externalRepresentation(m_impl->frame);
 }
 
 wxString wxWebFrame::RunScript(const wxString& javascript)
 {
     wxString returnValue = wxEmptyString;
-    if (m_impl->frame) {
-        JSC::JSValue result = m_impl->frame->script()->executeScript(javascript, true).jsValue();
-        if (result)
-            returnValue = wxString(result.toString(m_impl->frame->script()->globalObject(WebCore::mainThreadNormalWorld())->globalExec()).UTF8String().c_str(), wxConvUTF8);        
+    if (m_impl->frame && m_impl->frame->loader()) {
+        bool hasLoaded = m_impl->frame->loader()->frameHasLoaded();
+        wxASSERT_MSG(hasLoaded, wxT("Document must be loaded before calling RunScript."));
+        if (hasLoaded) {
+            WebCore::ScriptController* controller = m_impl->frame->script();
+            bool jsEnabled = controller->isEnabled(); 
+            wxASSERT_MSG(jsEnabled, wxT("RunScript requires JavaScript to be enabled."));
+            if (jsEnabled) {
+                JSC::JSValue result = controller->executeScript(javascript, true).jsValue();
+                if (result)
+                    returnValue = wxString(result.toString(m_impl->frame->script()->globalObject(WebCore::mainThreadNormalWorld())->globalExec()).UTF8String().c_str(), wxConvUTF8);        
+            }
+        }
     }
     return returnValue;
 }
@@ -206,7 +215,7 @@ bool wxWebFrame::FindString(const wxString& string, bool forward, bool caseSensi
 void wxWebFrame::LoadURL(const wxString& url)
 {
     if (m_impl->frame && m_impl->frame->loader()) {
-        WebCore::KURL kurl = WebCore::KURL(WebCore::KURL(), static_cast<const char*>(url.mb_str(wxConvUTF8)), WebCore::UTF8Encoding());
+        WebCore::KURL kurl = WebCore::KURL(WebCore::KURL(), url, WebCore::UTF8Encoding());
         // NB: This is an ugly fix, but CURL won't load sub-resources if the
         // protocol is omitted; sadly, it will not emit an error, either, so
         // there's no way for us to catch this problem the correct way yet.
diff --git a/WebKit/wx/WebKitSupport/ChromeClientWx.cpp b/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
index 629463f..17f6f43 100644
--- a/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
@@ -111,6 +111,9 @@ void ChromeClientWx::takeFocus(FocusDirection)
     notImplemented();
 }
 
+void ChromeClientWx::focusedNodeChanged(Node*)
+{
+}
 
 Page* ChromeClientWx::createWindow(Frame*, const FrameLoadRequest& request, const WindowFeatures&)
 {
diff --git a/WebKit/wx/WebKitSupport/ChromeClientWx.h b/WebKit/wx/WebKitSupport/ChromeClientWx.h
index 07f70a8..bd4f1ec 100644
--- a/WebKit/wx/WebKitSupport/ChromeClientWx.h
+++ b/WebKit/wx/WebKitSupport/ChromeClientWx.h
@@ -54,6 +54,8 @@ public:
     virtual bool canTakeFocus(FocusDirection);
     virtual void takeFocus(FocusDirection);
 
+    virtual void focusedNodeChanged(Node*);
+
     virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&);
     virtual Page* createModalDialog(Frame*, const FrameLoadRequest&);
     virtual void show();
diff --git a/WebKit/wx/WebKitSupport/DragClientWx.cpp b/WebKit/wx/WebKitSupport/DragClientWx.cpp
index dcccc34..fb6905b 100644
--- a/WebKit/wx/WebKitSupport/DragClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/DragClientWx.cpp
@@ -23,7 +23,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "DragClientWx.h"
+
 #include "NotImplemented.h"
 
 #include <stdio.h>
diff --git a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
index 568cf42..fbb4ec3 100644
--- a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
@@ -37,11 +37,13 @@
 #include "FrameLoaderTypes.h"
 #include "FrameView.h"
 #include "FrameTree.h"
+#include "PluginView.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameOwnerElement.h"
 #include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformString.h"
+#include "PluginView.h"
 #include "ProgressTracker.h"
 #include "RenderPart.h"
 #include "ResourceError.h"
@@ -80,7 +82,10 @@ inline int wxNavTypeFromWebNavType(NavigationType type){
 }
 
 FrameLoaderClientWx::FrameLoaderClientWx()
-    : m_webFrame(0)
+    : m_frame(0)
+    , m_pluginView(0)
+    , m_hasSentResponseToPlugin(false)
+    , m_webFrame(0)
 {
 }
 
@@ -257,6 +262,20 @@ void FrameLoaderClientWx::dispatchDidChangeLocationWithinPage()
     notImplemented();
 }
 
+void FrameLoaderClientWx::dispatchDidPushStateWithinPage()
+{
+    notImplemented();
+}
+
+void FrameLoaderClientWx::dispatchDidReplaceStateWithinPage()
+{
+    notImplemented();
+}
+
+void FrameLoaderClientWx::dispatchDidPopStateWithinPage()
+{
+    notImplemented();
+}
 
 void FrameLoaderClientWx::dispatchWillClose()
 {
@@ -408,7 +427,11 @@ void FrameLoaderClientWx::didChangeTitle(DocumentLoader *l)
 
 void FrameLoaderClientWx::finishedLoading(DocumentLoader*)
 {
-    notImplemented();
+    if (m_pluginView) {
+        m_pluginView->didFinishLoading();
+        m_pluginView = 0;
+        m_hasSentResponseToPlugin = false;
+    }
 }
 
 
@@ -579,9 +602,25 @@ void FrameLoaderClientWx::committedLoad(WebCore::DocumentLoader* loader, const c
 {
     if (!m_webFrame)
         return;
-    FrameLoader* fl = loader->frameLoader();
-    fl->setEncoding(m_response.textEncodingName(), false);
-    fl->addData(data, length);
+    if (!m_pluginView) {
+        FrameLoader* fl = loader->frameLoader();
+        fl->setEncoding(m_response.textEncodingName(), false);
+        fl->addData(data, length);
+    }
+    
+    // We re-check here as the plugin can have been created
+    if (m_pluginView) {
+        if (!m_hasSentResponseToPlugin) {
+            m_pluginView->didReceiveResponse(loader->response());
+            // didReceiveResponse sets up a new stream to the plug-in. on a full-page plug-in, a failure in
+            // setting up this stream can cause the main document load to be cancelled, setting m_pluginView
+            // to null
+            if (!m_pluginView)
+                return;
+            m_hasSentResponseToPlugin = true;
+        }
+        m_pluginView->didReceiveData(data, length);
+    }
 }
 
 WebCore::ResourceError FrameLoaderClientWx::cancelledError(const WebCore::ResourceRequest& request)
@@ -812,16 +851,21 @@ ObjectContentType FrameLoaderClientWx::objectContentType(const KURL& url, const
     return ObjectContentType();
 }
 
-PassRefPtr<Widget> FrameLoaderClientWx::createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool loadManually)
+PassRefPtr<Widget> FrameLoaderClientWx::createPlugin(const IntSize& size, HTMLPlugInElement* element, const KURL& url, const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually)
 {
-    notImplemented();
+#if __WXMSW__ || __WXMAC__
+    RefPtr<PluginView> pv = PluginView::create(m_frame, size, element, url, paramNames, paramValues, mimeType, loadManually);
+    if (pv->status() == PluginStatusLoadedSuccessfully)
+        return pv;
+#endif
     return 0;
 }
 
 void FrameLoaderClientWx::redirectDataToPlugin(Widget* pluginWidget)
 {
-    notImplemented();
-    return;
+    ASSERT(!m_pluginView);
+    m_pluginView = static_cast<PluginView*>(pluginWidget);
+    m_hasSentResponseToPlugin = false;
 }
 
 ResourceError FrameLoaderClientWx::pluginWillHandleLoadError(const ResourceResponse& response)
@@ -843,8 +887,11 @@ String FrameLoaderClientWx::overrideMediaType() const
     return String();
 }
 
-void FrameLoaderClientWx::windowObjectCleared()
+void FrameLoaderClientWx::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 {
+    if (world != mainThreadNormalWorld())
+        return;
+
     if (m_webView) {
         wxWebViewWindowObjectClearedEvent wkEvent(m_webView);
         Frame* coreFrame = m_webView->GetMainFrame()->GetFrame();
@@ -897,4 +944,11 @@ void FrameLoaderClientWx::transitionToCommittedForNewPage()
         m_frame->createView(size, backgroundColor, transparent, IntSize(), false); 
 }
 
+bool FrameLoaderClientWx::shouldUsePluginDocument(const String &mimeType) const
+{
+    // NOTE: Plugin Documents are used for viewing PDFs, etc. inline, and should
+    // not be used for pages with plugins in them.
+    return false;
+}
+
 }
diff --git a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
index ed11974..0c29941 100644
--- a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
+++ b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
@@ -31,7 +31,9 @@
 #include "FrameLoaderClient.h"
 #include "FrameLoader.h"
 #include "KURL.h"
+#include "PluginView.h"
 #include "ResourceResponse.h"
+#include "HTMLPlugInElement.h"
 
 class wxWebFrame;
 class wxWebView;
@@ -94,6 +96,9 @@ namespace WebCore {
         virtual void dispatchDidCancelClientRedirect();
         virtual void dispatchWillPerformClientRedirect(const KURL&, double interval, double fireDate);
         virtual void dispatchDidChangeLocationWithinPage();
+        virtual void dispatchDidPushStateWithinPage();
+        virtual void dispatchDidReplaceStateWithinPage();
+        virtual void dispatchDidPopStateWithinPage();
         virtual void dispatchWillClose();
         virtual void dispatchDidReceiveIcon();
         virtual void dispatchDidStartProvisionalLoad();
@@ -205,17 +210,21 @@ namespace WebCore {
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType);
         virtual String overrideMediaType() const;
 
-        virtual void windowObjectCleared();
+        virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
         virtual void documentElementAvailable();
         
         virtual void didPerformFirstNavigation() const;
         
         virtual void registerForIconNotification(bool listen = true);
+        
+        virtual bool shouldUsePluginDocument(const String &mimeType) const;
 
     private:
         wxWebFrame *m_webFrame;
         Frame* m_frame;
         wxWebView *m_webView;
+        PluginView* m_pluginView;
+        bool m_hasSentResponseToPlugin;
         ResourceResponse m_response;
         bool m_firstData;
     };
diff --git a/WebKit/wx/WebKitSupport/InspectorClientWx.cpp b/WebKit/wx/WebKitSupport/InspectorClientWx.cpp
index d55ad04..ff21ae0 100644
--- a/WebKit/wx/WebKitSupport/InspectorClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/InspectorClientWx.cpp
@@ -105,17 +105,12 @@ void InspectorClientWx::inspectedURLChanged(const String& newURL)
     notImplemented();
 }
 
-void InspectorClientWx::populateSetting(const String& key, InspectorController::Setting& setting)
+void InspectorClientWx::populateSetting(const String& key, String* setting)
 {
     notImplemented();
 }
 
-void InspectorClientWx::storeSetting(const String& key, const InspectorController::Setting& setting)
-{
-    notImplemented();
-}
-
-void InspectorClientWx::removeSetting(const String& key)
+void InspectorClientWx::storeSetting(const String& key, const String& setting)
 {
     notImplemented();
 }
diff --git a/WebKit/wx/WebKitSupport/InspectorClientWx.h b/WebKit/wx/WebKitSupport/InspectorClientWx.h
index 182df1b..f905817 100644
--- a/WebKit/wx/WebKitSupport/InspectorClientWx.h
+++ b/WebKit/wx/WebKitSupport/InspectorClientWx.h
@@ -60,10 +60,9 @@ public:
 
     virtual void inspectedURLChanged(const String& newURL);
 
-    virtual void populateSetting(const String& key, InspectorController::Setting&);
-    virtual void storeSetting(const String& key, const InspectorController::Setting&);
-    virtual void removeSetting(const String& key);
-    
+    virtual void populateSetting(const String& key, String* value);
+    virtual void storeSetting(const String& key, const String& value);
+
     virtual void inspectorWindowObjectCleared();
 };
 
diff --git a/WebKit/wx/WebView.cpp b/WebKit/wx/WebView.cpp
index 1b27cde..2c752de 100644
--- a/WebKit/wx/WebView.cpp
+++ b/WebKit/wx/WebView.cpp
@@ -257,7 +257,6 @@ BEGIN_EVENT_TABLE(wxWebView, wxWindow)
     EVT_SIZE(wxWebView::OnSize)
     EVT_MOUSE_EVENTS(wxWebView::OnMouseEvents)
     EVT_CONTEXT_MENU(wxWebView::OnContextMenuEvents)
-    EVT_MENU(wxID_ANY, wxWebView::OnMenuSelectEvents)
     EVT_KEY_DOWN(wxWebView::OnKeyEvents)
     EVT_KEY_UP(wxWebView::OnKeyEvents)
     EVT_CHAR(wxWebView::OnKeyEvents)
@@ -339,6 +338,10 @@ bool wxWebView::Create(wxWindow* parent, int id, const wxPoint& position,
     settings->setDatabasesEnabled(true);
 #endif
 
+#if __WXMSW__ || __WXMAC__
+    settings->setPluginsEnabled(true);
+#endif
+
     m_isInitialized = true;
 
     return true;
@@ -348,6 +351,9 @@ wxWebView::~wxWebView()
 {
     m_beingDestroyed = true;
     
+    while (HasCapture())
+        ReleaseMouse();
+    
     if (m_mainFrame && m_mainFrame->GetFrame())
         m_mainFrame->GetFrame()->loader()->detachFromParent();
     
@@ -646,6 +652,7 @@ void wxWebView::OnMouseEvents(wxMouseEvent& event)
 
 void wxWebView::OnContextMenuEvents(wxContextMenuEvent& event)
 {
+    Connect(wxEVT_COMMAND_MENU_SELECTED, wxCommandEventHandler(wxWebView::OnMenuSelectEvents), NULL, this);
     m_impl->page->contextMenuController()->clearContextMenu();
     wxPoint localEventPoint = ScreenToClient(event.GetPosition());
 
@@ -675,10 +682,18 @@ void wxWebView::OnContextMenuEvents(wxContextMenuEvent& event)
         return;
 
     PopupMenu(menuWx, localEventPoint);
+    
+    Disconnect(wxEVT_COMMAND_MENU_SELECTED, wxCommandEventHandler(wxWebView::OnMenuSelectEvents), NULL, this);
 }
 
 void wxWebView::OnMenuSelectEvents(wxCommandEvent& event)
 {
+    // we shouldn't hit this unless there's a context menu showing
+    WebCore::ContextMenu* coreMenu = m_impl->page->contextMenuController()->contextMenu();
+    ASSERT(coreMenu);
+    if (!coreMenu)
+        return;
+
     WebCore::ContextMenuItem* item = WebCore::ContextMenu::itemWithId (event.GetId());
     if (!item)
         return;
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index 50d4e19..a0f1cef 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,110 @@
+2009-12-07  Adam Roben  <aroben@apple.com>
+
+        Windows build fix for checkouts with a space in the path
+
+        * win/tools/scripts/auto-version.sh: Quote the output file's directory
+        before passing it to mkdir.
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32036
+        Implement CredentialStorage::getFromPersistentStorage for CFNetwork
+
+        * win/include/WebKitSystemInterface/WebKitSystemInterface.h:
+        * win/lib/WebKitSystemInterface.lib:
+        * win/lib/WebKitSystemInterface_debug.lib:
+        Update WebKitSystemInterface.
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31844
+        SocketStreamHandleCFNet should support CONNECT proxy credentials
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * libWebKitSystemInterfaceTiger.a:
+        * win/include/WebKitSystemInterface/WebKitSystemInterface.h:
+        * win/lib/WebKitSystemInterface.lib:
+        * win/lib/WebKitSystemInterface_debug.lib:
+        Update WebKitSystemInterface.
+
+2009-11-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Updated WebKitSystemInterface.
+
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * libWebKitSystemInterfaceTiger.a:
+
+2009-11-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed a leak in WKDrawMediaUIPart().
+
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * libWebKitSystemInterfaceTiger.a:
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7414396> Leopard & Tiger: Support closed caption in <video> element
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * libWebKitSystemInterfaceTiger.a:
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        * WebKitSystemInterface.h:
+            Add prototypes for WKQTMovieHasClosedCaptions and WKQTMovieSetShowClosedCaptions,
+            define WKMediaUIPartToggleClosedCaptionsButton.
+
+2009-11-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Update WebKitSystemInterface.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * libWebKitSystemInterfaceTiger.a:
+
+2009-11-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correction.  No review.
+
+        The WinCairo build requires ENABLE_FILTERS to work properly.
+
+        * win/tools/vsprops/WinCairo.vsprops:
+
+2009-11-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        WebKitSystemInterface part of making the appearance of the full-screen video HUD match
+        QuickTime Player X’s HUD.
+
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * libWebKitSystemInterfaceTiger.a:
+
 2009-10-26  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Adam Roben.
diff --git a/WebKitLibraries/WebKitSystemInterface.h b/WebKitLibraries/WebKitSystemInterface.h
index a97e635..f6234fe 100644
--- a/WebKitLibraries/WebKitSystemInterface.h
+++ b/WebKitLibraries/WebKitSystemInterface.h
@@ -188,6 +188,9 @@ typedef enum {
 
 int WKQTMovieGetType(QTMovie* movie);
 
+BOOL WKQTMovieHasClosedCaptions(QTMovie* movie);
+void WKQTMovieSetShowClosedCaptions(QTMovie* movie, BOOL showClosedCaptions);
+
 unsigned WKQTIncludeOnlyModernMediaFileTypes(void);
 int WKQTMovieDataRate(QTMovie* movie);
 float WKQTMovieMaxTimeLoaded(QTMovie* movie);
@@ -207,6 +210,8 @@ typedef enum {
     WKMediaUIPartSliderThumb,
     WKMediaUIPartRewindButton,
     WKMediaUIPartSeekToRealtimeButton,
+    WKMediaUIPartShowClosedCaptionsButton,
+    WKMediaUIPartHideClosedCaptionsButton,
     WKMediaUIPartUnMuteButton,
     WKMediaUIPartPauseButton,
     WKMediaUIPartBackground,
@@ -225,6 +230,7 @@ typedef enum {
     WKMediaControllerFlagDrawEndCaps = 1 << 3,
 } WKMediaControllerThemeState;
 
+BOOL WKMediaControllerThemeAvailable(int themeStyle);
 BOOL WKHitTestMediaUIPart(int part, int themeStyle, CGRect bounds, CGPoint point);
 void WKMeasureMediaUIPart(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
 void WKDrawMediaUIPart(int part, int themeStyle, CGContextRef context, CGRect rect, unsigned state);
@@ -273,6 +279,10 @@ void WKSetCAAnimationValueFunction(CAPropertyAnimation*, NSString* function);
 
 unsigned WKInitializeMaximumHTTPConnectionCountPerHost(unsigned preferredConnectionCount);
 
+void WKSetCONNECTProxyForStream(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
+void WKSetCONNECTProxyAuthorizationForStream(CFReadStreamRef, CFStringRef proxyAuthorizationString);
+CFHTTPMessageRef WKCopyCONNECTProxyResponse(CFReadStreamRef, CFURLRef responseURL);
+
 BOOL WKIsLatchingWheelEvent(NSEvent *);
 
 #ifndef BUILDING_ON_TIGER
diff --git a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
index 60c8017..71f4659 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
index a4b8ae7..6ecfb8b 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceTiger.a b/WebKitLibraries/libWebKitSystemInterfaceTiger.a
index 9ef1695..bd780bd 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceTiger.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceTiger.a
diff --git a/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h b/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
index b5ce097..e3feae6 100644
--- a/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
+++ b/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
@@ -42,6 +42,12 @@ typedef struct _CFURLResponse* CFURLResponseRef;
 typedef struct OpaqueCFHTTPCookieStorage*  CFHTTPCookieStorageRef;
 typedef struct _CFURLRequest* CFMutableURLRequestRef;
 typedef const struct _CFURLRequest* CFURLRequestRef;
+typedef struct _CFURLCredential* CFURLCredentialRef;
+typedef struct __CFHTTPMessage* CFHTTPMessageRef;
+typedef const struct __CFNumber* CFNumberRef;
+typedef struct __CFReadStream* CFReadStreamRef;
+typedef const struct __CFURL* CFURLRef;
+typedef struct _CFURLProtectionSpace* CFURLProtectionSpaceRef;
 
 void wkSetFontSmoothingLevel(int type);
 int wkGetFontSmoothingLevel();
@@ -77,6 +83,12 @@ void wkCFURLRequestSetHTTPRequestBodyParts(CFMutableURLRequestRef, CFArrayRef bo
 
 unsigned wkInitializeMaximumHTTPConnectionCountPerHost(unsigned preferredConnectionCount);
 
+void wkSetCONNECTProxyForStream(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
+void wkSetCONNECTProxyAuthorizationForStream(CFReadStreamRef, CFStringRef proxyAuthorizationString);
+CFHTTPMessageRef wkCopyCONNECTProxyResponse(CFReadStreamRef, CFURLRef responseURL);
+
+CFURLCredentialRef wkCopyCredentialFromCFPersistentStorage(CFURLProtectionSpaceRef);
+
 CFStringRef wkCFNetworkErrorGetLocalizedDescription(CFIndex errorCode);
 
 #endif // WebKitSystemInterface_h
diff --git a/WebKitLibraries/win/lib/WebKitSystemInterface.lib b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
index d4f9dd9..60d4e1e 100644
--- a/WebKitLibraries/win/lib/WebKitSystemInterface.lib
+++ b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
diff --git a/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib b/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
index 6d18588..56cbdcf 100644
--- a/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
+++ b/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
diff --git a/WebKitLibraries/win/tools/scripts/auto-version.sh b/WebKitLibraries/win/tools/scripts/auto-version.sh
index a67184f..c448db7 100755
--- a/WebKitLibraries/win/tools/scripts/auto-version.sh
+++ b/WebKitLibraries/win/tools/scripts/auto-version.sh
@@ -34,7 +34,7 @@ chomp()
 
 FALLBACK_VERSION_PATH=`cygpath -u "$WEBKITLIBRARIESDIR\\tools\\scripts\\VERSION"`
 OUTPUT_FILE=$(cygpath -u "$1")/include/autoversion.h
-mkdir -p $(dirname "$OUTPUT_FILE")
+mkdir -p "$(dirname "$OUTPUT_FILE")"
 
 # Take the initial version number from RC_PROJECTSOURCEVERSION if it
 # exists, otherwise fall back to the version number stored in the source.
diff --git a/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops b/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops
index b3b1e4c..1a8f4b2 100644
--- a/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops
@@ -6,7 +6,7 @@
 	>

 	<Tool

 		Name="VCCLCompilerTool"

-		PreprocessorDefinitions="WIN_CAIRO=1"

+		PreprocessorDefinitions="WIN_CAIRO=1;ENABLE_FILTERS"

 		AdditionalIncludeDirectories="&quot;$(WebKitLibrariesDir)\include\cairo&quot;"

 	/>

 	<Tool

diff --git a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json
index 2b8faf6..69ff238 100644
--- a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json
+++ b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json
@@ -22,10 +22,14 @@
                     { "name": "apple-windows-4", "platform": "win"},
 
                     { "name": "gtk-linux-slave-1", "platform": "gtk"},
+                    { "name": "gtk-linux-slave-2", "platform": "gtk"},
+                    { "name": "gtk-linux-slave-3", "platform": "gtk"},
 
                     { "name": "szeged-linux-1", "platform": "qt"},
 
-                    { "name": "google-slave-1", "platform": "chromium-win" }
+                    { "name": "google-windows-1", "platform": "chromium" },
+                    { "name": "google-mac-1", "platform": "chromium" },
+                    { "name": "google-linux-1", "platform": "chromium" }
                   ],
 
     "builders":   [ { "name": "Tiger Intel Release", "type": "BuildAndTest", "builddir": "tiger-intel-release",
@@ -93,14 +97,34 @@
                       "slavenames": ["gtk-linux-slave-1"]
                     },
                     {
+                      "name": "GTK Linux 32-bit Debug", "type": "BuildAndTest", "builddir": "gtk-linux-32-debug",
+                      "platform": "gtk", "configuration": "debug", "architectures": ["i386"],
+                      "slavenames": ["gtk-linux-slave-2"]
+                    },
+                    {
+                      "name": "GTK Linux 64-bit Debug", "type": "BuildAndTest", "builddir": "gtk-linux-64-debug",
+                      "platform": "gtk", "configuration": "debug", "architectures": ["x86_64"],
+                      "slavenames": ["gtk-linux-slave-3"]
+                    },
+                    {
                       "name": "Qt Linux Release", "type": "BuildAndTest", "builddir": "qt-linux-release",
                       "platform": "qt", "configuration": "release", "architectures": ["i386"],
                       "slavenames": ["szeged-linux-1"]
                     },
                     {
-                      "name": "Chromium Win Release", "type": "ChromiumBuild", "builddir": "chromium-win-release",
-                      "platform": "chromium-win", "configuration": "release", "architectures": ["i386"],
-                      "slavenames": ["google-slave-1"]
+                      "name": "Chromium Win Release", "type": "Build", "builddir": "chromium-win-release",
+                      "platform": "chromium", "configuration": "release", "architectures": ["i386"],
+                      "slavenames": ["google-windows-1"]
+                    },
+                    {
+                      "name": "Chromium Mac Release", "type": "Build", "builddir": "chromium-mac-release",
+                      "platform": "chromium", "configuration": "release", "architectures": ["i386"],
+                      "slavenames": ["google-mac-1"]
+                    },
+                    {
+                      "name": "Chromium Linux Release", "type": "Build", "builddir": "chromium-linux-release",
+                      "platform": "chromium", "configuration": "release", "architectures": ["i386"],
+                      "slavenames": ["google-linux-1"]
                     }
                   ],
 
@@ -108,8 +132,9 @@
                       "builderNames": ["Tiger Intel Release", "Leopard Intel Release (Build)", "Leopard Intel Debug (Build)",
                                        "SnowLeopard Intel Release (Build)", "SnowLeopard Intel Leaks",
                                        "Windows Release (Build)", "Windows Debug (Build)",
-                                       "GTK Linux Release", "Qt Linux Release",
-                                       "Chromium Win Release"]
+                                       "GTK Linux Release", "GTK Linux 32-bit Debug", "GTK Linux 64-bit Debug",
+                                       "Qt Linux Release",
+                                       "Chromium Win Release", "Chromium Mac Release", "Chromium Linux Release"]
                     },
                     { "type": "Triggerable", "name": "leopard-intel-release-tests",
                       "builderNames": ["Leopard Intel Release (Tests)"]
diff --git a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg
index 6219b0d..cd81108 100644
--- a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg
+++ b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg
@@ -48,63 +48,22 @@ class CheckOutSource(source.SVN):
         source.SVN.__init__(self, baseURL=self.baseURL, defaultBranch="trunk", mode=self.mode, *args, **kwargs)
 
 
-# FIXME: Remove this step once Chromium WebKit port build system is decoupled from
-# Chromium (https://bugs.webkit.org/show_bug.cgi?id=28396)
-class UpdateChromiumSource(shell.ShellCommand):
-    command = ["gclient", "sync"]
-    name = "update-chromium"
-    description = ["updating chromium source"]
-    descriptionDone = ["updated"]
-    haltOnFailure = True
-
-    def createSummary(self, log):
-        scraper = re.compile(r"^________ running '[^\n]+third_party[/\\]WebKit[^\n]+$\n(?:^[UA]\W+[^\n]+$\n)*^(?:Updated to|At) revision (\d+)", re.DOTALL | re.MULTILINE)
-        revisions = scraper.findall(log.getText())
-        gotRevision = "??" # This matches SVN unknown revision response.
-        if len(revisions):
-            gotRevision = "r%s" % revisions[-1]
-        self.descriptionDone = ["updated", gotRevision]
-
-    def start(self):
-        os = self.getProperty("fullPlatform").split('-')[1]
-        if os == "win":
-            self.setCommand(["gclient.bat", "sync"])
-        revision = self.getProperty("revision")
-        if revision:
-            command = self.command[:]
-            command.append("--revision=src/third_party/WebKit@%d" % revision)
-            self.setCommand(command)
-        return shell.ShellCommand.start(self)
-
-
-# FIXME: Remove this step once Chromium WebKit port build system is decoupled from
-# Chromium (https://bugs.webkit.org/show_bug.cgi?id=28396)
-class CompileChromiumWebKit(shell.ShellCommand):
-    command = ["python", "../../../scripts/slave/compile.py"]
-    name = "build-chromium"
-    description = ["compiling"]
-    descriptionDone = ["compiled"]
-    haltOnFailure = True
-
-    def start(self):
-        os = self.getProperty("fullPlatform").split('-')[1]
-        command = self.command[:]
-        if os == "win":
-            command.extend(["--solution=webkit.sln", "--build-dir=src\\webkit", "--", "/project", "webcore"])
-        elif os == "mac":
-            command.extend(["--solution=__solution__", "--build-dir=src/build", "--", "-project", "../webkit/webkit.xcodeproj", "-target", "webcore"])
-        self.setCommand(command)
-        return shell.ShellCommand.start(self)
-
-
 class InstallWin32Dependencies(shell.Compile):
     description = ["installing dependencies"]
     descriptionDone = ["installed dependencies"]
     command = ["perl", "./WebKitTools/Scripts/update-webkit-auxiliary-libs"]
 
 
+class InstallChromiumDependencies(shell.ShellCommand):
+    name = "gclient"
+    description = ["updating chromium dependencies"]
+    descriptionDone = ["updated chromium dependencies"]
+    command = ["perl", "./WebKitTools/Scripts/update-webkit-chromium"]
+    haltOnFailure = True
+
+
 def appendCustomBuildFlags(step, platform):
-    if platform in ('gtk', 'wx', 'qt'):
+    if platform in ('gtk', 'wx', 'qt', 'chromium'):
         step.setCommand(step.command + ['--' + platform])
 
 
@@ -215,7 +174,7 @@ class RunWebKitTests(shell.Test):
     descriptionDone = ["layout-tests"]
     command = ["perl", "./WebKitTools/Scripts/run-webkit-tests", "--no-launch-safari", "--no-new-test-results",
                "--no-sample-on-timeout", "--results-directory", "layout-test-results", "--use-remote-links-to-tests",
-               WithProperties("--%(configuration)s")]
+               WithProperties("--%(configuration)s"), "--exit-after-n-failures", "20"]
 
     def __init__(self, skipBuild=False, *args, **kwargs):
         self.skipBuild = skipBuild
@@ -240,6 +199,8 @@ class RunWebKitTests(shell.Test):
                 incorrectLayoutLines.append(line)
             elif line.startswith("WARNING:") and line.find(' leak') >= 0:
                 incorrectLayoutLines.append(line.replace('WARNING: ', ''))
+            elif line.find('Exiting early') >= 0:
+                incorrectLayoutLines.append(line)
 
             # FIXME: Detect and summarize leaks of RefCounted objects
 
@@ -318,23 +279,17 @@ class Factory(factory.BuildFactory):
         self.addStep(CheckOutSource)
         if platform == "win":
             self.addStep(InstallWin32Dependencies)
-
-# FIXME: Remove this factory once Chromium WebKit port build system is decoupled from
-# Chromium (https://bugs.webkit.org/show_bug.cgi?id=28396)
-class ChromiumBuildFactory(factory.BuildFactory):
-    def __init__(self, platform, configuration, architectures):
-        factory.BuildFactory.__init__(self)
-        self.addStep(ConfigureBuild, platform=platform, configuration=configuration, architecture=" ".join(architectures), buildOnly=True)
-        self.addStep(UpdateChromiumSource)
-        self.addStep(CompileChromiumWebKit)
+        if platform == "chromium":
+            self.addStep(InstallChromiumDependencies)
 
 class BuildFactory(Factory):
-    def __init__(self, platform, configuration, architectures, triggers):
+    def __init__(self, platform, configuration, architectures, triggers=None):
         Factory.__init__(self, platform, configuration, architectures, True)
         self.addStep(CompileWebKit)
-        self.addStep(ArchiveBuiltProduct)
-        self.addStep(UploadBuiltProduct)
-        self.addStep(trigger.Trigger, schedulerNames=triggers)
+        if triggers:
+            self.addStep(ArchiveBuiltProduct)
+            self.addStep(UploadBuiltProduct)
+            self.addStep(trigger.Trigger, schedulerNames=triggers)
 
 class TestFactory(Factory):
     def __init__(self, platform, configuration, architectures):
diff --git a/WebKitTools/ChangeLog b/WebKitTools/ChangeLog
index 7dcbf6c..c55009d 100644
--- a/WebKitTools/ChangeLog
+++ b/WebKitTools/ChangeLog
@@ -1,3 +1,3947 @@
+2009-12-10  Eric Seidel  <eric@webkit.org>
+
+        No review, just updating unit tests to match recent checkins.
+
+        * Scripts/modules/mock_bugzillatool.py:
+         - Add missing red_core_builders_names method causing exception.
+        * Scripts/modules/workqueue_unittest.py:
+         - processutils is dead, use executive.py instead.
+
+2009-12-10  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move run_command onto Executive to make code which uses run_command testable
+        https://bugs.webkit.org/show_bug.cgi?id=32396
+
+        * Scripts/modules/executive.py:
+         - Move run_command and error handlers onto Executive.
+        * Scripts/modules/scm.py:
+        * Scripts/modules/scm_unittest.py:
+
+2009-12-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool needs a command to list patches needing cq+
+        https://bugs.webkit.org/show_bug.cgi?id=32351
+
+        * Scripts/modules/bugzilla.py:
+         - Parse attacher_email from attachment xml.
+        * Scripts/modules/bugzilla_unittest.py:
+         - Test new attacher_email parsing.
+        * Scripts/modules/commands/queries.py:
+         - Add PatchesToCommitQueue
+        * Scripts/modules/commands/queries_unittest.py:
+         - Tests for PatchesToCommitQueue
+        * Scripts/modules/mock_bugzillatool.py:
+         - Add necessary mock methods for running PatchesToCommitQueue
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Turns out every StepSequence command needs a --quiet
+        option.
+
+        * Scripts/modules/stepsequence.py:
+
+2009-12-10  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Implements displayWebView() to force an invalidation and repaint.
+        This fixes a problem running the timeline-paint.html unit test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31729
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (displayWebView):
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Convert more commands to StepSequences
+        https://bugs.webkit.org/show_bug.cgi?id=32362
+
+        We should eventually convert all the commands, but I'm starting with
+        the easy ones.
+
+        * Scripts/modules/commands/download.py:
+
+2009-12-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] editing/selection/shrink-selection-after-shift-pagedown.html failing
+        https://bugs.webkit.org/show_bug.cgi?id=31103
+
+        Give focus to the webviews when we create them, since some tests expect this.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (main):
+
+2009-12-10  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool "builders are red" error should tell you which builders
+        https://bugs.webkit.org/show_bug.cgi?id=32211
+
+        * Scripts/modules/buildsteps.py:
+
+2009-12-09  Marwan Al Jubeh  <marwan.aljubeh@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=31228
+        Set the WebKitOutputDir, WebKitLibrariesDir and Cygwin environment variables automatically
+        in Windows as part of running update_webkit.
+
+        * Scripts/update-webkit:
+         - Run setupAppleWinEnv() on Apple's Windows port.
+        * Scripts/webkitdirs.pm:
+         - Added functions that return the source directory, libraries directory and default build directory on Windows.
+         - Added isWindowsNT() which tests if the current Windows version is from the Windows NT family.
+         - Implemented setupAppleWinEnv() which sets the environment variables WebKitOutputDir, WebKitLibrariesDir
+           and Cygwin to their desired values.
+
+2009-12-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        exception thrown when running apply-patches
+        https://bugs.webkit.org/show_bug.cgi?id=32344
+
+        The update step now takes a port option.  Once we finish the Steps
+        refactoring, we won't have to worry about this kind of bug again.
+
+        * Scripts/modules/commands/download.py:
+
+2009-12-09  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Fix ScriptError includes.  I don't understand why these
+        didn't throw during unit testing...
+
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/logging_unittest.py:
+        * Scripts/modules/workqueue.py:
+
+2009-12-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Remove unused PatchCollection class
+        https://bugs.webkit.org/show_bug.cgi?id=32312
+
+        It's dead code.
+
+        * Scripts/modules/patchcollection.py:
+        * Scripts/modules/patchcollection_unittest.py: Removed.
+
+2009-12-09  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed "build" fix.  CheckStyle needs a --no-upate option.
+
+        * Scripts/modules/commands/download.py:
+
+2009-12-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Convert Build to use Sequence
+        https://bugs.webkit.org/show_bug.cgi?id=32310
+
+        So much prettier.
+
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/stepsequence.py: Added.
+
+2009-12-09  Adam Barth  <abarth@webkit.org>
+
+        Add missing file.
+
+        * Scripts/modules/executive.py: Added.
+
+2009-12-09  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed "build" fix.
+
+        * Scripts/modules/landingsequence.py:
+
+2009-12-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Implement abstract Steps
+        https://bugs.webkit.org/show_bug.cgi?id=32212
+
+        This is a fairly disruptive change that refactors how we build
+        commands.  Instead of using a landing sequence, we can now assemble a
+        sequence of steps directly.  We still use the landing sequence in the
+        interim, but this will be removed soon.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/commands/early_warning_system.py:
+        * Scripts/modules/commands/queues.py:
+        * Scripts/modules/commands/queues_unittest.py:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/mock_bugzillatool.py:
+        * Scripts/modules/processutils.py: Removed.
+        * Scripts/modules/scm.py:
+        * Scripts/modules/scm_unittest.py:
+        * Scripts/modules/webkitport.py:
+
+2009-12-08  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        run_command and ScriptError should move into processutils.py
+        https://bugs.webkit.org/show_bug.cgi?id=32305
+
+        Turns out there are a zillion callers to run_command.
+
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/commands/early_warning_system.py:
+        * Scripts/modules/commands/queues.py:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/logging_unittest.py:
+        * Scripts/modules/processutils.py:
+        * Scripts/modules/scm.py:
+        * Scripts/modules/scm_unittest.py:
+        * Scripts/modules/workqueue.py:
+        * Scripts/modules/workqueue_unittest.py:
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * wx/browser/wscript:
+
+2009-12-08  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [check-webkit-style] False positive for DEFINE_OPCODE(op_jtrue) {
+        https://bugs.webkit.org/show_bug.cgi?id=32193
+
+        * Scripts/modules/cpp_style.py: For the function { rule, if there is space
+          at the beginning of line, ignore lines which then have a macro.
+        * Scripts/modules/cpp_style_unittest.py: Add tests to verify the
+          new behavior.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * DumpRenderTree/ForwardingHeaders/wtf/ThreadVerifier.h: Removed.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * DumpRenderTree/ForwardingHeaders/wtf/ThreadVerifier.h: Added.
+
+2009-12-08  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [check-webkit-style] False positive for camel case of JSC op codes
+        https://bugs.webkit.org/show_bug.cgi?id=32192
+
+        * Scripts/modules/cpp_style.py: Added an exception for the JSC op
+          code functions and const_iterator as well since I noticed a false
+          positive there when testing the fix.
+        * Scripts/modules/cpp_style_unittest.py: Added tests for these
+          changes.
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Win.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Scripts/webkitdirs.pm:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Gtk.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Scripts/build-webkit:
+
+2009-12-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Levin.
+
+        [check-webkit-style] S_OK is a fine identifier
+        https://bugs.webkit.org/show_bug.cgi?id=32225
+
+        * Scripts/modules/cpp_style.py:
+        * Scripts/modules/cpp_style_unittest.py:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Scripts/build-webkit:
+
+2009-12-07  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make run-webkit-websocketserver log to stderr rather than to a file.
+        https://bugs.webkit.org/show_bug.cgi?id=32234
+
+        * Scripts/run-webkit-websocketserver:
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Scripts/build-webkit:
+
+2009-12-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7450481> One compositing test keeps DRT in "compositing mode", breaks repaint tests
+
+        The counter that WebView used to keep track of the number of enclosed WebHTMLViews using
+        accelerated compositing was hard to manage, and maintained incorrectly in a number of cases.
+        This caused one compositing test make DumpRenderTree think that all subsequent tests
+        were compositing too.
+
+        Replace this counter with notifications, which are only fired if a client (DRT) requests them. The
+        notification informs the client that a WebHTMLView entered compositing mode (or an already-
+        compositing WebHTML was added); it does not say when a view becomes uncomposited, or all
+        compositing subviews were removed, since this is tricky to get right.
+        
+        DumpRenderTreeWindow listens for this notification, and uses it to turn on window
+        autodisplay, which is necessary to kick-start Core Animation rendering and animations.
+        We ensure that window autodisplay is turned off before every test.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (createWebViewAndOffscreenWindow):
+        (resetWebViewToConsistentStateBeforeTesting):
+        * DumpRenderTree/mac/DumpRenderTreeWindow.h:
+        * DumpRenderTree/mac/DumpRenderTreeWindow.mm:
+        (-[DumpRenderTreeWindow close]):
+        (-[DumpRenderTreeWindow startListeningForAcceleratedCompositingChanges]):
+        (-[DumpRenderTreeWindow webViewStartedAcceleratedCompositing:]):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        For now only enable FILTERS build flag on WebKit/mac. Other platforms will follow soon.
+
+        * Scripts/build-webkit:
+
+2009-12-07  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium buildbots are not red when they fail
+        https://bugs.webkit.org/show_bug.cgi?id=32235
+
+        * Scripts/build-webkit:
+
+2009-12-07  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Typo in chromium linux builder
+        https://bugs.webkit.org/show_bug.cgi?id=32238
+
+        * Scripts/webkitdirs.pm:
+
+2009-12-07  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        fixes to build-webkit --chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32179
+
+        * Scripts/webkitdirs.pm:
+
+2009-12-07  Eric Seidel  <eric@webkit.org>
+
+        No review, just adding two recently approved committers.
+
+        * Scripts/modules/committers.py:
+
+2009-12-07  Alexey Proskuryakov  <ap@apple.com>
+
+        * Scripts/run-webkit-websocketserver: Added property svn:executable.
+
+2009-12-07  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add run-webkit-websocketserver
+
+        https://bugs.webkit.org/show_bug.cgi?id=31390
+
+        * Scripts/run-webkit-websocketserver: Added.
+
+2009-12-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix. Be flexible about which version of ICU is used on Windows.
+
+        * DumpRenderTree/win/DumpRenderTree.vcproj: Add optional xcopy commands to copy ICU 4.2.
+
+2009-12-07  Dirk Schulze  <krit@webkit.org>
+
+        Not reviewed, adding myself to the reviewers list.
+
+        * Scripts/modules/committers.py:
+
+2009-12-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add an API for uploading results files to StatusBot
+        https://bugs.webkit.org/show_bug.cgi?id=32210
+
+        Add Content-Type: plain/text which was forgotten
+        from the previous commit when I landed with land-patches
+        instead of land-diff.
+
+        * QueueStatusServer/queue_status.py:
+
+2009-12-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Status Server needs a way to handle uploaded results
+        https://bugs.webkit.org/show_bug.cgi?id=32209
+
+        * QueueStatusServer/queue_status.py: Add a ShowResults (results/*) command
+        * QueueStatusServer/update_status.html: Add file upload.
+
+2009-12-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add an API for uploading results files to StatusBot
+        https://bugs.webkit.org/show_bug.cgi?id=32210
+
+        * Scripts/modules/statusbot.py:
+
+2009-12-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Status Server needs a way to handle uploaded results
+        https://bugs.webkit.org/show_bug.cgi?id=32209
+
+        * QueueStatusServer/queue_status.py: Add a ShowResults (results/*) command
+        * QueueStatusServer/update_status.html: Add file upload.
+
+2009-12-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] BuildAttachment should not check the builders
+        https://bugs.webkit.org/show_bug.cgi?id=32207
+
+        This is code that got copied here by accident when the class was created.
+
+        * Scripts/modules/commands/download.py:
+
+2009-12-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Make LandingSequence.update aware of ports
+        https://bugs.webkit.org/show_bug.cgi?id=32208
+
+        This is required to make build work on the Chromium port because
+        Chromium has a custom update-webkit.
+
+        * Scripts/modules/landingsequence.py:
+
+2009-12-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add early warning system commands to bugzilla-tool.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/webkitport.py:
+
+2009-12-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Implement Qt EarlyWarningSystem and Chromium EarlyWarningSystem
+        https://bugs.webkit.org/show_bug.cgi?id=32205
+
+        * Scripts/modules/commands/early_warning_system.py: Added.
+        * Scripts/modules/commands/queues.py:
+
+2009-12-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r51728): update-webkit fails when the current directory is
+        not inside a Subversion working copy
+        https://bugs.webkit.org/show_bug.cgi?id=32204
+
+        * Scripts/update-webkit: Invoke isSVN() in the correct working
+        directory.
+
+2009-12-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Rename AbstractTryQueue to AbstractReviewQueue
+        https://bugs.webkit.org/show_bug.cgi?id=32202
+
+        * Scripts/modules/commands/queues.py:
+
+2009-12-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Implement ChromiumPort
+        https://bugs.webkit.org/show_bug.cgi?id=32182
+
+        * Scripts/modules/webkitport.py:
+        * Scripts/modules/webkitport_unittest.py:
+
+2009-12-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move update-webkit into BuildSteps
+        https://bugs.webkit.org/show_bug.cgi?id=32181
+
+        We need to move update-webkit out of SCM.py because SCM isn't supposed to know
+        that WebKit exists.  The proper place for the knowledge of the existence of
+        update-webkit is in WebKitPort because some ports have specialized update
+        scripts (analogous to build-webkit).
+
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/scm.py:
+        * Scripts/modules/webkitport.py:
+
+2009-12-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        update-webkit should call git svn rebase and resolve-ChangeLogs -f
+        https://bugs.webkit.org/show_bug.cgi?id=27162
+
+        Teach update-webkit about Git.  I didn't add the call to
+        resolve-ChangeLogs -f because sometimes that script goes bananas.  We
+        can iterate from here, however.
+
+        * Scripts/update-webkit:
+
+2009-12-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] build fix after r51634 removed unused QBoxLayout include which included limits.h.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+
+2009-12-04  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Treat.
+
+        Add some missing methods for showing and hiding the
+        Web Inspector.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::WebPage):
+        (WebCore::WebPage::~WebPage):
+        (WebCore::WebPage::webInspector):
+        * DumpRenderTree/qt/DumpRenderTree.h:
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::showWebInspector):
+        (LayoutTestController::hideWebInspector):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
+2009-12-04  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Treat.
+
+        Implement the setAllowUniversalAccessFromFileURLs method
+        for the Qt LayoutTestController.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::resetSettings):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
+2009-12-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: AX: buttons now extremely repetitive
+        https://bugs.webkit.org/show_bug.cgi?id=32164
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (isAttributeSupportedCallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::isAttributeSupported):
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::isAttributeSupported):
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::isAttributeSupported):
+
+2009-12-03  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Levin.
+
+        check-webkit-style should check for camelCase variable names
+        https://bugs.webkit.org/show_bug.cgi?id=32051
+
+        * Scripts/modules/cpp_style.py:
+        * Scripts/modules/cpp_style_unittest.py:
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        AX: VO just says "term" on many web sites
+        https://bugs.webkit.org/show_bug.cgi?id=32139
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (getRoleDescriptionCallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::roleDescription):
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::roleDescription):
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::roleDescription):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Implement WAI-ARIA scrollbar role and related property aria-orientation
+        https://bugs.webkit.org/show_bug.cgi?id=32126
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (getOrientationCallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::orientation):
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::orientation):
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::orientation):
+
+2009-12-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Minor correction to r51663.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (addQTDirToPATH):
+            GetEnvironmentVariable -> GetEnvironmentVariableW.
+
+2009-12-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        ~96 regression tests fail when using QuickTime 7.6 (they pass with QuickTime 7.3)
+        https://bugs.webkit.org/show_bug.cgi?id=30256
+
+        Add the QuickTime dll directory to the PATH environment variable so
+        inialization can succeed.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (addQTDirToPATH):
+        (initialize):
+
+2009-12-03  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] After revision 32643, sender() is of type QWebPage instead of QWebFrame.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::maybeDump):
+
+2009-12-03  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Update pywebsocket to 0.4.3
+        This version logs friendlier and higher-level messages in WARN level, which is used for LayoutTests.
+        Stack trace is logged now in INFO level.
+        https://bugs.webkit.org/show_bug.cgi?id=32097
+
+        * pywebsocket/mod_pywebsocket/dispatch.py:
+        * pywebsocket/mod_pywebsocket/msgutil.py:
+        * pywebsocket/mod_pywebsocket/standalone.py:
+        * pywebsocket/mod_pywebsocket/util.py:
+        * pywebsocket/setup.py:
+        * pywebsocket/test/test_dispatch.py:
+        * pywebsocket/test/test_util.py:
+
+2009-12-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix JSClassRef leak.
+
+        * DumpRenderTree/AccessibilityController.cpp:
+        (AccessibilityController::makeWindowObject):
+        * DumpRenderTree/GCController.cpp:
+        (GCController::makeWindowObject):
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::makeWindowObject):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        Keep DRT-win building...
+
+        * DumpRenderTree/win/FrameLoadDelegate.h:
+        (FrameLoadDelegate::didPushStateWithinPageForFrame):
+        (FrameLoadDelegate::didReplaceStateWithinPageForFrame):
+        (FrameLoadDelegate::didPopStateWithinPageForFrame):
+
+2009-12-03  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Unreviewed build fix.
+
+        [Qt] ARM-Linux build fix after r51634 removed unused QBoxLayout include which included limits.h on ARM.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+
+2009-12-03  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Refactor DRT to not crash on tests which open child windows from javascript.
+        Prevent DRT from showing the main view if these childs get deleted.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=31591.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::WebPage):
+        (WebCore::DumpRenderTree::DumpRenderTree):
+        (WebCore::DumpRenderTree::~DumpRenderTree):
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+        (WebCore::DumpRenderTree::open):
+        (WebCore::DumpRenderTree::closeRemainingWindows):
+        (WebCore::DumpRenderTree::createWindow):
+        (WebCore::DumpRenderTree::windowCount):
+        * DumpRenderTree/qt/DumpRenderTree.h:
+
+2009-12-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION(51595): commit-queue is throwing exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=32083
+
+        * Scripts/modules/commands/queues.py:
+         - Don't use default value of [] as it ends up getting shared.
+         - Make log_progress accept arrays of ints as well as strings.
+         - Return an exit code from execute()
+        * Scripts/modules/commands/queues_unittest.py: Added.
+         - Test to make sure log_progress will accept ints.
+         - Test to make sure run_bugzilla_tool will accept ints.
+        * Scripts/modules/workqueue.py:
+         - Print the stack trace on unexpected exceptions for easier debugging.
+        * Scripts/run-webkit-unittests:
+         - Add queues_unittest.
+
+        * Scripts/modules/commands/queues.py:
+        * Scripts/modules/commands/queues_unittest.py: Copied from WebKitTools/Scripts/modules/commands/commandtest.py.
+        * Scripts/modules/mock_bugzillatool.py:
+        * Scripts/modules/workqueue.py:
+        * Scripts/run-webkit-unittests:
+
+2009-12-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        check-webkit-style is too noisy about namespace indenting issues.
+        https://bugs.webkit.org/show_bug.cgi?id=32096
+
+        * Scripts/modules/cpp_style.py:
+        Added a _FileState object to be able to track file level information. In this
+        case, it simply tracks whether the error has already been given, so that it isn't
+        done again.
+        * Scripts/modules/cpp_style_unittest.py:
+        Modified test cases to pass in the _FileState object and fix a test that expected
+        to see the namespace error twice (now it only occurs once). No new tests because
+        existing tests cover the change in functionality.
+
+2009-12-01  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        [wx] Get DumpRenderTree building after waf switch.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32041
+
+        * DumpRenderTree/wscript: Added.
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::setTimelineProfilingEnabled):
+        (LayoutTestController::evaluateScriptInIsolatedWorld):
+        (LayoutTestController::disableImageLoading):
+        (LayoutTestController::whiteListAccessFromOrigin):
+        (LayoutTestController::counterValueForElementById):
+        * Scripts/build-webkit:
+
+2009-12-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] build-attachment shouldn't check whether the builders are red
+        https://bugs.webkit.org/show_bug.cgi?id=32062
+
+        build-attachment doesn't touch the remote repository, so there isn't a
+        need to hold off when the builders are red.
+
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/landingsequence.py:
+
+2009-12-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION(51590): style-queue and build-queue think their empty when they are not
+        https://bugs.webkit.org/show_bug.cgi?id=32061
+
+        * Scripts/modules/bugzilla.py: make all id lookups return ints instead of strings.
+        * Scripts/modules/bugzilla_unittest.py: Add and update unit tests to use ints.
+
+2009-12-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        build-queue is throwing exceptions and complaining about
+        lack of --no-update on build-attachment.  Make it stop.
+
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/commands/download.py:
+
+2009-12-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed "build" fix.  Forgot to declare my variables.  :(
+
+        * QueueStatusServer/queue_status.py:
+
+2009-12-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Implement status bubble view
+        https://bugs.webkit.org/show_bug.cgi?id=32057
+
+        The status bubble is a compact representation of the queue status for a
+        given patch.  This will eventually help us reduce the comment spam from
+        the queues.
+
+        * QueueStatusServer/index.html: Added HTML5 doctype for sanity.
+        * QueueStatusServer/queue_status.py:
+        * QueueStatusServer/status_bubble.html: Added.
+
+2009-12-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        trim commands/*.py includes now that commands are unit tested
+        https://bugs.webkit.org/show_bug.cgi?id=32056
+
+        In the course of ensuring that the unit tests still
+        passed after this change, I had to actually make them
+        pass in the first place.
+
+        * Scripts/modules/bugzilla.py:
+         - Fix _parse_attachment_ids_request_query to return ints instead of strings.
+        * Scripts/modules/commands/download.py: Remove unneeded imports.
+        * Scripts/modules/commands/queries.py: Ditto.
+        * Scripts/modules/commands/queues.py: Ditto.
+        * Scripts/modules/commands/upload.py: Ditto.
+        * Scripts/modules/scm_unittest.py:
+         - Fix to expect the \n after the path since echo adds an \n.
+
+2009-12-01  Yaar Schnitman  <yaar@chromium.org>
+
+        build-webkit: Remove flex,bison,gperf check for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32043
+
+        * Scripts/webkitdirs.pm:
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Build fixage for Windows/GTK for DumpRenderTree.
+
+        WAI-ARIA: implement support for ARIA drag and drop
+        https://bugs.webkit.org/show_bug.cgi?id=32007
+
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::ariaIsGrabbed):
+        (AccessibilityUIElement::ariaDropEffects):
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::ariaIsGrabbed):
+        (AccessibilityUIElement::ariaDropEffects):
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement support for ARIA drag and drop
+        https://bugs.webkit.org/show_bug.cgi?id=32007
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (getARIADropEffectsCallback):
+        (getARIAIsGrabbedCallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::ariaIsGrabbed):
+        (AccessibilityUIElement::ariaDropEffects):
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. GTK DRT try 2.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::sampleSVGAnimationForElementAtTime):
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix gtk DRT build.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+
+2009-12-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        check-webkit-style does not understand (Prefix)Foo(Custom|Gtk|CG|Mac).cpp including Foo.h
+        https://bugs.webkit.org/show_bug.cgi?id=32033
+
+        * Scripts/modules/cpp_style.py: Changed check for a possible primary header to use find
+                                        instead of startswith.
+        * Scripts/modules/cpp_style_unittest.py: Added a unit test for the new behavior.
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Qt build almost fixed, DumpRenderTree should compile now as well.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.h: Update old function signature.
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add new 'sampleSVGAnimationForElementAtTime' DRT method,
+        used by the new SVG animation testing framework, implemented
+        for qt/gtk/win/mac.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (sampleSVGAnimationForElementAtTimeCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::sampleSVGAnimationForElementAtTime):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::sampleSVGAnimationForElementAtTime):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::sampleSVGAnimationForElementAtTime):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::sampleSVGAnimationForElementAtTime):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::sampleSVGAnimationForElementAtTime):
+
+2009-12-01  Adam Roben  <aroben@apple.com>
+
+        Remove user content before running each test on Windows
+
+        Fixes <http://webkit.org/b/31479> Make websocket tests work on Windows
+
+        Reviewed by Alexey Proskuryakov.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetWebViewToConsistentStateBeforeTesting): Remove all user content
+        before each test, which matches Mac.
+
+2009-12-01  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make pywebsocket log errors to a file
+        https://bugs.webkit.org/show_bug.cgi?id=31604
+
+        * Scripts/run-webkit-tests: Log output to a pywebsocket_log.txt file in results directory
+        (by passing the path to the server via a recently added -l option).
+
+2009-12-01  Adam Roben  <aroben@apple.com>
+
+        Fix tests that use the TestNetscapePlugin in Debug_Internal builds
+
+        Reviewed by Ada Chan.
+
+        Fixes <http://webkit.org/b/32027> REGRESSION (r49705): Tests that use
+        TestNetscapePlugin fail in Debug_Internal builds
+
+        * DumpRenderTree/win/DumpRenderTree.cpp: Use the "_Debug" plugin
+        directory in Debug and Debug_All builds, but not in Debug_Internal
+        builds.
+
+2009-12-01  Adam Roben  <aroben@apple.com>
+
+        Re-enable DRT's watchdog timer on Windows
+
+        It was accidentally disabled in r50907.
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::setWaitToDump): Remove a "false &&" that snuck
+        into an if condition.
+
+2009-12-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        check-webkit-style complains about #imports with / in them
+        https://bugs.webkit.org/show_bug.cgi?id=32022
+
+        We need to exclude #import directives in addition to #include from the
+        binary operator whitespace checks.
+
+        * Scripts/modules/cpp_style.py:
+        * Scripts/modules/cpp_style_unittest.py:
+
+2009-11-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        check-webkit-style is slightly too verbose
+        https://bugs.webkit.org/show_bug.cgi?id=32010
+
+        check-webkit-style prints out a bunch of "done" lines that seem redundant,
+        especially for the style-queue.
+
+        * Scripts/modules/cpp_style.py:
+
+2009-11-30  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Moved the functions that are closing the result log of the
+        tests to the last line of the runTest function, this avoids
+        reporting crashes in the wrong test if there is a problem when
+        reseting the state after the test.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (dump):
+        (runTest):
+
+2009-11-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31286
+        fast/js/date-proto-generic-invocation breaks another test
+
+        Don't cache JSClassRefs, a change to the prototype chain will
+        last between tests.
+
+        * DumpRenderTree/AccessibilityController.cpp:
+        (AccessibilityController::getJSClass):
+        * DumpRenderTree/GCController.cpp:
+        (GCController::getJSClass):
+        * DumpRenderTree/GCController.h:
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::getJSClass):
+
+2009-11-30  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Update pywebsocket to 0.4.2.1.
+        This is to fix a bug that some messages are logged to stderr even when the log file is specified.
+        https://bugs.webkit.org/show_bug.cgi?id=31976
+
+        * pywebsocket/mod_pywebsocket/standalone.py:
+        * pywebsocket/setup.py:
+
+2009-11-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Generate pass messages for style-queue
+        https://bugs.webkit.org/show_bug.cgi?id=31995
+
+        With this change, the style-queue posts "pass" messages to bugs as
+        well.  Also, added more information to the state store w.r.t. passing
+        and failing.
+
+        * Scripts/modules/commands/queues.py:
+        * Scripts/modules/patchcollection.py:
+
+2009-11-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Simon Fraser.
+
+        Check for WEBKIT_TESTFONTS environment variable in
+        run-webkit-tests, for GTK+, to have a more prominent error
+        message.
+
+        * Scripts/run-webkit-tests:
+
+2009-11-30  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        update-webkit --chromium forces gclient sync
+
+        https://bugs.webkit.org/show_bug.cgi?id=31967
+
+        * Scripts/update-webkit-chromium:
+
+2009-11-29  Eric Seidel  <eric@webkit.org>
+
+        Add Erik Arvidsson to committers.py since by r51326 he clear has commit rights.
+
+        * Scripts/modules/committers.py:
+
+2009-11-29  Eric Seidel  <eric@webkit.org>
+
+        No review, just adding missing svn property.
+
+        Set svn:executable property on new scripts.
+        These were added by commit-queue commits, but the executable
+        property was lost due to a bug in svn-apply:
+        https://bugs.webkit.org/show_bug.cgi?id=27204
+
+        * Scripts/update-webkit-chromium: Added property svn:executable.
+        * Scripts/validate-committer-lists: Added property svn:executable.
+
+2009-11-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Need a way to validate that committers.py includes all committers/reviewers
+        https://bugs.webkit.org/show_bug.cgi?id=30970
+
+        Add a script which knows how to compare our public committer/reviewer
+        lists and show discrepancies between them.
+
+        Validates mailing lists vs. committers.py:
+        - committers.py committers missing from webkit-committers@lists
+        - webkit-committers@lists members missing from committers.py
+        - committers.py reviewers missing from webkit-reviewers@lists
+        - webkit-reviewers@lists members missing from committers.py
+        - webkit-reviewers@lists members missing from committers.py reviewer list
+
+        Validates committers.py vs. trunk/ SVN history:
+        - committers who have not committed in over a year
+        - SVN committers missing from committers.py
+        - committers.py members who have no record in SVN.
+
+        All of these lists still show "false positives" until a few more committers.py updates are made, like:
+        https://bugs.webkit.org/show_bug.cgi?id=31366
+
+        * Scripts/validate-committer-lists: Added.
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] style-queue sends ~100 requests to QueueStatusServer every 5 minutes
+        https://bugs.webkit.org/show_bug.cgi?id=31950
+
+        Now we cache the last status that we get back from QueueStatusServer.
+        Eventually we'll have to do something more fancy if we want to support
+        a "try again" button on QueueStatusServer, but we can cross that bridge
+        when we come to it.
+
+        * Scripts/modules/patchcollection.py:
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        StyleQueue scans ~100 bug pages every 5 minutes
+        https://bugs.webkit.org/show_bug.cgi?id=31947
+
+        Instead of getting the pending-review attachment ids by scanning each
+        bug (which results in a network request), we should just get them all
+        from webkit.org/pending-review in one shot.
+
+        * Scripts/modules/bugzilla.py:
+        * Scripts/modules/bugzilla_unittest.py:
+        * Scripts/modules/commands/queries.py:
+        * Scripts/modules/commands/queries_unittest.py:
+        * Scripts/modules/commands/queues.py:
+        * Scripts/modules/mock_bugzillatool.py:
+        * Scripts/modules/patchcollection.py:
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] CC webkit-bot-watchers whenever the bots touch bugs
+        https://bugs.webkit.org/show_bug.cgi?id=31952
+
+        The mailing list is open for anyone to subscribe.
+
+        * Scripts/modules/bugzilla.py:
+        * Scripts/modules/commands/queues.py:
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] style-queue should report style errors to bugzilla
+        https://bugs.webkit.org/show_bug.cgi?id=31945
+
+        Currently, we're just logging the style errors locally.  With this
+        patch we'll actually log the errors to bugzilla.  Note: I plan to run
+        with the "local-only" logging during development.
+
+        * Scripts/modules/commands/queues.py:
+        * Scripts/modules/scm.py:
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] style-queue shouldn't reject patches from the commit-queue
+        https://bugs.webkit.org/show_bug.cgi?id=31944
+
+        Currently the style-queue subprocess gets confused and thinks its the
+        commit-queue.  If the patch has an error, it rejects it from the
+        commit-queue.  Instead, we should have style-queue specific logic.
+        This patch doesn't add that logic, but it gives us a callback we can
+        use to add that logic.
+
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/commands/queues.py:
+        * Scripts/modules/landingsequence.py:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Rubber stamped by Eric Seidel.
+
+        Rename CommitQueueStatus to QueueStatusServer to allow for more queues.
+
+        * CommitQueueStatus: Removed.
+        * CommitQueueStatus/app.yaml: Removed.
+        * CommitQueueStatus/filters: Removed.
+        * CommitQueueStatus/filters/__init__.py: Removed.
+        * CommitQueueStatus/filters/webkit_extras.py: Removed.
+        * CommitQueueStatus/index.html: Removed.
+        * CommitQueueStatus/index.yaml: Removed.
+        * CommitQueueStatus/queue_status.py: Removed.
+        * CommitQueueStatus/stylesheets: Removed.
+        * CommitQueueStatus/stylesheets/main.css: Removed.
+        * CommitQueueStatus/update_status.html: Removed.
+        * QueueStatusServer: Copied from WebKitTools/CommitQueueStatus.
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        style-queue should only process each patch once
+        https://bugs.webkit.org/show_bug.cgi?id=31939
+
+        Actually address reviewer comments!
+
+        * Scripts/bugzilla-tool:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] style-queue fails to apply a bunch of patches for no reason
+        https://bugs.webkit.org/show_bug.cgi?id=31942
+
+        By passing --non-interactive to check-style, we convince check-style
+        to pass --force to svn-apply, which lets it apply more patches.
+
+        * Scripts/modules/commands/queues.py:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Support --status-host in style-queue
+        https://bugs.webkit.org/show_bug.cgi?id=31941
+
+        * Scripts/modules/commands/queues.py:
+        * Scripts/modules/statusbot.py:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        style-queue should only process each patch once
+        https://bugs.webkit.org/show_bug.cgi?id=31939
+
+        Before processing a patch, the try-queues now ask the web service
+        whether they have already processed the patch.  This is an initial cut
+        of this functionality.  I expect we're make it richer over time.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/commands/queues.py:
+        * Scripts/modules/patchcollection.py:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        PatchStatus does not return status
+        https://bugs.webkit.org/show_bug.cgi?id=31938
+
+        We need to parse attachment_id as an int.  Otherwise, we can't find
+        anything in the datastore.
+
+        * CommitQueueStatus/queue_status.py:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make commit-queue status not throw an exception where there is not
+        status
+        https://bugs.webkit.org/show_bug.cgi?id=31936
+
+        We need to actually fetch the results of the query to see what's in the
+        datastore.
+
+        * CommitQueueStatus/queue_status.py:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] unit test ApplyPatches and ApplyAttachment
+        https://bugs.webkit.org/show_bug.cgi?id=31935
+
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/commands/download_unittest.py:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Unit test download commands
+        https://bugs.webkit.org/show_bug.cgi?id=31923
+
+        Adds download_unittest and fixes a bug found while testing.
+
+        * Scripts/modules/commands/commandtest.py:
+        * Scripts/modules/commands/download.py:
+            Fixed a bug where we'd throw an error because [].append returns
+            None.
+        * Scripts/modules/commands/download_unittest.py: Added.
+        * Scripts/modules/mock_bugzillatool.py:
+        * Scripts/run-webkit-unittests:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed "build" fix found while writing unit tests.
+
+        * Scripts/modules/commands/download.py:
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Kill WebKitLandingScripts
+        https://bugs.webkit.org/show_bug.cgi?id=31904
+
+        Step 6: Kill the rest.
+
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/commands/queries.py:
+        * Scripts/modules/commands/upload.py:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/scm.py:
+        * Scripts/modules/webkitlandingscripts.py: Removed.
+
+2009-11-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Unit test upload commands
+        https://bugs.webkit.org/show_bug.cgi?id=31903
+
+        Adds unit tests for all but two of the upload commands.  The two
+        remaining ones are more difficult.  I'll return to them later.  The
+        goal of these tests is just to run the commands.  We can test more
+        detailed behavior later.
+
+        * Scripts/modules/commands/commandtest.py:
+        * Scripts/modules/commands/upload.py:
+        * Scripts/modules/commands/upload_unittest.py:
+        * Scripts/modules/mock.py: Added.
+        * Scripts/modules/mock_bugzillatool.py:
+
+2009-11-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Kill WebKitLandingScripts
+        https://bugs.webkit.org/show_bug.cgi?id=31904
+
+        Step 5: Kill run_and_throw_if_fail.
+
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/processutils.py: Added.
+        * Scripts/modules/webkitlandingscripts.py:
+
+2009-11-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Kill WebKitLandingScripts
+        https://bugs.webkit.org/show_bug.cgi?id=31904
+
+        Step 4: Kill run_webkit_script.
+
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/webkitlandingscripts.py:
+
+2009-11-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Kill WebKitLandingScripts
+        https://bugs.webkit.org/show_bug.cgi?id=31904
+
+        Step 3: Kill build_webkit.
+
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/webkitlandingscripts.py:
+
+2009-11-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Kill WebKitLandingScripts
+        https://bugs.webkit.org/show_bug.cgi?id=31904
+
+        Step 2: Kill ensure_builders_are_green.
+
+        * Scripts/modules/buildsteps.py:
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/webkitlandingscripts.py:
+
+2009-11-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [bzt] Kill WebKitLandingScripts
+        https://bugs.webkit.org/show_bug.cgi?id=31904
+
+        Step 1: Kill prepare_clean_working_directory and run_webkit_tests.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/buildsteps.py: Added.
+        * Scripts/modules/commands/download.py:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/webkitlandingscripts.py:
+
+2009-11-26  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Remove directory prefixes from linux commands
+
+        SCM unittests can cause errors on some systems if we use absolute reference to
+        the commands, so directory prefixes have been removed.
+
+        * Scripts/modules/scm_unittest.py:
+
+2009-11-21  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Link DumpRenderTree to the Qt Ui Tools
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        Implement QWebPage::createPlugin using the Qt Ui Tools
+        to be able to create classes like QProgressBar from within
+        the <object></object> tags This is required for the
+        new automatic test of Qt Plugins.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::createPlugin):
+        * DumpRenderTree/qt/DumpRenderTree.h:
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+
+2009-11-25  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Update pywebsocket to 0.4.2
+
+        Update pywebsocket to 0.4.2
+        https://bugs.webkit.org/show_bug.cgi?id=31861
+
+        * pywebsocket/example/echo_client.py:
+        * pywebsocket/example/echo_wsh.py:
+        * pywebsocket/mod_pywebsocket/__init__.py:
+        * pywebsocket/mod_pywebsocket/dispatch.py:
+        * pywebsocket/mod_pywebsocket/msgutil.py:
+        * pywebsocket/mod_pywebsocket/standalone.py:
+        * pywebsocket/setup.py:
+        * pywebsocket/test/test_dispatch.py:
+        * pywebsocket/test/test_msgutil.py:
+
+2009-11-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add unit test for mark-fixed
+        https://bugs.webkit.org/show_bug.cgi?id=31896
+
+        * Scripts/modules/commands/commandtest.py: Added.
+        * Scripts/modules/commands/queries_unittest.py:
+        * Scripts/modules/commands/upload_unittest.py: Added.
+        * Scripts/modules/mock_bugzillatool.py:
+        * Scripts/run-webkit-unittests:
+
+2009-11-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        bugzilla-tool should have a mark-fixed command
+        https://bugs.webkit.org/show_bug.cgi?id=31853
+
+        Pretty simple stuff.
+
+        * Scripts/modules/commands/upload.py:
+
+2009-11-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        'bugzilla-tool help' should only show common commands like how 'git help' does
+        https://bugs.webkit.org/show_bug.cgi?id=31772
+
+        I also took this opportunity to make 'help' a real Command.
+        Making 'help' a real command required adding Command.tool (which we've wanted to do for a while).
+
+        * Scripts/bugzilla-tool:
+         - change should_show_command_help to should_show_in_main_help
+        * Scripts/modules/commands/download.py:
+         - Mark commands as being shown in main help or not.
+         - show_in_main_help = False is not required (default is false),
+           but it seemed to make the commands more self-documenting.
+        * Scripts/modules/commands/queries.py: ditto
+        * Scripts/modules/commands/queues.py: ditto
+        * Scripts/modules/commands/upload.py: ditto
+        * Scripts/modules/multicommandtool.py:
+         - Make Command hold a pointer to tool in self.tool.  Most Command
+           subclasses do not take advantage of this yet, but it was required
+           for HelpCommand to be able to reach the tool from _help_epilog().
+         - Move MultiCommandTool._standalone_help_for_command to Command.standalone_help
+         - Move MultiCommandTool._help_epilog to Command._help_epilog
+         - Move "help" logic into HelpCommand.execute()
+         - Change should_show_command_help to should_show_in_main_help and add a default implementation.
+        * Scripts/modules/multicommandtool_unittest.py:
+         - Test hiding of Commands in --help, and that all commands are shown in 'help --all-commands'
+
+2009-11-25  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        Patch by Mark Rowe.
+
+        The buildbots are failing on Windows because when they were upgraded
+        to 4.0.4, Apple Application Support was not in their path. Add it to
+        the path to fix the buildots.
+
+        * Scripts/webkitdirs.pm:
+
+2009-11-25  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        run-webkit-tests doesn't accept directories/files with --skipped=only parameter
+        https://bugs.webkit.org/show_bug.cgi?id=31799
+
+        * Scripts/run-webkit-tests: Fixed.
+
+2009-11-25  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Change run_command to give back stderr by default
+        https://bugs.webkit.org/show_bug.cgi?id=31734
+
+        Change run_command to give back stderr by default.
+        Set run_commands's 'svn-create-patch' calling to put only the stdout into the patches.
+        Change the related unittest call.
+
+        * Scripts/modules/scm.py:
+        * Scripts/modules/scm_unittest.py:
+
+2009-11-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Centralize required argument parsing in Command
+        https://bugs.webkit.org/show_bug.cgi?id=31872
+
+        * Scripts/modules/commands/download.py: remove custom required arg message.
+        * Scripts/modules/commands/upload.py: ditto.
+        * Scripts/modules/multicommandtool.py:
+         - Add _parse_required_arguments.
+         - Pass program name off to OptionParser.
+         - Add name() for access to tool name.
+         - Add check_arguments_and_execute and make it return a return code.
+         - Replace a couple uses of + with %.
+        * Scripts/modules/multicommandtool_unittest.py: test _parse_required_arguments
+
+2009-11-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Abstract out capturing stdout/stderr into a new OutputCapture class for re-use among the various unit tests.
+        https://bugs.webkit.org/show_bug.cgi?id=31870
+
+        * Scripts/modules/commands/queries_unittest.py: Use the new class.
+        * Scripts/modules/multicommandtool_unittest.py: Ditto.
+        * Scripts/modules/outputcapture.py: Added.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Scripts/build-webkit:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Changes the way 3D_RENDERING and ACCELERATED_COMPOSITING related tests are excluded
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+        
+        Now the script allows the directories with these tests to be included on all
+        platforms but Mac, where they behave the same as always. For all other platforms
+        the tests need to be excluded using the Skipped files, which is currently done
+        for all platforms (including win since we're not turned on yet)
+
+        * Scripts/webkitdirs.pm:
+
+2009-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        queries_unittest.py should test command output
+        https://bugs.webkit.org/show_bug.cgi?id=31845
+
+        * Scripts/modules/commands/queries_unittest.py:
+         - Capture stdout and stderr and compare with expected strings.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        No Review.
+
+        Fix spelling error ("depenedencies").
+
+        * Scripts/build-webkit:
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Land the configuration that includes the two debug GTK Linux builders.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+
+2009-11-24  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/31840> bisect-builds broke after r50080
+
+        Reviewed by Dan Bernstein.
+
+        * Scripts/bisect-builds:
+        (mountAndRunNightly): Switched back to using backticks to run
+        the hdiutil command since exec() will terminate the existing
+        script, which is not what we want.  Store the output of
+        File::Spec->devnull() in a variable for use in the hdiutil
+        detach commands.
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        * DumpRenderTree/pthreads/JavaScriptThreadingPthreads.cpp:
+        * DumpRenderTree/qt/jsobjects.cpp:
+        * DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp:
+
+2009-11-23  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Implement new required function to pass test we used to pass. This
+        change is required since r51294.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+
+2009-11-23  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] DRT: dumpBackForwardList() does not work properly with non-file URLs.
+        https://bugs.webkit.org/show_bug.cgi?id=31775
+
+        LayoutTestController::dumpBackForwardList() should work with local URLs
+        as well as with normal URLs (in http tests for instance).
+        Currently it does not output the latter properly.
+
+        Unskip a bunch of passing http/navigation tests.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::dumpHistoryItem):
+
+2009-11-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARIA: support aria-flowto
+        https://bugs.webkit.org/show_bug.cgi?id=31762
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (ariaFlowToElementAtIndexCallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::ariaFlowToElementAtIndex):
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::ariaFlowToElementAtIndex):
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::ariaFlowToElementAtIndex):
+
+2009-11-22  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] fast/history/back-forward-reset-after-error-handling.html failing due to WorkQueue not being un-frozen
+        https://bugs.webkit.org/show_bug.cgi?id=31638
+
+        Unfreeze WorkQueue after each test execution.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+
+2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] DumpRenderTree should explicitly ignore any SSL certificate errors
+        for localhost and 127.0.0.1.
+        https://bugs.webkit.org/show_bug.cgi?id=31783
+
+        Unskip the http/tests/ssl/verify-ssl-enabled.php test, which is passing now.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::NetworkAccessManager::NetworkAccessManager):
+        (WebCore::NetworkAccessManager::sslErrorsEncountered):
+        (WebCore::WebPage::WebPage):
+        * DumpRenderTree/qt/DumpRenderTree.h:
+
+2009-11-22  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Disable access to file:/// directory listings
+        https://bugs.webkit.org/show_bug.cgi?id=31329
+
+        Implemented setAllowUniversalAccessFromFileURLs to support testing of
+        file URL security.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (setAllowUniversalAccessFromFileURLsCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::setAllowUniversalAccessFromFileURLs):
+
+2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix the timeout of fast/frames/frame-navigation.html
+        https://bugs.webkit.org/show_bug.cgi?id=31638
+
+        The test is timeouting, because it uses the WorkQueue to load a document in one
+        of the child frames and once the loading is finished, the DRT does not dump the
+        tree. This is because it waits for the QWebFrame::loadFinished() signal from
+        the main frame, while it should connect to QWebPage::loadFinished().
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::DumpRenderTree):
+
+2009-11-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool --help spews way too much text
+        https://bugs.webkit.org/show_bug.cgi?id=31771
+
+        * Scripts/bugzilla-tool:
+         - Remove self.cached_scm initialization hack.
+        * Scripts/modules/buildbot.py:
+         - Make default_host accessible to callers.
+        * Scripts/modules/commands/download.py:
+         - Phrase help for all commands consistently and remove spurious help text punctuation.
+        * Scripts/modules/commands/queries.py: Ditto.
+        * Scripts/modules/commands/queues.py: Ditto.
+        * Scripts/modules/commands/upload.py: Ditto.
+        * Scripts/modules/multicommandtool.py:
+         - Add HelpPrintingOptionParser.format_epilog to replace
+           NonWrappingEpilogIndentedHelpFormatter and allow us to lazily initialize
+           per-command help (thus removing the need for the cached_scm hack in BugzillaTool).
+         - Make --help only show a list of commands like "svn help" and "git help" do --
+           previously --help was listing all commands and options.
+         - Sort list of commands alphabetically.
+
+2009-11-21  Eric Seidel  <eric@webkit.org>
+
+        No review.  Fixing a typo from the previous patch for bug 31767.
+
+        AbstractQueue.run_bugzilla_tool throws an exception
+        https://bugs.webkit.org/show_bug.cgi?id=31769
+
+        * Scripts/modules/commands/queues.py:
+
+2009-11-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue fails to run with "permissions error" due to bad bugzilla-tool path
+        https://bugs.webkit.org/show_bug.cgi?id=31767
+
+        What we really want to test is BugzillaTool.path() instead of TrivialTool.path().
+        Since we don't have a good way to test BugzillaTool pieces, I've
+        left out a test for now.
+
+        * Scripts/bugzilla-tool:
+         - Add a path() implementation to expose bugzilla-tool's __file__ path to commit-queue.
+        * Scripts/modules/commands/queues.py:
+         - Use tool.path() instead of __file__.
+        * Scripts/modules/multicommandtool.py:
+         - Add a new path() method to MultiComandTool.
+        * Scripts/modules/multicommandtool_unittest.py:
+         - Provide a path() method.  Little point in testing this mock implementation.
+
+2009-11-21  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed "build" fix.  Turns out I was testing the wrong copy of
+        WebKitTools.
+
+        * Scripts/modules/commands/download.py:
+
+2009-11-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Convert check-style to use LandingSequence
+        https://bugs.webkit.org/show_bug.cgi?id=31763
+
+        Instead of manipulating the working copy by hand, we should use the
+        LandingSequence in CheckStyle.  This will make this code eaiser to
+        test.
+
+        * Scripts/modules/commands/download.py:
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Unit test query commands
+        https://bugs.webkit.org/show_bug.cgi?id=31755
+
+        These tests are pretty rough, but hopefully they'll grow.
+
+        * Scripts/modules/commands/queries_unittest.py: Added.
+        * Scripts/modules/mock_bugzillatool.py: Added.
+        * Scripts/run-webkit-unittests:
+
+2009-11-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a bunch of unit test regressions from our recent bugzilla-toll hacking
+        https://bugs.webkit.org/show_bug.cgi?id=31758
+
+        * Scripts/modules/multicommandtool.py:
+         - Allow passing of explicit commands to MultiCommandTool.__init__
+        * Scripts/modules/multicommandtool_unittest.py:
+         - Use new Command.name naming system.
+         - Test Command auto-discovery.
+        * Scripts/modules/workqueue.py:
+         - bug_id no longer exists, use patch['bug_id'] instead.
+        * Scripts/modules/workqueue_unittest.py:
+         - WorkQueues require names now.
+         - should_proceed_with_work_item must return a patch object.
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for aria-owns
+        https://bugs.webkit.org/show_bug.cgi?id=31702
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (ariaOwnsElementAtIndexCallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::ariaOwnsElementAtIndex):
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::ariaOwnsElementAtIndex):
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::ariaOwnsElementAtIndex):
+
+2009-11-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix exception thrown when running the commit-queue.
+
+        * Scripts/modules/statusbot.py: patch is optional.
+        * Scripts/modules/workqueue.py: WorkQUeue requires a name.
+
+2009-11-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Teach the StatusBot how to support more than just the commit-queue
+        https://bugs.webkit.org/show_bug.cgi?id=31754
+
+        * Scripts/modules/workqueue.py: Another typo.
+
+2009-11-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Teach the StatusBot how to support more than just the commit-queue
+        https://bugs.webkit.org/show_bug.cgi?id=31754
+
+        * Scripts/modules/commands/queues.py: Fix silly typo.
+
+2009-11-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Teach the StatusBot how to support more than just the commit-queue
+        https://bugs.webkit.org/show_bug.cgi?id=31754
+
+        * CommitQueueStatus/index.yaml:
+         - Add indices required for the new queries.
+        * CommitQueueStatus/queue_status.py:
+         - Add a patch-status page and move update_status to update-status.
+         - Only display "commit-queue" status records for the commit-queue.
+         - Add support for a queue_name property on status records.
+         - Fix _int_from_request to actually work.
+        * CommitQueueStatus/update_status.html:
+         - Add support for a queue_name on status records.
+         - Remove unused list of bug ids.
+         * Scripts/modules/commands/queues.py
+          - Make the queues pass the patch instead of the bug_id to StatusBot.
+        * Scripts/modules/statusbot.py:
+         - Support passing the queue_name to the status updates.
+         - Support fetching patch status with patch_status().
+        * Scripts/modules/workqueue.py:
+         - Pass the patch to the StatusBot instead of the bug_id.
+         - Let WorkQueues have a name.
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move bugzilla-tool commands into their own file
+        https://bugs.webkit.org/show_bug.cgi?id=31752
+
+        This will let us write unit tests.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/commands/__init__.py: Added.
+        * Scripts/modules/commands/download.py: Added.
+        * Scripts/modules/commands/queries.py: Added.
+        * Scripts/modules/commands/queues.py: Added.
+        * Scripts/modules/commands/upload.py: Added.
+        * Scripts/modules/grammar.py: Added.
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        BuildQueue should check if the tree is currently buildable
+        https://bugs.webkit.org/show_bug.cgi?id=31744
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/webkitlandingscripts.py:
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move prepare_clean_working_directory into the LandingSequence
+        https://bugs.webkit.org/show_bug.cgi?id=31743
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/landingsequence.py:
+
+2009-11-20  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        NPN_ReloadPlugins does not reload the page even if reloadPages is true.
+        https://bugs.webkit.org/show_bug.cgi?id=30460
+
+        Added code for calling NPN_ReloadPlugins with reloadPages true and false.
+
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp:
+        (pluginInvoke):
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Pass the port information to the child process
+        https://bugs.webkit.org/show_bug.cgi?id=31736
+
+        We need to do this so the child process knows what to build!
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/webkitport.py:
+        * Scripts/modules/webkitport_unittest.py:
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Support Qt port in build-queue
+        https://bugs.webkit.org/show_bug.cgi?id=31733
+
+        * Scripts/bugzilla-tool:
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement a build-queue
+        https://bugs.webkit.org/show_bug.cgi?id=31725
+
+        Currently this just builds the first 10 patches in the review queue.
+        We'll want to do something smarter soon.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make commit-queue and style-queue show up in help
+        https://bugs.webkit.org/show_bug.cgi?id=31724
+
+        We need to store their names on their class to make these commands
+        properly register themselves with MultiCommandTool.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement bugzilla-tool build-attachment
+        https://bugs.webkit.org/show_bug.cgi?id=31722
+
+        This command builds an attachment from bugzilla.  It leaves the built
+        patch in the working copy.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/landingsequence.py:
+        * Scripts/modules/webkitlandingscripts.py:
+
+2009-11-20  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] DRT release event does not create the state correctly
+        https://bugs.webkit.org/show_bug.cgi?id=31717
+
+        * WebKitTools/DumpRenderTree/gtk/EventSender.cpp:
+
+2009-11-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        MultiCommandTool should find Command objects automatically instead of with a manual list
+        https://bugs.webkit.org/show_bug.cgi?id=31710
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/multicommandtool.py:
+         - Use some wild python-fu to crawl all the known subclasses of Command.
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed "build" fix.  Added missing import.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed "build" fix.  I failed to update LandingSequence.test
+        properly.
+
+        * Scripts/modules/landingsequence.py:
+
+2009-11-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Create LandingSequence as the all-sing, all-dance landing class
+        https://bugs.webkit.org/show_bug.cgi?id=31709
+
+        Client can inherit from this class to carefully control exactly which
+        steps they wish to have happen in the landing sequence.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/landingsequence.py: Added.
+        * Scripts/modules/webkitlandingscripts.py: Added.
+
+2009-11-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Abstract AbstractPatchProcessingCommand from AbstractPatchLandingCommand
+        https://bugs.webkit.org/show_bug.cgi?id=31707
+
+        This is to help when we implement build-attachment.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Support Qt port in bugzilla-tool
+        https://bugs.webkit.org/show_bug.cgi?id=31701
+
+        Now we support building with Qt!
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/webkitport.py: Added.
+        * Scripts/modules/webkitport_unittest.py: Added.
+        * Scripts/run-webkit-unittests:
+
+2009-11-19  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Remove inserting stderr into patch in bugzilla-tool
+        https://bugs.webkit.org/show_bug.cgi?id=29914
+
+        Modify SCM python module's run_command function to avoid return of stderr
+        by default, so stderr won't be inserted into the patches.
+        Modify the related unit test.
+
+        * Scripts/modules/scm.py:
+        * Scripts/modules/scm_unittest.py:
+
+2009-11-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool needs per-command help
+        https://bugs.webkit.org/show_bug.cgi?id=31697
+
+        Added support for "bugzilla-tool help command-name"
+        and a unit test to make sure it works.
+
+        * Scripts/modules/multicommandtool.py:
+        * Scripts/modules/multicommandtool_unittest.py:
+
+2009-11-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move MultiCommandTool and Command into a separate file and add some basic unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=31695
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/multicommandtool.py: Added.
+        * Scripts/modules/multicommandtool_unittest.py: Added.
+        * Scripts/run-webkit-unittests:
+
+2009-11-19  Eric Seidel  <eric@webkit.org>
+
+        No review, just adding a FIXME.
+
+        Split out command parsing and help printing from BugzillaTool
+        https://bugs.webkit.org/show_bug.cgi?id=31688
+
+        * Scripts/bugzilla-tool: Add an extra comment about current design failures.
+
+2009-11-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Split out command parsing and help printing from BugzillaTool
+        https://bugs.webkit.org/show_bug.cgi?id=31688
+
+        * Scripts/bugzilla-tool:
+         - Add new MultiCommandTool class to contain option parsing and help printing logic.
+         - Rename private methods to use _ pattern.
+         - MultiCommandTool has two abstract methods should_show_command_help and should_execute_command.
+         - 
+
+2009-11-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Re-factor help printing to use modern python idioms
+        https://bugs.webkit.org/show_bug.cgi?id=31685
+
+        * Scripts/bugzilla-tool:
+
+2009-11-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        commit-queue empty queue logs twice
+        https://bugs.webkit.org/show_bug.cgi?id=31679
+
+        * Scripts/bugzilla-tool:
+
+2009-11-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        bugzilla-tool's reviewer/committer rejection message should be clearer
+        https://bugs.webkit.org/show_bug.cgi?id=31126
+
+        Add more explanatory prose to bugzilla-tool's flag permission rejection message.
+
+        * Scripts/modules/bugzilla.py:
+
+2009-11-19  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Forces a WM_PAINT event on calling layoutTestController.display()
+        in order to enable the timeline-paint.html test on Windows.
+        ::UpdateWindow() does not force an event becaue the window is 
+        not visible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31402
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (displayWebView):
+
+2009-11-19  Michelangelo De Simone  <michelangelo@webkit.org>
+
+        No review needed.
+
+        Added myself to committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-11-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bugzilla-tool command classes should match command names
+        https://bugs.webkit.org/show_bug.cgi?id=31666
+
+        I renamed all the commands except CommitMessageForCurrentDiff because
+        the new name would conflict with an existing class.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Web Inspector: Implement "show inspector" in WebKit GTK
+        API and enable console tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31669
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::showWebInspector):
+
+2009-11-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Minor refactoring + more documentation.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::clearHistory):
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+
+2009-11-19  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Ignore websocket tests when --no-http is specified.
+        https://bugs.webkit.org/show_bug.cgi?id=31662
+
+        * Scripts/run-webkit-tests:
+
+2009-11-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Normalize ' and " in bugzilla-tool
+        https://bugs.webkit.org/show_bug.cgi?id=31655
+
+        We decided " is better than ' and we should be consistent.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/ImageDiff.pro:
+
+2009-11-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        GitTest.test_create_binary_patch fails if /tmp is symlink
+        https://bugs.webkit.org/show_bug.cgi?id=31536
+
+        * Scripts/modules/scm_unittest.py:
+
+2009-11-18  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Configuration for Chromium Build Slaves.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31442
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+
+2009-11-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        workqueue.py results in totally broken commit-queue UI
+        https://bugs.webkit.org/show_bug.cgi?id=31645
+
+        * Scripts/bugzilla-tool:
+         - Remove unneeded use of PatchCollection.
+         - Grab a new copy of the cq'd patches every run of the queue.
+
+2009-11-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Make the Mac Geolocation API async.
+
+        Update DRT to use the new async Mac Geolocation API.
+
+        * DumpRenderTree/mac/UIDelegate.mm:
+        (-[UIDelegate webView:decidePolicyForGeolocationRequestFromOrigin:frame:listener:]):
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add and option to toggle HTML5 datalist support to build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31599
+
+        * Scripts/build-webkit:
+
+2009-11-18  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Enable wx plugin support using the Windows implementation as a base.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31636
+
+        * wx/build/settings.py:
+
+2009-11-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Change the initialization order so that the controllers
+        will be created before exporting them to the JS DOM window.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::DumpRenderTree):
+
+2009-11-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a code copy and paste error. m_page should be page.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::createWindow):
+
+2009-11-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <http://webkit.org/b/31603> WebSocket server is confused if WebKit tests run from within /tmp on Mac OS X
+
+        * pywebsocket/mod_pywebsocket/dispatch.py: Use os.path.realpath as it returns the canonical path of a file.
+        This prevents symlinks from confusing the descendant check.
+
+2009-11-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <http://webkit.org/b/31602> Failing to start the WebSocket server shouldn’t terminate entire test run
+
+        If the WebSocket server fails to start have DRT load an error page in place of tests that require the
+        server to be up rather than having run-webkit-tests abort immediately.
+
+        * Scripts/run-webkit-tests:
+
+2009-11-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        commit-queue is failing to set reviewer in ChangeLogs
+        https://bugs.webkit.org/show_bug.cgi?id=31592
+
+        * Scripts/bugzilla-tool: Clarify the "applying" log message.
+        * Scripts/modules/bugzilla.py:
+         - Add a new _validate_committer_and_reviewer function as a
+           temporary solution until we can make a real Attachment object
+           which knows how to fill in its committer/reviewer fields automatically.
+
+2009-11-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed buildbot fix.
+
+        Revert part of earlier patch and add comment, as it
+        was causing timeouts on the buildbot.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::notifyDone):
+
+2009-11-17  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Make the timeout 15 sec as for the other DRT's and make
+        it print out the same output when a test timeout.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::waitUntilDone):
+        (LayoutTestController::notifyDone):
+        (LayoutTestController::timerEvent):
+
+2009-11-17  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixed typos in comments.
+
+        * Scripts/modules/committers.py:
+
+2009-11-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make DRT show web inspector for tests in inspector/ folder.
+        - Updated DRT to show/close inspector for all tests under /inspector
+        - Introduced LayoutTestController::setTimelineProfilingEnabled and
+          WebInspector::setTimelineProfilingEnabled beside setJavaScriptProfilingEnabled
+        - Removed reload on each inspector test
+        - Renamed fast/inspector to fast/inspector-support in order not to trigger
+        inspector for those.
+        - Reimplemented timeline tests in order to get rid of reload there.
+        - Moved tests that don't require harness into the fast group.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31472
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (setTimelineProfilingEnabledCallback):
+        (closeWebInspectorCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (shouldOpenWebInspector):
+        (runTest):
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setTimelineProfilingEnabled):
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (shouldOpenWebInspector):
+        (runTest):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::setTimelineProfilingEnabled):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (shouldOpenWebInspector):
+        (runTest):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::setTimelineProfilingEnabled):
+
+2009-11-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect use of JavaScriptCore API in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=31577
+
+        Return undefined rather than a literal null.
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (setSelectedTextRangeCallback):
+        (incrementCallback):
+        (decrementCallback):
+        (showMenuCallback):
+
+2009-11-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: aria-labelledby duplicates some of its WAI-ARIA label
+        https://bugs.webkit.org/show_bug.cgi?id=31565
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (titleUIElementCallback):
+        (getIsValidCallback):
+        (AccessibilityUIElement::getJSClass):
+
+2009-11-16  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        r50942 broke output from created windows. Make the
+        m_enableTextOutput a member of the DRT and not the
+        WebPage.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::WebPage):
+        (WebCore::WebPage::javaScriptAlert):
+        (WebCore::WebPage::javaScriptConsoleMessage):
+        (WebCore::WebPage::javaScriptConfirm):
+        (WebCore::WebPage::javaScriptPrompt):
+        (WebCore::WebPage::acceptNavigationRequest):
+        (WebCore::DumpRenderTree::DumpRenderTree):
+        (WebCore::DumpRenderTree::open):
+        (WebCore::DumpRenderTree::createWindow):
+        * DumpRenderTree/qt/DumpRenderTree.h:
+        (WebCore::DumpRenderTree::setTextOutputEnabled):
+        (WebCore::DumpRenderTree::isTextOutputEnabled):
+        (WebCore::WebPage::shouldInterruptJavaScript):
+        (WebCore::WebPage::isTextOutputEnabled):
+        (WebCore::WebPage::setViewGeometry):
+
+2009-11-16  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Moved DumpRenderTree/gtk/TestNetscapePlugin to DumpRenderTree/unix/TestNetscapePlugin
+        as the implementation is being used by at least Qt and Gtk+.
+
+        Update buildsystems as well.
+
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
+        * DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h:
+        * DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h:
+        * DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h:
+        * DumpRenderTree/unix/TestNetscapePlugin/TestNetscapePlugin.cpp:
+        * GNUmakefile.am:
+
+2009-11-16  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Disable wss until all platforms support pyOpenSSL
+
+        https://bugs.webkit.org/show_bug.cgi?id=31479
+
+        * Scripts/run-webkit-tests:
+
+2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Implement load error pages support for Qt's DRT.
+        https://bugs.webkit.org/show_bug.cgi?id=31509
+
+        For now, it will not be a default feature, and layout tests
+        that want to make use of this have to explicitily call
+        'handleErrorPages();' for the test source.
+
+        Any of the other DumpRenderTree's (mac, win and gtk)
+        support handling error pages. Qt's will be the first.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::supportsExtension):
+        (WebCore::WebPage::extension):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::reset):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        (LayoutTestController::shouldHandleErrorPages):
+        (LayoutTestController::handleErrorPages):
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename the --commit-queue flag on land-* now that the commit-queue needs no special treatment
+        https://bugs.webkit.org/show_bug.cgi?id=31549
+
+        Renamed --commit-queue to --non-interactive in most places
+        and remove the code in land-patches which is no longer needed.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        The commit-queue should use land-attachment
+        https://bugs.webkit.org/show_bug.cgi?id=31548
+
+        * Scripts/bugzilla-tool:
+
+2009-11-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Convert CommitQueue over to PatchCollection
+        https://bugs.webkit.org/show_bug.cgi?id=31547
+
+        Also fixes a bug in workqueue and adds a test!
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/workqueue.py:
+        * Scripts/modules/workqueue_unittest.py:
+
+2009-11-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move StyleQueue over to using PatchCollection
+        https://bugs.webkit.org/show_bug.cgi?id=31544
+
+        That's what the class it's for.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/patchcollection.py:
+        * Scripts/modules/patchcollection_unittest.py:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool needs a land-attachment command
+        https://bugs.webkit.org/show_bug.cgi?id=31546
+
+        * Scripts/bugzilla-tool:
+         - Move all the logic into AbstractLandingCommand and
+           add a new LandAttachment command subclass.
+         - Split out _collect_patches_by_bug logging from _fetch_list_of_patches_to_land.
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move more patch-landing code into WebKitLandingScripts in preparation for land-attachment
+        https://bugs.webkit.org/show_bug.cgi?id=31543
+
+        Just moving code and updating the one caller to use WebKitLandingScripts instead of 'self'.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Disable the style queue from posting to the commit queue status page.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement PatchCollection
+        https://bugs.webkit.org/show_bug.cgi?id=31541
+
+        This class holds a set of patches and lets clients iterate through
+        them.  Optionally, clients can install a filter.
+
+        * Scripts/modules/patchcollection.py: Added.
+        * Scripts/modules/patchcollection_unittest.py: Added.
+        * Scripts/run-webkit-unittests:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool land-patches will close bugs with patches r=?
+        https://bugs.webkit.org/show_bug.cgi?id=28230
+
+        The commit-queue shouldn't close patches with outstanding reviews on them,
+        even if many reviewers seem to be against multi-patch bugs.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool check-style should work with attachment ids instead of bug ids
+        https://bugs.webkit.org/show_bug.cgi?id=31540
+
+        * Scripts/bugzilla-tool:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        WorkQueue is the only place that should know about special exit codes
+        https://bugs.webkit.org/show_bug.cgi?id=31534
+
+        Move LandPatchesFromBugs.handled_error to WorkQueue.exit_after_handled_error
+        and add tests for handling exit codes.
+        I also cleaned up workqueue_unittest.py more.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/workqueue.py:
+        * Scripts/modules/workqueue_unittest.py:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Re-factor workqueue_unittest to allow for more than one test.
+        https://bugs.webkit.org/show_bug.cgi?id=31535
+
+        * Scripts/modules/workqueue_unittest.py:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        land-patches needs to be re-factored into smaller chunks
+        https://bugs.webkit.org/show_bug.cgi?id=31532
+
+        * Scripts/bugzilla-tool: fix a couple obvious typos.
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        land-patches needs to be re-factored into smaller chunks
+        https://bugs.webkit.org/show_bug.cgi?id=31532
+
+        The next patch will move these methods into WebKitLandingScripts.
+
+        * Scripts/bugzilla-tool:
+         - Split out _land_patch and _close_bug_if_no_active_patches.
+
+2009-11-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix silly copy-and-paste code.  I am a terrible coder.
+
+        * Scripts/modules/bugzilla.py:
+
+2009-11-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement a StyleQueue
+        https://bugs.webkit.org/show_bug.cgi?id=31537
+
+        The first iteration of the style queue only produces output locally.
+        There is also a limit of 10 patches because it's not that useful to
+        iterate through the entire review queue at this point.  We can remove
+        the limit later.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/bugzilla.py:
+
+2009-11-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Unit test WorkQueue
+        https://bugs.webkit.org/show_bug.cgi?id=31531
+
+        Adds basic unit testing for WorkQueue.  Just runs through one cycle.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/statusbot.py:
+        * Scripts/modules/workqueue.py:
+        * Scripts/modules/workqueue_unittest.py: Added.
+        * Scripts/run-webkit-unittests:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool land-diff should know how to parse bug ids out of ChangeLogs
+        https://bugs.webkit.org/show_bug.cgi?id=31530
+
+        * Scripts/bugzilla-tool:
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool needs apply-attachment
+        https://bugs.webkit.org/show_bug.cgi?id=31528
+
+        * Scripts/bugzilla-tool:
+         - Add ApplyAttachment command.
+         - Abstract applying code into WebKitApplyingScripts.
+         - Rename setup_for_landing to prepare_clean_working_directory and make local_commit checking optional.
+        * Scripts/modules/bugzilla.py:
+         - Add fetch_attachment and bug_id_for_attachment_id.
+        * Scripts/modules/bugzilla_unittest.py:
+         - Add test for new parsing.
+         - Fix previous parsing test which broke with Adam's check-style patch (bug 31515).
+
+2009-11-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Document check-style's use of force_clean.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/scm.py:
+
+2009-11-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move WorkQueue to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=31529
+
+        WorkQueue and WorkQueueDelegate are separate concerns from
+        bugzilla-tool.  Also added a missing include to logging.py.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/logging.py:
+        * Scripts/modules/workqueue.py:
+
+2009-11-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move OutputTee to logging.py.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/logging.py:
+
+2009-11-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Refactor bugzilla-tool to allow for multiple queues
+        https://bugs.webkit.org/show_bug.cgi?id=31513
+
+        Divide the commit queue class into three class to make creating
+        additional queues easier.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-15  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        svn-apply may not handle git patches created by bugzilla-tool
+        https://bugs.webkit.org/show_bug.cgi?id=31457
+
+        * Scripts/modules/scm.py:
+        * Scripts/modules/scm_unittest.py:
+
+2009-11-15  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        bugzilla-tool should post git binary diff
+        https://bugs.webkit.org/show_bug.cgi?id=31458
+
+        Add --binary option to Git.create_patch.
+
+        * Scripts/modules/scm.py:
+        * Scripts/modules/scm_unittest.py:
+
+2009-11-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add bugzilla-tool check-style
+        https://bugs.webkit.org/show_bug.cgi?id=31515
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/bugzilla.py:
+
+2009-11-13  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make the Qt Linux only --valgrind feature, suppress errors
+        defined in the SuppressedValgrindErrors file.
+
+        * Scripts/run-webkit-tests:
+
+2009-11-13  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Set the locale to C and not to the current one in use on the system.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Add support for
+        http/tests/security/isolatedWorld/didClearWindowObject.html
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Reviewed by Dave Hyatt.
+
+        * DumpRenderTree/mac/DumpRenderTreeMac.h: Declared worldIDForWorld.
+
+        * DumpRenderTree/mac/FrameLoadDelegate.mm:
+        (-[FrameLoadDelegate didClearWindowObjectInStandardWorldForFrame:]):
+        Added. Moved code here from -webView:didClearWindowObject:forFrame:.
+        (-[FrameLoadDelegate didClearWindowObjectForFrame:inIsolatedWorld:]):
+        Added. Sets a __worldID property on the global object whose value is
+        the ID of this world.
+        (-[FrameLoadDelegate webView:didClearWindowObjectForFrame:inScriptWorld:]):
+        Respond to this new delegate callback by calling through to one of the
+        above new methods.
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (worldMap): Added. Returns a HashMap containing all the worlds we've
+        created.
+        (worldIDForWorld): Added. Returns the ID for this world, or 0 if we
+        haven't kept track of this world.
+        (LayoutTestController::evaluateScriptInIsolatedWorld): Use worldMap()
+        instead of declaring our own.
+
+        * DumpRenderTree/win/DumpRenderTreeWin.h: Declared worldIDForWorld.
+
+        * DumpRenderTree/win/FrameLoadDelegate.cpp:
+        (FrameLoadDelegate::didClearWindowObject): Moved code from hear to
+        didClearWindowObjectForFrameInStandardWorld.
+        (FrameLoadDelegate::didClearWindowObjectForFrameInScriptWorld):
+        Respond to this new delegate callback by calling through to one of the
+        below new methods.
+        (FrameLoadDelegate::didClearWindowObjectForFrameInIsolatedWorld):
+        Added. Sets a __worldID property on the gobal object whose value is
+        the ID of this world.
+        (FrameLoadDelegate::didClearWindowObjectForFrameInStandardWorld):
+        Added. Moved code here from didClearWindowObject.
+
+        * DumpRenderTree/win/FrameLoadDelegate.h: Added the
+        didClearWindowObjectForFrame* functions.
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (worldMap): Added. Returns a HashMap containing all the worlds we've
+        created.
+        (worldIDForWorld): Added. Returns the ID of this world, or 0 if we
+        haven't kept track of this world.
+        (LayoutTestController::evaluateScriptInIsolatedWorld): Use worldMap()
+        instead of declaring our own.
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Finish replacing worldIDs with world objects
+
+        The only remaining use of worldIDs was in a method only used by DRT
+        for the isolated worlds tests.
+
+        Fixes <http://webkit.org/b/31414> Replace worldIDs with world objects
+
+        Reviewed by Mark Rowe.
+
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::evaluateScriptInIsolatedWorld):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::evaluateScriptInIsolatedWorld):
+        Updated for changes to WebFrame. Now holds the map of worldID -> world
+        at this level instead of making WebKit do it.
+
+2009-11-13  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Ensure the DRT does not output anything until first test is run
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        * DumpRenderTree/qt/DumpRenderTree.h:
+
+2009-11-13  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Clear the undo stack in before each new test run.
+
+        Locally fixes 3 incorrect layouts, 9 timeouts and 7 crashes.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+
+2009-11-13  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add WebKitUsesPageCachePreferenceKey overriding support to DRT's LayoutTestController.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::WebPage::resetSettings):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::overridePreference):
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Update committers.py based on svn records
+        https://bugs.webkit.org/show_bug.cgi?id=31366
+
+        This list was generated using validate-committer-lists from
+        https://bugs.webkit.org/show_bug.cgi?id=30970
+        and makes committers.py current for committers who have
+        committed in the last 3 years.
+
+        * Scripts/modules/committers.py:
+
+2009-11-12  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        The document-open.html test was flaky at times. The test invokes the layout test plugin
+        which in its destroy stream handler opens a new document. This basically tears down the
+        stream and the associated plugin instance. The pluginLog function in the layout test
+        plugin attempts to retrieve the window script object on a torn down plugin instance
+        which crashed consistently on windows in the debugger. The functions which issue
+        these logs already have a valid window script object. We now have variants of the pluginLog
+        function which take in a window script object with and without variable arguments. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=31067
+
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp:
+        (pluginLogWithWindowObject):
+        (pluginLogWithWindowObjectVariableArgs):
+        (pluginLog):
+        (notifyTestCompletion):
+        (testDocumentOpen):
+        (testWindowOpen):
+
+2009-11-12  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30997
+        [Gtk] Implemment AtkDocument
+
+        Added testing support.
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        * DumpRenderTree/AccessibilityUIElement.h:
+        (getDocumentEncodingCallback):
+        (getDocumentURICallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::documentEncoding):
+        (AccessibilityUIElement::documentURI):
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::addUserScript):
+        (LayoutTestController::addUserStyleSheet):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::addUserScript):
+        (LayoutTestController::addUserStyleSheet):
+        Changed these functions to create a new WebJSWorld each time they're
+        called and to pass that world to WebKit.
+
+2009-11-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        need to implement aria tree roles
+        https://bugs.webkit.org/show_bug.cgi?id=31284
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (disclosedRowAtIndexCallback):
+        (selectedRowAtIndexCallback):
+        (isEqualCallback):
+        (isAttributeSettableCallback):
+        (isActionSupportedCallback):
+        (disclosedByRowCallback):
+        (hierarchicalLevelCallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        (AccessibilityUIElement::isEqual):
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::hierarchicalLevel):
+        (AccessibilityUIElement::disclosedRowAtIndex):
+        (AccessibilityUIElement::selectedRowAtIndex):
+        (AccessibilityUIElement::disclosedByRow):
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::getChildAtIndex):
+        (AccessibilityUIElement::disclosedRowAtIndex):
+        (AccessibilityUIElement::selectedRowAtIndex):
+        (AccessibilityUIElement::titleUIElement):
+        (AccessibilityUIElement::parentElement):
+        (AccessibilityUIElement::disclosedByRow):
+        (AccessibilityUIElement::hierarchicalLevel):
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::hierarchicalLevel):
+        (AccessibilityUIElement::disclosedRowAtIndex):
+        (AccessibilityUIElement::selectedRowAtIndex):
+        (AccessibilityUIElement::disclosedByRow):
+
+2009-11-11  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        svn-apply can not handle git binary diffs
+        https://bugs.webkit.org/show_bug.cgi?id=26830
+
+        Support "literal" type git binary diffs.
+
+        * Scripts/VCSUtils.pm:
+        * Scripts/modules/scm_unittest.py:
+        * Scripts/svn-apply:
+
+2009-11-11  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, removing duplicate entry for myself in committers.py.
+
+        * Scripts/modules/committers.py:
+
+2009-11-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31200
+        Tests in http/tests/security/mixedContent start to fail when new tests are added
+
+        * DumpRenderTree/mac/DumpRenderTree.mm: (dumpRenderTree): Added a workaround for Tiger bug.
+
+2009-11-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        Create, and display a window for the inspector, for inspector
+        tests.
+
+        Need to also show/hide the inspector window to avoid having
+        problems with code assuming it is realized
+        https://bugs.webkit.org/show_bug.cgi?id=31347
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (webInspectorShowWindow):
+        (webInspectorCloseWindow):
+        (webInspectorInspectWebView):
+        (createWebView):
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed Qt buildbot fix.
+
+        My previous fix was wrong, so revert that change and fix it by
+        returning when the document of the frame has no document element.
+        Idea is borrowed from mac and win DRT.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::dumpFramesAsText):
+
+2009-11-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed byg Kenneth Rohde Christiansen.
+
+        Update Kenneth's committer record to include the email he
+        uses on lists.webkit.org.
+
+        * Scripts/modules/committers.py:
+
+2009-11-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Several committers use separate email addresses for bugzilla and svn.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=31364
+
+        Update records for existing committers to include email addresses
+        used in svn.webkit.org and lists.webkit.org.
+        Most committers use the same email address in all 3 places, but some use
+        separate addresses.  committers.py needs record of each of these addresses.
+
+        * Scripts/modules/committers.py:
+
+2009-11-11  Eric Seidel  <eric@webkit.org>
+
+        No review, adding second email address for an existing committer.
+
+        Add Yong Li's second bugzilla account to his committer record.
+        See: https://bugs.webkit.org/show_bug.cgi?id=27371#c27
+
+        * Scripts/modules/committers.py:
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        If the frame has no innerText don't append it, and
+        do not add a newline which breaks some cross platform
+        results.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::dumpFramesAsText):
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement missing functionality in the Gtk/Qt TestNetscapePlugin.
+
+        * DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp:
+        (webkit_test_plugin_new_instance):
+        (webkit_test_plugin_destroy_instance):
+        (webkit_test_plugin_destroy_stream):
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Implement the functionality needed by plugins/window-open.html
+
+        * DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp:
+        (webkit_test_plugin_new_instance):
+        (webkit_test_plugin_set_window):
+
+2009-11-11  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Force -graphicssystem raster and -style windows when running DRT
+
+        * DumpRenderTree/qt/main.cpp:
+        * Scripts/run-webkit-tests:
+
+2009-11-11  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compute correct library paths for Qt
+
+        * Scripts/webkitdirs.pm:
+
+2009-11-10  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <http://webkit.org/b/31200> Tests in http/tests/security/mixedContent start to fail when new tests are added
+
+        The first request to an HTTPS URL results in didFailProvisionalLoadWithError being called with an error
+        about the validity of the self-signed certificates used in the regression tests.  We would then add the
+        host to the ignore list for SSL certificate errors and retry the request.  If this happened during a test
+        that had enabled frame load delegate logging this would result in extra log messages being generated,
+        causing the test to fail.
+
+        We address this by explicitly ignoring SSL certificate errors for localhost and 127.0.0.1 before running any
+        tests.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (dumpRenderTree):
+        * DumpRenderTree/mac/FrameLoadDelegate.mm:
+        (-[FrameLoadDelegate webView:didFailProvisionalLoadWithError:forFrame:]):
+
+2009-11-10  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove obsolete scrollbar policy settings from DRT constructor.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::DumpRenderTree):
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Remove WebSocket configuration from WebKitWebSettings
+        https://bugs.webkit.org/show_bug.cgi?id=31244
+
+        Follow-up of r50724. Don't set the enable-web-socket property
+        anymore.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename 3D Canvas related classes to use WebGL prefix
+        https://bugs.webkit.org/show_bug.cgi?id=29095
+
+        Checkin new version of do-webcore-rename used to do the WebGL type rename,
+        and upate webkitdirs script to new method of testing for WebGL.
+
+        * Scripts/do-webcore-rename:
+        * Scripts/webkitdirs.pm:
+
+2009-11-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make do-webcore-rename work with git.
+
+        * Scripts/do-webcore-rename:
+
+2009-11-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Adding Kenneth to the reviewers list.
+
+        * Scripts/modules/committers.py:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Expose Page::tabKeyCyclesThroughElements in the API
+        https://bugs.webkit.org/show_bug.cgi?id=30482
+
+        LayoutTestControllerGtk now uses the exposed
+        Page::tabKeyCyclesThroughElements API
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setTabKeyCyclesThroughElements):
+
+2009-11-08  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Added support for key code 8 (backspace) in EventSenderQt.
+        This helps to pass the test case below. Also replaced hardcoded
+        code numbers with defined constants.
+        https://bugs.webkit.org/show_bug.cgi?id=31185
+        
+        Test: editing/undo/undo-deleteWord.html
+
+        * DumpRenderTree/qt/EventSenderQt.cpp:
+        (EventSender::keyDown):
+
+2009-11-07  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] [DRT] Fix wrong logic in LayoutTestController processWork
+        https://bugs.webkit.org/show_bug.cgi?id=31164
+
+        Fixed wrong logic to assume WorkQueue is done in QT's DRT.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::processWork):
+
+2009-11-05  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt][DRT] Replace queueScript by queueNonLoadingScript and queueLoadingScript method
+        https://bugs.webkit.org/show_bug.cgi?id=31158
+
+        By invoking a script queue'd by queueScript(), 'true' was beeing returned
+        always, which from WorkQueue prospective means that a load has been started
+        and the queue processing should stop and wait for the load to finish.
+        Spinning it off into a loading and a non-loading variants was the solution
+        adopted by Mac's DRT to work around this problem. The former keeps returning
+        'true' while the later executes the script synchronously and returns 'false'
+        making it possible to the WorkQueue to proceed right away.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::processWork):
+        (LayoutTestController::queueLoadingScript):
+        (LayoutTestController::queueNonLoadingScript):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/qt/WorkQueueItem.h:
+        (LoadingScriptItem::LoadingScriptItem):
+        (LoadingScriptItem::invoke):
+        (NonLoadingScriptItem::NonLoadingScriptItem):
+        (NonLoadingScriptItem::invoke):
+
+2009-11-07  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Cameron Zwarich.
+
+        Invoke prepare-ChangeLog via an absolute path rather than assuming it can be found in PATH.
+
+        * Scripts/commit-log-editor:
+
+2009-11-07  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=28168>.
+        commit-log-editor does not support all the email address configurations that prepare-Changelog supports
+
+        Move logic for determining the name and email address to use in a ChangeLog entry from
+        prepare-ChangeLog to VCSUtils so that commit-log-editor can use it.  It wants to check
+        whether the author of the patch matches committer, and therefore needs access to the
+        email address that would be used in a ChangeLog entry.
+
+        Based on a patch by Pierre d'Herbemont.
+
+        * Scripts/VCSUtils.pm:
+        * Scripts/commit-log-editor:
+        * Scripts/prepare-ChangeLog:
+        * Scripts/webkitdirs.pm:
+
+2009-11-06  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added functionality to the layout test plugin to invoke document.open and
+        window.open with default arguments. The associated webkit bug is
+        https://bugs.webkit.org/show_bug.cgi?id=31067, which affects Chromium. Basically
+        window.open and document.open calls issued by NPAPI plugins via NPN_Invoke don't
+        work in Chromium (V8) if there is no calling javascript context. To achieve this
+        effect we invoke these functions in the layout test plugin in the NPP_SetWindow
+        for the window.open test case and in NPP_DestroyStream for the document.open test case.
+
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp:
+        (testDocumentOpen):
+        (testWindowOpen):
+        (pluginAllocate):
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h:
+        * DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp:
+        (NPP_New):
+        (NPP_SetWindow):
+        (NPP_DestroyStream):
+        * DumpRenderTree/win/TestNetscapePlugin/main.cpp:
+        (NPP_New):
+        (NPP_SetWindow):
+        (NPP_NewStream):
+        (NPP_DestroyStream):
+
+2009-11-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool crashed with exception
+        https://bugs.webkit.org/show_bug.cgi?id=31092
+
+        * Scripts/modules/bugzilla.py: Change a ',' to a '%' to fix the error.
+
+2009-11-04  Eric Seidel  <eric@webkit.org>
+
+        No review, just add a line which got left out of the patch uploaded for commit.
+
+        commit-queue is crashing when trying to reject patches after unknown failures
+        https://bugs.webkit.org/show_bug.cgi?id=31091
+
+        * Scripts/bugzilla-tool: Set bug_log = None after closing to we don't re-close and crash.
+
+2009-11-04  Adam Roben  <aroben@apple.com>
+
+        Remove bogus else clause in bugzilla-tool
+
+        Fixes <http://webkit.org/b/31125> REGRESSION (r47121): bugzilla-tool
+        create-bug raises exception after entering bug description
+
+        Reviewed by David Kilzer.
+
+        * Scripts/bugzilla-tool:
+        (CreateBug): else clauses are only hit if no exception is raised, so
+        it makes no sense to try to re-raise the exception in an else clause.
+        The exception will automatically be re-raised if it doesn't match any
+        of the except clauses, so we don't have to do anything special here at
+        all to get the desired behavior.
+
+2009-11-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        svn-apply's fixChangeLogPatch function seems broken
+        https://bugs.webkit.org/show_bug.cgi?id=30683
+
+        Update fixChangeLogPatch to be able to handle patches which
+        don't start at line 1.
+        Add unit tests for svn-apply to scm_unittest.py.
+
+        * Scripts/VCSUtils.pm:
+        * Scripts/modules/scm_unittest.py:
+
+2009-11-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Need to implement ARIA role="combobox"
+        https://bugs.webkit.org/show_bug.cgi?id=31096
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (showMenuCallback):
+        (getIsExpandedCallback):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::isExpanded):
+        (AccessibilityUIElement::showMenu):
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::isExpanded):
+        (AccessibilityUIElement::showMenu):
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::isSelected):
+        (AccessibilityUIElement::isExpanded):
+        (AccessibilityUIElement::showMenu):
+
+2009-11-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue is crashing when trying to reject patches after unknown failures
+        https://bugs.webkit.org/show_bug.cgi?id=31091
+
+        * Scripts/bugzilla-tool:
+         - patch['id'] was a copy/paste mistake.  This code has no 'patch' variable
+           so we have to find out what the current patch is by asking bugzilla again.
+         - Discovered that this code was also leaking file descriptors, so fixed that.
+
+2009-11-04  Adam Roben  <aroben@apple.com>
+
+        Make run-webkit-tests work for the Debug_Internal Windows
+        configuration
+
+        In Debug_Internal, DumpRenderTree.exe and ImageDiff.exe have no _debug
+        suffix.
+
+        Fixes <http://webkit.org/b/31123>.
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/run-webkit-tests: Don't add the _debug suffix in
+        Debug_Internal, either.
+
+2009-11-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        committers.py needs a way to store non-bugzilla email addresses
+        https://bugs.webkit.org/show_bug.cgi?id=31037
+
+        Make Committer and Reviewer constructors take a single email or a list of emails.
+        Change committer_by_bugzilla_email functions to committer_by_email to support lookup by any email.
+        Expose reviewers(), used by validate-committer-lists on bug 30970.
+
+        * Scripts/modules/committers.py:
+        * Scripts/modules/committers_unittest.py: Added tests for the new code.
+
+2009-11-03  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by David Levin.
+
+        Start/Stop Web Socket and Web Socket Secure servers for layout tests.
+        https://bugs.webkit.org/show_bug.cgi?id=27491
+
+        The test path determination logic is changed to handle websocket and websocket/ssl cases.
+        The logic for non-http (and now also non-websocket) tests is moved toward the end of the if-elsif statement.
+
+        Functions to start or stop Web Socket servers are added.
+
+        * Scripts/run-webkit-tests:
+
+2009-11-03  Eric Seidel  <eric@webkit.org>
+
+        No review, just changing wording of log message.
+
+        Change log string to say "failed" instead of "rejected"
+        when a commit fails due to an out of date checkout.
+        This makes grepping the commit-queue log for rejected patches easier.
+
+        * Scripts/bugzilla-tool:
+
+2009-11-03  Eric Seidel  <eric@webkit.org>
+
+        No review, adding commonly known committers missing from the file.
+
+        * Scripts/modules/committers.py: Add committers found by looking at SVN records.
+
+2009-11-03  Eric Seidel  <eric@webkit.org>
+
+        No review, just sort-order cleanup.
+
+        * Scripts/modules/committers.py: Sort committers/reviewers alphabetically.
+
+2009-11-03  Stephen White  <senorblanco@chromium.org>
+
+        (Unreviewed).
+
+        Add myself to committers.py.
+
+        * Scripts/modules/committers.py:
+
+2009-11-03  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollviier.
+
+        Add packaging scripts for Debian-based Linux distros.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31075
+
+        * wx/packaging/build-debian-installer.py: Added.
+        * wx/packaging/debian: Added.
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31070
+
+        Added an 'ondestroy' parameter to the test plug-in. When the plug-in is
+        destroyed, it executes the value of the 'ondestroy' parameter as a
+        script.
+
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp:
+        (pluginAllocate): Initialize onDestroy.
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h: Define
+        onDestroy.
+        * DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp:
+        (NPP_New): Set onDestroy to the value of the 'ondestroy' parameter, if
+        specified.
+        (NPP_Destroy): Execute the value of 'ondestroy' as a script.
+
+2009-11-02  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31035
+        [GTK] some accessibility tests hitting assertion in debug builds
+
+        Get the correct Gtk+ object before attempting to turn it into an AtkObject.
+
+        * DumpRenderTree/gtk/AccessibilityControllerGtk.cpp:
+        (AccessibilityController::rootElement):
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Support ARIA "tab" roles
+        https://bugs.webkit.org/show_bug.cgi?id=30842
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+
+2009-11-01  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Levin.
+
+        buildbots should use --exit-after-N-failures
+        https://bugs.webkit.org/show_bug.cgi?id=30809
+
+        Make the bots exit after 20 failures to prevent never-ending
+        test runs where every test spends a minute crashing.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        * DumpRenderTree/qt/main.cpp: 
+        (crashHandler): Mark function NO_RETURN
+
+2009-11-01  Jessie Berlin  <jberlin@webkit.org>
+
+        Adding myself to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-10-30  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Fix an issue that Adam noticed in DRT.
+
+        Reviewed by Darin Adler.
+
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::role):
+        Get the length of the role text, and create a buffer dynamically.
+
+2009-10-30  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r50105.
+        http://trac.webkit.org/changeset/50105
+
+        This commit was causing:
+        https://bugs.webkit.org/show_bug.cgi?id=30869
+        We'll re-implement the feature a different way.
+
+        * Scripts/bugzilla-tool:
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Test for MSAA: Accessibility of headings is not correct
+
+        https://bugs.webkit.org/show_bug.cgi?id=30937
+
+        Reviewed by Adam Roben.
+
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::role):
+        Allow the role returned to be a BSTR.
+        (AccessibilityUIElement::description):
+        Fix a copy/paste error.
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Test for MSAA: Accessibility of links is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=30928
+
+        Reviewed by Darin Adler.
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (getAccessibilityValueCallback):
+        Return the accessibility value.
+        (AccessibilityUIElement::getJSClass):
+        Added "accessibilityValue" value.
+
+        * DumpRenderTree/AccessibilityUIElement.h:
+
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::accessibilityValue):
+        Stubbed.
+
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::accessibilityValue):
+        Stubbed.
+
+        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
+        (AccessibilityUIElement::accessibilityValue):
+        Get the object's value, and return it as a JS string.
+
+2009-10-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Fix typo in command name used by wx build system.
+
+        * wx/build/build_utils.py:
+
+2009-10-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch v1 is a dumb default name for patches
+        https://bugs.webkit.org/show_bug.cgi?id=30952
+
+        Let's use "Patch" instead.
+
+        * Scripts/bugzilla-tool:
+
+2009-10-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Unreviewed trivial buildfix.
+
+        [Qt] Buildfix for r50333.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+
+2009-10-30  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Remove qt/WorkQueue.cpp|h in favor of platform independent WorkQueue
+        https://bugs.webkit.org/show_bug.cgi?id=30953
+
+        DumpRenderTree/WorkQueue and DumpRenderTree/qt/WorkQueue share mostly the
+        same implementation. Some Q_ASSERTs differ from ASSERTs basically. Patch
+        makes qt DRT to share this implementation (as gtk and mac ports do).
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/WorkQueue.cpp: Removed.
+        * DumpRenderTree/qt/WorkQueue.h: Removed.
+
+2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed potential buildbot fix.
+
+        Second try: Reset page history before running each test.
+
+        Apparently the QWebHistory::clear() keeps the current page
+        in history which is not what we want, so we not additionally
+        sets the history capacity to 0 (forces removing everything)
+        and then sets it back to its original value.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+
+2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed potential buildbot fix.
+
+        Reset page history before running each test.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * Scripts/build-webkit:
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix “Undefined subroutine” errors in svn-*apply by moving the removeEOL subroutine
+        from the two scripts that define it but don’t use it to the script that uses it but doesn’t
+        define it.
+
+        * Scripts/VCSUtils.pm:
+        * Scripts/svn-apply:
+        * Scripts/svn-unapply:
+
+2009-10-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Use the GTK+ main loop instead of rolling our own mini-version of
+        it.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (dump):
+        (runTest):
+        (webViewLoadFinished):
+
+2009-10-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Implement the Qt version of DRT dumpBackForwardList().
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::dumpHistoryItem):
+        (WebCore::DumpRenderTree::dumpBackForwardList):
+
+2009-10-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Implement DRT functionality for Qt introduced in
+        r28690 and r28705.
+
+        - Implemented pathToLocalResource which exposes the functionality of
+        converting a given unix path to the correct location on Windows.
+        - Implemented a way to remove machine-dependent information from paths
+        in layout test results.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::urlSuitableForTestResult):
+        (WebCore::WebPage::javaScriptConsoleMessage):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::pathToLocalResource):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
 2009-10-28  Roland Steiner  <rolandsteiner@chromium.org>
 
         Adding myself to the committers list.
diff --git a/WebKitTools/DumpRenderTree/AccessibilityController.cpp b/WebKitTools/DumpRenderTree/AccessibilityController.cpp
index af1daf6..d3688f4 100644
--- a/WebKitTools/DumpRenderTree/AccessibilityController.cpp
+++ b/WebKitTools/DumpRenderTree/AccessibilityController.cpp
@@ -48,7 +48,11 @@ static JSValueRef getRootElementCallback(JSContextRef context, JSObjectRef thisO
 void AccessibilityController::makeWindowObject(JSContextRef context, JSObjectRef windowObject, JSValueRef* exception)
 {
     JSRetainPtr<JSStringRef> accessibilityControllerStr(Adopt, JSStringCreateWithUTF8CString("accessibilityController"));
-    JSValueRef accessibilityControllerObject = JSObjectMake(context, getJSClass(), this);
+    
+    JSClassRef classRef = getJSClass();
+    JSValueRef accessibilityControllerObject = JSObjectMake(context, classRef, this);
+    JSClassRelease(classRef);
+
     JSObjectSetProperty(context, windowObject, accessibilityControllerStr.get(), accessibilityControllerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
 }
 
@@ -85,8 +89,7 @@ JSClassRef AccessibilityController::getJSClass()
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
     };
 
-    static JSClassRef accessibilityControllerClass = JSClassCreate(&classDefinition);
-    return accessibilityControllerClass;
+    return JSClassCreate(&classDefinition);
 }
 
 void AccessibilityController::resetToConsistentState()
diff --git a/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp b/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp
index 5958ccb..8c59252 100644
--- a/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp
+++ b/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp
@@ -161,6 +161,53 @@ static JSValueRef childAtIndexCallback(JSContextRef context, JSObjectRef functio
     return AccessibilityUIElement::makeJSAccessibilityUIElement(context, toAXElement(thisObject)->getChildAtIndex(indexNumber));
 }
 
+static JSValueRef disclosedRowAtIndexCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    int indexNumber = 0;
+    if (argumentCount == 1)
+        indexNumber = JSValueToNumber(context, arguments[0], exception);
+    
+    return AccessibilityUIElement::makeJSAccessibilityUIElement(context, toAXElement(thisObject)->disclosedRowAtIndex(indexNumber));
+}
+
+static JSValueRef ariaOwnsElementAtIndexCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    int indexNumber = 0;
+    if (argumentCount == 1)
+        indexNumber = JSValueToNumber(context, arguments[0], exception);
+    
+    return AccessibilityUIElement::makeJSAccessibilityUIElement(context, toAXElement(thisObject)->ariaOwnsElementAtIndex(indexNumber));
+}
+
+static JSValueRef ariaFlowToElementAtIndexCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    int indexNumber = 0;
+    if (argumentCount == 1)
+        indexNumber = JSValueToNumber(context, arguments[0], exception);
+    
+    return AccessibilityUIElement::makeJSAccessibilityUIElement(context, toAXElement(thisObject)->ariaFlowToElementAtIndex(indexNumber));
+}
+
+static JSValueRef selectedRowAtIndexCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    int indexNumber = 0;
+    if (argumentCount == 1)
+        indexNumber = JSValueToNumber(context, arguments[0], exception);
+    
+    return AccessibilityUIElement::makeJSAccessibilityUIElement(context, toAXElement(thisObject)->selectedRowAtIndex(indexNumber));
+}
+
+static JSValueRef isEqualCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    JSObjectRef otherElement = 0;
+    if (argumentCount == 1)
+        otherElement = JSValueToObject(context, arguments[0], exception);
+    else
+        return JSValueMakeBoolean(context, false);
+    
+    return JSValueMakeBoolean(context, toAXElement(thisObject)->isEqual(toAXElement(otherElement)));
+}
+
 static JSValueRef elementAtPointCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     int x = 0;
@@ -173,13 +220,23 @@ static JSValueRef elementAtPointCallback(JSContextRef context, JSObjectRef funct
     return AccessibilityUIElement::makeJSAccessibilityUIElement(context, toAXElement(thisObject)->elementAtPoint(x, y));
 }
 
+static JSValueRef isAttributeSupportedCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    JSStringRef attribute = 0;
+    if (argumentCount == 1)
+        attribute = JSValueToStringCopy(context, arguments[0], exception);    
+    JSValueRef result = JSValueMakeBoolean(context, toAXElement(thisObject)->isAttributeSupported(attribute));
+    if (attribute)
+        JSStringRelease(attribute);
+    return result;
+}
 
 static JSValueRef isAttributeSettableCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
-    JSStringRef attribute = NULL;
+    JSStringRef attribute = 0;
     if (argumentCount == 1)
         attribute = JSValueToStringCopy(context, arguments[0], exception);    
-    JSValueRef result = JSValueMakeNumber(context, toAXElement(thisObject)->isAttributeSettable(attribute));
+    JSValueRef result = JSValueMakeBoolean(context, toAXElement(thisObject)->isAttributeSettable(attribute));
     if (attribute)
         JSStringRelease(attribute);
     return result;
@@ -191,7 +248,7 @@ static JSValueRef isActionSupportedCallback(JSContextRef context, JSObjectRef fu
     JSStringRef action = 0;
     if (argumentCount == 1)
         action = JSValueToStringCopy(context, arguments[0], exception);    
-    JSValueRef result = JSValueMakeNumber(context, toAXElement(thisObject)->isActionSupported(action));
+    JSValueRef result = JSValueMakeBoolean(context, toAXElement(thisObject)->isActionSupported(action));
     if (action)
         JSStringRelease(action);
     return result;
@@ -199,7 +256,7 @@ static JSValueRef isActionSupportedCallback(JSContextRef context, JSObjectRef fu
 
 static JSValueRef attributeValueCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
-    JSStringRef attribute = NULL;
+    JSStringRef attribute = 0;
     if (argumentCount == 1)
         attribute = JSValueToStringCopy(context, arguments[0], exception);
     JSRetainPtr<JSStringRef> attributeValue(Adopt, toAXElement(thisObject)->attributeValue(attribute));
@@ -230,6 +287,11 @@ static JSValueRef parentElementCallback(JSContextRef context, JSObjectRef functi
     return AccessibilityUIElement::makeJSAccessibilityUIElement(context, toAXElement(thisObject)->parentElement());
 }
 
+static JSValueRef disclosedByRowCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    return AccessibilityUIElement::makeJSAccessibilityUIElement(context, toAXElement(thisObject)->disclosedByRow());
+}
+
 static JSValueRef setSelectedTextRangeCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     unsigned location = UINT_MAX, length = 0;
@@ -239,24 +301,51 @@ static JSValueRef setSelectedTextRangeCallback(JSContextRef context, JSObjectRef
     }
     
     toAXElement(thisObject)->setSelectedTextRange(location, length);
-    return 0;
+    return JSValueMakeUndefined(context);
 }
 
 static JSValueRef incrementCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     toAXElement(thisObject)->increment();
-    return 0;
+    return JSValueMakeUndefined(context);
 }
 
 static JSValueRef decrementCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     toAXElement(thisObject)->decrement();
-    return 0;
+    return JSValueMakeUndefined(context);
 }
 
+static JSValueRef showMenuCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    toAXElement(thisObject)->showMenu();
+    return JSValueMakeUndefined(context);
+}
 
 // Static Value Getters
 
+static JSValueRef getARIADropEffectsCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    JSRetainPtr<JSStringRef> dropEffects(Adopt, toAXElement(thisObject)->ariaDropEffects());
+    return JSValueMakeString(context, dropEffects.get());
+}
+
+static JSValueRef getARIAIsGrabbedCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    return JSValueMakeBoolean(context, toAXElement(thisObject)->ariaIsGrabbed());
+}
+
+static JSValueRef getIsValidCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    AccessibilityUIElement* uiElement = toAXElement(thisObject);
+    if (!uiElement->platformUIElement())
+        return JSValueMakeBoolean(context, false);
+    
+    // There might be other platform logic that one could check here...
+    
+    return JSValueMakeBoolean(context, true);
+}
+
 static JSValueRef getRoleCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
 {
     JSRetainPtr<JSStringRef> role(Adopt, toAXElement(thisObject)->role());
@@ -269,6 +358,12 @@ static JSValueRef getSubroleCallback(JSContextRef context, JSObjectRef thisObjec
     return JSValueMakeString(context, role.get());
 }
 
+static JSValueRef getRoleDescriptionCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    JSRetainPtr<JSStringRef> roleDesc(Adopt, toAXElement(thisObject)->roleDescription());
+    return JSValueMakeString(context, roleDesc.get());
+}
+
 static JSValueRef getTitleCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
 {
     JSRetainPtr<JSStringRef> title(Adopt, toAXElement(thisObject)->title());
@@ -281,12 +376,24 @@ static JSValueRef getDescriptionCallback(JSContextRef context, JSObjectRef thisO
     return JSValueMakeString(context, description.get());
 }
 
+static JSValueRef getStringValueCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    JSRetainPtr<JSStringRef> stringValue(Adopt, toAXElement(thisObject)->stringValue());
+    return JSValueMakeString(context, stringValue.get());
+}
+
 static JSValueRef getLanguageCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
 {
     JSRetainPtr<JSStringRef> language(Adopt, toAXElement(thisObject)->language());
     return JSValueMakeString(context, language.get());
 }
 
+static JSValueRef getOrientationCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    JSRetainPtr<JSStringRef> orientation(Adopt, toAXElement(thisObject)->orientation());
+    return JSValueMakeString(context, orientation.get());
+}
+
 static JSValueRef getChildrenCountCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
 {
     return JSValueMakeNumber(context, toAXElement(thisObject)->childrenCount());
@@ -358,12 +465,45 @@ static JSValueRef getIsRequiredCallback(JSContextRef context, JSObjectRef thisOb
     return JSValueMakeBoolean(context, toAXElement(thisObject)->isRequired());
 }
 
+static JSValueRef getIsSelectedCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    return JSValueMakeBoolean(context, toAXElement(thisObject)->isSelected());
+}
+
+static JSValueRef getIsExpandedCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    return JSValueMakeBoolean(context, toAXElement(thisObject)->isExpanded());
+}
+
+static JSValueRef hierarchicalLevelCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    return JSValueMakeNumber(context, toAXElement(thisObject)->hierarchicalLevel());
+}
+
 static JSValueRef getValueDescriptionCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
 {
     JSRetainPtr<JSStringRef> valueDescription(Adopt, toAXElement(thisObject)->valueDescription());
     return JSValueMakeString(context, valueDescription.get());
 }
 
+static JSValueRef getAccessibilityValueCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    JSRetainPtr<JSStringRef> accessibilityValue(Adopt, toAXElement(thisObject)->accessibilityValue());
+    return JSValueMakeString(context, accessibilityValue.get());
+}
+
+static JSValueRef getDocumentEncodingCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    JSRetainPtr<JSStringRef> documentEncoding(Adopt, toAXElement(thisObject)->documentEncoding());
+    return JSValueMakeString(context, documentEncoding.get());
+}
+
+static JSValueRef getDocumentURICallback(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    JSRetainPtr<JSStringRef> documentURI(Adopt, toAXElement(thisObject)->documentURI());
+    return JSValueMakeString(context, documentURI.get());
+}
+
 // Destruction
 
 static void finalize(JSObjectRef thisObject)
@@ -381,11 +521,14 @@ JSObjectRef AccessibilityUIElement::makeJSAccessibilityUIElement(JSContextRef co
 JSClassRef AccessibilityUIElement::getJSClass()
 {
     static JSStaticValue staticValues[] = {
+        { "accessibilityValue", getAccessibilityValueCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "role", getRoleCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "subrole", getSubroleCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "roleDescription", getRoleDescriptionCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "title", getTitleCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "description", getDescriptionCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "language", getLanguageCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "stringValue", getStringValueCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "x", getXCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "y", getYCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "width", getWidthCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -400,7 +543,16 @@ JSClassRef AccessibilityUIElement::getJSClass()
         { "selectedTextRange", getSelectedTextRangeCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "isEnabled", getIsEnabledCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "isRequired", getIsRequiredCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "isSelected", getIsSelectedCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "isExpanded", getIsExpandedCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "valueDescription", getValueDescriptionCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "hierarchicalLevel", hierarchicalLevelCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "documentEncoding", getDocumentEncodingCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "documentURI", getDocumentURICallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "isValid", getIsValidCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "orientation", getOrientationCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "ariaIsGrabbed", getARIAIsGrabbedCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "ariaDropEffects", getARIADropEffectsCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0, 0 }
     };
 
@@ -428,11 +580,19 @@ JSClassRef AccessibilityUIElement::getJSClass()
         { "titleUIElement", titleUIElementCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setSelectedTextRange", setSelectedTextRangeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "attributeValue", attributeValueCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "isAttributeSupported", isAttributeSupportedCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "isAttributeSettable", isAttributeSettableCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "isActionSupported", isActionSupportedCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "parentElement", parentElementCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "disclosedByRow", disclosedByRowCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "increment", incrementCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "decrement", decrementCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "showMenu", showMenuCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "disclosedRowAtIndex", disclosedRowAtIndexCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "ariaOwnsElementAtIndex", ariaOwnsElementAtIndexCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "ariaFlowToElementAtIndex", ariaFlowToElementAtIndexCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "selectedRowAtIndex", selectedRowAtIndexCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "isEqual", isEqualCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0 }
     };
 
diff --git a/WebKitTools/DumpRenderTree/AccessibilityUIElement.h b/WebKitTools/DumpRenderTree/AccessibilityUIElement.h
index fffdad8..9985523 100644
--- a/WebKitTools/DumpRenderTree/AccessibilityUIElement.h
+++ b/WebKitTools/DumpRenderTree/AccessibilityUIElement.h
@@ -61,6 +61,8 @@ public:
 
     static JSObjectRef makeJSAccessibilityUIElement(JSContextRef, const AccessibilityUIElement&);
 
+    bool isEqual(AccessibilityUIElement* otherElement) { return platformUIElement() == otherElement->platformUIElement(); }
+    
     void getLinkedUIElements(Vector<AccessibilityUIElement>&);
     void getDocumentLinks(Vector<AccessibilityUIElement>&);
     void getChildren(Vector<AccessibilityUIElement>&);
@@ -80,16 +82,22 @@ public:
     JSStringRef parameterizedAttributeNames();
     void increment();
     void decrement();
+    void showMenu();
 
     // Attributes - platform-independent implementations
     JSStringRef attributeValue(JSStringRef attribute);
+    bool isAttributeSupported(JSStringRef attribute);
     bool isAttributeSettable(JSStringRef attribute);
     bool isActionSupported(JSStringRef action);
     JSStringRef role();
     JSStringRef subrole();
+    JSStringRef roleDescription();
     JSStringRef title();
     JSStringRef description();
     JSStringRef language();
+    JSStringRef stringValue();
+    JSStringRef accessibilityValue() const;
+    JSStringRef orientation() const;
     double x();
     double y();
     double width();
@@ -102,8 +110,13 @@ public:
     JSStringRef selectedTextRange();
     bool isEnabled();
     bool isRequired() const;
+    bool isSelected() const;
+    bool isExpanded() const;
+    int hierarchicalLevel() const;
     double clickPointX();
     double clickPointY();
+    JSStringRef documentEncoding();
+    JSStringRef documentURI();
 
     // Table-specific attributes
     JSStringRef attributesOfColumnHeaders();
@@ -116,6 +129,20 @@ public:
     JSStringRef rowIndexRange();
     JSStringRef columnIndexRange();
     
+    // Tree/Outline specific attributes
+    AccessibilityUIElement selectedRowAtIndex(unsigned);
+    AccessibilityUIElement disclosedByRow();
+    AccessibilityUIElement disclosedRowAtIndex(unsigned);
+
+    // ARIA specific
+    AccessibilityUIElement ariaOwnsElementAtIndex(unsigned);
+    AccessibilityUIElement ariaFlowToElementAtIndex(unsigned);
+
+    // ARIA Drag and Drop
+    bool ariaIsGrabbed() const;
+    // A space concatentated string of all the drop effects.
+    JSStringRef ariaDropEffects() const;
+    
     // Parameterized attributes
     int lineForIndex(int);
     JSStringRef boundsForRange(unsigned location, unsigned length);
diff --git a/WebKitTools/DumpRenderTree/GCController.cpp b/WebKitTools/DumpRenderTree/GCController.cpp
index fe84a58..06a04fb 100644
--- a/WebKitTools/DumpRenderTree/GCController.cpp
+++ b/WebKitTools/DumpRenderTree/GCController.cpp
@@ -74,28 +74,15 @@ static JSValueRef getJSObjectCountCallback(JSContextRef context, JSObjectRef fun
 void GCController::makeWindowObject(JSContextRef context, JSObjectRef windowObject, JSValueRef* exception)
 {
     JSRetainPtr<JSStringRef> gcControllerStr(Adopt, JSStringCreateWithUTF8CString("GCController"));
-    JSValueRef gcControllerObject = JSObjectMake(context, getJSClass(), this);
-    JSObjectSetProperty(context, windowObject, gcControllerStr.get(), gcControllerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
-}
-
-JSClassRef GCController::getJSClass()
-{
-    static JSClassRef gcControllerClass = 0;
 
-    if (!gcControllerClass) {
-        JSStaticFunction* staticFunctions = GCController::staticFunctions();
-        JSClassDefinition classDefinition = {
-            0, kJSClassAttributeNone, "GCController", 0, 0, staticFunctions,
-            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
-        };
+    JSClassRef classRef = getJSClass();
+    JSValueRef gcControllerObject = JSObjectMake(context, classRef, this);
+    JSClassRelease(classRef);
 
-        gcControllerClass = JSClassCreate(&classDefinition);
-    }
-
-    return gcControllerClass;
+    JSObjectSetProperty(context, windowObject, gcControllerStr.get(), gcControllerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
 }
 
-JSStaticFunction* GCController::staticFunctions()
+JSClassRef GCController::getJSClass()
 {
     static JSStaticFunction staticFunctions[] = {
         { "collect", collectCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -104,5 +91,10 @@ JSStaticFunction* GCController::staticFunctions()
         { 0, 0, 0 }
     };
 
-    return staticFunctions;
+    static JSClassDefinition classDefinition = {
+        0, kJSClassAttributeNone, "GCController", 0, 0, staticFunctions,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+    };
+
+    return JSClassCreate(&classDefinition);
 }
diff --git a/WebKitTools/DumpRenderTree/GCController.h b/WebKitTools/DumpRenderTree/GCController.h
index 4284275..afc1de0 100644
--- a/WebKitTools/DumpRenderTree/GCController.h
+++ b/WebKitTools/DumpRenderTree/GCController.h
@@ -45,7 +45,6 @@ public:
 
 private:
     static JSClassRef getJSClass();
-    static JSStaticFunction* staticFunctions();
 };
 
 #endif // GCController_h
diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.cpp b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
index daf888f..572d610 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.cpp
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
@@ -838,6 +838,18 @@ static JSValueRef setXSSAuditorEnabledCallback(JSContextRef context, JSObjectRef
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef setAllowUniversalAccessFromFileURLsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Has mac & windows implementation
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setAllowUniversalAccessFromFileURLs(JSValueToBoolean(context, arguments[0]));
+
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef setTabKeyCyclesThroughElementsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has mac & windows implementation
@@ -850,6 +862,16 @@ static JSValueRef setTabKeyCyclesThroughElementsCallback(JSContextRef context, J
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef setTimelineProfilingEnabledCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setTimelineProfilingEnabled(JSValueToBoolean(context, arguments[0]));
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef setUseDashboardCompatibilityModeCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has mac implementation
@@ -979,6 +1001,7 @@ static JSValueRef showWebInspectorCallback(JSContextRef context, JSObjectRef fun
 static JSValueRef closeWebInspectorCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setTimelineProfilingEnabled(false);
     controller->closeWebInspector();
     return JSValueMakeUndefined(context);
 }
@@ -1050,6 +1073,22 @@ static JSValueRef pauseTransitionAtTimeOnElementWithIdCallback(JSContextRef cont
     return JSValueMakeBoolean(context, controller->pauseTransitionAtTimeOnElementWithId(propertyName.get(), time, elementId.get()));
 }
 
+static JSValueRef sampleSVGAnimationForElementAtTimeCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount != 3)
+        return JSValueMakeUndefined(context);
+
+    JSRetainPtr<JSStringRef> animationId(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+    double time = JSValueToNumber(context, arguments[1], exception);
+    ASSERT(!*exception);
+    JSRetainPtr<JSStringRef> elementId(Adopt, JSValueToStringCopy(context, arguments[2], exception));
+    ASSERT(!*exception);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeBoolean(context, controller->sampleSVGAnimationForElementAtTime(animationId.get(), time, elementId.get()));
+}
+
 static JSValueRef numberOfActiveAnimationsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     if (argumentCount != 0)
@@ -1150,26 +1189,24 @@ void LayoutTestController::makeWindowObject(JSContextRef context, JSObjectRef wi
 {
     JSRetainPtr<JSStringRef> layoutTestContollerStr(Adopt, JSStringCreateWithUTF8CString("layoutTestController"));
     ref();
-    JSValueRef layoutTestContollerObject = JSObjectMake(context, getJSClass(), this);
+
+    JSClassRef classRef = getJSClass();
+    JSValueRef layoutTestContollerObject = JSObjectMake(context, classRef, this);
+    JSClassRelease(classRef);
+
     JSObjectSetProperty(context, windowObject, layoutTestContollerStr.get(), layoutTestContollerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
 }
 
 JSClassRef LayoutTestController::getJSClass()
 {
-    static JSClassRef layoutTestControllerClass;
-
-    if (!layoutTestControllerClass) {
-        JSStaticValue* staticValues = LayoutTestController::staticValues();
-        JSStaticFunction* staticFunctions = LayoutTestController::staticFunctions();
-        JSClassDefinition classDefinition = {
-            0, kJSClassAttributeNone, "LayoutTestController", 0, staticValues, staticFunctions,
-            0, layoutTestControllerObjectFinalize, 0, 0, 0, 0, 0, 0, 0, 0, 0
-        };
-
-        layoutTestControllerClass = JSClassCreate(&classDefinition);
-    }
+    static JSStaticValue* staticValues = LayoutTestController::staticValues();
+    static JSStaticFunction* staticFunctions = LayoutTestController::staticFunctions();
+    static JSClassDefinition classDefinition = {
+        0, kJSClassAttributeNone, "LayoutTestController", 0, staticValues, staticFunctions,
+        0, layoutTestControllerObjectFinalize, 0, 0, 0, 0, 0, 0, 0, 0, 0
+    };
 
-    return layoutTestControllerClass;
+    return JSClassCreate(&classDefinition);
 }
 
 JSStaticValue* LayoutTestController::staticValues()
@@ -1227,6 +1264,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "pathToLocalResource", pathToLocalResourceCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pauseAnimationAtTimeOnElementWithId", pauseAnimationAtTimeOnElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pauseTransitionAtTimeOnElementWithId", pauseTransitionAtTimeOnElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "sampleSVGAnimationForElementAtTime", sampleSVGAnimationForElementAtTimeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "printToPDF", dumpAsPDFCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "queueBackNavigation", queueBackNavigationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "queueForwardNavigation", queueForwardNavigationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -1237,6 +1275,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "removeAllVisitedLinks", removeAllVisitedLinksCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "repaintSweepHorizontally", repaintSweepHorizontallyCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAcceptsEditing", setAcceptsEditingCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setAllowUniversalAccessFromFileURLs", setAllowUniversalAccessFromFileURLsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAlwaysAcceptCookies", setAlwaysAcceptCookiesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAppCacheMaximumSize", setAppCacheMaximumSizeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
         { "setAuthenticationPassword", setAuthenticationPasswordCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -1264,6 +1303,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "setSmartInsertDeleteEnabled", setSmartInsertDeleteEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setStopProvisionalFrameLoads", setStopProvisionalFrameLoadsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setTabKeyCyclesThroughElements", setTabKeyCyclesThroughElementsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setTimelineProfilingEnabled", setTimelineProfilingEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setUseDashboardCompatibilityMode", setUseDashboardCompatibilityModeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setUserStyleSheetEnabled", setUserStyleSheetEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setUserStyleSheetLocation", setUserStyleSheetLocationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.h b/WebKitTools/DumpRenderTree/LayoutTestController.h
index 79ffb99..7e18dce 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.h
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.h
@@ -67,6 +67,7 @@ public:
     void removeAllVisitedLinks();
     void setAcceptsEditing(bool acceptsEditing);
     void setAppCacheMaximumSize(unsigned long long quota);
+    void setAllowUniversalAccessFromFileURLs(bool);
     void setAuthorAndUserStylesEnabled(bool);
     void setCacheModel(int);
     void setCustomPolicyDelegate(bool setDelegate, bool permissive);
@@ -201,6 +202,7 @@ public:
     
     bool pauseAnimationAtTimeOnElementWithId(JSStringRef animationName, double time, JSStringRef elementId);
     bool pauseTransitionAtTimeOnElementWithId(JSStringRef propertyName, double time, JSStringRef elementId);
+    bool sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId);
     unsigned numberOfActiveAnimations() const;
 
     void whiteListAccessFromOrigin(JSStringRef sourceOrigin, JSStringRef destinationProtocol, JSStringRef destinationHost, bool allowDestinationSubdomains);
@@ -214,6 +216,7 @@ public:
 
     void showWebInspector();
     void closeWebInspector();
+    void setTimelineProfilingEnabled(bool enabled);
     void evaluateInWebInspector(long callId, JSStringRef script);
     void evaluateScriptInIsolatedWorld(unsigned worldId, JSObjectRef globalObject, JSStringRef script);
 
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp
index 14280ba..fa8aed1 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp
@@ -34,25 +34,12 @@
 #include <string.h>
 #include <stdlib.h>
 
-void pluginLog(NPP instance, const char* format, ...)
+// Helper function which takes in the plugin window object for logging to the console object.
+static void pluginLogWithWindowObject(NPObject* windowObject, NPP instance, const char* message)
 {
-    va_list args;
-    va_start(args, format);
-    char message[2048] = "PLUGIN: ";
-    vsprintf(message + strlen(message), format, args);
-    va_end(args);
-
-    NPObject* windowObject = 0;
-    NPError error = browser->getvalue(instance, NPNVWindowNPObject, &windowObject);
-    if (error != NPERR_NO_ERROR) {
-        fprintf(stderr, "Failed to retrieve window object while logging: %s\n", message);
-        return;
-    }
-
     NPVariant consoleVariant;
     if (!browser->getproperty(instance, windowObject, browser->getstringidentifier("console"), &consoleVariant)) {
         fprintf(stderr, "Failed to retrieve console object while logging: %s\n", message);
-        browser->releaseobject(windowObject);
         return;
     }
 
@@ -65,12 +52,43 @@ void pluginLog(NPP instance, const char* format, ...)
     if (!browser->invoke(instance, consoleObject, browser->getstringidentifier("log"), &messageVariant, 1, &result)) {
         fprintf(stderr, "Failed to invoke console.log while logging: %s\n", message);
         browser->releaseobject(consoleObject);
-        browser->releaseobject(windowObject);
         return;
     }
 
     browser->releasevariantvalue(&result);
     browser->releaseobject(consoleObject);
+}
+
+// Helper function which takes in the plugin window object for logging to the console object. This function supports variable
+// arguments.
+static void pluginLogWithWindowObjectVariableArgs(NPObject* windowObject, NPP instance, const char* format, ...)
+{
+    va_list args;
+    va_start(args, format);
+    char message[2048] = "PLUGIN: ";
+    vsprintf(message + strlen(message), format, args);
+    va_end(args);
+
+    pluginLogWithWindowObject(windowObject, instance, message);
+}
+             
+// Helper function to log to the console object.
+void pluginLog(NPP instance, const char* format, ...)
+{
+    va_list args;
+    va_start(args, format);
+    char message[2048] = "PLUGIN: ";
+    vsprintf(message + strlen(message), format, args);
+    va_end(args);
+
+    NPObject* windowObject = 0;
+    NPError error = browser->getvalue(instance, NPNVWindowNPObject, &windowObject);
+    if (error != NPERR_NO_ERROR) {
+        fprintf(stderr, "Failed to retrieve window object while logging: %s\n", message);
+        return;
+    }
+
+    pluginLogWithWindowObject(windowObject, instance, message);
     browser->releaseobject(windowObject);
 }
 
@@ -152,6 +170,8 @@ enum {
     ID_TEST_THROW_EXCEPTION_METHOD,
     ID_TEST_FAIL_METHOD,
     ID_DESTROY_NULL_STREAM,
+    ID_TEST_RELOAD_PLUGINS_NO_PAGES,
+    ID_TEST_RELOAD_PLUGINS_AND_PAGES,
     NUM_METHOD_IDENTIFIERS
 };
 
@@ -177,7 +197,9 @@ static const NPUTF8 *pluginMethodIdentifierNames[NUM_METHOD_IDENTIFIERS] = {
     "testConstruct",
     "testThrowException",
     "testFail",
-    "destroyNullStream"
+    "destroyNullStream",
+    "reloadPluginsNoPages",
+    "reloadPluginsAndPages"
 };
 
 static NPUTF8* createCStringFromNPVariant(const NPVariant* variant)
@@ -643,6 +665,76 @@ static bool testConstruct(PluginObject* obj, const NPVariant* args, uint32_t arg
     return browser->construct(obj->npp, NPVARIANT_TO_OBJECT(args[0]), args + 1, argCount - 1, result);
 }
 
+// Helper function to notify the layout test controller that the test completed.
+void notifyTestCompletion(NPP npp, NPObject* object)
+{
+    NPVariant result;
+    NPString script;
+    script.UTF8Characters = "javascript:window.layoutTestController.notifyDone();";
+    script.UTF8Length = strlen("javascript:window.layoutTestController.notifyDone();");
+    browser->evaluate(npp, object, &script, &result);
+    browser->releasevariantvalue(&result);
+}
+
+bool testDocumentOpen(NPP npp)
+{
+    NPIdentifier documentId = browser->getstringidentifier("document");
+    NPIdentifier openId = browser->getstringidentifier("open");
+
+    NPObject *windowObject = NULL;
+    browser->getvalue(npp, NPNVWindowNPObject, &windowObject);
+    if (!windowObject)
+        return false;
+
+    NPVariant docVariant;
+    browser->getproperty(npp, windowObject, documentId, &docVariant);
+    if (docVariant.type != NPVariantType_Object)
+        return false;
+
+    NPObject *documentObject = NPVARIANT_TO_OBJECT(docVariant);
+
+    NPVariant openArgs[2];
+    STRINGZ_TO_NPVARIANT("text/html", openArgs[0]);
+    STRINGZ_TO_NPVARIANT("_blank", openArgs[1]);
+
+    NPVariant result;
+    browser->invoke(npp, documentObject, openId, openArgs, 2, &result);
+    browser->releaseobject(documentObject);
+
+    if (result.type == NPVariantType_Object) {
+        pluginLogWithWindowObjectVariableArgs(windowObject, npp, "DOCUMENT OPEN SUCCESS");
+        notifyTestCompletion(npp, result.value.objectValue);
+        browser->releaseobject(result.value.objectValue);
+        return true;
+    }
+
+    return false;
+}
+
+bool testWindowOpen(NPP npp)
+{
+    NPIdentifier openId = browser->getstringidentifier("open");
+
+    NPObject *windowObject = NULL;
+    browser->getvalue(npp, NPNVWindowNPObject, &windowObject);
+    if (!windowObject)
+        return false;
+
+    NPVariant openArgs[2];
+    STRINGZ_TO_NPVARIANT("about:blank", openArgs[0]);
+    STRINGZ_TO_NPVARIANT("_blank", openArgs[1]);
+
+    NPVariant result;
+    browser->invoke(npp, windowObject, openId, openArgs, 2, &result);
+    if (result.type == NPVariantType_Object) {
+        pluginLogWithWindowObjectVariableArgs(windowObject, npp, "WINDOW OPEN SUCCESS");
+        notifyTestCompletion(npp, result.value.objectValue);
+        browser->releaseobject(result.value.objectValue);
+        return true;
+    }
+    return false;
+}
+
 static bool pluginInvoke(NPObject* header, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result)
 {
     PluginObject* plugin = reinterpret_cast<PluginObject*>(header);
@@ -691,6 +783,13 @@ static bool pluginInvoke(NPObject* header, NPIdentifier name, const NPVariant* a
         browser->invoke(plugin->npp, windowScriptObject, name, args, argCount, result);
     } else if (name == pluginMethodIdentifiers[ID_DESTROY_NULL_STREAM]) 
         return destroyNullStream(plugin, args, argCount, result);
+    else if (name == pluginMethodIdentifiers[ID_TEST_RELOAD_PLUGINS_NO_PAGES]) {
+        browser->reloadplugins(false);
+        return true;
+    } else if (name == pluginMethodIdentifiers[ID_TEST_RELOAD_PLUGINS_AND_PAGES]) {
+        browser->reloadplugins(true);
+        return true;
+    }
     
     return false;
 }
@@ -721,6 +820,7 @@ static NPObject *pluginAllocate(NPP npp, NPClass *theClass)
     newInstance->eventLogging = FALSE;
     newInstance->onStreamLoad = 0;
     newInstance->onStreamDestroy = 0;
+    newInstance->onDestroy = 0;
     newInstance->onURLNotify = 0;
     newInstance->logDestroy = FALSE;
     newInstance->logSetWindow = FALSE;
@@ -732,6 +832,9 @@ static NPObject *pluginAllocate(NPP npp, NPClass *theClass)
     newInstance->lastUrl = NULL;
     newInstance->lastHeaders = NULL;
 
+    newInstance->testDocumentOpenInDestroyStream = FALSE;
+    newInstance->testWindowOpen = FALSE;
+
     return (NPObject*)newInstance;
 }
 
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h
index 7437d04..157a1d2 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h
@@ -38,8 +38,11 @@ typedef struct {
     NPBool cachedPrivateBrowsingMode;
     NPObject* testObject;
     NPStream* stream;
+    NPBool testDocumentOpenInDestroyStream;
+    NPBool testWindowOpen;
     char* onStreamLoad;
     char* onStreamDestroy;
+    char* onDestroy;
     char* onURLNotify;
     char* firstUrl;
     char* firstHeaders;
@@ -55,3 +58,5 @@ extern void handleCallback(PluginObject* object, const char *url, NPReason reaso
 extern void notifyStream(PluginObject* object, const char *url, const char *headers);
 extern void testNPRuntime(NPP npp);
 extern void pluginLog(NPP instance, const char* format, ...);
+extern bool testDocumentOpen(NPP npp);
+extern bool testWindowOpen(NPP npp);
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp
index 125d2e8..5883ffb 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp
@@ -105,6 +105,12 @@ NPError NPP_New(NPMIMEType pluginType, NPP instance, uint16 mode, int16 argc, ch
                     pluginLog(instance, "src: %s", argv[i]);
         } else if (strcasecmp(argn[i], "cleardocumentduringnew") == 0)
             executeScript(obj, "document.body.innerHTML = ''");
+        else if (!strcasecmp(argn[i], "ondestroy"))
+            obj->onDestroy = strdup(argv[i]);
+        else if (strcasecmp(argn[i], "testdocumentopenindestroystream") == 0)
+            obj->testDocumentOpenInDestroyStream = TRUE;
+        else if (strcasecmp(argn[i], "testwindowopen") == 0)
+            obj->testWindowOpen = TRUE;
     }
         
 #ifndef NP_NO_CARBON
@@ -140,6 +146,11 @@ NPError NPP_Destroy(NPP instance, NPSavedData **save)
 {
     PluginObject* obj = static_cast<PluginObject*>(instance->pdata);
     if (obj) {
+        if (obj->onDestroy) {
+            executeScript(obj, obj->onDestroy);
+            free(obj->onDestroy);
+        }
+
         if (obj->onStreamLoad)
             free(obj->onStreamLoad);
 
@@ -166,6 +177,11 @@ NPError NPP_SetWindow(NPP instance, NPWindow *window)
             pluginLog(instance, "NPP_SetWindow: %d %d", (int)window->width, (int)window->height);
             obj->logSetWindow = false;
         }
+
+        if (obj->testWindowOpen) {
+            testWindowOpen(instance);
+            obj->testWindowOpen = FALSE;
+        }
     }
     
     return NPERR_NO_ERROR;
@@ -210,6 +226,11 @@ NPError NPP_DestroyStream(NPP instance, NPStream *stream, NPReason reason)
     if (obj->onStreamDestroy)
         executeScript(obj, obj->onStreamDestroy);
 
+    if (obj->testDocumentOpenInDestroyStream) {
+        testDocumentOpen(instance);
+        obj->testDocumentOpenInDestroyStream = FALSE;
+    }
+
     return NPERR_NO_ERROR;
 }
 
diff --git a/WebKitTools/DumpRenderTree/gtk/AccessibilityControllerGtk.cpp b/WebKitTools/DumpRenderTree/gtk/AccessibilityControllerGtk.cpp
index 593f2eb..df06cea 100644
--- a/WebKitTools/DumpRenderTree/gtk/AccessibilityControllerGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/AccessibilityControllerGtk.cpp
@@ -58,7 +58,11 @@ AccessibilityUIElement AccessibilityController::focusedElement()
 AccessibilityUIElement AccessibilityController::rootElement()
 {
     WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
-    AtkObject* axObject = gtk_widget_get_accessible(GTK_WIDGET(view));
+
+    // The presumed, desired rootElement is the parent of the web view.
+    GtkWidget* webViewParent = gtk_widget_get_parent(GTK_WIDGET(view));
+    AtkObject* axObject = gtk_widget_get_accessible(webViewParent);
+ 
     return AccessibilityUIElement(axObject);
 }
 
diff --git a/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp b/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
index 9aa31a8..13d313d 100644
--- a/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
@@ -161,6 +161,11 @@ JSStringRef AccessibilityUIElement::subrole()
     return 0;
 }
 
+JSStringRef AccessibilityUIElement::roleDescription()
+{
+    return 0;
+}
+
 JSStringRef AccessibilityUIElement::title()
 {
     const gchar* name = atk_object_get_name(ATK_OBJECT(m_element));
@@ -181,6 +186,12 @@ JSStringRef AccessibilityUIElement::description()
     return JSStringCreateWithUTF8CString(description);
 }
 
+JSStringRef AccessibilityUIElement::stringValue()
+{
+    // FIXME: implement
+    return JSStringCreateWithCharacters(0, 0);
+}
+
 JSStringRef AccessibilityUIElement::language()
 {
     // FIXME: implement
@@ -233,6 +244,10 @@ double AccessibilityUIElement::clickPointY()
     return 0.f;
 }
 
+JSStringRef AccessibilityUIElement::orientation() const
+{
+    return 0;
+}
 
 double AccessibilityUIElement::intValue()
 {
@@ -316,6 +331,34 @@ bool AccessibilityUIElement::isRequired() const
     return false;
 }
 
+bool AccessibilityUIElement::isSelected() const
+{
+    // FIXME: implement
+    return false;
+}
+
+int AccessibilityUIElement::hierarchicalLevel() const
+{
+    // FIXME: implement
+    return 0;
+}
+
+bool AccessibilityUIElement::ariaIsGrabbed() const
+{
+    return false;
+}
+ 
+JSStringRef AccessibilityUIElement::ariaDropEffects() const
+{   
+    return 0; 
+}
+
+bool AccessibilityUIElement::isExpanded() const
+{
+    // FIXME: implement
+    return false;
+}
+
 JSStringRef AccessibilityUIElement::attributesOfColumnHeaders()
 {
     // FIXME: implement
@@ -417,6 +460,11 @@ bool AccessibilityUIElement::isAttributeSettable(JSStringRef attribute)
     return false;
 }
 
+bool AccessibilityUIElement::isAttributeSupported(JSStringRef attribute)
+{
+    return false;
+}
+
 void AccessibilityUIElement::increment()
 {
     // FIXME: implement
@@ -426,3 +474,57 @@ void AccessibilityUIElement::decrement()
 {
     // FIXME: implement
 }
+
+void AccessibilityUIElement::showMenu()
+{
+    // FIXME: implement
+}
+
+AccessibilityUIElement AccessibilityUIElement::disclosedRowAtIndex(unsigned index)
+{
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::ariaOwnsElementAtIndex(unsigned index)
+{
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::ariaFlowToElementAtIndex(unsigned index)
+{
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::selectedRowAtIndex(unsigned index)
+{
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::disclosedByRow()
+{
+    return 0;
+}
+
+JSStringRef AccessibilityUIElement::accessibilityValue() const
+{
+    // FIXME: implement
+    return JSStringCreateWithCharacters(0, 0);
+}
+
+JSStringRef AccessibilityUIElement::documentEncoding()
+{
+    AtkRole role = atk_object_get_role(ATK_OBJECT(m_element));
+    if (role != ATK_ROLE_DOCUMENT_FRAME)
+        return JSStringCreateWithCharacters(0, 0);
+
+    return JSStringCreateWithUTF8CString(atk_document_get_attribute_value(ATK_DOCUMENT(m_element), "Encoding"));
+}
+
+JSStringRef AccessibilityUIElement::documentURI()
+{
+    AtkRole role = atk_object_get_role(ATK_OBJECT(m_element));
+    if (role != ATK_ROLE_DOCUMENT_FRAME)
+        return JSStringCreateWithCharacters(0, 0);
+
+    return JSStringCreateWithUTF8CString(atk_document_get_attribute_value(ATK_DOCUMENT(m_element), "URI"));
+}
diff --git a/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
index 4ed6e36..fd1e3c6 100644
--- a/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -82,6 +82,7 @@ static GCController* gcController = 0;
 static WebKitWebView* webView;
 static GtkWidget* window;
 static GtkWidget* container;
+static GtkWidget* webInspectorWindow;
 WebKitWebFrame* mainFrame = 0;
 WebKitWebFrame* topLoadingFrame = 0;
 guint waitToDumpWatchdog = 0;
@@ -113,6 +114,11 @@ static bool shouldLogFrameLoadDelegates(const char* pathOrURL)
     return strstr(pathOrURL, "loading/");
 }
 
+static bool shouldOpenWebInspector(const char* pathOrURL)
+{
+    return strstr(pathOrURL, "inspector/");
+}
+
 void dumpFrameScrollPosition(WebKitWebFrame* frame)
 {
 
@@ -120,7 +126,7 @@ void dumpFrameScrollPosition(WebKitWebFrame* frame)
 
 void displayWebView()
 {
-
+    gtk_widget_queue_draw(GTK_WIDGET(webView));
 }
 
 static void appendString(gchar*& target, gchar* string)
@@ -319,7 +325,6 @@ static void resetDefaultsToConsistentValues()
                  "enable-offline-web-application-cache", TRUE,
                  "enable-universal-access-from-file-uris", TRUE,
                  "enable-scripts", TRUE,
-                 "enable-web-sockets", TRUE,
                  "enable-dom-paste", TRUE,
                  "default-font-family", "Times",
                  "monospace-font-family", "Courier",
@@ -400,12 +405,8 @@ void dump()
 
     // FIXME: call displayWebView here when we support --paint
 
-    puts("#EOF"); // terminate the (possibly empty) pixels block
-
-    fflush(stdout);
-    fflush(stderr);
-
     done = true;
+    gtk_main_quit();
 }
 
 static void setDefaultsToConsistentStateValuesForTesting()
@@ -427,6 +428,14 @@ static void setDefaultsToConsistentStateValuesForTesting()
     g_free(databaseDirectory);
 }
 
+static void sendPixelResultsEOF()
+{
+    puts("#EOF");
+
+    fflush(stdout);
+    fflush(stderr);
+}
+
 static void runTest(const string& testPathOrURL)
 {
     ASSERT(!testPathOrURL.empty());
@@ -455,6 +464,9 @@ static void runTest(const string& testPathOrURL)
     if (shouldLogFrameLoadDelegates(pathOrURL.c_str()))
         gLayoutTestController->setDumpFrameLoadCallbacks(true);
 
+    if (shouldOpenWebInspector(pathOrURL.c_str()))
+        gLayoutTestController->showWebInspector();
+
     WorkQueue::shared()->clear();
     WorkQueue::shared()->setFrozen(false);
 
@@ -484,9 +496,10 @@ static void runTest(const string& testPathOrURL)
     g_free(url);
     url = NULL;
 
-    while (!done)
-        g_main_context_iteration(NULL, TRUE);
+    gtk_main();
 
+    if (shouldOpenWebInspector(pathOrURL.c_str()))
+        gLayoutTestController->closeWebInspector();
 
     // Also check if we still have opened webViews and free them.
     if (gLayoutTestController->closeRemainingWindowsWhenComplete() || webViewList) {
@@ -503,6 +516,9 @@ static void runTest(const string& testPathOrURL)
 
     gLayoutTestController->deref();
     gLayoutTestController = 0;
+
+    // terminate the (possibly empty) pixels block after all the state reset
+    sendPixelResultsEOF();
 }
 
 void webViewLoadStarted(WebKitWebView* view, WebKitWebFrame* frame, void*)
@@ -565,7 +581,7 @@ static void webViewLoadFinished(WebKitWebView* view, WebKitWebFrame* frame, void
 
     if (WorkQueue::shared()->count())
         g_timeout_add(0, processWork, 0);
-     else
+    else
         dump();
 }
 
@@ -708,9 +724,29 @@ static void databaseQuotaExceeded(WebKitWebView* view, WebKitWebFrame* frame, We
 
 static WebKitWebView* webViewCreate(WebKitWebView*, WebKitWebFrame*);
 
+static gboolean webInspectorShowWindow(WebKitWebInspector*, gpointer data)
+{
+    gtk_window_set_default_size(GTK_WINDOW(webInspectorWindow), 800, 600);
+    gtk_widget_show_all(webInspectorWindow);
+    return TRUE;
+}
+
+static gboolean webInspectorCloseWindow(WebKitWebInspector*, gpointer data)
+{
+    gtk_widget_destroy(webInspectorWindow);
+    webInspectorWindow = 0;
+    return TRUE;
+}
+
 static WebKitWebView* webInspectorInspectWebView(WebKitWebInspector*, gpointer data)
 {
-    return WEBKIT_WEB_VIEW(webkit_web_view_new());
+    webInspectorWindow = gtk_window_new(GTK_WINDOW_TOPLEVEL);
+
+    GtkWidget* webView = webkit_web_view_new();
+    gtk_container_add(GTK_CONTAINER(webInspectorWindow),
+                      webView);
+
+    return WEBKIT_WEB_VIEW(webView);
 }
 
 static WebKitWebView* createWebView()
@@ -738,7 +774,11 @@ static WebKitWebView* createWebView()
                      NULL);
 
     WebKitWebInspector* inspector = webkit_web_view_get_inspector(view);
-    g_signal_connect(inspector, "inspect-web-view", G_CALLBACK(webInspectorInspectWebView), 0);
+    g_object_connect(G_OBJECT(inspector),
+                     "signal::inspect-web-view", webInspectorInspectWebView, 0,
+                     "signal::show-window", webInspectorShowWindow, 0,
+                     "signal::close-window", webInspectorCloseWindow, 0,
+                     NULL);
 
     return view;
 }
@@ -793,6 +833,7 @@ int main(int argc, char* argv[])
     gtk_container_add(GTK_CONTAINER(container), GTK_WIDGET(webView));
     gtk_widget_realize(GTK_WIDGET(webView));
     gtk_widget_show_all(container);
+    gtk_widget_grab_focus(GTK_WIDGET(webView));
     mainFrame = webkit_web_view_get_main_frame(webView);
 
     setDefaultsToConsistentStateValuesForTesting();
diff --git a/WebKitTools/DumpRenderTree/gtk/EventSender.cpp b/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
index f42928c..6268b5b 100644
--- a/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
@@ -200,6 +200,23 @@ static JSValueRef mouseDownCallback(JSContextRef context, JSObjectRef function,
     return JSValueMakeUndefined(context);
 }
 
+static guint getStateFlags()
+{
+    guint state = 0;
+
+    if (down) {
+        if (currentEventButton == 1)
+            state = GDK_BUTTON1_MASK;
+        else if (currentEventButton == 2)
+            state = GDK_BUTTON2_MASK;
+        else if (currentEventButton == 3)
+            state = GDK_BUTTON3_MASK;
+    } else
+        state = 0;
+
+    return state;
+}
+
 static JSValueRef mouseUpCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
 
@@ -207,8 +224,6 @@ static JSValueRef mouseUpCallback(JSContextRef context, JSObjectRef function, JS
     if (!view)
         return JSValueMakeUndefined(context);
 
-    down = false;
-
     GdkEvent event;
     memset(&event, 0, sizeof(event));
     event.type = GDK_BUTTON_RELEASE;
@@ -226,6 +241,9 @@ static JSValueRef mouseUpCallback(JSContextRef context, JSObjectRef function, JS
     event.button.window = GTK_WIDGET(view)->window;
     event.button.time = GDK_CURRENT_TIME;
     event.button.device = gdk_device_get_core_pointer();
+    event.button.state = getStateFlags();
+
+    down = false;
 
     int x_root, y_root;
 #if GTK_CHECK_VERSION(2,17,3)
@@ -286,16 +304,8 @@ static JSValueRef mouseMoveToCallback(JSContextRef context, JSObjectRef function
 
     event.motion.x_root = x_root;
     event.motion.y_root = y_root;
-
-    if (down) {
-        if (currentEventButton == 1)
-            event.motion.state = GDK_BUTTON1_MASK;
-        else if (currentEventButton == 2)
-            event.motion.state = GDK_BUTTON2_MASK;
-        else if (currentEventButton == 3)
-            event.motion.state = GDK_BUTTON3_MASK;
-    } else
-        event.motion.state = 0;
+    
+    event.motion.state = getStateFlags();
 
     if (dragMode && down && !replayingSavedEvents) {
         msgQueue[endOfQueue].event = event;
diff --git a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index 631fc31..6e94c1c 100644
--- a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -49,6 +49,7 @@
 extern "C" {
 bool webkit_web_frame_pause_animation(WebKitWebFrame* frame, const gchar* name, double time, const gchar* element);
 bool webkit_web_frame_pause_transition(WebKitWebFrame* frame, const gchar* name, double time, const gchar* element);
+bool webkit_web_frame_pause_svg_animation(WebKitWebFrame* frame, const gchar* name, double time, const gchar* element);
 unsigned int webkit_web_frame_number_of_active_animations(WebKitWebFrame* frame);
 void webkit_application_cache_set_maximum_size(unsigned long long size);
 unsigned int webkit_worker_thread_count(void);
@@ -224,7 +225,18 @@ void LayoutTestController::setMainFrameIsFirstResponder(bool flag)
 
 void LayoutTestController::setTabKeyCyclesThroughElements(bool cycles)
 {
-    // FIXME: implement
+    WebKitWebView* webView = webkit_web_frame_get_web_view(mainFrame);
+    WebKitWebSettings* settings = webkit_web_view_get_settings(webView);
+    g_object_set(G_OBJECT(settings), "tab-key-cycles-through-elements", cycles, NULL);
+}
+
+void LayoutTestController::setTimelineProfilingEnabled(bool flag)
+{
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    ASSERT(view);
+
+    WebKitWebInspector* inspector = webkit_web_view_get_inspector(view);
+    g_object_set(G_OBJECT(inspector), "timeline-profiling-enabled", flag, NULL);
 }
 
 void LayoutTestController::setUseDashboardCompatibilityMode(bool flag)
@@ -305,6 +317,15 @@ void LayoutTestController::setXSSAuditorEnabled(bool flag)
     g_object_set(G_OBJECT(settings), "enable-xss-auditor", flag, NULL);
 }
 
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool flag)
+{
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    ASSERT(view);
+
+    WebKitWebSettings* settings = webkit_web_view_get_settings(view);
+    g_object_set(G_OBJECT(settings), "enable-universal-access-from-file-uris", flag, NULL);
+}
+
 void LayoutTestController::setAuthorAndUserStylesEnabled(bool flag)
 {
     // FIXME: implement
@@ -428,6 +449,16 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef prop
     return returnValue;
 }
 
+bool LayoutTestController::sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId)
+{    
+    gchar* name = JSStringCopyUTF8CString(animationId);
+    gchar* element = JSStringCopyUTF8CString(elementId);
+    bool returnValue = webkit_web_frame_pause_svg_animation(mainFrame, name, time, element);
+    g_free(name);
+    g_free(element);
+    return returnValue;
+}
+
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     return webkit_web_frame_number_of_active_animations(mainFrame);
@@ -493,7 +524,7 @@ void LayoutTestController::showWebInspector()
     WebKitWebInspector* inspector = webkit_web_view_get_inspector(webView);
 
     g_object_set(webSettings, "enable-developer-extras", TRUE, NULL);
-    webkit_web_inspector_inspect_coordinates(inspector, 0, 0);
+    webkit_web_inspector_show(inspector);
 }
 
 void LayoutTestController::closeWebInspector()
diff --git a/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm b/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm
index 375dbad..948f379 100644
--- a/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm
+++ b/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm
@@ -40,6 +40,18 @@
 #define NSAccessibilityValueDescriptionAttribute @"AXValueDescription"
 #endif
 
+#ifndef NSAccessibilityOwnsAttribute
+#define NSAccessibilityOwnsAttribute @"AXOwns"
+#endif
+
+#ifndef NSAccessibilityGrabbedAttribute
+#define NSAccessibilityGrabbedAttribute @"AXGrabbed"
+#endif
+
+#ifndef NSAccessibilityDropEffectsAttribute
+#define NSAccessibilityDropEffectsAttribute @"AXDropEffects"
+#endif
+
 @interface NSObject (WebKitAccessibilityArrayCategory)
 - (NSArray *)accessibilityArrayAttributeValues:(NSString *)attribute index:(NSUInteger)index maxCount:(NSUInteger)maxCount;
 @end
@@ -232,7 +244,43 @@ AccessibilityUIElement AccessibilityUIElement::getChildAtIndex(unsigned index)
 
     if (children.size() == 1)
         return children[0];
-    return nil;
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::ariaOwnsElementAtIndex(unsigned index)
+{
+    NSArray* objects = [m_element accessibilityAttributeValue:NSAccessibilityOwnsAttribute];
+    if (index < [objects count])
+        return [objects objectAtIndex:index];
+    
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::ariaFlowToElementAtIndex(unsigned index)
+{
+    NSArray* objects = [m_element accessibilityAttributeValue:NSAccessibilityLinkedUIElementsAttribute];
+    if (index < [objects count])
+        return [objects objectAtIndex:index];
+    
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::disclosedRowAtIndex(unsigned index)
+{
+    NSArray* rows = [m_element accessibilityAttributeValue:NSAccessibilityDisclosedRowsAttribute];
+    if (index < [rows count])
+        return [rows objectAtIndex:index];
+
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::selectedRowAtIndex(unsigned index)
+{
+    NSArray* rows = [m_element accessibilityAttributeValue:NSAccessibilitySelectedRowsAttribute];
+    if (index < [rows count])
+        return [rows objectAtIndex:index];
+    
+    return 0;
 }
 
 AccessibilityUIElement AccessibilityUIElement::titleUIElement()
@@ -241,7 +289,7 @@ AccessibilityUIElement AccessibilityUIElement::titleUIElement()
     if (accessibilityObject)
         return AccessibilityUIElement(accessibilityObject);
     
-    return nil;
+    return 0;
 }
 
 AccessibilityUIElement AccessibilityUIElement::parentElement()
@@ -250,7 +298,16 @@ AccessibilityUIElement AccessibilityUIElement::parentElement()
     if (accessibilityObject)
         return AccessibilityUIElement(accessibilityObject);
     
-    return nil;
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::disclosedByRow()
+{
+    id accessibilityObject = [m_element accessibilityAttributeValue:NSAccessibilityDisclosedByRowAttribute];
+    if (accessibilityObject)
+        return AccessibilityUIElement(accessibilityObject);
+    
+    return 0;
 }
 
 JSStringRef AccessibilityUIElement::attributesOfLinkedUIElements()
@@ -293,6 +350,11 @@ bool AccessibilityUIElement::isAttributeSettable(JSStringRef attribute)
     return [m_element accessibilityIsAttributeSettable:[NSString stringWithJSStringRef:attribute]];
 }
 
+bool AccessibilityUIElement::isAttributeSupported(JSStringRef attribute)
+{
+    return [[m_element accessibilityAttributeNames] containsObject:[NSString stringWithJSStringRef:attribute]];
+}
+
 JSStringRef AccessibilityUIElement::parameterizedAttributeNames()
 {
     NSArray* supportedParameterizedAttributes = [m_element accessibilityParameterizedAttributeNames];
@@ -317,6 +379,12 @@ JSStringRef AccessibilityUIElement::subrole()
     return concatenateAttributeAndValue(@"AXSubrole", role);
 }
 
+JSStringRef AccessibilityUIElement::roleDescription()
+{
+    NSString* role = descriptionOfValue([m_element accessibilityAttributeValue:NSAccessibilityRoleDescriptionAttribute], m_element);
+    return concatenateAttributeAndValue(@"AXRoleDescription", role);
+}
+
 JSStringRef AccessibilityUIElement::title()
 {
     NSString* title = descriptionOfValue([m_element accessibilityAttributeValue:NSAccessibilityTitleAttribute], m_element);
@@ -329,6 +397,18 @@ JSStringRef AccessibilityUIElement::description()
     return concatenateAttributeAndValue(@"AXDescription", description);
 }
 
+JSStringRef AccessibilityUIElement::orientation() const
+{
+    id description = descriptionOfValue([m_element accessibilityAttributeValue:NSAccessibilityOrientationAttribute], m_element);
+    return concatenateAttributeAndValue(@"AXOrientation", description);    
+}
+
+JSStringRef AccessibilityUIElement::stringValue()
+{
+    id description = descriptionOfValue([m_element accessibilityAttributeValue:NSAccessibilityValueAttribute], m_element);
+    return concatenateAttributeAndValue(@"AXValue", description);
+}
+
 JSStringRef AccessibilityUIElement::language()
 {
     id description = descriptionOfValue([m_element accessibilityAttributeValue:@"AXLanguage"], m_element);
@@ -433,6 +513,55 @@ bool AccessibilityUIElement::isRequired() const
     return false;
 }
 
+bool AccessibilityUIElement::isSelected() const
+{
+    id value = [m_element accessibilityAttributeValue:NSAccessibilitySelectedAttribute];
+    if ([value isKindOfClass:[NSNumber class]])
+        return [value boolValue];
+    return false;
+}
+
+bool AccessibilityUIElement::isExpanded() const
+{
+    id value = [m_element accessibilityAttributeValue:NSAccessibilityExpandedAttribute];
+    if ([value isKindOfClass:[NSNumber class]])
+        return [value boolValue];
+    return false;
+}
+
+int AccessibilityUIElement::hierarchicalLevel() const
+{
+    id value = [m_element accessibilityAttributeValue:NSAccessibilityDisclosureLevelAttribute];
+    if ([value isKindOfClass:[NSNumber class]])
+        return [value intValue];
+    return 0;
+}
+
+bool AccessibilityUIElement::ariaIsGrabbed() const
+{
+    id value = [m_element accessibilityAttributeValue:NSAccessibilityGrabbedAttribute];
+    if ([value isKindOfClass:[NSNumber class]])
+        return [value boolValue];
+    return false;
+}
+
+JSStringRef AccessibilityUIElement::ariaDropEffects() const
+{
+    id value = [m_element accessibilityAttributeValue:NSAccessibilityDropEffectsAttribute];
+    if (![value isKindOfClass:[NSArray class]])
+        return 0;
+
+    NSMutableString* dropEffects = [NSMutableString string];
+    NSInteger length = [value count];
+    for (NSInteger k = 0; k < length; ++k) {
+        [dropEffects appendString:[value objectAtIndex:k]];
+        if (k < length - 1)
+            [dropEffects appendString:@","];
+    }
+    
+    return [dropEffects createJSStringRef];
+}
+
 // parameterized attributes
 int AccessibilityUIElement::lineForIndex(int index)
 {
@@ -571,3 +700,24 @@ void AccessibilityUIElement::decrement()
 {
     [m_element accessibilityPerformAction:NSAccessibilityDecrementAction];
 }
+
+void AccessibilityUIElement::showMenu()
+{
+    [m_element accessibilityPerformAction:NSAccessibilityShowMenuAction];
+}
+
+JSStringRef AccessibilityUIElement::accessibilityValue() const
+{
+    // FIXME: implement
+    return JSStringCreateWithCharacters(0, 0);
+}
+
+JSStringRef AccessibilityUIElement::documentEncoding()
+{
+    return JSStringCreateWithCharacters(0, 0);
+}
+
+JSStringRef AccessibilityUIElement::documentURI()
+{
+    return JSStringCreateWithCharacters(0, 0);
+}
diff --git a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
index 98f4f9c..4ffeac3 100644
--- a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -87,6 +87,10 @@ using namespace std;
 @interface DumpRenderTreeEvent : NSEvent
 @end
 
+@interface NSURLRequest (PrivateThingsWeShouldntReallyUse)
++(void)setAllowsAnyHTTPSCertificate:(BOOL)allow forHost:(NSString *)host;
+@end
+
 static void runTest(const string& testPathOrURL);
 
 // Deciding when it's OK to dump out the state is a bit tricky.  All these must be true:
@@ -302,7 +306,7 @@ WebView *createWebViewAndOffscreenWindow()
     [window orderBack:nil];
     [window setAutodisplay:NO];
 
-    [window startObservingWebView];
+    [window startListeningForAcceleratedCompositingChanges];
     
     // For reasons that are not entirely clear, the following pair of calls makes WebView handle its
     // dynamic scrollbars properly. Without it, every frame will always have scrollbars.
@@ -596,9 +600,17 @@ void dumpRenderTree(int argc, const char *argv[])
     mainFrame = [webView mainFrame];
 
     [[NSURLCache sharedURLCache] removeAllCachedResponses];
-
     [WebCache empty];
-     
+
+    // <http://webkit.org/b/31200> In order to prevent extra frame load delegate logging being generated if the first test to use SSL
+    // is set to log frame load delegate calls we ignore SSL certificate errors on localhost and 127.0.0.1.
+#if BUILDING_ON_TIGER
+    // Initialize internal NSURLRequest data for setAllowsAnyHTTPSCertificate:forHost: to work properly.
+    [[[[NSURLRequest alloc] init] autorelease] HTTPMethod];
+#endif
+    [NSURLRequest setAllowsAnyHTTPSCertificate:YES forHost:@"localhost"];
+    [NSURLRequest setAllowsAnyHTTPSCertificate:YES forHost:@"127.0.0.1"];
+
     // <rdar://problem/5222911>
     testStringByEvaluatingJavaScriptFromString();
 
@@ -1090,6 +1102,11 @@ static bool shouldLogHistoryDelegates(const char* pathOrURL)
     return strstr(pathOrURL, "globalhistory/");
 }
 
+static bool shouldOpenWebInspector(const char* pathOrURL)
+{
+    return strstr(pathOrURL, "inspector/");
+}
+
 static void resetWebViewToConsistentStateBeforeTesting()
 {
     WebView *webView = [mainFrame webView];
@@ -1105,6 +1122,7 @@ static void resetWebViewToConsistentStateBeforeTesting()
     [webView _clearMainFrameName];
     [[webView undoManager] removeAllActions];
     [WebView _removeAllUserContentFromGroup:[webView groupName]];
+    [[webView window] setAutodisplay:NO];
 
     resetDefaultsToConsistentValues();
 
@@ -1166,7 +1184,10 @@ static void runTest(const string& testPathOrURL)
         [[mainFrame webView] setHistoryDelegate:historyDelegate];
     else
         [[mainFrame webView] setHistoryDelegate:nil];
-    
+
+    if (shouldOpenWebInspector(pathOrURL.c_str()))
+        gLayoutTestController->showWebInspector();
+
     if ([WebHistory optionalSharedHistory])
         [WebHistory setOptionalSharedHistory:nil];
     lastMousePosition = NSZeroPoint;
@@ -1190,6 +1211,7 @@ static void runTest(const string& testPathOrURL)
         [[NSRunLoop currentRunLoop] runMode:NSDefaultRunLoopMode beforeDate:[NSDate distantPast]];
         [pool release];
     }
+
     pool = [[NSAutoreleasePool alloc] init];
     [EventSendingController clearSavedEvents];
     [[mainFrame webView] setSelectedDOMRange:nil affinity:NSSelectionAffinityDownstream];
@@ -1214,11 +1236,14 @@ static void runTest(const string& testPathOrURL)
         }
     }
 
+    if (shouldOpenWebInspector(pathOrURL.c_str()))
+        gLayoutTestController->closeWebInspector();
+
     resetWebViewToConsistentStateBeforeTesting();
 
     [mainFrame loadHTMLString:@"<html></html>" baseURL:[NSURL URLWithString:@"about:blank"]];
     [mainFrame stopLoading];
-    
+
     [pool release];
 
     // We should only have our main window left open when we're done
diff --git a/WebKitTools/DumpRenderTree/mac/DumpRenderTreeMac.h b/WebKitTools/DumpRenderTree/mac/DumpRenderTreeMac.h
index 72d5db1..fe1ac00 100644
--- a/WebKitTools/DumpRenderTree/mac/DumpRenderTreeMac.h
+++ b/WebKitTools/DumpRenderTree/mac/DumpRenderTreeMac.h
@@ -42,6 +42,7 @@
 @class NavigationController;
 @class PolicyDelegate;
 @class WebFrame;
+@class WebScriptWorld;
 @class WebView;
 
 typedef const struct __CFString* CFStringRef;
@@ -62,4 +63,6 @@ extern CFRunLoopTimerRef waitToDumpWatchdog;
 WebView* createWebViewAndOffscreenWindow();
 void setPersistentUserStyleSheetLocation(CFStringRef);
 
+unsigned worldIDForWorld(WebScriptWorld *);
+
 #endif // DumpRenderTreeMac_h 
diff --git a/WebKitTools/DumpRenderTree/mac/DumpRenderTreeWindow.h b/WebKitTools/DumpRenderTree/mac/DumpRenderTreeWindow.h
index b6bdcb8..a229d20 100644
--- a/WebKitTools/DumpRenderTree/mac/DumpRenderTreeWindow.h
+++ b/WebKitTools/DumpRenderTree/mac/DumpRenderTreeWindow.h
@@ -34,7 +34,6 @@
 
 @interface DumpRenderTreeWindow : NSWindow
 {
-    BOOL observingWebView;
 }
 
 // I'm not sure why we can't just use [NSApp windows]
@@ -42,7 +41,6 @@
 
 - (WebView *)webView;
 
-- (void)startObservingWebView;
-- (void)stopObservingWebView;
+- (void)startListeningForAcceleratedCompositingChanges;
 
 @end
diff --git a/WebKitTools/DumpRenderTree/mac/DumpRenderTreeWindow.mm b/WebKitTools/DumpRenderTree/mac/DumpRenderTreeWindow.mm
index aa5b117..8845ef0 100644
--- a/WebKitTools/DumpRenderTree/mac/DumpRenderTreeWindow.mm
+++ b/WebKitTools/DumpRenderTree/mac/DumpRenderTreeWindow.mm
@@ -67,7 +67,7 @@ static CFArrayCallBacks NonRetainingArrayCallbacks = {
 
 - (void)close
 {
-    [self stopObservingWebView];
+    [[NSNotificationCenter defaultCenter] removeObserver:self];
 
     CFRange arrayRange = CFRangeMake(0, CFArrayGetCount(openWindowsRef));
     CFIndex i = CFArrayGetFirstIndexOfValue(openWindowsRef, arrayRange, self);
@@ -99,32 +99,20 @@ static CFArrayCallBacks NonRetainingArrayCallbacks = {
     return nil;
 }
 
-- (void)startObservingWebView
+- (void)startListeningForAcceleratedCompositingChanges
 {
-    [self stopObservingWebView];
-    [[self webView] addObserver:self forKeyPath:@"_isUsingAcceleratedCompositing" options:0 context:0];
-    observingWebView = YES;
+    [[self webView] _setPostsAcceleratedCompositingNotifications:YES];
+    [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(webViewStartedAcceleratedCompositing:)
+        name:_WebViewDidStartAcceleratedCompositingNotification object:nil];
 }
 
-- (void)stopObservingWebView
+- (void)webViewStartedAcceleratedCompositing:(NSNotification *)notification
 {
-    if (!observingWebView)
-        return;
-    [[self webView] removeObserver:self forKeyPath:@"_isUsingAcceleratedCompositing"];
-    observingWebView = NO;
-}
-
-- (void)observeValueForKeyPath:(NSString *)keyPath ofObject:(id)object change:(NSDictionary *)change context:(void *)context
-{
-    if ([keyPath isEqualToString:@"_isUsingAcceleratedCompositing"]) {
-        // When using accelerated compositing, the window needs to be autodisplay for AppKit/CA to
-        // start accelerated animations correctly.
-        BOOL isAccelerated = [[self webView] _isUsingAcceleratedCompositing];
-        [self setAutodisplay:isAccelerated];
-        return;
-    }
-    
-    [super observeValueForKeyPath:keyPath ofObject:object change:change context:context];
+    // If the WebView has gone into compositing mode, turn on window autodisplay. This is necessary for CA
+    // to update layers and start animations.
+    // We only ever turn autodisplay on here, because we turn it off before every test.
+    if ([[self webView] _isUsingAcceleratedCompositing])
+        [self setAutodisplay:YES];
 }
 
 @end
diff --git a/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.mm b/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.mm
index 2838d2e..963eae7 100644
--- a/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.mm
+++ b/WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.mm
@@ -48,13 +48,10 @@
 #import <WebKit/WebHTMLViewPrivate.h>
 #import <WebKit/WebKit.h>
 #import <WebKit/WebNSURLExtras.h>
+#import <WebKit/WebScriptWorld.h>
 #import <WebKit/WebSecurityOriginPrivate.h>
 #import <wtf/Assertions.h>
 
-@interface NSURLRequest (PrivateThingsWeShouldntReallyUse)
-+(void)setAllowsAnyHTTPSCertificate:(BOOL)allow forHost:(NSString *)host;
-@end
-
 @interface NSURL (DRTExtras)
 - (NSString *)_drt_descriptionSuitableForTestResult;
 @end
@@ -182,13 +179,15 @@
 {
     if (!done && gLayoutTestController->dumpFrameLoadCallbacks()) {
         NSString *string = [NSString stringWithFormat:@"%@ - didFailProvisionalLoadWithError", [frame _drt_descriptionSuitableForTestResult]];
-        printf ("%s\n", [string UTF8String]);
+        printf("%s\n", [string UTF8String]);
     }
 
     if ([error domain] == NSURLErrorDomain && ([error code] == NSURLErrorServerCertificateHasUnknownRoot || [error code] == NSURLErrorServerCertificateUntrusted)) {
-        NSURL *failedURL = [[error userInfo] objectForKey:@"NSErrorFailingURLKey"];
-        [NSURLRequest setAllowsAnyHTTPSCertificate:YES forHost:[failedURL _web_hostString]];
-        [frame loadRequest:[[[[frame provisionalDataSource] request] mutableCopy] autorelease]];
+        // <http://webkit.org/b/31200> In order to prevent extra frame load delegate logging being generated if the first test to use SSL
+        // is set to log frame load delegate calls we ignore SSL certificate errors on localhost and 127.0.0.1 from within dumpRenderTree.
+        // Those are the only hosts that we use SSL with at present.  If we hit this code path then we've found another host that we need
+        // to apply the workaround to.
+        ASSERT_NOT_REACHED();
         return;
     }
     
@@ -238,11 +237,8 @@
     ASSERT_NOT_REACHED();
 }
 
-- (void)webView:(WebView *)sender didClearWindowObject:(WebScriptObject *)obj forFrame:(WebFrame *)frame
+- (void)didClearWindowObjectInStandardWorldForFrame:(WebFrame *)frame
 {
-    ASSERT(obj == [frame windowObject]);
-    ASSERT([obj JSObject] == JSContextGetGlobalObject([frame globalContext]));
-
     // Make New-Style LayoutTestController
     JSContextRef context = [frame globalContext];
     JSObjectRef globalObject = JSContextGetGlobalObject(context);
@@ -260,7 +256,9 @@
 
     // Make Old-Style controllers
 
-    AppleScriptController *asc = [[AppleScriptController alloc] initWithWebView:sender];
+    WebView *webView = [frame webView];
+    WebScriptObject *obj = [frame windowObject];
+    AppleScriptController *asc = [[AppleScriptController alloc] initWithWebView:webView];
     [obj setValue:asc forKey:@"appleScriptController"];
     [asc release];
 
@@ -284,11 +282,32 @@
 
     [obj setValue:[PlainTextController sharedPlainTextController] forKey:@"plainText"];
 
-    TextInputController *tic = [[TextInputController alloc] initWithWebView:sender];
+    TextInputController *tic = [[TextInputController alloc] initWithWebView:webView];
     [obj setValue:tic forKey:@"textInputController"];
     [tic release];
 }
 
+- (void)didClearWindowObjectForFrame:(WebFrame *)frame inIsolatedWorld:(WebScriptWorld *)world
+{
+    JSGlobalContextRef ctx = [frame _globalContextForScriptWorld:world];
+    if (!ctx)
+        return;
+
+    JSObjectRef globalObject = JSContextGetGlobalObject(ctx);
+    if (!globalObject)
+        return;
+
+    JSObjectSetProperty(ctx, globalObject, JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithUTF8CString("__worldID")).get(), JSValueMakeNumber(ctx, worldIDForWorld(world)), kJSPropertyAttributeReadOnly, 0);
+}
+
+- (void)webView:(WebView *)sender didClearWindowObjectForFrame:(WebFrame *)frame inScriptWorld:(WebScriptWorld *)world
+{
+    if (world == [WebScriptWorld standardWorld])
+        [self didClearWindowObjectInStandardWorldForFrame:frame];
+    else
+        [self didClearWindowObjectForFrame:frame inIsolatedWorld:world];
+}
+
 - (void)webView:(WebView *)sender didReceiveTitle:(NSString *)title forFrame:(WebFrame *)frame
 {
     if (!done && gLayoutTestController->dumpFrameLoadCallbacks()) {
diff --git a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index 4d6a609..69fe19f 100644
--- a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -43,25 +43,27 @@
 #import <WebKit/WebApplicationCache.h>
 #import <WebKit/WebBackForwardList.h>
 #import <WebKit/WebCoreStatistics.h>
-#import <WebKit/WebDatabaseManagerPrivate.h>
 #import <WebKit/WebDataSource.h>
+#import <WebKit/WebDatabaseManagerPrivate.h>
 #import <WebKit/WebFrame.h>
 #import <WebKit/WebFrameViewPrivate.h>
-#import <WebKit/WebIconDatabasePrivate.h>
+#import <WebKit/WebGeolocationMockPrivate.h>
 #import <WebKit/WebHTMLRepresentation.h>
 #import <WebKit/WebHTMLViewPrivate.h>
 #import <WebKit/WebHistory.h>
 #import <WebKit/WebHistoryPrivate.h>
+#import <WebKit/WebIconDatabasePrivate.h>
 #import <WebKit/WebInspectorPrivate.h>
-#import <WebKit/WebGeolocationMockPrivate.h>
 #import <WebKit/WebNSURLExtras.h>
 #import <WebKit/WebPreferences.h>
 #import <WebKit/WebPreferencesPrivate.h>
+#import <WebKit/WebScriptWorld.h>
 #import <WebKit/WebSecurityOriginPrivate.h>
 #import <WebKit/WebTypesInternal.h>
 #import <WebKit/WebView.h>
 #import <WebKit/WebViewPrivate.h>
 #import <WebKit/WebWorkersPrivate.h>
+#import <wtf/HashMap.h>
 #import <wtf/RetainPtr.h>
 
 @interface CommandValidationTarget : NSObject <NSValidatedUserInterfaceItem>
@@ -299,6 +301,11 @@ void LayoutTestController::setXSSAuditorEnabled(bool enabled)
     [[[mainFrame webView] preferences] setXSSAuditorEnabled:enabled];
 }
 
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
+{
+    [[[mainFrame webView] preferences] setAllowUniversalAccessFromFileURLs:enabled];
+}
+
 void LayoutTestController::setPopupBlockingEnabled(bool popupBlockingEnabled)
 {
     [[[mainFrame webView] preferences] setJavaScriptCanOpenWindowsAutomatically:!popupBlockingEnabled];
@@ -309,6 +316,11 @@ void LayoutTestController::setTabKeyCyclesThroughElements(bool cycles)
     [[mainFrame webView] setTabKeyCyclesThroughElements:cycles];
 }
 
+void LayoutTestController::setTimelineProfilingEnabled(bool enabled)
+{
+    [[[mainFrame webView] inspector] setTimelineProfilingEnabled:enabled];
+}
+
 void LayoutTestController::setUseDashboardCompatibilityMode(bool flag)
 {
     [[mainFrame webView] _setDashboardBehavior:WebDashboardBehaviorUseBackwardCompatibilityMode to:flag];
@@ -474,6 +486,16 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef prop
     return [mainFrame _pauseTransitionOfProperty:nameNS onNode:[[mainFrame DOMDocument] getElementById:idNS] atTime:time];
 }
 
+bool LayoutTestController::sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId)
+{
+    RetainPtr<CFStringRef> animationIDCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, animationId));
+    NSString *animationIDNS = (NSString *)animationIDCF.get();
+    RetainPtr<CFStringRef> elementIDCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, elementId));
+    NSString *elementIDNS = (NSString *)elementIDCF.get();
+
+    return [mainFrame _pauseSVGAnimation:elementIDNS onSMILNode:[[mainFrame DOMDocument] getElementById:animationIDNS] atTime:time];
+}
+
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     return [mainFrame _numberOfActiveAnimations];
@@ -501,14 +523,14 @@ void LayoutTestController::addUserScript(JSStringRef source, bool runAtStart)
 {
     RetainPtr<CFStringRef> sourceCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, source));
     NSString *sourceNS = (NSString *)sourceCF.get();
-    [WebView _addUserScriptToGroup:@"org.webkit.DumpRenderTree" worldID:1 source:sourceNS url:nil whitelist:nil blacklist:nil injectionTime:(runAtStart ? WebInjectAtDocumentStart : WebInjectAtDocumentEnd)];
+    [WebView _addUserScriptToGroup:@"org.webkit.DumpRenderTree" world:[WebScriptWorld world] source:sourceNS url:nil whitelist:nil blacklist:nil injectionTime:(runAtStart ? WebInjectAtDocumentStart : WebInjectAtDocumentEnd)];
 }
 
 void LayoutTestController::addUserStyleSheet(JSStringRef source)
 {
     RetainPtr<CFStringRef> sourceCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, source));
     NSString *sourceNS = (NSString *)sourceCF.get();
-    [WebView _addUserStyleSheetToGroup:@"org.webkit.DumpRenderTree" worldID:1 source:sourceNS url:nil whitelist:nil blacklist:nil];
+    [WebView _addUserStyleSheetToGroup:@"org.webkit.DumpRenderTree" world:[WebScriptWorld world] source:sourceNS url:nil whitelist:nil blacklist:nil];
 }
 
 void LayoutTestController::showWebInspector()
@@ -530,9 +552,40 @@ void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef scrip
     [[[mainFrame webView] inspector] evaluateInFrontend:nil callId:callId script:scriptNS];
 }
 
+typedef HashMap<unsigned, RetainPtr<WebScriptWorld> > WorldMap;
+static WorldMap& worldMap()
+{
+    static WorldMap& map = *new WorldMap;
+    return map;
+}
+
+unsigned worldIDForWorld(WebScriptWorld *world)
+{
+    WorldMap::const_iterator end = worldMap().end();
+    for (WorldMap::const_iterator it = worldMap().begin(); it != end; ++it) {
+        if (it->second == world)
+            return it->first;
+    }
+
+    return 0;
+}
+
 void LayoutTestController::evaluateScriptInIsolatedWorld(unsigned worldID, JSObjectRef globalObject, JSStringRef script)
 {
     RetainPtr<CFStringRef> scriptCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, script));
     NSString *scriptNS = (NSString *)scriptCF.get();
-    [mainFrame _stringByEvaluatingJavaScriptInIsolatedWorld:worldID WithGlobalObject:globalObject FromString:scriptNS];
+
+    // A worldID of 0 always corresponds to a new world. Any other worldID corresponds to a world
+    // that is created once and cached forever.
+    WebScriptWorld *world;
+    if (!worldID)
+        world = [WebScriptWorld world];
+    else {
+        RetainPtr<WebScriptWorld>& worldSlot = worldMap().add(worldID, 0).first->second;
+        if (!worldSlot)
+            worldSlot.adoptNS([[WebScriptWorld alloc] init]);
+        world = worldSlot.get();
+    }
+
+    [mainFrame _stringByEvaluatingJavaScriptFromString:scriptNS withGlobalObject:globalObject inScriptWorld:world];
 }
diff --git a/WebKitTools/DumpRenderTree/mac/UIDelegate.mm b/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
index 393899e..81c03d2 100644
--- a/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
+++ b/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
@@ -34,9 +34,9 @@
 #import "EventSendingController.h"
 #import "LayoutTestController.h"
 #import <WebKit/WebFramePrivate.h>
-#import <WebKit/WebGeolocationPrivate.h>
 #import <WebKit/WebHTMLViewPrivate.h>
 #import <WebKit/WebSecurityOriginPrivate.h>
+#import <WebKit/WebUIDelegatePrivate.h>
 #import <WebKit/WebView.h>
 #import <wtf/Assertions.h>
 
@@ -151,10 +151,14 @@ DumpRenderTreeDraggingInfo *draggingInfo = nil;
         printf("UI DELEGATE STATUS CALLBACK: setStatusText:%s\n", [text UTF8String]);
 }
 
-- (void)webView:(WebView *)sender frame:(WebFrame *)frame requestGeolocationPermission:(WebGeolocation *)geolocation securityOrigin:(WebSecurityOrigin *)origin
+- (void)webView:(WebView *)webView decidePolicyForGeolocationRequestFromOrigin:(WebSecurityOrigin *)origin frame:(WebFrame *)frame listener:(id<WebGeolocationPolicyListener>)listener
 {
-    if (gLayoutTestController->isGeolocationPermissionSet())
-        [geolocation setIsAllowed:gLayoutTestController->geolocationPermission()];
+    if (gLayoutTestController->isGeolocationPermissionSet()) {
+        if (gLayoutTestController->geolocationPermission())
+            [listener allow];
+        else
+            [listener deny];
+    }
 }
 
 - (BOOL)webView:(WebView *)sender shouldHaltPlugin:(DOMNode *)pluginNode
diff --git a/WebKitTools/DumpRenderTree/pthreads/JavaScriptThreadingPthreads.cpp b/WebKitTools/DumpRenderTree/pthreads/JavaScriptThreadingPthreads.cpp
index 3ac257d..5a48b27 100644
--- a/WebKitTools/DumpRenderTree/pthreads/JavaScriptThreadingPthreads.cpp
+++ b/WebKitTools/DumpRenderTree/pthreads/JavaScriptThreadingPthreads.cpp
@@ -28,6 +28,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
  
+#include "config.h"
 #include "JavaScriptThreading.h"
 
 #include <CoreFoundation/CoreFoundation.h>
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp
index 9faa37f..6d466bf 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp
@@ -29,6 +29,8 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
+
 #include "DumpRenderTree.h"
 #include "EventSenderQt.h"
 #include "LayoutTestControllerQt.h"
@@ -41,25 +43,29 @@
 #include <QCryptographicHash>
 #include <QDir>
 #include <QFile>
-#include <QTimer>
-#include <QBoxLayout>
-#include <QScrollArea>
 #include <QApplication>
 #include <QUrl>
+#include <QFileInfo>
 #include <QFocusEvent>
 #include <QFontDatabase>
+#include <QNetworkAccessManager>
+#include <QNetworkReply>
 #include <QNetworkRequest>
+#include <QUndoStack>
 
-#include <qwebpage.h>
-#include <qwebframe.h>
-#include <qwebview.h>
 #include <qwebsettings.h>
 #include <qwebsecurityorigin.h>
 
+#ifndef QT_NO_UITOOLS
+#include <QtUiTools/QUiLoader>
+#endif
+
 #ifdef Q_WS_X11
 #include <fontconfig/fontconfig.h>
 #endif
 
+#include <limits.h>
+
 #include <unistd.h>
 #include <qdebug.h>
 
@@ -69,6 +75,7 @@ extern void qt_dump_frame_loader(bool b);
 extern void qt_drt_clearFrameName(QWebFrame* qFrame);
 extern void qt_drt_overwritePluginDirectories();
 extern void qt_drt_resetOriginAccessWhiteLists();
+extern bool qt_drt_hasDocumentElement(QWebFrame* qFrame);
 
 namespace WebCore {
 
@@ -76,39 +83,39 @@ namespace WebCore {
 const unsigned int maxViewWidth = 800;
 const unsigned int maxViewHeight = 600;
 
-class WebPage : public QWebPage {
-    Q_OBJECT
-public:
-    WebPage(QWidget *parent, DumpRenderTree *drt);
-
-    QWebPage *createWindow(QWebPage::WebWindowType);
-
-    void javaScriptAlert(QWebFrame *frame, const QString& message);
-    void javaScriptConsoleMessage(const QString& message, int lineNumber, const QString& sourceID);
-    bool javaScriptConfirm(QWebFrame *frame, const QString& msg);
-    bool javaScriptPrompt(QWebFrame *frame, const QString& msg, const QString& defaultValue, QString* result);
-
-    void resetSettings();
-
-public slots:
-    bool shouldInterruptJavaScript() { return false; }
+NetworkAccessManager::NetworkAccessManager(QObject* parent)
+    : QNetworkAccessManager(parent)
+{
+#ifndef QT_NO_SSL
+    connect(this, SIGNAL(sslErrors(QNetworkReply*, const QList<QSslError>&)),
+            this, SLOT(sslErrorsEncountered(QNetworkReply*, const QList<QSslError>&)));
+#endif
+}
 
-protected:
-    bool acceptNavigationRequest(QWebFrame* frame, const QNetworkRequest& request, NavigationType type);
+#ifndef QT_NO_SSL
+void NetworkAccessManager::sslErrorsEncountered(QNetworkReply* reply, const QList<QSslError>& errors)
+{
+    if (reply->url().host() == "127.0.0.1" || reply->url().host() == "localhost") {
+        bool ignore = true;
+
+        // Accept any HTTPS certificate.
+        foreach (const QSslError& error, errors) {
+            if (error.error() < QSslError::UnableToGetIssuerCertificate || error.error() > QSslError::HostNameMismatch) {
+                ignore = false;
+                break;
+            }
+        }
 
-private slots:
-    void setViewGeometry(const QRect &r)
-    {
-        QWidget *v = view();
-        if (v)
-            v->setGeometry(r);
+        if (ignore)
+            reply->ignoreSslErrors();
     }
-private:
-    DumpRenderTree *m_drt;
-};
+}
+#endif
 
-WebPage::WebPage(QWidget *parent, DumpRenderTree *drt)
-    : QWebPage(parent), m_drt(drt)
+WebPage::WebPage(QObject* parent, DumpRenderTree* drt)
+    : QWebPage(parent)
+    , m_webInspector(0)
+    , m_drt(drt)
 {
     QWebSettings* globalSettings = QWebSettings::globalSettings();
 
@@ -129,21 +136,37 @@ WebPage::WebPage(QWidget *parent, DumpRenderTree *drt)
     connect(this, SIGNAL(geometryChangeRequested(const QRect &)),
             this, SLOT(setViewGeometry(const QRect & )));
 
+    setNetworkAccessManager(new NetworkAccessManager(this));
     setPluginFactory(new TestPlugin(this));
 }
 
+WebPage::~WebPage()
+{
+    delete m_webInspector;
+}
+
+QWebInspector* WebPage::webInspector()
+{
+    if (!m_webInspector) {
+        m_webInspector = new QWebInspector;
+        m_webInspector->setPage(this);
+    }
+    return m_webInspector;
+}
+
 void WebPage::resetSettings()
 {
     // After each layout test, reset the settings that may have been changed by
     // layoutTestController.overridePreference() or similar.
 
     settings()->resetFontSize(QWebSettings::DefaultFontSize);
-
     settings()->resetAttribute(QWebSettings::JavascriptCanOpenWindows);
     settings()->resetAttribute(QWebSettings::JavascriptEnabled);
     settings()->resetAttribute(QWebSettings::PrivateBrowsingEnabled);
     settings()->resetAttribute(QWebSettings::LinksIncludedInFocusChain);
     settings()->resetAttribute(QWebSettings::OfflineWebApplicationCacheEnabled);
+    settings()->resetAttribute(QWebSettings::LocalContentCanAccessRemoteUrls);
+    QWebSettings::setMaximumPagesInCache(0); // reset to default
 }
 
 QWebPage *WebPage::createWindow(QWebPage::WebWindowType)
@@ -153,22 +176,52 @@ QWebPage *WebPage::createWindow(QWebPage::WebWindowType)
 
 void WebPage::javaScriptAlert(QWebFrame*, const QString& message)
 {
+    if (!isTextOutputEnabled())
+        return;
+
     fprintf(stdout, "ALERT: %s\n", message.toUtf8().constData());
 }
 
+static QString urlSuitableForTestResult(const QString& url)
+{
+    if (url.isEmpty() || !url.startsWith(QLatin1String("file://")))
+        return url;
+
+    return QFileInfo(url).fileName();
+}
+
 void WebPage::javaScriptConsoleMessage(const QString& message, int lineNumber, const QString&)
 {
-    fprintf (stdout, "CONSOLE MESSAGE: line %d: %s\n", lineNumber, message.toUtf8().constData());
+    if (!isTextOutputEnabled())
+        return;
+
+    QString newMessage;
+    if (!message.isEmpty()) {
+        newMessage = message;
+
+        size_t fileProtocol = newMessage.indexOf(QLatin1String("file://"));
+        if (fileProtocol != -1) {
+            newMessage = newMessage.left(fileProtocol) + urlSuitableForTestResult(newMessage.mid(fileProtocol));
+        }
+    }
+
+    fprintf (stdout, "CONSOLE MESSAGE: line %d: %s\n", lineNumber, newMessage.toUtf8().constData());
 }
 
 bool WebPage::javaScriptConfirm(QWebFrame*, const QString& msg)
 {
+    if (!isTextOutputEnabled())
+        return true;
+
     fprintf(stdout, "CONFIRM: %s\n", msg.toUtf8().constData());
     return true;
 }
 
 bool WebPage::javaScriptPrompt(QWebFrame*, const QString& msg, const QString& defaultValue, QString* result)
 {
+    if (!isTextOutputEnabled())
+        return true;
+
     fprintf(stdout, "PROMPT: %s, default text: %s\n", msg.toUtf8().constData(), defaultValue.toUtf8().constData());
     *result = defaultValue;
     return true;
@@ -203,35 +256,83 @@ bool WebPage::acceptNavigationRequest(QWebFrame* frame, const QNetworkRequest& r
             typeDescription = "illegal value";
         }
 
-        fprintf(stdout, "Policy delegate: attempt to load %s with navigation type '%s'\n",
-                url.toUtf8().constData(), typeDescription.toUtf8().constData());
+        if (isTextOutputEnabled())
+            fprintf(stdout, "Policy delegate: attempt to load %s with navigation type '%s'\n",
+                    url.toUtf8().constData(), typeDescription.toUtf8().constData());
+
         m_drt->layoutTestController()->notifyDone();
     }
     return QWebPage::acceptNavigationRequest(frame, request, type);
 }
 
+bool WebPage::supportsExtension(QWebPage::Extension extension) const
+{
+    if (extension == QWebPage::ErrorPageExtension)
+        return m_drt->layoutTestController()->shouldHandleErrorPages();
+
+    return false;
+}
+
+bool WebPage::extension(Extension extension, const ExtensionOption *option, ExtensionReturn *output)
+{
+    const QWebPage::ErrorPageExtensionOption* info = static_cast<const QWebPage::ErrorPageExtensionOption*>(option);
+
+    // Lets handle error pages for the main frame for now.
+    if (info->frame != mainFrame())
+        return false;
+
+    QWebPage::ErrorPageExtensionReturn* errorPage = static_cast<QWebPage::ErrorPageExtensionReturn*>(output);
+
+    errorPage->content = QString("data:text/html,<body/>").toUtf8();
+
+    return true;
+}
+
+QObject* WebPage::createPlugin(const QString& classId, const QUrl& url, const QStringList& paramNames, const QStringList& paramValues)
+{
+    Q_UNUSED(url);
+    Q_UNUSED(paramNames);
+    Q_UNUSED(paramValues);
+#ifndef QT_NO_UITOOLS
+    QUiLoader loader;
+    return loader.createWidget(classId, view());
+#else
+    Q_UNUSED(classId);
+    return 0;
+#endif
+}
+
 DumpRenderTree::DumpRenderTree()
     : m_dumpPixels(false)
     , m_stdin(0)
     , m_notifier(0)
+    , m_enableTextOutput(false)
 {
     qt_drt_overwritePluginDirectories();
     QWebSettings::enablePersistentStorage();
 
+    // create our primary testing page/view.
+    m_mainView = new QWebView(0);
+    m_mainView->resize(QSize(maxViewWidth, maxViewHeight));
+    m_page = new WebPage(m_mainView, this);
+    m_mainView->setPage(m_page);
+
+    // create out controllers. This has to be done before connectFrame,
+    // as it exports there to the JavaScript DOM window.
     m_controller = new LayoutTestController(this);
     connect(m_controller, SIGNAL(done()), this, SLOT(dump()));
+    m_eventSender = new EventSender(m_page);
+    m_textInputController = new TextInputController(m_page);
+    m_gcController = new GCController(m_page);
 
-    QWebView *view = new QWebView(0);
-    view->resize(QSize(maxViewWidth, maxViewHeight));
-    m_page = new WebPage(view, this);
-    view->setPage(m_page);
-    connect(m_page, SIGNAL(frameCreated(QWebFrame *)), this, SLOT(connectFrame(QWebFrame *)));
+    // now connect our different signals
+    connect(m_page, SIGNAL(frameCreated(QWebFrame *)),
+            this, SLOT(connectFrame(QWebFrame *)));
     connectFrame(m_page->mainFrame());
 
-    connect(m_page->mainFrame(), SIGNAL(loadFinished(bool)), m_controller, SLOT(maybeDump(bool)));
+    connect(m_page, SIGNAL(loadFinished(bool)),
+            m_controller, SLOT(maybeDump(bool)));
 
-    m_page->mainFrame()->setScrollBarPolicy(Qt::Horizontal, Qt::ScrollBarAlwaysOff);
-    m_page->mainFrame()->setScrollBarPolicy(Qt::Vertical, Qt::ScrollBarAlwaysOff);
     connect(m_page->mainFrame(), SIGNAL(titleChanged(const QString&)),
             SLOT(titleChanged(const QString&)));
     connect(m_page, SIGNAL(databaseQuotaExceeded(QWebFrame*,QString)),
@@ -239,20 +340,15 @@ DumpRenderTree::DumpRenderTree()
     connect(m_page, SIGNAL(statusBarMessage(const QString&)),
             this, SLOT(statusBarMessage(const QString&)));
 
-    m_eventSender = new EventSender(m_page);
-    m_textInputController = new TextInputController(m_page);
-    m_gcController = new GCController(m_page);
-
     QObject::connect(this, SIGNAL(quit()), qApp, SLOT(quit()), Qt::QueuedConnection);
     qt_drt_run(true);
     QFocusEvent event(QEvent::FocusIn, Qt::ActiveWindowFocusReason);
-    QApplication::sendEvent(view, &event);
+    QApplication::sendEvent(m_mainView, &event);
 }
 
 DumpRenderTree::~DumpRenderTree()
 {
-    delete m_page;
-
+    delete m_mainView;
     delete m_stdin;
     delete m_notifier;
 }
@@ -270,29 +366,48 @@ void DumpRenderTree::open()
     }
 }
 
-void DumpRenderTree::resetToConsistentStateBeforeTesting()
+static void clearHistory(QWebPage* page)
 {
-    closeRemainingWindows();
+    // QWebHistory::clear() leaves current page, so remove it as well by setting
+    // max item count to 0, and then setting it back to it's original value.
+
+    QWebHistory* history = page->history();
+    int itemCount = history->maximumItemCount();
+
+    history->clear();
+    history->setMaximumItemCount(0);
+    history->setMaximumItemCount(itemCount);
+}
 
-    // Reset so that any current loads are stopped
+void DumpRenderTree::resetToConsistentStateBeforeTesting()
+{
+    // reset so that any current loads are stopped
+    // NOTE: that this has to be done before the layoutTestController is
+    // reset or we get timeouts for some tests.
     m_page->blockSignals(true);
     m_page->triggerAction(QWebPage::Stop);
     m_page->blockSignals(false);
 
-    m_page->mainFrame()->setZoomFactor(1.0);
+    // reset the layoutTestController at this point, so that we under no
+    // circumstance dump (stop the waitUntilDone timer) during the reset
+    // of the DRT.
+    m_controller->reset();
+
+    closeRemainingWindows();
 
-    static_cast<WebPage*>(m_page)->resetSettings();
+    m_page->resetSettings();
+    m_page->undoStack()->clear();
+    m_page->mainFrame()->setZoomFactor(1.0);
+    clearHistory(m_page);
     qt_drt_clearFrameName(m_page->mainFrame());
 
     WorkQueue::shared()->clear();
-    // Causes timeout, why?
-    //WorkQueue::shared()->setFrozen(false);
+    WorkQueue::shared()->setFrozen(false);
 
-    m_controller->reset();
     qt_drt_resetOriginAccessWhiteLists();
 
-    QLocale qlocale;
-    QLocale::setDefault(qlocale); 
+    QLocale::setDefault(QLocale::c());
+    setlocale(LC_ALL, "");
 }
 
 void DumpRenderTree::open(const QUrl& aurl)
@@ -316,7 +431,7 @@ void DumpRenderTree::open(const QUrl& aurl)
     bool isW3CTest = url.toString().contains("svg/W3C-SVG-1.1");
     int width = isW3CTest ? 480 : maxViewWidth;
     int height = isW3CTest ? 360 : maxViewHeight;
-    m_page->view()->resize(QSize(width, height));
+    m_mainView->resize(QSize(width, height));
     m_page->setPreferredContentsSize(QSize());
     m_page->setViewportSize(QSize(width, height));
 
@@ -329,6 +444,7 @@ void DumpRenderTree::open(const QUrl& aurl)
 #endif
 
     qt_dump_frame_loader(url.toString().contains("loading/"));
+    setTextOutputEnabled(true);
     m_page->mainFrame()->load(url);
 }
 
@@ -359,7 +475,7 @@ void DumpRenderTree::setDumpPixels(bool dump)
 
 void DumpRenderTree::closeRemainingWindows()
 {
-    foreach(QWidget *widget, windows)
+    foreach (QObject* widget, windows)
         delete widget;
     windows.clear();
 }
@@ -377,7 +493,7 @@ void DumpRenderTree::initJSObjects()
 
 QString DumpRenderTree::dumpFramesAsText(QWebFrame* frame)
 {
-    if (!frame)
+    if (!frame || !qt_drt_hasDocumentElement(frame))
         return QString();
 
     QString result;
@@ -388,7 +504,8 @@ QString DumpRenderTree::dumpFramesAsText(QWebFrame* frame)
         result.append(QLatin1String("'\n--------\n"));
     }
 
-    result.append(frame->toPlainText());
+    QString innerText = frame->toPlainText();
+    result.append(innerText);
     result.append(QLatin1String("\n"));
 
     if (m_controller->shouldDumpChildrenAsText()) {
@@ -400,11 +517,69 @@ QString DumpRenderTree::dumpFramesAsText(QWebFrame* frame)
     return result;
 }
 
+static QString dumpHistoryItem(const QWebHistoryItem& item, int indent, bool current)
+{
+    QString result;
+
+    int start = 0;
+    if (current) {
+        result.append(QLatin1String("curr->"));
+        start = 6;
+    }
+    for (int i = start; i < indent; i++)
+        result.append(' ');
+
+    QString url = item.url().toString();
+    if (url.contains("file://")) {
+        static QString layoutTestsString("/LayoutTests/");
+        static QString fileTestString("(file test):");
+
+        QString res = url.mid(url.indexOf(layoutTestsString) + layoutTestsString.length());
+        if (res.isEmpty())
+            return result;
+
+        result.append(fileTestString);
+        result.append(res);
+    } else {
+        result.append(url);
+    }
+
+    // FIXME: Wrong, need (private?) API for determining this.
+    result.append(QLatin1String("  **nav target**"));
+    result.append(QLatin1String("\n"));
+
+    return result;
+}
+
 QString DumpRenderTree::dumpBackForwardList()
 {
+    QWebHistory* history = webPage()->history();
+
     QString result;
     result.append(QLatin1String("\n============== Back Forward List ==============\n"));
-    result.append(QLatin1String("FIXME: Unimplemented!\n"));
+
+    // FORMAT:
+    // "        (file test):fast/loader/resources/click-fragment-link.html  **nav target**"
+    // "curr->  (file test):fast/loader/resources/click-fragment-link.html#testfragment  **nav target**"
+
+    int maxItems = history->maximumItemCount();
+
+    foreach (const QWebHistoryItem item, history->backItems(maxItems)) {
+        if (!item.isValid())
+            continue;
+        result.append(dumpHistoryItem(item, 8, false));
+    }
+
+    QWebHistoryItem item = history->currentItem();
+    if (item.isValid())
+        result.append(dumpHistoryItem(item, 8, true));
+
+    foreach (const QWebHistoryItem item, history->forwardItems(maxItems)) {
+        if (!item.isValid())
+            continue;
+        result.append(dumpHistoryItem(item, 8, false));
+    }
+
     result.append(QLatin1String("===============================================\n"));
     return result;
 }
@@ -551,25 +726,28 @@ QWebPage *DumpRenderTree::createWindow()
 {
     if (!m_controller->canOpenWindows())
         return 0;
-    QWidget *container = new QWidget(0);
-    container->resize(0, 0);
-    container->move(-1, -1);
-    container->hide();
-    QWebPage *page = new WebPage(container, this);
-    connectFrame(page->mainFrame());
-    connect(m_page, SIGNAL(frameCreated(QWebFrame *)), this, SLOT(connectFrame(QWebFrame *)));
+
+    // Create a dummy container object to track the page in DRT.
+    // QObject is used instead of QWidget to prevent DRT from
+    // showing the main view when deleting the container.
+
+    QObject* container = new QObject(m_mainView);
+    // create a QWebPage we want to return
+    QWebPage* page = static_cast<QWebPage*>(new WebPage(container, this));
+    // gets cleaned up in closeRemainingWindows()
     windows.append(container);
+
+    // connect the needed signals to the page
+    connect(page, SIGNAL(frameCreated(QWebFrame*)), this, SLOT(connectFrame(QWebFrame*)));
+    connectFrame(page->mainFrame());
+    connect(page, SIGNAL(loadFinished(bool)), m_controller, SLOT(maybeDump(bool)));
     return page;
 }
 
 int DumpRenderTree::windowCount() const
 {
-    int count = 0;
-    foreach(QWidget *w, windows) {
-        if (w->children().count())
-            ++count;
-    }
-    return count + 1;
+// include the main view in the count
+    return windows.count() + 1;
 }
 
 #if defined(Q_WS_X11)
@@ -613,5 +791,3 @@ void DumpRenderTree::initializeFonts()
 #endif
 
 }
-
-#include "DumpRenderTree.moc"
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.h b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.h
index c5b4801..ab229fe 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.h
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.h
@@ -31,15 +31,25 @@
 #define DUMPRENDERTREE_H
 
 #include <QList>
+#include <QNetworkAccessManager>
 #include <QObject>
 #include <QTextStream>
 #include <QSocketNotifier>
 
+#ifndef QT_NO_SSL
+#include <QSslError>
+#endif
+
+#include <qwebframe.h>
+#include <qwebinspector.h>
+#include <qwebpage.h>
+#include <qwebview.h>
+
 QT_BEGIN_NAMESPACE
 class QUrl;
 class QFile;
 QT_END_NAMESPACE
-class QWebPage;
+
 class QWebFrame;
 
 class LayoutTestController;
@@ -49,6 +59,8 @@ class GCController;
 
 namespace WebCore {
 
+class WebPage;
+
 class DumpRenderTree : public QObject {
 Q_OBJECT
 
@@ -62,6 +74,9 @@ public:
     // Initialize in single-file mode.
     void open(const QUrl& url);
 
+    void setTextOutputEnabled(bool enable) { m_enableTextOutput = enable; }
+    bool isTextOutputEnabled() { return m_enableTextOutput; }
+
     void setDumpPixels(bool);
 
     void closeRemainingWindows();
@@ -74,7 +89,7 @@ public:
     QWebPage *createWindow();
     int windowCount() const;
 
-    QWebPage *webPage() const { return m_page; }
+    WebPage *webPage() const { return m_page; }
 
 
 #if defined(Q_WS_X11)
@@ -101,7 +116,8 @@ private:
     bool m_dumpPixels;
     QString m_expectedHash;
 
-    QWebPage *m_page;
+    WebPage *m_page;
+    QWebView* m_mainView;
 
     EventSender *m_eventSender;
     TextInputController *m_textInputController;
@@ -110,7 +126,59 @@ private:
     QFile *m_stdin;
     QSocketNotifier* m_notifier;
 
-    QList<QWidget *> windows;
+    QList<QObject*> windows;
+    bool m_enableTextOutput;
+};
+
+class NetworkAccessManager : public QNetworkAccessManager {
+    Q_OBJECT
+public:
+    NetworkAccessManager(QObject* parent);
+
+private slots:
+#ifndef QT_NO_SSL
+    void sslErrorsEncountered(QNetworkReply*, const QList<QSslError>&);
+#endif
+};
+
+class WebPage : public QWebPage {
+    Q_OBJECT
+public:
+    WebPage(QObject* parent, DumpRenderTree*);
+    virtual ~WebPage();
+    QWebInspector* webInspector();
+
+    QWebPage *createWindow(QWebPage::WebWindowType);
+
+    void javaScriptAlert(QWebFrame *frame, const QString& message);
+    void javaScriptConsoleMessage(const QString& message, int lineNumber, const QString& sourceID);
+    bool javaScriptConfirm(QWebFrame *frame, const QString& msg);
+    bool javaScriptPrompt(QWebFrame *frame, const QString& msg, const QString& defaultValue, QString* result);
+
+    void resetSettings();
+
+    virtual bool supportsExtension(QWebPage::Extension extension) const;
+    virtual bool extension(Extension extension, const ExtensionOption *option, ExtensionReturn *output);
+
+    QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&);
+
+public slots:
+    bool shouldInterruptJavaScript() { return false; }
+
+protected:
+    bool acceptNavigationRequest(QWebFrame* frame, const QNetworkRequest& request, NavigationType type);
+    bool isTextOutputEnabled() { return m_drt->isTextOutputEnabled(); }
+
+private slots:
+    void setViewGeometry(const QRect &r)
+    {
+        QWidget *v = view();
+        if (v)
+            v->setGeometry(r);
+    }
+private:
+    QWebInspector* m_webInspector;
+    DumpRenderTree *m_drt;
 };
 
 }
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
index 571313c..81e929b 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
@@ -1,9 +1,20 @@
 TARGET = DumpRenderTree
 CONFIG  -= app_bundle
+CONFIG += uitools
+
+mac:!static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
+    CONFIG -= debug
+    CONFIG += release
+}
+
+BASEDIR = $$PWD/../
 
 include(../../../WebKit.pri)
 INCLUDEPATH += /usr/include/freetype2
+INCLUDEPATH += ../../..
 INCLUDEPATH += ../../../JavaScriptCore
+INCLUDEPATH += ../../../JavaScriptCore/ForwardingHeaders
+INCLUDEPATH += $$BASEDIR
 DESTDIR = ../../../bin
 
 CONFIG += link_pkgconfig
@@ -12,7 +23,7 @@ PKGCONFIG += fontconfig
 QT = core gui network
 macx: QT += xml
 
-HEADERS = WorkQueue.h \
+HEADERS = $$BASEDIR/WorkQueue.h \
     WorkQueueItem.h \
     DumpRenderTree.h \
     EventSenderQt.h \
@@ -20,7 +31,7 @@ HEADERS = WorkQueue.h \
     LayoutTestControllerQt.h \
     jsobjects.h \
     testplugin.h
-SOURCES = WorkQueue.cpp \
+SOURCES = $$BASEDIR/WorkQueue.cpp \
     DumpRenderTree.cpp \
     EventSenderQt.cpp \
     TextInputControllerQt.cpp \
@@ -34,8 +45,4 @@ unix:!mac {
     QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 }
 
-lessThan(QT_MINOR_VERSION, 4) {
-    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-}
-
 DEFINES+=USE_SYSTEM_MALLOC
diff --git a/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp b/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
index bbefed9..a0da273 100644
--- a/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
+++ b/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
@@ -30,6 +30,15 @@
 #include "EventSenderQt.h"
 
 //#include <QtDebug>
+
+#define KEYCODE_DEL         127
+#define KEYCODE_BACKSPACE   8
+#define KEYCODE_LEFTARROW   0xf702
+#define KEYCODE_RIGHTARROW  0xf703
+#define KEYCODE_UPARROW     0xf700
+#define KEYCODE_DOWNARROW   0xf701
+
+
 EventSender::EventSender(QWebPage* parent)
     : QObject(parent)
 {
@@ -129,7 +138,7 @@ void EventSender::keyDown(const QString& string, const QStringList& modifiers)
             if (modifs == Qt::ShiftModifier)
                 code = Qt::Key_Backtab;
             s = QString();
-        } else if (code == 127) {
+        } else if (code == KEYCODE_DEL || code == KEYCODE_BACKSPACE) {
             code = Qt::Key_Backspace;
             if (modifs == Qt::AltModifier)
                 modifs = Qt::ControlModifier;
@@ -148,28 +157,28 @@ void EventSender::keyDown(const QString& string, const QStringList& modifiers)
             s = QString();
             code = Qt::Key_Home;
             modifs = 0;
-        } else if (code == 0xf702) {
+        } else if (code == KEYCODE_LEFTARROW) {
             s = QString();
             code = Qt::Key_Left;
             if (modifs & Qt::MetaModifier) {
                 code = Qt::Key_Home;
                 modifs &= ~Qt::MetaModifier;
             }
-        } else if (code == 0xf703) {
+        } else if (code == KEYCODE_RIGHTARROW) {
             s = QString();
             code = Qt::Key_Right;
             if (modifs & Qt::MetaModifier) {
                 code = Qt::Key_End;
                 modifs &= ~Qt::MetaModifier;
             }
-        } else if (code == 0xf700) {
+        } else if (code == KEYCODE_UPARROW) {
             s = QString();
             code = Qt::Key_Up;
             if (modifs & Qt::MetaModifier) {
                 code = Qt::Key_PageUp;
                 modifs &= ~Qt::MetaModifier;
             }
-        } else if (code == 0xf701) {
+        } else if (code == KEYCODE_DOWNARROW) {
             s = QString();
             code = Qt::Key_Down;
             if (modifs & Qt::MetaModifier) {
diff --git a/WebKitTools/DumpRenderTree/qt/ImageDiff.pro b/WebKitTools/DumpRenderTree/qt/ImageDiff.pro
index 11ee1fa..636835a 100644
--- a/WebKitTools/DumpRenderTree/qt/ImageDiff.pro
+++ b/WebKitTools/DumpRenderTree/qt/ImageDiff.pro
@@ -13,6 +13,3 @@ unix:!mac {
     QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 }
 
-lessThan(QT_MINOR_VERSION, 4) {
-    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-}
diff --git a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
index b8de6a5..0ea5632 100644
--- a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
+++ b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
@@ -32,13 +32,16 @@
 #include "DumpRenderTree.h"
 #include "WorkQueue.h"
 #include "WorkQueueItem.h"
+#include <QDir>
 
 extern void qt_dump_editing_callbacks(bool b);
 extern void qt_dump_resource_load_callbacks(bool b);
 extern void qt_drt_setJavaScriptProfilingEnabled(QWebFrame*, bool enabled);
 extern bool qt_drt_pauseAnimation(QWebFrame*, const QString& name, double time, const QString& elementId);
 extern bool qt_drt_pauseTransitionOfProperty(QWebFrame*, const QString& name, double time, const QString& elementId);
+extern bool qt_drt_pauseSVGAnimation(QWebFrame*, const QString& animationId, double time, const QString& elementId);
 extern int qt_drt_numberOfActiveAnimations(QWebFrame*);
+
 extern void qt_drt_whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
 extern QString qt_drt_counterValueForElementById(QWebFrame* qFrame, const QString& id);
 
@@ -63,6 +66,7 @@ void LayoutTestController::reset()
     m_timeoutTimer.stop();
     m_topLoadingFrame = 0;
     m_waitForPolicy = false;
+    m_handleErrorPages = false;
     qt_dump_editing_callbacks(false);
     qt_dump_resource_load_callbacks(false);
 }
@@ -72,7 +76,7 @@ void LayoutTestController::processWork()
     // qDebug() << ">>>processWork";
 
     // if we didn't start a new load, then we finished all the commands, so we're ready to dump state
-    if (!WorkQueue::shared()->processWork() && !shouldWaitUntilDone()) {
+    if (WorkQueue::shared()->processWork() && !shouldWaitUntilDone()) {
         emit done();
         m_isLoading = false;
     }
@@ -81,7 +85,7 @@ void LayoutTestController::processWork()
 // Called on loadFinished on mainFrame.
 void LayoutTestController::maybeDump(bool success)
 {
-    Q_ASSERT(sender() == m_topLoadingFrame);
+    Q_ASSERT(sender() == m_topLoadingFrame->page());
 
     // as the function is called on loadFinished, the test might
     // already have dumped and thus no longer be active, thus
@@ -107,7 +111,7 @@ void LayoutTestController::waitUntilDone()
 {
     //qDebug() << ">>>>waitForDone";
     m_waitForDone = true;
-    m_timeoutTimer.start(11000, this);
+    m_timeoutTimer.start(15000, this);
 }
 
 QString LayoutTestController::counterValueForElementById(const QString& id)
@@ -123,10 +127,14 @@ void LayoutTestController::keepWebHistory()
 void LayoutTestController::notifyDone()
 {
     qDebug() << ">>>>notifyDone";
+
     if (!m_timeoutTimer.isActive())
         return;
+
     m_timeoutTimer.stop();
     emit done();
+
+    // FIXME: investigate why always resetting these result in timeouts
     m_isLoading = false;
     m_waitForDone = false;
     m_waitForPolicy = false;
@@ -142,6 +150,12 @@ void LayoutTestController::clearBackForwardList()
     m_drt->webPage()->history()->clear();
 }
 
+QString LayoutTestController::pathToLocalResource(const QString& url)
+{
+    // Function introduced in r28690.
+    return QLatin1String("file://") + QUrl(url).toLocalFile();
+}
+
 void LayoutTestController::dumpEditingCallbacks()
 {
     qDebug() << ">>>dumpEditingCallbacks";
@@ -179,10 +193,16 @@ void LayoutTestController::queueReload()
     WorkQueue::shared()->queue(new ReloadItem(m_drt->webPage()));
 }
 
-void LayoutTestController::queueScript(const QString &url)
+void LayoutTestController::queueLoadingScript(const QString& script)
+{
+    //qDebug() << ">>>queueLoadingScript" << script;
+    WorkQueue::shared()->queue(new LoadingScriptItem(script, m_drt->webPage()));
+}
+
+void LayoutTestController::queueNonLoadingScript(const QString& script)
 {
-    //qDebug() << ">>>queueScript" << url;
-    WorkQueue::shared()->queue(new ScriptItem(url, m_drt->webPage()));
+    //qDebug() << ">>>queueNonLoadingScript" << script;
+    WorkQueue::shared()->queue(new NonLoadingScriptItem(script, m_drt->webPage()));
 }
 
 void LayoutTestController::provisionalLoad()
@@ -195,7 +215,9 @@ void LayoutTestController::provisionalLoad()
 void LayoutTestController::timerEvent(QTimerEvent *ev)
 {
     if (ev->timerId() == m_timeoutTimer.timerId()) {
-        //qDebug() << ">>>>>>>>>>>>> timeout";
+        const char* message = "FAIL: Timed out waiting for notifyDone to be called\n";
+        fprintf(stderr, "%s", message);
+        fprintf(stdout, "%s", message);
         notifyDone();
     } else
         QObject::timerEvent(ev);
@@ -215,6 +237,22 @@ QString LayoutTestController::decodeHostName(const QString& host)
     return decoded;
 }
 
+void LayoutTestController::showWebInspector()
+{
+    m_drt->webPage()->settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+    m_drt->webPage()->webInspector()->show();
+}
+
+void LayoutTestController::hideWebInspector()
+{
+    m_drt->webPage()->webInspector()->hide();
+}
+
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
+{
+    m_drt->webPage()->settings()->setAttribute(QWebSettings::LocalContentCanAccessRemoteUrls, enabled);
+}
+
 void LayoutTestController::setJavaScriptProfilingEnabled(bool enable)
 {
     m_topLoadingFrame->page()->settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
@@ -260,6 +298,15 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(const QString& p
     return qt_drt_pauseTransitionOfProperty(frame, propertyName, time, elementId);
 }
 
+bool LayoutTestController::sampleSVGAnimationForElementAtTime(const QString& animationId,
+                                                              double time,
+                                                              const QString& elementId)
+{
+    QWebFrame* frame = m_drt->webPage()->mainFrame();
+    Q_ASSERT(frame);
+    return qt_drt_pauseSVGAnimation(frame, animationId, time, elementId);
+}
+
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     QWebFrame* frame = m_drt->webPage()->mainFrame();
@@ -313,4 +360,6 @@ void LayoutTestController::overridePreference(const QString& name, const QVarian
         settings->setAttribute(QWebSettings::OfflineWebApplicationCacheEnabled, value.toBool());
     else if (name == "WebKitDefaultFontSize")
         settings->setFontSize(QWebSettings::DefaultFontSize, value.toInt());
+    else if (name == "WebKitUsesPageCachePreferenceKey")
+        QWebSettings::setMaximumPagesInCache(value.toInt());
 }
diff --git a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
index cab014c..ac8681f 100644
--- a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
+++ b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
@@ -63,6 +63,7 @@ public:
     bool shouldDumpDatabaseCallbacks() const { return m_dumpDatabaseCallbacks; }
     bool shouldDumpStatusCallbacks() const { return m_dumpStatusCallbacks; }
     bool shouldWaitUntilDone() const { return m_waitForDone; }
+    bool shouldHandleErrorPages() const { return m_handleErrorPages; }
     bool canOpenWindows() const { return m_canOpenWindows; }
     bool shouldDumpTitleChanges() const { return m_dumpTitleChanges; }
     bool waitForPolicy() const { return m_waitForPolicy; }
@@ -87,22 +88,28 @@ public slots:
     void keepWebHistory();
     void notifyDone();
     void dumpBackForwardList() { m_dumpBackForwardList = true; }
+    void handleErrorPages() { m_handleErrorPages = true; }
     void dumpEditingCallbacks();
     void dumpResourceLoadCallbacks();
     void queueBackNavigation(int howFarBackward);
     void queueForwardNavigation(int howFarForward);
     void queueLoad(const QString& url, const QString& target = QString());
     void queueReload();
-    void queueScript(const QString& url);
+    void queueLoadingScript(const QString& script);
+    void queueNonLoadingScript(const QString& script);
     void provisionalLoad();
     void setCloseRemainingWindowsWhenComplete(bool = false) {}
     int windowCount();
     void display() {}
     void clearBackForwardList();
+    QString pathToLocalResource(const QString& url);
     void dumpTitleChanges() { m_dumpTitleChanges = true; }
     QString encodeHostName(const QString& host);
     QString decodeHostName(const QString& host);
     void dumpSelectionRect() const {}
+    void showWebInspector();
+    void hideWebInspector();
+    void setAllowUniversalAccessFromFileURLs(bool enable);
     void setJavaScriptProfilingEnabled(bool enable);
     void setFixedContentsSize(int width, int height);
     void setPrivateBrowsingEnabled(bool enable);
@@ -111,6 +118,8 @@ public slots:
 
     bool pauseAnimationAtTimeOnElementWithId(const QString& animationName, double time, const QString& elementId);
     bool pauseTransitionAtTimeOnElementWithId(const QString& propertyName, double time, const QString& elementId);
+    bool sampleSVGAnimationForElementAtTime(const QString& animationId, double time, const QString& elementId);
+
     unsigned numberOfActiveAnimations() const;
 
     void whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
@@ -138,6 +147,7 @@ private:
     bool m_dumpDatabaseCallbacks;
     bool m_dumpStatusCallbacks;
     bool m_waitForPolicy;
+    bool m_handleErrorPages;
 
     QBasicTimer m_timeoutTimer;
     QWebFrame* m_topLoadingFrame;
diff --git a/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro b/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
index 7f502f8..7b8162b 100644
--- a/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
+++ b/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
@@ -1,7 +1,7 @@
 TEMPLATE = lib
 TARGET = TestNetscapePlugIn
 
-VPATH = ../../gtk/TestNetscapePlugin ../../TestNetscapePlugIn.subproj
+VPATH = ../../unix/TestNetscapePlugin ../../TestNetscapePlugIn.subproj
 include(../../../../WebKit.pri)
 
 DESTDIR = $$OUTPUT_DIR/lib/plugins
@@ -18,8 +18,8 @@ mac {
 }
 
 INCLUDEPATH += ../../../../JavaScriptCore \
-               ../../gtk/TestNetscapePlugin/ForwardingHeaders \
-               ../../gtk/TestNetscapePlugin/ForwardingHeaders/WebKit \
+               ../../unix/TestNetscapePlugin/ForwardingHeaders \
+               ../../unix/TestNetscapePlugin/ForwardingHeaders/WebKit \
                ../../../../WebCore \
                ../../../../WebCore/bridge \
                ../../TestNetscapePlugIn.subproj
@@ -31,5 +31,5 @@ mac {
     SOURCES += ../../TestNetscapePlugIn.subproj/main.cpp
     LIBS += -framework Carbon
 } else {
-    SOURCES += ../../gtk/TestNetscapePlugin/TestNetscapePlugin.cpp
+    SOURCES += ../../unix/TestNetscapePlugin/TestNetscapePlugin.cpp
 }
diff --git a/WebKitTools/DumpRenderTree/qt/WorkQueue.cpp b/WebKitTools/DumpRenderTree/qt/WorkQueue.cpp
deleted file mode 100644
index f8448e4..0000000
--- a/WebKitTools/DumpRenderTree/qt/WorkQueue.cpp
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
- * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "WorkQueue.h"
-
-static const unsigned queueLength = 1024;
-
-static WorkQueueItem* theQueue[queueLength];
-static unsigned startOfQueue;
-static unsigned endOfQueue;
-
-WorkQueue* WorkQueue::shared()
-{
-    static WorkQueue* sharedInstance = new WorkQueue;
-    return sharedInstance;
-}
-
-WorkQueue::WorkQueue()
-    : m_frozen(false)
-{
-}
-
-void WorkQueue::queue(WorkQueueItem* item)
-{
-    Q_ASSERT(endOfQueue < queueLength);
-    Q_ASSERT(endOfQueue >= startOfQueue);
-
-    if (m_frozen) {
-        delete item;
-        return;
-    }
-
-    theQueue[endOfQueue++] = item;
-}
-
-WorkQueueItem* WorkQueue::dequeue()
-{
-    Q_ASSERT(endOfQueue >= startOfQueue);
-
-    if (startOfQueue == endOfQueue)
-        return 0;
-
-    return theQueue[startOfQueue++];
-}
-
-unsigned WorkQueue::count()
-{
-    return endOfQueue - startOfQueue;
-}
-
-void WorkQueue::clear()
-{
-    for (unsigned i = startOfQueue; i < endOfQueue; ++i) {
-        delete theQueue[i];
-        theQueue[i] = 0;
-    }
-
-    startOfQueue = 0;
-    endOfQueue = 0;
-}
-
-bool WorkQueue::processWork()
-{
-    bool startedLoad = false;
-
-    while (!startedLoad && count()) {
-        WorkQueueItem* item = dequeue();
-        Q_ASSERT(item);
-        startedLoad = item->invoke();
-        delete item;
-    }
-
-    // If we're done and we didn't start a load, then we're really done, so return true.
-    return !startedLoad;
-}
diff --git a/WebKitTools/DumpRenderTree/qt/WorkQueue.h b/WebKitTools/DumpRenderTree/qt/WorkQueue.h
deleted file mode 100644
index 902ba0d..0000000
--- a/WebKitTools/DumpRenderTree/qt/WorkQueue.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
- * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WorkQueue_h
-#define WorkQueue_h
-
-#include "WorkQueueItem.h"
-
-class WorkQueue {
-public:
-    static WorkQueue* shared();
-
-    void queue(WorkQueueItem*);
-    WorkQueueItem* dequeue();
-    void clear();
-    unsigned count();
-
-    void setFrozen(bool b) { m_frozen = b; }
-
-    bool processWork(); // Returns true if all work is done, false if we started a load.
-
-private:
-    WorkQueue();
-
-    bool m_frozen;
-};
-
-#endif // !defined(WorkQueue_h)
diff --git a/WebKitTools/DumpRenderTree/qt/WorkQueueItem.h b/WebKitTools/DumpRenderTree/qt/WorkQueueItem.h
index 9819ec0..d534493 100644
--- a/WebKitTools/DumpRenderTree/qt/WorkQueueItem.h
+++ b/WebKitTools/DumpRenderTree/qt/WorkQueueItem.h
@@ -89,6 +89,27 @@ private:
     QString m_script;
 };
 
+class LoadingScriptItem : public ScriptItem {
+public:
+    LoadingScriptItem(const QString& script, QWebPage* page)
+        : ScriptItem(script, page)
+    {
+    }
+
+    virtual bool invoke() const { return ScriptItem::invoke(); }
+};
+
+class NonLoadingScriptItem : public ScriptItem {
+public:
+    NonLoadingScriptItem(const QString& script, QWebPage* page)
+        : ScriptItem(script, page)
+    {
+    }
+
+    virtual bool invoke() const { ScriptItem::invoke(); return false; }
+};
+
+
 class BackForwardItem : public WorkQueueItem {
 public:
     virtual bool invoke() const;
diff --git a/WebKitTools/DumpRenderTree/qt/jsobjects.cpp b/WebKitTools/DumpRenderTree/qt/jsobjects.cpp
index e747aeb..af331f0 100644
--- a/WebKitTools/DumpRenderTree/qt/jsobjects.cpp
+++ b/WebKitTools/DumpRenderTree/qt/jsobjects.cpp
@@ -26,7 +26,10 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-#include <jsobjects.h>
+
+#include "config.h"
+#include "jsobjects.h"
+
 #include <qwebpage.h>
 
 GCController::GCController(QWebPage* parent)
diff --git a/WebKitTools/DumpRenderTree/qt/main.cpp b/WebKitTools/DumpRenderTree/qt/main.cpp
index ae67a59..719315f 100644
--- a/WebKitTools/DumpRenderTree/qt/main.cpp
+++ b/WebKitTools/DumpRenderTree/qt/main.cpp
@@ -29,6 +29,8 @@
 
 #include "DumpRenderTree.h"
 
+#include <wtf/AlwaysInline.h>
+
 #include <qstringlist.h>
 #include <qapplication.h>
 #include <qurl.h>
@@ -38,6 +40,7 @@
 #include <qwebsettings.h>
 #include <qwebdatabase.h>
 #include <qdesktopservices.h>
+#include <qwindowsstyle.h>
 
 #ifdef Q_WS_X11
 #include <qx11info_x11.h>
@@ -86,7 +89,7 @@ QString get_backtrace() {
     return s;
 }
 
-static void crashHandler(int sig)
+static NO_RETURN void crashHandler(int sig)
 {
     fprintf(stderr, "%s\n", strsignal(sig));
     fprintf(stderr, "%s\n", get_backtrace().toLatin1().constData());
@@ -98,23 +101,25 @@ int main(int argc, char* argv[])
 #ifdef Q_WS_X11
     FcInit();
     WebCore::DumpRenderTree::initializeFonts();
+#endif
+
 #if QT_VERSION >= 0x040500
     QApplication::setGraphicsSystem("raster");
 #endif
-#endif
-    QApplication app(argc, argv);
-#ifdef Q_WS_X11
-    QX11Info::setAppDpiY(0, 96);
-    QX11Info::setAppDpiX(0, 96);
-#endif
+
+    QApplication::setStyle(new QWindowsStyle);
 
     QFont f("Sans Serif");
     f.setPointSize(9);
     f.setWeight(QFont::Normal);
     f.setStyle(QFont::StyleNormal);
-    app.setFont(f);
-    app.setStyle(QLatin1String("Plastique"));
+    QApplication::setFont(f);
 
+    QApplication app(argc, argv);
+#ifdef Q_WS_X11
+    QX11Info::setAppDpiY(0, 96);
+    QX11Info::setAppDpiX(0, 96);
+#endif
 
     signal(SIGILL, crashHandler);    /* 4:   illegal instruction (not reset when caught) */
     signal(SIGTRAP, crashHandler);   /* 5:   trace trap (not reset when caught) */
diff --git a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h b/WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h
index 08706f7..08706f7 100644
--- a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h
+++ b/WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h
diff --git a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h b/WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h
index 54a603d..54a603d 100644
--- a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h
+++ b/WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h
diff --git a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h b/WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h
index 00bbc18..00bbc18 100644
--- a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h
+++ b/WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h
diff --git a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp b/WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/TestNetscapePlugin.cpp
index 6c62a7c..cb01267 100644
--- a/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp
+++ b/WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/TestNetscapePlugin.cpp
@@ -45,6 +45,8 @@ extern "C" {
     char* NP_GetMIMEDescription(void);
 }
 
+static void executeScript(const PluginObject* obj, const char* script);
+
 static NPError
 webkit_test_plugin_new_instance(NPMIMEType /*mimetype*/,
                                 NPP instance,
@@ -75,9 +77,15 @@ webkit_test_plugin_new_instance(NPMIMEType /*mimetype*/,
                 for (int i = 0; i < argc; i++)
                     if (strcasecmp(argn[i], "src") == 0)
                         pluginLog(instance, "src: %s", argv[i]);
-            }
+            } else if (strcasecmp(argn[i], "cleardocumentduringnew") == 0)
+                executeScript(obj, "document.body.innerHTML = ''");
+            else if (!strcasecmp(argn[i], "ondestroy"))
+                obj->onDestroy = strdup(argv[i]);
+            else if (strcasecmp(argn[i], "testdocumentopenindestroystream") == 0)
+                obj->testDocumentOpenInDestroyStream = TRUE;
+            else if (strcasecmp(argn[i], "testwindowopen") == 0)
+                obj->testWindowOpen = TRUE;
         }
-
         instance->pdata = obj;
     }
 
@@ -89,6 +97,11 @@ webkit_test_plugin_destroy_instance(NPP instance, NPSavedData** /*save*/)
 {
     PluginObject* obj = static_cast<PluginObject*>(instance->pdata);
     if (obj) {
+        if (obj->onDestroy) {
+            executeScript(obj, obj->onDestroy);
+            free(obj->onDestroy);
+        }
+
         if (obj->onStreamLoad)
             free(obj->onStreamLoad);
 
@@ -117,6 +130,12 @@ webkit_test_plugin_set_window(NPP instance, NPWindow *window)
             pluginLog(instance, "NPP_SetWindow: %d %d", (int)window->width, (int)window->height);
             obj->logSetWindow = false;
         }
+
+        if (obj->testWindowOpen) {
+            testWindowOpen(instance);
+            obj->testWindowOpen = FALSE;
+        }
+
     }
 
     return NPERR_NO_ERROR;
@@ -167,6 +186,11 @@ webkit_test_plugin_destroy_stream(NPP instance, NPStream* /*stream*/, NPError /*
     if (obj->onStreamDestroy)
         executeScript(obj, obj->onStreamDestroy);
 
+    if (obj->testDocumentOpenInDestroyStream) {
+        testDocumentOpen(instance);
+        obj->testDocumentOpenInDestroyStream = FALSE;
+    }
+
     return NPERR_NO_ERROR;
 }
 
diff --git a/WebKitTools/DumpRenderTree/win/AccessibilityUIElementWin.cpp b/WebKitTools/DumpRenderTree/win/AccessibilityUIElementWin.cpp
index de3d9ff..163abb1 100644
--- a/WebKitTools/DumpRenderTree/win/AccessibilityUIElementWin.cpp
+++ b/WebKitTools/DumpRenderTree/win/AccessibilityUIElementWin.cpp
@@ -151,10 +151,24 @@ JSStringRef AccessibilityUIElement::role()
     VARIANT vRole;
     if (FAILED(m_element->get_accRole(self(), &vRole)))
         return JSStringCreateWithCharacters(0, 0);
-    ASSERT(V_VT(&vRole) == VT_I4);
-    TCHAR roleText[64] = {0};
-    ::GetRoleText(V_I4(&vRole), roleText, ARRAYSIZE(roleText));
-    return JSStringCreateWithCharacters(roleText, _tcslen(roleText));
+
+    ASSERT(V_VT(&vRole) == VT_I4 || V_VT(&vRole) == VT_BSTR);
+
+    wstring result;
+    if (V_VT(&vRole) == VT_I4) {
+        unsigned roleTextLength = ::GetRoleText(V_I4(&vRole), 0, 0) + 1;
+
+        Vector<TCHAR> roleText(roleTextLength);
+
+        ::GetRoleText(V_I4(&vRole), roleText.data(), roleTextLength);
+
+        result = roleText.data();
+    } else if (V_VT(&vRole) == VT_BSTR)
+        result = wstring(V_BSTR(&vRole), ::SysStringLen(V_BSTR(&vRole)));
+
+    ::VariantClear(&vRole);
+
+    return JSStringCreateWithCharacters(result.data(), result.length());
 }
 
 JSStringRef AccessibilityUIElement::subrole()
@@ -162,6 +176,11 @@ JSStringRef AccessibilityUIElement::subrole()
     return 0;
 }
 
+JSStringRef AccessibilityUIElement::roleDescription()
+{
+    return 0;
+}
+
 JSStringRef AccessibilityUIElement::title()
 {
     BSTR titleBSTR;
@@ -175,13 +194,18 @@ JSStringRef AccessibilityUIElement::title()
 JSStringRef AccessibilityUIElement::description()
 {
     BSTR descriptionBSTR;
-    if (FAILED(m_element->get_accName(self(), &descriptionBSTR)) || !descriptionBSTR)
+    if (FAILED(m_element->get_accDescription(self(), &descriptionBSTR)) || !descriptionBSTR)
         return JSStringCreateWithCharacters(0, 0);
     wstring description(descriptionBSTR, SysStringLen(descriptionBSTR));
     ::SysFreeString(descriptionBSTR);
     return JSStringCreateWithCharacters(description.data(), description.length());
 }
 
+JSStringRef AccessibilityUIElement::stringValue()
+{
+    return JSStringCreateWithCharacters(0, 0);
+}
+
 JSStringRef AccessibilityUIElement::language()
 {
     return JSStringCreateWithCharacters(0, 0);
@@ -233,6 +257,35 @@ JSStringRef AccessibilityUIElement::valueDescription()
 {
     return 0;
 }
+bool AccessibilityUIElement::isSelected() const
+{
+    return false;
+}
+
+int AccessibilityUIElement::hierarchicalLevel() const
+{
+    return 0;
+}
+
+bool AccessibilityUIElement::ariaIsGrabbed() const
+{
+    return false;
+}
+ 
+JSStringRef AccessibilityUIElement::ariaDropEffects() const
+{
+    return 0;
+}
+
+bool AccessibilityUIElement::isExpanded() const
+{
+    return false;
+}
+
+JSStringRef AccessibilityUIElement::orientation() const
+{
+    return 0;
+}
 
 double AccessibilityUIElement::intValue()
 {
@@ -270,6 +323,7 @@ bool AccessibilityUIElement::isRequired() const
     return false;
 }
 
+
 int AccessibilityUIElement::insertionPointLineNumber()
 {
     return 0;
@@ -359,6 +413,11 @@ bool AccessibilityUIElement::isAttributeSettable(JSStringRef attribute)
     return false;
 }
 
+bool AccessibilityUIElement::isAttributeSupported(JSStringRef attribute)
+{
+    return false;
+}
+
 void AccessibilityUIElement::increment()
 {
 }
@@ -366,3 +425,55 @@ void AccessibilityUIElement::increment()
 void AccessibilityUIElement::decrement()
 {
 }
+
+void AccessibilityUIElement::showMenu()
+{
+}
+
+AccessibilityUIElement AccessibilityUIElement::disclosedRowAtIndex(unsigned index)
+{
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::ariaOwnsElementAtIndex(unsigned index)
+{
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::ariaFlowToElementAtIndex(unsigned index)
+{
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::selectedRowAtIndex(unsigned index)
+{
+    return 0;
+}
+
+AccessibilityUIElement AccessibilityUIElement::disclosedByRow()
+{
+    return 0;
+}
+
+JSStringRef AccessibilityUIElement::accessibilityValue() const
+{
+    BSTR valueBSTR;
+    if (FAILED(m_element->get_accValue(self(), &valueBSTR)) || !valueBSTR)
+        return JSStringCreateWithCharacters(0, 0);
+
+    wstring value(valueBSTR, SysStringLen(valueBSTR));
+    ::SysFreeString(valueBSTR);
+
+    return JSStringCreateWithCharacters(value.data(), value.length());
+}
+
+
+JSStringRef AccessibilityUIElement::documentEncoding()
+{
+    return JSStringCreateWithCharacters(0, 0);
+}
+
+JSStringRef AccessibilityUIElement::documentURI()
+{
+    return JSStringCreateWithCharacters(0, 0);
+}
diff --git a/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp b/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp
index b18b724..1bc4678 100644
--- a/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp
+++ b/WebKitTools/DumpRenderTree/win/DRTDesktopNotificationPresenter.cpp
@@ -28,6 +28,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "DRTDesktopNotificationPresenter.h"
 
 #include "DumpRenderTree.h"
diff --git a/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp
index d486d06..1315f9e 100644
--- a/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp
@@ -66,7 +66,7 @@
 
 using namespace std;
 
-#ifndef NDEBUG
+#if !defined(NDEBUG) && (!defined(DEBUG_INTERNAL) || defined(DEBUG_ALL))
 const LPWSTR TestPluginDir = L"TestNetscapePlugin_Debug";
 #else
 const LPWSTR TestPluginDir = L"TestNetscapePlugin";
@@ -201,6 +201,43 @@ static const wstring& fontsPath()
     return path;
 }
 
+static void addQTDirToPATH()
+{
+    static LPCWSTR pathEnvironmentVariable = L"PATH";
+    static LPCWSTR quickTimeKeyName = L"Software\\Apple Computer, Inc.\\QuickTime";
+    static LPCWSTR quickTimeSysDir = L"QTSysDir";
+    static bool initialized;
+
+    if (initialized)
+        return;
+    initialized = true;
+
+    // Get the QuickTime dll directory from the registry. The key can be in either HKLM or HKCU.
+    WCHAR qtPath[MAX_PATH];
+    DWORD qtPathBufferLen = sizeof(qtPath);
+    DWORD keyType;
+    HRESULT result = SHGetValue(HKEY_LOCAL_MACHINE, quickTimeKeyName, quickTimeSysDir, &keyType, (LPVOID)qtPath, &qtPathBufferLen);
+    if (result != ERROR_SUCCESS || !qtPathBufferLen || keyType != REG_SZ) {
+        qtPathBufferLen = sizeof(qtPath);
+        result = SHGetValue(HKEY_CURRENT_USER, quickTimeKeyName, quickTimeSysDir, &keyType, (LPVOID)qtPath, &qtPathBufferLen);
+        if (result != ERROR_SUCCESS || !qtPathBufferLen || keyType != REG_SZ)
+            return;
+    }
+
+    // Read the current PATH.
+    DWORD pathSize = GetEnvironmentVariableW(pathEnvironmentVariable, 0, 0);
+    Vector<WCHAR> oldPath(pathSize);
+    if (!GetEnvironmentVariableW(pathEnvironmentVariable, oldPath.data(), oldPath.size()))
+        return;
+
+    // And add the QuickTime dll.
+    wstring newPath;
+    newPath.append(qtPath);
+    newPath.append(L";");
+    newPath.append(oldPath.data(), oldPath.size());
+    SetEnvironmentVariableW(pathEnvironmentVariable, newPath.data());
+}
+
 #ifdef DEBUG_ALL
 #define WEBKITDLL TEXT("WebKit_debug.dll")
 #else
@@ -263,6 +300,10 @@ static void initialize()
         for (int i = 0; i < ARRAYSIZE(fontsToInstall); ++i)
             textRenderer->registerPrivateFont(wstring(resourcesPath + fontsToInstall[i]).c_str());
 
+    // Add the QuickTime dll directory to PATH or QT 7.6 will fail to initialize on systems
+    // linked with older versions of qtmlclientlib.dll.
+    addQTDirToPATH();
+
     // Register a host window
     WNDCLASSEX wcex;
 
@@ -286,7 +327,7 @@ static void initialize()
 void displayWebView()
 {
     ::InvalidateRect(webViewWindow, 0, TRUE);
-    ::UpdateWindow(webViewWindow);
+    ::SendMessage(webViewWindow, WM_PAINT, 0, 0);
 }
 
 void dumpFrameScrollPosition(IWebFrame* frame)
@@ -688,6 +729,11 @@ static bool shouldLogHistoryDelegates(const char* pathOrURL)
     return strstr(pathOrURL, "/globalhistory/") || strstr(pathOrURL, "\\globalhistory\\");
 }
 
+static bool shouldOpenWebInspector(const char* pathOrURL)
+{
+    return strstr(pathOrURL, "/inspector/") || strstr(pathOrURL, "\\inspector\\");
+}
+
 static void resetDefaultsToConsistentValues(IWebPreferences* preferences)
 {
 #ifdef USE_MAC_FONTS
@@ -793,6 +839,12 @@ static void resetWebViewToConsistentStateBeforeTesting()
     webViewPrivate->clearMainFrameName();
     webViewPrivate->resetOriginAccessWhiteLists();
 
+    BSTR groupName;
+    if (SUCCEEDED(webView->groupName(&groupName))) {
+        webViewPrivate->removeAllUserContentFromGroup(groupName);
+        SysFreeString(groupName);
+    }
+
     sharedUIDelegate->resetUndoManager();
 
     sharedFrameLoadDelegate->resetToConsistentState();
@@ -859,6 +911,9 @@ static void runTest(const string& testPathOrURL)
 
     resetWebViewToConsistentStateBeforeTesting();
 
+    if (shouldOpenWebInspector(pathOrURL.c_str()))
+        gLayoutTestController->showWebInspector();
+
     prevTestBFItem = 0;
     if (webView) {
         COMPtr<IWebBackForwardList> bfList;
@@ -893,6 +948,9 @@ static void runTest(const string& testPathOrURL)
         DispatchMessage(&msg);
     }
 
+    if (shouldOpenWebInspector(pathOrURL.c_str()))
+        gLayoutTestController->closeWebInspector();
+
     resetWebViewToConsistentStateBeforeTesting();
 
     frame->stopLoading();
diff --git a/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj b/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj
index ba3640c..299c53c 100644
--- a/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj
+++ b/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj
@@ -84,7 +84,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -157,7 +157,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -228,7 +228,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -300,7 +300,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -373,7 +373,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -444,7 +444,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;if exist &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc42$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

diff --git a/WebKitTools/DumpRenderTree/win/DumpRenderTreeWin.h b/WebKitTools/DumpRenderTree/win/DumpRenderTreeWin.h
index 6eb468d..54ec87b 100644
--- a/WebKitTools/DumpRenderTree/win/DumpRenderTreeWin.h
+++ b/WebKitTools/DumpRenderTree/win/DumpRenderTreeWin.h
@@ -30,6 +30,7 @@
 #define DumpRenderTreeWin_h
 
 struct IWebFrame;
+struct IWebScriptWorld;
 struct IWebView;
 struct PolicyDelegate;
 typedef const struct __CFString* CFStringRef;
@@ -55,6 +56,8 @@ WindowToWebViewMap& windowToWebViewMap();
 void setPersistentUserStyleSheetLocation(CFStringRef);
 bool setAlwaysAcceptCookies(bool alwaysAcceptCookies);
 
+unsigned worldIDForWorld(IWebScriptWorld*);
+
 extern UINT_PTR waitToDumpWatchdog;
 
 #endif // DumpRenderTreeWin_h
diff --git a/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.cpp b/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.cpp
index 939090a..37d5e1c 100644
--- a/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.cpp
+++ b/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.cpp
@@ -289,12 +289,53 @@ HRESULT STDMETHODCALLTYPE FrameLoadDelegate::willCloseFrame(
     return E_NOTIMPL;
 }
 
-HRESULT STDMETHODCALLTYPE FrameLoadDelegate::didClearWindowObject( 
-    /* [in] */ IWebView*webView,
-    /* [in] */ JSContextRef context,
-    /* [in] */ JSObjectRef windowObject,
-    /* [in] */ IWebFrame* frame)
+HRESULT FrameLoadDelegate::didClearWindowObject(IWebView*, JSContextRef, JSObjectRef, IWebFrame*)
+{
+    return E_NOTIMPL;
+}
+
+HRESULT FrameLoadDelegate::didClearWindowObjectForFrameInScriptWorld(IWebView* webView, IWebFrame* frame, IWebScriptWorld* world)
+{
+    ASSERT_ARG(webView, webView);
+    ASSERT_ARG(frame, frame);
+    ASSERT_ARG(world, world);
+    if (!webView || !frame || !world)
+        return E_POINTER;
+
+    COMPtr<IWebScriptWorld> standardWorld;
+    if (FAILED(world->standardWorld(&standardWorld)))
+        return S_OK;
+
+    if (world == standardWorld)
+        didClearWindowObjectForFrameInStandardWorld(frame);
+    else
+        didClearWindowObjectForFrameInIsolatedWorld(frame, world);
+    return S_OK;
+}
+
+void FrameLoadDelegate::didClearWindowObjectForFrameInIsolatedWorld(IWebFrame* frame, IWebScriptWorld* world)
+{
+    COMPtr<IWebFramePrivate> framePrivate(Query, frame);
+    if (!framePrivate)
+        return;
+
+    JSGlobalContextRef ctx = framePrivate->globalContextForScriptWorld(world);
+    if (!ctx)
+        return;
+
+    JSObjectRef globalObject = JSContextGetGlobalObject(ctx);
+    if (!globalObject)
+        return;
+
+    JSObjectSetProperty(ctx, globalObject, JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithUTF8CString("__worldID")).get(), JSValueMakeNumber(ctx, worldIDForWorld(world)), kJSPropertyAttributeReadOnly, 0);
+    return;
+}
+
+void FrameLoadDelegate::didClearWindowObjectForFrameInStandardWorld(IWebFrame* frame)
 {
+    JSGlobalContextRef context = frame->globalContext();
+    JSObjectRef windowObject = JSContextGetGlobalObject(context);
+
     JSValueRef exception = 0;
 
     ::gLayoutTestController->makeWindowObject(context, windowObject, &exception);
@@ -310,8 +351,6 @@ HRESULT STDMETHODCALLTYPE FrameLoadDelegate::didClearWindowObject(
     JSValueRef eventSender = makeEventSender(context);
     JSObjectSetProperty(context, windowObject, eventSenderStr, eventSender, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, 0);
     JSStringRelease(eventSenderStr);
-
-    return S_OK;
 }
 
 HRESULT STDMETHODCALLTYPE FrameLoadDelegate::didFinishDocumentLoadForFrame( 
diff --git a/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h b/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h
index 56325e2..cc6653b 100644
--- a/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h
+++ b/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h
@@ -141,7 +141,24 @@ public:
         /* [in] */ IWebView *sender,
         /* [in] */ IWebSecurityOrigin *origin);
 
-protected:
+    virtual HRESULT STDMETHODCALLTYPE didClearWindowObjectForFrameInScriptWorld(IWebView*, IWebFrame*, IWebScriptWorld*);
+
+    virtual HRESULT STDMETHODCALLTYPE didPushStateWithinPageForFrame( 
+        /* [in] */ IWebView *sender,
+        /* [in] */ IWebFrame *frame) { return E_NOTIMPL; } 
+    
+    virtual HRESULT STDMETHODCALLTYPE didReplaceStateWithinPageForFrame( 
+        /* [in] */ IWebView *sender,
+        /* [in] */ IWebFrame *frame) { return E_NOTIMPL; } 
+
+    virtual HRESULT STDMETHODCALLTYPE didPopStateWithinPageForFrame( 
+        /* [in] */ IWebView *sender,
+        /* [in] */ IWebFrame *frame) { return E_NOTIMPL; } 
+
+private:
+    void didClearWindowObjectForFrameInIsolatedWorld(IWebFrame*, IWebScriptWorld*);
+    void didClearWindowObjectForFrameInStandardWorld(IWebFrame*);
+
     void locationChangeDone(IWebError*, IWebFrame*);
 
     ULONG m_refCount;
diff --git a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index d3cac7a..5debf16 100644
--- a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -372,6 +372,23 @@ void LayoutTestController::setXSSAuditorEnabled(bool enabled)
     prefsPrivate->setXSSAuditorEnabled(enabled);
 }
 
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
+{
+    COMPtr<IWebView> webView;
+    if (FAILED(frame->webView(&webView)))
+        return;
+
+    COMPtr<IWebPreferences> preferences;
+    if (FAILED(webView->preferences(&preferences)))
+        return;
+
+    COMPtr<IWebPreferencesPrivate> prefsPrivate(Query, preferences);
+    if (!prefsPrivate)
+        return;
+
+    prefsPrivate->setAllowUniversalAccessFromFileURLs(enabled);
+}
+
 void LayoutTestController::setPopupBlockingEnabled(bool enabled)
 {
     COMPtr<IWebView> webView;
@@ -398,6 +415,23 @@ void LayoutTestController::setTabKeyCyclesThroughElements(bool shouldCycle)
     viewPrivate->setTabKeyCyclesThroughElements(shouldCycle ? TRUE : FALSE);
 }
 
+void LayoutTestController::setTimelineProfilingEnabled(bool flag)
+{
+    COMPtr<IWebView> webView;
+    if (FAILED(frame->webView(&webView)))
+        return;
+
+    COMPtr<IWebViewPrivate> viewPrivate;
+    if (FAILED(webView->QueryInterface(&viewPrivate)))
+        return;
+
+    COMPtr<IWebInspector> inspector;
+    if (FAILED(viewPrivate->inspector(&inspector)))
+        return;
+
+    inspector->setTimelineProfilingEnabled(flag);
+}
+
 void LayoutTestController::setUseDashboardCompatibilityMode(bool flag)
 {
     // FIXME: Implement!
@@ -827,6 +861,31 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef prop
     return SUCCEEDED(hr) && wasRunning;
 }
 
+bool LayoutTestController::sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId)
+{
+    COMPtr<IDOMDocument> document;
+    if (FAILED(frame->DOMDocument(&document)))
+        return false;
+
+    BSTR idBSTR = JSStringCopyBSTR(animationId);
+    COMPtr<IDOMElement> element;
+    HRESULT hr = document->getElementById(idBSTR, &element);
+    SysFreeString(idBSTR);
+    if (FAILED(hr))
+        return false;
+
+    COMPtr<IWebFramePrivate> framePrivate(Query, frame);
+    if (!framePrivate)
+        return false;
+
+    BSTR elementIdBSTR = JSStringCopyBSTR(elementId);
+    BOOL wasRunning = FALSE;
+    hr = framePrivate->pauseSVGAnimation(elementIdBSTR, element.get(), time, &wasRunning);
+    SysFreeString(elementIdBSTR);
+
+    return SUCCEEDED(hr) && wasRunning;
+}
+
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     COMPtr<IWebFramePrivate> framePrivate(Query, frame);
@@ -861,7 +920,11 @@ void LayoutTestController::addUserScript(JSStringRef source, bool runAtStart)
     if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
         return;
 
-    webView->addUserScriptToGroup(_bstr_t(L"org.webkit.DumpRenderTree").GetBSTR(), 1, bstrT(source).GetBSTR(), 0, 0, 0, 0, 0, runAtStart ? WebInjectAtDocumentStart : WebInjectAtDocumentEnd);
+    COMPtr<IWebScriptWorld> world;
+    if (FAILED(WebKitCreateInstance(__uuidof(WebScriptWorld), 0, __uuidof(world), reinterpret_cast<void**>(&world))))
+        return;
+
+    webView->addUserScriptToGroup(_bstr_t(L"org.webkit.DumpRenderTree").GetBSTR(), world.get(), bstrT(source).GetBSTR(), 0, 0, 0, 0, 0, runAtStart ? WebInjectAtDocumentStart : WebInjectAtDocumentEnd);
 }
 
 
@@ -871,7 +934,11 @@ void LayoutTestController::addUserStyleSheet(JSStringRef source)
     if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
         return;
 
-    webView->addUserStyleSheetToGroup(_bstr_t(L"org.webkit.DumpRenderTree").GetBSTR(), 1, bstrT(source).GetBSTR(), 0, 0, 0, 0, 0);
+    COMPtr<IWebScriptWorld> world;
+    if (FAILED(WebKitCreateInstance(__uuidof(WebScriptWorld), 0, __uuidof(world), reinterpret_cast<void**>(&world))))
+        return;
+
+    webView->addUserStyleSheetToGroup(_bstr_t(L"org.webkit.DumpRenderTree").GetBSTR(), world.get(), bstrT(source).GetBSTR(), 0, 0, 0, 0, 0);
 }
 
 void LayoutTestController::showWebInspector()
@@ -947,14 +1014,45 @@ void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef scrip
     inspectorPrivate->evaluateInFrontend(callId, bstrT(script).GetBSTR());
 }
 
-void LayoutTestController::evaluateScriptInIsolatedWorld(unsigned worldId, JSObjectRef globalObject, JSStringRef script)
+typedef HashMap<unsigned, COMPtr<IWebScriptWorld> > WorldMap;
+static WorldMap& worldMap()
+{
+    static WorldMap& map = *new WorldMap;
+    return map;
+}
+
+unsigned worldIDForWorld(IWebScriptWorld* world)
+{
+    WorldMap::const_iterator end = worldMap().end();
+    for (WorldMap::const_iterator it = worldMap().begin(); it != end; ++it) {
+        if (it->second == world)
+            return it->first;
+    }
+
+    return 0;
+}
+
+void LayoutTestController::evaluateScriptInIsolatedWorld(unsigned worldID, JSObjectRef globalObject, JSStringRef script)
 {
     COMPtr<IWebFramePrivate> framePrivate(Query, frame);
     if (!framePrivate)
         return;
 
+    // A worldID of 0 always corresponds to a new world. Any other worldID corresponds to a world
+    // that is created once and cached forever.
+    COMPtr<IWebScriptWorld> world;
+    if (!worldID) {
+        if (FAILED(WebKitCreateInstance(__uuidof(WebScriptWorld), 0, __uuidof(world), reinterpret_cast<void**>(&world))))
+            return;
+    } else {
+        COMPtr<IWebScriptWorld>& worldSlot = worldMap().add(worldID, 0).first->second;
+        if (!worldSlot && FAILED(WebKitCreateInstance(__uuidof(WebScriptWorld), 0, __uuidof(worldSlot), reinterpret_cast<void**>(&worldSlot))))
+            return;
+        world = worldSlot;
+    }
+
     BSTR result;
-    if (FAILED(framePrivate->stringByEvaluatingJavaScriptInIsolatedWorld(worldId, reinterpret_cast<OLE_HANDLE>(globalObject), bstrT(script).GetBSTR(), &result)))
+    if (FAILED(framePrivate->stringByEvaluatingJavaScriptInScriptWorld(world.get(), globalObject, bstrT(script).GetBSTR(), &result)))
         return;
     SysFreeString(result);
 }
diff --git a/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/main.cpp b/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/main.cpp
index 7175d33..82b1d4d 100644
--- a/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/main.cpp
+++ b/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/main.cpp
@@ -88,12 +88,15 @@ NPError NPP_New(NPMIMEType pluginType, NPP instance, uint16 mode, int16 argc, ch
                 for (int i = 0; i < argc; i++)
                     if (_stricmp(argn[i], "src") == 0)
                         pluginLog(instance, "src: %s", argv[i]);
-            }
+            } else if (_stricmp(argn[i], "testdocumentopenindestroystream") == 0)
+                obj->testDocumentOpenInDestroyStream = TRUE;
+              else if (_stricmp(argn[i], "testwindowopen") == 0)
+                obj->testWindowOpen = TRUE;
         }
         
         instance->pdata = obj;
     }
-    
+
     return NPERR_NO_ERROR;
 }
 
@@ -120,6 +123,15 @@ NPError NPP_Destroy(NPP instance, NPSavedData **save)
 
 NPError NPP_SetWindow(NPP instance, NPWindow *window)
 {
+    PluginObject* obj = static_cast<PluginObject*>(instance->pdata);
+
+    if (obj) {
+        if (obj->testWindowOpen) {
+            testWindowOpen(instance);
+            obj->testWindowOpen = FALSE;
+        }
+    }
+
     return NPERR_NO_ERROR;
 }
 
@@ -149,7 +161,7 @@ NPError NPP_NewStream(NPP instance, NPMIMEType type, NPStream *stream, NPBool se
 
     if (obj->onStreamLoad)
         executeScript(obj, obj->onStreamLoad);
-    
+
     return NPERR_NO_ERROR;
 }
 
@@ -160,6 +172,10 @@ NPError NPP_DestroyStream(NPP instance, NPStream *stream, NPReason reason)
     if (obj->onStreamDestroy)
         executeScript(obj, obj->onStreamDestroy);
 
+    if (obj->testDocumentOpenInDestroyStream) {
+        testDocumentOpen(instance);
+    }
+
     return NPERR_NO_ERROR;
 }
 
diff --git a/WebKitTools/DumpRenderTree/wscript b/WebKitTools/DumpRenderTree/wscript
new file mode 100644
index 0000000..29eca9a
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/wscript
@@ -0,0 +1,64 @@
+#! /usr/bin/env python
+
+# Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+#
+# wxBrowser sample app build script for the waf build system
+
+import sys
+
+from settings import *
+
+include_paths = [
+                os.path.join(output_dir),
+                os.path.join(wk_root, 'JavaScriptCore'),
+                os.path.join(wk_root, 'WebCore'),
+                os.path.join(wk_root, 'WebKit', 'wx'), 
+                '.', 
+                'wx'
+                ]
+sources = [
+            'LayoutTestController.cpp',
+            'WorkQueue.cpp',
+            'wx/DumpRenderTreeWx.cpp',
+            'wx/LayoutTestControllerWx.cpp',
+            'wx/WorkQueueItemWx.cpp'
+          ]
+
+def set_options(opt):
+    common_set_options(opt)
+
+def configure(conf):
+    common_configure(conf)
+    
+def build(bld):
+    obj = bld.new_task_gen(
+        features = 'cxx cprogram',
+        includes = ' '.join(include_paths),
+        source = sources,
+        target = 'DumpRenderTree',
+        uselib = 'WXWEBKIT WX ' + get_config(),
+        libpath = [output_dir],
+        uselib_local = '',
+        install_path = output_dir)
+        
diff --git a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index 72f85ae..2c46950 100644
--- a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -170,6 +170,11 @@ void LayoutTestController::setXSSAuditorEnabled(bool enabled)
     // FIXME: implement
 }
 
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
+{
+    // FIXME: implement
+}
+
 void LayoutTestController::setAuthorAndUserStylesEnabled(bool flag)
 {
     // FIXME: implement
@@ -262,6 +267,12 @@ bool LayoutTestController::pauseAnimationAtTimeOnElementWithId(JSStringRef anima
     return false;
 }
 
+bool LayoutTestController::sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId)
+{
+    // FIXME: implement
+    return false;
+}
+
 void LayoutTestController::setCacheModel(int)
 {
     // FIXME: implement
@@ -318,3 +329,28 @@ void LayoutTestController::removeAllVisitedLinks()
 {
     // FIXME: Implement this.
 }
+
+void LayoutTestController::setTimelineProfilingEnabled(bool enabled)
+{
+
+}
+
+void LayoutTestController::evaluateScriptInIsolatedWorld(unsigned worldId, JSObjectRef globalObject, JSStringRef script)
+{
+
+}
+
+void LayoutTestController::disableImageLoading()
+{
+
+}
+
+void LayoutTestController::whiteListAccessFromOrigin(JSStringRef sourceOrigin, JSStringRef destinationProtocol, JSStringRef destinationHost, bool allowDestinationSubdomains)
+{
+
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
+{
+
+}
diff --git a/WebKitTools/GNUmakefile.am b/WebKitTools/GNUmakefile.am
index c2029f3..4425196 100644
--- a/WebKitTools/GNUmakefile.am
+++ b/WebKitTools/GNUmakefile.am
@@ -113,7 +113,7 @@ dumprendertree_cppflags += \
 
 TestNetscapePlugin_libtestnetscapeplugin_la_CPPFLAGS = \
 	-I$(srcdir)/WebKitTools/DumpRenderTree \
-	-I$(srcdir)/WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders \
+	-I$(srcdir)/WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders \
 	-I$(srcdir)/WebCore \
 	-I$(srcdir)/WebCore/bridge \
 	-I$(srcdir)/WebCore/plugins \
@@ -122,17 +122,17 @@ TestNetscapePlugin_libtestnetscapeplugin_la_CPPFLAGS = \
 	$(javascriptcore_cppflags)
 
 TestNetscapePlugin_libtestnetscapeplugin_la_SOURCES = \
-	WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h \
-	WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h \
-	WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h \
-	WebKitTools/DumpRenderTree/gtk/TestNetscapePlugin/TestNetscapePlugin.cpp \
+	WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h \
+	WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h \
+	WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h \
+	WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/TestNetscapePlugin.cpp \
 	WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp \
 	WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h \
 	WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.cpp \
 	WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/TestObject.h
 
 TestNetscapePlugin_libtestnetscapeplugin_la_LDFLAGS = \
-	-rpath ${shell pwd}/$(top_builddir)/TestNetscapePlugin/.libs \
+	-rpath ${shell pwd}/$(top_builddir)/../unix/TestNetscapePlugin/.libs \
 	$(no_undefined) \
 	-avoid-version \
 	-module
diff --git a/WebKitTools/CommitQueueStatus/app.yaml b/WebKitTools/QueueStatusServer/app.yaml
index 2756112..2756112 100644
--- a/WebKitTools/CommitQueueStatus/app.yaml
+++ b/WebKitTools/QueueStatusServer/app.yaml
diff --git a/WebKitTools/CommitQueueStatus/filters/__init__.py b/WebKitTools/QueueStatusServer/filters/__init__.py
index ef65bee..ef65bee 100644
--- a/WebKitTools/CommitQueueStatus/filters/__init__.py
+++ b/WebKitTools/QueueStatusServer/filters/__init__.py
diff --git a/WebKitTools/CommitQueueStatus/filters/webkit_extras.py b/WebKitTools/QueueStatusServer/filters/webkit_extras.py
index 6a08727..6a08727 100644
--- a/WebKitTools/CommitQueueStatus/filters/webkit_extras.py
+++ b/WebKitTools/QueueStatusServer/filters/webkit_extras.py
diff --git a/WebKitTools/CommitQueueStatus/index.html b/WebKitTools/QueueStatusServer/index.html
index 2b5aced..fbd51fb 100644
--- a/WebKitTools/CommitQueueStatus/index.html
+++ b/WebKitTools/QueueStatusServer/index.html
@@ -1,3 +1,4 @@
+<!DOCTYPE html>
 <html>
 <head>
     <title>WebKit Commit Queue Status</title>
diff --git a/WebKitTools/CommitQueueStatus/index.yaml b/WebKitTools/QueueStatusServer/index.yaml
index a3b9e05..bf11262 100644
--- a/WebKitTools/CommitQueueStatus/index.yaml
+++ b/WebKitTools/QueueStatusServer/index.yaml
@@ -9,3 +9,16 @@ indexes:
 # manually, move them above the marker line.  The index.yaml file is
 # automatically uploaded to the admin console when you next deploy
 # your application using appcfg.py.
+
+- kind: QueueStatus
+  properties:
+  - name: active_patch_id
+  - name: queue_name
+  - name: date
+    direction: desc
+
+- kind: QueueStatus
+  properties:
+  - name: queue_name
+  - name: date
+    direction: desc
diff --git a/WebKitTools/CommitQueueStatus/queue_status.py b/WebKitTools/QueueStatusServer/queue_status.py
index 30d2494..65197bb 100644
--- a/WebKitTools/CommitQueueStatus/queue_status.py
+++ b/WebKitTools/QueueStatusServer/queue_status.py
@@ -35,29 +35,91 @@ use_library('django', '1.1')
 
 from google.appengine.ext.webapp import template
 from google.appengine.api import users
-from google.appengine.ext import webapp
+from google.appengine.ext import webapp, db
 from google.appengine.ext.webapp.util import run_wsgi_app
-from google.appengine.ext import db
 
 webapp.template.register_template_library('filters.webkit_extras')
 
+
 class QueueStatus(db.Model):
     author = db.UserProperty()
+    queue_name = db.StringProperty()
     active_bug_id = db.IntegerProperty()
     active_patch_id = db.IntegerProperty()
     message = db.StringProperty(multiline=True)
     date = db.DateTimeProperty(auto_now_add=True)
+    results_file = db.BlobProperty()
+
 
 class MainPage(webapp.RequestHandler):
     def get(self):
-        statuses_query = QueueStatus.all().order('-date')
+        statuses_query = QueueStatus.all().filter('queue_name =', 'commit-queue').order('-date')
         statuses = statuses_query.fetch(6)
+        if not statuses:
+            return self.response.out.write("No status to report.")
         template_values = {
             'last_status' : statuses[0],
             'recent_statuses' : statuses[1:],
         }
         self.response.out.write(template.render('index.html', template_values))
 
+
+class PatchStatus(webapp.RequestHandler):
+    def get(self, queue_name, attachment_id):
+        statuses = QueueStatus.all().filter('queue_name =', queue_name).filter('active_patch_id =', int(attachment_id)).order('-date').fetch(1)
+        if not statuses:
+            self.error(404)
+            return
+        self.response.out.write(statuses[0].message)
+
+
+class StatusSummary(object):
+    def _status_to_code(self, status):
+        code_names = {
+            "Pass": "pass",
+            "Pending": "pending",
+            "Fail": "fail",
+            "Error": "error",
+        }
+        return code_names.get(status, "none")
+
+    def _queue_name_to_code(self, queue_name):
+        code_names = {
+            "style-queue": "style",
+        }
+        return code_names[queue_name]
+
+    queues = [
+        "style-queue",
+    ]
+
+    def __init__(self):
+        self._summary = {}
+
+    def summarize(self, attachment_id):
+        if self._summary.get(attachment_id):
+            return self._summary.get(attachment_id)
+
+        attachment_summary = {}
+        for queue in self.queues:
+            statuses = QueueStatus.all().filter('queue_name =', queue).filter('active_patch_id =', attachment_id).order('-date').fetch(1)
+            status_code = self._status_to_code(statuses[0].message if statuses else None)
+            queue_code = self._queue_name_to_code(queue)
+            attachment_summary[queue_code] = status_code
+
+        self._summary[attachment_id] = attachment_summary
+        return attachment_summary
+
+
+class StatusBubble(webapp.RequestHandler):
+    def get(self, attachment_id):
+        status_summary = StatusSummary()
+        template_values = {
+            "queue_status" : status_summary.summarize(int(attachment_id)),
+        }
+        self.response.out.write(template.render('status_bubble.html', template_values))
+
+
 class UpdateStatus(webapp.RequestHandler):
     def get(self):
         self.response.out.write(template.render('update_status.html', None))
@@ -66,6 +128,7 @@ class UpdateStatus(webapp.RequestHandler):
         string_value = self.request.get(name)
         try:
             int_value = int(string_value)
+            return int_value
         except ValueError, TypeError:
             pass
         return None
@@ -76,15 +139,33 @@ class UpdateStatus(webapp.RequestHandler):
         if users.get_current_user():
             queue_status.author = users.get_current_user()
 
+        queue_name = self.request.get('queue_name')
+        queue_status.queue_name = queue_name
         queue_status.active_bug_id = self._int_from_request('bug_id')
         queue_status.active_patch_id = self._int_from_request('patch_id')
         queue_status.message = self.request.get('status')
+        results_file = self.request.get("results_file")
+        queue_status.results_file = db.Blob(results_file)
         queue_status.put()
         self.redirect('/')
 
+
+class ShowResults(webapp.RequestHandler):
+    def get(self, status_id):
+        status = QueueStatus.get_by_id(int(status_id))
+        if not status:
+            self.error(404)
+            return
+        self.response.headers["Content-Type"] = "text/plain"
+        self.response.out.write(status.results_file)
+
+
 routes = [
     ('/', MainPage),
-    ('/update_status', UpdateStatus)
+    ('/update-status', UpdateStatus),
+    (r'/patch-status/(.*)/(.*)', PatchStatus),
+    (r'/status-bubble/(.*)', StatusBubble),
+    (r'/results/(.*)', ShowResults)
 ]
 
 application = webapp.WSGIApplication(routes, debug=True)
diff --git a/WebKitTools/QueueStatusServer/status_bubble.html b/WebKitTools/QueueStatusServer/status_bubble.html
new file mode 100644
index 0000000..f8959d9
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/status_bubble.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+body {
+    font-family: Verdana, sans-serif;
+    margin: 0px;
+    padding: 0px;
+}
+.status {
+    display: block;
+    float: left;
+    margin: 1px;
+    padding: 1px 2px;
+    border-radius: 5px;
+    border: 1px solid #AAA;
+    font-size: 11px;
+}
+.pass {
+    background-color: #8FDF5F;
+    border: 1px solid #4F8530;
+}
+.fail {
+    background-color: #E98080;
+    border: 1px solid #A77272;
+}
+.pending {
+    background-color: #FFFC6C;
+    border: 1px solid #C5C56D;
+}
+</style>
+</head>
+<body>{% for key, value in queue_status.items %}
+<div class="status {{value}}" title="{{key}}: {{value}}">{{key}}</div>{% endfor %}
+</body>
+</html>
diff --git a/WebKitTools/CommitQueueStatus/stylesheets/main.css b/WebKitTools/QueueStatusServer/stylesheets/main.css
index 55d3694..55d3694 100644
--- a/WebKitTools/CommitQueueStatus/stylesheets/main.css
+++ b/WebKitTools/QueueStatusServer/stylesheets/main.css
diff --git a/WebKitTools/CommitQueueStatus/update_status.html b/WebKitTools/QueueStatusServer/update_status.html
index edafba4..9343c60 100644
--- a/WebKitTools/CommitQueueStatus/update_status.html
+++ b/WebKitTools/QueueStatusServer/update_status.html
@@ -1,5 +1,5 @@
-Update the current status of the commit-queue:
-<form name="update_status" method="post">
+<form name="update_status" enctype="multipart/form-data" method="post">
+Update status for a queue: <input name="queue_name">
  <div>
      Active Bug Id:
     <input name="bug_id">
@@ -8,12 +8,10 @@ Update the current status of the commit-queue:
      Active Patch Id:
     <input name="patch_id">
  </div>
- <div>
-     Space separated list of other bugs in queue:
-    <input name="bugs_in_queue">
- </div>
   <div>
+      Status Text:<br>
       <textarea name="status" rows="3" cols="60"></textarea>
   </div>
+  <div>Results file: <input type="file" name="results_file"></div>
   <div><input type="submit" value="Add Status"></div>
 </form>
diff --git a/WebKitTools/Scripts/VCSUtils.pm b/WebKitTools/Scripts/VCSUtils.pm
index e1e0bc2..7638102 100644
--- a/WebKitTools/Scripts/VCSUtils.pm
+++ b/WebKitTools/Scripts/VCSUtils.pm
@@ -41,7 +41,10 @@ BEGIN {
     @ISA         = qw(Exporter);
     @EXPORT      = qw(
         &canonicalizePath
+        &changeLogEmailAddress
+        &changeLogName
         &chdirReturningRelativePath
+        &decodeGitBinaryPatch
         &determineSVNRoot
         &determineVCSRoot
         &fixChangeLogPatch
@@ -298,6 +301,14 @@ sub canonicalizePath($)
     return ($#dirs >= 0) ? File::Spec->catdir(@dirs) : ".";
 }
 
+sub removeEOL($)
+{
+    my ($line) = @_;
+
+    $line =~ s/[\r\n]+$//g;
+    return $line;
+}
+
 sub svnStatus($)
 {
     my ($fullPath) = @_;
@@ -335,8 +346,6 @@ sub gitdiff2svndiff($)
     $_ = shift @_;
     if (m#^diff --git a/(.+) b/(.+)#) {
         return "Index: $1";
-    } elsif (m/^new file.*/) {
-        return "";
     } elsif (m#^index [0-9a-f]{7}\.\.[0-9a-f]{7} [0-9]{6}#) {
         return "===================================================================";
     } elsif (m#^--- a/(.+)#) {
@@ -347,56 +356,215 @@ sub gitdiff2svndiff($)
     return $_;
 }
 
+# The diff(1) command is greedy when matching lines, so a new ChangeLog entry will
+# have lines of context at the top of a patch when the existing entry has the same
+# date and author as the new entry.  Alter the ChangeLog patch so
+# that the added lines ("+") in the patch always start at the beginning of the
+# patch and there are no initial lines of context.
 sub fixChangeLogPatch($)
 {
-    my $patch = shift;
-    my $contextLineCount = 3;
-
-    return $patch if $patch !~ /\n@@ -1,(\d+) \+1,(\d+) @@\n( .*\n)+(\+.*\n)+( .*\n){$contextLineCount}$/m;
-    my ($oldLineCount, $newLineCount) = ($1, $2);
-    return $patch if $oldLineCount <= $contextLineCount;
-
-    # The diff(1) command is greedy when matching lines, so a new ChangeLog entry will
-    # have lines of context at the top of a patch when the existing entry has the same
-    # date and author as the new entry.  This nifty loop alters a ChangeLog patch so
-    # that the added lines ("+") in the patch always start at the beginning of the
-    # patch and there are no initial lines of context.
-    my $newPatch;
-    my $lineCountInState = 0;
-    my $oldContentLineCountReduction = $oldLineCount - $contextLineCount;
-    my $newContentLineCountWithoutContext = $newLineCount - $oldLineCount - $oldContentLineCountReduction;
-    my ($stateHeader, $statePreContext, $stateNewChanges, $statePostContext) = (1..4);
-    my $state = $stateHeader;
-    foreach my $line (split(/\n/, $patch)) {
-        $lineCountInState++;
-        if ($state == $stateHeader && $line =~ /^@@ -1,$oldLineCount \+1,$newLineCount @\@$/) {
-            $line = "@@ -1,$contextLineCount +1," . ($newLineCount - $oldContentLineCountReduction) . " @@";
-            $lineCountInState = 0;
-            $state = $statePreContext;
-        } elsif ($state == $statePreContext && substr($line, 0, 1) eq " ") {
-            $line = "+" . substr($line, 1);
-            if ($lineCountInState == $oldContentLineCountReduction) {
-                $lineCountInState = 0;
-                $state = $stateNewChanges;
-            }
-        } elsif ($state == $stateNewChanges && substr($line, 0, 1) eq "+") {
-            # No changes to these lines
-            if ($lineCountInState == $newContentLineCountWithoutContext) {
-                $lineCountInState = 0;
-                $state = $statePostContext;
-            }
-        } elsif ($state == $statePostContext) {
-            if (substr($line, 0, 1) eq "+" && $lineCountInState <= $oldContentLineCountReduction) {
-                $line = " " . substr($line, 1);
-            } elsif ($lineCountInState > $contextLineCount && substr($line, 0, 1) eq " ") {
-                next; # Discard
+    my $patch = shift; # $patch will only contain patch fragments for ChangeLog.
+
+    $patch =~ /(\r?\n)/;
+    my $lineEnding = $1;
+    my @patchLines = split(/$lineEnding/, $patch);
+
+    # e.g. 2009-06-03  Eric Seidel  <eric@webkit.org>
+    my $dateLineRegexpString = '^\+(\d{4}-\d{2}-\d{2})' # Consume the leading '+' and the date.
+                             . '\s+(.+)\s+' # Consume the name.
+                             . '<([^<>]+)>$'; # And finally the email address.
+
+    # Figure out where the patch contents start and stop.
+    my $patchHeaderIndex;
+    my $firstContentIndex;
+    my $trailingContextIndex;
+    my $dateIndex;
+    my $patchEndIndex = scalar(@patchLines);
+    for (my $index = 0; $index < @patchLines; ++$index) {
+        my $line = $patchLines[$index];
+        if ($line =~ /^\@\@ -\d+,\d+ \+\d+,\d+ \@\@$/) { # e.g. @@ -1,5 +1,18 @@
+            if ($patchHeaderIndex) {
+                $patchEndIndex = $index; # We only bother to fix up the first patch fragment.
+                last;
             }
+            $patchHeaderIndex = $index;
         }
-        $newPatch .= $line . "\n";
+        $firstContentIndex = $index if ($patchHeaderIndex && !$firstContentIndex && $line =~ /^\+[^+]/); # Only match after finding patchHeaderIndex, otherwise we'd match "+++".
+        $dateIndex = $index if ($line =~ /$dateLineRegexpString/);
+        $trailingContextIndex = $index if ($firstContentIndex && !$trailingContextIndex && $line =~ /^ /);
     }
+    my $contentLineCount = $trailingContextIndex - $firstContentIndex;
+    my $trailingContextLineCount = $patchEndIndex - $trailingContextIndex;
+
+    # If we didn't find a date line in the content then this is not a patch we should try and fix.
+    return $patch if (!$dateIndex);
+
+    # We only need to do anything if the date line is not the first content line.
+    return $patch if ($dateIndex == $firstContentIndex);
+
+    # Write the new patch.
+    my $totalNewContentLines = $contentLineCount + $trailingContextLineCount;
+    $patchLines[$patchHeaderIndex] = "@@ -1,$trailingContextLineCount +1,$totalNewContentLines @@"; # Write a new header.
+    my @repeatedLines = splice(@patchLines, $dateIndex, $trailingContextIndex - $dateIndex); # The date line and all the content after it that diff saw as repeated.
+    splice(@patchLines, $firstContentIndex, 0, @repeatedLines); # Move the repeated content to the top.
+    foreach my $line (@repeatedLines) {
+        $line =~ s/^\+/ /;
+    }
+    splice(@patchLines, $trailingContextIndex, $patchEndIndex, @repeatedLines); # Replace trailing context with the repeated content.
+    splice(@patchLines, $patchHeaderIndex + 1, $firstContentIndex - $patchHeaderIndex - 1); # Remove any leading context.
+
+    return join($lineEnding, @patchLines) . "\n"; # patch(1) expects an extra trailing newline.
+}
 
-    return $newPatch;
+sub gitConfig($)
+{
+    return unless $isGit;
+
+    my ($config) = @_;
+
+    my $result = `git config $config`;
+    if (($? >> 8)) {
+        $result = `git repo-config $config`;
+    }
+    chomp $result;
+    return $result;
 }
 
+sub changeLogNameError($)
+{
+    my ($message) = @_;
+    print STDERR "$message\nEither:\n";
+    print STDERR "  set CHANGE_LOG_NAME in your environment\n";
+    print STDERR "  OR pass --name= on the command line\n";
+    print STDERR "  OR set REAL_NAME in your environment";
+    print STDERR "  OR git users can set 'git config user.name'\n";
+    exit(1);
+}
+
+sub changeLogName()
+{
+    my $name = $ENV{CHANGE_LOG_NAME} || $ENV{REAL_NAME} || gitConfig("user.name") || (split /\s*,\s*/, (getpwuid $<)[6])[0];
+
+    changeLogNameError("Failed to determine ChangeLog name.") unless $name;
+    # getpwuid seems to always succeed on windows, returning the username instead of the full name.  This check will catch that case.
+    changeLogNameError("'$name' does not contain a space!  ChangeLogs should contain your full name.") unless ($name =~ /\w \w/);
+
+    return $name;
+}
+
+sub changeLogEmailAddressError($)
+{
+    my ($message) = @_;
+    print STDERR "$message\nEither:\n";
+    print STDERR "  set CHANGE_LOG_EMAIL_ADDRESS in your environment\n";
+    print STDERR "  OR pass --email= on the command line\n";
+    print STDERR "  OR set EMAIL_ADDRESS in your environment\n";
+    print STDERR "  OR git users can set 'git config user.email'\n";
+    exit(1);
+}
+
+sub changeLogEmailAddress()
+{
+    my $emailAddress = $ENV{CHANGE_LOG_EMAIL_ADDRESS} || $ENV{EMAIL_ADDRESS} || gitConfig("user.email");
+
+    changeLogEmailAddressError("Failed to determine email address for ChangeLog.") unless $emailAddress;
+    changeLogEmailAddressError("Email address '$emailAddress' does not contain '\@' and is likely invalid.") unless ($emailAddress =~ /\@/);
+
+    return $emailAddress;
+}
+
+# http://tools.ietf.org/html/rfc1924
+sub decodeBase85($)
+{
+    my ($encoded) = @_;
+    my %table;
+    my @characters = ('0'..'9', 'A'..'Z', 'a'..'z', '!', '#', '$', '%', '&', '(', ')', '*', '+', '-', ';', '<', '=', '>', '?', '@', '^', '_', '`', '{', '|', '}', '~');
+    for (my $i = 0; $i < 85; $i++) {
+        $table{$characters[$i]} = $i;
+    }
+
+    my $decoded = '';
+    my @encodedChars = $encoded =~ /./g;
+
+    for (my $encodedIter = 0; defined($encodedChars[$encodedIter]);) {
+        my $digit = 0;
+        for (my $i = 0; $i < 5; $i++) {
+            $digit *= 85;
+            my $char = $encodedChars[$encodedIter];
+            $digit += $table{$char};
+            $encodedIter++;
+        }
+
+        for (my $i = 0; $i < 4; $i++) {
+            $decoded .= chr(($digit >> (3 - $i) * 8) & 255);
+        }
+    }
+
+    return $decoded;
+}
+
+sub decodeGitBinaryChunk($$)
+{
+    my ($contents, $fullPath) = @_;
+
+    # Load this module lazily in case the user don't have this module
+    # and won't handle git binary patches.
+    require Compress::Zlib;
+
+    my $encoded = "";
+    my $compressedSize = 0;
+    while ($contents =~ /^([A-Za-z])(.*)$/gm) {
+        my $line = $2;
+        next if $line eq "";
+        die "$fullPath: unexpected size of a line: $&" if length($2) % 5 != 0;
+        my $actualSize = length($2) / 5 * 4;
+        my $encodedExpectedSize = ord($1);
+        my $expectedSize = $encodedExpectedSize <= ord("Z") ? $encodedExpectedSize - ord("A") + 1 : $encodedExpectedSize - ord("a") + 27;
+
+        die "$fullPath: unexpected size of a line: $&" if int(($expectedSize + 3) / 4) * 4 != $actualSize;
+        $compressedSize += $expectedSize;
+        $encoded .= $line;
+    }
+
+    my $compressed = decodeBase85($encoded);
+    $compressed = substr($compressed, 0, $compressedSize);
+    return Compress::Zlib::uncompress($compressed);
+}
+
+sub decodeGitBinaryPatch($$)
+{
+    my ($contents, $fullPath) = @_;
+
+    # Git binary patch has two chunks. One is for the normal patching
+    # and another is for the reverse patching.
+    #
+    # Each chunk a line which starts from either "literal" or "delta",
+    # followed by a number which specifies decoded size of the chunk.
+    # The "delta" type chunks aren't supported by this function yet.
+    #
+    # Then, content of the chunk comes. To decode the content, we
+    # need decode it with base85 first, and then zlib.
+    my $gitPatchRegExp = '(literal|delta) ([0-9]+)\n([A-Za-z0-9!#$%&()*+-;<=>?@^_`{|}~\\n]*?)\n\n';
+    if ($contents !~ m"\nGIT binary patch\n$gitPatchRegExp$gitPatchRegExp\Z") {
+        die "$fullPath: unknown git binary patch format"
+    }
+
+    my $binaryChunkType = $1;
+    my $binaryChunkExpectedSize = $2;
+    my $encodedChunk = $3;
+    my $reverseBinaryChunkType = $4;
+    my $reverseBinaryChunkExpectedSize = $5;
+    my $encodedReverseChunk = $6;
+
+    my $binaryChunk = decodeGitBinaryChunk($encodedChunk, $fullPath);
+    my $binaryChunkActualSize = length($binaryChunk);
+    my $reverseBinaryChunk = decodeGitBinaryChunk($encodedReverseChunk, $fullPath);
+    my $reverseBinaryChunkActualSize = length($reverseBinaryChunk);
+
+    die "$fullPath: unexpected size of the first chunk (expected $binaryChunkExpectedSize but was $binaryChunkActualSize" if ($binaryChunkExpectedSize != $binaryChunkActualSize);
+    die "$fullPath: unexpected size of the second chunk (expected $reverseBinaryChunkExpectedSize but was $reverseBinaryChunkActualSize" if ($reverseBinaryChunkExpectedSize != $reverseBinaryChunkActualSize);
+
+    return ($binaryChunkType, $binaryChunk, $reverseBinaryChunkType, $reverseBinaryChunk);
+}
 
 1;
diff --git a/WebKitTools/Scripts/bisect-builds b/WebKitTools/Scripts/bisect-builds
index 55bf238..063b61e 100755
--- a/WebKitTools/Scripts/bisect-builds
+++ b/WebKitTools/Scripts/bisect-builds
@@ -363,12 +363,13 @@ sub mountAndRunNightly($$$$)
     my $mountPath = "/Volumes/WebKit";
     my $webkitApp = File::Spec->catfile($mountPath, "WebKit.app");
     my $diskImage = File::Spec->catfile($directory, $filename);
+    my $devNull = File::Spec->devnull();
 
     my $i = 0;
     while (-e $mountPath) {
         $i++;
         usleep 100 if $i > 1;
-        exec "hdiutil", "detach '$mountPath' 2> " . File::Spec->devnull();
+        `hdiutil detach '$mountPath' 2> $devNull`;
         die "Could not unmount $diskImage at $mountPath" if $i > 100;
     }
     die "Can't mount $diskImage: $mountPath already exists!" if -e $mountPath;
@@ -393,7 +394,7 @@ sub mountAndRunNightly($$$$)
     $tempFile ||= "";
     `DYLD_FRAMEWORK_PATH=$frameworkPath WEBKIT_UNSET_DYLD_FRAMEWORK_PATH=YES $safari $tempFile`;
 
-    exec "hdiutil", "detach '$mountPath' 2> " . File::Spec->devnull();
+    `hdiutil detach '$mountPath' 2> $devNull`;
 }
 
 sub parseRevisions($$;$)
diff --git a/WebKitTools/Scripts/bugzilla-tool b/WebKitTools/Scripts/bugzilla-tool
index 8e899b5..fdbb740 100755
--- a/WebKitTools/Scripts/bugzilla-tool
+++ b/WebKitTools/Scripts/bugzilla-tool
@@ -31,894 +31,74 @@
 # A tool for automating dealing with bugzilla, posting patches, committing patches, etc.
 
 import os
-import re
-import StringIO # for add_patch_to_bug file wrappers
-import subprocess
-import sys
-import time
 
-from datetime import datetime, timedelta
-from optparse import OptionParser, IndentedHelpFormatter, SUPPRESS_USAGE, make_option
-
-# Import WebKit-specific modules.
-from modules.bugzilla import Bugzilla, parse_bug_id
-from modules.changelogs import ChangeLog
-from modules.comments import bug_comment_from_commit_text
-from modules.logging import error, log, tee
-from modules.scm import CommitMessage, detect_scm_system, ScriptError, CheckoutNeedsUpdate
+from modules.bugzilla import Bugzilla
 from modules.buildbot import BuildBot
-from modules.statusbot import StatusBot
-
-def plural(noun):
-    # This is a dumb plural() implementation which was just enough for our uses.
-    if re.search('h$', noun):
-        return noun + 'es'
-    else:
-        return noun + 's'
-
-def pluralize(noun, count):
-    if count != 1:
-        noun = plural(noun)
-    return "%d %s" % (count, noun)
-
-def commit_message_for_this_commit(scm):
-    changelog_paths = scm.modified_changelogs()
-    if not len(changelog_paths):
-        raise ScriptError(message="Found no modified ChangeLogs, cannot create a commit message.\n"
-                          "All changes require a ChangeLog.  See:\n"
-                          "http://webkit.org/coding/contributing.html")
-
-    changelog_messages = []
-    for changelog_path in changelog_paths:
-        log("Parsing ChangeLog: %s" % changelog_path)
-        changelog_entry = ChangeLog(changelog_path).latest_entry()
-        if not changelog_entry:
-            raise ScriptError(message="Failed to parse ChangeLog: " + os.path.abspath(changelog_path))
-        changelog_messages.append(changelog_entry)
-
-    # FIXME: We should sort and label the ChangeLog messages like commit-log-editor does.
-    return CommitMessage(''.join(changelog_messages).splitlines())
-
-
-class Command:
-    def __init__(self, help_text, argument_names="", options=[], requires_local_commits=False):
-        self.help_text = help_text
-        self.argument_names = argument_names
-        self.options = options
-        self.option_parser = HelpPrintingOptionParser(usage=SUPPRESS_USAGE, add_help_option=False, option_list=self.options)
-        self.requires_local_commits = requires_local_commits
-    
-    def name_with_arguments(self, command_name):
-        usage_string = command_name
-        if len(self.options) > 0:
-            usage_string += " [options]"
-        if self.argument_names:
-            usage_string += " " + self.argument_names
-        return usage_string
-
-    def parse_args(self, args):
-        return self.option_parser.parse_args(args)
-
-    def execute(self, options, args, tool):
-        raise NotImplementedError, "subclasses must implement"
-
-
-class BugsInCommitQueue(Command):
-    def __init__(self):
-        Command.__init__(self, 'Bugs in the commit queue')
-
-    def execute(self, options, args, tool):
-        bug_ids = tool.bugs.fetch_bug_ids_from_commit_queue()
-        for bug_id in bug_ids:
-            print "%s" % bug_id
-
-
-class PatchesInCommitQueue(Command):
-    def __init__(self):
-        Command.__init__(self, 'Patches in the commit queue')
-
-    def execute(self, options, args, tool):
-        patches = tool.bugs.fetch_patches_from_commit_queue()
-        log("Patches in commit queue:")
-        for patch in patches:
-            print "%s" % patch['url']
-
-
-class ReviewedPatchesOnBug(Command):
-    def __init__(self):
-        Command.__init__(self, 'r+\'d patches on a bug', 'BUGID')
-
-    def execute(self, options, args, tool):
-        bug_id = args[0]
-        patches_to_land = tool.bugs.fetch_reviewed_patches_from_bug(bug_id)
-        for patch in patches_to_land:
-            print "%s" % patch['url']
-
-
-class ApplyPatchesFromBug(Command):
-    def __init__(self):
-        options = [
-            make_option("--no-update", action="store_false", dest="update", default=True, help="Don't update the working directory before applying patches"),
-            make_option("--local-commit", action="store_true", dest="local_commit", default=False, help="Make a local commit for each applied patch"),
-        ]
-        options += WebKitLandingScripts.cleaning_options()
-        Command.__init__(self, 'Applies all patches on a bug to the local working directory without committing.', 'BUGID', options=options)
-
-    @staticmethod
-    def apply_patches(patches, scm, commit_each):
-        for patch in patches:
-            scm.apply_patch(patch)
-            if commit_each:
-                commit_message = commit_message_for_this_commit(scm)
-                scm.commit_locally_with_message(commit_message.message() or patch['name'])
-
-    def execute(self, options, args, tool):
-        bug_id = args[0]
-        patches = tool.bugs.fetch_reviewed_patches_from_bug(bug_id)
-        os.chdir(tool.scm().checkout_root)
-        if options.clean:
-            tool.scm().ensure_clean_working_directory(options.force_clean)
-        if options.update:
-            tool.scm().update_webkit()
-        
-        if options.local_commit and not tool.scm().supports_local_commits():
-            error("--local-commit passed, but %s does not support local commits" % tool.scm().display_name())
-        
-        self.apply_patches(patches, tool.scm(), options.local_commit)
-
-
-class WebKitLandingScripts:
-    @staticmethod
-    def cleaning_options():
-        return [
-            make_option("--force-clean", action="store_true", dest="force_clean", default=False, help="Clean working directory before applying patches (removes local changes and commits)"),
-            make_option("--no-clean", action="store_false", dest="clean", default=True, help="Don't check if the working directory is clean before applying patches"),
-        ]
-
-    @staticmethod
-    def land_options():
-        return [
-            make_option("--ignore-builders", action="store_false", dest="check_builders", default=True, help="Don't check to see if the build.webkit.org builders are green before landing."),
-            make_option("--no-close", action="store_false", dest="close_bug", default=True, help="Leave bug open after landing."),
-            make_option("--no-build", action="store_false", dest="build", default=True, help="Commit without building first, implies --no-test."),
-            make_option("--no-test", action="store_false", dest="test", default=True, help="Commit without running run-webkit-tests."),
-            make_option("--quiet", action="store_true", dest="quiet", default=False, help="Produce less console output."),
-            make_option("--commit-queue", action="store_true", dest="commit_queue", default=False, help="Run in commit queue mode (no user interaction)."),
-        ]
-
-    @staticmethod
-    def run_command_with_teed_output(args, teed_output):
-        child_process = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-
-        # Use our own custom wait loop because Popen ignores a tee'd stderr/stdout.
-        # FIXME: This could be improved not to flatten output to stdout.
-        while True:
-            output_line = child_process.stdout.readline()
-            if output_line == '' and child_process.poll() != None:
-                return child_process.poll()
-            teed_output.write(output_line)
-
-    @staticmethod
-    def run_and_throw_if_fail(args, quiet=False):
-        # Cache the child's output locally so it can be used for error reports.
-        child_out_file = StringIO.StringIO()
-        if quiet:
-            dev_null = open(os.devnull, "w")
-        child_stdout = tee(child_out_file, dev_null if quiet else sys.stdout)
-        exit_code = WebKitLandingScripts.run_command_with_teed_output(args, child_stdout)
-        if quiet:
-            dev_null.close()
-
-        child_output = child_out_file.getvalue()
-        child_out_file.close()
-
-        if exit_code:
-            raise ScriptError(script_args=args, exit_code=exit_code, output=child_output)
-
-    # We might need to pass scm into this function for scm.checkout_root
-    @staticmethod
-    def webkit_script_path(script_name):
-        return os.path.join("WebKitTools", "Scripts", script_name)
-
-    @classmethod
-    def run_webkit_script(cls, script_name, quiet=False):
-        log("Running %s" % script_name)
-        cls.run_and_throw_if_fail(cls.webkit_script_path(script_name), quiet)
-
-    @classmethod
-    def build_webkit(cls, quiet=False):
-        cls.run_webkit_script("build-webkit", quiet)
-
-    @staticmethod
-    def ensure_builders_are_green(buildbot, options):
-        if not options.check_builders or buildbot.core_builders_are_green():
-            return
-        error("Builders at %s are red, please do not commit.  Pass --ignore-builders to bypass this check." % (buildbot.buildbot_host))
-
-    @classmethod
-    def run_webkit_tests(cls, launch_safari, fail_fast=False, quiet=False):
-        args = [cls.webkit_script_path("run-webkit-tests")]
-        if not launch_safari:
-            args.append("--no-launch-safari")
-        if quiet:
-            args.append("--quiet")
-        if fail_fast:
-            args.append("--exit-after-n-failures=1")
-        cls.run_and_throw_if_fail(args)
-
-    @staticmethod
-    def setup_for_landing(scm, options):
-        os.chdir(scm.checkout_root)
-        scm.ensure_no_local_commits(options.force_clean)
-        if options.clean:
-            scm.ensure_clean_working_directory(options.force_clean)
-
-    @classmethod
-    def build_and_commit(cls, scm, options):
-        if options.build:
-            cls.build_webkit(quiet=options.quiet)
-            if options.test:
-                # When running the commit-queue we don't want to launch Safari and we want to exit after the first failure.
-                cls.run_webkit_tests(launch_safari=not options.commit_queue, fail_fast=options.commit_queue, quiet=options.quiet)
-        commit_message = commit_message_for_this_commit(scm)
-        commit_log = scm.commit_with_message(commit_message.message())
-        return bug_comment_from_commit_text(scm, commit_log)
-
-
-class LandAndUpdateBug(Command):
-    def __init__(self):
-        options = [
-            make_option("-r", "--reviewer", action="store", type="string", dest="reviewer", help="Update ChangeLogs to say Reviewed by REVIEWER."),
-        ]
-        options += WebKitLandingScripts.land_options()
-        Command.__init__(self, 'Lands the current working directory diff and updates the bug if provided.', '[BUGID]', options=options)
-
-    def guess_reviewer_from_bug(self, bugs, bug_id):
-        patches = bugs.fetch_reviewed_patches_from_bug(bug_id)
-        if len(patches) != 1:
-            log("%s on bug %s, cannot infer reviewer." % (pluralize("reviewed patch", len(patches)), bug_id))
-            return None
-        patch = patches[0]
-        reviewer = patch['reviewer']
-        log('Guessing "%s" as reviewer from attachment %s on bug %s.' % (reviewer, patch['id'], bug_id))
-        return reviewer
-
-    def update_changelogs_with_reviewer(self, reviewer, bug_id, tool):
-        if not reviewer:
-            if not bug_id:
-                log("No bug id provided and --reviewer= not provided.  Not updating ChangeLogs with reviewer.")
-                return
-            reviewer = self.guess_reviewer_from_bug(tool.bugs, bug_id)
-
-        if not reviewer:
-            log("Failed to guess reviewer from bug %s and --reviewer= not provided.  Not updating ChangeLogs with reviewer." % bug_id)
-            return
-
-        for changelog_path in tool.scm().modified_changelogs():
-            ChangeLog(changelog_path).set_reviewer(reviewer)
-
-    def execute(self, options, args, tool):
-        bug_id = args[0] if len(args) else None
-        os.chdir(tool.scm().checkout_root)
-
-        WebKitLandingScripts.ensure_builders_are_green(tool.buildbot, options)
-
-        self.update_changelogs_with_reviewer(options.reviewer, bug_id, tool)
-
-        comment_text = WebKitLandingScripts.build_and_commit(tool.scm(), options)
-        if bug_id:
-            log("Updating bug %s" % bug_id)
-            if options.close_bug:
-                tool.bugs.close_bug_as_fixed(bug_id, comment_text)
-            else:
-                # FIXME: We should a smart way to figure out if the patch is attached
-                # to the bug, and if so obsolete it.
-                tool.bugs.post_comment_to_bug(bug_id, comment_text)
-        else:
-            log(comment_text)
-            log("No bug id provided.")
-
-
-class LandPatchesFromBugs(Command):
-    def __init__(self):
-        options = WebKitLandingScripts.cleaning_options()
-        options += WebKitLandingScripts.land_options()
-        Command.__init__(self, 'Lands all patches on a bug optionally testing them first', 'BUGID', options=options)
-
-    @staticmethod
-    def handled_error(error):
-        log(error)
-        exit(2) # Exit 2 insted of 1 to indicate to the commit-queue to indicate we handled the error, and that the queue should keep looping.
-
-    @classmethod
-    def land_patches(cls, bug_id, patches, options, tool):
-        try:
-            comment_text = ""
-            for patch in patches:
-                tool.scm().update_webkit() # Update before every patch in case the tree has changed
-                log("Applying %s from bug %s." % (patch['id'], bug_id))
-                tool.scm().apply_patch(patch, force=options.commit_queue)
-                # Make sure the tree is still green after updating, before building this patch.
-                # The first patch ends up checking tree status twice, but that's OK.
-                WebKitLandingScripts.ensure_builders_are_green(tool.buildbot, options)
-                comment_text = WebKitLandingScripts.build_and_commit(tool.scm(), options)
-                tool.bugs.clear_attachment_flags(patch['id'], comment_text)
-
-            if options.close_bug:
-                tool.bugs.close_bug_as_fixed(bug_id, "All reviewed patches have been landed.  Closing bug.")
-        except CheckoutNeedsUpdate, e:
-            log("Commit was rejected because the checkout is out of date.  Please update and try again.")
-            log("You can pass --no-build to skip building/testing after update if you believe the new commits did not affect the results.")
-            cls.handled_error(e)
-        except ScriptError, e:
-            # Mark the patch as commit-queue- and comment in the bug.
-            tool.bugs.reject_patch_from_commit_queue(patch['id'], e.message_with_output())
-            cls.handled_error(e)
-
-    @staticmethod
-    def _fetch_list_of_patches_to_land(options, args, tool):
-        bugs_to_patches = {}
-        patch_count = 0
-        for bug_id in args:
-            patches = []
-            if options.commit_queue:
-                patches = tool.bugs.fetch_commit_queue_patches_from_bug(bug_id, reject_invalid_patches=True)
-            else:
-                patches = tool.bugs.fetch_reviewed_patches_from_bug(bug_id)
-
-            patches_found = len(patches)
-            log("%s found on bug %s." % (pluralize("reviewed patch", patches_found), bug_id))
-
-            patch_count += patches_found
-            if patches_found:
-                bugs_to_patches[bug_id] = patches
-
-        log("Landing %s from %s." % (pluralize("patch", patch_count), pluralize("bug", len(args))))
-        return bugs_to_patches
-
-    def execute(self, options, args, tool):
-        if not len(args):
-            error("bug-id(s) required")
-
-        # Check the tree status here so we can fail early
-        WebKitLandingScripts.ensure_builders_are_green(tool.buildbot, options)
-
-        bugs_to_patches = self._fetch_list_of_patches_to_land(options, args, tool)
-
-        WebKitLandingScripts.setup_for_landing(tool.scm(), options)
-
-        for bug_id in bugs_to_patches.keys():
-            self.land_patches(bug_id, bugs_to_patches[bug_id], options, tool)
-
-
-class CommitMessageForCurrentDiff(Command):
-    def __init__(self):
-        Command.__init__(self, 'Prints a commit message suitable for the uncommitted changes.')
-
-    def execute(self, options, args, tool):
-        os.chdir(tool.scm().checkout_root)
-        print "%s" % commit_message_for_this_commit(tool.scm()).message()
-
-
-class ObsoleteAttachmentsOnBug(Command):
-    def __init__(self):
-        Command.__init__(self, 'Marks all attachments on a bug as obsolete.', 'BUGID')
-
-    def execute(self, options, args, tool):
-        bug_id = args[0]
-        attachments = tool.bugs.fetch_attachments_from_bug(bug_id)
-        for attachment in attachments:
-            if not attachment['is_obsolete']:
-                tool.bugs.obsolete_attachment(attachment['id'])
-
+from modules.buildsteps import BuildSteps
+from modules.commands.download import *
+from modules.commands.early_warning_system import *
+from modules.commands.queries import *
+from modules.commands.queues import *
+from modules.commands.upload import *
+from modules.executive import Executive
+from modules.logging import log
+from modules.multicommandtool import MultiCommandTool
+from modules.scm import detect_scm_system
+
+class BugzillaTool(MultiCommandTool):
+    def __init__(self):
+        MultiCommandTool.__init__(self)
+        self.global_option_parser.add_option("--dry-run", action="callback", help="do not touch remote servers", callback=self.dry_run_callback)
 
-class PostDiffAsPatchToBug(Command):
-    def __init__(self):
-        options = [
-            make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment (default: 'patch')"),
-        ]
-        options += self.posting_options()
-        Command.__init__(self, 'Attaches the current working directory diff to a bug as a patch file.', '[BUGID]', options=options)
-
-    @staticmethod
-    def posting_options():
-        return [
-            make_option("--no-obsolete", action="store_false", dest="obsolete_patches", default=True, help="Do not obsolete old patches before posting this one."),
-            make_option("--no-review", action="store_false", dest="review", default=True, help="Do not mark the patch for review."),
-            make_option("--request-commit", action="store_true", dest="request_commit", default=False, help="Mark the patch as needing auto-commit after review."),
-        ]
-
-    @staticmethod
-    def obsolete_patches_on_bug(bug_id, bugs):
-        patches = bugs.fetch_patches_from_bug(bug_id)
-        if len(patches):
-            log("Obsoleting %s on bug %s" % (pluralize('old patch', len(patches)), bug_id))
-            for patch in patches:
-                bugs.obsolete_attachment(patch['id'])
-
-    def execute(self, options, args, tool):
-        # Perfer a bug id passed as an argument over a bug url in the diff (i.e. ChangeLogs).
-        bug_id = (args and args[0]) or parse_bug_id(tool.scm().create_patch())
-        if not bug_id:
-            error("No bug id passed and no bug url found in diff, can't post.")
-
-        if options.obsolete_patches:
-            self.obsolete_patches_on_bug(bug_id, tool.bugs)
-
-        diff = tool.scm().create_patch()
-        diff_file = StringIO.StringIO(diff) # add_patch_to_bug expects a file-like object
-
-        description = options.description or "Patch v1"
-        tool.bugs.add_patch_to_bug(bug_id, diff_file, description, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
-
-
-class PostCommitsAsPatchesToBug(Command):
-    def __init__(self):
-        options = [
-            make_option("-b", "--bug-id", action="store", type="string", dest="bug_id", help="Specify bug id if no URL is provided in the commit log."),
-            make_option("--add-log-as-comment", action="store_true", dest="add_log_as_comment", default=False, help="Add commit log message as a comment when uploading the patch."),
-            make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment (default: description from commit message)"),
-        ]
-        options += PostDiffAsPatchToBug.posting_options()
-        Command.__init__(self, 'Attaches a range of local commits to bugs as patch files.', 'COMMITISH', options=options, requires_local_commits=True)
-
-    def _comment_text_for_commit(self, options, commit_message, tool, commit_id):
-        comment_text = None
-        if (options.add_log_as_comment):
-            comment_text = commit_message.body(lstrip=True)
-            comment_text += "---\n"
-            comment_text += tool.scm().files_changed_summary_for_commit(commit_id)
-        return comment_text
-
-    def _diff_file_for_commit(self, tool, commit_id):
-        diff = tool.scm().create_patch_from_local_commit(commit_id)
-        return StringIO.StringIO(diff) # add_patch_to_bug expects a file-like object
-
-    def execute(self, options, args, tool):
-        if not args:
-            error("%s argument is required" % self.argument_names)
-
-        commit_ids = tool.scm().commit_ids_from_commitish_arguments(args)
-        if len(commit_ids) > 10: # We could lower this limit, 10 is too many for one bug as-is.
-            error("bugzilla-tool does not support attaching %s at once.  Are you sure you passed the right commit range?" % (pluralize('patch', len(commit_ids))))
-
-        have_obsoleted_patches = set()
-        for commit_id in commit_ids:
-            commit_message = tool.scm().commit_message_for_local_commit(commit_id)
-
-            # Prefer --bug-id=, then a bug url in the commit message, then a bug url in the entire commit diff (i.e. ChangeLogs).
-            bug_id = options.bug_id or parse_bug_id(commit_message.message()) or parse_bug_id(tool.scm().create_patch_from_local_commit(commit_id))
-            if not bug_id:
-                log("Skipping %s: No bug id found in commit or specified with --bug-id." % commit_id)
-                continue
-
-            if options.obsolete_patches and bug_id not in have_obsoleted_patches:
-                PostDiffAsPatchToBug.obsolete_patches_on_bug(bug_id, tool.bugs)
-                have_obsoleted_patches.add(bug_id)
-
-            diff_file = self._diff_file_for_commit(tool, commit_id)
-            description = options.description or commit_message.description(lstrip=True, strip_url=True)
-            comment_text = self._comment_text_for_commit(options, commit_message, tool, commit_id)
-            tool.bugs.add_patch_to_bug(bug_id, diff_file, description, comment_text, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
-
-
-class RolloutCommit(Command):
-    def __init__(self):
-        options = WebKitLandingScripts.land_options()
-        options += WebKitLandingScripts.cleaning_options()
-        options.append(make_option("--complete-rollout", action="store_true", dest="complete_rollout", help="Experimental support for complete unsupervised rollouts, including re-opening the bug.  Not recommended."))
-        Command.__init__(self, 'Reverts the given revision and commits the revert and re-opens the original bug.', 'REVISION [BUGID]', options=options)
-
-    @staticmethod
-    def _create_changelogs_for_revert(scm, revision):
-        # First, discard the ChangeLog changes from the rollout.
-        changelog_paths = scm.modified_changelogs()
-        scm.revert_files(changelog_paths)
-
-        # Second, make new ChangeLog entries for this rollout.
-        # This could move to prepare-ChangeLog by adding a --revert= option.
-        WebKitLandingScripts.run_webkit_script("prepare-ChangeLog")
-        for changelog_path in changelog_paths:
-            ChangeLog(changelog_path).update_for_revert(revision)
-
-    @staticmethod
-    def _parse_bug_id_from_revision_diff(tool, revision):
-        original_diff = tool.scm().diff_for_revision(revision)
-        return parse_bug_id(original_diff)
-
-    @staticmethod
-    def _reopen_bug_after_rollout(tool, bug_id, comment_text):
-        if bug_id:
-            tool.bugs.reopen_bug(bug_id, comment_text)
-        else:
-            log(comment_text)
-            log("No bugs were updated or re-opened to reflect this rollout.")
-
-    def execute(self, options, args, tool):
-        if not args:
-            error("REVISION is required, see --help.")
-        revision = args[0]
-        bug_id = self._parse_bug_id_from_revision_diff(tool, revision)
-        if options.complete_rollout:
-            if bug_id:
-                log("Will re-open bug %s after rollout." % bug_id)
-            else:
-                log("Failed to parse bug number from diff.  No bugs will be updated/reopened after the rollout.")
-
-        WebKitLandingScripts.setup_for_landing(tool.scm(), options)
-        tool.scm().update_webkit()
-        tool.scm().apply_reverse_diff(revision)
-        self._create_changelogs_for_revert(tool.scm(), revision)
-
-        # FIXME: Fully automated rollout is not 100% idiot-proof yet, so for now just log with instructions on how to complete the rollout.
-        # Once we trust rollout we will remove this option.
-        if not options.complete_rollout:
-            log("\nNOTE: Rollout support is experimental.\nPlease verify the rollout diff and use 'bugzilla-tool land-diff %s' to commit the rollout." % bug_id)
-        else:
-            comment_text = WebKitLandingScripts.build_and_commit(tool.scm(), options)
-            self._reopen_bug_after_rollout(tool, bug_id, comment_text)
-
-
-class CreateBug(Command):
-    def __init__(self):
-        options = [
-            make_option("--cc", action="store", type="string", dest="cc", help="Comma-separated list of email addresses to carbon-copy."),
-            make_option("--component", action="store", type="string", dest="component", help="Component for the new bug."),
-            make_option("--no-prompt", action="store_false", dest="prompt", default=True, help="Do not prompt for bug title and comment; use commit log instead."),
-            make_option("--no-review", action="store_false", dest="review", default=True, help="Do not mark the patch for review."),
-            make_option("--request-commit", action="store_true", dest="request_commit", default=False, help="Mark the patch as needing auto-commit after review."),
-        ]
-        Command.__init__(self, 'Create a bug from local changes or local commits.', '[COMMITISH]', options=options)
-
-    def create_bug_from_commit(self, options, args, tool):
-        commit_ids = tool.scm().commit_ids_from_commitish_arguments(args)
-        if len(commit_ids) > 3:
-            error("Are you sure you want to create one bug with %s patches?" % len(commit_ids))
-
-        commit_id = commit_ids[0]
-
-        bug_title = ""
-        comment_text = ""
-        if options.prompt:
-            (bug_title, comment_text) = self.prompt_for_bug_title_and_comment()
-        else:
-            commit_message = tool.scm().commit_message_for_local_commit(commit_id)
-            bug_title = commit_message.description(lstrip=True, strip_url=True)
-            comment_text = commit_message.body(lstrip=True)
-            comment_text += "---\n"
-            comment_text += tool.scm().files_changed_summary_for_commit(commit_id)
-
-        diff = tool.scm().create_patch_from_local_commit(commit_id)
-        diff_file = StringIO.StringIO(diff) # create_bug_with_patch expects a file-like object
-        bug_id = tool.bugs.create_bug_with_patch(bug_title, comment_text, options.component, diff_file, "Patch v1", cc=options.cc, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
-
-        if bug_id and len(commit_ids) > 1:
-            options.bug_id = bug_id
-            options.obsolete_patches = False
-            # FIXME: We should pass through --no-comment switch as well.
-            PostCommitsAsPatchesToBug.execute(self, options, commit_ids[1:], tool)
-
-    def create_bug_from_patch(self, options, args, tool):
-        bug_title = ""
-        comment_text = ""
-        if options.prompt:
-            (bug_title, comment_text) = self.prompt_for_bug_title_and_comment()
-        else:
-            commit_message = commit_message_for_this_commit(tool.scm())
-            bug_title = commit_message.description(lstrip=True, strip_url=True)
-            comment_text = commit_message.body(lstrip=True)
-
-        diff = tool.scm().create_patch()
-        diff_file = StringIO.StringIO(diff) # create_bug_with_patch expects a file-like object
-        bug_id = tool.bugs.create_bug_with_patch(bug_title, comment_text, options.component, diff_file, "Patch v1", cc=options.cc, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
-
-    def prompt_for_bug_title_and_comment(self):
-        bug_title = raw_input("Bug title: ")
-        print "Bug comment (hit ^D on blank line to end):"
-        lines = sys.stdin.readlines()
-        try:
-            sys.stdin.seek(0, os.SEEK_END)
-        except IOError:
-            # Cygwin raises an Illegal Seek (errno 29) exception when the above
-            # seek() call is made. Ignoring it seems to cause no harm.
-            # FIXME: Figure out a way to get avoid the exception in the first
-            # place.
-            pass
-        else:
-            raise
-        comment_text = ''.join(lines)
-        return (bug_title, comment_text)
-
-    def execute(self, options, args, tool):
-        if len(args):
-            if (not tool.scm().supports_local_commits()):
-                error("Extra arguments not supported; patch is taken from working directory.")
-            self.create_bug_from_commit(options, args, tool)
-        else:
-            self.create_bug_from_patch(options, args, tool)
-
-
-class CheckTreeStatus(Command):
-    def __init__(self):
-        Command.__init__(self, 'Print out the status of the webkit builders.')
-
-    def execute(self, options, args, tool):
-        for builder in tool.buildbot.builder_statuses():
-            status_string = "ok" if builder['is_green'] else 'FAIL'
-            print "%s : %s" % (status_string.ljust(4), builder['name'])
-
-
-class LandPatchesFromCommitQueue(Command):
-    def __init__(self):
-        options = [
-            make_option("--is-relaunch", action="store_true", dest="is_relaunch", default=False, help="Internal: Used by the queue to indicate that it's relaunching itself."),
-            make_option("--no-confirm", action="store_false", dest="confirm", default=True, help="Do not ask the user for confirmation before running the queue.  Dangerous!"),
-            make_option("--status-host", action="store", type="string", dest="status_host", default=StatusBot.default_host, help="Do not ask the user for confirmation before running the queue.  Dangerous!"),
-        ]
-        Command.__init__(self, 'Run the commit queue.', options=options)
-        self._original_stdout = None
-        self._original_stderr = None
-        self._files_for_output = []
-
-    queue_log_path = 'commit_queue.log'
-    bug_logs_directory = 'commit_queue_logs'
-
-    log_date_format = "%Y-%m-%d %H:%M:%S"
-    sleep_duration_text = "5 mins"
-    seconds_to_sleep = 300
-
-    def _tee_outputs_to_files(self, files):
-        if not self._original_stdout:
-            self._original_stdout = sys.stdout
-            self._original_stderr = sys.stderr
-        if files and len(files):
-            sys.stdout = tee(self._original_stdout, *files)
-            sys.stderr = tee(self._original_stderr, *files)
-        else:
-            sys.stdout = self._original_stdout
-            sys.stderr = self._original_stderr
-
-    @classmethod
-    def _sleep_message(cls, message):
-        wake_time = datetime.now() + timedelta(seconds=cls.seconds_to_sleep)
-        return "%s Sleeping until %s (%s)." % (message, wake_time.strftime(cls.log_date_format), cls.sleep_duration_text)
-
-    def _sleep(self, message):
-        log(self._sleep_message(message))
-        time.sleep(self.seconds_to_sleep)
-        self._next_patch()
-
-    def _update_status_and_sleep(self, message):
-        status_message = self._sleep_message(message)
-        self.status_bot.update_status(status_message)
-        log(status_message)
-        time.sleep(self.seconds_to_sleep)
-        self._next_patch()
-
-    def _next_patch(self):
-        # Re-exec this script to catch any updates to the script.
-        # Make sure that the re-execed commit-queue does not wait for the user.
-        args = sys.argv[:]
-        if args.count("--is-relaunch") == 0:
-            args.append("--is-relaunch")
-        os.execvp(sys.argv[0], args)
-
-    @staticmethod
-    def _open_log_file(log_path):
-        (log_directory, log_name) = os.path.split(log_path)
-        if log_directory and not os.path.exists(log_directory):
-            os.makedirs(log_directory)
-        return open(log_path, 'a+')
-
-    def _add_log_to_output_tee(self, path):
-        log_file = self._open_log_file(path)
-        self._files_for_output.append(log_file)
-        self._tee_outputs_to_files(self._files_for_output)
-        return log_file
-
-    def _remove_log_from_output_tee(self, log_file):
-        self._files_for_output.remove(log_file)
-        self._tee_outputs_to_files(self._files_for_output)
-        log_file.close()
-
-    def execute(self, options, args, tool):
-        if not options.is_relaunch:
-            log("CAUTION: commit-queue will discard all local changes in %s" % tool.scm().checkout_root)
-            if options.confirm:
-                response = raw_input("Are you sure?  Type 'yes' to continue: ")
-                if (response != 'yes'):
-                    error("User declined.")
-
-        queue_log = self._add_log_to_output_tee(self.queue_log_path)
-        if not options.is_relaunch:
-            log("Running WebKit Commit Queue. %s" % datetime.now().strftime(self.log_date_format))
-
-        self.status_bot = StatusBot(host=options.status_host)
-
-        # Either of these calls could throw URLError which shouldn't stop the queue.
-        # We catch all exceptions just in case.
-        try:
-            # Fetch patches instead of just bug ids to that we validate reviewer/committer flags on every patch.
-            patches = tool.bugs.fetch_patches_from_commit_queue(reject_invalid_patches=True)
-            if not len(patches):
-                self._update_status_and_sleep("Empty queue.")
-            patch_ids = map(lambda patch: patch['id'], patches)
-            first_bug_id = patches[0]['bug_id']
-            log("%s in commit queue [%s]" % (pluralize('patch', len(patches)), ", ".join(patch_ids)))
-
-            red_builders_names = tool.buildbot.red_core_builders_names()
-            if red_builders_names:
-                red_builders_names = map(lambda name: '"%s"' % name, red_builders_names) # Add quotes around the names.
-                self._update_status_and_sleep("Builders [%s] are red. See http://build.webkit.org." % ", ".join(red_builders_names))
-
-            self.status_bot.update_status("Landing patches from bug %s." % first_bug_id, bug_id=first_bug_id)
-        except Exception, e:
-            # Don't try tell the status bot, in case telling it causes an exception.
-            self._sleep("Exception while checking queue and bots: %s." % e)
-
-        # Try to land patches on the first bug in the queue before looping
-        bug_log_path = os.path.join(self.bug_logs_directory, "%s.log" % first_bug_id)
-        bug_log = self._add_log_to_output_tee(bug_log_path)
-        bugzilla_tool_path = __file__ # re-execute this script
-        bugzilla_tool_args = [bugzilla_tool_path, 'land-patches', '--force-clean', '--commit-queue', '--quiet', first_bug_id]
-        try:
-            WebKitLandingScripts.run_and_throw_if_fail(bugzilla_tool_args)
-        except ScriptError, e:
-            # Unexpected failure!  Mark the patch as commit-queue- and comment in the bug.
-            # exit(2) is a special exit code we use to indicate that the error was already handled by land-patches and we should keep looping anyway.
-            if e.exit_code != 2:
-                tool.bugs.reject_patch_from_commit_queue(patch['id'], "Unexpected failure when landing patch!  Please file a bug against bugzilla-tool.\n%s" % e.message_with_output())
-        self._remove_log_from_output_tee(bug_log)
-        # self._remove_log_from_output_tee(queue_log) # implicit in the exec()
-        self._next_patch()
-
-
-class NonWrappingEpilogIndentedHelpFormatter(IndentedHelpFormatter):
-    def __init__(self):
-        IndentedHelpFormatter.__init__(self)
-
-    # The standard IndentedHelpFormatter paragraph-wraps the epilog, killing our custom formatting.
-    def format_epilog(self, epilog):
-        if epilog:
-            return "\n" + epilog + "\n"
-        return ""
-
-
-class HelpPrintingOptionParser(OptionParser):
-    def error(self, msg):
-        self.print_usage(sys.stderr)
-        error_message = "%s: error: %s\n" % (self.get_prog_name(), msg)
-        error_message += "\nType '" + self.get_prog_name() + " --help' to see usage.\n"
-        self.exit(2, error_message)
-
-
-class BugzillaTool:
-    def __init__(self):
-        self.cached_scm = None
         self.bugs = Bugzilla()
         self.buildbot = BuildBot()
-        self.commands = [
-            { 'name' : 'bugs-to-commit', 'object' : BugsInCommitQueue() },
-            { 'name' : 'patches-to-commit', 'object' : PatchesInCommitQueue() },
-            { 'name' : 'reviewed-patches', 'object' : ReviewedPatchesOnBug() },
-            { 'name' : 'create-bug', 'object' : CreateBug() },
-            { 'name' : 'apply-patches', 'object' : ApplyPatchesFromBug() },
-            { 'name' : 'land-diff', 'object' : LandAndUpdateBug() },
-            { 'name' : 'land-patches', 'object' : LandPatchesFromBugs() },
-            { 'name' : 'commit-message', 'object' : CommitMessageForCurrentDiff() },
-            { 'name' : 'obsolete-attachments', 'object' : ObsoleteAttachmentsOnBug() },
-            { 'name' : 'post-diff', 'object' : PostDiffAsPatchToBug() },
-            { 'name' : 'post-commits', 'object' : PostCommitsAsPatchesToBug() },
-            { 'name' : 'tree-status', 'object' : CheckTreeStatus() },
-            { 'name' : 'commit-queue', 'object' : LandPatchesFromCommitQueue() },
-            { 'name' : 'rollout', 'object' : RolloutCommit() },
-        ]
+        self.executive = Executive()
+        self._scm = None
+        self._status = None
+        self.steps = BuildSteps()
 
-        self.global_option_parser = HelpPrintingOptionParser(usage=self.usage_line(), formatter=NonWrappingEpilogIndentedHelpFormatter(), epilog=self.commands_usage())
-        self.global_option_parser.add_option("--dry-run", action="store_true", dest="dryrun", help="do not touch remote servers", default=False)
+    def dry_run_callback(self, option, opt, value, parser):
+        self.scm().dryrun = True
+        self.bugs.dryrun = True
 
     def scm(self):
         # Lazily initialize SCM to not error-out before command line parsing (or when running non-scm commands).
-        original_cwd = os.path.abspath('.')
-        if not self.cached_scm:
-            self.cached_scm = detect_scm_system(original_cwd)
-        
-        if not self.cached_scm:
+        original_cwd = os.path.abspath(".")
+        if not self._scm:
+            self._scm = detect_scm_system(original_cwd)
+
+        if not self._scm:
             script_directory = os.path.abspath(sys.path[0])
             webkit_directory = os.path.abspath(os.path.join(script_directory, "../.."))
-            self.cached_scm = detect_scm_system(webkit_directory)
-            if self.cached_scm:
+            self._scm = detect_scm_system(webkit_directory)
+            if self._scm:
                 log("The current directory (%s) is not a WebKit checkout, using %s" % (original_cwd, webkit_directory))
             else:
                 error("FATAL: Failed to determine the SCM system for either %s or %s" % (original_cwd, webkit_directory))
-        
-        return self.cached_scm
-
-    @staticmethod
-    def usage_line():
-        return "Usage: %prog [options] command [command-options] [command-arguments]"
-
-    def commands_usage(self):
-        commands_text = "Commands:\n"
-        longest_name_length = 0
-        command_rows = []
-        scm_supports_local_commits = self.scm().supports_local_commits()
-        for command in self.commands:
-            command_object = command['object']
-            if command_object.requires_local_commits and not scm_supports_local_commits:
-                continue
-            command_name_and_args = command_object.name_with_arguments(command['name'])
-            command_rows.append({ 'name-and-args': command_name_and_args, 'object': command_object })
-            longest_name_length = max([longest_name_length, len(command_name_and_args)])
-        
-        # Use our own help formatter so as to indent enough.
-        formatter = IndentedHelpFormatter()
-        formatter.indent()
-        formatter.indent()
-        
-        for row in command_rows:
-            command_object = row['object']
-            commands_text += "  " + row['name-and-args'].ljust(longest_name_length + 3) + command_object.help_text + "\n"
-            commands_text += command_object.option_parser.format_option_help(formatter)
-        return commands_text
-
-    def handle_global_args(self, args):
-        (options, args) = self.global_option_parser.parse_args(args)
-        if len(args):
-            # We'll never hit this because split_args splits at the first arg without a leading '-'
-            self.global_option_parser.error("Extra arguments before command: " + args)
-        
-        if options.dryrun:
-            self.scm().dryrun = True
-            self.bugs.dryrun = True
-    
-    @staticmethod
-    def split_args(args):
-        # Assume the first argument which doesn't start with '-' is the command name.
-        command_index = 0
-        for arg in args:
-            if arg[0] != '-':
-                break
-            command_index += 1
-        else:
-            return (args[:], None, [])
 
-        global_args = args[:command_index]
-        command = args[command_index]
-        command_args = args[command_index + 1:]
-        return (global_args, command, command_args)
-    
-    def command_by_name(self, command_name):
-        for command in self.commands:
-            if command_name == command['name']:
-                return command
-        return None
-    
-    def main(self):
-        (global_args, command_name, args_after_command_name) = self.split_args(sys.argv[1:])
-        
-        # Handle --help, etc:
-        self.handle_global_args(global_args)
-        
-        if not command_name:
-            self.global_option_parser.error("No command specified")
-        
-        command = self.command_by_name(command_name)
-        if not command:
-            self.global_option_parser.error(command_name + " is not a recognized command")
+        return self._scm
 
-        command_object = command['object']
+    def status(self):
+        if not self._status:
+            self._status = StatusBot()
+        return self._status
 
-        if command_object.requires_local_commits and not self.scm().supports_local_commits():
-            error(command_name + " requires local commits using %s in %s." % (self.scm().display_name(), self.scm().checkout_root))
+    def path(self):
+        return __file__
 
-        (command_options, command_args) = command_object.parse_args(args_after_command_name)
-        return command_object.execute(command_options, command_args, self)
+    def should_show_in_main_help(self, command):
+        if not command.show_in_main_help:
+            return False
+        if command.requires_local_commits:
+            return self.scm().supports_local_commits()
+        return True
 
+    def should_execute_command(self, command):
+        if command.requires_local_commits and not self.scm().supports_local_commits():
+            failure_reason = "%s requires local commits using %s in %s." % (command.name, self.scm().display_name(), self.scm().checkout_root)
+            return (False, failure_reason)
+        return (True, None)
 
-def main():
-    tool = BugzillaTool()
-    return tool.main()
 
 if __name__ == "__main__":
-    main()
+    BugzillaTool().main()
diff --git a/WebKitTools/Scripts/build-webkit b/WebKitTools/Scripts/build-webkit
index 4f78eef..566965b 100755
--- a/WebKitTools/Scripts/build-webkit
+++ b/WebKitTools/Scripts/build-webkit
@@ -50,9 +50,9 @@ my $minimal = 0;
 my $makeArgs;
 my $startTime = time();
 
-my ($threeDCanvasSupport, $threeDRenderingSupport, $channelMessagingSupport, $databaseSupport, $datagridSupport, $domStorageSupport,
-    $eventsourceSupport, $filtersSupport, $geolocationSupport, $iconDatabaseSupport,
-    $javaScriptDebuggerSupport, $mathmlSupport, $offlineWebApplicationSupport, $rubySupport, $sharedWorkersSupport, 
+my ($threeDCanvasSupport, $threeDRenderingSupport, $channelMessagingSupport, $databaseSupport, $datagridSupport, $datalistSupport,
+    $domStorageSupport, $eventsourceSupport, $filtersSupport, $geolocationSupport, $iconDatabaseSupport,
+    $javaScriptDebuggerSupport, $mathmlSupport, $offlineWebApplicationSupport, $sharedWorkersSupport,
     $svgSupport, $svgAnimationSupport, $svgAsImageSupport, $svgDOMObjCBindingsSupport, $svgFontsSupport,
     $svgForeignObjectSupport, $svgUseSupport, $videoSupport, $webSocketsSupport, $wmlSupport, $wcssSupport, $xhtmlmpSupport, $workersSupport,
     $xpathSupport, $xsltSupport, $coverageSupport, $notificationsSupport);
@@ -75,6 +75,9 @@ my @features = (
 
     { option => "datagrid", desc => "Toggle Datagrid Support",
       define => "ENABLE_DATAGRID", default => 1, value => \$datagridSupport },
+      
+    { option => "datalist", desc => "Toggle HTML5 datalist support",
+      define => "ENABLE_DATALIST", default => 1, value => \$datalistSupport },
           
     { option => "dom-storage", desc => "Toggle DOM Storage Support",
       define => "ENABLE_DOM_STORAGE", default => 1, value => \$domStorageSupport },
@@ -83,7 +86,7 @@ my @features = (
       define => "ENABLE_EVENTSOURCE", default => 1, value => \$eventsourceSupport },
 
     { option => "filters", desc => "Toggle Filters support",
-      define => "ENABLE_FILTERS", default => 0, value => \$filtersSupport },
+      define => "ENABLE_FILTERS", default => (isAppleWebKit() || isGtk() || isQt()), value => \$filtersSupport },
 
     { option => "geolocation", desc => "Toggle Geolocation support",
       define => "ENABLE_GEOLOCATION", default => isGtk(), value => \$geolocationSupport },
@@ -103,9 +106,6 @@ my @features = (
     { option => "offline-web-applications", desc => "Toggle Offline Web Application Support",
       define => "ENABLE_OFFLINE_WEB_APPLICATIONS", default => 1, value => \$offlineWebApplicationSupport },
 
-    { option => "ruby", desc => "Toggle HTML5 Ruby support",
-      define => "ENABLE_RUBY", default => 1, value => \$rubySupport },
-
     { option => "shared-workers", desc => "Toggle SharedWorkers support",
       define => "ENABLE_SHARED_WORKERS", default => (isAppleWebKit() || isGtk()), value => \$sharedWorkersSupport },
 
@@ -313,6 +313,7 @@ removeLibraryDependingOnSVG("WebCore", $svgSupport);
 
 if (isWx()) {
     downloadWafIfNeeded();
+    push @projects, 'WebKitTools/DumpRenderTree';
     push @projects, 'WebKitTools/wx/browser';
     push @projects, 'WebKit/wx/bindings/python';
 }
@@ -321,7 +322,7 @@ if (isChromium()) {
     # Chromium doesn't build by project directories.
     @projects = ();
     my $result = buildChromium($clean, @options);
-    exit $result if $result;
+    exit exitStatus($result) if exitStatus($result);
 }
 
 # Build, and abort if the build fails.
@@ -361,7 +362,7 @@ for my $dir (@projects) {
         if (isAppleWinWebKit()) {
             print "\n\n===== BUILD FAILED ======\n\n";
             my $scriptDir = relativeScriptsDir();
-            print "Please ensure you have run $scriptDir/update-webkit to install depenedencies.\n\n";
+            print "Please ensure you have run $scriptDir/update-webkit to install dependencies.\n\n";
             my $baseProductDir = baseProductDir();
             print "You can view build errors by checking the BuildLog.htm files located at:\n$baseProductDir/obj/<project>/<config>.\n";
         }
diff --git a/WebKitTools/Scripts/commit-log-editor b/WebKitTools/Scripts/commit-log-editor
index e58b181..75017e3 100755
--- a/WebKitTools/Scripts/commit-log-editor
+++ b/WebKitTools/Scripts/commit-log-editor
@@ -170,7 +170,8 @@ for my $changeLog (@changeLogs) {
 
             # Attempt to insert the "patch by" line, after the first blank line.
             if ($previousLineWasBlank && $hasAuthorInfoToWrite && $lineCount > 0) {
-                my $authorAndCommitterAreSamePerson = $ENV{EMAIL_ADDRESS} && $email eq $ENV{EMAIL_ADDRESS};
+                my $committerEmail = changeLogEmailAddress();
+                my $authorAndCommitterAreSamePerson = $email eq $committerEmail;
                 if (!$authorAndCommitterAreSamePerson) {
                     $contents .= "Patch by $author <$email> on $date\n";
                     $hasAuthorInfoToWrite = 0;
@@ -229,7 +230,7 @@ if (isGit() && scalar keys %changeLogSort == 0) {
         chomp($webkitGenerateCommitMessage = `git config --bool core.webkitGenerateCommitMessage`);
     }
     if ($webkitGenerateCommitMessage ne "false") {
-        open CHANGELOG_ENTRIES, "-|", "prepare-ChangeLog --git-index --no-write" or die "prepare-ChangeLog failed: $!.\n";
+        open CHANGELOG_ENTRIES, "-|", "$FindBin::Bin/prepare-ChangeLog --git-index --no-write" or die "prepare-ChangeLog failed: $!.\n";
         while (<CHANGELOG_ENTRIES>) {
             print NEWLOG normalizeLineEndings($_, $endl);
         }
diff --git a/WebKitTools/Scripts/do-webcore-rename b/WebKitTools/Scripts/do-webcore-rename
index 2d6ca46..a65fa4f 100755
--- a/WebKitTools/Scripts/do-webcore-rename
+++ b/WebKitTools/Scripts/do-webcore-rename
@@ -33,6 +33,7 @@ use FindBin;
 use lib $FindBin::Bin;
 use webkitdirs;
 use File::Find;
+use VCSUtils;
 
 setConfiguration();
 chdirWebKit();
@@ -66,9 +67,229 @@ sub wanted
 
     push @paths, $File::Find::name;
 }
-
+my $isDOMTypeRename = 1;
 my %renames = (
-    "parseURL" => "deprecatedParseURL"
+    "CanvasActiveInfo" => "WebGLActiveInfo",
+    "canvasActiveInfo" => "webGLActiveInfo",
+    "CanvasActiveInfoConstructor" => "WebGLActiveInfoConstructor",
+    "CanvasActiveInfoPrototype" => "WebGLActiveInfoPrototype",
+    "toCanvasActiveInfo" => "toWebGLActiveInfo",
+    "JSCanvasActiveInfo" => "JSWebGLActiveInfo",
+    "JSCanvasActiveInfoPrototype" => "JSWebGLActiveInfoPrototype",
+    "JSCanvasActiveInfoConstructor" => "JSWebGLActiveInfoConstructor",
+    "JSCanvasActiveInfoCustom" => "JSWebGLActiveInfoCustom",
+    "V8CanvasActiveInfo" => "V8WebGLActiveInfo",
+    "V8CanvasActiveInfoPrototype" => "V8WebGLActiveInfoPrototype",
+    "V8CanvasActiveInfoConstructor" => "V8WebGLActiveInfoConstructor",
+    "V8CanvasActiveInfoCustom" => "V8WebGLActiveInfoCustom",
+    "CanvasArray" => "WebGLArray",
+    "canvasArray" => "webGLArray",
+    "CanvasArrayConstructor" => "WebGLArrayConstructor",
+    "CanvasArrayPrototype" => "WebGLArrayPrototype",
+    "toCanvasArray" => "toWebGLArray",
+    "JSCanvasArray" => "JSWebGLArray",
+    "JSCanvasArrayPrototype" => "JSWebGLArrayPrototype",
+    "JSCanvasArrayConstructor" => "JSWebGLArrayConstructor",
+    "JSCanvasArrayCustom" => "JSWebGLArrayCustom",
+    "V8CanvasArray" => "V8WebGLArray",
+    "V8CanvasArrayPrototype" => "V8WebGLArrayPrototype",
+    "V8CanvasArrayConstructor" => "V8WebGLArrayConstructor",
+    "V8CanvasArrayCustom" => "V8WebGLArrayCustom",
+    "CanvasArrayBuffer" => "WebGLArrayBuffer",
+    "canvasArrayBuffer" => "webGLArrayBuffer",
+    "CanvasArrayBufferConstructor" => "WebGLArrayBufferConstructor",
+    "CanvasArrayBufferPrototype" => "WebGLArrayBufferPrototype",
+    "toCanvasArrayBuffer" => "toWebGLArrayBuffer",
+    "JSCanvasArrayBuffer" => "JSWebGLArrayBuffer",
+    "JSCanvasArrayBufferPrototype" => "JSWebGLArrayBufferPrototype",
+    "JSCanvasArrayBufferConstructor" => "JSWebGLArrayBufferConstructor",
+    "JSCanvasArrayBufferCustom" => "JSWebGLArrayBufferCustom",
+    "V8CanvasArrayBuffer" => "V8WebGLArrayBuffer",
+    "V8CanvasArrayBufferPrototype" => "V8WebGLArrayBufferPrototype",
+    "V8CanvasArrayBufferConstructor" => "V8WebGLArrayBufferConstructor",
+    "V8CanvasArrayBufferCustom" => "V8WebGLArrayBufferCustom",
+    "CanvasBuffer" => "WebGLBuffer",
+    "canvasBuffer" => "webGLBuffer",
+    "CanvasBufferConstructor" => "WebGLBufferConstructor",
+    "CanvasBufferPrototype" => "WebGLBufferPrototype",
+    "toCanvasBuffer" => "toWebGLBuffer",
+    "JSCanvasBuffer" => "JSWebGLBuffer",
+    "JSCanvasBufferPrototype" => "JSWebGLBufferPrototype",
+    "JSCanvasBufferConstructor" => "JSWebGLBufferConstructor",
+    "JSCanvasBufferCustom" => "JSWebGLBufferCustom",
+    "V8CanvasBuffer" => "V8WebGLBuffer",
+    "V8CanvasBufferPrototype" => "V8WebGLBufferPrototype",
+    "V8CanvasBufferConstructor" => "V8WebGLBufferConstructor",
+    "V8CanvasBufferCustom" => "V8WebGLBufferCustom",
+    "CanvasByteArray" => "WebGLByteArray",
+    "canvasByteArray" => "webGLByteArray",
+    "CanvasByteArrayConstructor" => "WebGLByteArrayConstructor",
+    "CanvasByteArrayPrototype" => "WebGLByteArrayPrototype",
+    "toCanvasByteArray" => "toWebGLByteArray",
+    "JSCanvasByteArray" => "JSWebGLByteArray",
+    "JSCanvasByteArrayPrototype" => "JSWebGLByteArrayPrototype",
+    "JSCanvasByteArrayConstructor" => "JSWebGLByteArrayConstructor",
+    "JSCanvasByteArrayCustom" => "JSWebGLByteArrayCustom",
+    "V8CanvasByteArray" => "V8WebGLByteArray",
+    "V8CanvasByteArrayPrototype" => "V8WebGLByteArrayPrototype",
+    "V8CanvasByteArrayConstructor" => "V8WebGLByteArrayConstructor",
+    "V8CanvasByteArrayCustom" => "V8WebGLByteArrayCustom",
+    "CanvasFloatArray" => "WebGLFloatArray",
+    "canvasFloatArray" => "webGLFloatArray",
+    "CanvasFloatArrayConstructor" => "WebGLFloatArrayConstructor",
+    "CanvasFloatArrayPrototype" => "WebGLFloatArrayPrototype",
+    "toCanvasFloatArray" => "toWebGLFloatArray",
+    "JSCanvasFloatArray" => "JSWebGLFloatArray",
+    "JSCanvasFloatArrayPrototype" => "JSWebGLFloatArrayPrototype",
+    "JSCanvasFloatArrayConstructor" => "JSWebGLFloatArrayConstructor",
+    "JSCanvasFloatArrayCustom" => "JSWebGLFloatArrayCustom",
+    "V8CanvasFloatArray" => "V8WebGLFloatArray",
+    "V8CanvasFloatArrayPrototype" => "V8WebGLFloatArrayPrototype",
+    "V8CanvasFloatArrayConstructor" => "V8WebGLFloatArrayConstructor",
+    "V8CanvasFloatArrayCustom" => "V8WebGLFloatArrayCustom",
+    "CanvasFramebuffer" => "WebGLFramebuffer",
+    "canvasFramebuffer" => "webGLFramebuffer",
+    "CanvasFramebufferConstructor" => "WebGLFramebufferConstructor",
+    "CanvasFramebufferPrototype" => "WebGLFramebufferPrototype",
+    "toCanvasFramebuffer" => "toWebGLFramebuffer",
+    "JSCanvasFramebuffer" => "JSWebGLFramebuffer",
+    "JSCanvasFramebufferPrototype" => "JSWebGLFramebufferPrototype",
+    "JSCanvasFramebufferConstructor" => "JSWebGLFramebufferConstructor",
+    "JSCanvasFramebufferCustom" => "JSWebGLFramebufferCustom",
+    "V8CanvasFramebuffer" => "V8WebGLFramebuffer",
+    "V8CanvasFramebufferPrototype" => "V8WebGLFramebufferPrototype",
+    "V8CanvasFramebufferConstructor" => "V8WebGLFramebufferConstructor",
+    "V8CanvasFramebufferCustom" => "V8WebGLFramebufferCustom",
+    "CanvasIntArray" => "WebGLIntArray",
+    "canvasIntArray" => "webGLIntArray",
+    "CanvasIntArrayConstructor" => "WebGLIntArrayConstructor",
+    "CanvasIntArrayPrototype" => "WebGLIntArrayPrototype",
+    "toCanvasIntArray" => "toWebGLIntArray",
+    "JSCanvasIntArray" => "JSWebGLIntArray",
+    "JSCanvasIntArrayPrototype" => "JSWebGLIntArrayPrototype",
+    "JSCanvasIntArrayConstructor" => "JSWebGLIntArrayConstructor",
+    "JSCanvasIntArrayCustom" => "JSWebGLIntArrayCustom",
+    "V8CanvasIntArray" => "V8WebGLIntArray",
+    "V8CanvasIntArrayPrototype" => "V8WebGLIntArrayPrototype",
+    "V8CanvasIntArrayConstructor" => "V8WebGLIntArrayConstructor",
+    "V8CanvasIntArrayCustom" => "V8WebGLIntArrayCustom",
+    "CanvasProgram" => "WebGLProgram",
+    "canvasProgram" => "webGLProgram",
+    "CanvasProgramConstructor" => "WebGLProgramConstructor",
+    "CanvasProgramPrototype" => "WebGLProgramPrototype",
+    "toCanvasProgram" => "toWebGLProgram",
+    "JSCanvasProgram" => "JSWebGLProgram",
+    "JSCanvasProgramPrototype" => "JSWebGLProgramPrototype",
+    "JSCanvasProgramConstructor" => "JSWebGLProgramConstructor",
+    "JSCanvasProgramCustom" => "JSWebGLProgramCustom",
+    "V8CanvasProgram" => "V8WebGLProgram",
+    "V8CanvasProgramPrototype" => "V8WebGLProgramPrototype",
+    "V8CanvasProgramConstructor" => "V8WebGLProgramConstructor",
+    "V8CanvasProgramCustom" => "V8WebGLProgramCustom",
+    "CanvasRenderbuffer" => "WebGLRenderbuffer",
+    "canvasRenderbuffer" => "webGLRenderbuffer",
+    "CanvasRenderbufferConstructor" => "WebGLRenderbufferConstructor",
+    "CanvasRenderbufferPrototype" => "WebGLRenderbufferPrototype",
+    "toCanvasRenderbuffer" => "toWebGLRenderbuffer",
+    "JSCanvasRenderbuffer" => "JSWebGLRenderbuffer",
+    "JSCanvasRenderbufferPrototype" => "JSWebGLRenderbufferPrototype",
+    "JSCanvasRenderbufferConstructor" => "JSWebGLRenderbufferConstructor",
+    "JSCanvasRenderbufferCustom" => "JSWebGLRenderbufferCustom",
+    "V8CanvasRenderbuffer" => "V8WebGLRenderbuffer",
+    "V8CanvasRenderbufferPrototype" => "V8WebGLRenderbufferPrototype",
+    "V8CanvasRenderbufferConstructor" => "V8WebGLRenderbufferConstructor",
+    "V8CanvasRenderbufferCustom" => "V8WebGLRenderbufferCustom",
+    "CanvasRenderingContext3D" => "WebGLRenderingContext",
+    "canvasRenderingContext3D" => "webGLRenderingContext",
+    "CanvasRenderingContext3DConstructor" => "WebGLRenderingContextConstructor",
+    "CanvasRenderingContext3DPrototype" => "WebGLRenderingContextPrototype",
+    "toCanvasRenderingContext3D" => "toWebGLRenderingContext",
+    "JSCanvasRenderingContext3D" => "JSWebGLRenderingContext",
+    "JSCanvasRenderingContext3DPrototype" => "JSWebGLRenderingContextPrototype",
+    "JSCanvasRenderingContext3DConstructor" => "JSWebGLRenderingContextConstructor",
+    "JSCanvasRenderingContext3DCustom" => "JSWebGLRenderingContextCustom",
+    "V8CanvasRenderingContext3D" => "V8WebGLRenderingContext",
+    "V8CanvasRenderingContext3DPrototype" => "V8WebGLRenderingContextPrototype",
+    "V8CanvasRenderingContext3DConstructor" => "V8WebGLRenderingContextConstructor",
+    "V8CanvasRenderingContext3DCustom" => "V8WebGLRenderingContextCustom",
+    "CanvasShader" => "WebGLShader",
+    "canvasShader" => "webGLShader",
+    "CanvasShaderConstructor" => "WebGLShaderConstructor",
+    "CanvasShaderPrototype" => "WebGLShaderPrototype",
+    "toCanvasShader" => "toWebGLShader",
+    "JSCanvasShader" => "JSWebGLShader",
+    "JSCanvasShaderPrototype" => "JSWebGLShaderPrototype",
+    "JSCanvasShaderConstructor" => "JSWebGLShaderConstructor",
+    "JSCanvasShaderCustom" => "JSWebGLShaderCustom",
+    "V8CanvasShader" => "V8WebGLShader",
+    "V8CanvasShaderPrototype" => "V8WebGLShaderPrototype",
+    "V8CanvasShaderConstructor" => "V8WebGLShaderConstructor",
+    "V8CanvasShaderCustom" => "V8WebGLShaderCustom",
+    "CanvasShortArray" => "WebGLShortArray",
+    "canvasShortArray" => "webGLShortArray",
+    "CanvasShortArrayConstructor" => "WebGLShortArrayConstructor",
+    "CanvasShortArrayPrototype" => "WebGLShortArrayPrototype",
+    "toCanvasShortArray" => "toWebGLShortArray",
+    "JSCanvasShortArray" => "JSWebGLShortArray",
+    "JSCanvasShortArrayPrototype" => "JSWebGLShortArrayPrototype",
+    "JSCanvasShortArrayConstructor" => "JSWebGLShortArrayConstructor",
+    "JSCanvasShortArrayCustom" => "JSWebGLShortArrayCustom",
+    "V8CanvasShortArray" => "V8WebGLShortArray",
+    "V8CanvasShortArrayPrototype" => "V8WebGLShortArrayPrototype",
+    "V8CanvasShortArrayConstructor" => "V8WebGLShortArrayConstructor",
+    "V8CanvasShortArrayCustom" => "V8WebGLShortArrayCustom",
+    "CanvasTexture" => "WebGLTexture",
+    "canvasTexture" => "webGLTexture",
+    "CanvasTextureConstructor" => "WebGLTextureConstructor",
+    "CanvasTexturePrototype" => "WebGLTexturePrototype",
+    "toCanvasTexture" => "toWebGLTexture",
+    "JSCanvasTexture" => "JSWebGLTexture",
+    "JSCanvasTexturePrototype" => "JSWebGLTexturePrototype",
+    "JSCanvasTextureConstructor" => "JSWebGLTextureConstructor",
+    "JSCanvasTextureCustom" => "JSWebGLTextureCustom",
+    "V8CanvasTexture" => "V8WebGLTexture",
+    "V8CanvasTexturePrototype" => "V8WebGLTexturePrototype",
+    "V8CanvasTextureConstructor" => "V8WebGLTextureConstructor",
+    "V8CanvasTextureCustom" => "V8WebGLTextureCustom",
+    "CanvasUnsignedByteArray" => "WebGLUnsignedByteArray",
+    "canvasUnsignedByteArray" => "webGLUnsignedByteArray",
+    "CanvasUnsignedByteArrayConstructor" => "WebGLUnsignedByteArrayConstructor",
+    "CanvasUnsignedByteArrayPrototype" => "WebGLUnsignedByteArrayPrototype",
+    "toCanvasUnsignedByteArray" => "toWebGLUnsignedByteArray",
+    "JSCanvasUnsignedByteArray" => "JSWebGLUnsignedByteArray",
+    "JSCanvasUnsignedByteArrayPrototype" => "JSWebGLUnsignedByteArrayPrototype",
+    "JSCanvasUnsignedByteArrayConstructor" => "JSWebGLUnsignedByteArrayConstructor",
+    "JSCanvasUnsignedByteArrayCustom" => "JSWebGLUnsignedByteArrayCustom",
+    "V8CanvasUnsignedByteArray" => "V8WebGLUnsignedByteArray",
+    "V8CanvasUnsignedByteArrayPrototype" => "V8WebGLUnsignedByteArrayPrototype",
+    "V8CanvasUnsignedByteArrayConstructor" => "V8WebGLUnsignedByteArrayConstructor",
+    "V8CanvasUnsignedByteArrayCustom" => "V8WebGLUnsignedByteArrayCustom",
+    "CanvasUnsignedIntArray" => "WebGLUnsignedIntArray",
+    "canvasUnsignedIntArray" => "webGLUnsignedIntArray",
+    "CanvasUnsignedIntArrayConstructor" => "WebGLUnsignedIntArrayConstructor",
+    "CanvasUnsignedIntArrayPrototype" => "WebGLUnsignedIntArrayPrototype",
+    "toCanvasUnsignedIntArray" => "toWebGLUnsignedIntArray",
+    "JSCanvasUnsignedIntArray" => "JSWebGLUnsignedIntArray",
+    "JSCanvasUnsignedIntArrayPrototype" => "JSWebGLUnsignedIntArrayPrototype",
+    "JSCanvasUnsignedIntArrayConstructor" => "JSWebGLUnsignedIntArrayConstructor",
+    "JSCanvasUnsignedIntArrayCustom" => "JSWebGLUnsignedIntArrayCustom",
+    "V8CanvasUnsignedIntArray" => "V8WebGLUnsignedIntArray",
+    "V8CanvasUnsignedIntArrayPrototype" => "V8WebGLUnsignedIntArrayPrototype",
+    "V8CanvasUnsignedIntArrayConstructor" => "V8WebGLUnsignedIntArrayConstructor",
+    "V8CanvasUnsignedIntArrayCustom" => "V8WebGLUnsignedIntArrayCustom",
+    "CanvasUnsignedShortArray" => "WebGLUnsignedShortArray",
+    "canvasUnsignedShortArray" => "webGLUnsignedShortArray",
+    "CanvasUnsignedShortArrayConstructor" => "WebGLUnsignedShortArrayConstructor",
+    "CanvasUnsignedShortArrayPrototype" => "WebGLUnsignedShortArrayPrototype",
+    "toCanvasUnsignedShortArray" => "toWebGLUnsignedShortArray",
+    "JSCanvasUnsignedShortArray" => "JSWebGLUnsignedShortArray",
+    "JSCanvasUnsignedShortArrayPrototype" => "JSWebGLUnsignedShortArrayPrototype",
+    "JSCanvasUnsignedShortArrayConstructor" => "JSWebGLUnsignedShortArrayConstructor",
+    "JSCanvasUnsignedShortArrayCustom" => "JSWebGLUnsignedShortArrayCustom",
+    "V8CanvasUnsignedShortArray" => "V8WebGLUnsignedShortArray",
+    "V8CanvasUnsignedShortArrayPrototype" => "V8WebGLUnsignedShortArrayPrototype",
+    "V8CanvasUnsignedShortArrayConstructor" => "V8WebGLUnsignedShortArrayConstructor",
+    "V8CanvasUnsignedShortArrayCustom" => "V8WebGLUnsignedShortArrayCustom"
 );
 
 my %renamesContemplatedForTheFuture = (
@@ -150,11 +371,18 @@ for my $file (sort @paths) {
     }
 }
 
+
+my $isGit = isGit();
+
 for my $file (sort @paths) {
     if ($newFile{$file}) {
         my $newFile = $newFile{$file};
         print "Renaming $file to $newFile\n";
-        system "svn move $file $newFile";
+        if ($isGit) {
+            system "git mv $file $newFile";
+        } else {
+            system "svn move $file $newFile";
+        }
     }
 }
 
@@ -171,8 +399,14 @@ for my $file (sort @paths) {
     }
     my $newContents = $contents;
 
-    for my $from (keys %renames) {
-        $newContents =~ s/\b$from(?!["\w])/$renames{$from}/g; # this " unconfuses Xcode syntax highlighting
+    if ($isDOMTypeRename) {
+        for my $from (keys %renames) {
+            $newContents =~ s/\b$from/$renames{$from}/g;
+        }
+    } else {
+        for my $from (keys %renames) {
+            $newContents =~ s/\b$from(?!["\w])/$renames{$from}/g; # this " unconfuses Xcode syntax highlighting
+        }
     }
 
     if ($newContents ne $contents) {
diff --git a/WebKitTools/Scripts/modules/bugzilla.py b/WebKitTools/Scripts/modules/bugzilla.py
index fe81b48..be78544 100644
--- a/WebKitTools/Scripts/modules/bugzilla.py
+++ b/WebKitTools/Scripts/modules/bugzilla.py
@@ -43,7 +43,7 @@ from modules.committers import CommitterList
 
 # WebKit includes a built copy of BeautifulSoup in Scripts/modules
 # so this import should always succeed.
-from .BeautifulSoup import BeautifulSoup
+from .BeautifulSoup import BeautifulSoup, SoupStrainer
 
 try:
     from mechanize import Browser
@@ -95,10 +95,10 @@ def is_mac_os_x():
 def parse_bug_id(message):
     match = re.search("http\://webkit\.org/b/(?P<bug_id>\d+)", message)
     if match:
-        return match.group('bug_id')
+        return int(match.group('bug_id'))
     match = re.search(Bugzilla.bug_server_regex + "show_bug\.cgi\?id=(?P<bug_id>\d+)", message)
     if match:
-        return match.group('bug_id')
+        return int(match.group('bug_id'))
     return None
 
 # FIXME: This should not depend on git for config storage
@@ -163,17 +163,20 @@ class Bugzilla:
 
     def _parse_attachment_flag(self, element, flag_name, attachment, result_key):
         flag = element.find('flag', attrs={'name' : flag_name})
-        if flag and flag['status'] == '+':
-            attachment[result_key] = flag['setter']
+        if flag:
+            attachment[flag_name] = flag['status']
+            if flag['status'] == '+':
+                attachment[result_key] = flag['setter']
 
     def _parse_attachment_element(self, element, bug_id):
         attachment = {}
         attachment['bug_id'] = bug_id
         attachment['is_obsolete'] = (element.has_key('isobsolete') and element['isobsolete'] == "1")
         attachment['is_patch'] = (element.has_key('ispatch') and element['ispatch'] == "1")
-        attachment['id'] = str(element.find('attachid').string)
+        attachment['id'] = int(element.find('attachid').string)
         attachment['url'] = self.attachment_url_for_id(attachment['id'])
         attachment['name'] = unicode(element.find('desc').string)
+        attachment['attacher_email'] = str(element.find('attacher').string)
         attachment['type'] = str(element.find('type').string)
         self._parse_attachment_flag(element, 'review', attachment, 'reviewer_email')
         self._parse_attachment_flag(element, 'commit-queue', attachment, 'committer_email')
@@ -192,6 +195,36 @@ class Bugzilla:
             attachments.append(attachment)
         return attachments
 
+    def _parse_bug_id_from_attachment_page(self, page):
+        up_link = BeautifulSoup(page).find('link', rel='Up') # The "Up" relation happens to point to the bug.
+        if not up_link:
+            return None # This attachment does not exist (or you don't have permissions to view it).
+        match = re.search("show_bug.cgi\?id=(?P<bug_id>\d+)", up_link['href'])
+        return int(match.group('bug_id'))
+
+    def bug_id_for_attachment_id(self, attachment_id):
+        attachment_url = self.attachment_url_for_id(attachment_id, 'edit')
+        log("Fetching: %s" % attachment_url)
+        page = urllib2.urlopen(attachment_url)
+        return self._parse_bug_id_from_attachment_page(page)
+
+    # This should really return an Attachment object
+    # which can lazily fetch any missing data.
+    def fetch_attachment(self, attachment_id):
+        # We could grab all the attachment details off of the attachment edit page
+        # but we already have working code to do so off of the bugs page, so re-use that.
+        bug_id = self.bug_id_for_attachment_id(attachment_id)
+        if not bug_id:
+            return None
+        attachments = self.fetch_attachments_from_bug(bug_id)
+        for attachment in attachments:
+            # FIXME: Once we have a real Attachment class we shouldn't paper over this possible comparison failure
+            # and we should remove the int() == int() hacks and leave it just ==.
+            if int(attachment['id']) == int(attachment_id):
+                self._validate_committer_and_reviewer(attachment)
+                return attachment
+        return None # This should never be hit.
+
     def fetch_title_from_bug(self, bug_id):
         bug_url = self.bug_url_for_bug_id(bug_id, xml=True)
         page = urllib2.urlopen(bug_url)
@@ -209,6 +242,14 @@ class Bugzilla:
     def _view_source_link(self, local_path):
         return "http://trac.webkit.org/browser/trunk/%s" % local_path
 
+    def _flag_permission_rejection_message(self, setter_email, flag_name):
+        committer_list = "WebKitTools/Scripts/modules/committers.py"
+        contribution_guidlines_url = "http://webkit.org/coding/contributing.html"
+        rejection_message = "%s does not have %s permissions according to %s." % (setter_email, flag_name, self._view_source_link(committer_list))
+        rejection_message += "\n\n- If you have %s rights please correct the error in %s by adding yourself to the file (no review needed) and then set the %s flag again." % (flag_name, committer_list, flag_name)
+        rejection_message += "\n\n- If you do not have %s rights please read %s for instructions on how to use bugzilla flags." % (flag_name, contribution_guidlines_url)
+        return rejection_message
+
     def _validate_setter_email(self, patch, result_key, lookup_function, rejection_function, reject_invalid_patches):
         setter_email = patch.get(result_key + '_email')
         if not setter_email:
@@ -220,18 +261,30 @@ class Bugzilla:
             return patch[result_key]
 
         if reject_invalid_patches:
-            committer_list = "WebKitTools/Scripts/modules/committers.py"
-            failure_message = "%s does not have %s permissions according to %s." % (setter_email, result_key, self._view_source_link(committer_list))
-            rejection_function(patch['id'], failure_message)
+            rejection_function(patch['id'], self._flag_permission_rejection_message(setter_email, result_key))
         else:
-            log("Warning, attachment %s on bug %s has invalid %s (%s)", (patch['id'], patch['bug_id'], result_key, setter_email))
+            log("Warning, attachment %s on bug %s has invalid %s (%s)" % (patch['id'], patch['bug_id'], result_key, setter_email))
         return None
 
     def _validate_reviewer(self, patch, reject_invalid_patches):
-        return self._validate_setter_email(patch, 'reviewer', self.committers.reviewer_by_bugzilla_email, self.reject_patch_from_review_queue, reject_invalid_patches)
+        return self._validate_setter_email(patch, 'reviewer', self.committers.reviewer_by_email, self.reject_patch_from_review_queue, reject_invalid_patches)
 
     def _validate_committer(self, patch, reject_invalid_patches):
-        return self._validate_setter_email(patch, 'committer', self.committers.committer_by_bugzilla_email, self.reject_patch_from_commit_queue, reject_invalid_patches)
+        return self._validate_setter_email(patch, 'committer', self.committers.committer_by_email, self.reject_patch_from_commit_queue, reject_invalid_patches)
+
+    # FIXME: This is a hack until we have a real Attachment object.
+    # _validate_committer and _validate_reviewer fill in the 'reviewer' and 'committer'
+    # keys which other parts of the code expect to be filled in.
+    def _validate_committer_and_reviewer(self, patch):
+        self._validate_reviewer(patch, reject_invalid_patches=False)
+        self._validate_committer(patch, reject_invalid_patches=False)
+
+    def fetch_unreviewed_patches_from_bug(self, bug_id):
+        unreviewed_patches = []
+        for attachment in self.fetch_attachments_from_bug(bug_id):
+            if attachment.get('review') == '?' and not attachment['is_obsolete']:
+                unreviewed_patches.append(attachment)
+        return unreviewed_patches
 
     def fetch_reviewed_patches_from_bug(self, bug_id, reject_invalid_patches=False):
         reviewed_patches = []
@@ -247,20 +300,44 @@ class Bugzilla:
                 commit_queue_patches.append(attachment)
         return commit_queue_patches
 
-    def fetch_bug_ids_from_commit_queue(self):
-        commit_queue_url = self.bug_server_url + "buglist.cgi?query_format=advanced&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&field0-0-0=flagtypes.name&type0-0-0=equals&value0-0-0=commit-queue%2B"
-
-        page = urllib2.urlopen(commit_queue_url)
+    def _fetch_bug_ids_advanced_query(self, query):
+        page = urllib2.urlopen(query)
         soup = BeautifulSoup(page)
 
         bug_ids = []
         # Grab the cells in the first column (which happens to be the bug ids)
         for bug_link_cell in soup('td', "first-child"): # tds with the class "first-child"
             bug_link = bug_link_cell.find("a")
-            bug_ids.append(bug_link.string) # the contents happen to be the bug id
+            bug_ids.append(int(bug_link.string)) # the contents happen to be the bug id
 
         return bug_ids
 
+    def _parse_attachment_ids_request_query(self, page):
+        digits = re.compile("\d+")
+        attachment_href = re.compile("attachment.cgi\?id=\d+&action=review")
+        attachment_links = SoupStrainer("a", href=attachment_href)
+        return [int(digits.search(tag["href"]).group(0)) for tag in BeautifulSoup(page, parseOnlyThese=attachment_links)]
+
+    def _fetch_attachment_ids_request_query(self, query):
+        return self._parse_attachment_ids_request_query(urllib2.urlopen(query))
+
+    def fetch_bug_ids_from_commit_queue(self):
+        commit_queue_url = self.bug_server_url + "buglist.cgi?query_format=advanced&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&field0-0-0=flagtypes.name&type0-0-0=equals&value0-0-0=commit-queue%2B"
+        return self._fetch_bug_ids_advanced_query(commit_queue_url)
+
+    # List of all r+'d bugs.
+    def fetch_bug_ids_from_needs_commit_list(self):
+        needs_commit_query_url = self.bug_server_url + "buglist.cgi?query_format=advanced&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&field0-0-0=flagtypes.name&type0-0-0=equals&value0-0-0=review%2B"
+        return self._fetch_bug_ids_advanced_query(needs_commit_query_url)
+
+    def fetch_bug_ids_from_review_queue(self):
+        review_queue_url = self.bug_server_url + "buglist.cgi?query_format=advanced&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&field0-0-0=flagtypes.name&type0-0-0=equals&value0-0-0=review?"
+        return self._fetch_bug_ids_advanced_query(review_queue_url)
+
+    def fetch_attachment_ids_from_review_queue(self):
+        review_queue_url = self.bug_server_url + "request.cgi?action=queue&type=review&group=type"
+        return self._fetch_attachment_ids_request_query(review_queue_url)
+
     def fetch_patches_from_commit_queue(self, reject_invalid_patches=False):
         patches_to_land = []
         for bug_id in self.fetch_bug_ids_from_commit_queue():
@@ -268,6 +345,22 @@ class Bugzilla:
             patches_to_land += patches
         return patches_to_land
 
+    def fetch_patches_from_pending_commit_list(self):
+        patches_needing_commit = []
+        for bug_id in self.fetch_bug_ids_from_needs_commit_list():
+            patches = self.fetch_reviewed_patches_from_bug(bug_id)
+            patches_needing_commit += patches
+        return patches_needing_commit
+
+    def fetch_patches_from_review_queue(self, limit=None):
+        patches_to_review = []
+        for bug_id in self.fetch_bug_ids_from_review_queue():
+            if limit and len(patches_to_review) >= limit:
+                break
+            patches = self.fetch_unreviewed_patches_from_bug(bug_id)
+            patches_to_review += patches
+        return patches_to_review
+
     def authenticate(self):
         if self.authenticated:
             return
@@ -312,7 +405,7 @@ class Bugzilla:
         if self.dryrun:
             log(comment_text)
             return
-        
+
         self.browser.open("%sattachment.cgi?action=enter&bugid=%s" % (self.bug_server_url, bug_id))
         self.browser.select_form(name="entryform")
         self._fill_attachment_form(description, patch_file_object, mark_for_review=mark_for_review, mark_for_commit_queue=mark_for_commit_queue, bug_id=bug_id)
@@ -442,8 +535,20 @@ class Bugzilla:
             # Bugzilla has two textareas named 'comment', one is somehow hidden.  We want the first.
             self.browser.set_value(comment_text, name='comment', nr=0)
         self.browser.submit()
-    
-    def post_comment_to_bug(self, bug_id, comment_text):
+
+    def add_cc_to_bug(self, bug_id, email_address):
+        self.authenticate()
+
+        log("Adding %s to the CC list for bug %s" % (email_address, bug_id))
+        if self.dryrun:
+            return
+
+        self.browser.open(self.bug_url_for_bug_id(bug_id))
+        self.browser.select_form(name="changeform")
+        self.browser["newcc"] = email_address
+        self.browser.submit()
+
+    def post_comment_to_bug(self, bug_id, comment_text, cc=None):
         self.authenticate()
 
         log("Adding comment to bug %s" % bug_id)
@@ -453,7 +558,9 @@ class Bugzilla:
 
         self.browser.open(self.bug_url_for_bug_id(bug_id))
         self.browser.select_form(name="changeform")
-        self.browser['comment'] = comment_text
+        self.browser["comment"] = comment_text
+        if cc:
+            self.browser["newcc"] = cc
         self.browser.submit()
 
     def close_bug_as_fixed(self, bug_id, comment_text=None):
diff --git a/WebKitTools/Scripts/modules/bugzilla_unittest.py b/WebKitTools/Scripts/modules/bugzilla_unittest.py
index f08031e..fb7f8c4 100644
--- a/WebKitTools/Scripts/modules/bugzilla_unittest.py
+++ b/WebKitTools/Scripts/modules/bugzilla_unittest.py
@@ -29,7 +29,7 @@
 import unittest
 
 from modules.committers import CommitterList, Reviewer, Committer
-from modules.bugzilla import Bugzilla
+from modules.bugzilla import Bugzilla, parse_bug_id
 
 from modules.BeautifulSoup import BeautifulSoup
 
@@ -61,17 +61,34 @@ class BugzillaTest(unittest.TestCase):
         </attachment>
 '''
     _expected_example_attachment_parsing = {
-        'bug_id' : "100",
+        'bug_id' : 100,
         'is_obsolete' : True,
         'is_patch' : True,
-        'id' : "33721",
+        'id' : 33721,
         'url' : "https://bugs.webkit.org/attachment.cgi?id=33721",
         'name' : "Fixed whitespace issue",
         'type' : "text/plain",
+        'review' : '+',
         'reviewer_email' : 'one@test.com',
-        'committer_email' : 'two@test.com'
+        'commit-queue' : '+',
+        'committer_email' : 'two@test.com',
+        'attacher_email' : 'christian.plesner.hansen@gmail.com',
     }
 
+    def test_parse_bug_id(self):
+        # FIXME: These would be all better as doctests
+        bugs = Bugzilla()
+        self.assertEquals(12345, parse_bug_id("http://webkit.org/b/12345"))
+        self.assertEquals(12345, parse_bug_id("http://bugs.webkit.org/show_bug.cgi?id=12345"))
+        self.assertEquals(12345, parse_bug_id(bugs.short_bug_url_for_bug_id(12345)))
+        self.assertEquals(12345, parse_bug_id(bugs.bug_url_for_bug_id(12345)))
+        self.assertEquals(12345, parse_bug_id(bugs.bug_url_for_bug_id(12345, xml=True)))
+
+        # Our bug parser is super-fragile, but at least we're testing it.
+        self.assertEquals(None, parse_bug_id("http://www.webkit.org/b/12345"))
+        self.assertEquals(None, parse_bug_id("http://bugs.webkit.org/show_bug.cgi?ctype=xml&id=12345"))
+
+
     def test_attachment_parsing(self):
         bugzilla = Bugzilla()
 
@@ -86,5 +103,71 @@ class BugzillaTest(unittest.TestCase):
         for key, expected_value in self._expected_example_attachment_parsing.items():
             self.assertEquals(attachment[key], expected_value, ("Failure for key: %s: Actual='%s' Expected='%s'" % (key, attachment[key], expected_value)))
 
+    _sample_attachment_detail_page = """
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+                      "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+  <head>
+    <title>
+  Attachment 41073 Details for Bug 27314</title>
+<link rel="Top" href="https://bugs.webkit.org/">
+    <link rel="Up" href="show_bug.cgi?id=27314">
+"""
+
+    def test_attachment_detail_bug_parsing(self):
+        bugzilla = Bugzilla()
+        self.assertEquals(27314, bugzilla._parse_bug_id_from_attachment_page(self._sample_attachment_detail_page))
+
+    _sample_request_page = """
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+                      "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+  <head>
+    <title>Request Queue</title>
+  </head>
+<body>
+
+<h3>Flag: review</h3>
+  <table class="requests" cellspacing="0" cellpadding="4" border="1">
+    <tr>
+        <th>Requester</th>
+        <th>Requestee</th>
+        <th>Bug</th>
+        <th>Attachment</th>
+        <th>Created</th>
+    </tr>
+    <tr>
+        <td>Shinichiro Hamaji &lt;hamaji&#64;chromium.org&gt;</td>
+        <td></td>
+        <td><a href="show_bug.cgi?id=30015">30015: text-transform:capitalize is failing in CSS2.1 test suite</a></td>
+        <td><a href="attachment.cgi?id=40511&amp;action=review">
+40511: Patch v0</a></td>
+        <td>2009-10-02 04:58 PST</td>
+    </tr>
+    <tr>
+        <td>Zan Dobersek &lt;zandobersek&#64;gmail.com&gt;</td>
+        <td></td>
+        <td><a href="show_bug.cgi?id=26304">26304: [GTK] Add controls for playing html5 video.</a></td>
+        <td><a href="attachment.cgi?id=40722&amp;action=review">
+40722: Media controls, the simple approach</a></td>
+        <td>2009-10-06 09:13 PST</td>
+    </tr>
+    <tr>
+        <td>Zan Dobersek &lt;zandobersek&#64;gmail.com&gt;</td>
+        <td></td>
+        <td><a href="show_bug.cgi?id=26304">26304: [GTK] Add controls for playing html5 video.</a></td>
+        <td><a href="attachment.cgi?id=40723&amp;action=review">
+40723: Adjust the media slider thumb size</a></td>
+        <td>2009-10-06 09:15 PST</td>
+    </tr>
+  </table>
+</body>
+</html>
+"""
+
+    def test_request_page_parsing(self):
+        bugzilla = Bugzilla()
+        self.assertEquals([40511, 40722, 40723], bugzilla._parse_attachment_ids_request_query(self._sample_request_page))
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/Scripts/modules/buildbot.py b/WebKitTools/Scripts/modules/buildbot.py
index e948d8c..548cad8 100644
--- a/WebKitTools/Scripts/modules/buildbot.py
+++ b/WebKitTools/Scripts/modules/buildbot.py
@@ -39,7 +39,8 @@ from modules.logging import log
 from .BeautifulSoup import BeautifulSoup
 
 class BuildBot:
-    def __init__(self, host="build.webkit.org"):
+    default_host = "build.webkit.org"
+    def __init__(self, host=default_host):
         self.buildbot_host = host
         self.buildbot_server_url = "http://%s/" % self.buildbot_host
         
diff --git a/WebKitTools/Scripts/modules/buildsteps.py b/WebKitTools/Scripts/modules/buildsteps.py
new file mode 100644
index 0000000..425b912
--- /dev/null
+++ b/WebKitTools/Scripts/modules/buildsteps.py
@@ -0,0 +1,254 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+
+from optparse import make_option
+
+from modules.comments import bug_comment_from_commit_text
+from modules.logging import log, error
+from modules.webkitport import WebKitPort
+
+
+class CommandOptions(object):
+    force_clean = make_option("--force-clean", action="store_true", dest="force_clean", default=False, help="Clean working directory before applying patches (removes local changes and commits)")
+    clean = make_option("--no-clean", action="store_false", dest="clean", default=True, help="Don't check if the working directory is clean before applying patches")
+    check_builders = make_option("--ignore-builders", action="store_false", dest="check_builders", default=True, help="Don't check to see if the build.webkit.org builders are green before landing.")
+    quiet = make_option("--quiet", action="store_true", dest="quiet", default=False, help="Produce less console output.")
+    non_interactive = make_option("--non-interactive", action="store_true", dest="non_interactive", default=False, help="Never prompt the user, fail as fast as possible.")
+    parent_command = make_option("--parent-command", action="store", dest="parent_command", default=None, help="(Internal) The command that spawned this instance.")
+    update = make_option("--no-update", action="store_false", dest="update", default=True, help="Don't update the working directory.")
+    build = make_option("--no-build", action="store_false", dest="build", default=True, help="Commit without building first, implies --no-test.")
+    test = make_option("--no-test", action="store_false", dest="test", default=True, help="Commit without running run-webkit-tests.")
+    close_bug = make_option("--no-close", action="store_false", dest="close_bug", default=True, help="Leave bug open after landing.")
+    port = make_option("--port", action="store", dest="port", default=None, help="Specify a port (e.g., mac, qt, gtk, ...).")
+
+
+class AbstractStep(object):
+    def __init__(self, tool, options, patch=None):
+        self._tool = tool
+        self._options = options
+        self._patch = patch
+        self._port = None
+
+    def _run_script(self, script_name, quiet=False, port=WebKitPort):
+        log("Running %s" % script_name)
+        self._tool.executive.run_and_throw_if_fail(port.script_path(script_name), quiet)
+
+    # FIXME: The port should live on the tool.
+    def port(self):
+        if self._port:
+            return self._port
+        self._port = WebKitPort.port(self._options.port)
+        return self._port
+
+    @classmethod
+    def options(cls):
+        return []
+
+    def run(self, tool):
+        raise NotImplementedError, "subclasses must implement"
+
+
+class PrepareChangelogStep(AbstractStep):
+    def run(self):
+        self._run_script("prepare-ChangeLog")
+
+
+class CleanWorkingDirectoryStep(AbstractStep):
+    def __init__(self, tool, options, patch=None, allow_local_commits=False):
+        AbstractStep.__init__(self, tool, options, patch)
+        self._allow_local_commits = allow_local_commits
+
+    @classmethod
+    def options(cls):
+        return [
+            CommandOptions.force_clean,
+            CommandOptions.clean,
+        ]
+
+    def run(self):
+        os.chdir(self._tool.scm().checkout_root)
+        if not self._allow_local_commits:
+            self._tool.scm().ensure_no_local_commits(self._options.force_clean)
+        if self._options.clean:
+            self._tool.scm().ensure_clean_working_directory(force_clean=self._options.force_clean)
+
+
+class UpdateStep(AbstractStep):
+    @classmethod
+    def options(cls):
+        return [
+            CommandOptions.update,
+            CommandOptions.port,
+        ]
+
+    def run(self):
+        if not self._options.update:
+            return
+        log("Updating working directory")
+        self._tool.executive.run_and_throw_if_fail(self.port().update_webkit_command())
+
+
+class ApplyPatchStep(AbstractStep):
+    @classmethod
+    def options(cls):
+        return [
+            CommandOptions.non_interactive,
+        ]
+
+    def run(self):
+        log("Processing patch %s from bug %s." % (self._patch["id"], self._patch["bug_id"]))
+        self._tool.scm().apply_patch(self._patch, force=self._options.non_interactive)
+
+
+class EnsureBuildersAreGreenStep(AbstractStep):
+    @classmethod
+    def options(cls):
+        return [
+            CommandOptions.check_builders,
+        ]
+
+    def run(self):
+        if not self._options.check_builders:
+            return
+        red_builders_names = self._tool.buildbot.red_core_builders_names()
+        if not red_builders_names:
+            return
+        red_builders_names = map(lambda name: "\"%s\"" % name, red_builders_names) # Add quotes around the names.
+        error("Builders [%s] are red, please do not commit.\nSee http://%s.\nPass --ignore-builders to bypass this check." % (", ".join(red_builders_names), self._tool.buildbot.buildbot_host))
+
+
+class BuildStep(AbstractStep):
+    @classmethod
+    def options(cls):
+        return [
+            CommandOptions.build,
+            CommandOptions.quiet,
+        ]
+
+    def run(self):
+        if not self._options.build:
+            return
+        log("Building WebKit")
+        self._tool.executive.run_and_throw_if_fail(self.port().build_webkit_command(), self._options.quiet)
+
+
+class CheckStyleStep(AbstractStep):
+    def run(self):
+        self._run_script("check-webkit-style")
+
+
+class RunTestsStep(AbstractStep):
+    @classmethod
+    def options(cls):
+        return [
+            CommandOptions.build,
+            CommandOptions.test,
+            CommandOptions.non_interactive,
+            CommandOptions.quiet,
+            CommandOptions.port,
+        ]
+
+    def run(self):
+        if not self._options.build:
+            return
+        if not self._options.test:
+            return
+        args = self.port().run_webkit_tests_command()
+        if self._options.non_interactive:
+            args.append("--no-launch-safari")
+            args.append("--exit-after-n-failures=1")
+        if self._options.quiet:
+            args.append("--quiet")
+        self._tool.executive.run_and_throw_if_fail(args)
+
+
+class CommitStep(AbstractStep):
+    def run(self):
+        commit_message = self._tool.scm().commit_message_for_this_commit()
+        return self._tool.scm().commit_with_message(commit_message.message())
+
+
+class ClosePatchStep(AbstractStep):
+    def run(self, commit_log):
+        comment_text = bug_comment_from_commit_text(self._tool.scm(), commit_log)
+        self._tool.bugs.clear_attachment_flags(self._patch["id"], comment_text)
+
+
+class CloseBugStep(AbstractStep):
+    @classmethod
+    def options(cls):
+        return [
+            CommandOptions.close_bug,
+        ]
+
+    def run(self):
+        if not self._options.close_bug:
+            return
+        # Check to make sure there are no r? or r+ patches on the bug before closing.
+        # Assume that r- patches are just previous patches someone forgot to obsolete.
+        patches = self._tool.bugs.fetch_patches_from_bug(self._patch["bug_id"])
+        for patch in patches:
+            review_flag = patch.get("review")
+            if review_flag == "?" or review_flag == "+":
+                log("Not closing bug %s as attachment %s has review=%s.  Assuming there are more patches to land from this bug." % (patch["bug_id"], patch["id"], review_flag))
+                return
+        self._tool.bugs.close_bug_as_fixed(self._patch["bug_id"], "All reviewed patches have been landed.  Closing bug.")
+
+
+# FIXME: This class is a dinosaur and should be extinct soon.
+class BuildSteps:
+    # FIXME: The options should really live on each "Step" object.
+    @staticmethod
+    def cleaning_options():
+        return [
+            CommandOptions.force_clean,
+            CommandOptions.clean,
+        ]
+
+    # FIXME: These distinctions are bogus.  We need a better model for handling options.
+    @staticmethod
+    def build_options():
+        return [
+            CommandOptions.check_builders,
+            CommandOptions.quiet,
+            CommandOptions.non_interactive,
+            CommandOptions.parent_command,
+            CommandOptions.port,
+        ]
+
+    @staticmethod
+    def land_options():
+        return [
+            CommandOptions.update,
+            CommandOptions.build,
+            CommandOptions.test,
+            CommandOptions.close_bug,
+        ]
+
diff --git a/WebKitTools/Scripts/modules/commands/__init__.py b/WebKitTools/Scripts/modules/commands/__init__.py
new file mode 100644
index 0000000..ef65bee
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/__init__.py
@@ -0,0 +1 @@
+# Required for Python to search this directory for module files
diff --git a/WebKitTools/Scripts/modules/commands/commandtest.py b/WebKitTools/Scripts/modules/commands/commandtest.py
new file mode 100644
index 0000000..618a517
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/commandtest.py
@@ -0,0 +1,42 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from modules.mock import Mock
+from modules.mock_bugzillatool import MockBugzillaTool
+from modules.outputcapture import OutputCapture
+
+class CommandsTest(unittest.TestCase):
+    def assert_execute_outputs(self, command, args, expected_stdout="", expected_stderr="", options=Mock(), tool=MockBugzillaTool()):
+        capture = OutputCapture()
+        capture.capture_output()
+        command.execute(options, args, tool)
+        (stdout_string, stderr_string) = capture.restore_output()
+        self.assertEqual(stdout_string, expected_stdout)
+        self.assertEqual(expected_stderr, expected_stderr)
diff --git a/WebKitTools/Scripts/modules/commands/download.py b/WebKitTools/Scripts/modules/commands/download.py
new file mode 100644
index 0000000..2acd69f
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/download.py
@@ -0,0 +1,370 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+
+from optparse import make_option
+
+from modules.bugzilla import parse_bug_id
+from modules.buildsteps import CommandOptions, BuildSteps, EnsureBuildersAreGreenStep, CleanWorkingDirectoryStep, UpdateStep, ApplyPatchStep, BuildStep, CheckStyleStep, PrepareChangelogStep
+from modules.changelogs import ChangeLog
+from modules.comments import bug_comment_from_commit_text
+from modules.executive import ScriptError
+from modules.grammar import pluralize
+from modules.landingsequence import LandingSequence
+from modules.logging import error, log
+from modules.multicommandtool import Command
+from modules.stepsequence import StepSequence
+
+
+class Build(Command):
+    name = "build"
+    show_in_main_help = False
+    def __init__(self):
+        self._sequence = StepSequence([
+            CleanWorkingDirectoryStep,
+            UpdateStep,
+            BuildStep
+        ])
+        Command.__init__(self, "Update working copy and build", "", self._sequence.options())
+
+    def execute(self, options, args, tool):
+        self._sequence.run_and_handle_errors(tool, options)
+
+
+class ApplyAttachment(Command):
+    name = "apply-attachment"
+    show_in_main_help = True
+    def __init__(self):
+        options = WebKitApplyingScripts.apply_options()
+        options += BuildSteps.cleaning_options()
+        Command.__init__(self, "Apply an attachment to the local working directory", "ATTACHMENT_ID", options=options)
+
+    def execute(self, options, args, tool):
+        WebKitApplyingScripts.setup_for_patch_apply(tool, options)
+        attachment_id = args[0]
+        attachment = tool.bugs.fetch_attachment(attachment_id)
+        WebKitApplyingScripts.apply_patches_with_options(tool.scm(), [attachment], options)
+
+
+class ApplyPatches(Command):
+    name = "apply-patches"
+    show_in_main_help = True
+    def __init__(self):
+        options = WebKitApplyingScripts.apply_options()
+        options += BuildSteps.cleaning_options()
+        Command.__init__(self, "Apply reviewed patches from provided bugs to the local working directory", "BUGID", options=options)
+
+    def execute(self, options, args, tool):
+        WebKitApplyingScripts.setup_for_patch_apply(tool, options)
+        bug_id = args[0]
+        patches = tool.bugs.fetch_reviewed_patches_from_bug(bug_id)
+        WebKitApplyingScripts.apply_patches_with_options(tool.scm(), patches, options)
+
+
+class WebKitApplyingScripts:
+    @staticmethod
+    def apply_options():
+        return [
+            make_option("--no-update", action="store_false", dest="update", default=True, help="Don't update the working directory before applying patches"),
+            make_option("--local-commit", action="store_true", dest="local_commit", default=False, help="Make a local commit for each applied patch"),
+            CommandOptions.port,
+        ]
+
+    @staticmethod
+    def setup_for_patch_apply(tool, options):
+        clean_step = CleanWorkingDirectoryStep(tool, options, allow_local_commits=True)
+        clean_step.run()
+        update_step = UpdateStep(tool, options)
+        update_step.run()
+
+    @staticmethod
+    def apply_patches_with_options(scm, patches, options):
+        if options.local_commit and not scm.supports_local_commits():
+            error("--local-commit passed, but %s does not support local commits" % scm.display_name())
+
+        for patch in patches:
+            log("Applying attachment %s from bug %s" % (patch["id"], patch["bug_id"]))
+            scm.apply_patch(patch)
+            if options.local_commit:
+                commit_message = scm.commit_message_for_this_commit()
+                scm.commit_locally_with_message(commit_message.message() or patch["name"])
+
+
+class LandDiffSequence(LandingSequence):
+    def run(self):
+        self.check_builders()
+        self.build()
+        self.test()
+        commit_log = self.commit()
+        self.close_bug(commit_log)
+
+    def close_bug(self, commit_log):
+        comment_test = bug_comment_from_commit_text(self._tool.scm(), commit_log)
+        bug_id = self._patch["bug_id"]
+        if bug_id:
+            log("Updating bug %s" % bug_id)
+            if self._options.close_bug:
+                self._tool.bugs.close_bug_as_fixed(bug_id, comment_test)
+            else:
+                # FIXME: We should a smart way to figure out if the patch is attached
+                # to the bug, and if so obsolete it.
+                self._tool.bugs.post_comment_to_bug(bug_id, comment_test)
+        else:
+            log(comment_test)
+            log("No bug id provided.")
+
+
+class LandDiff(Command):
+    name = "land-diff"
+    show_in_main_help = True
+    def __init__(self):
+        options = [
+            make_option("-r", "--reviewer", action="store", type="string", dest="reviewer", help="Update ChangeLogs to say Reviewed by REVIEWER."),
+        ]
+        options += BuildSteps.build_options()
+        options += BuildSteps.land_options()
+        Command.__init__(self, "Land the current working directory diff and updates the associated bug if any", "[BUGID]", options=options)
+
+    def guess_reviewer_from_bug(self, bugs, bug_id):
+        patches = bugs.fetch_reviewed_patches_from_bug(bug_id)
+        if len(patches) != 1:
+            log("%s on bug %s, cannot infer reviewer." % (pluralize("reviewed patch", len(patches)), bug_id))
+            return None
+        patch = patches[0]
+        reviewer = patch["reviewer"]
+        log("Guessing \"%s\" as reviewer from attachment %s on bug %s." % (reviewer, patch["id"], bug_id))
+        return reviewer
+
+    def update_changelogs_with_reviewer(self, reviewer, bug_id, tool):
+        if not reviewer:
+            if not bug_id:
+                log("No bug id provided and --reviewer= not provided.  Not updating ChangeLogs with reviewer.")
+                return
+            reviewer = self.guess_reviewer_from_bug(tool.bugs, bug_id)
+
+        if not reviewer:
+            log("Failed to guess reviewer from bug %s and --reviewer= not provided.  Not updating ChangeLogs with reviewer." % bug_id)
+            return
+
+        for changelog_path in tool.scm().modified_changelogs():
+            ChangeLog(changelog_path).set_reviewer(reviewer)
+
+    def execute(self, options, args, tool):
+        bug_id = (args and args[0]) or parse_bug_id(tool.scm().create_patch())
+
+        EnsureBuildersAreGreenStep(tool, options).run()
+
+        os.chdir(tool.scm().checkout_root)
+        self.update_changelogs_with_reviewer(options.reviewer, bug_id, tool)
+
+        fake_patch = {
+            "id": None,
+            "bug_id": bug_id
+        }
+
+        sequence = LandDiffSequence(fake_patch, options, tool)
+        sequence.run()
+
+
+class AbstractPatchProcessingCommand(Command):
+    def __init__(self, help_text, args_description, options):
+        Command.__init__(self, help_text, args_description, options=options)
+
+    def _fetch_list_of_patches_to_process(self, options, args, tool):
+        raise NotImplementedError, "subclasses must implement"
+
+    def _prepare_to_process(self, options, args, tool):
+        raise NotImplementedError, "subclasses must implement"
+
+    @staticmethod
+    def _collect_patches_by_bug(patches):
+        bugs_to_patches = {}
+        for patch in patches:
+            bug_id = patch["bug_id"]
+            bugs_to_patches[bug_id] = bugs_to_patches.get(bug_id, []) + [patch]
+        return bugs_to_patches
+
+    def execute(self, options, args, tool):
+        self._prepare_to_process(options, args, tool)
+        patches = self._fetch_list_of_patches_to_process(options, args, tool)
+
+        # It's nice to print out total statistics.
+        bugs_to_patches = self._collect_patches_by_bug(patches)
+        log("Processing %s from %s." % (pluralize("patch", len(patches)), pluralize("bug", len(bugs_to_patches))))
+
+        for patch in patches:
+            self._process_patch(patch, options, args, tool)
+
+
+class CheckStyle(AbstractPatchProcessingCommand):
+    name = "check-style"
+    show_in_main_help = False
+    def __init__(self):
+        self._sequence = StepSequence([
+            CleanWorkingDirectoryStep,
+            UpdateStep,
+            ApplyPatchStep,
+            CheckStyleStep,
+        ])
+        AbstractPatchProcessingCommand.__init__(self, "Run check-webkit-style on the specified attachments", "ATTACHMENT_ID [ATTACHMENT_IDS]", self._sequence.options())
+
+    def _fetch_list_of_patches_to_process(self, options, args, tool):
+        return map(lambda patch_id: tool.bugs.fetch_attachment(patch_id), args)
+
+    def _prepare_to_process(self, options, args, tool):
+        pass
+
+    def _process_patch(self, patch, options, args, tool):
+        self._sequence.run_and_handle_errors(tool, options, patch)
+
+
+class BuildAttachment(AbstractPatchProcessingCommand):
+    name = "build-attachment"
+    show_in_main_help = False
+    def __init__(self):
+        self._sequence = StepSequence([
+            CleanWorkingDirectoryStep,
+            UpdateStep,
+            ApplyPatchStep,
+            BuildStep,
+        ])
+        AbstractPatchProcessingCommand.__init__(self, "Apply and build patches from bugzilla", "ATTACHMENT_ID [ATTACHMENT_IDS]", self._sequence.options())
+
+    def _fetch_list_of_patches_to_process(self, options, args, tool):
+        return map(lambda patch_id: tool.bugs.fetch_attachment(patch_id), args)
+
+    def _prepare_to_process(self, options, args, tool):
+        pass
+
+    def _process_patch(self, patch, options, args, tool):
+        self._sequence.run_and_handle_errors(tool, options, patch)
+
+
+class AbstractPatchLandingCommand(AbstractPatchProcessingCommand):
+    def __init__(self, help_text, args_description):
+        options = BuildSteps.cleaning_options()
+        options += BuildSteps.build_options()
+        options += BuildSteps.land_options()
+        AbstractPatchProcessingCommand.__init__(self, help_text, args_description, options)
+
+    def _prepare_to_process(self, options, args, tool):
+        # Check the tree status first so we can fail early.
+        EnsureBuildersAreGreenStep(tool, options).run()
+
+    def _process_patch(self, patch, options, args, tool):
+        sequence = LandingSequence(patch, options, tool)
+        sequence.run_and_handle_errors()
+
+
+class LandAttachment(AbstractPatchLandingCommand):
+    name = "land-attachment"
+    show_in_main_help = True
+    def __init__(self):
+        AbstractPatchLandingCommand.__init__(self, "Land patches from bugzilla, optionally building and testing them first", "ATTACHMENT_ID [ATTACHMENT_IDS]")
+
+    def _fetch_list_of_patches_to_process(self, options, args, tool):
+        return map(lambda patch_id: tool.bugs.fetch_attachment(patch_id), args)
+
+
+class LandPatches(AbstractPatchLandingCommand):
+    name = "land-patches"
+    show_in_main_help = True
+    def __init__(self):
+        AbstractPatchLandingCommand.__init__(self, "Land all patches on the given bugs, optionally building and testing them first", "BUGID [BUGIDS]")
+
+    def _fetch_list_of_patches_to_process(self, options, args, tool):
+        all_patches = []
+        for bug_id in args:
+            patches = tool.bugs.fetch_reviewed_patches_from_bug(bug_id)
+            log("%s found on bug %s." % (pluralize("reviewed patch", len(patches)), bug_id))
+            all_patches += patches
+        return all_patches
+
+
+# FIXME: Requires unit test.
+class Rollout(Command):
+    name = "rollout"
+    show_in_main_help = True
+    def __init__(self):
+        options = BuildSteps.cleaning_options()
+        options += BuildSteps.build_options()
+        options += BuildSteps.land_options()
+        options.append(make_option("--complete-rollout", action="store_true", dest="complete_rollout", help="Commit the revert and re-open the original bug."))
+        Command.__init__(self, "Revert the given revision in the working copy and optionally commit the revert and re-open the original bug", "REVISION [BUGID]", options=options)
+
+    @staticmethod
+    def _create_changelogs_for_revert(tool, revision):
+        # First, discard the ChangeLog changes from the rollout.
+        changelog_paths = tool.scm().modified_changelogs()
+        tool.scm().revert_files(changelog_paths)
+
+        # Second, make new ChangeLog entries for this rollout.
+        # This could move to prepare-ChangeLog by adding a --revert= option.
+        PrepareChangelogStep(tool, None).run()
+        for changelog_path in changelog_paths:
+            ChangeLog(changelog_path).update_for_revert(revision)
+
+    @staticmethod
+    def _parse_bug_id_from_revision_diff(tool, revision):
+        original_diff = tool.scm().diff_for_revision(revision)
+        return parse_bug_id(original_diff)
+
+    @staticmethod
+    def _reopen_bug_after_rollout(tool, bug_id, comment_text):
+        if bug_id:
+            tool.bugs.reopen_bug(bug_id, comment_text)
+        else:
+            log(comment_text)
+            log("No bugs were updated or re-opened to reflect this rollout.")
+
+    def execute(self, options, args, tool):
+        revision = args[0]
+        bug_id = self._parse_bug_id_from_revision_diff(tool, revision)
+        if options.complete_rollout:
+            if bug_id:
+                log("Will re-open bug %s after rollout." % bug_id)
+            else:
+                log("Failed to parse bug number from diff.  No bugs will be updated/reopened after the rollout.")
+
+        CleanWorkingDirectoryStep(tool, options).run()
+        UpdateStep(tool, options).run()
+        tool.scm().apply_reverse_diff(revision)
+        self._create_changelogs_for_revert(tool, revision)
+
+        # FIXME: Fully automated rollout is not 100% idiot-proof yet, so for now just log with instructions on how to complete the rollout.
+        # Once we trust rollout we will remove this option.
+        if not options.complete_rollout:
+            log("\nNOTE: Rollout support is experimental.\nPlease verify the rollout diff and use \"bugzilla-tool land-diff %s\" to commit the rollout." % bug_id)
+        else:
+            # FIXME: This function does not exist!!
+            # comment_text = WebKitLandingScripts.build_and_commit(tool.scm(), options)
+            raise ScriptError("OOPS! This option is not implemented (yet).")
+            self._reopen_bug_after_rollout(tool, bug_id, comment_text)
diff --git a/WebKitTools/Scripts/modules/commands/download_unittest.py b/WebKitTools/Scripts/modules/commands/download_unittest.py
new file mode 100644
index 0000000..a1ed41a
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/download_unittest.py
@@ -0,0 +1,77 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from modules.commands.commandtest import CommandsTest
+from modules.commands.download import *
+from modules.mock import Mock
+
+class DownloadCommandsTest(CommandsTest):
+    def _default_options(self):
+        options = Mock()
+        options.force_clean = False
+        options.clean = True
+        options.check_builders = True
+        options.quiet = False
+        options.non_interactive = False
+        options.update = True
+        options.build = True
+        options.test = True
+        options.close_bug = True
+        return options
+
+    def test_build(self):
+        self.assert_execute_outputs(Build(), [], options=self._default_options())
+
+    def test_apply_attachment(self):
+        options = self._default_options()
+        options.update = True
+        options.local_commit = True
+        self.assert_execute_outputs(ApplyAttachment(), [197], options=options)
+
+    def test_apply_patches(self):
+        options = self._default_options()
+        options.update = True
+        options.local_commit = True
+        self.assert_execute_outputs(ApplyPatches(), [42], options=options)
+
+    def test_land_diff(self):
+        self.assert_execute_outputs(LandDiff(), [42], options=self._default_options())
+
+    def test_check_style(self):
+        self.assert_execute_outputs(CheckStyle(), [197], options=self._default_options())
+
+    def test_build_attachment(self):
+        self.assert_execute_outputs(BuildAttachment(), [197], options=self._default_options())
+
+    def test_land_attachment(self):
+        self.assert_execute_outputs(LandAttachment(), [197], options=self._default_options())
+
+    def test_land_patches(self):
+        self.assert_execute_outputs(LandPatches(), [42], options=self._default_options())
diff --git a/WebKitTools/Scripts/modules/commands/early_warning_system.py b/WebKitTools/Scripts/modules/commands/early_warning_system.py
new file mode 100644
index 0000000..e8ef408
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/early_warning_system.py
@@ -0,0 +1,66 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from modules.commands.queues import AbstractReviewQueue
+from modules.executive import ScriptError
+from modules.webkitport import WebKitPort
+
+class AbstractEarlyWarningSystem(AbstractReviewQueue):
+    def __init__(self):
+        AbstractReviewQueue.__init__(self)
+        self.port = WebKitPort.port(self.port_name)
+
+    def should_proceed_with_work_item(self, patch):
+        try:
+            self.run_bugzilla_tool(["build", self.port.flag(), "--force-clean", "--quiet"])
+        except ScriptError, e:
+            return (False, "Unable to perform a build.", None)
+        return (True, "Building patch %s on bug %s." % (patch["id"], patch["bug_id"]), patch)
+
+    def process_work_item(self, patch):
+        self.run_bugzilla_tool([
+            "build-attachment",
+            self.port.flag(),
+            "--force-clean",
+            "--quiet",
+            "--non-interactive",
+            "--parent-command=%s" % self.name,
+            "--no-update",
+            patch["id"]])
+        self._patches.did_pass(patch)
+
+
+class QtEWS(AbstractEarlyWarningSystem):
+    name = "qt-ews"
+    port_name = "qt"
+
+
+class ChromiumEWS(AbstractEarlyWarningSystem):
+    name = "chromium-ews"
+    port_name = "chromium"
diff --git a/WebKitTools/Scripts/modules/commands/queries.py b/WebKitTools/Scripts/modules/commands/queries.py
new file mode 100644
index 0000000..98310e3
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/queries.py
@@ -0,0 +1,135 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+from optparse import make_option
+
+from modules.buildbot import BuildBot
+from modules.committers import CommitterList
+from modules.logging import log
+from modules.multicommandtool import Command
+
+
+class BugsToCommit(Command):
+    name = "bugs-to-commit"
+    show_in_main_help = False
+    def __init__(self):
+        Command.__init__(self, "List bugs in the commit-queue")
+
+    def execute(self, options, args, tool):
+        bug_ids = tool.bugs.fetch_bug_ids_from_commit_queue()
+        for bug_id in bug_ids:
+            print "%s" % bug_id
+
+
+class PatchesToCommit(Command):
+    name = "patches-to-commit"
+    show_in_main_help = False
+    def __init__(self):
+        Command.__init__(self, "List patches in the commit-queue")
+
+    def execute(self, options, args, tool):
+        patches = tool.bugs.fetch_patches_from_commit_queue()
+        log("Patches in commit queue:")
+        for patch in patches:
+            print "%s" % patch["url"]
+
+
+class PatchesToCommitQueue(Command):
+    name = "patches-to-commit-queue"
+    show_in_main_help = False
+    def __init__(self):
+        options = [
+            make_option("--bugs", action="store_true", dest="bugs", help="Output bug links instead of patch links"),
+        ]
+        Command.__init__(self, "Patches which should be added to the commit queue", options=options)
+
+    @staticmethod
+    def _needs_commit_queue(patch):
+        commit_queue_flag = patch.get("commit-queue")
+        if (commit_queue_flag and commit_queue_flag == '+'): # If it's already cq+, ignore the patch.
+            log("%s already has cq=%s" % (patch["id"], commit_queue_flag))
+            return False
+
+        # We only need to worry about patches from contributers who are not yet committers.
+        committer_record = CommitterList().committer_by_email(patch["attacher_email"])
+        if committer_record:
+            log("%s committer = %s" % (patch["id"], committer_record))
+        return not committer_record
+
+    def execute(self, options, args, tool):
+        patches = tool.bugs.fetch_patches_from_pending_commit_list()
+        patches_needing_cq = filter(self._needs_commit_queue, patches)
+        if options.bugs:
+            bugs_needing_cq = map(lambda patch: patch['bug_id'], patches_needing_cq)
+            bugs_needing_cq = sorted(set(bugs_needing_cq))
+            for bug_id in bugs_needing_cq:
+                print "%s" % tool.bugs.bug_url_for_bug_id(bug_id)
+        else:
+            for patch in patches_needing_cq:
+                print "%s" % tool.bugs.attachment_url_for_id(patch["id"], action="edit")
+
+
+class PatchesToReview(Command):
+    name = "patches-to-review"
+    show_in_main_help = False
+    def __init__(self):
+        Command.__init__(self, "List patches that are pending review")
+
+    def execute(self, options, args, tool):
+        patch_ids = tool.bugs.fetch_attachment_ids_from_review_queue()
+        log("Patches pending review:")
+        for patch_id in patch_ids:
+            print patch_id
+
+
+class ReviewedPatches(Command):
+    name = "reviewed-patches"
+    show_in_main_help = False
+    def __init__(self):
+        Command.__init__(self, "List r+'d patches on a bug", "BUGID")
+
+    def execute(self, options, args, tool):
+        bug_id = args[0]
+        patches_to_land = tool.bugs.fetch_reviewed_patches_from_bug(bug_id)
+        for patch in patches_to_land:
+            print "%s" % patch["url"]
+
+
+class TreeStatus(Command):
+    name = "tree-status"
+    show_in_main_help = True
+    def __init__(self):
+        Command.__init__(self, "Print the status of the %s buildbots" % BuildBot.default_host)
+
+    def execute(self, options, args, tool):
+        for builder in tool.buildbot.builder_statuses():
+            status_string = "ok" if builder["is_green"] else "FAIL"
+            print "%s : %s" % (status_string.ljust(4), builder["name"])
diff --git a/WebKitTools/Scripts/modules/commands/queries_unittest.py b/WebKitTools/Scripts/modules/commands/queries_unittest.py
new file mode 100644
index 0000000..0d1c82a
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/queries_unittest.py
@@ -0,0 +1,68 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from modules.bugzilla import Bugzilla
+from modules.commands.commandtest import CommandsTest
+from modules.commands.queries import *
+from modules.mock import Mock
+from modules.mock_bugzillatool import MockBugzillaTool
+
+class QueryCommandsTest(CommandsTest):
+    def test_bugs_to_commit(self):
+        self.assert_execute_outputs(BugsToCommit(), None, "42\n75\n")
+
+    def test_patches_to_commit(self):
+        expected_stdout = "http://example.com/197\nhttp://example.com/128\n"
+        expected_stderr = "Patches in commit queue:\n"
+        self.assert_execute_outputs(PatchesToCommit(), None, expected_stdout, expected_stderr)
+
+    def test_patches_to_commit_queue(self):
+        expected_stdout = "http://example.com/197&action=edit\nhttp://example.com/128&action=edit\n"
+        expected_stderr = ""
+        options = Mock()
+        options.bugs = False
+        self.assert_execute_outputs(PatchesToCommitQueue(), None, expected_stdout, expected_stderr, options=options)
+
+        expected_stdout = "http://example.com/42\n"
+        options.bugs = True
+        self.assert_execute_outputs(PatchesToCommitQueue(), None, expected_stdout, expected_stderr, options=options)
+
+    def test_patches_to_review(self):
+        expected_stdout = "197\n128\n"
+        expected_stderr = "Patches pending review:\n"
+        self.assert_execute_outputs(PatchesToReview(), None, expected_stdout, expected_stderr)
+
+    def test_reviewed_patches(self):
+        expected_stdout = "http://example.com/197\nhttp://example.com/128\n"
+        self.assert_execute_outputs(ReviewedPatches(), [42], expected_stdout)
+
+    def test_tree_status(self):
+        expected_stdout = "ok   : Builder1\nok   : Builder2\n"
+        self.assert_execute_outputs(TreeStatus(), None, expected_stdout)
diff --git a/WebKitTools/Scripts/modules/commands/queues.py b/WebKitTools/Scripts/modules/commands/queues.py
new file mode 100644
index 0000000..53b9e48
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/queues.py
@@ -0,0 +1,216 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import re
+
+from datetime import datetime
+from optparse import make_option
+
+from modules.executive import ScriptError
+from modules.grammar import pluralize
+from modules.landingsequence import LandingSequence, LandingSequenceErrorHandler
+from modules.logging import error, log
+from modules.multicommandtool import Command
+from modules.patchcollection import PersistentPatchCollection, PersistentPatchCollectionDelegate
+from modules.statusbot import StatusBot
+from modules.workqueue import WorkQueue, WorkQueueDelegate
+
+class AbstractQueue(Command, WorkQueueDelegate):
+    show_in_main_help = False
+    watchers = "webkit-bot-watchers@googlegroups.com"
+    def __init__(self, options=None): # Default values should never be collections (like []) as default values are shared between invocations
+        options_list = (options or []) + [
+            make_option("--no-confirm", action="store_false", dest="confirm", default=True, help="Do not ask the user for confirmation before running the queue.  Dangerous!"),
+            make_option("--status-host", action="store", type="string", dest="status_host", default=StatusBot.default_host, help="Hostname (e.g. localhost or commit.webkit.org) where status updates should be posted."),
+        ]
+        Command.__init__(self, "Run the %s" % self.name, options=options_list)
+
+    def _cc_watchers(self, bug_id):
+        try:
+            self.tool.bugs.add_cc_to_bug(bug_id, self.watchers)
+        except Exception, e:
+            log("Failed to CC watchers: %s." % e)
+
+    def queue_log_path(self):
+        return "%s.log" % self.name
+
+    def work_logs_directory(self):
+        return "%s-logs" % self.name
+
+    def status_host(self):
+        return self.options.status_host
+
+    def begin_work_queue(self):
+        log("CAUTION: %s will discard all local changes in %s" % (self.name, self.tool.scm().checkout_root))
+        if self.options.confirm:
+            response = raw_input("Are you sure?  Type \"yes\" to continue: ")
+            if (response != "yes"):
+                error("User declined.")
+        log("Running WebKit %s. %s" % (self.name, datetime.now().strftime(WorkQueue.log_date_format)))
+
+    def should_continue_work_queue(self):
+        return True
+
+    def next_work_item(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def should_proceed_with_work_item(self, work_item):
+        raise NotImplementedError, "subclasses must implement"
+
+    def process_work_item(self, work_item):
+        raise NotImplementedError, "subclasses must implement"
+
+    def handle_unexpected_error(self, work_item, message):
+        raise NotImplementedError, "subclasses must implement"
+
+    def run_bugzilla_tool(self, args):
+        bugzilla_tool_args = [self.tool.path()] + map(str, args)
+        self.tool.executive.run_and_throw_if_fail(bugzilla_tool_args)
+
+    def log_progress(self, patch_ids):
+        log("%s in %s [%s]" % (pluralize("patch", len(patch_ids)), self.name, ", ".join(map(str, patch_ids))))
+
+    def execute(self, options, args, tool):
+        self.options = options
+        self.tool = tool
+        work_queue = WorkQueue(self.name, self)
+        return work_queue.run()
+
+
+class CommitQueue(AbstractQueue, LandingSequenceErrorHandler):
+    name = "commit-queue"
+    def __init__(self):
+        AbstractQueue.__init__(self)
+
+    # AbstractQueue methods
+
+    def begin_work_queue(self):
+        AbstractQueue.begin_work_queue(self)
+
+    def next_work_item(self):
+        patches = self.tool.bugs.fetch_patches_from_commit_queue(reject_invalid_patches=True)
+        if not patches:
+            return None
+        # Only bother logging if we have patches in the queue.
+        self.log_progress([patch['id'] for patch in patches])
+        return patches[0]
+
+    def should_proceed_with_work_item(self, patch):
+        red_builders_names = self.tool.buildbot.red_core_builders_names()
+        if red_builders_names:
+            red_builders_names = map(lambda name: "\"%s\"" % name, red_builders_names) # Add quotes around the names.
+            return (False, "Builders [%s] are red. See http://build.webkit.org." % ", ".join(red_builders_names), None)
+        return (True, "Landing patch %s from bug %s." % (patch["id"], patch["bug_id"]), patch)
+
+    def process_work_item(self, patch):
+        self._cc_watchers(patch["bug_id"])
+        self.run_bugzilla_tool(["land-attachment", "--force-clean", "--non-interactive", "--parent-command=commit-queue", "--quiet", patch["id"]])
+
+    def handle_unexpected_error(self, patch, message):
+        self.tool.bugs.reject_patch_from_commit_queue(patch["id"], message)
+
+    # LandingSequenceErrorHandler methods
+
+    @classmethod
+    def handle_script_error(cls, tool, patch, script_error):
+        tool.bugs.reject_patch_from_commit_queue(patch["id"], script_error.message_with_output())
+
+
+class AbstractReviewQueue(AbstractQueue, PersistentPatchCollectionDelegate, LandingSequenceErrorHandler):
+    def __init__(self, options=None):
+        AbstractQueue.__init__(self, options)
+
+    # PersistentPatchCollectionDelegate methods
+
+    def collection_name(self):
+        return self.name
+
+    def fetch_potential_patch_ids(self):
+        return self.tool.bugs.fetch_attachment_ids_from_review_queue()
+
+    def status_server(self):
+        return self.tool.status()
+
+    # AbstractQueue methods
+
+    def begin_work_queue(self):
+        AbstractQueue.begin_work_queue(self)
+        self.tool.status().set_host(self.options.status_host)
+        self._patches = PersistentPatchCollection(self)
+
+    def next_work_item(self):
+        patch_id = self._patches.next()
+        if patch_id:
+            return self.tool.bugs.fetch_attachment(patch_id)
+
+    def should_proceed_with_work_item(self, patch):
+        raise NotImplementedError, "subclasses must implement"
+
+    def process_work_item(self, patch):
+        raise NotImplementedError, "subclasses must implement"
+
+    def handle_unexpected_error(self, patch, message):
+        log(message)
+
+    # LandingSequenceErrorHandler methods
+
+    @classmethod
+    def handle_script_error(cls, tool, patch, script_error):
+        log(script_error.message_with_output())
+
+
+class StyleQueue(AbstractReviewQueue):
+    name = "style-queue"
+    def __init__(self):
+        AbstractReviewQueue.__init__(self)
+
+    def should_proceed_with_work_item(self, patch):
+        return (True, "Checking style for patch %s on bug %s." % (patch["id"], patch["bug_id"]), patch)
+
+    def process_work_item(self, patch):
+        try:
+            self.run_bugzilla_tool(["check-style", "--force-clean", "--non-interactive", "--parent-command=style-queue", patch["id"]])
+            message = "%s ran check-webkit-style on attachment %s without any errors." % (self.name, patch["id"])
+            self.tool.bugs.post_comment_to_bug(patch["bug_id"], message, cc=self.watchers)
+            self._patches.did_pass(patch)
+        except ScriptError, e:
+            self._patches.did_fail(patch)
+            raise e
+
+    @classmethod
+    def handle_script_error(cls, tool, patch, script_error):
+        command = script_error.script_args
+        if type(command) is list:
+            command = command[0]
+        # FIXME: We shouldn't need to use a regexp here.  ScriptError should
+        #        have a better API.
+        if re.search("check-webkit-style", command):
+            message = "Attachment %s did not pass %s:\n\n%s" % (patch["id"], cls.name, script_error.message_with_output(output_limit=5*1024))
+            tool.bugs.post_comment_to_bug(patch["bug_id"], message, cc=cls.watchers)
diff --git a/WebKitTools/Scripts/modules/commands/queues_unittest.py b/WebKitTools/Scripts/modules/commands/queues_unittest.py
new file mode 100644
index 0000000..75abbe5
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/queues_unittest.py
@@ -0,0 +1,66 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from modules.commands.commandtest import CommandsTest
+from modules.commands.queues import *
+from modules.mock_bugzillatool import MockBugzillaTool
+from modules.outputcapture import OutputCapture
+
+
+class TestQueue(AbstractQueue):
+    name = "test-queue"
+
+
+class AbstractQueueTest(CommandsTest):
+    def _assert_output(self, function, args, expected_stdout="", expected_stderr=""):
+        capture = OutputCapture()
+        capture.capture_output()
+        function(*args)
+        (stdout_string, stderr_string) = capture.restore_output()
+        self.assertEqual(stdout_string, expected_stdout)
+        self.assertEqual(stderr_string, expected_stderr)
+
+    def _assert_log_progress_output(self, patch_ids, progress_output):
+        self._assert_output(TestQueue().log_progress, [patch_ids], expected_stderr=progress_output)
+
+    def test_log_progress(self):
+        self._assert_log_progress_output([1,2,3], "3 patches in test-queue [1, 2, 3]\n")
+        self._assert_log_progress_output(["1","2","3"], "3 patches in test-queue [1, 2, 3]\n")
+        self._assert_log_progress_output([1], "1 patch in test-queue [1]\n")
+
+    def _assert_run_bugzilla_tool_output(self, run_args, tool_output):
+        queue = TestQueue()
+        queue.bind_to_tool(MockBugzillaTool())
+        # MockBugzillaTool.path() is "echo"
+        self._assert_output(queue.run_bugzilla_tool, [run_args], expected_stdout=tool_output)
+
+    def test_run_bugzilla_tool(self):
+        self._assert_run_bugzilla_tool_output([1], "")
+        self._assert_run_bugzilla_tool_output(["one", 2], "")
diff --git a/WebKitTools/Scripts/modules/commands/upload.py b/WebKitTools/Scripts/modules/commands/upload.py
new file mode 100644
index 0000000..1f892a1
--- /dev/null
+++ b/WebKitTools/Scripts/modules/commands/upload.py
@@ -0,0 +1,246 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+import StringIO
+import sys
+
+from optparse import make_option
+
+from modules.bugzilla import parse_bug_id
+from modules.grammar import pluralize
+from modules.logging import error, log
+from modules.multicommandtool import Command
+
+# FIXME: Requires unit test.
+class CommitMessageForCurrentDiff(Command):
+    name = "commit-message"
+    show_in_main_help = False
+    def __init__(self):
+        Command.__init__(self, "Print a commit message suitable for the uncommitted changes")
+
+    def execute(self, options, args, tool):
+        os.chdir(tool.scm().checkout_root)
+        print "%s" % tool.scm().commit_message_for_this_commit().message()
+
+
+class ObsoleteAttachments(Command):
+    name = "obsolete-attachments"
+    show_in_main_help = False
+    def __init__(self):
+        Command.__init__(self, "Mark all attachments on a bug as obsolete", "BUGID")
+
+    def execute(self, options, args, tool):
+        bug_id = args[0]
+        attachments = tool.bugs.fetch_attachments_from_bug(bug_id)
+        for attachment in attachments:
+            if not attachment["is_obsolete"]:
+                tool.bugs.obsolete_attachment(attachment["id"])
+
+
+class PostDiff(Command):
+    name = "post-diff"
+    show_in_main_help = True
+    def __init__(self):
+        options = [
+            make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment (default: \"patch\")"),
+        ]
+        options += self.posting_options()
+        Command.__init__(self, "Attach the current working directory diff to a bug as a patch file", "[BUGID]", options=options)
+
+    @staticmethod
+    def posting_options():
+        return [
+            make_option("--no-obsolete", action="store_false", dest="obsolete_patches", default=True, help="Do not obsolete old patches before posting this one."),
+            make_option("--no-review", action="store_false", dest="review", default=True, help="Do not mark the patch for review."),
+            make_option("--request-commit", action="store_true", dest="request_commit", default=False, help="Mark the patch as needing auto-commit after review."),
+        ]
+
+    @staticmethod
+    def obsolete_patches_on_bug(bug_id, bugs):
+        patches = bugs.fetch_patches_from_bug(bug_id)
+        if len(patches):
+            log("Obsoleting %s on bug %s" % (pluralize("old patch", len(patches)), bug_id))
+            for patch in patches:
+                bugs.obsolete_attachment(patch["id"])
+
+    def execute(self, options, args, tool):
+        # Perfer a bug id passed as an argument over a bug url in the diff (i.e. ChangeLogs).
+        bug_id = (args and args[0]) or parse_bug_id(tool.scm().create_patch())
+        if not bug_id:
+            error("No bug id passed and no bug url found in diff, can't post.")
+
+        if options.obsolete_patches:
+            self.obsolete_patches_on_bug(bug_id, tool.bugs)
+
+        diff = tool.scm().create_patch()
+        diff_file = StringIO.StringIO(diff) # add_patch_to_bug expects a file-like object
+
+        description = options.description or "Patch"
+        tool.bugs.add_patch_to_bug(bug_id, diff_file, description, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
+
+
+class PostCommits(Command):
+    name = "post-commits"
+    show_in_main_help = True
+    def __init__(self):
+        options = [
+            make_option("-b", "--bug-id", action="store", type="string", dest="bug_id", help="Specify bug id if no URL is provided in the commit log."),
+            make_option("--add-log-as-comment", action="store_true", dest="add_log_as_comment", default=False, help="Add commit log message as a comment when uploading the patch."),
+            make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment (default: description from commit message)"),
+        ]
+        options += PostDiff.posting_options()
+        Command.__init__(self, "Attach a range of local commits to bugs as patch files", "COMMITISH", options=options, requires_local_commits=True)
+
+    def _comment_text_for_commit(self, options, commit_message, tool, commit_id):
+        comment_text = None
+        if (options.add_log_as_comment):
+            comment_text = commit_message.body(lstrip=True)
+            comment_text += "---\n"
+            comment_text += tool.scm().files_changed_summary_for_commit(commit_id)
+        return comment_text
+
+    def _diff_file_for_commit(self, tool, commit_id):
+        diff = tool.scm().create_patch_from_local_commit(commit_id)
+        return StringIO.StringIO(diff) # add_patch_to_bug expects a file-like object
+
+    def execute(self, options, args, tool):
+        commit_ids = tool.scm().commit_ids_from_commitish_arguments(args)
+        if len(commit_ids) > 10: # We could lower this limit, 10 is too many for one bug as-is.
+            error("bugzilla-tool does not support attaching %s at once.  Are you sure you passed the right commit range?" % (pluralize("patch", len(commit_ids))))
+
+        have_obsoleted_patches = set()
+        for commit_id in commit_ids:
+            commit_message = tool.scm().commit_message_for_local_commit(commit_id)
+
+            # Prefer --bug-id=, then a bug url in the commit message, then a bug url in the entire commit diff (i.e. ChangeLogs).
+            bug_id = options.bug_id or parse_bug_id(commit_message.message()) or parse_bug_id(tool.scm().create_patch_from_local_commit(commit_id))
+            if not bug_id:
+                log("Skipping %s: No bug id found in commit or specified with --bug-id." % commit_id)
+                continue
+
+            if options.obsolete_patches and bug_id not in have_obsoleted_patches:
+                PostDiff.obsolete_patches_on_bug(bug_id, tool.bugs)
+                have_obsoleted_patches.add(bug_id)
+
+            diff_file = self._diff_file_for_commit(tool, commit_id)
+            description = options.description or commit_message.description(lstrip=True, strip_url=True)
+            comment_text = self._comment_text_for_commit(options, commit_message, tool, commit_id)
+            tool.bugs.add_patch_to_bug(bug_id, diff_file, description, comment_text, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
+
+
+class MarkFixed(Command):
+    name = "mark-fixed"
+    show_in_main_help = False
+    def __init__(self):
+        Command.__init__(self, "Mark the specified bug as fixed", "BUG_ID REASON")
+
+    def execute(self, options, args, tool):
+        tool.bugs.close_bug_as_fixed(args[0], args[1])
+
+
+# FIXME: Requires unit test.  Blocking issue: too complex for now.
+class CreateBug(Command):
+    name = "create-bug"
+    show_in_main_help = True
+    def __init__(self):
+        options = [
+            make_option("--cc", action="store", type="string", dest="cc", help="Comma-separated list of email addresses to carbon-copy."),
+            make_option("--component", action="store", type="string", dest="component", help="Component for the new bug."),
+            make_option("--no-prompt", action="store_false", dest="prompt", default=True, help="Do not prompt for bug title and comment; use commit log instead."),
+            make_option("--no-review", action="store_false", dest="review", default=True, help="Do not mark the patch for review."),
+            make_option("--request-commit", action="store_true", dest="request_commit", default=False, help="Mark the patch as needing auto-commit after review."),
+        ]
+        Command.__init__(self, "Create a bug from local changes or local commits", "[COMMITISH]", options=options)
+
+    def create_bug_from_commit(self, options, args, tool):
+        commit_ids = tool.scm().commit_ids_from_commitish_arguments(args)
+        if len(commit_ids) > 3:
+            error("Are you sure you want to create one bug with %s patches?" % len(commit_ids))
+
+        commit_id = commit_ids[0]
+
+        bug_title = ""
+        comment_text = ""
+        if options.prompt:
+            (bug_title, comment_text) = self.prompt_for_bug_title_and_comment()
+        else:
+            commit_message = tool.scm().commit_message_for_local_commit(commit_id)
+            bug_title = commit_message.description(lstrip=True, strip_url=True)
+            comment_text = commit_message.body(lstrip=True)
+            comment_text += "---\n"
+            comment_text += tool.scm().files_changed_summary_for_commit(commit_id)
+
+        diff = tool.scm().create_patch_from_local_commit(commit_id)
+        diff_file = StringIO.StringIO(diff) # create_bug_with_patch expects a file-like object
+        bug_id = tool.bugs.create_bug_with_patch(bug_title, comment_text, options.component, diff_file, "Patch", cc=options.cc, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
+
+        if bug_id and len(commit_ids) > 1:
+            options.bug_id = bug_id
+            options.obsolete_patches = False
+            # FIXME: We should pass through --no-comment switch as well.
+            PostCommits.execute(self, options, commit_ids[1:], tool)
+
+    def create_bug_from_patch(self, options, args, tool):
+        bug_title = ""
+        comment_text = ""
+        if options.prompt:
+            (bug_title, comment_text) = self.prompt_for_bug_title_and_comment()
+        else:
+            commit_message = tool.scm().commit_message_for_this_commit()
+            bug_title = commit_message.description(lstrip=True, strip_url=True)
+            comment_text = commit_message.body(lstrip=True)
+
+        diff = tool.scm().create_patch()
+        diff_file = StringIO.StringIO(diff) # create_bug_with_patch expects a file-like object
+        bug_id = tool.bugs.create_bug_with_patch(bug_title, comment_text, options.component, diff_file, "Patch", cc=options.cc, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
+
+    def prompt_for_bug_title_and_comment(self):
+        bug_title = raw_input("Bug title: ")
+        print "Bug comment (hit ^D on blank line to end):"
+        lines = sys.stdin.readlines()
+        try:
+            sys.stdin.seek(0, os.SEEK_END)
+        except IOError:
+            # Cygwin raises an Illegal Seek (errno 29) exception when the above
+            # seek() call is made. Ignoring it seems to cause no harm.
+            # FIXME: Figure out a way to get avoid the exception in the first
+            # place.
+            pass
+        comment_text = "".join(lines)
+        return (bug_title, comment_text)
+
+    def execute(self, options, args, tool):
+        if len(args):
+            if (not tool.scm().supports_local_commits()):
+                error("Extra arguments not supported; patch is taken from working directory.")
+            self.create_bug_from_commit(options, args, tool)
+        else:
+            self.create_bug_from_patch(options, args, tool)
diff --git a/WebKit/chromium/webkit.gyp b/WebKitTools/Scripts/modules/commands/upload_unittest.py
index 04d1bad..4d3f85c 100644
--- a/WebKit/chromium/webkit.gyp
+++ b/WebKitTools/Scripts/modules/commands/upload_unittest.py
@@ -1,18 +1,18 @@
-#
 # Copyright (C) 2009 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
 # met:
 #
-#   * Redistributions of source code must retain the above copyright notice,
-#     this list of conditions and the following disclaimer.
-#   * Redistributions in binary form must reproduce the above copyright 
-#     notice, this list of conditions and the following disclaimer in the
-#     documentation and/or other materials provided with the distribution.
-#   * Neither the name of Google Inc. nor the names of its contributors 
-#     may be used to endorse or promote products derived from this software
-#     without specific prior written permission.
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
 #
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
@@ -25,18 +25,18 @@
 # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
 
-{
-  'targets': [
-    {
-      # This target only builds webcore right now, but it will also build
-      # the chromium webkit api once the api is upstreamed.
-      'target_name': 'webkit',
-      'type': 'none',
-      'dependencies': [
-        '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
-      ],
-    },
-  ], # targets
-}
+import unittest
+
+from modules.commands.commandtest import CommandsTest
+from modules.commands.upload import *
+
+class UploadCommandsTest(CommandsTest):
+    def test_mark_fixed(self):
+        self.assert_execute_outputs(MarkFixed(), [43, "Test comment"])
+
+    def test_obsolete_attachments(self):
+        self.assert_execute_outputs(ObsoleteAttachments(), [42])
+
+    def test_post_diff(self):
+        self.assert_execute_outputs(PostDiff(), [42])
diff --git a/WebKitTools/Scripts/modules/committers.py b/WebKitTools/Scripts/modules/committers.py
index fc263eb..d32a536 100644
--- a/WebKitTools/Scripts/modules/committers.py
+++ b/WebKitTools/Scripts/modules/committers.py
@@ -29,128 +29,176 @@
 # WebKit's Python module for committer and reviewer validation
 
 class Committer:
-    def __init__(self, name, email):
+    def __init__(self, name, email_or_emails):
         self.full_name = name
-        self.bugzilla_email = email
+        if isinstance(email_or_emails, str):
+            self.emails = [email_or_emails]
+        else:
+            self.emails = email_or_emails
         self.can_review = False
 
     def __str__(self):
-        return '"%s" <%s>' % (self.full_name, self.bugzilla_email)
+        return '"%s" <%s>' % (self.full_name, self.emails[0])
 
 class Reviewer(Committer):
-    def __init__(self, name, email):
-        Committer.__init__(self, name, email)
+    def __init__(self, name, email_or_emails):
+        Committer.__init__(self, name, email_or_emails)
         self.can_review = True
 
-# This is intended as a cannonical, machine-readable list of all non-reviewer committers for WebKit.
+# This is intended as a canonical, machine-readable list of all non-reviewer committers for WebKit.
 # If your name is missing here and you are a committer, please add it.  No review needed.
 # All reviewers are committers, so this list is only of committers who are not reviewers.
 committers_unable_to_review = [
     Committer("Aaron Boodman", "aa@chromium.org"),
     Committer("Adam Langley", "agl@chromium.org"),
     Committer("Albert J. Wong", "ajwong@chromium.org"),
+    Committer("Alexander Kellett", ["lypanov@mac.com", "a-lists001@lypanov.net", "lypanov@kde.org"]),
+    Committer("Andre Boule", "aboule@apple.com"),
+    Committer("Andrew Wellington", ["andrew@webkit.org", "proton@wiretapped.net"]),
+    Committer("Anthony Ricaud", "rik@webkit.org"),
     Committer("Anton Muhin", "antonm@chromium.org"),
     Committer("Antonio Gomes", "tonikitoo@webkit.org"),
-    Committer("Anthony Ricaud", "rik@webkit.org"),
     Committer("Ben Murdoch", "benm@google.com"),
-    Committer("Chris Fleizach", "cfleizach@apple.com"),
+    Committer("Benjamin C Meyer", ["ben@meyerhome.net", "ben@webkit.org"]),
     Committer("Brent Fulgham", "bfulgham@webkit.org"),
+    Committer("Brett Wilson", "brettw@chromium.org"),
     Committer("Brian Weinstein", "bweinstein@apple.com"),
     Committer("Cameron McCormack", "cam@webkit.org"),
+    Committer("Chris Fleizach", "cfleizach@apple.com"),
+    Committer("Chris Marrin", "cmarrin@apple.com"),
+    Committer("Chris Petersen", "cpetersen@apple.com"),
+    Committer("Christian Dywan", ["christian@twotoasts.de", "christian@webkit.org"]),
     Committer("Collin Jackson", "collinj@webkit.org"),
     Committer("Csaba Osztrogonac", "ossy@webkit.org"),
     Committer("Daniel Bates", "dbates@webkit.org"),
+    Committer("David Smith", ["catfish.man@gmail.com", "dsmith@webkit.org"]),
+    Committer("Dean Jackson", "dino@apple.com"),
     Committer("Drew Wilson", "atwilson@chromium.org"),
-    Committer("Dirk Schulze", "krit@webkit.org"),
-    Committer("Dmitry Titov", "dimich@chromium.org"),
     Committer("Dumitru Daniliuc", "dumi@chromium.org"),
     Committer("Eli Fidler", "eli@staikos.net"),
+    Committer("Enrica Casucci", "enrica@apple.com"),
+    Committer("Erik Arvidsson", "arv@chromium.org"),
     Committer("Eric Roman", "eroman@chromium.org"),
+    Committer("Feng Qian", "feng@chromium.org"),
     Committer("Fumitoshi Ukai", "ukai@chromium.org"),
+    Committer("Girish Ramakrishnan", ["girish@forwardbias.in", "ramakrishnan.girish@gmail.com"]),
+    Committer("Graham Dennis", ["Graham.Dennis@gmail.com", "gdennis@webkit.org"]),
     Committer("Greg Bolsinga", "bolsinga@apple.com"),
-    Committer("Jeremy Moskovich", "playmobil@google.com"),
+    Committer("Hin-Chung Lam", ["hclam@google.com", "hclam@chromium.org"]),
+    Committer("Jens Alfke", ["snej@chromium.org", "jens@apple.com"]),
+    Committer("Jeremy Moskovich", ["playmobil@google.com", "jeremy@chromium.org"]),
     Committer("Jeremy Orlow", "jorlow@chromium.org"),
+    Committer("Jessie Berlin", ["jberlin@webkit.org", "jberlin@apple.com"]),
     Committer("Jian Li", "jianli@chromium.org"),
     Committer("John Abd-El-Malek", "jam@chromium.org"),
+    Committer("Joost de Valk", ["joost@webkit.org", "webkit-dev@joostdevalk.nl"]),
     Committer("Joseph Pecoraro", "joepeck@webkit.org"),
-    Committer("Julie Parent", "jparent@google.com"),
-    Committer("Kenneth Rohde Christiansen", "kenneth@webkit.org"),
+    Committer("Julie Parent", ["jparent@google.com", "jparent@chromium.org"]),
+    Committer("Julien Chaffraix", ["jchaffraix@webkit.org", "julien.chaffraix@gmail.com"]),
+    Committer("Jungshik Shin", "jshin@chromium.org"),
+    Committer("Keishi Hattori", "keishi@webkit.org"),
+    Committer("Kelly Norton", "knorton@google.com"),
     Committer("Kent Tamura", "tkent@chromium.org"),
+    Committer("Krzysztof Kowalczyk", "kkowalczyk@gmail.com"),
     Committer("Laszlo Gombos", "laszlo.1.gombos@nokia.com"),
+    Committer("Levi Weintraub", "lweintraub@apple.com"),
     Committer("Mads Ager", "ager@chromium.org"),
+    Committer("Matt Lilek", ["webkit@mattlilek.com", "pewtermoose@webkit.org"]),
+    Committer("Matt Perry", "mpcomplete@chromium.org"),
+    Committer("Maxime Britto", ["maxime.britto@gmail.com", "britto@apple.com"]),
+    Committer("Maxime Simon", ["simon.maxime@gmail.com", "maxime.simon@webkit.org"]),
+    Committer("Michelangelo De Simone", "michelangelo@webkit.org"),
     Committer("Mike Belshe", "mike@belshe.com"),
+    Committer("Mike Fenton", ["mike.fenton@torchmobile.com", "mifenton@rim.com"]),
+    Committer("Mike Thole", ["mthole@mikethole.com", "mthole@apple.com"]),
     Committer("Nate Chapin", "japhet@chromium.org"),
     Committer("Ojan Vafai", "ojan@chromium.org"),
     Committer("Pam Greene", "pam@chromium.org"),
-    Committer("Peter Kasting", "pkasting@google.com"),
-    Committer("Pierre d'Herbemont", "pdherbemont@free.fr"),
+    Committer("Peter Kasting", ["pkasting@google.com", "pkasting@chromium.org"]),
+    Committer("Pierre d'Herbemont", ["pdherbemont@free.fr", "pdherbemont@apple.com"]),
+    Committer("Pierre-Olivier Latour", "pol@apple.com"),
     Committer("Roland Steiner", "rolandsteiner@chromium.org"),
     Committer("Ryosuke Niwa", "rniwa@webkit.org"),
     Committer("Scott Violet", "sky@chromium.org"),
     Committer("Shinichiro Hamaji", "hamaji@chromium.org"),
+    Committer("Stephen White", "senorblanco@chromium.org"),
     Committer("Steve Block", "steveblock@google.com"),
     Committer("Tony Chang", "tony@chromium.org"),
+    Committer("Trey Matteson", "trey@usa.net"),
+    Committer("Tristan O'Tierney", ["tristan@otierney.net", "tristan@apple.com"]),
+    Committer("William Siegrist", "wsiegrist@apple.com"),
     Committer("Yael Aharon", "yael.aharon@nokia.com"),
-    Committer("Yong Li", "yong.li@torchmobile.com"),
+    Committer("Yaar Schnitman", ["yaar@chromium.org", "yaar@google.com"]),
+    Committer("Yong Li", ["yong.li@torchmobile.com", "yong.li.webkit@gmail.com"]),
+    Committer("Yongjun Zhang", "yongjun.zhang@nokia.com"),
     Committer("Yury Semikhatsky", "yurys@chromium.org"),
     Committer("Zoltan Horvath", "zoltan@webkit.org"),
 ]
 
-# This is intended as a cannonical, machine-readable list of all reviewers for WebKit.
+# This is intended as a canonical, machine-readable list of all reviewers for WebKit.
 # If your name is missing here and you are a reviewer, please add it.  No review needed.
 reviewers_list = [
-    Reviewer("Adam Barth", "abarth@webkit.org"),
     Reviewer("Ada Chan", "adachan@apple.com"),
+    Reviewer("Adam Barth", "abarth@webkit.org"),
     Reviewer("Adam Roben", "aroben@apple.com"),
-    Reviewer("Adam Treat", "treat@kde.org"),
+    Reviewer("Adam Treat", ["treat@kde.org", "treat@webkit.org"]),
     Reviewer("Adele Peterson", "adele@apple.com"),
-    Reviewer("Alexey Proskuryakov", "ap@webkit.org"),
+    Reviewer("Alexey Proskuryakov", ["ap@webkit.org", "ap@apple.com"]),
     Reviewer("Alice Liu", "alice.liu@apple.com"),
-    Reviewer("Alp Toker", "alp@nuanti.com"),
-    Reviewer("Anders Carlsson", "andersca@apple.com"),
-    Reviewer("Antti Koivisto", "koivisto@iki.fi"),
-    Reviewer("Ariya Hidayat", "ariya.hidayat@trolltech.com"),
+    Reviewer("Alp Toker", ["alp@nuanti.com", "alp@atoker.com", "alp@webkit.org"]),
+    Reviewer("Anders Carlsson", ["andersca@apple.com", "acarlsson@apple.com"]),
+    Reviewer("Antti Koivisto", ["koivisto@iki.fi", "antti@apple.com"]),
+    Reviewer("Ariya Hidayat", ["ariya.hidayat@trolltech.com", "ariya.hidayat@gmail.com", "ariya@webkit.org"]),
+    Reviewer("Beth Dakin", "bdakin@apple.com"),
     Reviewer("Brady Eidson", "beidson@apple.com"),
-    Reviewer("Cameron Zwarich", "zwarich@apple.com"),
-    Reviewer("Dan Bernstein", "mitz@webkit.org"),
+    Reviewer("Cameron Zwarich", ["zwarich@apple.com", "cwzwarich@apple.com", "cwzwarich@webkit.org"]),
+    Reviewer("Chris Blumenberg", "cblu@apple.com"),
+    Reviewer("Dan Bernstein", ["mitz@webkit.org", "mitz@apple.com"]),
     Reviewer("Darin Adler", "darin@apple.com"),
-    Reviewer("Darin Fisher", "fishd@chromium.org"),
+    Reviewer("Darin Fisher", ["fishd@chromium.org", "darin@chromium.org"]),
     Reviewer("David Harrison", "harrison@apple.com"),
     Reviewer("David Hyatt", "hyatt@apple.com"),
-    Reviewer("David Kilzer", "ddkilzer@webkit.org"),
+    Reviewer("David Kilzer", ["ddkilzer@webkit.org", "ddkilzer@apple.com"]),
     Reviewer("David Levin", "levin@chromium.org"),
     Reviewer("Dimitri Glazkov", "dglazkov@chromium.org"),
+    Reviewer("Dirk Schulze", "krit@webkit.org"),
+    Reviewer("Dmitry Titov", "dimich@chromium.org"),
     Reviewer("Don Melton", "gramps@apple.com"),
-    Reviewer("Dmitri Titov", "dimich@chromium.org"),
     Reviewer("Eric Carlson", "eric.carlson@apple.com"),
     Reviewer("Eric Seidel", "eric@webkit.org"),
     Reviewer("Gavin Barraclough", "barraclough@apple.com"),
     Reviewer("Geoffrey Garen", "ggaren@apple.com"),
-    Reviewer("George Staikos", "staikos@kde.org"),
-    Reviewer("Gustavo Noronha", "gns@gnome.org"),
-    Reviewer("Holger Freyther", "zecke@selfish.org"),
-    Reviewer("Jan Alonzo", "jmalonzo@gmail.com"),
+    Reviewer("George Staikos", ["staikos@kde.org", "staikos@webkit.org"]),
+    Reviewer("Gustavo Noronha Silva", ["gns@gnome.org", "kov@webkit.org"]),
+    Reviewer("Holger Freyther", ["zecke@selfish.org", "zecke@webkit.org"]),
+    Reviewer("Jan Alonzo", ["jmalonzo@gmail.com", "jmalonzo@webkit.org"]),
     Reviewer("John Sullivan", "sullivan@apple.com"),
     Reviewer("Jon Honeycutt", "jhoneycutt@apple.com"),
     Reviewer("Justin Garcia", "justin.garcia@apple.com"),
+    Reviewer("Ken Kocienda", "kocienda@apple.com"),
+    Reviewer("Kenneth Rohde Christiansen", ["kenneth@webkit.org", "kenneth.christiansen@openbossa.org"]),
     Reviewer("Kevin Decker", "kdecker@apple.com"),
     Reviewer("Kevin McCullough", "kmccullough@apple.com"),
-    Reviewer("Kevin Ollivier", "kevino@theolliviers.com"),
-    Reviewer("Lars Knoll", "lars@trolltech.com"),
+    Reviewer("Kevin Ollivier", ["kevino@theolliviers.com", "kevino@webkit.org"]),
+    Reviewer("Lars Knoll", ["lars@trolltech.com", "lars@kde.org"]),
     Reviewer("Maciej Stachowiak", "mjs@apple.com"),
     Reviewer("Mark Rowe", "mrowe@apple.com"),
-    Reviewer("Nikolas Zimmermann", "zimmermann@kde.org"),
+    Reviewer("Nikolas Zimmermann", ["zimmermann@kde.org", "zimmermann@physik.rwth-aachen.de", "zimmermann@webkit.org"]),
     Reviewer("Oliver Hunt", "oliver@apple.com"),
     Reviewer("Pavel Feldman", "pfeldman@chromium.org"),
-    Reviewer("Rob Buis", "rwlbuis@gmail.com"),
-    Reviewer("Sam Weinig", "sam@webkit.org"),
+    Reviewer("Richard Williamson", "rjw@apple.com"),
+    Reviewer("Rob Buis", ["rwlbuis@gmail.com", "rwlbuis@webkit.org"]),
+    Reviewer("Sam Weinig", ["sam@webkit.org", "weinig@apple.com"]),
     Reviewer("Simon Fraser", "simon.fraser@apple.com"),
-    Reviewer("Simon Hausmann", "hausmann@webkit.org"),
+    Reviewer("Simon Hausmann", ["hausmann@webkit.org", "hausmann@kde.org"]),
     Reviewer("Stephanie Lewis", "slewis@apple.com"),
     Reviewer("Steve Falkenburg", "sfalken@apple.com"),
-    Reviewer("Timothy Hatcher", "timothy@hatcher.name"),
+    Reviewer("Tim Omernick", "timo@apple.com"),
+    Reviewer("Timothy Hatcher", ["timothy@hatcher.name", "timothy@apple.com"]),
     Reviewer(u'Tor Arne Vestb\xf8', "vestbo@webkit.org"),
-    Reviewer("Xan Lopez", "xan.lopez@gmail.com"),
+    Reviewer("Vicki Murley", "vicki@apple.com"),
+    Reviewer("Xan Lopez", ["xan.lopez@gmail.com", "xan@gnome.org", "xan@webkit.org"]),
+    Reviewer("Zack Rusin", "zack@kde.org"),
 ]
 
 
@@ -164,17 +212,21 @@ class CommitterList:
     def committers(self):
         return self._committers
 
+    def reviewers(self):
+        return self._reviewers
+
     def _email_to_committer_map(self):
         if not len(self._committers_by_email):
             for committer in self._committers:
-                self._committers_by_email[committer.bugzilla_email] = committer
+                for email in committer.emails:
+                    self._committers_by_email[email] = committer
         return self._committers_by_email
 
-    def committer_by_bugzilla_email(self, bugzilla_email):
-        return self._email_to_committer_map().get(bugzilla_email)
+    def committer_by_email(self, email):
+        return self._email_to_committer_map().get(email)
 
-    def reviewer_by_bugzilla_email(self, bugzilla_email):
-        committer = self.committer_by_bugzilla_email(bugzilla_email)
+    def reviewer_by_email(self, email):
+        committer = self.committer_by_email(email)
         if committer and not committer.can_review:
             return None
         return committer
diff --git a/WebKitTools/Scripts/modules/committers_unittest.py b/WebKitTools/Scripts/modules/committers_unittest.py
index 045e20e..cf9f486 100644
--- a/WebKitTools/Scripts/modules/committers_unittest.py
+++ b/WebKitTools/Scripts/modules/committers_unittest.py
@@ -33,20 +33,30 @@ class CommittersTest(unittest.TestCase):
 
     def test_committer_lookup(self):
         committer = Committer('Test One', 'one@test.com')
-        reviewer = Reviewer('Test Two', 'two@test.com')
+        reviewer = Reviewer('Test Two', ['two@test.com', 'two@rad.com', 'so_two@gmail.com'])
         committer_list = CommitterList(committers=[committer], reviewers=[reviewer])
 
         # Test valid committer and reviewer lookup
-        self.assertEqual(committer_list.committer_by_bugzilla_email('one@test.com'), committer)
-        self.assertEqual(committer_list.reviewer_by_bugzilla_email('two@test.com'), reviewer)
-        self.assertEqual(committer_list.committer_by_bugzilla_email('two@test.com'), reviewer)
+        self.assertEqual(committer_list.committer_by_email('one@test.com'), committer)
+        self.assertEqual(committer_list.reviewer_by_email('two@test.com'), reviewer)
+        self.assertEqual(committer_list.committer_by_email('two@test.com'), reviewer)
+        self.assertEqual(committer_list.committer_by_email('two@rad.com'), reviewer)
+        self.assertEqual(committer_list.reviewer_by_email('so_two@gmail.com'), reviewer)
 
         # Test that a known committer is not returned during reviewer lookup
-        self.assertEqual(committer_list.reviewer_by_bugzilla_email('one@test.com'), None)
+        self.assertEqual(committer_list.reviewer_by_email('one@test.com'), None)
 
         # Test that unknown email address fail both committer and reviewer lookup
-        self.assertEqual(committer_list.committer_by_bugzilla_email('bar@bar.com'), None)
-        self.assertEqual(committer_list.reviewer_by_bugzilla_email('bar@bar.com'), None)
+        self.assertEqual(committer_list.committer_by_email('bar@bar.com'), None)
+        self.assertEqual(committer_list.reviewer_by_email('bar@bar.com'), None)
+
+        # Test that emails returns a list.
+        self.assertEqual(committer.emails, ['one@test.com'])
+
+        # Test that committers returns committers and reviewers and reviewers() just reviewers.
+        self.assertEqual(committer_list.committers(), [committer, reviewer])
+        self.assertEqual(committer_list.reviewers(), [reviewer])
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/Scripts/modules/cpp_style.py b/WebKitTools/Scripts/modules/cpp_style.py
index 485b07c..d8ca8d1 100644
--- a/WebKitTools/Scripts/modules/cpp_style.py
+++ b/WebKitTools/Scripts/modules/cpp_style.py
@@ -130,6 +130,7 @@ _ERROR_CATEGORIES = '''\
     readability/function
     readability/multiline_comment
     readability/multiline_string
+    readability/naming
     readability/null
     readability/streams
     readability/todo
@@ -243,14 +244,14 @@ _PRIMARY_HEADER = 1
 _OTHER_HEADER = 2
 
 
+# The regexp compilation caching is inlined in all regexp functions for
+# performance reasons; factoring it out into a separate function turns out
+# to be noticeably expensive.
 _regexp_compile_cache = {}
 
 
 def match(pattern, s):
     """Matches the string with the pattern, caching the compiled regexp."""
-    # The regexp compilation caching is inlined in both match and search for
-    # performance reasons; factoring it out into a separate function turns out
-    # to be noticeably expensive.
     if not pattern in _regexp_compile_cache:
         _regexp_compile_cache[pattern] = sre_compile.compile(pattern)
     return _regexp_compile_cache[pattern].match(s)
@@ -263,6 +264,20 @@ def search(pattern, s):
     return _regexp_compile_cache[pattern].search(s)
 
 
+def sub(pattern, replacement, s):
+    """Substitutes occurrences of a pattern, caching the compiled regexp."""
+    if not pattern in _regexp_compile_cache:
+        _regexp_compile_cache[pattern] = sre_compile.compile(pattern)
+    return _regexp_compile_cache[pattern].sub(replacement, s)
+
+
+def subn(pattern, replacement, s):
+    """Substitutes occurrences of a pattern, caching the compiled regexp."""
+    if not pattern in _regexp_compile_cache:
+        _regexp_compile_cache[pattern] = sre_compile.compile(pattern)
+    return _regexp_compile_cache[pattern].subn(replacement, s)
+
+
 class _IncludeState(dict):
     """Tracks line numbers for includes, and the order in which includes appear.
 
@@ -868,7 +883,7 @@ def get_header_guard_cpp_variable(filename):
     """
 
     fileinfo = FileInfo(filename)
-    return re.sub(r'[-./\s]', '_', fileinfo.repository_name()).upper() + '_'
+    return sub(r'[-./\s]', '_', fileinfo.repository_name()).upper() + '_'
 
 
 def check_for_header_guard(filename, lines, error):
@@ -1119,6 +1134,16 @@ class _ClassState(object):
                   self.classinfo_stack[0].name)
 
 
+class _FileState(object):
+    def __init__(self):
+        self._did_inside_namespace_indent_warning = False
+
+    def set_did_inside_namespace_indent_warning(self):
+        self._did_inside_namespace_indent_warning = True
+
+    def did_inside_namespace_indent_warning(self):
+        return self._did_inside_namespace_indent_warning
+
 def check_for_non_standard_constructs(filename, clean_lines, line_number,
                                       class_state, error):
     """Logs an error if we see certain non-ANSI constructs ignored by gcc-2.
@@ -1532,10 +1557,10 @@ def check_spacing(filename, clean_lines, line_number, error):
     line = clean_lines.elided[line_number]  # get rid of comments and strings
 
     # Don't try to do spacing checks for operator methods
-    line = re.sub(r'operator(==|!=|<|<<|<=|>=|>>|>)\(', 'operator\(', line)
-    # Don't try to do spacing checks for #include statements at minimum it
-    # messes up checks for spacing around /
-    if match(r'\s*#\s*include', line):
+    line = sub(r'operator(==|!=|<|<<|<=|>=|>>|>)\(', 'operator\(', line)
+    # Don't try to do spacing checks for #include or #import statements at
+    # minimum because it messes up checks for spacing around /
+    if match(r'\s*#\s*(?:include|import)', line):
         return
     if search(r'[\w.]=[\w.]', line):
         error(filename, line_number, 'whitespace/operators', 4,
@@ -1675,7 +1700,7 @@ def get_previous_non_blank_line(clean_lines, line_number):
     return ('', -1)
 
 
-def check_namespace_indentation(filename, clean_lines, line_number, file_extension, error):
+def check_namespace_indentation(filename, clean_lines, line_number, file_extension, file_state, error):
     """Looks for indentation errors inside of namespaces.
 
     Args:
@@ -1683,6 +1708,8 @@ def check_namespace_indentation(filename, clean_lines, line_number, file_extensi
       clean_lines: A CleansedLines instance containing the file.
       line_number: The number of the line to check.
       file_extension: The extension (dot not included) of the file.
+      file_state: A _FileState instance which maintains information about
+                  the state of things in the file.
       error: The function to call with any errors found.
     """
 
@@ -1694,8 +1721,10 @@ def check_namespace_indentation(filename, clean_lines, line_number, file_extensi
 
     current_indentation_level = len(namespace_match.group('namespace_indentation'))
     if current_indentation_level > 0:
-        error(filename, line_number, 'whitespace/indent', 4,
-              'namespace should never be indented.')
+        # Don't warn about an indented namespace if we already warned about indented code.
+        if not file_state.did_inside_namespace_indent_warning():
+            error(filename, line_number, 'whitespace/indent', 4,
+                  'namespace should never be indented.')
         return
     looking_for_semicolon = False;
     line_offset = 0
@@ -1706,7 +1735,8 @@ def check_namespace_indentation(filename, clean_lines, line_number, file_extensi
             continue
         if not current_indentation_level:
             if not (in_preprocessor_directive or looking_for_semicolon):
-                if not match(r'\S', current_line):
+                if not match(r'\S', current_line) and not file_state.did_inside_namespace_indent_warning():
+                    file_state.set_did_inside_namespace_indent_warning()
                     error(filename, line_number + line_offset, 'whitespace/indent', 4,
                           'Code inside a namespace should not be indented.')
             if in_preprocessor_directive or (current_line.strip()[0] == '#'): # This takes care of preprocessor directive syntax.
@@ -1871,7 +1901,8 @@ def check_braces(filename, clean_lines, line_number, error):
                   'This { should be at the end of the previous line')
     elif (search(r'\)\s*(const\s*)?{\s*$', line)
           and line.count('(') == line.count(')')
-          and not search(r'\b(if|for|foreach|while|switch)\b', line)):
+          and not search(r'\b(if|for|foreach|while|switch)\b', line)
+          and not match(r'\s+[A-Z_][A-Z_0-9]+\b', line)):
         error(filename, line_number, 'whitespace/braces', 4,
               'Place brace on its own line for function definitions.')
 
@@ -2124,7 +2155,7 @@ def get_line_width(line):
     return len(line)
 
 
-def check_style(filename, clean_lines, line_number, file_extension, error):
+def check_style(filename, clean_lines, line_number, file_extension, file_state, error):
     """Checks rules from the 'C++ style rules' section of cppguide.html.
 
     Most of these rules are hard to test (naming, comment style), but we
@@ -2136,6 +2167,8 @@ def check_style(filename, clean_lines, line_number, file_extension, error):
       clean_lines: A CleansedLines instance containing the file.
       line_number: The number of the line to check.
       file_extension: The extension (without the dot) of the filename.
+      file_state: A _FileState instance which maintains information about
+                  the state of things in the file.
       error: The function to call with any errors found.
     """
 
@@ -2203,7 +2236,7 @@ def check_style(filename, clean_lines, line_number, file_extension, error):
               'operators on the left side of the line instead of the right side.')
 
     # Some more style checks
-    check_namespace_indentation(filename, clean_lines, line_number, file_extension, error)
+    check_namespace_indentation(filename, clean_lines, line_number, file_extension, file_state, error)
     check_using_std(filename, clean_lines, line_number, error)
     check_max_min_macros(filename, clean_lines, line_number, error)
     check_switch_indentation(filename, clean_lines, line_number, error)
@@ -2309,7 +2342,7 @@ def _classify_include(filename, include, is_system, include_state):
     include_base = FileInfo(include).base_name()
 
     # If we haven't encountered a primary header, then be lenient in checking.
-    if not include_state.visited_primary_section() and target_base.startswith(include_base):
+    if not include_state.visited_primary_section() and target_base.find(include_base) != -1:
         return _PRIMARY_HEADER
     # If we already encountered a primary header, perform a strict comparison.
     # In case the two filename bases are the same then the above lenient check
@@ -2616,6 +2649,109 @@ def check_language(filename, clean_lines, line_number, file_extension, include_s
               'http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml#Namespaces'
               ' for more information.')
 
+    check_identifier_name_in_declaration(filename, line_number, line, error)
+
+
+def check_identifier_name_in_declaration(filename, line_number, line, error):
+    """Checks if identifier names contain any underscores.
+
+    As identifiers in libraries we are using have a bunch of
+    underscores, we only warn about the declarations of identifiers
+    and don't check use of identifiers.
+
+    Args:
+      filename: The name of the current file.
+      line_number: The number of the line to check.
+      line: The line of code to check.
+      error: The function to call with any errors found.
+    """
+    # We don't check a return statement.
+    if match(r'\s*return\b', line):
+        return
+
+    # Basically, a declaration is a type name followed by whitespaces
+    # followed by an identifier. The type name can be complicated
+    # due to type adjectives and templates. We remove them first to
+    # simplify the process to find declarations of identifiers.
+
+    # Convert "long long", "long double", and "long long int" to
+    # simple types, but don't remove simple "long".
+    line = sub(r'long (long )?(?=long|double|int)', '', line)
+    line = sub(r'\b(unsigned|signed|inline|using|static|const|volatile|auto|register|extern|typedef|restrict|struct|class|virtual)(?=\W)', '', line)
+
+    # Remove all template parameters by removing matching < and >.
+    # Loop until no templates are removed to remove nested templates.
+    while True:
+        line, number_of_replacements = subn(r'<([\w\s:]|::)+\s*[*&]*\s*>', '', line)
+        if not number_of_replacements:
+            break
+
+    # Declarations of local variables can be in condition expressions
+    # of control flow statements (e.g., "if (RenderObject* p = o->parent())").
+    # We remove the keywords and the first parenthesis.
+    #
+    # Declarations in "while", "if", and "switch" are different from
+    # other declarations in two aspects:
+    #
+    # - There can be only one declaration between the parentheses.
+    #   (i.e., you cannot write "if (int i = 0, j = 1) {}")
+    # - The variable must be initialized.
+    #   (i.e., you cannot write "if (int i) {}")
+    #
+    # and we will need different treatments for them.
+    line = sub(r'^\s*for\s*\(', '', line)
+    line, control_statement = subn(r'^\s*(while|else if|if|switch)\s*\(', '', line)
+
+    # Detect variable and functions.
+    type_regexp = r'\w([\w]|\s*[*&]\s*|::)+'
+    identifier_regexp = r'(?P<identifier>[\w:]+)'
+    character_after_identifier_regexp = r'(?P<character_after_identifier>[[;()=,])(?!=)'
+    declaration_without_type_regexp = r'\s*' + identifier_regexp + r'\s*' + character_after_identifier_regexp
+    declaration_with_type_regexp = r'\s*' + type_regexp + r'\s' + declaration_without_type_regexp
+    is_function_arguments = False
+    number_of_identifiers = 0
+    while True:
+        # If we are seeing the first identifier or arguments of a
+        # function, there should be a type name before an identifier.
+        if not number_of_identifiers or is_function_arguments:
+            declaration_regexp = declaration_with_type_regexp
+        else:
+            declaration_regexp = declaration_without_type_regexp
+
+        matched = match(declaration_regexp, line)
+        if not matched:
+            return
+        identifier = matched.group('identifier')
+        character_after_identifier = matched.group('character_after_identifier')
+
+        # If we removed a non-for-control statement, the character after
+        # the identifier should be '='. With this rule, we can avoid
+        # warning for cases like "if (val & INT_MAX) {".
+        if control_statement and character_after_identifier != '=':
+            return
+
+        is_function_arguments = is_function_arguments or character_after_identifier == '('
+
+        # Remove "m_" and "s_" to allow them.
+        modified_identifier = sub(r'(^|(?<=::))[ms]_', '', identifier)
+        if modified_identifier.find('_') >= 0:
+            # Various exceptions to the rule: JavaScript op codes functions, const_iterator.
+            if (not (filename.find('JavaScriptCore') >= 0 and modified_identifier.find('_op_') >= 0)
+                and not modified_identifier == "const_iterator"):
+                error(filename, line_number, 'readability/naming', 4, identifier + " is incorrectly named. Don't use underscores in your identifier names.")
+
+        # There can be only one declaration in non-for-control statements.
+        if control_statement:
+            return
+        # We should continue checking if this is a function
+        # declaration because we need to check its arguments.
+        # Also, we need to check multiple declarations.
+        if character_after_identifier != '(' and character_after_identifier != ',':
+            return
+
+        number_of_identifiers += 1
+        line = line[matched.end():]
+
 
 def check_c_style_cast(filename, line_number, line, raw_line, cast_type, pattern,
                        error):
@@ -2914,7 +3050,7 @@ def check_for_include_what_you_use(filename, clean_lines, include_state, error,
 
 def process_line(filename, file_extension,
                  clean_lines, line, include_state, function_state,
-                 class_state, error):
+                 class_state, file_state, error):
     """Processes a single line in the file.
 
     Args:
@@ -2927,6 +3063,8 @@ def process_line(filename, file_extension,
       function_state: A _FunctionState instance which counts function lines, etc.
       class_state: A _ClassState instance which maintains information about
                    the current stack of nested class declarations being parsed.
+      file_state: A _FileState instance which maintains information about
+                  the state of things in the file.
       error: A callable to which errors are reported, which takes 4 arguments:
              filename, line number, error level, and message
 
@@ -2936,7 +3074,7 @@ def process_line(filename, file_extension,
     if search(r'\bNOLINT\b', raw_lines[line]):  # ignore nolint lines
         return
     check_for_multiline_comments_and_strings(filename, clean_lines, line, error)
-    check_style(filename, clean_lines, line, file_extension, error)
+    check_style(filename, clean_lines, line, file_extension, file_state, error)
     check_language(filename, clean_lines, line, file_extension, include_state,
                    error)
     check_for_non_standard_constructs(filename, clean_lines, line,
@@ -2961,6 +3099,7 @@ def process_file_data(filename, file_extension, lines, error):
     include_state = _IncludeState()
     function_state = _FunctionState()
     class_state = _ClassState()
+    file_state = _FileState()
 
     check_for_copyright(filename, lines, error)
 
@@ -2971,7 +3110,7 @@ def process_file_data(filename, file_extension, lines, error):
     clean_lines = CleansedLines(lines)
     for line in xrange(clean_lines.num_lines()):
         process_line(filename, file_extension, clean_lines, line,
-                     include_state, function_state, class_state, error)
+                     include_state, function_state, class_state, file_state, error)
     class_state.check_finished(filename, error)
 
     check_for_include_what_you_use(filename, clean_lines, include_state, error)
@@ -3038,8 +3177,6 @@ def process_file(filename, error=error):
                   'One or more unexpected \\r (^M) found;'
                   'better to use only a \\n')
 
-    sys.stderr.write('Done processing %s\n' % filename)
-
 
 def print_usage(message):
     """Prints a brief usage string and exits, optionally with an error message.
diff --git a/WebKitTools/Scripts/modules/cpp_style_unittest.py b/WebKitTools/Scripts/modules/cpp_style_unittest.py
index d5637f4..75dd47e 100644
--- a/WebKitTools/Scripts/modules/cpp_style_unittest.py
+++ b/WebKitTools/Scripts/modules/cpp_style_unittest.py
@@ -120,9 +120,10 @@ class CppStyleTestBase(unittest.TestCase):
         function_state = cpp_style._FunctionState()
         ext = file_name[file_name.rfind('.') + 1:]
         class_state = cpp_style._ClassState()
+        file_state = cpp_style._FileState()
         cpp_style.process_line(file_name, ext, clean_lines, 0,
                                include_state, function_state,
-                               class_state, error_collector)
+                               class_state, file_state, error_collector)
         # Single-line lint tests are allowed to fail the 'unlintable function'
         # check.
         error_collector.remove_if_present(
@@ -137,8 +138,9 @@ class CppStyleTestBase(unittest.TestCase):
         lines = cpp_style.CleansedLines(lines)
         ext = file_name[file_name.rfind('.') + 1:]
         class_state = cpp_style._ClassState()
+        file_state = cpp_style._FileState()
         for i in xrange(lines.num_lines()):
-            cpp_style.check_style(file_name, lines, i, ext, error_collector)
+            cpp_style.check_style(file_name, lines, i, ext, file_state, error_collector)
             cpp_style.check_for_non_standard_constructs(file_name, lines, i, class_state,
                                                         error_collector)
         class_state.check_finished(file_name, error_collector)
@@ -934,15 +936,15 @@ class CppStyleTest(CppStyleTestBase):
         self.assert_lint('int doublesize[some_var * 2];', errmsg)
         self.assert_lint('int a[afunction()];', errmsg)
         self.assert_lint('int a[function(kMaxFooBars)];', errmsg)
-        self.assert_lint('bool a_list[items_->size()];', errmsg)
+        self.assert_lint('bool aList[items_->size()];', errmsg)
         self.assert_lint('namespace::Type buffer[len+1];', errmsg)
 
         self.assert_lint('int a[64];', '')
         self.assert_lint('int a[0xFF];', '')
         self.assert_lint('int first[256], second[256];', '')
-        self.assert_lint('int array_name[kCompileTimeConstant];', '')
+        self.assert_lint('int arrayName[kCompileTimeConstant];', '')
         self.assert_lint('char buf[somenamespace::kBufSize];', '')
-        self.assert_lint('int array_name[ALL_CAPS];', '')
+        self.assert_lint('int arrayName[ALL_CAPS];', '')
         self.assert_lint('AClass array1[foo::bar::ALL_CAPS];', '')
         self.assert_lint('int a[kMaxStrLen + 1];', '')
         self.assert_lint('int a[sizeof(foo)];', '')
@@ -1116,6 +1118,12 @@ class CppStyleTest(CppStyleTestBase):
             'if (condition) {',
             '')
         self.assert_multi_line_lint(
+            '    MACRO1(macroArg) {',
+            '')
+        self.assert_multi_line_lint(
+            'ACCESSOR_GETTER(MessageEventPorts) {',
+            'Place brace on its own line for function definitions.  [whitespace/braces] [4]')
+        self.assert_multi_line_lint(
             'int foo() {',
             'Place brace on its own line for function definitions.  [whitespace/braces] [4]')
         self.assert_multi_line_lint(
@@ -1271,6 +1279,8 @@ class CppStyleTest(CppStyleTestBase):
         self.assert_lint('a = 1 << 20', '')
         self.assert_multi_line_lint('#include "config.h"\n#include <sys/io.h>\n',
                                     '')
+        self.assert_multi_line_lint('#include "config.h"\n#import <foo/bar.h>\n',
+                                    '')
 
     def test_spacing_before_last_semicolon(self):
         self.assert_lint('call_function() ;',
@@ -1520,14 +1530,14 @@ class CppStyleTest(CppStyleTestBase):
 
     def test_indent(self):
         self.assert_lint('static int noindent;', '')
-        self.assert_lint('    int four_space_indent;', '')
-        self.assert_lint(' int one_space_indent;',
+        self.assert_lint('    int fourSpaceIndent;', '')
+        self.assert_lint(' int oneSpaceIndent;',
                          'Weird number of spaces at line-start.  '
                          'Are you using a 4-space indent?  [whitespace/indent] [3]')
-        self.assert_lint('   int three_space_indent;',
+        self.assert_lint('   int threeSpaceIndent;',
                          'Weird number of spaces at line-start.  '
                          'Are you using a 4-space indent?  [whitespace/indent] [3]')
-        self.assert_lint(' char* one_space_indent = "public:";',
+        self.assert_lint(' char* oneSpaceIndent = "public:";',
                          'Weird number of spaces at line-start.  '
                          'Are you using a 4-space indent?  [whitespace/indent] [3]')
         self.assert_lint(' public:', '')
@@ -1960,7 +1970,7 @@ class CppStyleTest(CppStyleTestBase):
         self.assert_lint('double const static foo = 2.0;',
                          build_storage_class_error_message)
 
-        self.assert_lint('uint64 typedef unsigned_long_long;',
+        self.assert_lint('uint64 typedef unsignedLongLong;',
                          build_storage_class_error_message)
 
         self.assert_lint('int register foo = 0;',
@@ -2044,6 +2054,7 @@ class CppStyleTest(CppStyleTestBase):
                          'Changing pointer instead of value (or unused value of '
                          'operator*).  [runtime/invalid_increment] [5]')
 
+
 class CleansedLinesTest(unittest.TestCase):
     def test_init(self):
         lines = ['Line 1',
@@ -2305,6 +2316,10 @@ class OrderOfIncludesTest(CppStyleTestBase):
                          classify_include('fooCustom.cpp',
                                           'foo.h',
                                           False, include_state))
+        self.assertEqual(cpp_style._PRIMARY_HEADER,
+                         classify_include('PrefixFooCustom.cpp',
+                                          'Foo.h',
+                                          False, include_state))
         # Tricky example where both includes might be classified as primary.
         self.assert_language_rules_check('ScrollbarThemeWince.cpp',
                                          '#include "config.h"\n'
@@ -2828,7 +2843,16 @@ class WebKitStyleTest(CppStyleTestBase):
             '};\n'
             '};\n'
             '}',
-            ['Code inside a namespace should not be indented.  [whitespace/indent] [4]', 'namespace should never be indented.  [whitespace/indent] [4]'],
+            'Code inside a namespace should not be indented.  [whitespace/indent] [4]',
+            'foo.h')
+        self.assert_multi_line_lint(
+            'namespace OuterNamespace {\n'
+            '    class Document {\n'
+            '    namespace InnerNamespace {\n'
+            '};\n'
+            '};\n'
+            '}',
+            'Code inside a namespace should not be indented.  [whitespace/indent] [4]',
             'foo.h')
         self.assert_multi_line_lint(
             'namespace WebCore {\n'
@@ -3584,8 +3608,104 @@ class WebKitStyleTest(CppStyleTestBase):
             'foo.h')
 
     def test_names(self):
-        # FIXME: Implement this.
-        pass
+        name_error_message = " is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]"
+
+        # Basic cases from WebKit style guide.
+        self.assert_lint('struct Data;', '')
+        self.assert_lint('size_t bufferSize;', '')
+        self.assert_lint('class HTMLDocument;', '')
+        self.assert_lint('String mimeType();', '')
+        self.assert_lint('size_t buffer_size;',
+                         'buffer_size' + name_error_message)
+        self.assert_lint('short m_length;', '')
+        self.assert_lint('short _length;',
+                         '_length' + name_error_message)
+        self.assert_lint('short length_;',
+                         'length_' + name_error_message)
+
+        # Pointers, references, functions, templates, and adjectives.
+        self.assert_lint('char* under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('const int UNDER_SCORE;',
+                         'UNDER_SCORE' + name_error_message)
+        self.assert_lint('static inline const char const& const under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('WebCore::RenderObject* under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('int func_name();',
+                         'func_name' + name_error_message)
+        self.assert_lint('RefPtr<RenderObject*> under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('WTF::Vector<WTF::RefPtr<const RenderObject* const> > under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('int under_score[];',
+                         'under_score' + name_error_message)
+        self.assert_lint('struct dirent* under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('long under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('long long under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('long double under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('long long int under_score;',
+                         'under_score' + name_error_message)
+
+        # Declarations in control statement.
+        self.assert_lint('if (int under_score = 42) {',
+                         'under_score' + name_error_message)
+        self.assert_lint('else if (int under_score = 42) {',
+                         'under_score' + name_error_message)
+        self.assert_lint('for (int under_score = 42; cond; i++) {',
+                         'under_score' + name_error_message)
+        self.assert_lint('while (foo & under_score = bar) {',
+                         'under_score' + name_error_message)
+        self.assert_lint('for (foo * under_score = p; cond; i++) {',
+                         'under_score' + name_error_message)
+        self.assert_lint('for (foo * under_score; cond; i++) {',
+                         'under_score' + name_error_message)
+        self.assert_lint('while (foo & value_in_thirdparty_library) {', '')
+        self.assert_lint('while (foo * value_in_thirdparty_library) {', '')
+        self.assert_lint('if (mli && S_OK == mli->foo()) {', '')
+
+        # More member variables and functions.
+        self.assert_lint('int SomeClass::s_validName', '')
+        self.assert_lint('int m_under_score;',
+                         'm_under_score' + name_error_message)
+        self.assert_lint('int SomeClass::s_under_score = 0;',
+                         'SomeClass::s_under_score' + name_error_message)
+        self.assert_lint('int SomeClass::under_score = 0;',
+                         'SomeClass::under_score' + name_error_message)
+
+        # Other statements.
+        self.assert_lint('return INT_MAX;', '')
+        self.assert_lint('return_t under_score;',
+                         'under_score' + name_error_message)
+        self.assert_lint('goto under_score;',
+                         'under_score' + name_error_message)
+
+        # Multiple variables in one line.
+        self.assert_lint('void myFunction(int variable1, int another_variable);',
+                         'another_variable' + name_error_message)
+        self.assert_lint('int variable1, another_variable;',
+                         'another_variable' + name_error_message)
+        self.assert_lint('int first_variable, secondVariable;',
+                         'first_variable' + name_error_message)
+        self.assert_lint('void my_function(int variable_1, int variable_2);',
+                         ['my_function' + name_error_message,
+                          'variable_1' + name_error_message,
+                          'variable_2' + name_error_message])
+        self.assert_lint('for (int variable_1, variable_2;;) {',
+                         ['variable_1' + name_error_message,
+                          'variable_2' + name_error_message])
+
+        # There is an exception for op code functions but only in the JavaScriptCore directory.
+        self.assert_lint('void this_op_code(int var1, int var2)', '', 'JavaScriptCore/foo.cpp')
+        self.assert_lint('void this_op_code(int var1, int var2)', 'this_op_code' + name_error_message)
+
+        # const_iterator is allowed as well.
+        self.assert_lint('typedef VectorType::const_iterator const_iterator;', '')
+
 
     def test_other(self):
         # FIXME: Implement this.
diff --git a/WebKitTools/Scripts/modules/executive.py b/WebKitTools/Scripts/modules/executive.py
new file mode 100644
index 0000000..b73e17d
--- /dev/null
+++ b/WebKitTools/Scripts/modules/executive.py
@@ -0,0 +1,124 @@
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+import StringIO
+import subprocess
+import sys
+
+from modules.logging import tee
+
+
+class ScriptError(Exception):
+    def __init__(self, message=None, script_args=None, exit_code=None, output=None, cwd=None):
+        if not message:
+            message = 'Failed to run "%s"' % script_args
+            if exit_code:
+                message += " exit_code: %d" % exit_code
+            if cwd:
+                message += " cwd: %s" % cwd
+
+        Exception.__init__(self, message)
+        self.script_args = script_args # 'args' is already used by Exception
+        self.exit_code = exit_code
+        self.output = output
+        self.cwd = cwd
+
+    def message_with_output(self, output_limit=500):
+        if self.output:
+            if output_limit and len(self.output) > output_limit:
+                 return "%s\nLast %s characters of output:\n%s" % (self, output_limit, self.output[-output_limit:])
+            return "%s\n%s" % (self, self.output)
+        return str(self)
+
+
+# FIXME: This should not be a global static.
+# New code should use Executive.run_command directly instead
+def run_command(*args, **kwargs):
+    return Executive().run_command(*args, **kwargs)
+
+
+class Executive(object):
+    def _run_command_with_teed_output(self, args, teed_output):
+        child_process = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+
+        # Use our own custom wait loop because Popen ignores a tee'd stderr/stdout.
+        # FIXME: This could be improved not to flatten output to stdout.
+        while True:
+            output_line = child_process.stdout.readline()
+            if output_line == "" and child_process.poll() != None:
+                return child_process.poll()
+            teed_output.write(output_line)
+
+    def run_and_throw_if_fail(self, args, quiet=False):
+        # Cache the child's output locally so it can be used for error reports.
+        child_out_file = StringIO.StringIO()
+        if quiet:
+            dev_null = open(os.devnull, "w")
+        child_stdout = tee(child_out_file, dev_null if quiet else sys.stdout)
+        exit_code = self._run_command_with_teed_output(args, child_stdout)
+        if quiet:
+            dev_null.close()
+
+        child_output = child_out_file.getvalue()
+        child_out_file.close()
+
+        if exit_code:
+            raise ScriptError(script_args=args, exit_code=exit_code, output=child_output)
+
+    # Error handlers do not need to be static methods once all callers are updated to use an Executive object.
+    @staticmethod
+    def default_error_handler(error):
+        raise error
+
+    @staticmethod
+    def ignore_error(error):
+        pass
+
+    # FIXME: This should be merged with run_and_throw_if_fail
+    def run_command(self, args, cwd=None, input=None, error_handler=None, return_exit_code=False, return_stderr=True):
+        if hasattr(input, 'read'): # Check if the input is a file.
+            stdin = input
+            string_to_communicate = None
+        else:
+            stdin = subprocess.PIPE if input else None
+            string_to_communicate = input
+        if return_stderr:
+            stderr = subprocess.STDOUT
+        else:
+            stderr = None
+        process = subprocess.Popen(args, stdin=stdin, stdout=subprocess.PIPE, stderr=stderr, cwd=cwd)
+        output = process.communicate(string_to_communicate)[0]
+        exit_code = process.wait()
+        if exit_code:
+            script_error = ScriptError(script_args=args, exit_code=exit_code, output=output, cwd=cwd)
+            (error_handler or self.default_error_handler)(script_error)
+        if return_exit_code:
+            return exit_code
+        return output
diff --git a/WebKitTools/Scripts/modules/grammar.py b/WebKitTools/Scripts/modules/grammar.py
new file mode 100644
index 0000000..dd2967a
--- /dev/null
+++ b/WebKitTools/Scripts/modules/grammar.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import re
+
+def plural(noun):
+    # This is a dumb plural() implementation which was just enough for our uses.
+    if re.search("h$", noun):
+        return noun + "es"
+    else:
+        return noun + "s"
+
+def pluralize(noun, count):
+    if count != 1:
+        noun = plural(noun)
+    return "%d %s" % (count, noun)
diff --git a/WebKitTools/Scripts/modules/landingsequence.py b/WebKitTools/Scripts/modules/landingsequence.py
new file mode 100644
index 0000000..90683f4
--- /dev/null
+++ b/WebKitTools/Scripts/modules/landingsequence.py
@@ -0,0 +1,113 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from modules.comments import bug_comment_from_commit_text
+from modules.executive import ScriptError
+from modules.logging import log
+from modules.scm import CheckoutNeedsUpdate
+from modules.webkitport import WebKitPort
+from modules.workqueue import WorkQueue
+from modules.buildsteps import CleanWorkingDirectoryStep, UpdateStep, ApplyPatchStep, EnsureBuildersAreGreenStep, BuildStep, RunTestsStep, CommitStep, ClosePatchStep, CloseBugStep
+
+
+class LandingSequenceErrorHandler():
+    @classmethod
+    def handle_script_error(cls, tool, patch, script_error):
+        raise NotImplementedError, "subclasses must implement"
+
+# FIXME: This class is slowing being killed and replaced with StepSequence.
+class LandingSequence:
+    def __init__(self, patch, options, tool):
+        self._patch = patch
+        self._options = options
+        self._tool = tool
+        self._port = WebKitPort.port(self._options.port)
+
+    def run(self):
+        self.clean()
+        self.update()
+        self.apply_patch()
+        self.check_builders()
+        self.build()
+        self.test()
+        commit_log = self.commit()
+        self.close_patch(commit_log)
+        self.close_bug()
+
+    def run_and_handle_errors(self):
+        try:
+            self.run()
+        except CheckoutNeedsUpdate, e:
+            log("Commit failed because the checkout is out of date.  Please update and try again.")
+            log("You can pass --no-build to skip building/testing after update if you believe the new commits did not affect the results.")
+            WorkQueue.exit_after_handled_error(e)
+        except ScriptError, e:
+            if not self._options.quiet:
+                log(e.message_with_output())
+            if self._options.parent_command:
+                command = self._tool.command_by_name(self._options.parent_command)
+                command.handle_script_error(self._tool, self._patch, e)
+            WorkQueue.exit_after_handled_error(e)
+
+    def clean(self):
+        step = CleanWorkingDirectoryStep(self._tool, self._options)
+        step.run()
+
+    def update(self):
+        step = UpdateStep(self._tool, self._options)
+        step.run()
+
+    def apply_patch(self):
+        step = ApplyPatchStep(self._tool, self._options, self._patch)
+        step.run()
+
+    def check_builders(self):
+        step = EnsureBuildersAreGreenStep(self._tool, self._options)
+        step.run()
+
+    def build(self):
+        step = BuildStep(self._tool, self._options)
+        step.run()
+
+    def test(self):
+        step = RunTestsStep(self._tool, self._options)
+        step.run()
+
+    def commit(self):
+        step = CommitStep(self._tool, self._options)
+        return step.run()
+
+    def close_patch(self, commit_log):
+        step = ClosePatchStep(self._tool, self._options, self._patch)
+        step.run(commit_log)
+
+    def close_bug(self):
+        step = CloseBugStep(self._tool, self._options, self._patch)
+        step.run()
diff --git a/WebKitTools/Scripts/modules/logging.py b/WebKitTools/Scripts/modules/logging.py
index cbccacf..7b7cec5 100644
--- a/WebKitTools/Scripts/modules/logging.py
+++ b/WebKitTools/Scripts/modules/logging.py
@@ -29,6 +29,7 @@
 #
 # WebKit's Python module for logging
 
+import os
 import sys
 
 def log(string):
@@ -46,3 +47,38 @@ class tee:
     def write(self, string):
         for file in self.files:
             file.write(string)
+
+class OutputTee:
+    def __init__(self):
+        self._original_stdout = None
+        self._original_stderr = None
+        self._files_for_output = []
+
+    def add_log(self, path):
+        log_file = self._open_log_file(path)
+        self._files_for_output.append(log_file)
+        self._tee_outputs_to_files(self._files_for_output)
+        return log_file
+
+    def remove_log(self, log_file):
+        self._files_for_output.remove(log_file)
+        self._tee_outputs_to_files(self._files_for_output)
+        log_file.close()
+
+    @staticmethod
+    def _open_log_file(log_path):
+        (log_directory, log_name) = os.path.split(log_path)
+        if log_directory and not os.path.exists(log_directory):
+            os.makedirs(log_directory)
+        return open(log_path, 'a+')
+
+    def _tee_outputs_to_files(self, files):
+        if not self._original_stdout:
+            self._original_stdout = sys.stdout
+            self._original_stderr = sys.stderr
+        if files and len(files):
+            sys.stdout = tee(self._original_stdout, *files)
+            sys.stderr = tee(self._original_stderr, *files)
+        else:
+            sys.stdout = self._original_stdout
+            sys.stderr = self._original_stderr
diff --git a/WebKitTools/Scripts/modules/logging_unittest.py b/WebKitTools/Scripts/modules/logging_unittest.py
index 7d41e56..b09a563 100644
--- a/WebKitTools/Scripts/modules/logging_unittest.py
+++ b/WebKitTools/Scripts/modules/logging_unittest.py
@@ -32,8 +32,8 @@ import StringIO
 import tempfile
 import unittest
 
+from modules.executive import ScriptError
 from modules.logging import *
-from modules.scm import ScriptError
 
 class LoggingTest(unittest.TestCase):
 
diff --git a/WebKitTools/Scripts/modules/mock.py b/WebKitTools/Scripts/modules/mock.py
new file mode 100644
index 0000000..f6f328e
--- /dev/null
+++ b/WebKitTools/Scripts/modules/mock.py
@@ -0,0 +1,309 @@
+# mock.py

+# Test tools for mocking and patching.

+# Copyright (C) 2007-2009 Michael Foord

+# E-mail: fuzzyman AT voidspace DOT org DOT uk

+

+# mock 0.6.0

+# http://www.voidspace.org.uk/python/mock/

+

+# Released subject to the BSD License

+# Please see http://www.voidspace.org.uk/python/license.shtml

+

+# 2009-11-25: Licence downloaded from above URL.

+# BEGIN DOWNLOADED LICENSE

+#

+# Copyright (c) 2003-2009, Michael Foord

+# All rights reserved.

+# E-mail : fuzzyman AT voidspace DOT org DOT uk

+# 

+# Redistribution and use in source and binary forms, with or without

+# modification, are permitted provided that the following conditions are

+# met:

+# 

+# 

+#     * Redistributions of source code must retain the above copyright

+#       notice, this list of conditions and the following disclaimer.

+# 

+#     * Redistributions in binary form must reproduce the above

+#       copyright notice, this list of conditions and the following

+#       disclaimer in the documentation and/or other materials provided

+#       with the distribution.

+# 

+#     * Neither the name of Michael Foord nor the name of Voidspace

+#       may be used to endorse or promote products derived from this

+#       software without specific prior written permission.

+# 

+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+#

+# END DOWNLOADED LICENSE

+

+# Scripts maintained at http://www.voidspace.org.uk/python/index.shtml

+# Comments, suggestions and bug reports welcome.

+

+

+__all__ = (

+    'Mock',

+    'patch',

+    'patch_object',

+    'sentinel',

+    'DEFAULT'

+)

+

+__version__ = '0.6.0'

+

+class SentinelObject(object):

+    def __init__(self, name):

+        self.name = name

+        

+    def __repr__(self):

+        return '<SentinelObject "%s">' % self.name

+

+

+class Sentinel(object):

+    def __init__(self):

+        self._sentinels = {}

+        

+    def __getattr__(self, name):

+        return self._sentinels.setdefault(name, SentinelObject(name))

+    

+    

+sentinel = Sentinel()

+

+DEFAULT = sentinel.DEFAULT

+

+class OldStyleClass:

+    pass

+ClassType = type(OldStyleClass)

+

+def _is_magic(name):

+    return '__%s__' % name[2:-2] == name

+

+def _copy(value):

+    if type(value) in (dict, list, tuple, set):

+        return type(value)(value)

+    return value

+

+

+class Mock(object):

+

+    def __init__(self, spec=None, side_effect=None, return_value=DEFAULT, 

+                 name=None, parent=None, wraps=None):

+        self._parent = parent

+        self._name = name

+        if spec is not None and not isinstance(spec, list):

+            spec = [member for member in dir(spec) if not _is_magic(member)]

+        

+        self._methods = spec

+        self._children = {}

+        self._return_value = return_value

+        self.side_effect = side_effect

+        self._wraps = wraps

+        

+        self.reset_mock()

+        

+

+    def reset_mock(self):

+        self.called = False

+        self.call_args = None

+        self.call_count = 0

+        self.call_args_list = []

+        self.method_calls = []

+        for child in self._children.itervalues():

+            child.reset_mock()

+        if isinstance(self._return_value, Mock):

+            self._return_value.reset_mock()

+        

+    

+    def __get_return_value(self):

+        if self._return_value is DEFAULT:

+            self._return_value = Mock()

+        return self._return_value

+    

+    def __set_return_value(self, value):

+        self._return_value = value

+        

+    return_value = property(__get_return_value, __set_return_value)

+

+

+    def __call__(self, *args, **kwargs):

+        self.called = True

+        self.call_count += 1

+        self.call_args = (args, kwargs)

+        self.call_args_list.append((args, kwargs))

+        

+        parent = self._parent

+        name = self._name

+        while parent is not None:

+            parent.method_calls.append((name, args, kwargs))

+            if parent._parent is None:

+                break

+            name = parent._name + '.' + name

+            parent = parent._parent

+        

+        ret_val = DEFAULT

+        if self.side_effect is not None:

+            if (isinstance(self.side_effect, Exception) or 

+                isinstance(self.side_effect, (type, ClassType)) and

+                issubclass(self.side_effect, Exception)):

+                raise self.side_effect

+            

+            ret_val = self.side_effect(*args, **kwargs)

+            if ret_val is DEFAULT:

+                ret_val = self.return_value

+        

+        if self._wraps is not None and self._return_value is DEFAULT:

+            return self._wraps(*args, **kwargs)

+        if ret_val is DEFAULT:

+            ret_val = self.return_value

+        return ret_val

+    

+    

+    def __getattr__(self, name):

+        if self._methods is not None:

+            if name not in self._methods:

+                raise AttributeError("Mock object has no attribute '%s'" % name)

+        elif _is_magic(name):

+            raise AttributeError(name)

+        

+        if name not in self._children:

+            wraps = None

+            if self._wraps is not None:

+                wraps = getattr(self._wraps, name)

+            self._children[name] = Mock(parent=self, name=name, wraps=wraps)

+            

+        return self._children[name]

+    

+    

+    def assert_called_with(self, *args, **kwargs):

+        assert self.call_args == (args, kwargs), 'Expected: %s\nCalled with: %s' % ((args, kwargs), self.call_args)

+        

+

+def _dot_lookup(thing, comp, import_path):

+    try:

+        return getattr(thing, comp)

+    except AttributeError:

+        __import__(import_path)

+        return getattr(thing, comp)

+

+

+def _importer(target):

+    components = target.split('.')

+    import_path = components.pop(0)

+    thing = __import__(import_path)

+

+    for comp in components:

+        import_path += ".%s" % comp

+        thing = _dot_lookup(thing, comp, import_path)

+    return thing

+

+

+class _patch(object):

+    def __init__(self, target, attribute, new, spec, create):

+        self.target = target

+        self.attribute = attribute

+        self.new = new

+        self.spec = spec

+        self.create = create

+        self.has_local = False

+

+

+    def __call__(self, func):

+        if hasattr(func, 'patchings'):

+            func.patchings.append(self)

+            return func

+

+        def patched(*args, **keywargs):

+            # don't use a with here (backwards compatability with 2.5)

+            extra_args = []

+            for patching in patched.patchings:

+                arg = patching.__enter__()

+                if patching.new is DEFAULT:

+                    extra_args.append(arg)

+            args += tuple(extra_args)

+            try:

+                return func(*args, **keywargs)

+            finally:

+                for patching in getattr(patched, 'patchings', []):

+                    patching.__exit__()

+

+        patched.patchings = [self]

+        patched.__name__ = func.__name__ 

+        patched.compat_co_firstlineno = getattr(func, "compat_co_firstlineno", 

+                                                func.func_code.co_firstlineno)

+        return patched

+

+

+    def get_original(self):

+        target = self.target

+        name = self.attribute

+        create = self.create

+        

+        original = DEFAULT

+        if _has_local_attr(target, name):

+            try:

+                original = target.__dict__[name]

+            except AttributeError:

+                # for instances of classes with slots, they have no __dict__

+                original = getattr(target, name)

+        elif not create and not hasattr(target, name):

+            raise AttributeError("%s does not have the attribute %r" % (target, name))

+        return original

+

+    

+    def __enter__(self):

+        new, spec, = self.new, self.spec

+        original = self.get_original()

+        if new is DEFAULT:

+            # XXXX what if original is DEFAULT - shouldn't use it as a spec

+            inherit = False

+            if spec == True:

+                # set spec to the object we are replacing

+                spec = original

+                if isinstance(spec, (type, ClassType)):

+                    inherit = True

+            new = Mock(spec=spec)

+            if inherit:

+                new.return_value = Mock(spec=spec)

+        self.temp_original = original

+        setattr(self.target, self.attribute, new)

+        return new

+

+

+    def __exit__(self, *_):

+        if self.temp_original is not DEFAULT:

+            setattr(self.target, self.attribute, self.temp_original)

+        else:

+            delattr(self.target, self.attribute)

+        del self.temp_original

+            

+                

+def patch_object(target, attribute, new=DEFAULT, spec=None, create=False):

+    return _patch(target, attribute, new, spec, create)

+

+

+def patch(target, new=DEFAULT, spec=None, create=False):

+    try:

+        target, attribute = target.rsplit('.', 1)    

+    except (TypeError, ValueError):

+        raise TypeError("Need a valid target to patch. You supplied: %r" % (target,))

+    target = _importer(target)

+    return _patch(target, attribute, new, spec, create)

+

+

+

+def _has_local_attr(obj, name):

+    try:

+        return name in vars(obj)

+    except TypeError:

+        # objects without a __dict__

+        return hasattr(obj, name)

diff --git a/WebKitTools/Scripts/modules/mock_bugzillatool.py b/WebKitTools/Scripts/modules/mock_bugzillatool.py
new file mode 100644
index 0000000..e600947
--- /dev/null
+++ b/WebKitTools/Scripts/modules/mock_bugzillatool.py
@@ -0,0 +1,153 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+
+from modules.mock import Mock
+from modules.scm import CommitMessage
+
+
+class MockBugzilla(Mock):
+    patch1 = {
+        "id" : 197,
+        "bug_id" : 42,
+        "url" : "http://example.com/197",
+        "is_obsolete" : False,
+        "reviewer" : "Reviewer1",
+        "attacher_email" : "Contributer1",
+    }
+    patch2 = {
+        "id" : 128,
+        "bug_id" : 42,
+        "url" : "http://example.com/128",
+        "is_obsolete" : False,
+        "reviewer" : "Reviewer2",
+        "attacher_email" : "Contributer2",
+    }
+    bug_server_url = "http://example.com"
+
+    def fetch_bug_ids_from_commit_queue(self):
+        return [42, 75]
+
+    def fetch_attachment_ids_from_review_queue(self):
+        return [197, 128]
+
+    def fetch_patches_from_commit_queue(self):
+        return [self.patch1, self.patch2]
+
+    def fetch_patches_from_pending_commit_list(self):
+        return [self.patch1, self.patch2]
+
+    def fetch_reviewed_patches_from_bug(self, bug_id):
+        if bug_id == 42:
+            return [self.patch1, self.patch2]
+        return None
+
+    def fetch_attachments_from_bug(self, bug_id):
+        if bug_id == 42:
+            return [self.patch1, self.patch2]
+        return None
+
+    def fetch_patches_from_bug(self, bug_id):
+        if bug_id == 42:
+            return [self.patch1, self.patch2]
+        return None
+
+    def fetch_attachment(self, attachment_id):
+        if attachment_id == 197:
+            return self.patch1
+        if attachment_id == 128:
+            return self.patch2
+        raise Exception("Bogus attachment_id in fetch_attachment.")
+
+    def bug_url_for_bug_id(self, bug_id):
+        return "%s/%s" % (self.bug_server_url, bug_id)
+
+    def attachment_url_for_id(self, attachment_id, action):
+        action_param = ""
+        if action and action != "view":
+            action_param = "&action=%s" % action
+        return "%s/%s%s" % (self.bug_server_url, attachment_id, action_param)
+
+
+class MockBuildBot(Mock):
+    def builder_statuses(self):
+        return [{
+            "name": "Builder1",
+            "is_green": True
+        }, {
+            "name": "Builder2",
+            "is_green": True
+        }]
+
+    def red_core_builders_names(self):
+        return []
+
+class MockSCM(Mock):
+    def __init__(self):
+        Mock.__init__(self)
+        self.checkout_root = os.getcwd()
+
+    def create_patch(self):
+        return "Patch1"
+
+    def commit_ids_from_commitish_arguments(self, args):
+        return ["Commitish1", "Commitish2"]
+
+    def commit_message_for_local_commit(self, commit_id):
+        if commit_id == "Commitish1":
+            return CommitMessage("CommitMessage1\nhttps://bugs.example.org/show_bug.cgi?id=42\n")
+        if commit_id == "Commitish2":
+            return CommitMessage("CommitMessage2\nhttps://bugs.example.org/show_bug.cgi?id=75\n")
+        raise Exception("Bogus commit_id in commit_message_for_local_commit.")
+
+    def create_patch_from_local_commit(self, commit_id):
+        if commit_id == "Commitish1":
+            return "Patch1"
+        if commit_id == "Commitish2":
+            return "Patch2"
+        raise Exception("Bogus commit_id in commit_message_for_local_commit.")
+
+    def modified_changelogs(self):
+        # Ideally we'd return something more interesting here.
+        # The problem is that LandDiff will try to actually read the path from disk!
+        return []
+
+
+class MockBugzillaTool():
+    def __init__(self):
+        self.bugs = MockBugzilla()
+        self.buildbot = MockBuildBot()
+        self.executive = Mock()
+        self._scm = MockSCM()
+
+    def scm(self):
+        return self._scm
+
+    def path(self):
+        return "echo"
diff --git a/WebKitTools/Scripts/modules/multicommandtool.py b/WebKitTools/Scripts/modules/multicommandtool.py
new file mode 100644
index 0000000..0475cf1
--- /dev/null
+++ b/WebKitTools/Scripts/modules/multicommandtool.py
@@ -0,0 +1,253 @@
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# MultiCommandTool provides a framework for writing svn-like/git-like tools
+# which are called with the following format:
+# tool-name [global options] command-name [command options]
+
+import sys
+
+from optparse import OptionParser, IndentedHelpFormatter, SUPPRESS_USAGE, make_option
+
+from modules.grammar import pluralize
+from modules.logging import log
+
+class Command(object):
+    name = None
+    # show_in_main_help = False # Subclasses must define show_in_main_help, we leave it out here to enforce that.
+    def __init__(self, help_text, argument_names=None, options=None, requires_local_commits=False):
+        self.help_text = help_text
+        self.argument_names = argument_names
+        self.required_arguments = self._parse_required_arguments(argument_names)
+        self.options = options
+        self.option_parser = HelpPrintingOptionParser(usage=SUPPRESS_USAGE, add_help_option=False, option_list=self.options)
+        self.requires_local_commits = requires_local_commits
+        self.tool = None
+
+    # The tool calls bind_to_tool on each Command after adding it to its list.
+    def bind_to_tool(self, tool):
+        # Command instances can only be bound to one tool at a time.
+        if self.tool and tool != self.tool:
+            raise Exception("Command already bound to tool!")
+        self.tool = tool
+
+    @staticmethod
+    def _parse_required_arguments(argument_names):
+        required_args = []
+        if not argument_names:
+            return required_args
+        split_args = argument_names.split(" ")
+        for argument in split_args:
+            if argument[0] == '[':
+                # For now our parser is rather dumb.  Do some minimal validation that
+                # we haven't confused it.
+                if argument[-1] != ']':
+                    raise Exception("Failure to parse argument string %s.  Argument %s is missing ending ]" % (argument_names, argument))
+            else:
+                required_args.append(argument)
+        return required_args
+
+    def name_with_arguments(self):
+        usage_string = self.name
+        if self.options:
+            usage_string += " [options]"
+        if self.argument_names:
+            usage_string += " " + self.argument_names
+        return usage_string
+
+    def parse_args(self, args):
+        return self.option_parser.parse_args(args)
+
+    def check_arguments_and_execute(self, args_after_command_name, tool):
+        (command_options, command_args) = self.parse_args(args_after_command_name)
+
+        if len(command_args) < len(self.required_arguments):
+            log("%s required, %s provided.  Provided: %s  Required: %s\nSee '%s help %s' for usage." % (
+                pluralize("argument", len(self.required_arguments)),
+                pluralize("argument", len(command_args)),
+                "'%s'" % " ".join(command_args),
+                " ".join(self.required_arguments),
+                tool.name(),
+                self.name))
+            return 1
+        return self.execute(command_options, command_args, tool) or 0
+
+    def standalone_help(self):
+        help_text = self.name_with_arguments().ljust(len(self.name_with_arguments()) + 3) + self.help_text + "\n"
+        help_text += self.option_parser.format_option_help(IndentedHelpFormatter())
+        return help_text
+
+    def execute(self, options, args, tool):
+        raise NotImplementedError, "subclasses must implement"
+
+
+class HelpPrintingOptionParser(OptionParser):
+    def __init__(self, epilog_method=None, *args, **kwargs):
+        self.epilog_method = epilog_method
+        OptionParser.__init__(self, *args, **kwargs)
+
+    def error(self, msg):
+        self.print_usage(sys.stderr)
+        error_message = "%s: error: %s\n" % (self.get_prog_name(), msg)
+        error_message += "\nType \"%s --help\" to see usage.\n" % self.get_prog_name()
+        self.exit(1, error_message)
+
+    # We override format_epilog to avoid the default formatting which would paragraph-wrap the epilog
+    # and also to allow us to compute the epilog lazily instead of in the constructor (allowing it to be context sensitive).
+    def format_epilog(self, epilog):
+        if self.epilog_method:
+            return "\n%s\n" % self.epilog_method()
+        return ""
+
+
+class HelpCommand(Command):
+    name = "help"
+    show_in_main_help = False
+
+    def __init__(self):
+        options = [
+            make_option("-a", "--all-commands", action="store_true", dest="show_all_commands", help="Print all available commands"),
+        ]
+        Command.__init__(self, "Display information about this program or its subcommands", "[COMMAND]", options=options)
+        self.show_all_commands = False # A hack used to pass --all-commands to _help_epilog even though it's called by the OptionParser.
+
+    def _help_epilog(self):
+        # Only show commands which are relevant to this checkout's SCM system.  Might this be confusing to some users?
+        if self.show_all_commands:
+            epilog = "All %prog commands:\n"
+            relevant_commands = self.tool.commands[:]
+        else:
+            epilog = "Common %prog commands:\n"
+            relevant_commands = filter(self.tool.should_show_in_main_help, self.tool.commands)
+        longest_name_length = max(map(lambda command: len(command.name), relevant_commands))
+        relevant_commands.sort(lambda a, b: cmp(a.name, b.name))
+        command_help_texts = map(lambda command: "   %s   %s\n" % (command.name.ljust(longest_name_length), command.help_text), relevant_commands)
+        epilog += "%s\n" % "".join(command_help_texts)
+        epilog += "See '%prog help --all-commands' to list all commands.\n"
+        epilog += "See '%prog help COMMAND' for more information on a specific command.\n"
+        return self.tool.global_option_parser.expand_prog_name(epilog)
+
+    def execute(self, options, args, tool):
+        if args:
+            command = self.tool.command_by_name(args[0])
+            if command:
+                print command.standalone_help()
+                return 0
+
+        self.show_all_commands = options.show_all_commands
+        tool.global_option_parser.print_help()
+        return 0
+
+
+class MultiCommandTool(object):
+    def __init__(self, name=None, commands=None):
+        # Allow the unit tests to disable command auto-discovery.
+        self.commands = commands or [cls() for cls in self._find_all_commands() if cls.name]
+        self.help_command = self.command_by_name(HelpCommand.name)
+        # Require a help command, even if the manual test list doesn't include one.
+        if not self.help_command:
+            self.help_command = HelpCommand()
+            self.commands.append(self.help_command)
+        for command in self.commands:
+            command.bind_to_tool(self)
+        self.global_option_parser = HelpPrintingOptionParser(epilog_method=self.help_command._help_epilog, prog=name, usage=self._usage_line())
+
+    @classmethod
+    def _add_all_subclasses(cls, class_to_crawl, seen_classes):
+        for subclass in class_to_crawl.__subclasses__():
+            if subclass not in seen_classes:
+                seen_classes.add(subclass)
+                cls._add_all_subclasses(subclass, seen_classes)
+
+    @classmethod
+    def _find_all_commands(cls):
+        commands = set()
+        cls._add_all_subclasses(Command, commands)
+        return sorted(commands)
+
+    @staticmethod
+    def _usage_line():
+        return "Usage: %prog [options] COMMAND [ARGS]"
+
+    def name(self):
+        return self.global_option_parser.get_prog_name()
+
+    def handle_global_args(self, args):
+        (options, args) = self.global_option_parser.parse_args(args)
+        # We should never hit this because _split_args splits at the first arg without a leading "-".
+        if args:
+            self.global_option_parser.error("Extra arguments before command: %s" % args)
+
+    @staticmethod
+    def _split_args(args):
+        # Assume the first argument which doesn't start with "-" is the command name.
+        command_index = 0
+        for arg in args:
+            if arg[0] != "-":
+                break
+            command_index += 1
+        else:
+            return (args[:], None, [])
+
+        global_args = args[:command_index]
+        command = args[command_index]
+        command_args = args[command_index + 1:]
+        return (global_args, command, command_args)
+
+    def command_by_name(self, command_name):
+        for command in self.commands:
+            if command_name == command.name:
+                return command
+        return None
+
+    def path(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def should_show_in_main_help(self, command):
+        return command.show_in_main_help
+
+    def should_execute_command(self, command):
+        raise NotImplementedError, "subclasses must implement"
+
+    def main(self, argv=sys.argv):
+        (global_args, command_name, args_after_command_name) = self._split_args(argv[1:])
+
+        # Handle --help, etc:
+        self.handle_global_args(global_args)
+
+        command = self.command_by_name(command_name) or self.help_command
+        if not command:
+            self.global_option_parser.error("%s is not a recognized command" % command_name)
+
+        (should_execute, failure_reason) = self.should_execute_command(command)
+        if not should_execute:
+            log(failure_reason)
+            return 0
+
+        return command.check_arguments_and_execute(args_after_command_name, self)
diff --git a/WebKitTools/Scripts/modules/multicommandtool_unittest.py b/WebKitTools/Scripts/modules/multicommandtool_unittest.py
new file mode 100644
index 0000000..c71cc09
--- /dev/null
+++ b/WebKitTools/Scripts/modules/multicommandtool_unittest.py
@@ -0,0 +1,158 @@
+# Copyright (c) 2009, Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import sys
+import unittest
+from multicommandtool import MultiCommandTool, Command
+from modules.outputcapture import OutputCapture
+
+from optparse import make_option
+
+class TrivialCommand(Command):
+    name = "trivial"
+    show_in_main_help = True
+    def __init__(self, **kwargs):
+        Command.__init__(self, "help text", **kwargs)
+
+    def execute(self, options, args, tool):
+        pass
+
+class UncommonCommand(TrivialCommand):
+    name = "uncommon"
+    show_in_main_help = False
+
+class CommandTest(unittest.TestCase):
+    def test_name_with_arguments(self):
+        command_with_args = TrivialCommand(argument_names="ARG1 ARG2")
+        self.assertEqual(command_with_args.name_with_arguments(), "trivial ARG1 ARG2")
+
+        command_with_args = TrivialCommand(options=[make_option("--my_option")])
+        self.assertEqual(command_with_args.name_with_arguments(), "trivial [options]")
+
+    def test_parse_required_arguments(self):
+        self.assertEqual(Command._parse_required_arguments("ARG1 ARG2"), ["ARG1", "ARG2"])
+        self.assertEqual(Command._parse_required_arguments("[ARG1] [ARG2]"), [])
+        self.assertEqual(Command._parse_required_arguments("[ARG1] ARG2"), ["ARG2"])
+        # Note: We might make our arg parsing smarter in the future and allow this type of arguments string.
+        self.assertRaises(Exception, Command._parse_required_arguments, "[ARG1 ARG2]")
+
+    def test_required_arguments(self):
+        two_required_arguments = TrivialCommand(argument_names="ARG1 ARG2 [ARG3]")
+        capture = OutputCapture()
+        capture.capture_output()
+        exit_code = two_required_arguments.check_arguments_and_execute(["foo"], TrivialTool())
+        (stdout_string, stderr_string) = capture.restore_output()
+        expected_missing_args_error = "2 arguments required, 1 argument provided.  Provided: 'foo'  Required: ARG1 ARG2\nSee 'trivial-tool help trivial' for usage.\n"
+        self.assertEqual(exit_code, 1)
+        self.assertEqual(stdout_string, "")
+        self.assertEqual(stderr_string, expected_missing_args_error)
+
+
+class TrivialTool(MultiCommandTool):
+    def __init__(self, commands=None):
+        MultiCommandTool.__init__(self, name="trivial-tool", commands=commands)
+
+    def path():
+        return __file__
+
+    def should_execute_command(self, command):
+        return (True, None)
+
+
+class MultiCommandToolTest(unittest.TestCase):
+    def _assert_split(self, args, expected_split):
+        self.assertEqual(MultiCommandTool._split_args(args), expected_split)
+
+    def test_split_args(self):
+        # MultiCommandToolTest._split_args returns: (global_args, command, command_args)
+        full_args = ["--global-option", "command", "--option", "arg"]
+        full_args_expected = (["--global-option"], "command", ["--option", "arg"])
+        self._assert_split(full_args, full_args_expected)
+
+        full_args = []
+        full_args_expected = ([], None, [])
+        self._assert_split(full_args, full_args_expected)
+
+        full_args = ["command", "arg"]
+        full_args_expected = ([], "command", ["arg"])
+        self._assert_split(full_args, full_args_expected)
+
+    def test_command_by_name(self):
+        # This also tests Command auto-discovery.
+        tool = TrivialTool()
+        self.assertEqual(tool.command_by_name("trivial").name, "trivial")
+        self.assertEqual(tool.command_by_name("bar"), None)
+
+    def _assert_tool_main_outputs(self, tool, main_args, expected_stdout, expected_stderr = "", exit_code=0):
+        capture = OutputCapture()
+        capture.capture_output()
+        exit_code = tool.main(main_args)
+        (stdout_string, stderr_string) = capture.restore_output()
+        self.assertEqual(stdout_string, expected_stdout)
+        self.assertEqual(expected_stderr, expected_stderr)
+
+    def test_global_help(self):
+        tool = TrivialTool(commands=[TrivialCommand(), UncommonCommand()])
+        expected_common_commands_help = """Usage: trivial-tool [options] COMMAND [ARGS]
+
+Options:
+  -h, --help  show this help message and exit
+
+Common trivial-tool commands:
+   trivial   help text
+
+See 'trivial-tool help --all-commands' to list all commands.
+See 'trivial-tool help COMMAND' for more information on a specific command.
+
+"""
+        self._assert_tool_main_outputs(tool, ["tool", "help"], expected_common_commands_help)
+        expected_all_commands_help = """Usage: trivial-tool [options] COMMAND [ARGS]
+
+Options:
+  -h, --help  show this help message and exit
+
+All trivial-tool commands:
+   help       Display information about this program or its subcommands
+   trivial    help text
+   uncommon   help text
+
+See 'trivial-tool help --all-commands' to list all commands.
+See 'trivial-tool help COMMAND' for more information on a specific command.
+
+"""
+        self._assert_tool_main_outputs(tool, ["tool", "help", "--all-commands"], expected_all_commands_help)
+
+    def test_command_help(self):
+        command_with_options = TrivialCommand(options=[make_option("--my_option")])
+        tool = TrivialTool(commands=[command_with_options])
+        expected_subcommand_help = "trivial [options]   help text\nOptions:\n  --my_option=MY_OPTION\n\n"
+        self._assert_tool_main_outputs(tool, ["tool", "help", "trivial"], expected_subcommand_help)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/WebKitTools/Scripts/modules/outputcapture.py b/WebKitTools/Scripts/modules/outputcapture.py
new file mode 100644
index 0000000..f02fc5d
--- /dev/null
+++ b/WebKitTools/Scripts/modules/outputcapture.py
@@ -0,0 +1,53 @@
+# Copyright (c) 2009, Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Class for unittest support.  Used for capturing stderr/stdout.
+
+import sys
+from StringIO import StringIO
+
+class OutputCapture(object):
+    def __init__(self):
+        self.saved_outputs = dict()
+
+    def _capture_output_with_name(self, output_name):
+        self.saved_outputs[output_name] = getattr(sys, output_name)
+        setattr(sys, output_name, StringIO())
+
+    def _restore_output_with_name(self, output_name):
+        captured_output = getattr(sys, output_name).getvalue()
+        setattr(sys, output_name, self.saved_outputs[output_name])
+        del self.saved_outputs[output_name]
+        return captured_output
+
+    def capture_output(self):
+        self._capture_output_with_name("stdout")
+        self._capture_output_with_name("stderr")
+
+    def restore_output(self):
+        return (self._restore_output_with_name("stdout"), self._restore_output_with_name("stderr"))
diff --git a/WebKitTools/Scripts/modules/patchcollection.py b/WebKitTools/Scripts/modules/patchcollection.py
new file mode 100644
index 0000000..add8129
--- /dev/null
+++ b/WebKitTools/Scripts/modules/patchcollection.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+class PersistentPatchCollectionDelegate:
+    def collection_name(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def fetch_potential_patch_ids(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def status_server(self):
+        raise NotImplementedError, "subclasses must implement"
+
+
+class PersistentPatchCollection:
+    _initial_status = "Pending"
+    _pass_status = "Pass"
+    _fail_status = "Fail"
+    def __init__(self, delegate):
+        self._delegate = delegate
+        self._name = self._delegate.collection_name()
+        self._status = self._delegate.status_server()
+        self._status_cache = {}
+
+    def _cached_status(self, patch_id):
+        cached = self._status_cache.get(patch_id)
+        if cached:
+            return cached
+        status = self._status.patch_status(self._name, patch_id)
+        if status:
+            self._status_cache[patch_id] = status
+        return status
+
+    def next(self):
+        patch_ids = self._delegate.fetch_potential_patch_ids()
+        for patch_id in patch_ids:
+            status = self._cached_status(patch_id)
+            if not status:
+                return patch_id
+
+    def did_pass(self, patch):
+        self._status.update_status(self._name, self._pass_status, patch)
+
+    def did_fail(self, patch):
+        self._status.update_status(self._name, self._fail_status, patch)
diff --git a/WebKitTools/Scripts/modules/scm.py b/WebKitTools/Scripts/modules/scm.py
index 3ffa23b..ff26693 100644
--- a/WebKitTools/Scripts/modules/scm.py
+++ b/WebKitTools/Scripts/modules/scm.py
@@ -34,6 +34,8 @@ import re
 import subprocess
 
 # Import WebKit-specific modules.
+from modules.changelogs import ChangeLog
+from modules.executive import Executive, run_command, ScriptError
 from modules.logging import error, log
 
 def detect_scm_system(path):
@@ -77,44 +79,16 @@ class CommitMessage:
         return "\n".join(self.message_lines) + "\n"
 
 
-class ScriptError(Exception):
-    def __init__(self, message=None, script_args=None, exit_code=None, output=None, cwd=None):
-        if not message:
-            message = 'Failed to run "%s"' % script_args
-            if exit_code:
-                message += " exit_code: %d" % exit_code
-            if cwd:
-                message += " cwd: %s" % cwd
-
-        Exception.__init__(self, message)
-        self.script_args = script_args # 'args' is already used by Exception
-        self.exit_code = exit_code
-        self.output = output
-        self.cwd = cwd
-
-    def message_with_output(self, output_limit=500):
-        if self.output:
-            if len(self.output) > output_limit:
-                 return "%s\nLast %s characters of output:\n%s" % (self, output_limit, self.output[-output_limit:])
-            return "%s\n%s" % (self, self.output)
-        return str(self)
-
-
 class CheckoutNeedsUpdate(ScriptError):
     def __init__(self, script_args, exit_code, output, cwd):
         ScriptError.__init__(self, script_args=script_args, exit_code=exit_code, output=output, cwd=cwd)
 
 
-def default_error_handler(error):
-    raise error
-
 def commit_error_handler(error):
     if re.search("resource out of date", error.output):
         raise CheckoutNeedsUpdate(script_args=error.script_args, exit_code=error.exit_code, output=error.output, cwd=error.cwd)
-    default_error_handler(error)
+    Executive.default_error_handler(error)
 
-def ignore_error(error):
-    pass
 
 class SCM:
     def __init__(self, cwd, dryrun=False):
@@ -122,33 +96,15 @@ class SCM:
         self.checkout_root = self.find_checkout_root(self.cwd)
         self.dryrun = dryrun
 
-    @staticmethod
-    def run_command(args, cwd=None, input=None, error_handler=default_error_handler, return_exit_code=False):
-        if hasattr(input, 'read'): # Check if the input is a file.
-            stdin = input
-            string_to_communicate = None
-        else:
-            stdin = subprocess.PIPE if input else None
-            string_to_communicate = input
-        process = subprocess.Popen(args, stdin=stdin, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=cwd)
-        output = process.communicate(string_to_communicate)[0].rstrip()
-        exit_code = process.wait()
-        if exit_code:
-            script_error = ScriptError(script_args=args, exit_code=exit_code, output=output, cwd=cwd)
-            error_handler(script_error)
-        if return_exit_code:
-            return exit_code
-        return output
-
     def scripts_directory(self):
         return os.path.join(self.checkout_root, "WebKitTools", "Scripts")
 
     def script_path(self, script_name):
         return os.path.join(self.scripts_directory(), script_name)
 
-    def ensure_clean_working_directory(self, force):
-        if not force and not self.working_directory_is_clean():
-            print self.run_command(self.status_command(), error_handler=ignore_error)
+    def ensure_clean_working_directory(self, force_clean):
+        if not force_clean and not self.working_directory_is_clean():
+            print run_command(self.status_command(), error_handler=Executive.ignore_error)
             raise ScriptError(message="Working directory has modifications, pass --force-clean or --no-clean to continue.")
         
         log("Cleaning working directory")
@@ -168,15 +124,17 @@ class SCM:
         # It's possible that the patch was not made from the root directory.
         # We should detect and handle that case.
         curl_process = subprocess.Popen(['curl', '--location', '--silent', '--show-error', patch['url']], stdout=subprocess.PIPE)
-        args = [self.script_path('svn-apply'), '--reviewer', patch['reviewer']]
+        args = [self.script_path('svn-apply')]
+        if patch.get('reviewer'):
+            args += ['--reviewer', patch['reviewer']]
         if force:
             args.append('--force')
 
-        self.run_command(args, input=curl_process.stdout)
+        run_command(args, input=curl_process.stdout)
 
     def run_status_and_extract_filenames(self, status_command, status_regexp):
         filenames = []
-        for line in self.run_command(status_command).splitlines():
+        for line in run_command(status_command).splitlines():
             match = re.search(status_regexp, line)
             if not match:
                 continue
@@ -204,6 +162,28 @@ class SCM:
                 changelog_paths.append(path)
         return changelog_paths
 
+    # FIXME: Requires unit test
+    # FIXME: commit_message_for_this_commit and modified_changelogs don't
+    #        really belong here.  We should have a separate module for
+    #        handling ChangeLogs.
+    def commit_message_for_this_commit(self):
+        changelog_paths = self.modified_changelogs()
+        if not len(changelog_paths):
+            raise ScriptError(message="Found no modified ChangeLogs, cannot create a commit message.\n"
+                              "All changes require a ChangeLog.  See:\n"
+                              "http://webkit.org/coding/contributing.html")
+
+        changelog_messages = []
+        for changelog_path in changelog_paths:
+            log("Parsing ChangeLog: %s" % changelog_path)
+            changelog_entry = ChangeLog(changelog_path).latest_entry()
+            if not changelog_entry:
+                raise ScriptError(message="Failed to parse ChangeLog: " + os.path.abspath(changelog_path))
+            changelog_messages.append(changelog_entry)
+
+        # FIXME: We should sort and label the ChangeLog messages like commit-log-editor does.
+        return CommitMessage("".join(changelog_messages).splitlines())
+
     @staticmethod
     def in_working_directory(path):
         raise NotImplementedError, "subclasses must implement"
@@ -222,9 +202,6 @@ class SCM:
     def clean_working_directory(self):
         raise NotImplementedError, "subclasses must implement"
 
-    def update_webkit(self):
-        raise NotImplementedError, "subclasses must implement"
-
     def status_command(self):
         raise NotImplementedError, "subclasses must implement"
 
@@ -295,7 +272,7 @@ class SVN(SCM):
     @classmethod
     def value_from_svn_info(cls, path, field_name):
         svn_info_args = ['svn', 'info', path]
-        info_output = cls.run_command(svn_info_args)
+        info_output = run_command(svn_info_args).rstrip()
         match = re.search("^%s: (?P<value>.+)$" % field_name, info_output, re.MULTILINE)
         if not match:
             raise ScriptError(script_args=svn_info_args, message='svn info did not contain a %s.' % field_name)
@@ -323,18 +300,15 @@ class SVN(SCM):
 
     def svn_version(self):
         if not self.cached_version:
-            self.cached_version = self.run_command(['svn', '--version', '--quiet'])
+            self.cached_version = run_command(['svn', '--version', '--quiet'])
         
         return self.cached_version
 
     def working_directory_is_clean(self):
-        return self.run_command(['svn', 'diff']) == ""
+        return run_command(['svn', 'diff']) == ""
 
     def clean_working_directory(self):
-        self.run_command(['svn', 'revert', '-R', '.'])
-
-    def update_webkit(self):
-        self.run_command(self.script_path("update-webkit"))
+        run_command(['svn', 'revert', '-R', '.'])
 
     def status_command(self):
         return ['svn', 'status']
@@ -354,10 +328,10 @@ class SVN(SCM):
         return "svn"
 
     def create_patch(self):
-        return self.run_command(self.script_path("svn-create-patch"), cwd=self.checkout_root)
+        return run_command(self.script_path("svn-create-patch"), cwd=self.checkout_root, return_stderr=False)
 
     def diff_for_revision(self, revision):
-        return self.run_command(['svn', 'diff', '-c', str(revision)])
+        return run_command(['svn', 'diff', '-c', str(revision)])
 
     def _repository_url(self):
         return self.value_from_svn_info(self.checkout_root, 'URL')
@@ -367,20 +341,20 @@ class SVN(SCM):
         svn_merge_args = ['svn', 'merge', '--non-interactive', '-c', '-%s' % revision, self._repository_url()]
         log("WARNING: svn merge has been known to take more than 10 minutes to complete.  It is recommended you use git for rollouts.")
         log("Running '%s'" % " ".join(svn_merge_args))
-        self.run_command(svn_merge_args)
+        run_command(svn_merge_args)
 
     def revert_files(self, file_paths):
-        self.run_command(['svn', 'revert'] + file_paths)
+        run_command(['svn', 'revert'] + file_paths)
 
     def commit_with_message(self, message):
         if self.dryrun:
             # Return a string which looks like a commit so that things which parse this output will succeed.
             return "Dry run, no commit.\nCommitted revision 0."
-        return self.run_command(['svn', 'commit', '-m', message], error_handler=commit_error_handler)
+        return run_command(['svn', 'commit', '-m', message], error_handler=commit_error_handler)
 
     def svn_commit_log(self, svn_revision):
         svn_revision = self.strip_r_from_svn_revision(str(svn_revision))
-        return self.run_command(['svn', 'log', '--non-interactive', '--revision', svn_revision]);
+        return run_command(['svn', 'log', '--non-interactive', '--revision', svn_revision]);
 
     def last_svn_commit_log(self):
         # BASE is the checkout revision, HEAD is the remote repository revision
@@ -394,12 +368,12 @@ class Git(SCM):
 
     @classmethod
     def in_working_directory(cls, path):
-        return cls.run_command(['git', 'rev-parse', '--is-inside-work-tree'], cwd=path, error_handler=ignore_error) == "true"
+        return run_command(['git', 'rev-parse', '--is-inside-work-tree'], cwd=path, error_handler=Executive.ignore_error).rstrip() == "true"
 
     @classmethod
     def find_checkout_root(cls, path):
         # "git rev-parse --show-cdup" would be another way to get to the root
-        (checkout_root, dot_git) = os.path.split(cls.run_command(['git', 'rev-parse', '--git-dir'], cwd=path))
+        (checkout_root, dot_git) = os.path.split(run_command(['git', 'rev-parse', '--git-dir'], cwd=path))
         # If we were using 2.6 # checkout_root = os.path.relpath(checkout_root, path)
         if not os.path.isabs(checkout_root): # Sometimes git returns relative paths
             checkout_root = os.path.join(path, checkout_root)
@@ -411,28 +385,23 @@ class Git(SCM):
 
 
     def discard_local_commits(self):
-        self.run_command(['git', 'reset', '--hard', 'trunk'])
+        run_command(['git', 'reset', '--hard', 'trunk'])
     
     def local_commits(self):
-        return self.run_command(['git', 'log', '--pretty=oneline', 'HEAD...trunk']).splitlines()
+        return run_command(['git', 'log', '--pretty=oneline', 'HEAD...trunk']).splitlines()
 
     def rebase_in_progress(self):
         return os.path.exists(os.path.join(self.checkout_root, '.git/rebase-apply'))
 
     def working_directory_is_clean(self):
-        return self.run_command(['git', 'diff-index', 'HEAD']) == ""
+        return run_command(['git', 'diff-index', 'HEAD']) == ""
 
     def clean_working_directory(self):
         # Could run git clean here too, but that wouldn't match working_directory_is_clean
-        self.run_command(['git', 'reset', '--hard', 'HEAD'])
+        run_command(['git', 'reset', '--hard', 'HEAD'])
         # Aborting rebase even though this does not match working_directory_is_clean
         if self.rebase_in_progress():
-            self.run_command(['git', 'rebase', '--abort'])
-
-    def update_webkit(self):
-        # FIXME: Call update-webkit once https://bugs.webkit.org/show_bug.cgi?id=27162 is fixed.
-        log("Updating working directory")
-        self.run_command(['git', 'svn', 'rebase'])
+            run_command(['git', 'rebase', '--abort'])
 
     def status_command(self):
         return ['git', 'status']
@@ -450,12 +419,12 @@ class Git(SCM):
         return "git"
 
     def create_patch(self):
-        return self.run_command(['git', 'diff', 'HEAD'])
+        return run_command(['git', 'diff', '--binary', 'HEAD'])
 
     @classmethod
     def git_commit_from_svn_revision(cls, revision):
         # git svn find-rev always exits 0, even when the revision is not found.
-        return cls.run_command(['git', 'svn', 'find-rev', 'r%s' % revision])
+        return run_command(['git', 'svn', 'find-rev', 'r%s' % revision]).rstrip()
 
     def diff_for_revision(self, revision):
         git_commit = self.git_commit_from_svn_revision(revision)
@@ -469,15 +438,15 @@ class Git(SCM):
 
         # I think this will always fail due to ChangeLogs.
         # FIXME: We need to detec specific failure conditions and handle them.
-        self.run_command(['git', 'revert', '--no-commit', git_commit], error_handler=ignore_error)
+        run_command(['git', 'revert', '--no-commit', git_commit], error_handler=Executive.ignore_error)
 
         # Fix any ChangeLogs if necessary.
         changelog_paths = self.modified_changelogs()
         if len(changelog_paths):
-            self.run_command([self.script_path('resolve-ChangeLogs')] + changelog_paths)
+            run_command([self.script_path('resolve-ChangeLogs')] + changelog_paths)
 
     def revert_files(self, file_paths):
-        self.run_command(['git', 'checkout', 'HEAD'] + file_paths)
+        run_command(['git', 'checkout', 'HEAD'] + file_paths)
 
     def commit_with_message(self, message):
         self.commit_locally_with_message(message)
@@ -485,27 +454,27 @@ class Git(SCM):
 
     def svn_commit_log(self, svn_revision):
         svn_revision = self.strip_r_from_svn_revision(svn_revision)
-        return self.run_command(['git', 'svn', 'log', '-r', svn_revision])
+        return run_command(['git', 'svn', 'log', '-r', svn_revision])
 
     def last_svn_commit_log(self):
-        return self.run_command(['git', 'svn', 'log', '--limit=1'])
+        return run_command(['git', 'svn', 'log', '--limit=1'])
 
     # Git-specific methods:
 
     def create_patch_from_local_commit(self, commit_id):
-        return self.run_command(['git', 'diff', commit_id + "^.." + commit_id])
+        return run_command(['git', 'diff', '--binary', commit_id + "^.." + commit_id])
 
     def create_patch_since_local_commit(self, commit_id):
-        return self.run_command(['git', 'diff', commit_id])
+        return run_command(['git', 'diff', '--binary', commit_id])
 
     def commit_locally_with_message(self, message):
-        self.run_command(['git', 'commit', '--all', '-F', '-'], input=message)
+        run_command(['git', 'commit', '--all', '-F', '-'], input=message)
         
     def push_local_commits_to_server(self):
         if self.dryrun:
             # Return a string which looks like a commit so that things which parse this output will succeed.
             return "Dry run, no remote commit.\nCommitted r0"
-        return self.run_command(['git', 'svn', 'dcommit'], error_handler=commit_error_handler)
+        return run_command(['git', 'svn', 'dcommit'], error_handler=commit_error_handler)
 
     # This function supports the following argument formats:
     # no args : rev-list trunk..HEAD
@@ -522,14 +491,14 @@ class Git(SCM):
             if '...' in commitish:
                 raise ScriptError(message="'...' is not supported (found in '%s'). Did you mean '..'?" % commitish)
             elif '..' in commitish:
-                commit_ids += reversed(self.run_command(['git', 'rev-list', commitish]).splitlines())
+                commit_ids += reversed(run_command(['git', 'rev-list', commitish]).splitlines())
             else:
                 # Turn single commits or branch or tag names into commit ids.
-                commit_ids += self.run_command(['git', 'rev-parse', '--revs-only', commitish]).splitlines()
+                commit_ids += run_command(['git', 'rev-parse', '--revs-only', commitish]).splitlines()
         return commit_ids
 
     def commit_message_for_local_commit(self, commit_id):
-        commit_lines = self.run_command(['git', 'cat-file', 'commit', commit_id]).splitlines()
+        commit_lines = run_command(['git', 'cat-file', 'commit', commit_id]).splitlines()
 
         # Skip the git headers.
         first_line_after_headers = 0
@@ -540,4 +509,4 @@ class Git(SCM):
         return CommitMessage(commit_lines[first_line_after_headers:])
 
     def files_changed_summary_for_commit(self, commit_id):
-        return self.run_command(['git', 'diff-tree', '--shortstat', '--no-commit-id', commit_id])
+        return run_command(['git', 'diff-tree', '--shortstat', '--no-commit-id', commit_id])
diff --git a/WebKitTools/Scripts/modules/scm_unittest.py b/WebKitTools/Scripts/modules/scm_unittest.py
index 784303f..8e82f3c 100644
--- a/WebKitTools/Scripts/modules/scm_unittest.py
+++ b/WebKitTools/Scripts/modules/scm_unittest.py
@@ -29,21 +29,22 @@
 
 import base64
 import os
+import os.path
 import re
 import stat
 import subprocess
 import tempfile
 import unittest
 import urllib
-from modules.scm import detect_scm_system, SCM, ScriptError, CheckoutNeedsUpdate, ignore_error, commit_error_handler
 
+from datetime import date
+from modules.executive import Executive, run_command, ScriptError
+from modules.scm import detect_scm_system, SCM, CheckoutNeedsUpdate, commit_error_handler
 
 # Eventually we will want to write tests which work for both scms. (like update_webkit, changed_files, etc.)
 # Perhaps through some SCMTest base-class which both SVNTest and GitTest inherit from.
 
-def run(args, cwd=None):
-    return SCM.run_command(args, cwd=cwd)
-
+# FIXME: This should be unified into one of the executive.py commands!
 def run_silent(args, cwd=None):
     process = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=cwd)
     process.communicate() # ignore output
@@ -72,26 +73,26 @@ class SVNTestRepository:
         test_file.write("test1")
         test_file.flush()
         
-        run(['svn', 'add', 'test_file'])
-        run(['svn', 'commit', '--quiet', '--message', 'initial commit'])
+        run_command(['svn', 'add', 'test_file'])
+        run_command(['svn', 'commit', '--quiet', '--message', 'initial commit'])
         
         test_file.write("test2")
         test_file.flush()
         
-        run(['svn', 'commit', '--quiet', '--message', 'second commit'])
+        run_command(['svn', 'commit', '--quiet', '--message', 'second commit'])
         
         test_file.write("test3\n")
         test_file.flush()
         
-        run(['svn', 'commit', '--quiet', '--message', 'third commit'])
+        run_command(['svn', 'commit', '--quiet', '--message', 'third commit'])
 
         test_file.write("test4\n")
         test_file.close()
 
-        run(['svn', 'commit', '--quiet', '--message', 'fourth commit'])
+        run_command(['svn', 'commit', '--quiet', '--message', 'fourth commit'])
 
         # svn does not seem to update after commit as I would expect.
-        run(['svn', 'update'])
+        run_command(['svn', 'update'])
 
     @classmethod
     def setup(cls, test_object):
@@ -100,18 +101,18 @@ class SVNTestRepository:
         test_object.svn_repo_url = "file://%s" % test_object.svn_repo_path # Not sure this will work on windows
         # git svn complains if we don't pass --pre-1.5-compatible, not sure why:
         # Expected FS format '2'; found format '3' at /usr/local/libexec/git-core//git-svn line 1477
-        run(['svnadmin', 'create', '--pre-1.5-compatible', test_object.svn_repo_path])
+        run_command(['svnadmin', 'create', '--pre-1.5-compatible', test_object.svn_repo_path])
 
         # Create a test svn checkout
         test_object.svn_checkout_path = tempfile.mkdtemp(suffix="svn_test_checkout")
-        run(['svn', 'checkout', '--quiet', test_object.svn_repo_url, test_object.svn_checkout_path])
+        run_command(['svn', 'checkout', '--quiet', test_object.svn_repo_url, test_object.svn_checkout_path])
 
         cls._setup_test_commits(test_object)
 
     @classmethod
     def tear_down(cls, test_object):
-        run(['rm', '-rf', test_object.svn_repo_path])
-        run(['rm', '-rf', test_object.svn_checkout_path])
+        run_command(['rm', '-rf', test_object.svn_repo_path])
+        run_command(['rm', '-rf', test_object.svn_checkout_path])
 
 # For testing the SCM baseclass directly.
 class SCMClassTests(unittest.TestCase):
@@ -122,21 +123,21 @@ class SCMClassTests(unittest.TestCase):
         self.dev_null.close()
 
     def test_run_command_with_pipe(self):
-        input_process = subprocess.Popen(['/bin/echo', 'foo\nbar'], stdout=subprocess.PIPE, stderr=self.dev_null)
-        self.assertEqual(SCM.run_command(['/usr/bin/grep', 'bar'], input=input_process.stdout), "bar")
+        input_process = subprocess.Popen(['echo', 'foo\nbar'], stdout=subprocess.PIPE, stderr=self.dev_null)
+        self.assertEqual(run_command(['grep', 'bar'], input=input_process.stdout), "bar\n")
 
         # Test the non-pipe case too:
-        self.assertEqual(SCM.run_command(['/usr/bin/grep', 'bar'], input="foo\nbar"), "bar")
+        self.assertEqual(run_command(['grep', 'bar'], input="foo\nbar"), "bar\n")
 
         command_returns_non_zero = ['/bin/sh', '--invalid-option']
         # Test when the input pipe process fails.
         input_process = subprocess.Popen(command_returns_non_zero, stdout=subprocess.PIPE, stderr=self.dev_null)
         self.assertTrue(input_process.poll() != 0)
-        self.assertRaises(ScriptError, SCM.run_command, ['/usr/bin/grep', 'bar'], input=input_process.stdout)
+        self.assertRaises(ScriptError, run_command, ['grep', 'bar'], input=input_process.stdout)
 
         # Test when the run_command process fails.
-        input_process = subprocess.Popen(['/bin/echo', 'foo\nbar'], stdout=subprocess.PIPE, stderr=self.dev_null) # grep shows usage and calls exit(2) when called w/o arguments.
-        self.assertRaises(ScriptError, SCM.run_command, command_returns_non_zero, input=input_process.stdout)
+        input_process = subprocess.Popen(['echo', 'foo\nbar'], stdout=subprocess.PIPE, stderr=self.dev_null) # grep shows usage and calls exit(2) when called w/o arguments.
+        self.assertRaises(ScriptError, run_command, command_returns_non_zero, input=input_process.stdout)
 
     def test_error_handlers(self):
         git_failure_message="Merge conflict during commit: Your file or directory 'WebCore/ChangeLog' is probably out-of-date: resource out of date; try updating at /usr/local/libexec/git-core//git-svn line 469"
@@ -145,12 +146,13 @@ svn: File or directory 'ChangeLog' is out of date; try updating
 svn: resource out of date; try updating
 """
         command_does_not_exist = ['does_not_exist', 'invalid_option']
-        self.assertRaises(OSError, SCM.run_command, command_does_not_exist)
-        self.assertRaises(OSError, SCM.run_command, command_does_not_exist, error_handler=ignore_error)
+        self.assertRaises(OSError, run_command, command_does_not_exist)
+        self.assertRaises(OSError, run_command, command_does_not_exist, error_handler=Executive.ignore_error)
 
         command_returns_non_zero = ['/bin/sh', '--invalid-option']
-        self.assertRaises(ScriptError, SCM.run_command, command_returns_non_zero)
-        self.assertTrue(SCM.run_command(command_returns_non_zero, error_handler=ignore_error))
+        self.assertRaises(ScriptError, run_command, command_returns_non_zero)
+        # Check if returns error text:
+        self.assertTrue(run_command(command_returns_non_zero, error_handler=Executive.ignore_error))
 
         self.assertRaises(CheckoutNeedsUpdate, commit_error_handler, ScriptError(output=git_failure_message))
         self.assertRaises(CheckoutNeedsUpdate, commit_error_handler, ScriptError(output=svn_failure_message))
@@ -201,9 +203,185 @@ class SCMTest(unittest.TestCase):
         self.assertTrue(re.search('test2', r3_patch))
         self.assertTrue(re.search('test2', self.scm.diff_for_revision(2)))
 
+    def _shared_test_svn_apply_git_patch(self):
+        self._setup_webkittools_scripts_symlink(self.scm)
+        git_binary_addition = """diff --git a/fizzbuzz7.gif b/fizzbuzz7.gif
+new file mode 100644
+index 0000000000000000000000000000000000000000..64a9532e7794fcd791f6f12157406d90
+60151690
+GIT binary patch
+literal 512
+zcmZ?wbhEHbRAx|MU|?iW{Kxc~?KofD;ckY;H+&5HnHl!!GQMD7h+sU{_)e9f^V3c?
+zhJP##HdZC#4K}7F68@!1jfWQg2daCm-gs#3|JREDT>c+pG4L<_2;w##WMO#ysPPap
+zLqpAf1OE938xAsSp4!5f-o><?VKe(#0jEcwfHGF4%M1^kRs14oVBp2ZEL{E1N<-zJ
+zsfLmOtKta;2_;2c#^S1-8cf<nb!QnGl>c!Xe6RXvrEtAWBvSDTgTO1j3vA31Puw!A
+zs(87q)j_mVDTqBo-P+03-P5mHCEnJ+x}YdCuS7#bCCyePUe(ynK+|4b-3qK)T?Z&)
+zYG+`tl4h?GZv_$t82}X4*DTE|$;{DEiPyF@)U-1+FaX++T9H{&%cag`W1|zVP@`%b
+zqiSkp6{BTpWTkCr!=<C6Q=?#~R8^JfrliAF6Q^gV9Iup8RqCXqqhqC`qsyhk<-nlB
+z00f{QZvfK&|Nm#oZ0TQl`Yr$BIa6A@16O26ud7H<QM=xl`toLKnz-3h@9c9q&wm|X
+z{89I|WPyD!*M?gv?q`;L=2YFeXrJQNti4?}s!zFo=5CzeBxC69xA<zrjP<wUcCRh4
+ptUl-ZG<%a~#LwkIWv&q!KSCH7tQ8cJDiw+|GV?MN)RjY50RTb-xvT&H
+
+literal 0
+HcmV?d00001
+
+"""
+        self.scm.apply_patch(self._create_patch(git_binary_addition))
+        added = read_from_path('fizzbuzz7.gif')
+        self.assertEqual(512, len(added))
+        self.assertTrue(added.startswith('GIF89a'))
+        self.assertTrue('fizzbuzz7.gif' in self.scm.changed_files())
+
+        # The file already exists.
+        self.assertRaises(ScriptError, self.scm.apply_patch, self._create_patch(git_binary_addition))
+
+        git_binary_modification = """diff --git a/fizzbuzz7.gif b/fizzbuzz7.gif
+index 64a9532e7794fcd791f6f12157406d9060151690..323fae03f4606ea9991df8befbb2fca7
+GIT binary patch
+literal 7
+OcmYex&reD$;sO8*F9L)B
+
+literal 512
+zcmZ?wbhEHbRAx|MU|?iW{Kxc~?KofD;ckY;H+&5HnHl!!GQMD7h+sU{_)e9f^V3c?
+zhJP##HdZC#4K}7F68@!1jfWQg2daCm-gs#3|JREDT>c+pG4L<_2;w##WMO#ysPPap
+zLqpAf1OE938xAsSp4!5f-o><?VKe(#0jEcwfHGF4%M1^kRs14oVBp2ZEL{E1N<-zJ
+zsfLmOtKta;2_;2c#^S1-8cf<nb!QnGl>c!Xe6RXvrEtAWBvSDTgTO1j3vA31Puw!A
+zs(87q)j_mVDTqBo-P+03-P5mHCEnJ+x}YdCuS7#bCCyePUe(ynK+|4b-3qK)T?Z&)
+zYG+`tl4h?GZv_$t82}X4*DTE|$;{DEiPyF@)U-1+FaX++T9H{&%cag`W1|zVP@`%b
+zqiSkp6{BTpWTkCr!=<C6Q=?#~R8^JfrliAF6Q^gV9Iup8RqCXqqhqC`qsyhk<-nlB
+z00f{QZvfK&|Nm#oZ0TQl`Yr$BIa6A@16O26ud7H<QM=xl`toLKnz-3h@9c9q&wm|X
+z{89I|WPyD!*M?gv?q`;L=2YFeXrJQNti4?}s!zFo=5CzeBxC69xA<zrjP<wUcCRh4
+ptUl-ZG<%a~#LwkIWv&q!KSCH7tQ8cJDiw+|GV?MN)RjY50RTb-xvT&H
+
+"""
+        self.scm.apply_patch(self._create_patch(git_binary_modification))
+        modified = read_from_path('fizzbuzz7.gif')
+        self.assertEqual('foobar\n', modified)
+        self.assertTrue('fizzbuzz7.gif' in self.scm.changed_files())
+
+        # Applying the same modification should fail.
+        self.assertRaises(ScriptError, self.scm.apply_patch, self._create_patch(git_binary_modification))
+
+        git_binary_deletion = """diff --git a/fizzbuzz7.gif b/fizzbuzz7.gif
+deleted file mode 100644
+index 323fae0..0000000
+GIT binary patch
+literal 0
+HcmV?d00001
+
+literal 7
+OcmYex&reD$;sO8*F9L)B
+
+"""
+        self.scm.apply_patch(self._create_patch(git_binary_deletion))
+        self.assertFalse(os.path.exists('fizzbuzz7.gif'))
+        self.assertFalse('fizzbuzz7.gif' in self.scm.changed_files())
+
+        # Cannot delete again.
+        self.assertRaises(ScriptError, self.scm.apply_patch, self._create_patch(git_binary_deletion))
+
 
 class SVNTest(SCMTest):
 
+    @staticmethod
+    def _set_date_and_reviewer(changelog_entry):
+        # Joe Cool matches the reviewer set in SCMTest._create_patch
+        changelog_entry = changelog_entry.replace('REVIEWER_HERE', 'Joe Cool')
+        # svn-apply will update ChangeLog entries with today's date.
+        return changelog_entry.replace('DATE_HERE', date.today().isoformat())
+
+    def test_svn_apply(self):
+        first_entry = """2009-10-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Foo Bar.
+
+        Most awesome change ever.
+
+        * scm_unittest.py:
+"""
+        intermediate_entry = """2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Baz Bar.
+
+        A more awesomer change yet!
+
+        * scm_unittest.py:
+"""
+        one_line_overlap_patch = """Index: ChangeLog
+===================================================================
+--- ChangeLog	(revision 5)
++++ ChangeLog	(working copy)
+@@ -1,5 +1,13 @@
+ 2009-10-26  Eric Seidel  <eric@webkit.org>
+
++        Reviewed by NOBODY (OOPS!).
++
++        Second most awsome change ever.
++
++        * scm_unittest.py:
++
++2009-10-26  Eric Seidel  <eric@webkit.org>
++
+         Reviewed by Foo Bar.
+
+         Most awesome change ever.
+"""
+        one_line_overlap_entry = """DATE_HERE  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by REVIEWER_HERE.
+
+        Second most awsome change ever.
+
+        * scm_unittest.py:
+"""
+        two_line_overlap_patch = """Index: ChangeLog
+===================================================================
+--- ChangeLog	(revision 5)
++++ ChangeLog	(working copy)
+@@ -2,6 +2,14 @@
+
+         Reviewed by Foo Bar.
+
++        Second most awsome change ever.
++
++        * scm_unittest.py:
++
++2009-10-26  Eric Seidel  <eric@webkit.org>
++
++        Reviewed by Foo Bar.
++
+         Most awesome change ever.
+
+         * scm_unittest.py:
+"""
+        two_line_overlap_entry = """DATE_HERE  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Foo Bar.
+
+        Second most awsome change ever.
+
+        * scm_unittest.py:
+"""
+        write_into_file_at_path('ChangeLog', first_entry)
+        run_command(['svn', 'add', 'ChangeLog'])
+        run_command(['svn', 'commit', '--quiet', '--message', 'ChangeLog commit'])
+
+        # Patch files were created against just 'first_entry'.
+        # Add a second commit to make svn-apply have to apply the patches with fuzz.
+        changelog_contents = "%s\n%s" % (intermediate_entry, first_entry)
+        write_into_file_at_path('ChangeLog', changelog_contents)
+        run_command(['svn', 'commit', '--quiet', '--message', 'Intermediate commit'])
+
+        self._setup_webkittools_scripts_symlink(self.scm)
+        self.scm.apply_patch(self._create_patch(one_line_overlap_patch))
+        expected_changelog_contents = "%s\n%s" % (self._set_date_and_reviewer(one_line_overlap_entry), changelog_contents)
+        self.assertEquals(read_from_path('ChangeLog'), expected_changelog_contents)
+
+        self.scm.revert_files(['ChangeLog'])
+        self.scm.apply_patch(self._create_patch(two_line_overlap_patch))
+        expected_changelog_contents = "%s\n%s" % (self._set_date_and_reviewer(two_line_overlap_entry), changelog_contents)
+        self.assertEquals(read_from_path('ChangeLog'), expected_changelog_contents)
+
     def setUp(self):
         SVNTestRepository.setup(self)
         os.chdir(self.svn_checkout_path)
@@ -217,13 +395,13 @@ class SVNTest(SCMTest):
         os.mkdir(test_dir_path)
         test_file_path = os.path.join(test_dir_path, 'test_file2')
         write_into_file_at_path(test_file_path, 'test content')
-        run(['svn', 'add', 'test_dir'])
+        run_command(['svn', 'add', 'test_dir'])
 
         # create_patch depends on 'svn-create-patch', so make a dummy version.
         scripts_path = os.path.join(self.svn_checkout_path, 'WebKitTools', 'Scripts')
         os.makedirs(scripts_path)
         create_patch_path = os.path.join(scripts_path, 'svn-create-patch')
-        write_into_file_at_path(create_patch_path, '#!/bin/sh\necho $PWD')
+        write_into_file_at_path(create_patch_path, '#!/bin/sh\necho $PWD') # We could pass -n to prevent the \n, but not all echo accept -n.
         os.chmod(create_patch_path, stat.S_IXUSR | stat.S_IRUSR)
 
         # Change into our test directory and run the create_patch command.
@@ -232,7 +410,7 @@ class SVNTest(SCMTest):
         self.assertEqual(scm.checkout_root, self.svn_checkout_path) # Sanity check that detection worked right.
         patch_contents = scm.create_patch()
         # Our fake 'svn-create-patch' returns $PWD instead of a patch, check that it was executed from the root of the repo.
-        self.assertEqual(os.path.realpath(scm.checkout_root), patch_contents)
+        self.assertEqual("%s\n" % os.path.realpath(scm.checkout_root), patch_contents) # Add a \n because echo adds a \n.
 
     def test_detection(self):
         scm = detect_scm_system(self.svn_checkout_path)
@@ -262,13 +440,13 @@ Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
 
     def test_apply_svn_patch(self):
         scm = detect_scm_system(self.svn_checkout_path)
-        patch = self._create_patch(run(['svn', 'diff', '-r4:3']))
+        patch = self._create_patch(run_command(['svn', 'diff', '-r4:3']))
         self._setup_webkittools_scripts_symlink(scm)
         scm.apply_patch(patch)
 
     def test_apply_svn_patch_force(self):
         scm = detect_scm_system(self.svn_checkout_path)
-        patch = self._create_patch(run(['svn', 'diff', '-r2:4']))
+        patch = self._create_patch(run_command(['svn', 'diff', '-r2:4']))
         self._setup_webkittools_scripts_symlink(scm)
         self.assertRaises(ScriptError, scm.apply_patch, patch, force=True)
 
@@ -286,6 +464,8 @@ Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
     def test_diff_for_revision(self):
         self._shared_test_diff_for_revision()
 
+    def test_svn_apply_git_patch(self):
+        self._shared_test_svn_apply_git_patch()
 
 class GitTest(SCMTest):
 
@@ -295,7 +475,7 @@ class GitTest(SCMTest):
         run_silent(['git', 'svn', '--quiet', 'clone', self.svn_repo_url, self.git_checkout_path])
 
     def _tear_down_git_clone_of_svn_repository(self):
-        run(['rm', '-rf', self.git_checkout_path])
+        run_command(['rm', '-rf', self.git_checkout_path])
 
     def setUp(self):
         SVNTestRepository.setup(self)
@@ -315,11 +495,11 @@ class GitTest(SCMTest):
     def test_rebase_in_progress(self):
         svn_test_file = os.path.join(self.svn_checkout_path, 'test_file')
         write_into_file_at_path(svn_test_file, "svn_checkout")
-        run(['svn', 'commit', '--message', 'commit to conflict with git commit'], cwd=self.svn_checkout_path)
+        run_command(['svn', 'commit', '--message', 'commit to conflict with git commit'], cwd=self.svn_checkout_path)
 
         git_test_file = os.path.join(self.git_checkout_path, 'test_file')
         write_into_file_at_path(git_test_file, "git_checkout")
-        run(['git', 'commit', '-a', '-m', 'commit to be thrown away by rebase abort'])
+        run_command(['git', 'commit', '-a', '-m', 'commit to be thrown away by rebase abort'])
 
         # --quiet doesn't make git svn silent, so use run_silent to redirect output
         self.assertRaises(ScriptError, run_silent, ['git', 'svn', '--quiet', 'rebase']) # Will fail due to a conflict leaving us mid-rebase.
@@ -351,19 +531,19 @@ class GitTest(SCMTest):
 
         actual_commits = scm.commit_ids_from_commitish_arguments([commit_range])
         expected_commits = []
-        expected_commits += reversed(run(['git', 'rev-list', commit_range]).splitlines())
+        expected_commits += reversed(run_command(['git', 'rev-list', commit_range]).splitlines())
 
         self.assertEqual(actual_commits, expected_commits)
 
     def test_apply_git_patch(self):
         scm = detect_scm_system(self.git_checkout_path)
-        patch = self._create_patch(run(['git', 'diff', 'HEAD..HEAD^']))
+        patch = self._create_patch(run_command(['git', 'diff', 'HEAD..HEAD^']))
         self._setup_webkittools_scripts_symlink(scm)
         scm.apply_patch(patch)
 
     def test_apply_git_patch_force(self):
         scm = detect_scm_system(self.git_checkout_path)
-        patch = self._create_patch(run(['git', 'diff', 'HEAD~2..HEAD']))
+        patch = self._create_patch(run_command(['git', 'diff', 'HEAD~2..HEAD']))
         self._setup_webkittools_scripts_symlink(scm)
         self.assertRaises(ScriptError, scm.apply_patch, patch, force=True)
 
@@ -376,5 +556,39 @@ class GitTest(SCMTest):
     def test_diff_for_revision(self):
         self._shared_test_diff_for_revision()
 
+    def test_svn_apply_git_patch(self):
+        self._shared_test_svn_apply_git_patch()
+
+    def test_create_binary_patch(self):
+        # Create a git binary patch and check the contents.
+        scm = detect_scm_system(self.git_checkout_path)
+        test_file_name = 'binary_file'
+        test_file_path = os.path.join(self.git_checkout_path, test_file_name)
+        file_contents = ''.join(map(chr, range(256)))
+        write_into_file_at_path(test_file_path, file_contents)
+        run_command(['git', 'add', test_file_name])
+        patch = scm.create_patch()
+        self.assertTrue(re.search(r'\nliteral 0\n', patch))
+        self.assertTrue(re.search(r'\nliteral 256\n', patch))
+
+        # Check if we can apply the created patch.
+        run_command(['git', 'rm', '-f', test_file_name])
+        self._setup_webkittools_scripts_symlink(scm)
+        self.scm.apply_patch(self._create_patch(patch))
+        self.assertEqual(file_contents, read_from_path(test_file_path))
+
+        # Check if we can create a patch from a local commit.
+        write_into_file_at_path(test_file_path, file_contents)
+        run_command(['git', 'add', test_file_name])
+        run_command(['git', 'commit', '-m', 'binary diff'])
+        patch_from_local_commit = scm.create_patch_from_local_commit('HEAD')
+        self.assertTrue(re.search(r'\nliteral 0\n', patch_from_local_commit))
+        self.assertTrue(re.search(r'\nliteral 256\n', patch_from_local_commit))
+        patch_since_local_commit = scm.create_patch_since_local_commit('HEAD^1')
+        self.assertTrue(re.search(r'\nliteral 0\n', patch_since_local_commit))
+        self.assertTrue(re.search(r'\nliteral 256\n', patch_since_local_commit))
+        self.assertEqual(patch_from_local_commit, patch_since_local_commit)
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/Scripts/modules/statusbot.py b/WebKitTools/Scripts/modules/statusbot.py
index 9c9ba04..350aebf 100644
--- a/WebKitTools/Scripts/modules/statusbot.py
+++ b/WebKitTools/Scripts/modules/statusbot.py
@@ -46,21 +46,44 @@ http://wwwsearch.sourceforge.net/mechanize/
 """
     exit(1)
 
+import urllib2
+
+
 class StatusBot:
     default_host = "webkit-commit-queue.appspot.com"
 
     def __init__(self, host=default_host):
+        self.set_host(host)
+        self.browser = Browser()
+
+    def set_host(self, host):
         self.statusbot_host = host
         self.statusbot_server_url = "http://%s" % self.statusbot_host
-        self.update_status_url = "%s/update_status" % self.statusbot_server_url
-        self.browser = Browser()
 
-    def update_status(self, status, bug_id=None, patch_id=None):
-        self.browser.open(self.update_status_url)
+    def update_status(self, queue_name, status, patch=None, results_file=None):
+        # During unit testing, statusbot_host is None
+        if not self.statusbot_host:
+            return
+
+        update_status_url = "%s/update-status" % self.statusbot_server_url
+        self.browser.open(update_status_url)
         self.browser.select_form(name="update_status")
-        if bug_id:
-            self.browser['bug_id'] = str(bug_id)
-        if patch_id:
-            self.browser['patch_id'] = str(patch_id)
+        self.browser['queue_name'] = queue_name
+        if patch:
+            if patch.get('bug_id'):
+                self.browser['bug_id'] = str(patch['bug_id'])
+            if patch.get('id'):
+                self.browser['patch_id'] = str(patch['id'])
         self.browser['status'] = status
+        if results_file:
+            self.browser.add_file(results_file, "text/plain", "results.txt", 'results_file')
         self.browser.submit()
+
+    def patch_status(self, queue_name, patch_id):
+        update_status_url = "%s/patch-status/%s/%s" % (self.statusbot_server_url, queue_name, patch_id)
+        try:
+            return urllib2.urlopen(update_status_url).read()
+        except urllib2.HTTPError, e:
+            if e.code == 404:
+                return None
+            raise e
diff --git a/WebKitTools/Scripts/modules/stepsequence.py b/WebKitTools/Scripts/modules/stepsequence.py
new file mode 100644
index 0000000..6f085c9
--- /dev/null
+++ b/WebKitTools/Scripts/modules/stepsequence.py
@@ -0,0 +1,68 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from modules.buildsteps import CommandOptions
+from modules.executive import ScriptError
+from modules.logging import log
+from modules.scm import CheckoutNeedsUpdate
+from modules.workqueue import WorkQueue
+
+
+class StepSequence(object):
+    def __init__(self, steps):
+        self._steps = steps
+
+    def options(self):
+        collected_options = [
+            CommandOptions.parent_command,
+            CommandOptions.quiet,
+        ]
+        for step in self._steps:
+            collected_options = collected_options + step.options()
+        # Remove duplicates.
+        collected_options = sorted(set(collected_options))
+        return collected_options
+
+    def _run(self, tool, options, patch):
+        for step in self._steps:
+            step(tool, options, patch).run()
+
+    def run_and_handle_errors(self, tool, options, patch=None):
+        try:
+            self._run(tool, options, patch)
+        except CheckoutNeedsUpdate, e:
+            log("Commit failed because the checkout is out of date.  Please update and try again.")
+            log("You can pass --no-build to skip building/testing after update if you believe the new commits did not affect the results.")
+            WorkQueue.exit_after_handled_error(e)
+        except ScriptError, e:
+            if not options.quiet:
+                log(e.message_with_output())
+            if options.parent_command:
+                command = tool.command_by_name(options.parent_command)
+                command.handle_script_error(tool, patch, e)
+            WorkQueue.exit_after_handled_error(e)
diff --git a/WebKitTools/Scripts/modules/webkitport.py b/WebKitTools/Scripts/modules/webkitport.py
new file mode 100644
index 0000000..849ac4b
--- /dev/null
+++ b/WebKitTools/Scripts/modules/webkitport.py
@@ -0,0 +1,118 @@
+# Copyright (C) 2009, Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# WebKit's Python module for understanding the various ports
+
+import os
+
+from optparse import make_option
+
+class WebKitPort():
+    # We might need to pass scm into this function for scm.checkout_root
+    @classmethod
+    def script_path(cls, script_name):
+        return os.path.join("WebKitTools", "Scripts", script_name)
+
+    @staticmethod
+    def port(port_name):
+        if port_name == "mac":
+            return MacPort
+        if port_name == "qt":
+            return QtPort
+        if port_name == "chromium":
+            return ChromiumPort
+        # FIXME: We should default to WinPort on Windows.
+        return MacPort
+
+    @classmethod
+    def name(cls):
+        raise NotImplementedError, "subclasses must implement"
+
+    @classmethod
+    def flag(cls):
+        raise NotImplementedError, "subclasses must implement"
+
+    @classmethod
+    def update_webkit_command(cls):
+        return [cls.script_path("update-webkit")]
+
+    @classmethod
+    def build_webkit_command(cls):
+        return [cls.script_path("build-webkit")]
+
+    @classmethod
+    def run_webkit_tests_command(cls):
+        return [cls.script_path("run-webkit-tests")]
+
+
+class MacPort(WebKitPort):
+    @classmethod
+    def name(cls):
+        return "Mac"
+
+    @classmethod
+    def flag(cls):
+        return "--port=mac"
+
+
+class QtPort(WebKitPort):
+    @classmethod
+    def name(cls):
+        return "Qt"
+
+    @classmethod
+    def flag(cls):
+        return "--port=qt"
+
+    @classmethod
+    def build_webkit_command(cls):
+        command = WebKitPort.build_webkit_command()
+        command.append("--qt")
+        return command
+
+
+class ChromiumPort(WebKitPort):
+    @classmethod
+    def name(cls):
+        return "Chromium"
+
+    @classmethod
+    def flag(cls):
+        return "--port=chromium"
+
+    @classmethod
+    def update_webkit_command(cls):
+        command = WebKitPort.update_webkit_command()
+        command.append("--chromium")
+        return command
+
+    @classmethod
+    def build_webkit_command(cls):
+        command = WebKitPort.build_webkit_command()
+        command.append("--chromium")
+        return command
diff --git a/WebKitTools/Scripts/modules/webkitport_unittest.py b/WebKitTools/Scripts/modules/webkitport_unittest.py
new file mode 100644
index 0000000..c713e83
--- /dev/null
+++ b/WebKitTools/Scripts/modules/webkitport_unittest.py
@@ -0,0 +1,56 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from modules.webkitport import WebKitPort, MacPort, QtPort, ChromiumPort
+
+class WebKitPortTest(unittest.TestCase):
+    def test_mac_port(self):
+        self.assertEquals(MacPort.name(), "Mac")
+        self.assertEquals(MacPort.flag(), "--port=mac")
+        self.assertEquals(MacPort.run_webkit_tests_command(), [WebKitPort.script_path("run-webkit-tests")])
+        self.assertEquals(MacPort.build_webkit_command(), [WebKitPort.script_path("build-webkit")])
+
+    def test_qt_port(self):
+        self.assertEquals(QtPort.name(), "Qt")
+        self.assertEquals(QtPort.flag(), "--port=qt")
+        self.assertEquals(QtPort.run_webkit_tests_command(), [WebKitPort.script_path("run-webkit-tests")])
+        self.assertEquals(QtPort.build_webkit_command(), [WebKitPort.script_path("build-webkit"), "--qt"])
+
+    def test_chromium_port(self):
+        self.assertEquals(ChromiumPort.name(), "Chromium")
+        self.assertEquals(ChromiumPort.flag(), "--port=chromium")
+        self.assertEquals(ChromiumPort.run_webkit_tests_command(), [WebKitPort.script_path("run-webkit-tests")])
+        self.assertEquals(ChromiumPort.build_webkit_command(), [WebKitPort.script_path("build-webkit"), "--chromium"])
+        self.assertEquals(ChromiumPort.update_webkit_command(), [WebKitPort.script_path("update-webkit"), "--chromium"])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/Scripts/modules/workqueue.py b/WebKitTools/Scripts/modules/workqueue.py
new file mode 100644
index 0000000..f8cbba8
--- /dev/null
+++ b/WebKitTools/Scripts/modules/workqueue.py
@@ -0,0 +1,159 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+# Copyright (c) 2009 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+import time
+import traceback
+
+from datetime import datetime, timedelta
+
+from modules.executive import ScriptError
+from modules.logging import log, OutputTee
+from modules.statusbot import StatusBot
+
+class WorkQueueDelegate:
+    def queue_name(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def queue_log_path(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def work_logs_directory(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def status_host(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def begin_work_queue(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def should_continue_work_queue(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def next_work_item(self):
+        raise NotImplementedError, "subclasses must implement"
+
+    def should_proceed_with_work_item(self, work_item):
+        # returns (safe_to_proceed, waiting_message, patch)
+        raise NotImplementedError, "subclasses must implement"
+
+    def process_work_item(self, work_item):
+        raise NotImplementedError, "subclasses must implement"
+
+    def handle_unexpected_error(self, work_item, message):
+        raise NotImplementedError, "subclasses must implement"
+
+
+class WorkQueue:
+    def __init__(self, name, delegate):
+        self._name = name
+        self._delegate = delegate
+        self._output_tee = OutputTee()
+
+    log_date_format = "%Y-%m-%d %H:%M:%S"
+    sleep_duration_text = "5 mins"
+    seconds_to_sleep = 300
+    handled_error_code = 2
+
+    # Child processes exit with a special code to the parent queue process can detect the error was handled.
+    @classmethod
+    def exit_after_handled_error(cls, error):
+        log(error)
+        exit(cls.handled_error_code)
+
+    def run(self):
+        self._begin_logging()
+        self.status_bot = StatusBot(host=self._delegate.status_host())
+
+        self._delegate.begin_work_queue()
+        while (self._delegate.should_continue_work_queue()):
+            self._ensure_work_log_closed()
+            try:
+                work_item = self._delegate.next_work_item()
+                if not work_item:
+                    self._update_status_and_sleep("Empty queue.")
+                    continue
+                (safe_to_proceed, waiting_message, patch) = self._delegate.should_proceed_with_work_item(work_item)
+                if not safe_to_proceed:
+                    self._update_status_and_sleep(waiting_message)
+                    continue
+                self.status_bot.update_status(self._name, waiting_message, patch)
+            except KeyboardInterrupt, e:
+                log("\nUser terminated queue.")
+                return 1
+            except Exception, e:
+                traceback.print_exc()
+                # Don't try tell the status bot, in case telling it causes an exception.
+                self._sleep("Exception while preparing queue: %s." % e)
+                continue
+
+            # FIXME: Work logs should not depend on bug_id specificaly.
+            self._open_work_log(patch["bug_id"])
+            try:
+                self._delegate.process_work_item(work_item)
+            except ScriptError, e:
+                # Use a special exit code to indicate that the error was already
+                # handled in the child process and we should just keep looping.
+                if e.exit_code == self.handled_error_code:
+                    continue
+                message = "Unexpected failure when landing patch!  Please file a bug against bugzilla-tool.\n%s" % e.message_with_output()
+                self._delegate.handle_unexpected_error(work_item, message)
+        # Never reached.
+        self._ensure_work_log_closed()
+
+    def _begin_logging(self):
+        self._queue_log = self._output_tee.add_log(self._delegate.queue_log_path())
+        self._work_log = None
+
+    def _open_work_log(self, bug_id):
+        work_log_path = os.path.join(self._delegate.work_logs_directory(), "%s.log" % bug_id)
+        self._work_log = self._output_tee.add_log(work_log_path)
+
+    def _ensure_work_log_closed(self):
+        # If we still have a bug log open, close it.
+        if self._work_log:
+            self._output_tee.remove_log(self._work_log)
+            self._work_log = None
+
+    @classmethod
+    def _sleep_message(cls, message):
+        wake_time = datetime.now() + timedelta(seconds=cls.seconds_to_sleep)
+        return "%s Sleeping until %s (%s)." % (message, wake_time.strftime(cls.log_date_format), cls.sleep_duration_text)
+
+    @classmethod
+    def _sleep(cls, message):
+        log(cls._sleep_message(message))
+        time.sleep(cls.seconds_to_sleep)
+
+    def _update_status_and_sleep(self, message):
+        status_message = self._sleep_message(message)
+        self.status_bot.update_status(self._name, status_message)
+        log(status_message)
+        time.sleep(self.seconds_to_sleep)
diff --git a/WebKitTools/Scripts/modules/workqueue_unittest.py b/WebKitTools/Scripts/modules/workqueue_unittest.py
new file mode 100644
index 0000000..ed77b5f
--- /dev/null
+++ b/WebKitTools/Scripts/modules/workqueue_unittest.py
@@ -0,0 +1,176 @@
+#!/usr/bin/env python
+# Copyright (c) 2009, Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+import shutil
+import tempfile
+import unittest
+
+from modules.executive import ScriptError
+from modules.workqueue import WorkQueue, WorkQueueDelegate
+
+class LoggingDelegate(WorkQueueDelegate):
+    def __init__(self, test):
+        self._test = test
+        self._callbacks = []
+        self._run_before = False
+
+    expected_callbacks = [
+        'queue_log_path',
+        'status_host',
+        'begin_work_queue',
+        'should_continue_work_queue',
+        'next_work_item',
+        'should_proceed_with_work_item',
+        'work_logs_directory',
+        'process_work_item',
+        'should_continue_work_queue'
+    ]
+
+    def record(self, method_name):
+        self._callbacks.append(method_name)
+
+    def queue_log_path(self):
+        self.record("queue_log_path")
+        return os.path.join(self._test.temp_dir, "queue_log_path")
+
+    def work_logs_directory(self):
+        self.record("work_logs_directory")
+        return os.path.join(self._test.temp_dir, "work_log_path")
+
+    def status_host(self):
+        self.record("status_host")
+        return None
+
+    def begin_work_queue(self):
+        self.record("begin_work_queue")
+
+    def should_continue_work_queue(self):
+        self.record("should_continue_work_queue")
+        if not self._run_before:
+            self._run_before = True
+            return True
+        return False
+
+    def next_work_item(self):
+        self.record("next_work_item")
+        return "work_item"
+
+    def should_proceed_with_work_item(self, work_item):
+        self.record("should_proceed_with_work_item")
+        self._test.assertEquals(work_item, "work_item")
+        fake_patch = { 'bug_id' : 42 }
+        return (True, "waiting_message", fake_patch)
+
+    def process_work_item(self, work_item):
+        self.record("process_work_item")
+        self._test.assertEquals(work_item, "work_item")
+
+    def handle_unexpected_error(self, work_item, message):
+        self.record("handle_unexpected_error")
+        self._test.assertEquals(work_item, "work_item")
+
+
+class ThrowErrorDelegate(LoggingDelegate):
+    def __init__(self, test, error_code):
+        LoggingDelegate.__init__(self, test)
+        self.error_code = error_code
+
+    def process_work_item(self, work_item):
+        self.record("process_work_item")
+        raise ScriptError(exit_code=self.error_code)
+
+
+class NotSafeToProceedDelegate(LoggingDelegate):
+    def should_proceed_with_work_item(self, work_item):
+        self.record("should_proceed_with_work_item")
+        self._test.assertEquals(work_item, "work_item")
+        fake_patch = { 'bug_id' : 42 }
+        return (False, "waiting_message", fake_patch)
+
+
+class FastWorkQueue(WorkQueue):
+    def __init__(self, delegate):
+        WorkQueue.__init__(self, "fast-queue", delegate)
+
+    # No sleep for the wicked.
+    seconds_to_sleep = 0
+
+    def _update_status_and_sleep(self, message):
+        pass
+
+
+class WorkQueueTest(unittest.TestCase):
+    def test_trivial(self):
+        delegate = LoggingDelegate(self)
+        work_queue = WorkQueue("trivial-queue", delegate)
+        work_queue.run()
+        self.assertEquals(delegate._callbacks, LoggingDelegate.expected_callbacks)
+        self.assertTrue(os.path.exists(delegate.queue_log_path()))
+        self.assertTrue(os.path.exists(os.path.join(delegate.work_logs_directory(), "42.log")))
+
+    def test_unexpected_error(self):
+        delegate = ThrowErrorDelegate(self, 3)
+        work_queue = WorkQueue("error-queue", delegate)
+        work_queue.run()
+        expected_callbacks = LoggingDelegate.expected_callbacks[:]
+        work_item_index = expected_callbacks.index('process_work_item')
+        # The unexpected error should be handled right after process_work_item starts
+        # but before any other callback.  Otherwise callbacks should be normal.
+        expected_callbacks.insert(work_item_index + 1, 'handle_unexpected_error')
+        self.assertEquals(delegate._callbacks, expected_callbacks)
+
+    def test_handled_error(self):
+        delegate = ThrowErrorDelegate(self, WorkQueue.handled_error_code)
+        work_queue = WorkQueue("handled-error-queue", delegate)
+        work_queue.run()
+        self.assertEquals(delegate._callbacks, LoggingDelegate.expected_callbacks)
+
+    def test_not_safe_to_proceed(self):
+        delegate = NotSafeToProceedDelegate(self)
+        work_queue = FastWorkQueue(delegate)
+        work_queue.run()
+        expected_callbacks = LoggingDelegate.expected_callbacks[:]
+        next_work_item_index = expected_callbacks.index('next_work_item')
+        # We slice out the common part of the expected callbacks.
+        # We add 2 here to include should_proceed_with_work_item, which is
+        # a pain to search for directly because it occurs twice.
+        expected_callbacks = expected_callbacks[:next_work_item_index + 2]
+        expected_callbacks.append('should_continue_work_queue')
+        self.assertEquals(delegate._callbacks, expected_callbacks)
+
+    def setUp(self):
+        self.temp_dir = tempfile.mkdtemp(suffix="work_queue_test_logs")
+
+    def tearDown(self):
+        shutil.rmtree(self.temp_dir)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/Scripts/prepare-ChangeLog b/WebKitTools/Scripts/prepare-ChangeLog
index dd864df..4c59af9 100755
--- a/WebKitTools/Scripts/prepare-ChangeLog
+++ b/WebKitTools/Scripts/prepare-ChangeLog
@@ -65,8 +65,8 @@ use POSIX qw(strftime);
 use VCSUtils;
 
 sub changeLogDate($);
-sub changeLogEmailAddress($);
-sub changeLogName($);
+sub changeLogEmailAddressFromArgs($);
+sub changeLogNameFromArgs($);
 sub firstDirectoryOrCwd();
 sub diffFromToString();
 sub diffCommand(@);
@@ -77,7 +77,6 @@ sub findOriginalFileFromSvn($);
 sub determinePropertyChanges($$$);
 sub pluralizeAndList($$@);
 sub generateFileList(\@\@\%);
-sub gitConfig($);
 sub isUnmodifiedStatus($);
 sub isModifiedStatus($);
 sub isAddedStatus($);
@@ -246,8 +245,8 @@ if (%changed_line_ranges) {
 
 # Get some parameters for the ChangeLog we are about to write.
 my $date = changeLogDate($changeLogTimeZone);
-$name = changeLogName($name);
-$emailAddress = changeLogEmailAddress($emailAddress);
+$name = changeLogNameFromArgs($name);
+$emailAddress = changeLogEmailAddressFromArgs($emailAddress);
 
 print STDERR "  Change author: $name <$emailAddress>.\n";
 
@@ -443,62 +442,22 @@ sub changeLogDate($)
     return $date;
 }
 
-sub changeLogNameError($)
-{
-    my ($message) = @_;
-    print STDERR "$message\nEither:\n";
-    print STDERR "  set CHANGE_LOG_NAME in your environment\n";
-    print STDERR "  OR pass --name= on the command line\n";
-    print STDERR "  OR set REAL_NAME in your environment";
-    print STDERR "  OR git users can set 'git config user.name'\n";
-    exit(1);
-}
-
-sub changeLogName($)
+sub changeLogNameFromArgs($)
 {
     my ($nameFromArgs) = @_;
-    # Silently allow --git-commit to win, we could warn if $emailAddressFromArgs is defined.
+    # Silently allow --git-commit to win, we could warn if $nameFromArgs is defined.
     return `$GIT log --max-count=1 --pretty=\"format:%an\" \"$gitCommit\"` if $gitCommit;
 
-    my $name = $nameFromArgs
-        || $ENV{CHANGE_LOG_NAME}
-        || $ENV{REAL_NAME}
-        || gitConfig("user.name")
-        || (split /\s*,\s*/, (getpwuid $<)[6])[0];
-
-    changeLogNameError("Failed to determine ChangeLog name.") unless $name;
-    # getpwuid seems to always succeed on windows, returning the username instead of the full name.  This check will catch that case.
-    changeLogNameError("'$name' does not contain a space!  ChangeLogs should contain your full name.") unless ($name =~ /\w \w/);
-
-    return $name;
-}
-
-sub changeLogEmailAddressError($)
-{
-    my ($message) = @_;
-    print STDERR "$message\nEither:\n";
-    print STDERR "  set CHANGE_LOG_EMAIL_ADDRESS in your environment\n";
-    print STDERR "  OR pass --email= on the command line\n";
-    print STDERR "  OR set EMAIL_ADDRESS in your environment\n";
-    print STDERR "  OR git users can set 'git config user.email'\n";
-    exit(1);
+    return $nameFromArgs || changeLogName();
 }
 
-sub changeLogEmailAddress($)
+sub changeLogEmailAddressFromArgs($)
 {
     my ($emailAddressFromArgs) = @_;
     # Silently allow --git-commit to win, we could warn if $emailAddressFromArgs is defined.
     return `$GIT log --max-count=1 --pretty=\"format:%ae\" \"$gitCommit\"` if $gitCommit;
 
-    my $emailAddress = $emailAddressFromArgs
-        || $ENV{CHANGE_LOG_EMAIL_ADDRESS}
-        || $ENV{EMAIL_ADDRESS}
-        || gitConfig("user.email");
-
-    changeLogEmailAddressError("Failed to determine email address for ChangeLog.") unless $emailAddress;
-    changeLogEmailAddressError("Email address '$emailAddress' does not contain '\@' and is likely invalid.") unless ($emailAddress =~ /\@/);
-
-    return $emailAddress;
+    return $emailAddressFromArgs || changeLogEmailAddress();
 }
 
 sub get_function_line_ranges($$)
@@ -1477,20 +1436,6 @@ sub generateFileList(\@\@\%)
     close STAT;
 }
 
-sub gitConfig($)
-{
-    return unless $isGit;
-
-    my ($config) = @_;
-
-    my $result = `$GIT config $config`;
-    if (($? >> 8) != 0) {
-        $result = `$GIT repo-config $config`;
-    }
-    chomp $result;
-    return $result;
-}
-
 sub isUnmodifiedStatus($)
 {
     my ($status) = @_;
diff --git a/WebKitTools/Scripts/run-webkit-tests b/WebKitTools/Scripts/run-webkit-tests
index 6056035..6dd8339 100755
--- a/WebKitTools/Scripts/run-webkit-tests
+++ b/WebKitTools/Scripts/run-webkit-tests
@@ -76,6 +76,7 @@ sub buildPlatformTestHierarchy(@);
 sub closeCygpaths();
 sub closeDumpTool();
 sub closeHTTPD();
+sub closeWebSocketServer();
 sub countAndPrintLeaks($$$);
 sub countFinishedTest($$$$);
 sub deleteExpectedAndActualResults($);
@@ -86,15 +87,18 @@ sub fileNameWithNumber($$);
 sub htmlForResultsSection(\@$&);
 sub isTextOnlyTest($);
 sub launchWithCurrentEnv(@);
+sub resolveAndMakeTestResultsDirectory();
 sub numericcmp($$);
 sub openDiffTool();
 sub openDumpTool();
 sub openHTTPDIfNeeded();
 sub parseLeaksandPrintUniqueLeaks();
+sub openWebSocketServerIfNeeded();
 sub pathcmp($$);
 sub printFailureMessageForTest($$);
 sub processIgnoreTests($$);
 sub readFromDumpToolWithTimer(**);
+sub readSkippedFiles($);
 sub recordActualResultsAndDiff($$);
 sub sampleDumpTool();
 sub setFileHandleNonBlocking(*$);
@@ -117,6 +121,9 @@ my $guardMalloc = '';
 my $httpdPort = 8000;
 my $httpdSSLPort = 8443;
 my $ignoreMetrics = 0;
+my $webSocketPort = 8880;
+# wss is disabled until all platforms support pyOpenSSL.
+# my $webSocketSecurePort = 9323;
 my $ignoreTests = '';
 my $iterations = 1;
 my $launchSafari = 1;
@@ -185,6 +192,12 @@ if (isAppleMacWebKit()) {
     }
 } elsif (isGtk()) {
     $platform = "gtk";
+    if (!$ENV{"WEBKIT_TESTFONTS"}) {
+        print "The WEBKIT_TESTFONTS environment variable is not defined.\n";
+        print "You must set it before running the tests.\n";
+        print "Use git to grab the actual fonts from http://gitorious.org/qtwebkit/testfonts\n";
+        exit 1;
+    }
 } elsif (isWx()) {
     $platform = "wx";
 } elsif (isCygwin()) {
@@ -292,8 +305,6 @@ if (!$getOptionsResult || $showHelp) {
 my $ignoreSkipped = $treatSkipped eq "ignore";
 my $skippedOnly = $treatSkipped eq "only";
 
-!$skippedOnly || @ARGV == 0 or die "--skipped=only cannot be used when tests are specified on the command line.";
-
 my $configuration = configuration();
 
 $verbose = 1 if $testsPerDumpTool == 1;
@@ -347,12 +358,12 @@ if (!defined($root)) {
 }
 
 my $dumpToolName = "DumpRenderTree";
-$dumpToolName .= "_debug" if isCygwin() && $configuration ne "Release";
+$dumpToolName .= "_debug" if isCygwin() && configurationForVisualStudio() !~ /^Release|Debug_Internal$/;
 my $dumpTool = "$productDir/$dumpToolName";
 die "can't find executable $dumpToolName (looked in $productDir)\n" unless -x $dumpTool;
 
 my $imageDiffTool = "$productDir/ImageDiff";
-$imageDiffTool .= "_debug" if isCygwin() && $configuration ne "Release";
+$imageDiffTool .= "_debug" if isCygwin() && configurationForVisualStudio() !~ /^Release|Debug_Internal$/;
 die "can't find executable $imageDiffTool (looked in $productDir)\n" if $pixelTests && !-x $imageDiffTool;
 
 checkFrameworks() unless isCygwin();
@@ -412,6 +423,7 @@ if (checkWebCoreSVGSupport(0)) {
 
 if (!$testHTTP) {
     $ignoredDirectories{'http'} = 1;
+    $ignoredDirectories{'websocket'} = 1;
 }
 
 if (!$testMedia) {
@@ -449,7 +461,17 @@ if (!checkWebCoreWCSSSupport(0)) {
 }
 
 processIgnoreTests($ignoreTests, "ignore-tests") if $ignoreTests;
-readSkippedFiles() unless $ignoreSkipped;
+if (!$ignoreSkipped) {
+    if (!$skippedOnly || @ARGV == 0) {
+        readSkippedFiles("");
+    } else {
+        # Since readSkippedFiles() appends to @ARGV, we must use a foreach
+        # loop so that we only iterate over the original argument list.
+        foreach my $argnum (0 .. $#ARGV) {
+            readSkippedFiles(shift @ARGV);
+        }
+    }
+}
 
 my @tests = findTestsToRun();
 
@@ -485,6 +507,11 @@ my $atLineStart = 1;
 my $lastDirectory = "";
 
 my $isHttpdOpen = 0;
+my $isWebSocketServerOpen = 0;
+my $webSocketServerPID = 0;
+my $failedToStartWebSocketServer = 0;
+# wss is disabled until all platforms support pyOpenSSL.
+# my $webSocketSecureServerPID = 0;
 
 sub catch_pipe { $dumpToolCrashed = 1; }
 $SIG{"PIPE"} = "catch_pipe";
@@ -577,15 +604,7 @@ for my $test (@tests) {
         }
     }
 
-    if ($test !~ /^http\//) {
-        my $testPath = "$testDirectory/$test";
-        if (isCygwin()) {
-            $testPath = toWindowsPath($testPath);
-        } else {
-            $testPath = canonpath($testPath);
-        }
-        print OUT "$testPath$suffixExpectedHash\n";
-    } else {
+    if ($test =~ /^http\//) {
         openHTTPDIfNeeded();
         if ($test !~ /^http\/tests\/local\// && $test !~ /^http\/tests\/ssl\// && $test !~ /^http\/tests\/wml\// && $test !~ /^http\/tests\/media\//) {
             my $path = canonpath($test);
@@ -604,6 +623,41 @@ for my $test (@tests) {
             }
             print OUT "$testPath$suffixExpectedHash\n";
         }
+    } elsif ($test =~ /^websocket\//) {
+        if ($test =~ /^websocket\/tests\/local\//) {
+            my $testPath = "$testDirectory/$test";
+            if (isCygwin()) {
+                $testPath = toWindowsPath($testPath);
+            } else {
+                $testPath = canonpath($testPath);
+            }
+            print OUT "$testPath\n";
+        } else {
+            if (openWebSocketServerIfNeeded()) {
+                my $path = canonpath($test);
+                if ($test =~ /^websocket\/tests\/ssl\//) {
+                    # wss is disabled until all platforms support pyOpenSSL.
+                    print STDERR "Error: wss is disabled until all platforms support pyOpenSSL.";
+                    # print OUT "https://127.0.0.1:$webSocketSecurePort/$path\n";
+                } else {
+                    print OUT "http://127.0.0.1:$webSocketPort/$path\n";
+                }
+            } else {
+                # We failed to launch the WebSocket server.  Display a useful error message rather than attempting
+                # to run tests that expect the server to be available.
+                my $errorMessagePath = "$testDirectory/websocket/resources/server-failed-to-start.html";
+                $errorMessagePath = isCygwin() ? toWindowsPath($errorMessagePath) : canonpath($errorMessagePath);
+                print OUT "$errorMessagePath\n";
+            }
+        }
+    } else {
+        my $testPath = "$testDirectory/$test";
+        if (isCygwin()) {
+            $testPath = toWindowsPath($testPath);
+        } else {
+            $testPath = canonpath($testPath);
+        }
+        print OUT "$testPath$suffixExpectedHash\n";
     }
 
     # DumpRenderTree is expected to dump two "blocks" to stdout for each test.
@@ -892,6 +946,7 @@ printf "\n%0.2fs total testing time\n", (time - $overallStartTime) . "";
 !$isDumpToolOpen || die "Failed to close $dumpToolName.\n";
 
 closeHTTPD();
+closeWebSocketServer();
 
 # Because multiple instances of this script are running concurrently we cannot 
 # safely delete this symlink.
@@ -966,7 +1021,10 @@ close HTML;
 
 my @configurationArgs = argumentsForConfiguration();
 
-if (isQt() || isGtk()) {
+if (isGtk()) {
+  system "WebKitTools/Scripts/run-launcher", @configurationArgs, "file://".$testResults if $launchSafari;
+} elsif (isQt()) {
+  unshift @configurationArgs, qw(-graphicssystem raster -style windows);
   system "WebKitTools/Scripts/run-launcher", @configurationArgs, "file://".$testResults if $launchSafari;
 } elsif (isCygwin()) {
   system "cygstart", $testResults if $launchSafari;
@@ -1166,6 +1224,13 @@ sub launchWithCurrentEnv(@)
     return @args;
 }
 
+sub resolveAndMakeTestResultsDirectory()
+{
+    my $absTestResultsDirectory = File::Spec->rel2abs(glob $testResultsDirectory);
+    mkpath $absTestResultsDirectory;
+    return $absTestResultsDirectory;
+}
+
 sub openDiffTool()
 {
     return if $isDiffToolOpen;
@@ -1238,7 +1303,7 @@ sub openDumpTool()
     }
 
     if ($useValgrind) {
-        unshift @args, "valgrind";
+        unshift @args, "valgrind", "--suppressions=$platformBaseDirectory/qt/SuppressedValgrindErrors";
     } 
     
     $ENV{MallocStackLogging} = 1 if $shouldCheckLeaks;
@@ -1326,11 +1391,9 @@ sub openHTTPDIfNeeded()
     my $jsTestResourcesDirectory = $testDirectory . "/fast/js/resources";
     my $typesConfig = "$testDirectory/http/conf/mime.types";
     my $listen = "127.0.0.1:$httpdPort";
-    my $absTestResultsDirectory = File::Spec->rel2abs(glob $testResultsDirectory);
+    my $absTestResultsDirectory = resolveAndMakeTestResultsDirectory();
     my $sslCertificate = "$testDirectory/http/conf/webkit-httpd.pem";
 
-    mkpath $absTestResultsDirectory;
-
     my @args = (
         "-f", "$httpdConfig",
         "-C", "DocumentRoot \"$documentRoot\"",
@@ -1373,6 +1436,77 @@ sub closeHTTPD()
     $isHttpdOpen = 0;
 }
 
+sub openWebSocketServerIfNeeded()
+{
+    return 1 if $isWebSocketServerOpen;
+    return 0 if $failedToStartWebSocketServer;
+
+    my $webSocketServerPath = "/usr/bin/python";
+    my $webSocketPythonPath = "WebKitTools/pywebsocket";
+    my $webSocketHandlerDir = "$testDirectory";
+    my $webSocketHandlerScanDir = "$testDirectory/websocket/tests";
+    my $sslCertificate = "$testDirectory/http/conf/webkit-httpd.pem";
+    my $absTestResultsDirectory = resolveAndMakeTestResultsDirectory();
+    my $logFile = "$absTestResultsDirectory/pywebsocket_log.txt";
+
+    my @args = (
+        "WebKitTools/pywebsocket/mod_pywebsocket/standalone.py",
+        "-p", "$webSocketPort",
+        "-d", "$webSocketHandlerDir",
+        "-s", "$webSocketHandlerScanDir",
+        "-l", "$logFile",
+    );
+    # wss is disabled until all platforms support pyOpenSSL.
+    # my @argsSecure = (
+    #     "WebKitTools/pywebsocket/mod_pywebsocket/standalone.py",
+    #     "-p", "$webSocketSecurePort",
+    #     "-d", "$webSocketHandlerDir",
+    #     "-t",
+    #     "-k", "$sslCertificate",
+    #     "-c", "$sslCertificate",
+    # );
+
+    $ENV{"PYTHONPATH"} = $webSocketPythonPath;
+    $webSocketServerPID = open3(\*WEBSOCKETSERVER_IN, \*WEBSOCKETSERVER_OUT, \*WEBSOCKETSERVER_ERR, $webSocketServerPath, @args);
+    # wss is disabled until all platforms support pyOpenSSL.
+    # $webSocketSecureServerPID = open3(\*WEBSOCKETSECURESERVER_IN, \*WEBSOCKETSECURESERVER_OUT, \*WEBSOCKETSECURESERVER_ERR, $webSocketServerPath, @argsSecure);
+    # my @listen = ("http://127.0.0.1:$webSocketPort", "https://127.0.0.1:$webSocketSecurePort");
+    my @listen = ("http://127.0.0.1:$webSocketPort");
+    for (my $i = 0; $i < @listen; $i++) {
+        my $retryCount = 10;
+        while (system("/usr/bin/curl -k -q --silent --stderr - --output /dev/null $listen[$i]") && $retryCount) {
+            sleep 1;
+            --$retryCount;
+        }
+        unless ($retryCount) {
+            print STDERR "Timed out waiting for WebSocketServer to start.\n";
+            $failedToStartWebSocketServer = 1;
+            return 0;
+        }
+    }
+
+    $isWebSocketServerOpen = 1;
+    return 1;
+}
+
+sub closeWebSocketServer()
+{
+    return if !$isWebSocketServerOpen;
+
+    close WEBSOCKETSERVER_IN;
+    close WEBSOCKETSERVER_OUT;
+    close WEBSOCKETSERVER_ERR;
+    kill 15, $webSocketServerPID;
+
+    # wss is disabled until all platforms support pyOpenSSL.
+    # close WEBSOCKETSECURESERVER_IN;
+    # close WEBSOCKETSECURESERVER_OUT;
+    # close WEBSOCKETSECURESERVER_ERR;
+    # kill 15, $webSocketSecureServerPID;
+
+    $isWebSocketServerOpen = 0;
+}
+
 sub fileNameWithNumber($$)
 {
     my ($base, $number) = @_;
@@ -1980,8 +2114,10 @@ sub fileShouldBeIgnored
     return 0;
 }
 
-sub readSkippedFiles
+sub readSkippedFiles($)
 {
+    my ($constraintPath) = @_;
+
     foreach my $level (@platformTestHierarchy) {
         if (open SKIPPED, "<", "$level/Skipped") {
             if ($verbose) {
@@ -1996,8 +2132,19 @@ sub readSkippedFiles
                 $skipped =~ s/[ \n\r]+$//;
                 if ($skipped && $skipped !~ /^#/) {
                     if ($skippedOnly) {
-                        if (!&fileShouldBeIgnored($skipped)) {
-                            push(@ARGV, $skipped);
+                        if (!fileShouldBeIgnored($skipped)) {
+                            if (!$constraintPath) {
+                                # Always add $skipped since no constraint path was specified on the command line.
+                                push(@ARGV, $skipped);
+                            } elsif ($skipped =~ /^($constraintPath)/) {
+                                # Add $skipped only if it matches the current path constraint, e.g.,
+                                # "--skipped=only dir1" with "dir1/file1.html" on the skipped list.
+                                push(@ARGV, $skipped);
+                            } elsif ($constraintPath =~ /^($skipped)/) {
+                                # Add current path constraint if it is more specific than the skip list entry,
+                                # e.g., "--skipped=only dir1/dir2/dir3" with "dir1" on the skipped list.
+                                push(@ARGV, $constraintPath);
+                            }
                         } elsif ($verbose) {
                             print "    $skipped\n";
                         }
@@ -2068,6 +2215,9 @@ sub findTestsToRun
         }
     }
 
+    # Remove duplicate tests
+    @testsToRun = keys %{{ map { $_ => 1 } @testsToRun }};
+
     @testsToRun = sort pathcmp @testsToRun;
 
     # Reverse the tests
diff --git a/WebKitTools/Scripts/run-webkit-unittests b/WebKitTools/Scripts/run-webkit-unittests
index 8d0ef1d..3487299 100755
--- a/WebKitTools/Scripts/run-webkit-unittests
+++ b/WebKitTools/Scripts/run-webkit-unittests
@@ -32,11 +32,18 @@ import unittest
 from modules.bugzilla_unittest import *
 from modules.buildbot_unittest import *
 from modules.changelogs_unittest import *
+from modules.commands.download_unittest import *
+from modules.commands.upload_unittest import *
+from modules.commands.queries_unittest import *
+from modules.commands.queues_unittest import *
 from modules.committers_unittest import *
 from modules.cpp_style_unittest import *
 from modules.diff_parser_unittest import *
 from modules.logging_unittest import *
+from modules.multicommandtool_unittest import *
 from modules.scm_unittest import *
+from modules.webkitport_unittest import *
+from modules.workqueue_unittest import *
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/WebKitTools/Scripts/run-webkit-websocketserver b/WebKitTools/Scripts/run-webkit-websocketserver
new file mode 100755
index 0000000..e05303a
--- /dev/null
+++ b/WebKitTools/Scripts/run-webkit-websocketserver
@@ -0,0 +1,96 @@
+#!/usr/bin/perl
+# Copyright (C) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Script to run Web Socket server.
+
+use strict;
+use warnings;
+
+use File::Spec;
+use FindBin;
+use IPC::Open2;
+
+use lib $FindBin::Bin;
+use webkitdirs;
+
+sub closeWebSocketServer();
+sub openWebSocketServer();
+
+my $webSocketPort = 8880;
+
+my $srcDir = sourceDir();
+my $layoutTestsName = "$srcDir/LayoutTests";
+my $testDirectory = File::Spec->rel2abs($layoutTestsName);
+my $webSocketServerPID = 0;
+
+
+print "Starting Web Socket server...\n";
+openWebSocketServer();
+print "Started.\n";
+print "Hit [ENTER] to stop it.";
+<STDIN>;
+print "Stopping Web Socket server...\n";
+closeWebSocketServer();
+print "Stopped.\n";
+exit 0;
+
+
+sub openWebSocketServer()
+{
+    my $webSocketServerPath = "/usr/bin/python";
+    my $webSocketPythonPath = "$srcDir/WebKitTools/pywebsocket";
+    my $webSocketHandlerDir = "$testDirectory";
+    my $webSocketHandlerScanDir = "$testDirectory/websocket/tests";
+
+    my @args = (
+        "$srcDir/WebKitTools/pywebsocket/mod_pywebsocket/standalone.py",
+        "-p", "$webSocketPort",
+        "-d", "$webSocketHandlerDir",
+        "-s", "$webSocketHandlerScanDir",
+    );
+
+    $ENV{"PYTHONPATH"} = $webSocketPythonPath;
+    $webSocketServerPID = open2(\*WEBSOCKETSERVER_IN, \*WEBSOCKETSERVER_OUT, $webSocketServerPath, @args);
+
+    my $listen = "http://127.0.0.1:$webSocketPort";
+    my $retryCount = 10;
+    while (system("/usr/bin/curl -k -q --silent --stderr - --output /dev/null $listen") && $retryCount) {
+        sleep 1;
+        --$retryCount;
+    }
+    die "Timed out waiting for WebSocketServer to start" unless $retryCount;
+}
+
+sub closeWebSocketServer()
+{
+    close WEBSOCKETSERVER_IN;
+    close WEBSOCKETSERVER_OUT;
+    kill 15, $webSocketServerPID;
+}
+
diff --git a/WebKitTools/Scripts/svn-apply b/WebKitTools/Scripts/svn-apply
index 7d14e3a..0373aa5 100755
--- a/WebKitTools/Scripts/svn-apply
+++ b/WebKitTools/Scripts/svn-apply
@@ -55,7 +55,7 @@
 #   Notice a patch that's being applied at the "wrong level" and make it work anyway.
 #   Do a dry run on the whole patch and don't do anything if part of the patch is
 #       going to fail (probably too strict unless we exclude ChangeLog).
-#   Handle git-diff patches with binary changes
+#   Handle git-diff patches with binary delta
 
 use strict;
 use warnings;
@@ -75,11 +75,11 @@ sub addDirectoriesIfNeeded($);
 sub applyPatch($$;$);
 sub checksum($);
 sub handleBinaryChange($$);
+sub handleGitBinaryChange($$);
 sub isDirectoryEmptyForRemoval($);
 sub patch($);
 sub removeDirectoriesIfNeeded();
 sub setChangeLogDateAndReviewer($$);
-sub removeEOL($);
 
 # These should be replaced by an scm class/module:
 sub scmKnowsOfFile($);
@@ -277,6 +277,39 @@ sub handleBinaryChange($$)
     }
 }
 
+sub handleGitBinaryChange($$)
+{
+    my ($fullPath, $contents) = @_;
+
+    my ($binaryChunkType, $binaryChunk, $reverseBinaryChunkType, $reverseBinaryChunk) = decodeGitBinaryPatch($contents, $fullPath);
+    # FIXME: support "delta" type.
+    die "only literal type is supported now" if ($binaryChunkType ne "literal" || $reverseBinaryChunkType ne "literal");
+
+    my $isFileAddition = $contents =~ /\nnew file mode \d+\n/;
+    my $isFileDeletion = $contents =~ /\ndeleted file mode \d+\n/;
+
+    my $originalContents = "";
+    if (open FILE, $fullPath) {
+        die "$fullPath already exists" if $isFileAddition;
+
+        $originalContents = join("", <FILE>);
+        close FILE;
+    }
+    die "Original content of $fullPath mismatches" if $originalContents ne $reverseBinaryChunk;
+
+    if ($isFileDeletion) {
+        scmRemove($fullPath);
+    } else {
+        # Addition or Modification
+        open FILE, ">", $fullPath or die "Failed to open $fullPath.";
+        print FILE $binaryChunk;
+        close FILE;
+        if ($isFileAddition) {
+            scmAdd($fullPath);
+        }
+    }
+}
+
 sub isDirectoryEmptyForRemoval($)
 {
     my ($dir) = @_;
@@ -311,12 +344,14 @@ sub patch($)
     my $deletion = 0;
     my $addition = 0;
     my $isBinary = 0;
+    my $isGitBinary = 0;
 
     $addition = 1 if ($patch =~ /\n--- .+\(revision 0\)\r?\n/ || $patch =~ /\n@@ -0,0 .* @@/) && !exists($copiedFiles{$fullPath});
     $deletion = 1 if $patch =~ /\n@@ .* \+0,0 @@/;
     $isBinary = 1 if $patch =~ /\nCannot display: file marked as a binary type\./;
+    $isGitBinary = 1 if $patch =~ /\nGIT binary patch\n/;
 
-    if (!$addition && !$deletion && !$isBinary) {
+    if (!$addition && !$deletion && !$isBinary && !$isGitBinary) {
         # Standard patch, patch tool can handle this.
         if (basename($fullPath) eq "ChangeLog") {
             my $changeLogDotOrigExisted = -f "${fullPath}.orig";
@@ -333,6 +368,9 @@ sub patch($)
         if ($isBinary) {
             # Binary change
             handleBinaryChange($fullPath, $patch);
+        } elsif ($isGitBinary) {
+            # Git binary change
+            handleGitBinaryChange($fullPath, $patch);
         } elsif ($deletion) {
             # Deletion
             applyPatch($patch, $fullPath, ["--force"]);
@@ -378,14 +416,6 @@ sub setChangeLogDateAndReviewer($$)
     return $patch;
 }
 
-sub removeEOL($)
-{
-    my ($line) = @_;
-
-    $line =~ s/[\r\n]+$//g;
-    return $line;
-}
-
 # This could be made into a more general "status" call, except svn and git
 # have different ideas about "moving" files which might get confusing.
 sub scmWillDeleteFile($)
diff --git a/WebKitTools/Scripts/svn-unapply b/WebKitTools/Scripts/svn-unapply
index 94bb1ce..c277a3e 100755
--- a/WebKitTools/Scripts/svn-unapply
+++ b/WebKitTools/Scripts/svn-unapply
@@ -73,7 +73,6 @@ use VCSUtils;
 sub checksum($);
 sub patch($);
 sub revertDirectories();
-sub removeEOL($);
 sub unapplyPatch($$;$);
 sub unsetChangeLogDate($$);
 
@@ -259,14 +258,6 @@ sub revertDirectories()
     }
 }
 
-sub removeEOL($)
-{
-    my ($line) = @_;
-
-    $line =~ s/[\r\n]+$//g;
-    return $line;
-}
-
 sub unapplyPatch($$;$)
 {
     my ($patch, $fullPath, $options) = @_;
diff --git a/WebKitTools/Scripts/update-webkit b/WebKitTools/Scripts/update-webkit
index b503004..7602c41 100755
--- a/WebKitTools/Scripts/update-webkit
+++ b/WebKitTools/Scripts/update-webkit
@@ -39,6 +39,7 @@ use VCSUtils;
 use webkitdirs;
 
 sub runSvnUpdate();
+sub runGitUpdate();
 
 # Handle options
 my $quiet = '';
@@ -46,6 +47,11 @@ my $showHelp;
 
 determineIsChromium();
 
+chdirWebKit();
+
+my $isGit = isGit();
+my $isSVN = isSVN();
+
 my $getOptionsResult = GetOptions(
     'h|help'  => \$showHelp,
     'q|quiet' => \$quiet,
@@ -67,20 +73,23 @@ push @svnOptions, '-q' if $quiet;
 # Don't prompt when using svn-1.6 or newer.
 push @svnOptions, qw(--accept postpone) if isSVNVersion16OrNewer();
 
-chdirWebKit();
 print "Updating OpenSource\n" unless $quiet;
-runSvnUpdate();
+runSvnUpdate() if $isSVN;
+runGitUpdate() if $isGit;
 
 if (-d "../Internal") {
     chdir("../Internal");
     print "Updating Internal\n" unless $quiet;
-    runSvnUpdate();
+    runSvnUpdate() if $isSVN;
+    runGitUpdate() if $isGit;
 } elsif (isChromium()) {
     system("perl", "WebKitTools/Scripts/update-webkit-chromium") == 0 or die $!;
 } elsif (isAppleWinWebKit()) {
     system("perl", "WebKitTools/Scripts/update-webkit-auxiliary-libs") == 0 or die;
 }
 
+setupAppleWinEnv() if isAppleWinWebKit();
+
 exit 0;
 
 sub runSvnUpdate()
@@ -104,3 +113,8 @@ sub runSvnUpdate()
             or die "Could not open resolve-ChangeLogs script: $!.\n";
     }
 }
+
+sub runGitUpdate()
+{
+    system("git", "svn", "rebase") == 0 or die;
+}
diff --git a/WebKitTools/Scripts/update-webkit-chromium b/WebKitTools/Scripts/update-webkit-chromium
index a0cc19a..779b9a6 100644..100755
--- a/WebKitTools/Scripts/update-webkit-chromium
+++ b/WebKitTools/Scripts/update-webkit-chromium
@@ -48,4 +48,4 @@ if (! -e ".gclient") {
 
 # Execute gclient sync.
 print "Updating chromium port dependencies using gclient...\n";
-system("gclient", "sync") == 0 or die $!;
+system("gclient", "sync", "--force") == 0 or die $!;
diff --git a/WebKitTools/Scripts/validate-committer-lists b/WebKitTools/Scripts/validate-committer-lists
new file mode 100755
index 0000000..05f2b36
--- /dev/null
+++ b/WebKitTools/Scripts/validate-committer-lists
@@ -0,0 +1,252 @@
+#!/usr/bin/env python
+
+# Copyright (c) 2009, Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Checks Python's known list of committers against lists.webkit.org and SVN history.
+
+
+import os
+import subprocess
+import re
+import urllib2
+from datetime import date, datetime, timedelta
+from modules.committers import CommitterList
+from modules.logging import log, error
+
+# WebKit includes a built copy of BeautifulSoup in Scripts/modules
+# so this import should always succeed.
+from modules.BeautifulSoup import BeautifulSoup
+
+def print_list_if_non_empty(title, list_to_print):
+    if not list_to_print:
+        return
+    print # Newline before the list
+    print title
+    for item in list_to_print:
+        print item
+
+class CommitterListFromMailingList:
+    committers_list_url = "http://lists.webkit.org/mailman/roster.cgi/webkit-committers"
+    reviewers_list_url = "http://lists.webkit.org/mailman/roster.cgi/webkit-reviewers"
+
+    def _fetch_emails_from_page(self, url):
+        page = urllib2.urlopen(url)
+        soup = BeautifulSoup(page)
+
+        emails = []
+        # Grab the cells in the first column (which happens to be the bug ids).
+        for email_item in soup('li'):
+            email_link = email_item.find("a")
+            email = email_link.string.replace(" at ", "@") # The email is obfuscated using " at " instead of "@".
+            emails.append(email)
+        return emails
+
+    @staticmethod
+    def _commiters_not_found_in_email_list(committers, emails):
+        missing_from_mailing_list = []
+        for committer in committers:
+            for email in committer.emails:
+                if email in emails:
+                    break
+            else:
+                missing_from_mailing_list.append(committer)
+        return missing_from_mailing_list
+
+    @staticmethod
+    def _emails_not_found_in_committer_list(committers, emails):
+        email_to_committer_map = {}
+        for committer in committers:
+            for email in committer.emails:
+                email_to_committer_map[email] = committer
+
+        return filter(lambda email: not email_to_committer_map.get(email), emails)
+
+    def check_for_emails_missing_from_list(self, committer_list):
+        committer_emails = self._fetch_emails_from_page(self.committers_list_url)
+        list_name = "webkit-committers@lists.webkit.org"
+
+        missing_from_mailing_list = self._commiters_not_found_in_email_list(committer_list.committers(), committer_emails)
+        print_list_if_non_empty("Committers missing from %s:" % list_name, missing_from_mailing_list)
+
+        users_missing_from_committers = self._emails_not_found_in_committer_list(committer_list.committers(), committer_emails)
+        print_list_if_non_empty("Subcribers to %s missing from committer.py:" % list_name, users_missing_from_committers)
+
+
+        reviewer_emails = self._fetch_emails_from_page(self.reviewers_list_url)
+        list_name = "webkit-reviewers@lists.webkit.org"
+
+        missing_from_mailing_list = self._commiters_not_found_in_email_list(committer_list.reviewers(), reviewer_emails)
+        print_list_if_non_empty("Reviewers missing from %s:" % list_name, missing_from_mailing_list)
+
+        missing_from_reviewers = self._emails_not_found_in_committer_list(committer_list.reviewers(), reviewer_emails)
+        print_list_if_non_empty("Subcribers to %s missing from reviewers in committer.py:" % list_name, missing_from_reviewers)
+
+        missing_from_committers = self._emails_not_found_in_committer_list(committer_list.committers(), reviewer_emails)
+        print_list_if_non_empty("Subcribers to %s completely missing from committers.py" % list_name, missing_from_committers)
+
+
+class CommitterListFromGit:
+    login_to_email_address = {
+        'aliceli1' : 'alice.liu@apple.com',
+        'bdash' : 'mrowe@apple.com',
+        'bdibello' : 'bdibello@apple.com', # Bruce DiBello, only 4 commits: r10023, r9548, r9538, r9535
+        'cblu' : 'cblu@apple.com',
+        'cpeterse' : 'cpetersen@apple.com',
+        'eseidel' : 'eric@webkit.org',
+        'gdennis' : 'gdennis@webkit.org',
+        'goldsmit' : 'goldsmit@apple.com', # Debbie Goldsmith, only one commit r8839
+        'gramps' : 'gramps@apple.com',
+        'honeycutt' : 'jhoneycutt@apple.com',
+        'jdevalk' : 'joost@webkit.org',
+        'jens' : 'jens@apple.com',
+        'justing' : 'justin.garcia@apple.com',
+        'kali' : 'kali@apple.com', # Christy Warren, did BIDI work, 5 commits: r8815, r8802, r8801, r8791, r8773, r8603
+        'kjk' : 'kkowalczyk@gmail.com',
+        'kmccullo' : 'kmccullough@apple.com',
+        'kocienda' : 'kocienda@apple.com',
+        'lamadio' : 'lamadio@apple.com', # Lou Amadio, only 2 commits: r17949 and r17783
+        'lars' : 'lars@kde.org',
+        'lweintraub' : 'lweintraub@apple.com',
+        'lypanov' : 'lypanov@kde.org',
+        'mhay' : 'mhay@apple.com', # Mike Hay, 3 commits: r3813, r2552, r2548
+        'ouch' : 'ouch@apple.com', # John Louch
+        'pyeh' : 'patti@apple.com', # Patti Yeh, did VoiceOver work in WebKit
+        'rjw' : 'rjw@apple.com',
+        'seangies' : 'seangies@apple.com', # Sean Gies?, only 5 commits: r16600, r16592, r16511, r16489, r16484
+        'sheridan' : 'sheridan@apple.com', # Shelly Sheridan
+        'thatcher' : 'timothy@apple.com',
+        'tomernic' : 'timo@apple.com',
+        'trey' : 'trey@usa.net',
+        'tristan' : 'tristan@apple.com',
+        'vicki' : 'vicki@apple.com',
+        'voas' : 'voas@apple.com', # Ed Voas, did some Carbon work in WebKit
+        'zack' : 'zack@kde.org',
+        'zimmermann' : 'zimmermann@webkit.org',
+    }
+
+    def __init__(self):
+        self._last_commit_time_by_author_cache = {}
+
+    def _fetch_authors_and_last_commit_time_from_git_log(self):
+        last_commit_dates = {}
+        git_log_args = ['git', 'log', '--reverse', '--pretty=format:%ae %at']
+        process = subprocess.Popen(git_log_args, stdout=subprocess.PIPE)
+
+        # eric@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc 1257090899
+        line_regexp = re.compile("^(?P<author>.+)@\S+ (?P<timestamp>\d+)$")
+        while True:
+            output_line = process.stdout.readline()
+            if output_line == '' and process.poll() != None:
+                return last_commit_dates
+
+            match_result = line_regexp.match(output_line)
+            if not match_result:
+                error("Failed to match line: %s" % output_line)
+            last_commit_dates[match_result.group('author')] = float(match_result.group('timestamp'))
+
+    def _fill_in_emails_for_old_logins(self):
+        authors_missing_email = filter(lambda author: author.find('@') == -1, self._last_commit_time_by_author_cache)
+        authors_with_email = filter(lambda author: author.find('@') != -1, self._last_commit_time_by_author_cache)
+        prefixes_of_authors_with_email = map(lambda author: author.split('@')[0], authors_with_email)
+
+        for author in authors_missing_email:
+            # First check to see if we have a manual mapping from login to email.
+            author_email = self.login_to_email_address.get(author)
+
+            # Most old logins like 'darin' are now just 'darin@apple.com', so check for a prefix match if a manual mapping was not found.
+            if not author_email and author in prefixes_of_authors_with_email:
+                author_email_index = prefixes_of_authors_with_email.index(author)
+                author_email = authors_with_email[author_email_index]
+
+            if not author_email:
+                # No known email mapping, likely not an active committer.  We could log here.
+                continue
+
+            # log("%s -> %s" % (author, author_email)) # For sanity checking.
+            no_email_commit_time = self._last_commit_time_by_author_cache.get(author)
+            email_commit_time = self._last_commit_time_by_author_cache.get(author_email)
+            # We compare the timestamps for extra sanity even though we could assume commits before email address were used for login are always going to be older.
+            if not email_commit_time or email_commit_time < no_email_commit_time:
+                self._last_commit_time_by_author_cache[author_email] = no_email_commit_time
+            del self._last_commit_time_by_author_cache[author]
+
+    def _last_commit_by_author(self):
+        if not self._last_commit_time_by_author_cache:
+            self._last_commit_time_by_author_cache = self._fetch_authors_and_last_commit_time_from_git_log()
+            self._fill_in_emails_for_old_logins()
+            del self._last_commit_time_by_author_cache['(no author)'] # The initial svn import isn't very useful.
+        return self._last_commit_time_by_author_cache
+
+    @staticmethod
+    def _print_three_column_row(widths, values):
+        print "%s%s%s" % (values[0].ljust(widths[0]), values[1].ljust(widths[1]), values[2])
+
+    def print_possibly_expired_committers(self, committer_list):
+        authors_and_last_commits = self._last_commit_by_author().items()
+        authors_and_last_commits.sort(lambda a,b: cmp(a[1], b[1]), reverse=True)
+        committer_cuttof = date.today() - timedelta(days=365)
+        column_widths = [13, 25]
+        print
+        print "Committers who have not committed within one year:"
+        self._print_three_column_row(column_widths, ("Last Commit", "Committer Email", "Committer Record"))
+        for (author, last_commit) in authors_and_last_commits:
+            last_commit_date = date.fromtimestamp(last_commit)
+            if committer_cuttof > last_commit_date:
+                committer_record = committer_list.committer_by_email(author)
+                self._print_three_column_row(column_widths, (str(last_commit_date), author, committer_record))
+
+    def print_committers_missing_from_committer_list(self, committer_list):
+        missing_from_committers_py = []
+        last_commit_time_by_author = self._last_commit_by_author()
+        for author in last_commit_time_by_author:
+            if not committer_list.committer_by_email(author):
+                missing_from_committers_py.append(author)
+
+        never_committed = []
+        for committer in committer_list.committers():
+            for email in committer.emails:
+                if last_commit_time_by_author.get(email):
+                    break
+            else:
+                never_committed.append(committer)
+
+        print_list_if_non_empty("Historical committers missing from committer.py:", missing_from_committers_py)
+        print_list_if_non_empty("Committers in committer.py who have never committed:", never_committed)
+
+
+def main():
+    committer_list = CommitterList()
+    CommitterListFromMailingList().check_for_emails_missing_from_list(committer_list)
+
+    svn_committer_list = CommitterListFromGit()
+    svn_committer_list.print_possibly_expired_committers(committer_list)
+    svn_committer_list.print_committers_missing_from_committer_list(committer_list)
+
+if __name__ == "__main__":
+    main()
diff --git a/WebKitTools/Scripts/webkitdirs.pm b/WebKitTools/Scripts/webkitdirs.pm
index 16f9c26..64e5dc4 100644
--- a/WebKitTools/Scripts/webkitdirs.pm
+++ b/WebKitTools/Scripts/webkitdirs.pm
@@ -67,6 +67,7 @@ my $isChromium;
 # Variables for Win32 support
 my $vcBuildPath;
 my $windowsTmpPath;
+my $windowsSourceDir;
 
 sub determineSourceDir
 {
@@ -521,9 +522,19 @@ sub builtDylibPathForName
 {
     my $libraryName = shift;
     determineConfigurationProductDir();
-    if (isQt() or isChromium()) {
+    if (isChromium()) {
         return "$configurationProductDir/$libraryName";
     }
+    if (isQt()) {
+        $libraryName = "QtWebKit";
+        if (isDarwin() and -d "$configurationProductDir/lib/$libraryName.framework") {
+            return "$configurationProductDir/lib/$libraryName.framework/$libraryName";
+        } elsif (isWindows() or isCygwin()) {
+            return "$configurationProductDir/lib/$libraryName.dll";
+        } else {
+            return "$configurationProductDir/lib/lib$libraryName.so";
+        }
+    }
     if (isWx()) {
         return "$configurationProductDir/libwxwebkit.dylib";
     }
@@ -561,7 +572,7 @@ sub libraryContainsSymbol
     my $path = shift;
     my $symbol = shift;
 
-    if (isCygwin()) {
+    if (isCygwin() or isWindows()) {
         # FIXME: Implement this for Windows.
         return 0;
     }
@@ -637,7 +648,8 @@ sub checkWebCoreSVGSupport
 
 sub hasAcceleratedCompositingSupport
 {
-    return 0 if isCygwin() || isQt();
+    # On platforms other than Mac the Skipped files are used to skip compositing tests
+    return 1 if !isAppleMacWebKit();
 
     my $path = shift;
     return libraryContainsSymbol($path, "GraphicsLayer");
@@ -657,7 +669,8 @@ sub checkWebCoreAcceleratedCompositingSupport
 
 sub has3DRenderingSupport
 {
-    return 0 if isQt();
+    # On platforms other than Mac the Skipped files are used to skip 3D tests
+    return 1 if !isAppleMacWebKit();
 
     my $path = shift;
     return libraryContainsSymbol($path, "WebCoreHas3DRendering");
@@ -680,7 +693,7 @@ sub has3DCanvasSupport
     return 0 if isQt();
 
     my $path = shift;
-    return libraryContainsSymbol($path, "CanvasShader");
+    return libraryContainsSymbol($path, "WebGLShader");
 }
 
 sub checkWebCore3DCanvasSupport
@@ -974,6 +987,11 @@ sub isSnowLeopard()
     return isDarwin() && osXVersion()->{"minor"} == 6;
 }
 
+sub isWindowsNT()
+{
+    return $ENV{'OS'} eq 'Windows_NT';
+}
+
 sub relativeScriptsDir()
 {
     my $scriptDir = File::Spec->catpath("", File::Spec->abs2rel(dirname($0), getcwd()), "");
@@ -1025,7 +1043,7 @@ sub checkRequiredSystemConfig
             print "http://developer.apple.com/tools/xcode\n";
             print "*************************************************************\n";
         }
-    } elsif (isGtk() or isQt() or isWx() or isChromium()) {
+    } elsif (isGtk() or isQt() or isWx()) {
         my @cmds = qw(flex bison gperf);
         my @missing = ();
         foreach my $cmd (@cmds) {
@@ -1041,6 +1059,68 @@ sub checkRequiredSystemConfig
     # Win32 and other platforms may want to check for minimum config
 }
 
+sub determineWindowsSourceDir()
+{
+    return if $windowsSourceDir;
+    my $sourceDir = sourceDir();
+    chomp($windowsSourceDir = `cygpath -w $sourceDir`);
+}
+
+sub windowsSourceDir()
+{
+    determineWindowsSourceDir();
+    return $windowsSourceDir;
+}
+
+sub windowsLibrariesDir()
+{
+    return windowsSourceDir() . "\\WebKitLibraries\\win";
+}
+
+sub windowsOutputDir()
+{
+    return windowsSourceDir() . "\\WebKitBuild";
+}
+
+sub setupAppleWinEnv()
+{
+    return unless isAppleWinWebKit();
+
+    if (isWindowsNT()) {
+        my $restartNeeded = 0;
+        my %variablesToSet = ();
+
+        # Setting the environment variable 'CYGWIN' to 'tty' makes cygwin enable extra support (i.e., termios)
+        # for UNIX-like ttys in the Windows console
+        $variablesToSet{CYGWIN} = "tty" unless $ENV{CYGWIN};
+        
+        # Those environment variables must be set to be able to build inside Visual Studio.
+        $variablesToSet{WEBKITLIBRARIESDIR} = windowsLibrariesDir() unless $ENV{WEBKITLIBRARIESDIR};
+        $variablesToSet{WEBKITOUTPUTDIR} = windowsOutputDir() unless $ENV{WEBKITOUTPUTDIR};
+
+        foreach my $variable (keys %variablesToSet) {
+            print "Setting the Environment Variable '" . $variable . "' to '" . $variablesToSet{$variable} . "'\n\n";
+            system qw(regtool -s set), '\\HKEY_CURRENT_USER\\Environment\\' . $variable, $variablesToSet{$variable};
+            $restartNeeded ||= $variable eq "WEBKITLIBRARIESDIR" || $variable eq "WEBKITOUTPUTDIR";
+        }
+
+        if ($restartNeeded) {
+            print "Please restart your computer before attempting to build inside Visual Studio.\n\n";
+        }
+    } else {
+        if (!$ENV{'WEBKITLIBRARIESDIR'}) {
+            print "Warning: You must set the 'WebKitLibrariesDir' environment variable\n";
+            print "         to be able build WebKit from within Visual Studio.\n";
+            print "         Make sure that 'WebKitLibrariesDir' points to the\n";
+            print "         'WebKitLibraries/win' directory, not the 'WebKitLibraries/' directory.\n\n";
+        }
+        if (!$ENV{'WEBKITOUTPUTDIR'}) {
+            print "Warning: You must set the 'WebKitOutputDir' environment variable\n";
+            print "         to be able build WebKit from within Visual Studio.\n\n";
+        }
+    }
+}
+
 sub setupCygwinEnv()
 {
     return if !isCygwin();
@@ -1119,9 +1199,6 @@ sub buildVisualStudioProject
     }
 
     my $useenv = "/useenv";
-    if (isChromium()) {
-        $useenv = "";
-    }
 
     my @command = ($vcBuildPath, $useenv, $winProjectPath, $action, $config);
 
@@ -1393,6 +1470,46 @@ sub buildGtkProject($$@)
     return buildAutotoolsProject($clean, @buildArgs);
 }
 
+sub buildChromiumMakefile($$$)
+{
+    my ($dir, $target, $clean) = @_;
+    chdir $dir;
+    if ($clean) {
+        return system qw(rm -rf out);
+    }
+    my $config = configuration();
+    my @command = ("make", "-j4", "BUILDTYPE=$config", $target);
+    print join(" ", @command) . "\n";
+    return system @command;
+}
+
+sub buildChromiumVisualStudioProject($$)
+{
+    my ($projectPath, $clean) = @_;
+
+    my $config = configuration();
+    my $action = "/build";
+    $action = "/clean" if $clean;
+
+    # Find Visual Studio installation.
+    my $vsInstallDir;
+    my $programFilesPath = $ENV{'PROGRAMFILES'} || "C:\\Program Files";
+    if ($ENV{'VSINSTALLDIR'}) {
+        $vsInstallDir = $ENV{'VSINSTALLDIR'};
+    } else {
+        $vsInstallDir = "$programFilesPath/Microsoft Visual Studio 8";
+    }
+    $vsInstallDir = `cygpath "$vsInstallDir"` if isCygwin();
+    chomp $vsInstallDir;
+    $vcBuildPath = "$vsInstallDir/Common7/IDE/devenv.com";
+
+    # Create command line and execute it.
+    my @command = ($vcBuildPath, $projectPath, $action, $config);
+    print "Building results into: ", baseProductDir(), "\n";
+    print join(" ", @command), "\n";
+    return system @command;
+}
+
 sub buildChromium($@)
 {
     my ($clean, @options) = @_;
@@ -1400,30 +1517,38 @@ sub buildChromium($@)
     my $result = 1;
     if (isDarwin()) {
         # Mac build - builds the root xcode project.
-        $result = buildXCodeProject("WebKit/chromium/webkit",
-                                    $clean,
-                                    (@options));
-    } elsif (isCygwin()) {
+        $result = buildXCodeProject("WebKit/chromium/WebKit", $clean, (@options));
+    } elsif (isCygwin() || isWindows()) {
         # Windows build - builds the root visual studio solution.
-        $result = buildVisualStudioProject("WebKit/chromium/webkit.sln",
-                                           $clean);
+        $result = buildChromiumVisualStudioProject("WebKit/chromium/WebKit.sln", $clean);
     } elsif (isLinux()) {
-        # Linux build
-        # FIXME support linux.
-        print STDERR "Linux build is not supported. Yet.";
+        # Linux build - build using make.
+        $ result = buildChromiumMakefile("WebKit/chromium/", "webkit", $clean);
     } else {
-        print STDERR "This platform is not supported by chromium.";
+        print STDERR "This platform is not supported by chromium.\n";
     }
     return $result;
 }
 
+sub appleApplicationSupportPath
+{
+    open INSTALL_DIR, "</proc/registry/HKEY_LOCAL_MACHINE/SOFTWARE/Apple\ Inc./Apple\ Application\ Support/InstallDir";
+    my $path = <INSTALL_DIR>;
+    $path =~ s/[\r\n\x00].*//;
+    close INSTALL_DIR;
+
+    my $unixPath = `cygpath -u '$path'`;
+    chomp $unixPath;
+    return $unixPath;
+}
+
 sub setPathForRunningWebKitApp
 {
     my ($env) = @_;
 
     return unless isAppleWinWebKit();
 
-    $env->{PATH} = join(':', productDir(), dirname(installedSafariPath()), $env->{PATH} || "");
+    $env->{PATH} = join(':', productDir(), dirname(installedSafariPath()), appleApplicationSupportPath(), $env->{PATH} || "");
 }
 
 sub exitStatus($)
diff --git a/WebKitTools/pywebsocket/example/echo_client.py b/WebKitTools/pywebsocket/example/echo_client.py
index 61b129c..3262a6d 100644
--- a/WebKitTools/pywebsocket/example/echo_client.py
+++ b/WebKitTools/pywebsocket/example/echo_client.py
@@ -46,6 +46,8 @@ import socket
 import sys
 
 
+_TIMEOUT_SEC = 10
+
 _DEFAULT_PORT = 80
 _DEFAULT_SECURE_PORT = 443
 _UNDEFINED_PORT = -1
@@ -57,6 +59,8 @@ _EXPECTED_RESPONSE = (
         _UPGRADE_HEADER +
         _CONNECTION_HEADER)
 
+_GOODBYE_MESSAGE = 'Goodbye'
+
 
 def _method_line(resource):
     return 'GET %s HTTP/1.1\r\n' % resource
@@ -96,13 +100,14 @@ class EchoClient(object):
         Shake hands and then repeat sending message and receiving its echo.
         """
         self._socket = socket.socket()
+        self._socket.settimeout(self._options.socket_timeout)
         try:
             self._socket.connect((self._options.server_host,
                                   self._options.server_port))
             if self._options.use_tls:
                 self._socket = _TLSSocket(self._socket)
             self._handshake()
-            for line in self._options.message.split(','):
+            for line in self._options.message.split(',') + [_GOODBYE_MESSAGE]:
                 frame = '\x00' + line.encode('utf-8') + '\xff'
                 self._socket.send(frame)
                 if self._options.verbose:
@@ -111,7 +116,8 @@ class EchoClient(object):
                 if received != frame:
                     raise Exception('Incorrect echo: %r' % received)
                 if self._options.verbose:
-                    print 'Recv: %s' % received[1:-1].decode('utf-8')
+                    print 'Recv: %s' % received[1:-1].decode('utf-8',
+                                                             'replace')
         finally:
             self._socket.close()
 
@@ -166,11 +172,17 @@ def main():
     parser.add_option('-r', '--resource', dest='resource', type='string',
                       default='/echo', help='resource path')
     parser.add_option('-m', '--message', dest='message', type='string',
-                      help='comma-separated messages to send')
+                      help=('comma-separated messages to send excluding "%s" '
+                            'that is always sent at the end' %
+                            _GOODBYE_MESSAGE))
     parser.add_option('-q', '--quiet', dest='verbose', action='store_false',
                       default=True, help='suppress messages')
     parser.add_option('-t', '--tls', dest='use_tls', action='store_true',
                       default=False, help='use TLS (wss://)')
+    parser.add_option('-k', '--socket_timeout', dest='socket_timeout',
+                      type='int', default=_TIMEOUT_SEC,
+                      help='Timeout(sec) for sockets')
+
     (options, unused_args) = parser.parse_args()
 
     # Default port number depends on whether TLS is used.
diff --git a/WebKitTools/pywebsocket/example/echo_wsh.py b/WebKitTools/pywebsocket/example/echo_wsh.py
index f680fa5..50cad31 100644
--- a/WebKitTools/pywebsocket/example/echo_wsh.py
+++ b/WebKitTools/pywebsocket/example/echo_wsh.py
@@ -31,6 +31,9 @@
 from mod_pywebsocket import msgutil
 
 
+_GOODBYE_MESSAGE = 'Goodbye'
+
+
 def web_socket_do_extra_handshake(request):
     pass  # Always accept.
 
@@ -39,6 +42,8 @@ def web_socket_transfer_data(request):
     while True:
         line = msgutil.receive_message(request)
         msgutil.send_message(request, line)
+        if line == _GOODBYE_MESSAGE:
+            return
 
 
 # vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/__init__.py b/WebKitTools/pywebsocket/mod_pywebsocket/__init__.py
index beacc9e..05e80e8 100644
--- a/WebKitTools/pywebsocket/mod_pywebsocket/__init__.py
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/__init__.py
@@ -96,6 +96,9 @@ web_socket_transfer_data is called after the handshake completed
 successfully. A handler can receive/send messages from/to the client
 using request. mod_pywebsocket.msgutil module provides utilities
 for data transfer.
+
+A Web Socket handler must be thread-safe if the server (Apache or
+standalone.py) is configured to use threads.
 """
 
 
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/dispatch.py b/WebKitTools/pywebsocket/mod_pywebsocket/dispatch.py
index 84422eb..bf9a856 100644
--- a/WebKitTools/pywebsocket/mod_pywebsocket/dispatch.py
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/dispatch.py
@@ -62,7 +62,7 @@ def _normalize_path(path):
     """
 
     path = path.replace('\\', os.path.sep)
-    path = os.path.abspath(path)
+    path = os.path.realpath(path)
     path = path.replace('\\', '/')
     return path
 
@@ -136,7 +136,8 @@ class Dispatcher(object):
         self._source_warnings = []
         if scan_dir is None:
             scan_dir = root_dir
-        if not os.path.abspath(scan_dir).startswith(os.path.abspath(root_dir)):
+        if not os.path.realpath(scan_dir).startswith(
+                os.path.realpath(root_dir)):
             raise DispatchError('scan_dir:%s must be a directory under '
                                 'root_dir:%s.' % (scan_dir, root_dir))
         self._source_files_in_dir(root_dir, scan_dir)
@@ -159,9 +160,13 @@ class Dispatcher(object):
         do_extra_handshake_, unused_transfer_data = self._handler(request)
         try:
             do_extra_handshake_(request)
-        except Exception:
-            raise DispatchError('%s raised exception: %s' %
-                    (_DO_EXTRA_HANDSHAKE_HANDLER_NAME, util.get_stack_trace()))
+        except Exception, e:
+            util.prepend_message_to_exception(
+                    '%s raised exception for %s: ' % (
+                            _DO_EXTRA_HANDSHAKE_HANDLER_NAME,
+                            request.ws_resource),
+                    e)
+            raise
 
     def transfer_data(self, request):
         """Let a handler transfer_data with a Web Socket client.
@@ -176,19 +181,23 @@ class Dispatcher(object):
         unused_do_extra_handshake, transfer_data_ = self._handler(request)
         try:
             transfer_data_(request)
-        except Exception:
-            raise DispatchError('%s raised exception: %s' %
-                    (_TRANSFER_DATA_HANDLER_NAME, util.get_stack_trace()))
+        except Exception, e:
+            util.prepend_message_to_exception(
+                    '%s raised exception for %s: ' % (
+                            _TRANSFER_DATA_HANDLER_NAME, request.ws_resource),
+                    e)
+            raise
 
     def _handler(self, request):
         try:
-            return self._handlers[request.ws_resource]
+            ws_resource_path = request.ws_resource.split('?', 1)[0]
+            return self._handlers[ws_resource_path]
         except KeyError:
             raise DispatchError('No handler for: %r' % request.ws_resource)
 
     def _source_files_in_dir(self, root_dir, scan_dir):
         """Source all the handler source files in the scan_dir directory.
-        
+
         The resource path is determined relative to root_dir.
         """
 
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/msgutil.py b/WebKitTools/pywebsocket/mod_pywebsocket/msgutil.py
index bdb554d..90ae715 100644
--- a/WebKitTools/pywebsocket/mod_pywebsocket/msgutil.py
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/msgutil.py
@@ -39,6 +39,31 @@ not suitable because they don't allow direct raw bytes writing/reading.
 
 import Queue
 import threading
+import util
+
+
+class MsgUtilException(Exception):
+    pass
+
+
+def _read(request, length):
+    bytes = request.connection.read(length)
+    if not bytes:
+        raise MsgUtilException(
+                'Failed to receive message from %r' %
+                        (request.connection.remote_addr,))
+    return bytes
+
+
+def _write(request, bytes):
+    try:
+        request.connection.write(bytes)
+    except Exception, e:
+        util.prepend_message_to_exception(
+                'Failed to send message to %r: ' %
+                        (request.connection.remote_addr,),
+                e)
+        raise
 
 
 def send_message(request, message):
@@ -49,7 +74,7 @@ def send_message(request, message):
         message: unicode string to send.
     """
 
-    request.connection.write('\x00' + message.encode('utf-8') + '\xff')
+    _write(request, '\x00' + message.encode('utf-8') + '\xff')
 
 
 def receive_message(request):
@@ -63,7 +88,7 @@ def receive_message(request):
         # Read 1 byte.
         # mp_conn.read will block if no bytes are available.
         # Timeout is controlled by TimeOut directive of Apache.
-        frame_type_str = request.connection.read(1)
+        frame_type_str = _read(request, 1)
         frame_type = ord(frame_type_str[0])
         if (frame_type & 0x80) == 0x80:
             # The payload length is specified in the frame.
@@ -73,7 +98,9 @@ def receive_message(request):
         else:
             # The payload is delimited with \xff.
             bytes = _read_until(request, '\xff')
-            message = bytes.decode('utf-8')
+            # The Web Socket protocol section 4.4 specifies that invalid
+            # characters must be replaced with U+fffd REPLACEMENT CHARACTER.
+            message = bytes.decode('utf-8', 'replace')
             if frame_type == 0x00:
                 return message
             # Discard data of other types.
@@ -82,7 +109,7 @@ def receive_message(request):
 def _payload_length(request):
     length = 0
     while True:
-        b_str = request.connection.read(1)
+        b_str = _read(request, 1)
         b = ord(b_str[0])
         length = length * 128 + (b & 0x7f)
         if (b & 0x80) == 0:
@@ -93,7 +120,7 @@ def _payload_length(request):
 def _receive_bytes(request, length):
     bytes = []
     while length > 0:
-        new_bytes = request.connection.read(length)
+        new_bytes = _read(request, length)
         bytes.append(new_bytes)
         length -= len(new_bytes)
     return ''.join(bytes)
@@ -102,7 +129,7 @@ def _receive_bytes(request, length):
 def _read_until(request, delim_char):
     bytes = []
     while True:
-        ch = request.connection.read(1)
+        ch = _read(request, 1)
         if ch == delim_char:
             break
         bytes.append(ch)
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/standalone.py b/WebKitTools/pywebsocket/mod_pywebsocket/standalone.py
index a4c142b..6217585 100644
--- a/WebKitTools/pywebsocket/mod_pywebsocket/standalone.py
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/standalone.py
@@ -38,6 +38,7 @@ Usage:
     python standalone.py [-p <ws_port>] [-w <websock_handlers>]
                          [-s <scan_dir>]
                          [-d <document_root>]
+                         ... for other options, see _main below ...
 
 <ws_port> is the port number to use for ws:// connection.
 
@@ -59,6 +60,7 @@ import BaseHTTPServer
 import SimpleHTTPServer
 import SocketServer
 import logging
+import logging.handlers
 import optparse
 import os
 import socket
@@ -73,6 +75,25 @@ except ImportError:
 
 import dispatch
 import handshake
+import util
+
+
+_LOG_LEVELS = {
+    'debug': logging.DEBUG,
+    'info': logging.INFO,
+    'warn': logging.WARN,
+    'error': logging.ERROR,
+    'critical': logging.CRITICAL};
+
+_DEFAULT_LOG_MAX_BYTES = 1024 * 256
+_DEFAULT_LOG_BACKUP_COUNT = 5
+
+
+def _print_warnings_if_any(dispatcher):
+    warnings = dispatcher.source_warnings()
+    if warnings:
+        for warning in warnings:
+            logging.warning('mod_pywebsocket: %s' % warning)
 
 
 class _StandaloneConnection(object):
@@ -92,6 +113,14 @@ class _StandaloneConnection(object):
                 self._request_handler.server.server_port)
     local_addr = property(get_local_addr)
 
+    def get_remote_addr(self):
+        """Getter to mimic mp_conn.remote_addr.
+
+        Setting the property in __init__ won't work because the request
+        handler is not initialized yet there."""
+        return self._request_handler.client_address
+    remote_addr = property(get_remote_addr)
+
     def write(self, data):
         """Mimic mp_conn.write()."""
         return self._request_handler.wfile.write(data)
@@ -152,6 +181,16 @@ class WebSocketServer(SocketServer.ThreadingMixIn, BaseHTTPServer.HTTPServer):
             socket_ = OpenSSL.SSL.Connection(ctx, socket_)
         return socket_
 
+    def handle_error(self, rquest, client_address):
+        """Override SocketServer.handle_error."""
+
+        logging.error(
+            ('Exception in processing request from: %r' % (client_address,)) +
+            '\n' + util.get_stack_trace())
+        # Note: client_address is a tuple. To match it against %r, we need the
+        # trailing comma.
+
+
 class WebSocketRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
     """SimpleHTTPRequestHandler specialized for Web Socket."""
 
@@ -159,15 +198,13 @@ class WebSocketRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
         """Override SocketServer.StreamRequestHandler.setup."""
 
         self.connection = self.request
-        self.rfile = socket._fileobject(self.request, "rb", self.rbufsize)
-        self.wfile = socket._fileobject(self.request, "wb", self.wbufsize)
+        self.rfile = socket._fileobject(self.request, 'rb', self.rbufsize)
+        self.wfile = socket._fileobject(self.request, 'wb', self.wbufsize)
 
     def __init__(self, *args, **keywords):
         self._request = _StandaloneRequest(
                 self, WebSocketRequestHandler.options.use_tls)
-        self._dispatcher = dispatch.Dispatcher(
-                WebSocketRequestHandler.options.websock_handlers,
-                WebSocketRequestHandler.options.scan_dir)
+        self._dispatcher = WebSocketRequestHandler.options.dispatcher
         self._print_warnings_if_any()
         self._handshaker = handshake.Handshaker(self._request,
                                                 self._dispatcher)
@@ -198,12 +235,41 @@ class WebSocketRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
             except dispatch.DispatchError, e:
                 logging.warning('mod_pywebsocket: %s' % e)
                 return False
+            except Exception, e:
+                logging.warning('mod_pywebsocket: %s' % e)
+                logging.info('mod_pywebsocket: %s' % util.get_stack_trace())
+                return False
         return result
 
+    def log_request(self, code='-', size='-'):
+        """Override BaseHTTPServer.log_request."""
 
-def _main():
-    logging.basicConfig()
+        logging.info('"%s" %s %s',
+                     self.requestline, str(code), str(size))
 
+    def log_error(self, *args):
+        """Override BaseHTTPServer.log_error."""
+
+        # Despite the name, this method is for warnings than for errors.
+        # For example, HTTP status code is logged by this method.
+        logging.warn('%s - %s' % (self.address_string(), (args[0] % args[1:])))
+
+
+def _configure_logging(options):
+    logger = logging.getLogger()
+    logger.setLevel(_LOG_LEVELS[options.log_level])
+    if options.log_file:
+        handler = logging.handlers.RotatingFileHandler(
+                options.log_file, 'a', options.log_max, options.log_count)
+    else:
+        handler = logging.StreamHandler()
+    formatter = logging.Formatter(
+            "[%(asctime)s] [%(levelname)s] %(name)s: %(message)s")
+    handler.setFormatter(formatter)
+    logger.addHandler(handler)
+
+
+def _main():
     parser = optparse.OptionParser()
     parser.add_option('-p', '--port', dest='port', type='int',
                       default=handshake._DEFAULT_WEB_SOCKET_PORT,
@@ -224,27 +290,51 @@ def _main():
                       default='', help='TLS private key file.')
     parser.add_option('-c', '--certificate', dest='certificate',
                       default='', help='TLS certificate file.')
+    parser.add_option('-l', '--log_file', dest='log_file',
+                      default='', help='Log file.')
+    parser.add_option('--log_level', type='choice', dest='log_level',
+                      default='warn',
+                      choices=['debug', 'info', 'warn', 'error', 'critical'],
+                      help='Log level.')
+    parser.add_option('--log_max', dest='log_max', type='int',
+                      default=_DEFAULT_LOG_MAX_BYTES,
+                      help='Log maximum bytes')
+    parser.add_option('--log_count', dest='log_count', type='int',
+                      default=_DEFAULT_LOG_BACKUP_COUNT,
+                      help='Log backup count')
     options = parser.parse_args()[0]
 
+    os.chdir(options.document_root)
+
+    _configure_logging(options)
+
     if options.use_tls:
         if not _HAS_OPEN_SSL:
-            print >>sys.stderr, 'To use TLS, install pyOpenSSL.'
+            logging.critical('To use TLS, install pyOpenSSL.')
             sys.exit(1)
         if not options.private_key or not options.certificate:
-            print >>sys.stderr, ('To use TLS, specify private_key and '
-                                 'certificate.')
+            logging.critical(
+                    'To use TLS, specify private_key and certificate.')
             sys.exit(1)
 
     if not options.scan_dir:
         options.scan_dir = options.websock_handlers
 
-    WebSocketRequestHandler.options = options
-    WebSocketServer.options = options
-
-    os.chdir(options.document_root)
-
-    server = WebSocketServer(('', options.port), WebSocketRequestHandler)
-    server.serve_forever()
+    try:
+        # Share a Dispatcher among request handlers to save time for
+        # instantiation.  Dispatcher can be shared because it is thread-safe.
+        options.dispatcher = dispatch.Dispatcher(options.websock_handlers,
+                                                 options.scan_dir)
+        _print_warnings_if_any(options.dispatcher)
+
+        WebSocketRequestHandler.options = options
+        WebSocketServer.options = options
+
+        server = WebSocketServer(('', options.port), WebSocketRequestHandler)
+        server.serve_forever()
+    except Exception, e:
+        logging.critical(str(e))
+        sys.exit(1)
 
 
 if __name__ == '__main__':
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/util.py b/WebKitTools/pywebsocket/mod_pywebsocket/util.py
index 4835298..0ea8053 100644
--- a/WebKitTools/pywebsocket/mod_pywebsocket/util.py
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/util.py
@@ -49,4 +49,11 @@ def get_stack_trace():
     return out.getvalue()
 
 
+def prepend_message_to_exception(message, exc):
+    """Prepend message to the exception."""
+
+    exc.args = (message + str(exc),)
+    return
+
+
 # vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/setup.py b/WebKitTools/pywebsocket/setup.py
index 1810a6d..df05fef 100644
--- a/WebKitTools/pywebsocket/setup.py
+++ b/WebKitTools/pywebsocket/setup.py
@@ -56,7 +56,7 @@ setup(author='Yuzo Fujishima',
       name=_PACKAGE_NAME,
       packages=[_PACKAGE_NAME],
       url='http://code.google.com/p/pywebsocket/',
-      version='0.4.1',
+      version='0.4.3',
       )
 
 
diff --git a/WebKitTools/pywebsocket/test/test_dispatch.py b/WebKitTools/pywebsocket/test/test_dispatch.py
index d617205..b19d706 100644
--- a/WebKitTools/pywebsocket/test/test_dispatch.py
+++ b/WebKitTools/pywebsocket/test/test_dispatch.py
@@ -136,8 +136,7 @@ class DispatcherTest(unittest.TestCase):
         dispatcher.do_extra_handshake(request)  # Must not raise exception.
 
         request.ws_origin = 'http://bad.example.com'
-        self.assertRaises(dispatch.DispatchError,
-                          dispatcher.do_extra_handshake, request)
+        self.assertRaises(Exception, dispatcher.do_extra_handshake, request)
 
     def test_transfer_data(self):
         dispatcher = dispatch.Dispatcher(_TEST_HANDLERS_DIR, None)
@@ -156,6 +155,20 @@ class DispatcherTest(unittest.TestCase):
         self.assertEqual('sub/plain_wsh.py is called for /sub/plain, None',
                          request.connection.written_data())
 
+        request = mock.MockRequest(connection=mock.MockConn(''))
+        request.ws_resource = '/sub/plain?'
+        request.ws_protocol = None
+        dispatcher.transfer_data(request)
+        self.assertEqual('sub/plain_wsh.py is called for /sub/plain?, None',
+                         request.connection.written_data())
+
+        request = mock.MockRequest(connection=mock.MockConn(''))
+        request.ws_resource = '/sub/plain?q=v'
+        request.ws_protocol = None
+        dispatcher.transfer_data(request)
+        self.assertEqual('sub/plain_wsh.py is called for /sub/plain?q=v, None',
+                         request.connection.written_data())
+
     def test_transfer_data_no_handler(self):
         dispatcher = dispatch.Dispatcher(_TEST_HANDLERS_DIR, None)
         for resource in ['/blank', '/sub/non_callable',
@@ -179,10 +192,8 @@ class DispatcherTest(unittest.TestCase):
         try:
             dispatcher.transfer_data(request)
             self.fail()
-        except dispatch.DispatchError, e:
+        except Exception, e:
             self.failUnless(str(e).find('Intentional') != -1)
-        except Exception:
-            self.fail()
 
     def test_scan_dir(self):
         disp = dispatch.Dispatcher(_TEST_HANDLERS_DIR, None)
diff --git a/WebKitTools/pywebsocket/test/test_msgutil.py b/WebKitTools/pywebsocket/test/test_msgutil.py
index b3ba539..16b88e0 100644
--- a/WebKitTools/pywebsocket/test/test_msgutil.py
+++ b/WebKitTools/pywebsocket/test/test_msgutil.py
@@ -71,6 +71,13 @@ class MessageTest(unittest.TestCase):
         # U+672c is encoded as e6,9c,ac in UTF-8
         self.assertEqual(u'\u672c', msgutil.receive_message(request))
 
+    def test_receive_message_erroneous_unicode(self):
+        # \x80 and \x81 are invalid as UTF-8.
+        request = _create_request('\x00\x80\x81\xff')
+        # Invalid characters should be replaced with
+        # U+fffd REPLACEMENT CHARACTER
+        self.assertEqual(u'\ufffd\ufffd', msgutil.receive_message(request))
+
     def test_receive_message_discard(self):
         request = _create_request('\x80\x06IGNORE\x00Hello\xff'
                                 '\x01DISREGARD\xff\x00World!\xff')
diff --git a/WebKitTools/pywebsocket/test/test_util.py b/WebKitTools/pywebsocket/test/test_util.py
index 8058b6d..83e2635 100644
--- a/WebKitTools/pywebsocket/test/test_util.py
+++ b/WebKitTools/pywebsocket/test/test_util.py
@@ -49,6 +49,12 @@ class UtilTest(unittest.TestCase):
             self.failUnless(trace.startswith('Traceback'))
             self.failUnless(trace.find('ZeroDivisionError') != -1)
 
+    def test_prepend_message_to_exception(self):
+        exc = Exception('World')
+        self.assertEqual('World', str(exc))
+        util.prepend_message_to_exception('Hello ', exc)
+        self.assertEqual('Hello World', str(exc))
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/wx/browser/wscript b/WebKitTools/wx/browser/wscript
index d5246c1..a2a24e0 100644
--- a/WebKitTools/wx/browser/wscript
+++ b/WebKitTools/wx/browser/wscript
@@ -45,7 +45,7 @@ def build(bld):
         includes = ' '.join(include_paths),
         source = 'browser.cpp',
         target = 'wxBrowser',
-        uselib = 'WXWEBKIT WX ' + get_config(),
+        uselib = 'WX CURL ICU XSLT XML WXWEBKIT ' + get_config(),
         libpath = [output_dir],
         uselib_local = '',
         install_path = output_dir)
diff --git a/WebKitTools/wx/build/build_utils.py b/WebKitTools/wx/build/build_utils.py
index b767d9f..a6962e2 100644
--- a/WebKitTools/wx/build/build_utils.py
+++ b/WebKitTools/wx/build/build_utils.py
@@ -176,7 +176,7 @@ def get_config(wk_root):
     return config
 
 def svn_revision():
-    if os.system("git info") == 0:
+    if os.system("git-svn info") == 0:
         info = commands.getoutput("git-svn info ../..")
     else:
         info = commands.getoutput("svn info")
diff --git a/WebKitTools/wx/build/settings.py b/WebKitTools/wx/build/settings.py
index 652a880..f7f75b6 100644
--- a/WebKitTools/wx/build/settings.py
+++ b/WebKitTools/wx/build/settings.py
@@ -337,7 +337,7 @@ def common_configure(conf):
         # common win libs
         conf.env.append_value('LIB', [
             'kernel32', 'user32','gdi32','comdlg32','winspool','winmm',
-            'shell32', 'comctl32', 'ole32', 'oleaut32', 'uuid', 'advapi32', 
+            'shell32', 'shlwapi', 'comctl32', 'ole32', 'oleaut32', 'uuid', 'advapi32', 
             'wsock32', 'gdiplus', 'version'])
 
         conf.env['LIB_ICU'] = ['icudt', 'icule', 'iculx', 'icuuc', 'icuin', 'icuio', 'icutu']
diff --git a/WebKitTools/wx/packaging/build-debian-installer.py b/WebKitTools/wx/packaging/build-debian-installer.py
new file mode 100644
index 0000000..5c6795d
--- /dev/null
+++ b/WebKitTools/wx/packaging/build-debian-installer.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python
+
+import os
+import shutil
+import sys
+
+sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "build")))
+
+import build_utils
+
+script_dir = os.path.abspath(os.path.dirname(__file__))
+wxwebkit_dir = os.path.abspath(os.path.join(script_dir, "..", "..", "..", "WebKitBuild", "Debug" + build_utils.git_branch_name()))
+wxwk_root = os.path.abspath(os.path.join(script_dir, "..", "..", ".."))
+
+try:
+    os.chdir(wxwk_root)
+    deb_dir = os.path.join(wxwk_root, 'wxwebkit')
+    if os.path.exists(deb_dir):
+        shutil.rmtree(deb_dir)
+    os.makedirs(deb_dir)
+    print "Archiving git tree..."
+    os.system('git archive --format=tar HEAD | gzip > %s/webkitwx_0.1.orig.tar.gz' % deb_dir)
+    src_root = os.path.join(deb_dir, 'webkitwx-0.1')
+    print "Extracting tree..."    
+    os.makedirs(src_root)
+    os.chdir(src_root)
+    os.system('tar xzvf ../webkitwx_0.1.orig.tar.gz')
+
+    shutil.copytree(os.path.join(script_dir, 'debian'), os.path.join(src_root, 'debian'))
+
+    print "Building package..."
+    os.system('fakeroot debian/rules clean')
+    os.system('fakeroot debian/rules build')
+    os.system('debuild -i -rfakeroot -us -uc')
+finally:
+    shutil.rmtree(os.path.join(src_root, 'debian'))
diff --git a/WebKitTools/wx/packaging/debian/changelog b/WebKitTools/wx/packaging/debian/changelog
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/WebKitTools/wx/packaging/debian/changelog
@@ -0,0 +1 @@
+
diff --git a/WebKitTools/wx/packaging/debian/compat b/WebKitTools/wx/packaging/debian/compat
new file mode 100644
index 0000000..7ed6ff8
--- /dev/null
+++ b/WebKitTools/wx/packaging/debian/compat
@@ -0,0 +1 @@
+5
diff --git a/WebKitTools/wx/packaging/debian/control b/WebKitTools/wx/packaging/debian/control
new file mode 100644
index 0000000..57d8407
--- /dev/null
+++ b/WebKitTools/wx/packaging/debian/control
@@ -0,0 +1,29 @@
+Source: webkitwx
+Section: Python
+Priority: extra
+Maintainer: Kevin Ollivier <kevino@theolliviers.com>
+Build-Depends: debhelper (>= 5.0.38), python-central (>= 0.6), python-all-dev,
+ libwxgtk2.8-dev (>= 2.8.9.2-1), python-wxgtk2.8, python-wxtools (>= 2.8.9.2-1),
+ wx2.8-headers (>= 2.8.9.2-1), wx2.8-i18n (>= 2.8.9.2-1),
+ flex, bison, gperf, automake, autoconf, libtool, dpatch,
+ libxslt1-dev, libcurl4-openssl-dev,
+ libicu-dev, libjpeg62-dev, libpng12-dev, libsqlite3-dev, libgtk2.0-dev
+Build-Conflicts: python-setuptools
+XS-Python-Version: all
+Standards-Version: 3.7.3
+
+Package: python-webkitwx
+Section: python
+Architecture: any
+Depends: ${python:Depends}, ${shlibs:Depends}
+Provides: ${python:Provides}, webkitwx
+XB-Python-Version: ${python:Versions}
+Description: Python binding of wxwebkit
+ This is an experimental packaged release of webkit for wxpython
+
+Package: webkitwx-headers
+Architecture: all
+Description: Python binding of wxwebkit
+ This is an experimental packaged release of webkit for wxpython
+ These are the header files
+
diff --git a/WebKitTools/wx/packaging/debian/copyright b/WebKitTools/wx/packaging/debian/copyright
new file mode 100644
index 0000000..c2244ec
--- /dev/null
+++ b/WebKitTools/wx/packaging/debian/copyright
@@ -0,0 +1,18 @@
+This package was debianized by Chris Willing c.willing@uq.edu.au on
+Thu, Sat, 11 Apr 2009 12:54:52 +1000
+
+Upstream Author: Kevin Ollivier kevino@theolliviers.com and others
+
+Copyright: 2009 Kevin Ollivier, Apple Inc., and others
+
+License:
+	LGPL
+
+
+The Debian packaging is (C) 2009, Chris Willing <c.willing@uq.edu.au> and
+is licensed under the GPL, see `/usr/share/common-licenses/GPL'.
+
+
+# Please also look if there are files or directories which have a
+# different copyright/license attached and list them here.
+
diff --git a/WebKitTools/wx/packaging/debian/python-webkitwx.install b/WebKitTools/wx/packaging/debian/python-webkitwx.install
new file mode 100644
index 0000000..dff51ce
--- /dev/null
+++ b/WebKitTools/wx/packaging/debian/python-webkitwx.install
@@ -0,0 +1 @@
+WebKitBuild/Debug.master/libwxwebkit.so usr/lib/
diff --git a/WebKitTools/wx/packaging/debian/rules b/WebKitTools/wx/packaging/debian/rules
new file mode 100644
index 0000000..6840731
--- /dev/null
+++ b/WebKitTools/wx/packaging/debian/rules
@@ -0,0 +1,75 @@
+#! /usr/bin/make -f
+
+SHELL = /bin/bash
+
+PYVERS     := $(shell /usr/bin/python -c 'import sys; print sys.version[:3]')
+VER     := $(shell /usr/bin/python -c 'import sys; print sys.version[:3]')
+BIULD_DIR := WebKitBuild/Debug.master
+build: build-stamp
+build-stamp: $(PYVERS:%=build-python%)
+	touch $@
+build-python%:
+	touch $@
+
+clean:
+	rm -rf *-stamp build-python* build
+	rm -rf $(addprefix debian/,$(packages)) debian/files debian/substvars
+	rm -rf _trial_temp test.log
+	find . -name "*.pyc" |xargs -r rm
+	dh_clean
+
+install: build-stamp install-prereq $(PYVERS:%=install-python%) install-libs install-nover
+
+install-prereq: build-stamp
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+
+install-python%: install-prereq
+	dh_install -ppython-webkitwx \
+		$(BUILD_DIR)/webview.py \
+		$(BUILD_DIR)/Debug.master/_webview.so \
+			usr/lib/python$*/site-packages/wx-2.8-gtk2-unicode/wx/
+
+install-nover:	install-prereq
+	dh_install -pwebkitwx-headers \
+		$(BUILD_DIR)/JavaScriptCore \
+			usr/include/wxwebkit-1.0/
+
+install-libs:	install-prereq
+	dh_install
+	
+
+binary-indep:
+	(cd WebKitTools/Scripts && ./build-webkit --wx --makeargs="--wxpython")
+	dh_testdir
+	dh_testroot
+	dh_installchangelogs -i
+	dh_installdocs -i
+	dh_strip -i
+	dh_compress -i
+	dh_fixperms -i
+	dh_installdeb -i
+	dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
+
+binary-arch:
+	dh_testdir
+	dh_testroot
+	echo $(shell pwd)
+	echo $(shell ls -l)
+	dh_installchangelogs -a
+	dh_installdocs -a WebKit/wx/bindings/python/samples/simple.py
+	dh_strip -a
+	dh_compress -a -Xsimple.py
+	dh_fixperms -a
+	dh_pycentral -a
+	dh_installdeb -a
+	dh_shlibdeps -a
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+binary: binary-indep binary-arch
+.PHONY: build clean binary-indep binary-arch binary install install-nover install-prereq install-libs
diff --git a/autotools/webkit.m4 b/autotools/webkit.m4
index 14dd0a5..670cec3 100644
--- a/autotools/webkit.m4
+++ b/autotools/webkit.m4
@@ -139,11 +139,7 @@ esac
 
 AC_MSG_RESULT([$with_unicode_backend])
 
-# https://bugs.webkit.org/show_bug.cgi?id=15914
-# Splitting ICU removal patch into smaller portions. We compile a hybrid version
-# with the WTF Unicode backend being based on GLib while text codecs and TextBreakIterator
-# keep the ICU dependency. That's why we temporarily add icu headers and libs for glib config case as well.
-if test "$with_unicode_backend" = "icu" -o "$with_unicode_backend" = "glib"; then
+if test "$with_unicode_backend" = "icu"; then
         case "$host" in
             *-*-darwin*)
 		UNICODE_CFLAGS="-I$srcdir/JavaScriptCore/icu -I$srcdir/WebCore/icu"
@@ -169,14 +165,7 @@ if test "$with_unicode_backend" = "icu" -o "$with_unicode_backend" = "glib"; the
 fi
 
 if test "$with_unicode_backend" = "glib"; then
-	# https://bugs.webkit.org/show_bug.cgi?id=15914
-	# Splitting ICU removal patch into smaller portions, that's why we
-	# temporarily retrieve flags & libs info for glib into UNICODEGLIB
-	# instead of UNICODE variable, then concatenate.
-	# Patch 3/4 of the above issue will rename the variable back to UNICODE.
-	PKG_CHECK_MODULES([UNICODEGLIB], [glib-2.0 pango >= 1.21.0])
-	UNICODE_CFLAGS="$UNICODE_CFLAGS $UNICODEGLIB_CFLAGS"
-	UNICODE_LIBS="$UNICODE_LIBS $UNICODEGLIB_LIBS"
+	PKG_CHECK_MODULES([UNICODE], [glib-2.0 pango >= 1.21.0])
 fi
 
 AC_SUBST([UNICODE_CFLAGS])